Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1754998AbcKWAYR (ORCPT ); Tue, 22 Nov 2016 19:24:17 -0500 Received: from mx1.redhat.com ([209.132.183.28]:37828 "EHLO mx1.redhat.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1755401AbcKWAYO (ORCPT ); Tue, 22 Nov 2016 19:24:14 -0500 Subject: [PATCH 0/6] efi: Pass secure boot mode to kernel [ver #2] From: David Howells To: lukas@wunner.de Cc: linux-efi@vger.kernel.org, dhowells@redhat.com, linux-security-module@vger.kernel.org, keyrings@vger.kernel.org, linux-kernel@vger.kernel.org Date: Wed, 23 Nov 2016 00:22:28 +0000 Message-ID: <147986054870.13790.8640536414645705863.stgit@warthog.procyon.org.uk> User-Agent: StGit/0.17.1-dirty MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: 7bit X-Greylist: Sender IP whitelisted, not delayed by milter-greylist-4.5.16 (mx1.redhat.com [10.5.110.32]); Wed, 23 Nov 2016 00:22:30 +0000 (UTC) Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Length: 1649 Lines: 44 Here's a set of patches that can determine the secure boot state of the UEFI BIOS and pass that along to the main kernel image. This involves generalising ARM's efi_get_secureboot() function and making it mixed-mode safe. The patches can be found here also: http://git.kernel.org/cgit/linux/kernel/git/dhowells/linux-fs.git/log/?h=efi-secure-boot at tag: efi-secure-boot-20161123 Note that the patches are not terminal on the branch. David --- David Howells (4): x86/efi: Allow invocation of arbitrary runtime services arm/efi: Allow invocation of arbitrary runtime services efi: Add SHIM and image security database GUID definitions efi: Get the secure boot status Josh Boyer (2): efi: Disable secure boot if shim is in insecure mode efi: Add EFI_SECURE_BOOT bit Documentation/x86/zero-page.txt | 2 + arch/arm/include/asm/efi.h | 1 arch/arm64/include/asm/efi.h | 1 arch/x86/boot/compressed/eboot.c | 3 + arch/x86/boot/compressed/head_32.S | 6 +- arch/x86/boot/compressed/head_64.S | 8 +- arch/x86/include/asm/efi.h | 5 ++ arch/x86/include/uapi/asm/bootparam.h | 3 + arch/x86/kernel/setup.c | 7 ++ drivers/firmware/efi/libstub/Makefile | 2 - drivers/firmware/efi/libstub/arm-stub.c | 46 -------------- drivers/firmware/efi/libstub/secureboot.c | 93 +++++++++++++++++++++++++++++ include/linux/efi.h | 6 ++ 13 files changed, 128 insertions(+), 55 deletions(-) create mode 100644 drivers/firmware/efi/libstub/secureboot.c