acpi: Disable ACPI table override if securelevel is set
authorLinn Crosetto <linn@hpe.com>
Fri, 4 Mar 2016 23:08:24 +0000 (16:08 -0700)
committerAurelien Jarno <aurel32@debian.org>
Fri, 2 Mar 2018 07:52:22 +0000 (07:52 +0000)
commit6ed1796741251884d4addaf351ca5958c06fa56c
tree278fc9f7d3657832b0913ec125b966f1a35806ec
parent51545e405171d0e51cc8260656effbc3c2678aa9
acpi: Disable ACPI table override if securelevel is set

From the kernel documentation (initrd_table_override.txt):

  If the ACPI_INITRD_TABLE_OVERRIDE compile option is true, it is possible
  to override nearly any ACPI table provided by the BIOS with an
  instrumented, modified one.

When securelevel is set, the kernel should disallow any unauthenticated
changes to kernel space. ACPI tables contain code invoked by the kernel, so
do not allow ACPI tables to be overridden if securelevel is set.

Signed-off-by: Linn Crosetto <linn@hpe.com>
[bwh: Forward-ported to 4.7: ACPI override code moved to drivers/acpi/tables.c]
[bwh: Forward-ported to 4.9: adjust context]

Gbp-Pq: Topic features/all/securelevel
Gbp-Pq: Name acpi-disable-acpi-table-override-if-securelevel-is-s.patch
arch/x86/kernel/setup.c
drivers/acpi/tables.c