72 lines
2.7 KiB
Diff
72 lines
2.7 KiB
Diff
From 80cbcf54ff7aa0e372fe766e9a36a9b393c20fef Mon Sep 17 00:00:00 2001
|
|
From: Gerd Hoffmann <kraxel@redhat.com>
|
|
Date: Fri, 5 Jun 2026 11:30:09 +0200
|
|
Subject: [PATCH 1/2] Revert "OvmfPkg/X86QemuLoadImageLib: flip default for
|
|
EnableLegacyLoader to false"
|
|
|
|
RH-Author: Gerd Hoffmann <kraxel@redhat.com>
|
|
RH-MergeRequest: 140: Revert "OvmfPkg/X86QemuLoadImageLib: flip default for EnableLegacyLoader to false"
|
|
RH-Jira: RHEL-182421
|
|
RH-Acked-by: Luigi Leonardi <None>
|
|
RH-Commit: [1/1] f2ae66dcd46237e798d0b527218c6091ae8f13a9
|
|
|
|
This reverts commit d2cbaefc082294eadaa30a3d5f0fa8ba264a574a.
|
|
|
|
virt-install must be adapted before this works,
|
|
and it didn't happen yet.
|
|
|
|
Resolves: RHEL-182421
|
|
|
|
Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
|
|
---
|
|
.../X86QemuLoadImageLib/X86QemuLoadImageLib.c | 2 +-
|
|
OvmfPkg/RUNTIME_CONFIG.md | 15 ++++++---------
|
|
2 files changed, 7 insertions(+), 10 deletions(-)
|
|
|
|
diff --git a/OvmfPkg/Library/X86QemuLoadImageLib/X86QemuLoadImageLib.c b/OvmfPkg/Library/X86QemuLoadImageLib/X86QemuLoadImageLib.c
|
|
index f98f8ab885..b16bdeb47f 100644
|
|
--- a/OvmfPkg/Library/X86QemuLoadImageLib/X86QemuLoadImageLib.c
|
|
+++ b/OvmfPkg/Library/X86QemuLoadImageLib/X86QemuLoadImageLib.c
|
|
@@ -449,7 +449,7 @@ QemuLoadKernelImage (
|
|
&Enabled
|
|
);
|
|
if (EFI_ERROR (RetStatus)) {
|
|
- Enabled = FALSE;
|
|
+ Enabled = TRUE;
|
|
}
|
|
|
|
if (!Enabled) {
|
|
diff --git a/OvmfPkg/RUNTIME_CONFIG.md b/OvmfPkg/RUNTIME_CONFIG.md
|
|
index 57d0dd9611..b75a5dacad 100644
|
|
--- a/OvmfPkg/RUNTIME_CONFIG.md
|
|
+++ b/OvmfPkg/RUNTIME_CONFIG.md
|
|
@@ -153,19 +153,16 @@ without EFI stub. If you are using kernels that old secure boot
|
|
support is the least of your problems though ...
|
|
|
|
The linux kernel is typically signed by the distro secure boot keys
|
|
-and is verified by the distro `shim.efi` binary. qemu version 10.0
|
|
-(released in April 2025) got support for passing the shim binary
|
|
+and is verified by the distro `shim.efi` binary. qemu release 10.0
|
|
+(ETA ~ March 2025) will get support for passing the shim binary
|
|
(additionally to kernel + initrd) to the firmware, so the usual secure
|
|
boot verification can work with direct kernel load too.
|
|
|
|
-In edk2-stable202502 and newer the EnableLegacyLoader config option is
|
|
-available and enabled by default.
|
|
+For now the legacy loader is enabled by default. Once the new qemu
|
|
+release is available in most linux distros the defaut will be flipped
|
|
+to disabled.
|
|
|
|
-In edk2-stable202602 and newer the EnableLegacyLoader config option is
|
|
-disabled by default.
|
|
-
|
|
-Here is the qemu command line for direct kernel boot with secure boot
|
|
-verification:
|
|
+Usage (qemu 10.0+):
|
|
|
|
```
|
|
qemu-system-x86_64 \
|
|
--
|
|
2.52.0
|
|
|