From c8f9da6523312e9bb54495a970a8bc373df01aa7 Mon Sep 17 00:00:00 2001 From: Jeremy Cline Date: Mon, 19 Nov 2018 11:32:25 -0500 Subject: [PATCH] Resolve a conflict in the efi secureboot patch set --- efi-secureboot.patch | 53 +++++++++++++++++++++++--------------------- 1 file changed, 28 insertions(+), 25 deletions(-) diff --git a/efi-secureboot.patch b/efi-secureboot.patch index c57037623..1476abab3 100644 --- a/efi-secureboot.patch +++ b/efi-secureboot.patch @@ -38,7 +38,7 @@ index fb095ba0c02f..7d0fac5bcbbe 100644 -- 2.14.3 -From 42b2c81c12a8e8139fc7252cf91151c37b5a0966 Mon Sep 17 00:00:00 2001 +From b5123d0553f4ed5e734f6457696cdd30228d1eee Mon Sep 17 00:00:00 2001 From: David Howells Date: Tue, 27 Feb 2018 10:04:55 +0000 Subject: [PATCH 29/31] efi: Add an EFI_SECURE_BOOT flag to indicate secure @@ -55,22 +55,23 @@ Suggested-by: Ard Biesheuvel Signed-off-by: David Howells Reviewed-by: Ard Biesheuvel cc: linux-efi@vger.kernel.org +Signed-off-by: Jeremy Cline --- - arch/x86/kernel/setup.c | 14 +------------- + arch/x86/kernel/setup.c | 14 +----------- drivers/firmware/efi/Makefile | 1 + - drivers/firmware/efi/secureboot.c | 38 ++++++++++++++++++++++++++++++++++++++ - include/linux/efi.h | 16 ++++++++++------ - 4 files changed, 50 insertions(+), 19 deletions(-) + drivers/firmware/efi/secureboot.c | 38 +++++++++++++++++++++++++++++++ + include/linux/efi.h | 18 ++++++++++----- + 4 files changed, 52 insertions(+), 19 deletions(-) create mode 100644 drivers/firmware/efi/secureboot.c diff --git a/arch/x86/kernel/setup.c b/arch/x86/kernel/setup.c -index 1ae67e982af7..a7c240f00d78 100644 +index b74e7bfed6ab..7da1712c89c9 100644 --- a/arch/x86/kernel/setup.c +++ b/arch/x86/kernel/setup.c -@@ -1150,19 +1150,7 @@ void __init setup_arch(char **cmdline_p) +@@ -1158,19 +1158,7 @@ void __init setup_arch(char **cmdline_p) /* Allocate bigger log buffer */ setup_log_buf(1); - + - if (efi_enabled(EFI_BOOT)) { - switch (boot_params.secure_boot) { - case efi_secureboot_mode_disabled: @@ -85,11 +86,11 @@ index 1ae67e982af7..a7c240f00d78 100644 - } - } + efi_set_secure_boot(boot_params.secure_boot); - + reserve_initrd(); - + diff --git a/drivers/firmware/efi/Makefile b/drivers/firmware/efi/Makefile -index cb805374f4bc..da2b3e37b9f0 100644 +index 5f9f5039de50..7a0a6378203e 100644 --- a/drivers/firmware/efi/Makefile +++ b/drivers/firmware/efi/Makefile @@ -24,6 +24,7 @@ obj-$(CONFIG_EFI_FAKE_MEMMAP) += fake_mem.o @@ -98,7 +99,7 @@ index cb805374f4bc..da2b3e37b9f0 100644 obj-$(CONFIG_EFI_DEV_PATH_PARSER) += dev-path-parser.o +obj-$(CONFIG_EFI) += secureboot.o obj-$(CONFIG_APPLE_PROPERTIES) += apple-properties.o - + arm-obj-$(CONFIG_EFI) := arm-init.o arm-runtime.o diff --git a/drivers/firmware/efi/secureboot.c b/drivers/firmware/efi/secureboot.c new file mode 100644 @@ -145,10 +146,10 @@ index 000000000000..9070055de0a1 + } +} diff --git a/include/linux/efi.h b/include/linux/efi.h -index f5083aa72eae..79da76d14ca3 100644 +index 100ce4a4aff6..62361b647a75 100644 --- a/include/linux/efi.h +++ b/include/linux/efi.h -@@ -1142,6 +1142,14 @@ extern int __init efi_setup_pcdp_console(char *); +@@ -1155,6 +1155,14 @@ extern int __init efi_setup_pcdp_console(char *); #define EFI_DBG 8 /* Print additional debug info at runtime */ #define EFI_NX_PE_DATA 9 /* Can runtime data regions be mapped non-executable? */ #define EFI_MEM_ATTR 10 /* Did firmware publish an EFI_MEMORY_ATTRIBUTES table? */ @@ -160,29 +161,31 @@ index f5083aa72eae..79da76d14ca3 100644 + efi_secureboot_mode_disabled, + efi_secureboot_mode_enabled, +}; - + #ifdef CONFIG_EFI /* -@@ -1154,6 +1162,7 @@ static inline bool efi_enabled(int feature) - extern void efi_reboot(enum reboot_mode reboot_mode, const char *__unused); - +@@ -1169,6 +1177,8 @@ extern void efi_reboot(enum reboot_mode reboot_mode, const char *__unused); extern bool efi_is_table_address(unsigned long phys_addr); + + extern int efi_apply_persistent_mem_reservations(void); ++ +extern void __init efi_set_secure_boot(enum efi_secureboot_mode mode); #else static inline bool efi_enabled(int feature) { -@@ -1172,6 +1181,7 @@ static inline bool efi_is_table_address(unsigned long phys_addr) +@@ -1192,6 +1202,8 @@ static inline int efi_apply_persistent_mem_reservations(void) { - return false; + return 0; } ++ +static inline void efi_set_secure_boot(enum efi_secureboot_mode mode) {} #endif - + extern int efi_status_to_err(efi_status_t status); -@@ -1557,12 +1567,6 @@ efi_status_t efi_setup_gop(efi_system_table_t *sys_table_arg, +@@ -1577,12 +1589,6 @@ efi_status_t efi_setup_gop(efi_system_table_t *sys_table_arg, bool efi_runtime_disabled(void); extern void efi_call_virt_check_flags(unsigned long flags, const char *call); - + -enum efi_secureboot_mode { - efi_secureboot_mode_unset, - efi_secureboot_mode_unknown, @@ -190,10 +193,10 @@ index f5083aa72eae..79da76d14ca3 100644 - efi_secureboot_mode_enabled, -}; enum efi_secureboot_mode efi_get_secureboot(efi_system_table_t *sys_table); - + #ifdef CONFIG_RESET_ATTACK_MITIGATION -- -2.14.3 +2.19.1 From d78bf678059f83e22bec8ada1a448e22b9b90203 Mon Sep 17 00:00:00 2001 From: David Howells