tree 2ac58b6706965be98963dff2b30e45aeb37f66ae
parent d2e1601cf4c8a0df21c08b9c8acf22e9cb631c5c
author Michael Brown <mcb30@ipxe.org> 1684850108 +0100
committer Michael Brown <mcb30@ipxe.org> 1684850272 +0100

[efi] Support versions of shim that perform SBAT verification

The UEFI shim implements a fairly nicely designed revocation mechanism
designed around the concept of security generations.  Unfortunately
nobody in the shim community has thus far added the relevant metadata
to the Linux kernel, with the result that current versions of shim are
incapable of booting current versions of the Linux kernel.

Experience shows that there is unfortunately no point in trying to get
a fix for this upstreamed into shim.  We therefore default to working
around this undesirable behaviour by patching data read from the
"SbatLevel" variable used to hold SBAT configuration.

Signed-off-by: Michael Brown <mcb30@ipxe.org>