6dd2d79d97
- edk2-Revert-OvmfPkg-X86QemuLoadImageLib-flip-default-for-.patch [RHEL-182419] - edk2-Bumped-to-OpenSSL-3.5.5-3.patch [RHEL-165726] - Resolves: RHEL-182419 (edk2/x64: re-enable legacy kernel loader) - Resolves: RHEL-165726 (CVE-2026-28390 edk2: OpenSSL: Denial of Service due to NULL pointer dereference in CMS EnvelopedData processing [rhel-10.3])
72 lines
2.7 KiB
Diff
72 lines
2.7 KiB
Diff
From b89fdcc3378033dd9836d10f74e8541b72fbda63 Mon Sep 17 00:00:00 2001
|
|
From: Gerd Hoffmann <kraxel@redhat.com>
|
|
Date: Fri, 5 Jun 2026 11:30:09 +0200
|
|
Subject: [PATCH 1/2] Revert "OvmfPkg/X86QemuLoadImageLib: flip default for
|
|
EnableLegacyLoader to false"
|
|
|
|
RH-Author: Gerd Hoffmann <kraxel@redhat.com>
|
|
RH-MergeRequest: 111: Revert "OvmfPkg/X86QemuLoadImageLib: flip default for EnableLegacyLoader to false"
|
|
RH-Jira: RHEL-182419
|
|
RH-Acked-by: Luigi Leonardi <None>
|
|
RH-Commit: [1/1] 7549a66485f3047a60fbb54512a570d924ca3206 (kraxel.rh/centos-src-edk2)
|
|
|
|
This reverts commit d2cbaefc082294eadaa30a3d5f0fa8ba264a574a.
|
|
|
|
virt-install must be adapted before this works,
|
|
and it didn't happen yet.
|
|
|
|
Resolves: RHEL-182419
|
|
|
|
Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
|
|
---
|
|
.../X86QemuLoadImageLib/X86QemuLoadImageLib.c | 2 +-
|
|
OvmfPkg/RUNTIME_CONFIG.md | 15 ++++++---------
|
|
2 files changed, 7 insertions(+), 10 deletions(-)
|
|
|
|
diff --git a/OvmfPkg/Library/X86QemuLoadImageLib/X86QemuLoadImageLib.c b/OvmfPkg/Library/X86QemuLoadImageLib/X86QemuLoadImageLib.c
|
|
index f98f8ab885b..b16bdeb47f8 100644
|
|
--- a/OvmfPkg/Library/X86QemuLoadImageLib/X86QemuLoadImageLib.c
|
|
+++ b/OvmfPkg/Library/X86QemuLoadImageLib/X86QemuLoadImageLib.c
|
|
@@ -449,7 +449,7 @@ QemuLoadKernelImage (
|
|
&Enabled
|
|
);
|
|
if (EFI_ERROR (RetStatus)) {
|
|
- Enabled = FALSE;
|
|
+ Enabled = TRUE;
|
|
}
|
|
|
|
if (!Enabled) {
|
|
diff --git a/OvmfPkg/RUNTIME_CONFIG.md b/OvmfPkg/RUNTIME_CONFIG.md
|
|
index 57d0dd96111..b75a5dacadf 100644
|
|
--- a/OvmfPkg/RUNTIME_CONFIG.md
|
|
+++ b/OvmfPkg/RUNTIME_CONFIG.md
|
|
@@ -153,19 +153,16 @@ without EFI stub. If you are using kernels that old secure boot
|
|
support is the least of your problems though ...
|
|
|
|
The linux kernel is typically signed by the distro secure boot keys
|
|
-and is verified by the distro `shim.efi` binary. qemu version 10.0
|
|
-(released in April 2025) got support for passing the shim binary
|
|
+and is verified by the distro `shim.efi` binary. qemu release 10.0
|
|
+(ETA ~ March 2025) will get support for passing the shim binary
|
|
(additionally to kernel + initrd) to the firmware, so the usual secure
|
|
boot verification can work with direct kernel load too.
|
|
|
|
-In edk2-stable202502 and newer the EnableLegacyLoader config option is
|
|
-available and enabled by default.
|
|
+For now the legacy loader is enabled by default. Once the new qemu
|
|
+release is available in most linux distros the defaut will be flipped
|
|
+to disabled.
|
|
|
|
-In edk2-stable202602 and newer the EnableLegacyLoader config option is
|
|
-disabled by default.
|
|
-
|
|
-Here is the qemu command line for direct kernel boot with secure boot
|
|
-verification:
|
|
+Usage (qemu 10.0+):
|
|
|
|
```
|
|
qemu-system-x86_64 \
|
|
--
|
|
2.52.0
|
|
|