Ard Biesheuvel <ard.biesheu...@linaro.org> wrote:
> > @@ -1164,6 +1164,7 @@ void __init setup_arch(char **cmdline_p)
> > if (boot_params.secure_boot &&
> > IS_ENABLED(CONFIG_EFI_SECURE_BOOT_LOCK_DOWN)) {
> > lock_kernel_down();
> > + set_bit(EFI_SECURE_BOOT, &efi.flags);
>
> Why is this x86 only?
It probably doesn't really need to be, but that's what the patches I ported
do.
> And why is this bit only set if CONFIG_EFI_SECURE_BOOT_LOCK_DOWN is enabled?
Actually, the EFI_SECURE_BOOT bit should probably be set outside of that
portion of the if-condition.
David
