Merge ~xnox/shim:post-15.4-bugfixes into ~ubuntu-core-dev/shim/+git/shim:master

[Dimitri John Ledkov]

Add two more cherrypicks from upstream.

[Julian Andres Klode (juliank)]

I approve of these changes

review: Approve

diff --git a/debian/changelog b/debian/changelog
index f403ee7..d1fa4fa 100644
--- a/debian/changelog
+++ b/debian/changelog
@@ -1,7 +1,12 @@
 shim (15.4-0ubuntu2) UNRELEASED; urgency=medium
 
+  [ Balint Reczey ]
   * Fix boot on EFI 1.10 machines, for example on some MacBooks (LP: #1925010)
 
+  [ Dimitri John Ledkov ]
+  * Fix kernel warning when allocating MOK table (LP: #1925139)
+  * Fix booting with shim SBState disabled (LP: #1925140)
+
  -- Balint Reczey <[e-mail]>  Mon, 19 Apr 2021 15:52:50 +0200
 
 shim (15.4-0ubuntu1) hirsute; urgency=medium
diff --git a/debian/patches/361.patch b/debian/patches/361.patch
new file mode 100644
index 0000000..766e9a4
--- /dev/null
+++ b/debian/patches/361.patch
@@ -0,0 +1,38 @@
+From 33ca95024aa7e33218da5882d30b3ec690a11046 Mon Sep 17 00:00:00 2001
+From: Gary Lin <[e-mail]>
+Date: Thu, 8 Apr 2021 16:23:03 +0800
+Subject: [PATCH] mok: allocate MOK config table as BootServicesData
+
+Linux kernel is picky when reserving the memory for x86 and it only
+expects BootServicesData:
+
+https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/tree/arch/x86/platform/efi/quirks.c?h=v5.11#n254
+
+Otherwise, the following error would show during system boot:
+
+Apr 07 12:31:56.743925 localhost kernel: efi: Failed to lookup EFI memory descriptor for 0x000000003dcf8000
+
+Although BootServicesData would be reclaimed after ExitBootService(),
+linux kernel reserves MOK config table when it detects the existence of
+the table, so it's fine to allocate the table as BootServicesData.
+
+Signed-off-by: Gary Lin <[e-mail]>
+Origin: https://patch-diff.githubusercontent.com/raw/rhboot/shim/pull/361.patch
+Bug-Ubuntu: https://bugs.launchpad.net/ubuntu/+source/shim/+bug/1925139
+---
+ mok.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/mok.c b/mok.c
+index 5ad9072be..fc1ee04da 100644
+--- a/mok.c
++++ b/mok.c
+@@ -1002,7 +1002,7 @@ EFI_STATUS import_mok_state(EFI_HANDLE image_handle)
+ 		npages = ALIGN_VALUE(config_sz, PAGE_SIZE) >> EFI_PAGE_SHIFT;
+ 		config_table = NULL;
+ 		efi_status = gBS->AllocatePages(AllocateAnyPages,
+-						EfiRuntimeServicesData,
++						EfiBootServicesData,
+ 						npages,
+ 						(EFI_PHYSICAL_ADDRESS *)&config_table);
+ 		if (EFI_ERROR(efi_status) || !config_table) {
diff --git a/debian/patches/362.patch b/debian/patches/362.patch
new file mode 100644
index 0000000..488b14b
--- /dev/null
+++ b/debian/patches/362.patch
@@ -0,0 +1,37 @@
+From 975c2feaa47dc3b8d42d2995e09b5026ce66d7af Mon Sep 17 00:00:00 2001
+From: Adam Williamson <[e-mail]>
+Date: Thu, 8 Apr 2021 22:39:02 -0700
+Subject: [PATCH] Don't set user_insecure_mode and ignore_db in
+ import_one_mok_state
+
+This seems completely incorrect and unnecessary, unless I'm
+missing something. We already set them both to 0 at the start of
+`import_mok_state`, which is the only thing that uses
+`import_one_mok_state`, so it's unnecessary. It's incorrect
+because it means those variables will be set to 0 even when they
+should be set to 1 - even if they are momentarily set to 1 when
+`import_one_mok_state` is called on the relevant variable, they
+immediately get set back to 0 when it's called on the *next*
+variable.
+
+Signed-off-by: Adam Williamson <[e-mail]>
+Origin: https://patch-diff.githubusercontent.com/raw/rhboot/shim/pull/361.patch
+Bug-Ubuntu: https://bugs.launchpad.net/ubuntu/+source/shim/+bug/1925140
+---
+ mok.c | 3 ---
+ 1 file changed, 3 deletions(-)
+
+diff --git a/mok.c b/mok.c
+index 5ad9072be..9e37d6ab5 100644
+--- a/mok.c
++++ b/mok.c
+@@ -888,9 +888,6 @@ EFI_STATUS import_one_mok_state(struct mok_state_variable *v,
+ 	EFI_STATUS ret = EFI_SUCCESS;
+ 	EFI_STATUS efi_status;
+ 
+-	user_insecure_mode = 0;
+-	ignore_db = 0;
+-
+ 	UINT32 attrs = 0;
+ 	BOOLEAN delete = FALSE;
+ 
diff --git a/debian/patches/series b/debian/patches/series
index 17e624f..ab362be 100644
--- a/debian/patches/series
+++ b/debian/patches/series
@@ -1,2 +1,4 @@
 359.patch
+361.patch
+362.patch
 364.patch