acpi: Disable ACPI table override if securelevel is set
authorLinn Crosetto <linn@hpe.com>
Fri, 4 Mar 2016 23:08:24 +0000 (16:08 -0700)
committerBen Hutchings <ben@decadent.org.uk>
Sat, 23 Dec 2017 00:39:51 +0000 (00:39 +0000)
commit45d58db9d7a0f0d40a522a4f74c3936181ff018e
tree5588797364cfd68a0bc63ed761e827a8a57ac43b
parent2eea2b3d166b3bc7c56f345cb507fa5a2638eccd
acpi: Disable ACPI table override if securelevel is set

From the kernel documentation (initrd_table_override.txt):

  If the ACPI_INITRD_TABLE_OVERRIDE compile option is true, it is possible
  to override nearly any ACPI table provided by the BIOS with an
  instrumented, modified one.

When securelevel is set, the kernel should disallow any unauthenticated
changes to kernel space. ACPI tables contain code invoked by the kernel, so
do not allow ACPI tables to be overridden if securelevel is set.

Signed-off-by: Linn Crosetto <linn@hpe.com>
[bwh: Forward-ported to 4.7: ACPI override code moved to drivers/acpi/tables.c]
[bwh: Forward-ported to 4.9: adjust context]

Gbp-Pq: Topic features/all/securelevel
Gbp-Pq: Name acpi-disable-acpi-table-override-if-securelevel-is-s.patch
arch/x86/kernel/setup.c
drivers/acpi/tables.c