secureboot: enable secureboot if boot param is set

Orabug: 23511799

Enable secureboot if enabled via boot param.

Signed-off-by: Brian Maly <brian.maly@oracle.com>

diff --git a/arch/x86/kernel/setup.c b/arch/x86/kernel/setup.c
index 7cea402a45d332fa50fc5b7544c3e4ae4d395e97..97838c712a96a319e73c29b46e3929afd07873e0 100644 (file)
--- a/arch/x86/kernel/setup.c
+++ b/arch/x86/kernel/setup.c
@@ -1157,6 +1157,14 @@ void __init setup_arch(char **cmdline_p)
 
        io_delay_init();
 
+#ifdef CONFIG_EFI_SECURE_BOOT_SECURELEVEL
+       if (boot_params.secure_boot) {
+               set_bit(EFI_SECURE_BOOT, &efi.flags);
+               set_securelevel(1);
+               pr_info("Secure boot enabled\n");
+       }
+#endif
+
        /*
         * Parse the ACPI tables for possible boot-time SMP configuration.
         */