diff options
| author | Dave Young <[email protected]> | 2019-08-19 17:17:43 -0700 |
|---|---|---|
| committer | James Morris <[email protected]> | 2019-08-19 21:54:15 -0700 |
| commit | fef5dad9876034253d59acbf8c0c314f4d94cf87 (patch) | |
| tree | 1f17869cc8b60692044de992bb20644e3d7c2e21 /drivers/gpu/drm/amd/amdgpu/amdgpu_ucode.c | |
| parent | 7d31f4602f8d366072471ca138e4ea7b8edf9be0 (diff) | |
lockdown: Copy secure_boot flag in boot params across kexec reboot
Kexec reboot in case secure boot being enabled does not keep the secure
boot mode in new kernel, so later one can load unsigned kernel via legacy
kexec_load. In this state, the system is missing the protections provided
by secure boot.
Adding a patch to fix this by retain the secure_boot flag in original
kernel.
secure_boot flag in boot_params is set in EFI stub, but kexec bypasses the
stub. Fixing this issue by copying secure_boot flag across kexec reboot.
Signed-off-by: Dave Young <[email protected]>
Signed-off-by: David Howells <[email protected]>
Signed-off-by: Matthew Garrett <[email protected]>
Reviewed-by: Kees Cook <[email protected]>
cc: [email protected]
Signed-off-by: James Morris <[email protected]>
Diffstat (limited to 'drivers/gpu/drm/amd/amdgpu/amdgpu_ucode.c')
0 files changed, 0 insertions, 0 deletions