From 79cdb2a215de2ace7d1bf0a294165a04b726c70a Mon Sep 17 00:00:00 2001
From: Hans de Goede <hdegoede@redhat.com>
Date: Thu, 8 Mar 2018 15:23:27 +0100
Subject: [PATCH] Fix failure to boot on systems without a TPM

This commit fixes 2 issues with the TPM support code:

1) Remove "REQUIRE_TPM ?=" line from the Makefile, further down the Makefile
checks if REQUIRE_TPM is undefined, but the above line sets it to an empty
string, which is not the same as undefined. Without this handle_image fails
after the tpm_log_pe() call even if REQUIRE_TPM=1 once was not set when
building the shim

2) When secure-boot is disabled then shim_verify() would exit with the
status of tpm_log_pe(), which on systems with a TPM is an error. Combined
with the recent change to always install the shim protocols, this causes
grub to refuse to boot any kernel since the verify() call now always fails.
This commit fixes this by explicitly setting status = EFI_SUCCESS when
secure-boot is disabled.

Signed-off-by: Hans de Goede <hdegoede@redhat.com>
---
 Makefile | 1 -
 shim.c   | 4 +++-
 2 files changed, 3 insertions(+), 2 deletions(-)

diff --git a/Makefile b/Makefile
index 9ab1992..6fb616b 100644
--- a/Makefile
+++ b/Makefile
@@ -33,7 +33,6 @@ DEBUGINFO	?= $(prefix)/lib/debug/
 DEBUGSOURCE	?= $(prefix)/src/debug/
 OSLABEL		?= $(EFIDIR)
 DEFAULT_LOADER	?= \\\\grub$(ARCH_SUFFIX).efi
-REQUIRE_TPM	?=
 
 ARCH		?= $(shell $(CC) -dumpmachine | cut -f1 -d- | sed s,i[3456789]86,ia32,)
 OBJCOPY_GTE224	= $(shell expr `$(OBJCOPY) --version |grep ^"GNU objcopy" | sed 's/^.*\((.*)\|version\) //g' | cut -f1-2 -d.` \>= 2.24)
diff --git a/shim.c b/shim.c
index 34b819a..6d777d8 100644
--- a/shim.c
+++ b/shim.c
@@ -1829,8 +1829,10 @@ EFI_STATUS shim_verify (void *buffer, UINT32 size)
 		goto done;
 #endif
 
-	if (!secure_mode())
+	if (!secure_mode()) {
+		status = EFI_SUCCESS;
 		goto done;
+	}
 
 	status = verify_buffer(buffer, size, &context, sha256hash, sha1hash);