acpi: Disable ACPI table override if securelevel is set
authorLinn Crosetto <linn@hpe.com>
Fri, 4 Mar 2016 23:08:24 +0000 (16:08 -0700)
committerBen Hutchings <ben@decadent.org.uk>
Sun, 4 Jun 2017 02:03:01 +0000 (02:03 +0000)
commit76eb4fc65a7f996a9fce9e0e4c441b4055bcbb7a
treed0ee8369a00615c02edbb7303e592ec07394fa76
parent093f7db8f44d87fb7a7fa10fb9e9d9cc7925242f
acpi: Disable ACPI table override if securelevel is set

From the kernel documentation (initrd_table_override.txt):

  If the ACPI_INITRD_TABLE_OVERRIDE compile option is true, it is possible
  to override nearly any ACPI table provided by the BIOS with an
  instrumented, modified one.

When securelevel is set, the kernel should disallow any unauthenticated
changes to kernel space. ACPI tables contain code invoked by the kernel, so
do not allow ACPI tables to be overridden if securelevel is set.

Signed-off-by: Linn Crosetto <linn@hpe.com>
[bwh: Forward-ported to 4.7: ACPI override code moved to drivers/acpi/tables.c]
[bwh: Forward-ported to 4.9: adjust context]

Gbp-Pq: Topic features/all/securelevel
Gbp-Pq: Name acpi-disable-acpi-table-override-if-securelevel-is-s.patch
arch/x86/kernel/setup.c
drivers/acpi/tables.c