From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-6.8 required=3.0 tests=DKIMWL_WL_HIGH,DKIM_SIGNED, DKIM_VALID,HEADER_FROM_DIFFERENT_DOMAINS,MAILING_LIST_MULTI,SIGNED_OFF_BY, SPF_HELO_NONE,SPF_PASS,URIBL_BLOCKED,USER_AGENT_GIT autolearn=unavailable autolearn_force=no version=3.4.0 Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id 511E2C4332F for ; Sun, 8 Sep 2019 12:46:38 +0000 (UTC) Received: from vger.kernel.org (vger.kernel.org [209.132.180.67]) by mail.kernel.org (Postfix) with ESMTP id 2A555218AE for ; Sun, 8 Sep 2019 12:46:38 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=default; t=1567946798; bh=LtTjOxgtRGF6LCCtjHjnp/619AMlBzyRmzOQMaARqIw=; h=From:To:Cc:Subject:Date:In-Reply-To:References:List-ID:From; b=T6a/RSaHHPAMA0aEx9gW9P9x3lUdGK9BN8Gj0+tDXnmQ1CGv7RiaVF846LraRJSWi pytZaQymcdF87EpTMi2qaxgH65/nM6iaBhiHMN37JWZPJvHunLEE8Rt9bxuJjtOOjc wnTKkZJa9o2tJ495dyTYHTi1AGN5FCYjw0QwfnTc= Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1730430AbfIHMqh (ORCPT ); Sun, 8 Sep 2019 08:46:37 -0400 Received: from mail.kernel.org ([198.145.29.99]:34166 "EHLO mail.kernel.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1730389AbfIHMqa (ORCPT ); Sun, 8 Sep 2019 08:46:30 -0400 Received: from localhost (unknown [62.28.240.114]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by mail.kernel.org (Postfix) with ESMTPSA id CF6EE218AE; Sun, 8 Sep 2019 12:46:28 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=default; t=1567946789; bh=LtTjOxgtRGF6LCCtjHjnp/619AMlBzyRmzOQMaARqIw=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=n3oOGTwg/w3qVY4gu05fuUaV829mV5/zaqOzLxEhePJ5ZD6AopAC0ZGrb6AveIimu YJQyigA+dgwbKrenneyNMH/uP9MjyvIZoE0zw/QdzxZfH15+lhYnG5b7uarsclM/mw B2143Ny67JWdJ3exvlWYxA8+kpabDUNrADdzYSio= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, "John S. Gruber" , Borislav Petkov , John Hubbard , "H. Peter Anvin" , Ingo Molnar , Juergen Gross , Mark Brown , Thomas Gleixner , x86-ml Subject: [PATCH 4.14 40/40] x86/boot: Preserve boot_params.secure_boot from sanitizing Date: Sun, 8 Sep 2019 13:42:13 +0100 Message-Id: <20190908121132.874903916@linuxfoundation.org> X-Mailer: git-send-email 2.23.0 In-Reply-To: <20190908121114.260662089@linuxfoundation.org> References: <20190908121114.260662089@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Sender: linux-kernel-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org From: John S. Gruber commit 29d9a0b50736768f042752070e5cdf4e4d4c00df upstream. Commit a90118c445cc ("x86/boot: Save fields explicitly, zero out everything else") now zeroes the secure boot setting information (enabled/disabled/...) passed by the boot loader or by the kernel's EFI handover mechanism. The problem manifests itself with signed kernels using the EFI handoff protocol with grub and the kernel loses the information whether secure boot is enabled in the firmware, i.e., the log message "Secure boot enabled" becomes "Secure boot could not be determined". efi_main() arch/x86/boot/compressed/eboot.c sets this field early but it is subsequently zeroed by the above referenced commit. Include boot_params.secure_boot in the preserve field list. [ bp: restructure commit message and massage. ] Fixes: a90118c445cc ("x86/boot: Save fields explicitly, zero out everything else") Signed-off-by: John S. Gruber Signed-off-by: Borislav Petkov Reviewed-by: John Hubbard Cc: "H. Peter Anvin" Cc: Ingo Molnar Cc: Juergen Gross Cc: Mark Brown Cc: stable Cc: Thomas Gleixner Cc: x86-ml Link: https://lkml.kernel.org/r/CAPotdmSPExAuQcy9iAHqX3js_fc4mMLQOTr5RBGvizyCOPcTQQ@mail.gmail.com Signed-off-by: Greg Kroah-Hartman --- arch/x86/include/asm/bootparam_utils.h | 1 + 1 file changed, 1 insertion(+) --- a/arch/x86/include/asm/bootparam_utils.h +++ b/arch/x86/include/asm/bootparam_utils.h @@ -71,6 +71,7 @@ static void sanitize_boot_params(struct BOOT_PARAM_PRESERVE(eddbuf_entries), BOOT_PARAM_PRESERVE(edd_mbr_sig_buf_entries), BOOT_PARAM_PRESERVE(edd_mbr_sig_buffer), + BOOT_PARAM_PRESERVE(secure_boot), BOOT_PARAM_PRESERVE(hdr), BOOT_PARAM_PRESERVE(e820_table), BOOT_PARAM_PRESERVE(eddbuf),