From 08d849e4c516ab826dfdb71d3e57dddf668b6898 Mon Sep 17 00:00:00 2001 From: qihao_yewu Date: Fri, 1 Aug 2025 04:02:45 -0400 Subject: [PATCH] x86/loader: only patch linux kernels cheery-pick from 3f73fe11188307773ab6bce481a977c7a11e367e If the binary loaded via -kernel is *not* a linux kernel (in which case protocol == 0), do not patch the linux kernel header fields. It's (a) pointless and (b) might break binaries by random patching and (c) changes the binary hash which in turn breaks secure boot verification. Background: OVMF happily loads and runs not only linux kernels but any efi binary via direct kernel boot. Note: Breaking the secure boot verification is a problem for linux kernels too, but fixed that is left for another day ... Signed-off-by: Gerd Hoffmann Message-ID: <20240905141211.1253307-3-kraxel@redhat.com> (cherry picked from commit 57e2cc9abf5da38f600354fe920ff20e719607b4) Signed-off-by: Michael Tokarev (Mjt: it is in hw/i386/x86.c not hw/i386/x86-common.c in 8.2.x) Signed-off-by: qihao_yewu --- hw/i386/x86.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/hw/i386/x86.c b/hw/i386/x86.c index 2b6291ad8d..672de72762 100644 --- a/hw/i386/x86.c +++ b/hw/i386/x86.c @@ -1105,7 +1105,7 @@ void x86_load_linux(X86MachineState *x86ms, * kernel on the other side of the fw_cfg interface matches the hash of the * file the user passed in. */ - if (!sev_enabled()) { + if (!sev_enabled() && protocol > 0) { memcpy(setup, header, MIN(sizeof(header), setup_size)); } -- Gitee