mirror of
https://github.com/torvalds/linux.git
synced 2024-12-13 22:53:20 +00:00
58c909022a
Because of system-specific EFI firmware limitations, EFI volatile variables may not be capable of holding the required contents of the Machine Owner Key (MOK) certificate store when the certificate list grows above some size. Therefore, an EFI boot loader may pass the MOK certs via a EFI configuration table created specifically for this purpose to avoid this firmware limitation. An EFI configuration table is a much more primitive mechanism compared to EFI variables and is well suited for one-way passage of static information from a pre-OS environment to the kernel. This patch adds initial kernel support to recognize, parse, and validate the EFI MOK configuration table, where named entries contain the same data that would otherwise be provided in similarly named EFI variables. Additionally, this patch creates a sysfs binary file for each EFI MOK configuration table entry found. These files are read-only to root and are provided for use by user space utilities such as mokutil. A subsequent patch will load MOK certs into the trusted platform key ring using this infrastructure. Signed-off-by: Lenny Szubowicz <lszubowi@redhat.com> Link: https://lore.kernel.org/r/20200905013107.10457-2-lszubowi@redhat.com Signed-off-by: Ard Biesheuvel <ardb@kernel.org>
43 lines
1.5 KiB
Makefile
43 lines
1.5 KiB
Makefile
# SPDX-License-Identifier: GPL-2.0
|
|
#
|
|
# Makefile for linux kernel
|
|
#
|
|
|
|
#
|
|
# ARM64 maps efi runtime services in userspace addresses
|
|
# which don't have KASAN shadow. So dereference of these addresses
|
|
# in efi_call_virt() will cause crash if this code instrumented.
|
|
#
|
|
KASAN_SANITIZE_runtime-wrappers.o := n
|
|
|
|
obj-$(CONFIG_ACPI_BGRT) += efi-bgrt.o
|
|
obj-$(CONFIG_EFI) += efi.o vars.o reboot.o memattr.o tpm.o
|
|
obj-$(CONFIG_EFI) += capsule.o memmap.o
|
|
obj-$(CONFIG_EFI_PARAMS_FROM_FDT) += fdtparams.o
|
|
obj-$(CONFIG_EFI_VARS) += efivars.o
|
|
obj-$(CONFIG_EFI_ESRT) += esrt.o
|
|
obj-$(CONFIG_EFI_VARS_PSTORE) += efi-pstore.o
|
|
obj-$(CONFIG_UEFI_CPER) += cper.o
|
|
obj-$(CONFIG_EFI_RUNTIME_MAP) += runtime-map.o
|
|
obj-$(CONFIG_EFI_RUNTIME_WRAPPERS) += runtime-wrappers.o
|
|
subdir-$(CONFIG_EFI_STUB) += libstub
|
|
obj-$(CONFIG_EFI_FAKE_MEMMAP) += fake_map.o
|
|
obj-$(CONFIG_EFI_BOOTLOADER_CONTROL) += efibc.o
|
|
obj-$(CONFIG_EFI_TEST) += test/
|
|
obj-$(CONFIG_EFI_DEV_PATH_PARSER) += dev-path-parser.o
|
|
obj-$(CONFIG_APPLE_PROPERTIES) += apple-properties.o
|
|
obj-$(CONFIG_EFI_RCI2_TABLE) += rci2-table.o
|
|
obj-$(CONFIG_EFI_EMBEDDED_FIRMWARE) += embedded-firmware.o
|
|
obj-$(CONFIG_LOAD_UEFI_KEYS) += mokvar-table.o
|
|
|
|
fake_map-y += fake_mem.o
|
|
fake_map-$(CONFIG_X86) += x86_fake_mem.o
|
|
|
|
arm-obj-$(CONFIG_EFI) := efi-init.o arm-runtime.o
|
|
obj-$(CONFIG_ARM) += $(arm-obj-y)
|
|
obj-$(CONFIG_ARM64) += $(arm-obj-y)
|
|
obj-$(CONFIG_EFI_CAPSULE_LOADER) += capsule-loader.o
|
|
obj-$(CONFIG_EFI_EARLYCON) += earlycon.o
|
|
obj-$(CONFIG_UEFI_CPER_ARM) += cper-arm.o
|
|
obj-$(CONFIG_UEFI_CPER_X86) += cper-x86.o
|