From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-6.8 required=3.0 tests=DKIMWL_WL_HIGH,DKIM_SIGNED, DKIM_VALID,HEADER_FROM_DIFFERENT_DOMAINS,MAILING_LIST_MULTI,SIGNED_OFF_BY, SPF_HELO_NONE,SPF_PASS,URIBL_BLOCKED,USER_AGENT_GIT autolearn=ham autolearn_force=no version=3.4.0 Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id 4475BC4332F for ; Sun, 8 Sep 2019 12:46:32 +0000 (UTC) Received: from vger.kernel.org (vger.kernel.org [209.132.180.67]) by mail.kernel.org (Postfix) with ESMTP id 1C87D20644 for ; Sun, 8 Sep 2019 12:46:32 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=default; t=1567946792; bh=LtTjOxgtRGF6LCCtjHjnp/619AMlBzyRmzOQMaARqIw=; h=From:To:Cc:Subject:Date:In-Reply-To:References:List-ID:From; b=KLrwI2xI/YsMjh3mLhRKVTscAOvz1eX+JiZCYYDojVpl2b+BP+JLUO7ZyTGW5GnzE KVMwbnN5xJtVWHe94AkVllMp5Cnp3DGgIg/vSWlQlWXWWROdbTLXCCn4SfgYfW9bLL CdaYqhmlgQ/rgRy+WN+/GSxJw0j7vJtGmbtIgKwI= Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1726687AbfIHMqa (ORCPT ); Sun, 8 Sep 2019 08:46:30 -0400 Received: from mail.kernel.org ([198.145.29.99]:34166 "EHLO mail.kernel.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1730389AbfIHMqa (ORCPT ); Sun, 8 Sep 2019 08:46:30 -0400 Received: from localhost (unknown [62.28.240.114]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by mail.kernel.org (Postfix) with ESMTPSA id CF6EE218AE; Sun, 8 Sep 2019 12:46:28 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=default; t=1567946789; bh=LtTjOxgtRGF6LCCtjHjnp/619AMlBzyRmzOQMaARqIw=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=n3oOGTwg/w3qVY4gu05fuUaV829mV5/zaqOzLxEhePJ5ZD6AopAC0ZGrb6AveIimu YJQyigA+dgwbKrenneyNMH/uP9MjyvIZoE0zw/QdzxZfH15+lhYnG5b7uarsclM/mw B2143Ny67JWdJ3exvlWYxA8+kpabDUNrADdzYSio= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, "John S. Gruber" , Borislav Petkov , John Hubbard , "H. Peter Anvin" , Ingo Molnar , Juergen Gross , Mark Brown , Thomas Gleixner , x86-ml Subject: [PATCH 4.14 40/40] x86/boot: Preserve boot_params.secure_boot from sanitizing Date: Sun, 8 Sep 2019 13:42:13 +0100 Message-Id: <20190908121132.874903916@linuxfoundation.org> X-Mailer: git-send-email 2.23.0 In-Reply-To: <20190908121114.260662089@linuxfoundation.org> References: <20190908121114.260662089@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Sender: stable-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: stable@vger.kernel.org From: John S. Gruber commit 29d9a0b50736768f042752070e5cdf4e4d4c00df upstream. Commit a90118c445cc ("x86/boot: Save fields explicitly, zero out everything else") now zeroes the secure boot setting information (enabled/disabled/...) passed by the boot loader or by the kernel's EFI handover mechanism. The problem manifests itself with signed kernels using the EFI handoff protocol with grub and the kernel loses the information whether secure boot is enabled in the firmware, i.e., the log message "Secure boot enabled" becomes "Secure boot could not be determined". efi_main() arch/x86/boot/compressed/eboot.c sets this field early but it is subsequently zeroed by the above referenced commit. Include boot_params.secure_boot in the preserve field list. [ bp: restructure commit message and massage. ] Fixes: a90118c445cc ("x86/boot: Save fields explicitly, zero out everything else") Signed-off-by: John S. Gruber Signed-off-by: Borislav Petkov Reviewed-by: John Hubbard Cc: "H. Peter Anvin" Cc: Ingo Molnar Cc: Juergen Gross Cc: Mark Brown Cc: stable Cc: Thomas Gleixner Cc: x86-ml Link: https://lkml.kernel.org/r/CAPotdmSPExAuQcy9iAHqX3js_fc4mMLQOTr5RBGvizyCOPcTQQ@mail.gmail.com Signed-off-by: Greg Kroah-Hartman --- arch/x86/include/asm/bootparam_utils.h | 1 + 1 file changed, 1 insertion(+) --- a/arch/x86/include/asm/bootparam_utils.h +++ b/arch/x86/include/asm/bootparam_utils.h @@ -71,6 +71,7 @@ static void sanitize_boot_params(struct BOOT_PARAM_PRESERVE(eddbuf_entries), BOOT_PARAM_PRESERVE(edd_mbr_sig_buf_entries), BOOT_PARAM_PRESERVE(edd_mbr_sig_buffer), + BOOT_PARAM_PRESERVE(secure_boot), BOOT_PARAM_PRESERVE(hdr), BOOT_PARAM_PRESERVE(e820_table), BOOT_PARAM_PRESERVE(eddbuf),