[PATCH -for-stable-v6.6+ 0/6] EFI/x86 updates for secure boot

[Ard Biesheuvel <ardb+git@google.com>]

From: Ard Biesheuvel <ardb@kernel.org>

Please merge the attached series into stable branches v6.6 and v6.8.
They backport changes that are part of the work to harden the EFI stub
and make it compatible with MS requirements on EFI memory protections on
secure boot enabled systems.

Note that the first patch by Hou Wenlong is already in v6.8. The
remaining ones should apply equally to v6.6 and v6.8. Only patch #5 was
tweaked for context changes due to backports that overtook this one.

Thanks.

Ard Biesheuvel (5):
  efi/libstub: Add generic support for parsing mem_encrypt=
  x86/boot: Move mem_encrypt= parsing to the decompressor
  x86/sme: Move early SME kernel encryption handling into .head.text
  x86/sev: Move early startup code into .head.text section
  x86/efistub: Remap kernel text read-only before dropping NX attribute

Hou Wenlong (1):
  x86/head/64: Move the __head definition to <asm/init.h>

 arch/x86/boot/compressed/Makefile              |  2 +-
 arch/x86/boot/compressed/misc.c                | 16 +++++
 arch/x86/boot/compressed/sev.c                 |  3 +
 arch/x86/include/asm/boot.h                    |  1 +
 arch/x86/include/asm/init.h                    |  2 +
 arch/x86/include/asm/mem_encrypt.h             |  8 +--
 arch/x86/include/asm/sev.h                     | 10 +--
 arch/x86/include/uapi/asm/bootparam.h          |  1 +
 arch/x86/kernel/head64.c                       |  3 +-
 arch/x86/kernel/sev-shared.c                   | 23 +++---
 arch/x86/kernel/sev.c                          | 14 ++--
 arch/x86/lib/Makefile                          | 13 ----
 arch/x86/mm/mem_encrypt_identity.c             | 74 ++++++--------------
 drivers/firmware/efi/libstub/efi-stub-helper.c |  8 +++
 drivers/firmware/efi/libstub/efistub.h         |  2 +-
 drivers/firmware/efi/libstub/x86-stub.c        | 14 +++-
 16 files changed, 94 insertions(+), 100 deletions(-)

-- 
2.44.0.478.gd926399ef9-goog