• John S. Gruber's avatar
    x86/boot: Preserve boot_params.secure_boot from sanitizing · 29d9a0b5
    John S. Gruber authored
    Commit
    
      a90118c4 ("x86/boot: Save fields explicitly, zero out everything else")
    
    now zeroes the secure boot setting information (enabled/disabled/...)
    passed by the boot loader or by the kernel's EFI handover mechanism.
    
    The problem manifests itself with signed kernels using the EFI handoff
    protocol with grub and the kernel loses the information whether secure
    boot is enabled in the firmware, i.e., the log message "Secure boot
    enabled" becomes "Secure boot could not be determined".
    
    efi_main() arch/x86/boot/compressed/eboot.c sets this field early but it
    is subsequently zeroed by the above referenced commit.
    
    Include boot_params.secure_boot in the preserve field list.
    
     [ bp: restructure commit message and massage. ]
    
    Fixes: a90118c4 ("x86/boot: Save fields explicitly, zero out everything else")
    Signed-off-by: default avatarJohn S. Gruber <JohnSGruber@gmail.com>
    Signed-off-by: default avatarBorislav Petkov <bp@suse.de>
    Reviewed-by: default avatarJohn Hubbard <jhubbard@nvidia.com>
    Cc: "H. Peter Anvin" <hpa@zytor.com>
    Cc: Ingo Molnar <mingo@redhat.com>
    Cc: Juergen Gross <jgross@suse.com>
    Cc: Mark Brown <broonie@kernel.org>
    Cc: stable <stable@vger.kernel.org>
    Cc: Thomas Gleixner <tglx@linutronix.de>
    Cc: x86-ml <x86@kernel.org>
    Link: https://lkml.kernel.org/r/CAPotdmSPExAuQcy9iAHqX3js_fc4mMLQOTr5RBGvizyCOPcTQQ@mail.gmail.com
    29d9a0b5
bootparam_utils.h 2.8 KB