On Fri, Aug 30, 2013 at 01:46:30PM -0700, H. Peter Anvin wrote:
> On 08/29/2013 11:37 AM, Josh Boyer wrote:
> >> setup_efi_pci(boot_params);
> >> diff --git a/arch/x86/include/uapi/asm/bootparam.h b/arch/x86/include/uapi/asm/bootparam.h
> >> index c15ddaf..d35da96 100644
> >> --- a/arch/x86/include/uapi/asm/bootparam.h
> >> +++ b/arch/x86/include/uapi/asm/bootparam.h
> >> @@ -131,7 +131,8 @@ struct boot_params {
> >> __u8 eddbuf_entries; /* 0x1e9 */
> >> __u8 edd_mbr_sig_buf_entries; /* 0x1ea */
> >> __u8 kbd_status; /* 0x1eb */
> >> - __u8 _pad5[3]; /* 0x1ec */
> >> + __u8 secure_boot; /* 0x1ec */
> >> + __u8 _pad5[2]; /* 0x1ec */
> >> /*
> >> * The sentinel is set to a nonzero value (0xff) in header.S.
> >> *
> >
> > You need to include the following chunk of code with this, otherwise the
> > secure_boot variable gets cleared.
> >
>
> Not really.
>
> There are three cases:
>
> 1. Boot stub only. Here we do the right thing with the bootparams.
> 2. Boot loader bypasses the boot stub completely. Here we MUST NOT do
> what you suggest above.
> 3. Boot stub with a boot_params structure passed in. Here we should
> run sanitize_boot_params() (an inline for a reason) in the boot
> stub, before we set the secure_boot field. Once that is done, we
> again don't need that modification.
OK. If 3 works, then great. All I know is that Fedora has been
carrying the above hunk for months and it was missing in this patch set.
So when I went to test it, the patches didn't do anything because the
secure_boot field was getting cleared.
I'm more than happy to try option 3, and I'll poke at it next week
unless someone beats me to it.
josh
--
To unsubscribe from this list: send the line "unsubscribe linux-efi" in
the body of a message to majordomo@xxxxxxxxxxxxxxx
More majordomo info at http://vger.kernel.org/majordomo-info.html
