diff options
author | Justin M. Forbes <jforbes@redhat.com> | 2017-02-20 13:20:23 -0600 |
---|---|---|
committer | Justin M. Forbes <jforbes@redhat.com> | 2017-02-20 13:20:23 -0600 |
commit | a98ed5ce60a3a27dd83f47a33d8993eaaef3685e (patch) | |
tree | 2390fe67f35cf364436421355cf15e7fab72e294 /kexec-uefi-copy-secure_boot-flag-in-boot-params.patch | |
parent | 7a011b1bac9aea1fdb059ef767f1445c7062b79d (diff) | |
download | kernel-a98ed5ce60a3a27dd83f47a33d8993eaaef3685e.tar.gz kernel-a98ed5ce60a3a27dd83f47a33d8993eaaef3685e.tar.xz kernel-a98ed5ce60a3a27dd83f47a33d8993eaaef3685e.zip |
Linux 4.10 rebase for stabilization
Diffstat (limited to 'kexec-uefi-copy-secure_boot-flag-in-boot-params.patch')
-rw-r--r-- | kexec-uefi-copy-secure_boot-flag-in-boot-params.patch | 30 |
1 files changed, 0 insertions, 30 deletions
diff --git a/kexec-uefi-copy-secure_boot-flag-in-boot-params.patch b/kexec-uefi-copy-secure_boot-flag-in-boot-params.patch deleted file mode 100644 index e239ea908..000000000 --- a/kexec-uefi-copy-secure_boot-flag-in-boot-params.patch +++ /dev/null @@ -1,30 +0,0 @@ -From: Dave Young <dyoung@redhat.com> - -[PATCH] kexec/uefi: copy secure_boot flag in boot params across kexec reboot - -Kexec reboot in case secure boot being enabled does not keep the secure boot -mode in new kernel, so later one can load unsigned kernel via legacy kexec_load. -In this state, the system is missing the protections provided by secure boot. - -Adding a patch to fix this by retain the secure_boot flag in original kernel. - -secure_boot flag in boot_params is set in EFI stub, but kexec bypasses the stub. -Fixing this issue by copying secure_boot flag across kexec reboot. - -Signed-off-by: Dave Young <dyoung@redhat.com> ---- - arch/x86/kernel/kexec-bzimage64.c | 1 + - 1 file changed, 1 insertion(+) - -diff --git a/arch/x86/kernel/kexec-bzimage64.c b/arch/x86/kernel/kexec-bzimage64.c -index 9642b9b..0539ec7 100644 ---- a/arch/x86/kernel/kexec-bzimage64.c -+++ b/arch/x86/kernel/kexec-bzimage64.c -@@ -178,6 +178,7 @@ setup_efi_state(struct boot_params *params, unsigned long params_load_addr, - if (efi_enabled(EFI_OLD_MEMMAP)) - return 0; - -+ params->secure_boot = boot_params.secure_boot; - ei->efi_loader_signature = current_ei->efi_loader_signature; - ei->efi_systab = current_ei->efi_systab; - ei->efi_systab_hi = current_ei->efi_systab_hi; |