UBUNTU: [Config] CONFIG_EFI=y on armhf, reconcile secureboot EFI settings

Enable EFI stub on armhf, also improve Secureboot config options on
arm64/armhf to be in line with x86.

BugLink: http://bugs.launchpad.net/bugs/1726362
Signed-off-by: Dimitri John Ledkov <xnox@ubuntu.com>
[ saf: set CONFIG_ALLOW_LOCKDOWN_LIFT_BY_SYSRQ=n for arm64 and armhf,
  additional annotations file updates ]
Signed-off-by: Seth Forshee <seth.forshee@canonical.com>

diff --git a/debian.master/config/amd64/config.common.amd64 b/debian.master/config/amd64/config.common.amd64
index 7e8b0a149cb92aadafe0703494727a5dbab9be48..cc31b6da88398413dfff11fc5e79395dfb3b2124 100644 (file)
--- a/debian.master/config/amd64/config.common.amd64
+++ b/debian.master/config/amd64/config.common.amd64
@@ -12,6 +12,7 @@ CONFIG_ADFS_FS=m
 CONFIG_AFFS_FS=m
 CONFIG_AIX_PARTITION=y
 CONFIG_ALIM7101_WDT=m
+CONFIG_ALLOW_LOCKDOWN_LIFT_BY_SYSRQ=y
 CONFIG_ALTERA_TSE=m
 CONFIG_AMD_XGBE_HAVE_ECC=y
 CONFIG_AMIGA_PARTITION=y
@@ -93,7 +94,6 @@ CONFIG_DUMMY_IRQ=m
 CONFIG_DW_WATCHDOG=m
 CONFIG_ECHO=m
 CONFIG_EEPROM_93CX6=m
-CONFIG_EFI=y
 CONFIG_EFI_CAPSULE_LOADER=m
 CONFIG_EFI_DEV_PATH_PARSER=y
 CONFIG_EFS_FS=m
@@ -188,7 +188,6 @@ CONFIG_LAPB=m
 CONFIG_LDM_PARTITION=y
 CONFIG_LIBNVDIMM=y
 CONFIG_LLC2=m
-CONFIG_LOCK_DOWN_IN_EFI_SECURE_BOOT=y
 CONFIG_LOCK_DOWN_KERNEL=y
 CONFIG_LOG_BUF_SHIFT=18
 CONFIG_LPC_ICH=m

diff --git a/debian.master/config/annotations b/debian.master/config/annotations
index ee1a91bc2b1cd549e410c00941bdf8058bfaaf8c..9d9fe00b4edfa3c259851212d79daf04aeefd560 100644 (file)
--- a/debian.master/config/annotations
+++ b/debian.master/config/annotations
@@ -121,11 +121,11 @@ CONFIG_64BIT                                    policy<{'amd64': 'y', 'arm64': '
 
 # Menu: Boot options
 CONFIG_CMDLINE                                  policy<{'arm64': '"console=ttyAMA0"', 'armhf': '""'}>
+CONFIG_CMDLINE_FORCE                            policy<{'arm64': 'n'}>
+CONFIG_EFI                                      policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'i386': 'y'}>
+CONFIG_DMI                                      policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'i386': 'y'}>
 CONFIG_KEXEC                                    policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'i386': 'y', 'ppc64el': 'y', 's390x': 'y'}>
 CONFIG_CRASH_DUMP                               policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'i386': 'y', 'ppc64el': 'y', 's390x': 'y'}>
-CONFIG_EFI                                      policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'n', 'i386': 'y'}>
-CONFIG_DMI                                      policy<{'amd64': 'y', 'arm64': 'y', 'i386': 'y'}>
-CONFIG_CMDLINE_FORCE                            policy<{'arm64': 'n'}>
 #
 CONFIG_CRASH_DUMP                               mark<ENFORCED> note<LP:1363180>
 CONFIG_EFI                                      flag<REVIEW>
@@ -481,8 +481,8 @@ CONFIG_X509_CERTIFICATE_PARSER                  note<module signing>
 CONFIG_MODULE_SIG_KEY                           policy<{'amd64': '"certs/signing_key.pem"', 'arm64': '"certs/signing_key.pem"', 'armhf': '"certs/signing_key.pem"', 'i386': '"certs/signing_key.pem"', 'ppc64el': '"certs/signing_key.pem"', 's390x': '"certs/signing_key.pem"'}>
 CONFIG_SYSTEM_BLACKLIST_KEYRING                 policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'i386': 'y', 'ppc64el': 'y', 's390x': 'y'}>
 CONFIG_SYSTEM_BLACKLIST_HASH_LIST               policy<{'amd64': '""', 'arm64': '""', 'armhf': '""', 'i386': '""', 'ppc64el': '""', 's390x': '""'}>
-CONFIG_EFI_SIGNATURE_LIST_PARSER                policy<{'amd64': 'y', 'arm64': 'y', 'i386': 'y'}>
-CONFIG_LOAD_UEFI_KEYS                           policy<{'amd64': 'y', 'arm64': 'y', 'i386': 'y'}>
+CONFIG_EFI_SIGNATURE_LIST_PARSER                policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'i386': 'y'}>
+CONFIG_LOAD_UEFI_KEYS                           policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'i386': 'y'}>
 #
 CONFIG_EFI_SIGNATURE_LIST_PARSER                mark<ENFORCED>
 CONFIG_LOAD_UEFI_KEYS                           mark<ENFORCED>
@@ -1952,7 +1952,7 @@ CONFIG_FB_IMSTT                                 policy<{'amd64': 'y', 'arm64': '
 CONFIG_FB_VGA16                                 policy<{'amd64': 'm', 'i386': 'm', 'ppc64el': 'm'}>
 CONFIG_FB_UVESA                                 policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'i386': 'm', 'ppc64el': 'm'}>
 CONFIG_FB_VESA                                  policy<{'amd64': 'y', 'i386': 'y'}>
-CONFIG_FB_EFI                                   policy<{'amd64': 'y', 'arm64': 'y', 'i386': 'y'}>
+CONFIG_FB_EFI                                   policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'i386': 'y'}>
 CONFIG_FB_N411                                  policy<{'amd64': 'm', 'i386': 'm'}>
 CONFIG_FB_HGA                                   policy<{'amd64': 'm', 'i386': 'm'}>
 CONFIG_FB_OPENCORES                             policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'i386': 'm', 'ppc64el': 'm'}>
@@ -6221,7 +6221,7 @@ CONFIG_RTC_DRV_DS2404                           policy<{'amd64': 'm', 'arm64': '
 CONFIG_RTC_DRV_DA9052                           policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'i386': 'm', 'ppc64el': 'm'}>
 CONFIG_RTC_DRV_DA9055                           policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'i386': 'm', 'ppc64el': 'm'}>
 CONFIG_RTC_DRV_DA9063                           policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'i386': 'm', 'ppc64el': 'm'}>
-CONFIG_RTC_DRV_EFI                              policy<{'arm64': 'y'}>
+CONFIG_RTC_DRV_EFI                              policy<{'arm64': 'y', 'armhf': 'y'}>
 CONFIG_RTC_DRV_STK17TA8                         policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'i386': 'm', 'ppc64el': 'm'}>
 CONFIG_RTC_DRV_M48T86                           policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'i386': 'm', 'ppc64el': 'm'}>
 CONFIG_RTC_DRV_M48T35                           policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'i386': 'm', 'ppc64el': 'm'}>
@@ -9092,7 +9092,7 @@ CONFIG_TMPFS_POSIX_ACL                          policy<{'amd64': 'y', 'arm64': '
 CONFIG_TMPFS_XATTR                              policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'i386': 'y', 'ppc64el': 'y', 's390x': 'y'}>
 CONFIG_HUGETLBFS                                policy<{'amd64': 'y', 'arm64': 'y', 'armhf-generic-lpae': 'y', 'i386': 'y', 'ppc64el': 'y', 's390x': 'y'}>
 CONFIG_CONFIGFS_FS                              policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'i386': 'y', 'ppc64el': 'y', 's390x': 'y'}>
-CONFIG_EFIVAR_FS                                policy<{'amd64': 'y', 'arm64': 'y', 'i386': 'y'}>
+CONFIG_EFIVAR_FS                                policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'i386': 'y'}>
 #
 CONFIG_CONFIGFS_FS                              flag<REVIEW>
 CONFIG_EFIVAR_FS                                note<needed for variable EFI update>
@@ -9146,8 +9146,8 @@ CONFIG_EDD_OFF                                  policy<{'amd64': 'y', 'i386': 'y
 CONFIG_FIRMWARE_MEMMAP                          policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'i386': 'y'}>
 CONFIG_DELL_RBU                                 policy<{'amd64': 'm', 'i386': 'm'}>
 CONFIG_DCDBAS                                   policy<{'amd64': 'm', 'i386': 'm'}>
-CONFIG_DMIID                                    policy<{'amd64': 'y', 'arm64': 'y', 'i386': 'y'}>
-CONFIG_DMI_SYSFS                                policy<{'amd64': 'm', 'arm64': 'm', 'i386': 'm'}>
+CONFIG_DMIID                                    policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'i386': 'y'}>
+CONFIG_DMI_SYSFS                                policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'i386': 'm'}>
 CONFIG_ISCSI_IBFT_FIND                          policy<{'amd64': 'y', 'i386': 'y'}>
 CONFIG_ISCSI_IBFT                               policy<{'amd64': 'm', 'i386': 'm'}>
 CONFIG_RASPBERRYPI_FIRMWARE                     policy<{'arm64': 'y'}>
@@ -9156,17 +9156,17 @@ CONFIG_FW_CFG_SYSFS_CMDLINE                     policy<{'amd64': 'n', 'arm64': '
 CONFIG_QCOM_SCM_DOWNLOAD_MODE_DEFAULT           policy<{'arm64': 'n', 'armhf': 'n'}>
 
 # Menu: Firmware Drivers >> EFI (Extensible Firmware Interface) Support
-CONFIG_EFI_VARS                                 policy<{'amd64': 'y', 'arm64': 'y', 'i386': 'y'}>
-CONFIG_EFI_VARS_PSTORE                          policy<{'amd64': 'm', 'arm64': 'm', 'i386': 'm'}>
-CONFIG_EFI_VARS_PSTORE_DEFAULT_DISABLE          policy<{'amd64': 'n', 'arm64': 'n', 'i386': 'n'}>
+CONFIG_EFI_VARS                                 policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'i386': 'y'}>
+CONFIG_EFI_VARS_PSTORE                          policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'i386': 'm'}>
+CONFIG_EFI_VARS_PSTORE_DEFAULT_DISABLE          policy<{'amd64': 'n', 'arm64': 'n', 'armhf': 'n', 'i386': 'n'}>
 CONFIG_EFI_RUNTIME_MAP                          policy<{'amd64': 'y', 'i386': 'y'}>
 CONFIG_EFI_FAKE_MEMMAP                          policy<{'amd64': 'n', 'i386': 'n'}>
-CONFIG_EFI_BOOTLOADER_CONTROL                   policy<{'amd64': 'm', 'arm64': 'm', 'i386': 'm'}>
-CONFIG_EFI_CAPSULE_LOADER                       policy<{'amd64': 'm', 'arm64': 'm', 'i386': 'y'}>
+CONFIG_EFI_BOOTLOADER_CONTROL                   policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'i386': 'm'}>
+CONFIG_EFI_CAPSULE_LOADER                       policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'i386': 'y'}>
 CONFIG_EFI_CAPSULE_QUIRK_QUARK_CSH              policy<{'i386': 'y'}>
-CONFIG_EFI_TEST                                 policy<{'amd64': 'm', 'arm64': 'm', 'i386': 'm'}>
+CONFIG_EFI_TEST                                 policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'i386': 'm'}>
 CONFIG_APPLE_PROPERTIES                         policy<{'amd64': 'y', 'i386': 'y'}>
-CONFIG_RESET_ATTACK_MITIGATION                  policy<{'amd64': 'y', 'arm64': 'y', 'i386': 'y'}>
+CONFIG_RESET_ATTACK_MITIGATION                  policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'i386': 'y'}>
 #
 CONFIG_EFI_VARS                                 mark<ENFORCED> note<EFI boot requirement (d-i) LP:#837332>
 
@@ -11248,7 +11248,7 @@ CONFIG_X86_SMAP                                 policy<{'amd64': 'y', 'i386': 'y
 CONFIG_X86_INTEL_UMIP                           policy<{'amd64': 'y', 'i386': 'y'}>
 CONFIG_X86_INTEL_MPX                            policy<{'amd64': 'y'}>
 CONFIG_X86_INTEL_MEMORY_PROTECTION_KEYS         policy<{'amd64': 'y'}>
-CONFIG_EFI_STUB                                 policy<{'amd64': 'y', 'arm64': 'y', 'i386': 'y'}>
+CONFIG_EFI_STUB                                 policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'i386': 'y'}>
 CONFIG_EFI_MIXED                                policy<{'amd64': 'y'}>
 CONFIG_KEXEC_VERIFY_SIG                         policy<{'amd64': 'y'}>
 CONFIG_KEXEC_BZIMAGE_VERIFY_SIG                 policy<{'amd64': 'y'}>
@@ -11503,9 +11503,9 @@ CONFIG_HARDENED_USERCOPY                        policy<{'amd64': 'y', 'arm64': '
 CONFIG_HARDENED_USERCOPY_PAGESPAN               policy<{'amd64': 'n', 'arm64': 'n', 'armhf': 'n', 'i386': 'n', 'ppc64el': 'n', 's390x': 'n'}>
 CONFIG_FORTIFY_SOURCE                           policy<{'amd64': 'y', 'arm64': 'y', 'i386': 'y', 'ppc64el': 'y', 's390x': 'y'}>
 CONFIG_STATIC_USERMODEHELPER                    policy<{'amd64': 'n', 'arm64': 'n', 'armhf': 'n', 'i386': 'n', 'ppc64el': 'n', 's390x': 'n'}>
-CONFIG_LOCK_DOWN_KERNEL                         policy<{'amd64': 'y', 'arm64': 'n', 'armhf': 'n', 'i386': 'y', 'ppc64el': 'n', 's390x': 'n'}>
-CONFIG_ALLOW_LOCKDOWN_LIFT_BY_SYSRQ             policy<{'amd64': 'y', 'i386': 'y'}>
-CONFIG_LOCK_DOWN_IN_EFI_SECURE_BOOT             policy<{'amd64': 'y', 'arm64': 'n', 'i386': 'y'}>
+CONFIG_LOCK_DOWN_KERNEL                         policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'i386': 'y', 'ppc64el': 'n', 's390x': 'n'}>
+CONFIG_ALLOW_LOCKDOWN_LIFT_BY_SYSRQ             policy<{'amd64': 'y', 'arm64': 'n', 'armhf': 'n', 'i386': 'y'}>
+CONFIG_LOCK_DOWN_IN_EFI_SECURE_BOOT             policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'i386': 'y'}>
 #
 CONFIG_LOCK_DOWN_IN_EFI_SECURE_BOOT             mark<ENFORCED>
 CONFIG_ALLOW_LOCKDOWN_LIFT_BY_SYSRQ             mark<ENFORCED>

diff --git a/debian.master/config/arm64/config.common.arm64 b/debian.master/config/arm64/config.common.arm64
index 5afe8dcef6201a2c78c0e4941936d1e1b9c0c375..89e615fced030f268092f6a86898b55fd3fc5973 100644 (file)
--- a/debian.master/config/arm64/config.common.arm64
+++ b/debian.master/config/arm64/config.common.arm64
@@ -12,6 +12,7 @@ CONFIG_ADFS_FS=m
 CONFIG_AFFS_FS=m
 CONFIG_AIX_PARTITION=y
 CONFIG_ALIM7101_WDT=m
+# CONFIG_ALLOW_LOCKDOWN_LIFT_BY_SYSRQ is not set
 CONFIG_ALTERA_TSE=m
 # CONFIG_AMD_XGBE_HAVE_ECC is not set
 CONFIG_AMIGA_PARTITION=y
@@ -104,7 +105,6 @@ CONFIG_DUMMY_IRQ=m
 CONFIG_DW_WATCHDOG=m
 CONFIG_ECHO=m
 CONFIG_EEPROM_93CX6=m
-CONFIG_EFI=y
 CONFIG_EFI_CAPSULE_LOADER=m
 # CONFIG_EFI_DEV_PATH_PARSER is not set
 CONFIG_EFS_FS=m
@@ -206,8 +206,7 @@ CONFIG_LAPB=m
 CONFIG_LDM_PARTITION=y
 CONFIG_LIBNVDIMM=y
 CONFIG_LLC2=m
-# CONFIG_LOCK_DOWN_IN_EFI_SECURE_BOOT is not set
-# CONFIG_LOCK_DOWN_KERNEL is not set
+CONFIG_LOCK_DOWN_KERNEL=y
 CONFIG_LOG_BUF_SHIFT=14
 CONFIG_LPC_ICH=m
 CONFIG_LPC_SCH=m

diff --git a/debian.master/config/armhf/config.common.armhf b/debian.master/config/armhf/config.common.armhf
index cfda4ad50ecc43263ceb467096a26b8334a0bdb1..180cb080ac499cd322eadccfe764d386071696d1 100644 (file)
--- a/debian.master/config/armhf/config.common.armhf
+++ b/debian.master/config/armhf/config.common.armhf
@@ -8,6 +8,7 @@ CONFIG_ADFS_FS=m
 CONFIG_AFFS_FS=m
 CONFIG_AIX_PARTITION=y
 CONFIG_ALIM7101_WDT=m
+# CONFIG_ALLOW_LOCKDOWN_LIFT_BY_SYSRQ is not set
 CONFIG_ALTERA_TSE=m
 # CONFIG_AMD_XGBE_HAVE_ECC is not set
 CONFIG_AMIGA_PARTITION=y
@@ -91,7 +92,7 @@ CONFIG_DUMMY_IRQ=m
 CONFIG_DW_WATCHDOG=m
 CONFIG_ECHO=m
 CONFIG_EEPROM_93CX6=m
-# CONFIG_EFI is not set
+CONFIG_EFI_CAPSULE_LOADER=m
 CONFIG_EFS_FS=m
 CONFIG_EM_TIMER_STI=y
 CONFIG_ENCLOSURE_SERVICES=m
@@ -184,7 +185,7 @@ CONFIG_LAPB=m
 CONFIG_LDM_PARTITION=y
 CONFIG_LIBNVDIMM=y
 CONFIG_LLC2=m
-# CONFIG_LOCK_DOWN_KERNEL is not set
+CONFIG_LOCK_DOWN_KERNEL=y
 CONFIG_LOG_BUF_SHIFT=17
 CONFIG_LPC_ICH=m
 CONFIG_LPC_SCH=m

diff --git a/debian.master/config/config.common.ubuntu b/debian.master/config/config.common.ubuntu
index 01a46ef21695cf5705ec986bcd93087a9f2975a1..4466c92a283043bea42505507c710b1f9d725184 100644 (file)
--- a/debian.master/config/config.common.ubuntu
+++ b/debian.master/config/config.common.ubuntu
@@ -245,7 +245,6 @@ CONFIG_ALIM1535_WDT=m
 CONFIG_ALIX=y
 CONFIG_ALI_FIR=m
 CONFIG_ALLOW_DEV_COREDUMP=y
-CONFIG_ALLOW_LOCKDOWN_LIFT_BY_SYSRQ=y
 CONFIG_ALPINE_MSI=y
 CONFIG_ALTERA_MBOX=m
 CONFIG_ALTERA_MSGDMA=m
@@ -2671,6 +2670,7 @@ CONFIG_EEPROM_AT25=m
 CONFIG_EEPROM_IDT_89HPESX=m
 CONFIG_EEPROM_LEGACY=m
 CONFIG_EEPROM_MAX6875=m
+CONFIG_EFI=y
 CONFIG_EFIVAR_FS=y
 CONFIG_EFI_ARMSTUB=y
 CONFIG_EFI_BOOTLOADER_CONTROL=m
@@ -4875,6 +4875,7 @@ CONFIG_LOCKD=m
 CONFIG_LOCKDEP_SUPPORT=y
 CONFIG_LOCKD_V4=y
 CONFIG_LOCKUP_DETECTOR=y
+CONFIG_LOCK_DOWN_IN_EFI_SECURE_BOOT=y
 CONFIG_LOCK_SPIN_ON_OWNER=y
 # CONFIG_LOCK_STAT is not set
 # CONFIG_LOCK_TORTURE_TEST is not set

diff --git a/debian.master/config/i386/config.common.i386 b/debian.master/config/i386/config.common.i386
index 77843dd7f9fc4b181c979b26e219a5551709504c..759d77db36d2534c3ad78cd11a0dc83168f9f513 100644 (file)
--- a/debian.master/config/i386/config.common.i386
+++ b/debian.master/config/i386/config.common.i386
@@ -12,6 +12,7 @@ CONFIG_ADFS_FS=m
 CONFIG_AFFS_FS=m
 CONFIG_AIX_PARTITION=y
 CONFIG_ALIM7101_WDT=m
+CONFIG_ALLOW_LOCKDOWN_LIFT_BY_SYSRQ=y
 CONFIG_ALTERA_TSE=m
 CONFIG_AMD_XGBE_HAVE_ECC=y
 CONFIG_AMIGA_PARTITION=y
@@ -89,7 +90,6 @@ CONFIG_DUMMY_IRQ=m
 CONFIG_DW_WATCHDOG=m
 CONFIG_ECHO=m
 CONFIG_EEPROM_93CX6=m
-CONFIG_EFI=y
 CONFIG_EFI_CAPSULE_LOADER=y
 CONFIG_EFI_DEV_PATH_PARSER=y
 CONFIG_EFS_FS=m
@@ -184,7 +184,6 @@ CONFIG_LAPB=m
 CONFIG_LDM_PARTITION=y
 CONFIG_LIBNVDIMM=y
 CONFIG_LLC2=m
-CONFIG_LOCK_DOWN_IN_EFI_SECURE_BOOT=y
 CONFIG_LOCK_DOWN_KERNEL=y
 CONFIG_LOG_BUF_SHIFT=17
 CONFIG_LPC_ICH=m