Trusty SRU - Implement secure boot signed modules enforcement V2

Tim Gardner tim.gardner at
Fri Sep 9 19:15:05 UTC 2016

The attached pull request is a reprise from
wherein an arm64 regression fix was attempted. In the process we found
that some x86 laptop platforms would not boot. Subsequent bisection
found the root cause: "x86/efi: Save and restore FPU context around
efi_calls (x86_64)". A partial revert appears to have fixed the boot issue.

This patchset has been rebased against what will become
Ubuntu-3.13.0-97.144. Test kernels at

Tim Gardner tim.gardner at
-------------- next part --------------
The following changes since commit 2546ede8f9da5373cebba987a5a3e81ca1d05c97:

  powerpc/pseries: use pci_host_bridge.release_fn() to kfree(phb) (2016-09-01 11:03:18 -0600)

are available in the git repository at:

  git:// arm64-efi-lp1608854

for you to fetch changes up to af1ef5707b060336f06ace9e324d3bb9a3937b8c:

  Revert "x86/efi: Save and restore FPU context around efi_calls (x86_64)" (2016-09-09 12:59:20 -0600)

Andrzej Zaborowski (1):
      efi-pstore: Fix an overflow on 32-bit builds

Ard Biesheuvel (4):
      efi/arm64: ignore dtb= when UEFI SecureBoot is enabled
      efi/arm64: efistub: remove local copy of linux_banner
      arm64/efi: map the entire UEFI vendor string before reading it
      arm64/efi: add missing call to early_ioremap_reset()

Borislav Petkov (9):
      x86/efi: Simplify EFI_DEBUG
      x86/efi: Runtime services virtual mapping
      x86/efi: Check krealloc return value
      x86/efi: Fix 32-bit fallout
      x86/efi: Quirk out SGI UV
      x86/efi: Dump the EFI page table
      x86, pageattr: Export page unmapping interface
      x86/efi: Make efi virtual runtime map passing more robust
      x86/efi: Split efi_enter_virtual_mode

Bruno Prémont (1):
      x86, ia64: Move EFI_FB vga_default_device() initialization to pci_vga_fixup()

Catalin Marinas (2):
      efi: Fix compiler warnings (unused, const, type)
      efi: fdt: Do not report an error during boot if UEFI is not available

Daeseok Youn (1):
      efi: Use NULL instead of 0 for pointer

Dan Carpenter (2):
      efi: Fix error handling in add_sysfs_runtime_map_entry()
      efi: Small leak on error in runtime map code

Dave Young (8):
      x86/efi: Remove unused variables in __map_region()
      x86/efi: Add a wrapper function efi_map_region_fixed()
      x86/efi: Fix off-by-one bug in EFI Boot Services reservation
      x86/efi: Cleanup efi_enter_virtual_mode() function
      efi: Export more EFI table variables to sysfs
      efi: Export EFI runtime memory mapping to sysfs
      x86/efi: Pass necessary EFI data for kexec via setup_data
      x86/efi: parse_efi_setup() build fix

Dmitry Skorodumov (1):
      x86/efi: Use all 64 bit of efi_memmap in setup_e820()

Fabian Frederick (1):
      fs/efivarfs/super.c: use static const for dentry_operations

Geyslan G. Bem (1):
      efivarfs: 'efivarfs_file_write' function reorganization

Guenter Roeck (1):
      firmware: Do not use WARN_ON(!spin_is_locked())

H. Peter Anvin (1):
      efi: x86: Handle arbitrary Unicode characters

Ingo Molnar (1):
      efi: Disable interrupts around EFI calls, not in the epilog/prolog calls

Joe Perches (1):
      x86/efi: Style neatening

Josh Boyer (4):
      UBUNTU: SAUCE: UEFI: acpi: Ignore acpi_rsdp kernel parameter when module loading is restricted
      UBUNTU: SAUCE: UEFI MODSIGN: Import certificates from UEFI Secure Boot
      UBUNTU: SAUCE: UEFI: efi: Disable secure boot if shim is in insecure mode

Leif Lindholm (2):
      efi: efi-stub-helper cleanup
      arm64: efi: only attempt efi map setup if booting via EFI

Madper Xie (1):
      x86/efi: Delete out-of-date comments of efi_query_variable_store

Mark Salter (5):
      efi: create memory map iteration helper
      efi: add helper function to get UEFI params from FDT
      arm64: add EFI runtime services
      arm64: efi: add EFI stub
      doc: arm64: add description of EFI stub support

Matt Fleming (29):
      x86/efi: Delete superfluous global variables
      x86/efi: Allow mapping BGRT on x86-32
      x86/efi: Check status field to validate BGRT header
      efi: Move facility flags to struct efi
      efi: Set feature flags inside feature init functions
      ia64/efi: Implement efi_enabled()
      x86, tools: Consolidate #ifdef code
      x86/efi: Delete dead code when checking for non-native
      efi: Add separate 32-bit/64-bit definitions
      x86/efi: Build our own EFI services pointer table
      x86/efi: Add early thunk code to go from 64-bit to 32-bit
      x86/efi: Firmware agnostic handover entry points
      x86/efi: Wire up CONFIG_EFI_MIXED
      x86/efi: Re-disable interrupts after calling firmware services
      x86, tools: Fix up compiler warnings
      x86/efi: Preserve segment registers in mixed mode
      x86/efi: Rip out phys_efi_get_time()
      x86/efi: Restore 'attr' argument to query_variable_info()
      x86/efi: Delete most of the efi_call* macros
      efivars: Use local variables instead of a pointer dereference
      efivars: Check size of user object
      efivars: Stop passing a struct argument to efivar_validate()
      efivars: Refactor sanity checking code into separate function
      efivars: Add compatibility code for compat tasks
      x86/efi: Fix boot failure with EFI stub
      x86/efi: Fix boot crash by mapping EFI memmap entries bottom-up at runtime, instead of top-down
      efi/reboot: Add generic wrapper around EfiResetSystem()
      x86/reboot: Add EFI reboot quirk for ACPI Hardware Reduced flag
      efi/reboot: Allow powering off machines using EFI

Matthew Garrett (9):
      UBUNTU: SAUCE: UEFI: Add secure_modules() call
      UBUNTU: SAUCE: UEFI: PCI: Lock down BAR access when module security is enabled
      UBUNTU: SAUCE: UEFI: x86: Lock down IO port access when module security is enabled
      UBUNTU: SAUCE: UEFI: ACPI: Limit access to custom_method
      UBUNTU: SAUCE: UEFI: asus-wmi: Restrict debugfs interface when module loading is restricted
      UBUNTU: SAUCE: UEFI: Restrict /dev/mem and /dev/kmem when module loading is restricted
      UBUNTU: SAUCE: UEFI: kexec: Disable at runtime if the kernel enforces module loading restrictions
      UBUNTU: SAUCE: UEFI: x86: Restrict MSR access when module loading is restricted
      UBUNTU: SAUCE: UEFI: Add option to automatically enforce module signatures when in Secure Boot mode

Peter Jones (3):
      efi: Make our variable validation list include the guid
      lib/ucs2_string: Add ucs2 -> utf8 helper functions
      efi: Use ucs2_as_utf8 in efivarfs instead of open coding a bad version

Ricardo Neri (3):
      x86/efi: Implement a __efi_call_virt macro
      x86/efi: Save and restore FPU context around efi_calls (x86_64)
      x86/efi: Save and restore FPU context around efi_calls (i386)

Ross Lagerwall (1):
      efivarfs: Ensure VariableName is NUL-terminated

Roy Franz (5):
      efi: Add shared printk wrapper for consistent prefixing
      efi: Add get_dram_base() helper function
      doc: efi-stub.txt updates for ARM
      efi: Add shared FDT related functions for ARM/ARM64
      x86/efi: Store upper bits of command line buffer address in ext_cmd_line_ptr

Semen Protsenko (1):
      efi/arm64: Store Runtime Services revision

Silvan Jegen (1):
      doc: Fix trivial spelling mistake in efi-stub.txt

Tim Gardner (38):
      Revert "efi: Disable interrupts around EFI calls, not in the epilog/prolog calls"
      Revert "x86/efi: Use all 64 bit of efi_memmap in setup_e820()"
      Revert "x86/efi: Store upper bits of command line buffer address in ext_cmd_line_ptr"
      Revert "efivarfs: Ensure VariableName is NUL-terminated"
      Revert "efi/libstub: Fix boundary checking in efi_high_alloc()"
      Revert "arm64: efi: only attempt efi map setup if booting via EFI"
      Revert "UBUNTU: arm64: Implement efi_enabled()"
      Revert "efi/arm64: ignore dtb= when UEFI SecureBoot is enabled"
      Revert "doc: arm64: add description of EFI stub support"
      Revert "UBUNTU: Move get_dram_base to arm private file"
      Revert "arm64: efi: add EFI stub"
      Revert "arm64: add EFI runtime services"
      Revert "efi: Add shared FDT related functions for ARM/ARM64"
      Revert "efi: add helper function to get UEFI params from FDT"
      Revert "doc: efi-stub.txt updates for ARM"
      Revert "efi: Add get_dram_base() helper function"
      Revert "efi: create memory map iteration helper"
      Revert "x86, ia64: Move EFI_FB vga_default_device() initialization to pci_vga_fixup()"
      Revert "firmware: Do not use WARN_ON(!spin_is_locked())"
      Revert "efi-pstore: Fix an overflow on 32-bit builds"
      Revert "x86/efi: Fix 32-bit fallout"
      Revert "x86/efi: Check krealloc return value"
      Revert "x86/efi: Runtime services virtual mapping"
      Revert "x86/efi: Fix off-by-one bug in EFI Boot Services reservation"
      UBUNTU: SAUCE: Merge tag 'efi-next' of git:// into x86/efi
      UBUNTU: SAUCE: Merge tag 'v3.13-rc7' into x86/efi-kexec to resolve conflicts
      UBUNTU: v3.14 - Bacported EFI up to v3.14
      UBUNTU: SAUCE: Merge remote-tracking branch 'tip/x86/efi-mixed' into efi-for-mingo
      UBUNTU: SAUCE: merge with v3.15
      UBUNTU: SAUCE: merge with v3.16
      UBUNTU: [Config] CONFIG_LIBFDT=y
      UBUNTU: SAUCE: UEFI: Display MOKSBState when disabled
      UBUNTU: SAUCE: UEFI: Add secure boot and MOK SB State disabled sysctl
      UBUNTU: SAUCE: UEFI: Set EFI_SECURE_BOOT bit in x86_efi_facility
      Revert "x86/efi: Save and restore FPU context around efi_calls (x86_64)"

Yinghai Lu (1):
      efi/libstub: Fix boundary checking in efi_high_alloc()

 Documentation/ABI/testing/sysfs-firmware-efi       |   20 +
 .../ABI/testing/sysfs-firmware-efi-runtime-map     |   34 +
 Documentation/efi-stub.txt                         |    2 +-
 Documentation/x86/zero-page.txt                    |    2 +
 arch/arm64/include/asm/efi.h                       |    1 -
 arch/arm64/kernel/efi-stub.c                       |    8 -
 arch/arm64/kernel/efi.c                            |   27 +-
 arch/arm64/kernel/setup.c                          |    1 +
 arch/ia64/kernel/efi.c                             |    7 +
 arch/ia64/kernel/process.c                         |    2 +-
 arch/ia64/pci/fixup.c                              |   21 +
 arch/x86/Kconfig                                   |   25 +
 arch/x86/Kconfig.debug                             |    9 +
 arch/x86/boot/Makefile                             |    2 +-
 arch/x86/boot/compressed/eboot.c                   | 1102 ++++++++++++++++----
 arch/x86/boot/compressed/eboot.h                   |   60 ++
 arch/x86/boot/compressed/efi_stub_64.S             |   29 +
 arch/x86/boot/compressed/head_32.S                 |   50 +-
 arch/x86/boot/compressed/head_64.S                 |  105 +-
 arch/x86/boot/header.S                             |   15 +-
 arch/x86/boot/tools/build.c                        |  100 +-
 arch/x86/include/asm/efi.h                         |  158 +--
 arch/x86/include/asm/pgtable_types.h               |    2 +
 arch/x86/include/uapi/asm/bootparam.h              |    4 +-
 arch/x86/kernel/ioport.c                           |    5 +-
 arch/x86/kernel/msr.c                              |    7 +
 arch/x86/kernel/reboot.c                           |   26 +-
 arch/x86/kernel/setup.c                            |   89 +-
 arch/x86/mm/pageattr.c                             |   44 +-
 arch/x86/pci/fixup.c                               |   21 +
 arch/x86/platform/efi/Makefile                     |    1 +
 arch/x86/platform/efi/early_printk.c               |   83 +-
 arch/x86/platform/efi/efi-bgrt.c                   |   12 +-
 arch/x86/platform/efi/efi.c                        |  752 +++++++++----
 arch/x86/platform/efi/efi_32.c                     |   10 +-
 arch/x86/platform/efi/efi_64.c                     |  389 ++++++-
 arch/x86/platform/efi/efi_stub_64.S                |  247 +++--
 arch/x86/platform/efi/efi_thunk_64.S               |   65 ++
 arch/x86/platform/uv/bios_uv.c                     |    2 +-
 block/partitions/efi.h                             |    9 +-
 debian.master/config/config.common.ubuntu          |    5 +-
 drivers/acpi/custom_method.c                       |    3 +
 drivers/acpi/osl.c                                 |    3 +-
 drivers/char/mem.c                                 |   10 +
 drivers/firmware/efi/Kconfig                       |   11 +
 drivers/firmware/efi/Makefile                      |    3 +-
 drivers/firmware/efi/arm-stub.c                    |   39 +-
 drivers/firmware/efi/efi-stub-helper.c             |  273 +++--
 drivers/firmware/efi/efi.c                         |   78 +-
 drivers/firmware/efi/efivars.c                     |  221 +++-
 drivers/firmware/efi/fdt.c                         |   12 +-
 drivers/firmware/efi/reboot.c                      |   56 +
 drivers/firmware/efi/runtime-map.c                 |  181 ++++
 drivers/firmware/efi/vars.c                        |   82 +-
 drivers/pci/pci-sysfs.c                            |   10 +
 drivers/pci/proc.c                                 |    8 +-
 drivers/pci/syscall.c                              |    3 +-
 drivers/platform/x86/asus-wmi.c                    |    9 +
 fs/efivarfs/file.c                                 |   13 +-
 fs/efivarfs/super.c                                |    9 +-
 include/linux/efi.h                                |  308 +++++-
 include/linux/module.h                             |   13 +
 include/linux/ucs2_string.h                        |    4 +
 init/Kconfig                                       |    9 +
 kernel/Makefile                                    |    3 +
 kernel/kexec.c                                     |    3 +-
 kernel/modsign_uefi.c                              |   92 ++
 kernel/module.c                                    |   17 +
 kernel/sysctl.c                                    |   31 +
 lib/ucs2_string.c                                  |   62 ++
 notes.txt                                          |    1 +
 71 files changed, 4071 insertions(+), 1049 deletions(-)
 create mode 100644 Documentation/ABI/testing/sysfs-firmware-efi
 create mode 100644 Documentation/ABI/testing/sysfs-firmware-efi-runtime-map
 create mode 100644 arch/x86/platform/efi/efi_thunk_64.S
 create mode 100644 drivers/firmware/efi/reboot.c
 create mode 100644 drivers/firmware/efi/runtime-map.c
 create mode 100644 kernel/modsign_uefi.c
 create mode 100644 notes.txt

More information about the kernel-team mailing list