acpi: Disable ACPI table override if securelevel is set
authorLinn Crosetto <linn@hpe.com>
Fri, 4 Mar 2016 23:08:24 +0000 (16:08 -0700)
committerSalvatore Bonaccorso <carnil@debian.org>
Fri, 2 Dec 2016 05:35:22 +0000 (05:35 +0000)
commit4da1b79d5b089bec5539bbab664a60799f2dc3a8
tree7add20c35f3e3b243ad1fd84885ed8695480814c
parent8f0b225e1952c3ca89191f6857528bc9c0c11d4a
acpi: Disable ACPI table override if securelevel is set

From the kernel documentation (initrd_table_override.txt):

  If the ACPI_INITRD_TABLE_OVERRIDE compile option is true, it is possible
  to override nearly any ACPI table provided by the BIOS with an
  instrumented, modified one.

When securelevel is set, the kernel should disallow any unauthenticated
changes to kernel space. ACPI tables contain code invoked by the kernel, so
do not allow ACPI tables to be overridden if securelevel is set.

Signed-off-by: Linn Crosetto <linn@hpe.com>
[bwh: Forward-ported to 4.7: ACPI override code moved to drivers/acpi/tables.c]

Gbp-Pq: Topic features/all/securelevel
Gbp-Pq: Name acpi-disable-acpi-table-override-if-securelevel-is-s.patch
arch/x86/kernel/setup.c
drivers/acpi/tables.c