Update efi-lockdown for 4.11 merge

1 files changed, 20 insertions, 696 deletions

diff --git a/efi-lockdown.patch b/efi-lockdown.patch
index 6bbc24fa1..dcdd2e99a 100644
--- a/efi-lockdown.patch
+++ b/efi-lockdown.patch
@@ -1,666 +1,3 @@
-From d1d5053106cd1f8b2ae52fb6ffb2962f76053bf0 Mon Sep 17 00:00:00 2001
-From: Ard Biesheuvel <ard.biesheuvel@linaro.org>
-Date: Wed, 23 Nov 2016 10:42:44 +0000
-Subject: [PATCH 01/32] efi: use typed function pointers for runtime services
- table
-
-Instead of using void pointers, and casting them to correctly typed
-function pointers upon use, declare the runtime services pointers
-as function pointers using their respective prototypes, for which
-typedefs are already available.
-
-Signed-off-by: Ard Biesheuvel <ard.biesheuvel@linaro.org>
-Signed-off-by: David Howells <dhowells@redhat.com>
----
- include/linux/efi.h | 36 ++++++++++++++++++------------------
- 1 file changed, 18 insertions(+), 18 deletions(-)
-
-diff --git a/include/linux/efi.h b/include/linux/efi.h
-index a07a476..93a82de 100644
---- a/include/linux/efi.h
-+++ b/include/linux/efi.h
-@@ -508,24 +508,6 @@ typedef struct {
- 	u64 query_variable_info;
- } efi_runtime_services_64_t;
-
--typedef struct {
--	efi_table_hdr_t hdr;
--	void *get_time;
--	void *set_time;
--	void *get_wakeup_time;
--	void *set_wakeup_time;
--	void *set_virtual_address_map;
--	void *convert_pointer;
--	void *get_variable;
--	void *get_next_variable;
--	void *set_variable;
--	void *get_next_high_mono_count;
--	void *reset_system;
--	void *update_capsule;
--	void *query_capsule_caps;
--	void *query_variable_info;
--} efi_runtime_services_t;
--
- typedef efi_status_t efi_get_time_t (efi_time_t *tm, efi_time_cap_t *tc);
- typedef efi_status_t efi_set_time_t (efi_time_t *tm);
- typedef efi_status_t efi_get_wakeup_time_t (efi_bool_t *enabled, efi_bool_t *pending,
-@@ -560,6 +542,24 @@ typedef efi_status_t efi_query_variable_store_t(u32 attributes,
- 						unsigned long size,
- 						bool nonblocking);
-
-+typedef struct {
-+	efi_table_hdr_t			hdr;
-+	efi_get_time_t			*get_time;
-+	efi_set_time_t			*set_time;
-+	efi_get_wakeup_time_t		*get_wakeup_time;
-+	efi_set_wakeup_time_t		*set_wakeup_time;
-+	efi_set_virtual_address_map_t	*set_virtual_address_map;
-+	void				*convert_pointer;
-+	efi_get_variable_t		*get_variable;
-+	efi_get_next_variable_t		*get_next_variable;
-+	efi_set_variable_t		*set_variable;
-+	efi_get_next_high_mono_count_t	*get_next_high_mono_count;
-+	efi_reset_system_t		*reset_system;
-+	efi_update_capsule_t		*update_capsule;
-+	efi_query_capsule_caps_t	*query_capsule_caps;
-+	efi_query_variable_info_t	*query_variable_info;
-+} efi_runtime_services_t;
-+
- void efi_native_runtime_setup(void);
-
- /*
--- 
-2.9.3
-
-From 150ebd38630a3ac558b8ab839a7c7e5fd41cc5a8 Mon Sep 17 00:00:00 2001
-From: David Howells <dhowells@redhat.com>
-Date: Mon, 21 Nov 2016 23:36:31 +0000
-Subject: [PATCH 02/32] x86/efi: Allow invocation of arbitrary runtime services
-
-Provide the ability to perform mixed-mode runtime service calls for x86 in
-the same way that commit 0a637ee61247bd4bed9b2a07568ef7a1cfc76187
-("x86/efi: Allow invocation of arbitrary boot services") provides the
-ability to invoke arbitrary boot services.
-
-Suggested-by: Lukas Wunner <lukas@wunner.de>
-Signed-off-by: David Howells <dhowells@redhat.com>
----
- arch/x86/boot/compressed/eboot.c   | 1 +
- arch/x86/boot/compressed/head_32.S | 6 +++---
- arch/x86/boot/compressed/head_64.S | 8 ++++----
- arch/x86/include/asm/efi.h         | 5 +++++
- 4 files changed, 13 insertions(+), 7 deletions(-)
-
-diff --git a/arch/x86/boot/compressed/eboot.c b/arch/x86/boot/compressed/eboot.c
-index ff01c8f..c8c32eb 100644
---- a/arch/x86/boot/compressed/eboot.c
-+++ b/arch/x86/boot/compressed/eboot.c
-@@ -32,6 +32,7 @@ static void setup_boot_services##bits(struct efi_config *c)		\
- 									\
- 	table = (typeof(table))sys_table;				\
- 									\
-+	c->runtime_services = table->runtime;				\
- 	c->boot_services = table->boottime;				\
- 	c->text_output = table->con_out;				\
- }
-diff --git a/arch/x86/boot/compressed/head_32.S b/arch/x86/boot/compressed/head_32.S
-index fd0b6a2..d85b962 100644
---- a/arch/x86/boot/compressed/head_32.S
-+++ b/arch/x86/boot/compressed/head_32.S
-@@ -82,7 +82,7 @@ ENTRY(efi_pe_entry)
-
- 	/* Relocate efi_config->call() */
- 	leal	efi32_config(%esi), %eax
--	add	%esi, 32(%eax)
-+	add	%esi, 40(%eax)
- 	pushl	%eax
-
- 	call	make_boot_params
-@@ -108,7 +108,7 @@ ENTRY(efi32_stub_entry)
-
- 	/* Relocate efi_config->call() */
- 	leal	efi32_config(%esi), %eax
--	add	%esi, 32(%eax)
-+	add	%esi, 40(%eax)
- 	pushl	%eax
- 2:
- 	call	efi_main
-@@ -264,7 +264,7 @@ relocated:
- #ifdef CONFIG_EFI_STUB
- 	.data
- efi32_config:
--	.fill 4,8,0
-+	.fill 5,8,0
- 	.long efi_call_phys
- 	.long 0
- 	.byte 0
-diff --git a/arch/x86/boot/compressed/head_64.S b/arch/x86/boot/compressed/head_64.S
-index efdfba2..beab832 100644
---- a/arch/x86/boot/compressed/head_64.S
-+++ b/arch/x86/boot/compressed/head_64.S
-@@ -265,7 +265,7 @@ ENTRY(efi_pe_entry)
- 	/*
- 	 * Relocate efi_config->call().
- 	 */
--	addq	%rbp, efi64_config+32(%rip)
-+	addq	%rbp, efi64_config+40(%rip)
-
- 	movq	%rax, %rdi
- 	call	make_boot_params
-@@ -285,7 +285,7 @@ handover_entry:
- 	 * Relocate efi_config->call().
- 	 */
- 	movq	efi_config(%rip), %rax
--	addq	%rbp, 32(%rax)
-+	addq	%rbp, 40(%rax)
- 2:
- 	movq	efi_config(%rip), %rdi
- 	call	efi_main
-@@ -457,14 +457,14 @@ efi_config:
- #ifdef CONFIG_EFI_MIXED
- 	.global efi32_config
- efi32_config:
--	.fill	4,8,0
-+	.fill	5,8,0
- 	.quad	efi64_thunk
- 	.byte	0
- #endif
-
- 	.global efi64_config
- efi64_config:
--	.fill	4,8,0
-+	.fill	5,8,0
- 	.quad	efi_call
- 	.byte	1
- #endif /* CONFIG_EFI_STUB */
-diff --git a/arch/x86/include/asm/efi.h b/arch/x86/include/asm/efi.h
-index e99675b..2f77bce 100644
---- a/arch/x86/include/asm/efi.h
-+++ b/arch/x86/include/asm/efi.h
-@@ -191,6 +191,7 @@ static inline efi_status_t efi_thunk_set_virtual_address_map(
- struct efi_config {
- 	u64 image_handle;
- 	u64 table;
-+	u64 runtime_services;
- 	u64 boot_services;
- 	u64 text_output;
- 	efi_status_t (*call)(unsigned long, ...);
-@@ -226,6 +227,10 @@ static inline bool efi_is_64bit(void)
- #define __efi_call_early(f, ...)					\
- 	__efi_early()->call((unsigned long)f, __VA_ARGS__);
-
-+#define efi_call_runtime(f, ...)					\
-+	__efi_early()->call(efi_table_attr(efi_runtime_services, f,	\
-+		__efi_early()->runtime_services), __VA_ARGS__)
-+
- extern bool efi_reboot_required(void);
-
- #else
--- 
-2.9.3
-
-From 1342301133b5619b79f3288acf7e39450f8ba34f Mon Sep 17 00:00:00 2001
-From: David Howells <dhowells@redhat.com>
-Date: Tue, 22 Nov 2016 00:20:00 +0000
-Subject: [PATCH 03/32] arm/efi: Allow invocation of arbitrary runtime services
-
-efi_call_runtime() is provided for x86 to be able abstract mixed mode
-support.  Provide this for ARM also so that common code work in mixed mode
-also.
-
-Suggested-by: Lukas Wunner <lukas@wunner.de>
-Signed-off-by: David Howells <dhowells@redhat.com>
----
- arch/arm/include/asm/efi.h   | 1 +
- arch/arm64/include/asm/efi.h | 1 +
- 2 files changed, 2 insertions(+)
-
-diff --git a/arch/arm/include/asm/efi.h b/arch/arm/include/asm/efi.h
-index 0b06f53..e4e6a9d6 100644
---- a/arch/arm/include/asm/efi.h
-+++ b/arch/arm/include/asm/efi.h
-@@ -55,6 +55,7 @@ void efi_virtmap_unload(void);
-
- #define efi_call_early(f, ...)		sys_table_arg->boottime->f(__VA_ARGS__)
- #define __efi_call_early(f, ...)	f(__VA_ARGS__)
-+#define efi_call_runtime(f, ...)	sys_table_arg->runtime->f(__VA_ARGS__)
- #define efi_is_64bit()			(false)
-
- #define efi_call_proto(protocol, f, instance, ...)			\
-diff --git a/arch/arm64/include/asm/efi.h b/arch/arm64/include/asm/efi.h
-index 771b3f0..d74ae22 100644
---- a/arch/arm64/include/asm/efi.h
-+++ b/arch/arm64/include/asm/efi.h
-@@ -49,6 +49,7 @@ int efi_set_mapping_permissions(struct mm_struct *mm, efi_memory_desc_t *md);
-
- #define efi_call_early(f, ...)		sys_table_arg->boottime->f(__VA_ARGS__)
- #define __efi_call_early(f, ...)	f(__VA_ARGS__)
-+#define efi_call_runtime(f, ...)	sys_table_arg->runtime->f(__VA_ARGS__)
- #define efi_is_64bit()			(true)
-
- #define efi_call_proto(protocol, f, instance, ...)			\
--- 
-2.9.3
-
-From 2e25c5beef2a97abbb660e707bced77c0eb0ace9 Mon Sep 17 00:00:00 2001
-From: David Howells <dhowells@redhat.com>
-Date: Tue, 22 Nov 2016 00:10:55 +0000
-Subject: [PATCH 04/32] efi: Add SHIM and image security database GUID
- definitions
-
-Add the definitions for shim and image security database, both of which
-are used widely in various Linux distros.
-
-Signed-off-by: Josh Boyer <jwboyer@fedoraproject.org>
-Signed-off-by: David Howells <dhowells@redhat.com>
-Reviewed-by: Ard Biesheuvel <ard.biesheuvel@linaro.org>
----
- include/linux/efi.h | 3 +++
- 1 file changed, 3 insertions(+)
-
-diff --git a/include/linux/efi.h b/include/linux/efi.h
-index 93a82de..c790455 100644
---- a/include/linux/efi.h
-+++ b/include/linux/efi.h
-@@ -610,6 +610,9 @@ void efi_native_runtime_setup(void);
- #define EFI_CONSOLE_OUT_DEVICE_GUID		EFI_GUID(0xd3b36f2c, 0xd551, 0x11d4,  0x9a, 0x46, 0x00, 0x90, 0x27, 0x3f, 0xc1, 0x4d)
- #define APPLE_PROPERTIES_PROTOCOL_GUID		EFI_GUID(0x91bd12fe, 0xf6c3, 0x44fb,  0xa5, 0xb7, 0x51, 0x22, 0xab, 0x30, 0x3a, 0xe0)
-
-+#define EFI_IMAGE_SECURITY_DATABASE_GUID	EFI_GUID(0xd719b2cb, 0x3d3a, 0x4596, 0xa3, 0xbc, 0xda, 0xd0, 0x0e, 0x67, 0x65, 0x6f)
-+#define EFI_SHIM_LOCK_GUID			EFI_GUID(0x605dab50, 0xe046, 0x4300, 0xab, 0xb6, 0x3d, 0xd8, 0x10, 0xdd, 0x8b, 0x23)
-+
- /*
-  * This GUID is used to pass to the kernel proper the struct screen_info
-  * structure that was populated by the stub based on the GOP protocol instance
--- 
-2.9.3
-
-From 820d2f84670080c406bad4c8469e80e1e5f8a191 Mon Sep 17 00:00:00 2001
-From: David Howells <dhowells@redhat.com>
-Date: Mon, 21 Nov 2016 23:55:55 +0000
-Subject: [PATCH 05/32] efi: Get the secure boot status
-
-Get the firmware's secure-boot status in the kernel boot wrapper and stash
-it somewhere that the main kernel image can find.
-
-The efi_get_secureboot() function is extracted from the arm stub and (a)
-generalised so that it can be called from x86 and (b) made to use
-efi_call_runtime() so that it can be run in mixed-mode.
-
-Suggested-by: Lukas Wunner <lukas@wunner.de>
-Signed-off-by: David Howells <dhowells@redhat.com>
----
- Documentation/x86/zero-page.txt           |  2 +
- arch/x86/boot/compressed/eboot.c          |  2 +
- arch/x86/boot/compressed/head_32.S        |  1 +
- arch/x86/boot/compressed/head_64.S        |  1 +
- arch/x86/include/asm/bootparam_utils.h    |  5 ++-
- arch/x86/include/uapi/asm/bootparam.h     |  3 +-
- arch/x86/kernel/asm-offsets.c             |  1 +
- drivers/firmware/efi/libstub/Makefile     |  2 +-
- drivers/firmware/efi/libstub/arm-stub.c   | 58 ++-------------------------
- drivers/firmware/efi/libstub/secureboot.c | 66 +++++++++++++++++++++++++++++++
- include/linux/efi.h                       |  8 ++++
- 11 files changed, 90 insertions(+), 59 deletions(-)
- create mode 100644 drivers/firmware/efi/libstub/secureboot.c
-
-diff --git a/Documentation/x86/zero-page.txt b/Documentation/x86/zero-page.txt
-index 95a4d34..b8527c6 100644
---- a/Documentation/x86/zero-page.txt
-+++ b/Documentation/x86/zero-page.txt
-@@ -31,6 +31,8 @@ Offset	Proto	Name		Meaning
- 1E9/001	ALL	eddbuf_entries	Number of entries in eddbuf (below)
- 1EA/001	ALL	edd_mbr_sig_buf_entries	Number of entries in edd_mbr_sig_buffer
- 				(below)
-+1EB/001	ALL     kbd_status      Numlock is enabled
-+1EC/001	ALL     secure_boot	Secure boot is enabled in the firmware
- 1EF/001	ALL	sentinel	Used to detect broken bootloaders
- 290/040	ALL	edd_mbr_sig_buffer EDD MBR signatures
- 2D0/A00	ALL	e820_map	E820 memory map table
-diff --git a/arch/x86/boot/compressed/eboot.c b/arch/x86/boot/compressed/eboot.c
-index c8c32eb..5b151c2 100644
---- a/arch/x86/boot/compressed/eboot.c
-+++ b/arch/x86/boot/compressed/eboot.c
-@@ -1158,6 +1158,8 @@ struct boot_params *efi_main(struct efi_config *c,
- 	else
- 		setup_boot_services32(efi_early);
-
-+	boot_params->secure_boot = efi_get_secureboot(sys_table);
-+
- 	setup_graphics(boot_params);
-
- 	setup_efi_pci(boot_params);
-diff --git a/arch/x86/boot/compressed/head_32.S b/arch/x86/boot/compressed/head_32.S
-index d85b962..c635f7e 100644
---- a/arch/x86/boot/compressed/head_32.S
-+++ b/arch/x86/boot/compressed/head_32.S
-@@ -61,6 +61,7 @@
-
- 	__HEAD
- ENTRY(startup_32)
-+	movb	$0, BP_secure_boot(%esi)
- #ifdef CONFIG_EFI_STUB
- 	jmp	preferred_addr
-
-diff --git a/arch/x86/boot/compressed/head_64.S b/arch/x86/boot/compressed/head_64.S
-index beab832..ccd2c74 100644
---- a/arch/x86/boot/compressed/head_64.S
-+++ b/arch/x86/boot/compressed/head_64.S
-@@ -244,6 +244,7 @@ ENTRY(startup_64)
- 	 * that maps our entire kernel(text+data+bss+brk), zero page
- 	 * and command line.
- 	 */
-+	movb	$0, BP_secure_boot(%rsi)
- #ifdef CONFIG_EFI_STUB
- 	/*
- 	 * The entry point for the PE/COFF executable is efi_pe_entry, so
-diff --git a/arch/x86/include/asm/bootparam_utils.h b/arch/x86/include/asm/bootparam_utils.h
-index 4a8cb8d..7e16d53 100644
---- a/arch/x86/include/asm/bootparam_utils.h
-+++ b/arch/x86/include/asm/bootparam_utils.h
-@@ -38,9 +38,10 @@ static void sanitize_boot_params(struct boot_params *boot_params)
- 		memset(&boot_params->ext_ramdisk_image, 0,
- 		       (char *)&boot_params->efi_info -
- 			(char *)&boot_params->ext_ramdisk_image);
--		memset(&boot_params->kbd_status, 0,
-+		boot_params->kbd_status = 0;
-+		memset(&boot_params->_pad5, 0,
- 		       (char *)&boot_params->hdr -
--		       (char *)&boot_params->kbd_status);
-+		       (char *)&boot_params->_pad5);
- 		memset(&boot_params->_pad7[0], 0,
- 		       (char *)&boot_params->edd_mbr_sig_buffer[0] -
- 			(char *)&boot_params->_pad7[0]);
-diff --git a/arch/x86/include/uapi/asm/bootparam.h b/arch/x86/include/uapi/asm/bootparam.h
-index b10bf31..5138dac 100644
---- a/arch/x86/include/uapi/asm/bootparam.h
-+++ b/arch/x86/include/uapi/asm/bootparam.h
-@@ -135,7 +135,8 @@ struct boot_params {
- 	__u8  eddbuf_entries;				/* 0x1e9 */
- 	__u8  edd_mbr_sig_buf_entries;			/* 0x1ea */
- 	__u8  kbd_status;				/* 0x1eb */
--	__u8  _pad5[3];					/* 0x1ec */
-+	__u8  secure_boot;				/* 0x1ec */
-+	__u8  _pad5[2];					/* 0x1ed */
- 	/*
- 	 * The sentinel is set to a nonzero value (0xff) in header.S.
- 	 *
-diff --git a/arch/x86/kernel/asm-offsets.c b/arch/x86/kernel/asm-offsets.c
-index c62e015..de827d6 100644
---- a/arch/x86/kernel/asm-offsets.c
-+++ b/arch/x86/kernel/asm-offsets.c
-@@ -81,6 +81,7 @@ void common(void) {
-
- 	BLANK();
- 	OFFSET(BP_scratch, boot_params, scratch);
-+	OFFSET(BP_secure_boot, boot_params, secure_boot);
- 	OFFSET(BP_loadflags, boot_params, hdr.loadflags);
- 	OFFSET(BP_hardware_subarch, boot_params, hdr.hardware_subarch);
- 	OFFSET(BP_version, boot_params, hdr.version);
-diff --git a/drivers/firmware/efi/libstub/Makefile b/drivers/firmware/efi/libstub/Makefile
-index 6621b13..9af9668 100644
---- a/drivers/firmware/efi/libstub/Makefile
-+++ b/drivers/firmware/efi/libstub/Makefile
-@@ -28,7 +28,7 @@ OBJECT_FILES_NON_STANDARD	:= y
- # Prevents link failures: __sanitizer_cov_trace_pc() is not linked in.
- KCOV_INSTRUMENT			:= n
-
--lib-y				:= efi-stub-helper.o gop.o
-+lib-y				:= efi-stub-helper.o gop.o secureboot.o
-
- # include the stub's generic dependencies from lib/ when building for ARM/arm64
- arm-deps := fdt_rw.c fdt_ro.c fdt_wip.c fdt.c fdt_empty_tree.c fdt_sw.c sort.c
-diff --git a/drivers/firmware/efi/libstub/arm-stub.c b/drivers/firmware/efi/libstub/arm-stub.c
-index b4f7d78..06d5034 100644
---- a/drivers/firmware/efi/libstub/arm-stub.c
-+++ b/drivers/firmware/efi/libstub/arm-stub.c
-@@ -20,52 +20,6 @@
-
- bool __nokaslr;
-
--static int efi_get_secureboot(efi_system_table_t *sys_table_arg)
--{
--	static efi_char16_t const sb_var_name[] = {
--		'S', 'e', 'c', 'u', 'r', 'e', 'B', 'o', 'o', 't', 0 };
--	static efi_char16_t const sm_var_name[] = {
--		'S', 'e', 't', 'u', 'p', 'M', 'o', 'd', 'e', 0 };
--
--	efi_guid_t var_guid = EFI_GLOBAL_VARIABLE_GUID;
--	efi_get_variable_t *f_getvar = sys_table_arg->runtime->get_variable;
--	u8 val;
--	unsigned long size = sizeof(val);
--	efi_status_t status;
--
--	status = f_getvar((efi_char16_t *)sb_var_name, (efi_guid_t *)&var_guid,
--			  NULL, &size, &val);
--
--	if (status != EFI_SUCCESS)
--		goto out_efi_err;
--
--	if (val == 0)
--		return 0;
--
--	status = f_getvar((efi_char16_t *)sm_var_name, (efi_guid_t *)&var_guid,
--			  NULL, &size, &val);
--
--	if (status != EFI_SUCCESS)
--		goto out_efi_err;
--
--	if (val == 1)
--		return 0;
--
--	return 1;
--
--out_efi_err:
--	switch (status) {
--	case EFI_NOT_FOUND:
--		return 0;
--	case EFI_DEVICE_ERROR:
--		return -EIO;
--	case EFI_SECURITY_VIOLATION:
--		return -EACCES;
--	default:
--		return -EINVAL;
--	}
--}
--
- efi_status_t efi_open_volume(efi_system_table_t *sys_table_arg,
- 			     void *__image, void **__fh)
- {
-@@ -226,7 +180,7 @@ unsigned long efi_entry(void *handle, efi_system_table_t *sys_table,
- 	efi_guid_t loaded_image_proto = LOADED_IMAGE_PROTOCOL_GUID;
- 	unsigned long reserve_addr = 0;
- 	unsigned long reserve_size = 0;
--	int secure_boot = 0;
-+	enum efi_secureboot_mode secure_boot = efi_secureboot_mode_unknown;
- 	struct screen_info *si;
-
- 	/* Check if we were booted by the EFI firmware */
-@@ -296,19 +250,13 @@ unsigned long efi_entry(void *handle, efi_system_table_t *sys_table,
- 		pr_efi_err(sys_table, "Failed to parse EFI cmdline options\n");
-
- 	secure_boot = efi_get_secureboot(sys_table);
--	if (secure_boot > 0)
--		pr_efi(sys_table, "UEFI Secure Boot is enabled.\n");
--
--	if (secure_boot < 0) {
--		pr_efi_err(sys_table,
--			"could not determine UEFI Secure Boot status.\n");
--	}
-
- 	/*
- 	 * Unauthenticated device tree data is a security hazard, so
- 	 * ignore 'dtb=' unless UEFI Secure Boot is disabled.
- 	 */
--	if (secure_boot != 0 && strstr(cmdline_ptr, "dtb=")) {
-+	if (secure_boot != efi_secureboot_mode_disabled &&
-+	    strstr(cmdline_ptr, "dtb=")) {
- 		pr_efi(sys_table, "Ignoring DTB from command line.\n");
- 	} else {
- 		status = handle_cmdline_files(sys_table, image, cmdline_ptr,
-diff --git a/drivers/firmware/efi/libstub/secureboot.c b/drivers/firmware/efi/libstub/secureboot.c
-new file mode 100644
-index 0000000..70e2a36
---- /dev/null
-+++ b/drivers/firmware/efi/libstub/secureboot.c
-@@ -0,0 +1,66 @@
-+/*
-+ * Secure boot handling.
-+ *
-+ * Copyright (C) 2013,2014 Linaro Limited
-+ *     Roy Franz <roy.franz@linaro.org
-+ * Copyright (C) 2013 Red Hat, Inc.
-+ *     Mark Salter <msalter@redhat.com>
-+ *
-+ * This file is part of the Linux kernel, and is made available under the
-+ * terms of the GNU General Public License version 2.
-+ *
-+ */
-+
-+#include <linux/efi.h>
-+#include <asm/efi.h>
-+
-+/* BIOS variables */
-+static const efi_guid_t efi_variable_guid = EFI_GLOBAL_VARIABLE_GUID;
-+static const efi_char16_t const efi_SecureBoot_name[] = {
-+	'S', 'e', 'c', 'u', 'r', 'e', 'B', 'o', 'o', 't', 0
-+};
-+static const efi_char16_t const efi_SetupMode_name[] = {
-+	'S', 'e', 't', 'u', 'p', 'M', 'o', 'd', 'e', 0
-+};
-+
-+#define get_efi_var(name, vendor, ...) \
-+	efi_call_runtime(get_variable, \
-+			 (efi_char16_t *)(name), (efi_guid_t *)(vendor), \
-+			 __VA_ARGS__);
-+
-+/*
-+ * Determine whether we're in secure boot mode.  We return:
-+ */
-+enum efi_secureboot_mode efi_get_secureboot(efi_system_table_t *sys_table_arg)
-+{
-+	u8 secboot, setupmode;
-+	unsigned long size;
-+	efi_status_t status;
-+
-+	size = sizeof(secboot);
-+	status = get_efi_var(efi_SecureBoot_name, &efi_variable_guid,
-+			     NULL, &size, &secboot);
-+	if (status != EFI_SUCCESS)
-+		goto out_efi_err;
-+
-+	size = sizeof(setupmode);
-+	status = get_efi_var(efi_SetupMode_name, &efi_variable_guid,
-+			     NULL, &size, &setupmode);
-+	if (status != EFI_SUCCESS)
-+		goto out_efi_err;
-+
-+	if (secboot == 0 || setupmode == 1)
-+		goto secure_boot_disabled;
-+
-+	pr_efi(sys_table_arg, "UEFI Secure Boot is enabled.\n");
-+	return efi_secureboot_mode_enabled;
-+
-+secure_boot_disabled:
-+	return efi_secureboot_mode_disabled;
-+
-+out_efi_err:
-+	pr_efi_err(sys_table_arg, "Could not determine UEFI Secure Boot status.\n");
-+	if (status == EFI_NOT_FOUND)
-+		goto secure_boot_disabled;
-+	return efi_secureboot_mode_unknown;
-+}
-diff --git a/include/linux/efi.h b/include/linux/efi.h
-index c790455..92e23f0 100644
---- a/include/linux/efi.h
-+++ b/include/linux/efi.h
-@@ -1477,6 +1477,14 @@ efi_status_t efi_setup_gop(efi_system_table_t *sys_table_arg,
- bool efi_runtime_disabled(void);
- extern void efi_call_virt_check_flags(unsigned long flags, const char *call);
-
-+enum efi_secureboot_mode {
-+	efi_secureboot_mode_unset,
-+	efi_secureboot_mode_unknown,
-+	efi_secureboot_mode_disabled,
-+	efi_secureboot_mode_enabled,
-+};
-+enum efi_secureboot_mode efi_get_secureboot(efi_system_table_t *sys_table);
-+
- /*
-  * Arch code can implement the following three template macros, avoiding
-  * reptition for the void/non-void return cases of {__,}efi_call_virt():
--- 
-2.9.3
-
-From baa6cdc01e6017c6bd798b1af89458359e13155e Mon Sep 17 00:00:00 2001
-From: Josh Boyer <jwboyer@fedoraproject.org>
-Date: Mon, 21 Nov 2016 23:55:55 +0000
-Subject: [PATCH 06/32] efi: Disable secure boot if shim is in insecure mode
-
-A user can manually tell the shim boot loader to disable validation of
-images it loads.  When a user does this, it creates a UEFI variable called
-MokSBState that does not have the runtime attribute set.  Given that the
-user explicitly disabled validation, we can honor that and not enable
-secure boot mode if that variable is set.
-
-Signed-off-by: Josh Boyer <jwboyer@fedoraproject.org>
-Signed-off-by: David Howells <dhowells@redhat.com>
----
- drivers/firmware/efi/libstub/secureboot.c | 24 +++++++++++++++++++++++-
- 1 file changed, 23 insertions(+), 1 deletion(-)
-
-diff --git a/drivers/firmware/efi/libstub/secureboot.c b/drivers/firmware/efi/libstub/secureboot.c
-index 70e2a36..ba6ef71 100644
---- a/drivers/firmware/efi/libstub/secureboot.c
-+++ b/drivers/firmware/efi/libstub/secureboot.c
-@@ -23,6 +23,12 @@ static const efi_char16_t const efi_SetupMode_name[] = {
- 	'S', 'e', 't', 'u', 'p', 'M', 'o', 'd', 'e', 0
- };
-
-+/* SHIM variables */
-+static const efi_guid_t shim_guid = EFI_SHIM_LOCK_GUID;
-+static efi_char16_t const shim_MokSBState_name[] = {
-+	'M', 'o', 'k', 'S', 'B', 'S', 't', 'a', 't', 'e', 0
-+};
-+
- #define get_efi_var(name, vendor, ...) \
- 	efi_call_runtime(get_variable, \
- 			 (efi_char16_t *)(name), (efi_guid_t *)(vendor), \
-@@ -33,7 +39,8 @@ static const efi_char16_t const efi_SetupMode_name[] = {
-  */
- enum efi_secureboot_mode efi_get_secureboot(efi_system_table_t *sys_table_arg)
- {
--	u8 secboot, setupmode;
-+	u32 attr;
-+	u8 secboot, setupmode, moksbstate;
- 	unsigned long size;
- 	efi_status_t status;
-
-@@ -52,6 +59,21 @@ enum efi_secureboot_mode efi_get_secureboot(efi_system_table_t *sys_table_arg)
- 	if (secboot == 0 || setupmode == 1)
- 		goto secure_boot_disabled;
-
-+	/* See if a user has put shim into insecure mode.  If so, and if the
-+	 * variable doesn't have the runtime attribute set, we might as well
-+	 * honor that.
-+	 */
-+	size = sizeof(moksbstate);
-+	status = get_efi_var(shim_MokSBState_name, &shim_guid,
-+			     &attr, &size, &moksbstate);
-+
-+	/* If it fails, we don't care why.  Default to secure */
-+	if (status != EFI_SUCCESS)
-+		goto secure_boot_enabled;
-+	if (!(attr & EFI_VARIABLE_RUNTIME_ACCESS) && moksbstate == 1)
-+		goto secure_boot_disabled;
-+
-+secure_boot_enabled:
- 	pr_efi(sys_table_arg, "UEFI Secure Boot is enabled.\n");
- 	return efi_secureboot_mode_enabled;
-
--- 
-2.9.3
-
 From 9079547f4808ea5c8cd844bf40d3895994bd175e Mon Sep 17 00:00:00 2001
 From: Josh Boyer <jwboyer@fedoraproject.org>
 Date: Mon, 21 Nov 2016 23:55:55 +0000
@@ -681,40 +18,26 @@ Signed-off-by: David Howells <dhowells@redhat.com>
  2 files changed, 16 insertions(+)
 
 diff --git a/arch/x86/kernel/setup.c b/arch/x86/kernel/setup.c
-index 9c337b0..d8972ec 100644
+index 69780ed..447905e 100644
 --- a/arch/x86/kernel/setup.c
 +++ b/arch/x86/kernel/setup.c
-@@ -1152,6 +1152,21 @@ void __init setup_arch(char **cmdline_p)
- 	/* Allocate bigger log buffer */
- 	setup_log_buf(1);
-
-+	if (IS_ENABLED(CONFIG_EFI)) {
-+		switch (boot_params.secure_boot) {
-+		case efi_secureboot_mode_disabled:
-+			pr_info("Secure boot disabled\n");
-+			break;
-+		case efi_secureboot_mode_enabled:
+@@ -1182,6 +1182,7 @@ void __init setup_arch(char **cmdline_p)
+ 			pr_info("Secure boot disabled\n");
+ 			break;
+ 		case efi_secureboot_mode_enabled:
 +			set_bit(EFI_SECURE_BOOT, &efi.flags);
-+			pr_info("Secure boot enabled\n");
-+			break;
-+		default:
-+			pr_info("Secure boot could not be determined\n");
-+			break;
-+		}
-+	}
-+
- 	reserve_initrd();
-
- 	acpi_table_upgrade();
+ 			pr_info("Secure boot enabled\n");
+ 			break;
+ 		default:
 diff --git a/include/linux/efi.h b/include/linux/efi.h
-index 92e23f0..135ca9c 100644
+index 94d34e0..6049600 100644
 --- a/include/linux/efi.h
 +++ b/include/linux/efi.h
-@@ -1066,6 +1066,7 @@ extern int __init efi_setup_pcdp_console(char *);
- #define EFI_ARCH_1		7	/* First arch-specific bit */
+@@ -1069,6 +1069,7 @@ extern int __init efi_setup_pcdp_console(char *);
  #define EFI_DBG			8	/* Print additional debug info at runtime */
  #define EFI_NX_PE_DATA		9	/* Can runtime data regions be mapped non-executable? */
-+#define EFI_SECURE_BOOT		10	/* Are we in Secure Boot mode? */
+ #define EFI_MEM_ATTR		10	/* Did firmware publish an EFI_MEMORY_ATTRIBUTES table? */
++#define EFI_SECURE_BOOT		11	/* Are we in Secure Boot mode? */
 
  #ifdef CONFIG_EFI
  /*
@@ -759,9 +82,9 @@ index ba6ef71..333b159 100644
  	unsigned long size;
  	efi_status_t status;
 
-@@ -59,6 +62,17 @@ enum efi_secureboot_mode efi_get_secureboot(efi_system_table_t *sys_table_arg)
+@@ -57,6 +57,17 @@ enum efi_secureboot_mode efi_get_secureboot(efi_system_table_t *sys_table_arg)
  	if (secboot == 0 || setupmode == 1)
- 		goto secure_boot_disabled;
+ 		return efi_secureboot_mode_disabled;
 
 +	/* UEFI-2.6 requires DeployedMode to be 1. */
 +	if (sys_table_arg->hdr.revision >= EFI_2_60_SYSTEM_TABLE_REVISION) {
@@ -771,10 +94,11 @@ index ba6ef71..333b159 100644
 +		if (status != EFI_SUCCESS)
 +			goto out_efi_err;
 +		if (deployedmode == 0)
-+			goto secure_boot_disabled;
++			return efi_secureboot_mode_disabled;
 +	}
 +
- 	/* See if a user has put shim into insecure mode.  If so, and if the
+ 	/*
+ 	 * See if a user has put the shim into insecure mode. If so, and if the
  	 * variable doesn't have the runtime attribute set, we might as well
  	 * honor that.
 diff --git a/include/linux/efi.h b/include/linux/efi.h
@@ -1979,9 +1303,9 @@ index 5b151c2..5093a76 100644
 +	/* Ask the firmware to clear memory if we don't have a clean shutdown */
 +	enable_reset_attack_mitigation();
 +
- 	boot_params->secure_boot = efi_get_secureboot(sys_table);
-
- 	setup_graphics(boot_params);
+ 	/*
+ 	 * If the boot loader gave us a value for secure_boot then we use that,
+ 	 * otherwise we ask the BIOS.
 -- 
 2.9.3