From nobody Sat Nov 23 19:41:49 2024 Delivered-To: importer@patchew.org Authentication-Results: mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org; dmarc=pass(p=none dis=none) header.from=redhat.com ARC-Seal: i=1; a=rsa-sha256; t=1731582115; cv=none; d=zohomail.com; s=zohoarc; b=TWPWPGFztrHReL9PtdZBUZHSrT1riR5nXCl36RWRpn+J173WyesftdmK1pcPkvojW6j6IpWp+Lc0nvr152H41sTT6o14zHnbM/L3ywOeyhGUY5LX+xCe7Zdre+ZXtpNsCELN2aYtBCua7aBNSzayIHfYHlU5cw4aacOddipLQbo= ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=zohomail.com; s=zohoarc; t=1731582115; h=Content-Transfer-Encoding:Cc:Cc:Date:Date:From:From:In-Reply-To:List-Subscribe:List-Post:List-Id:List-Archive:List-Help:List-Unsubscribe:MIME-Version:Message-ID:References:Sender:Subject:Subject:To:To:Message-Id:Reply-To; bh=82tSYR4nPqAOKacioK5+vZbuqxoj+kBi00Fqe4SIAZo=; b=EpOzp7ZjSLv561ROvHjrTUPUyrW+M9qEEV443MDWGwVw+kjUjus8PFknwmgCZhZ5VcJNhuP+/ldQkKkhkrV6zxxZb/AqX+5ctoCJPqOkNttFwf2lphKVv6k4vnxcrkVrxrN1oO/AgF/+G9GP+omfhGkspMYL+r2gvM/7yQ5fv/c= ARC-Authentication-Results: i=1; mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org; dmarc=pass header.from= (p=none dis=none) Return-Path: Received: from lists.gnu.org (lists.gnu.org [209.51.188.17]) by mx.zohomail.com with SMTPS id 173158211584930.875735079013907; Thu, 14 Nov 2024 03:01:55 -0800 (PST) Received: from localhost ([::1] helo=lists1p.gnu.org) by lists.gnu.org with esmtp (Exim 4.90_1) (envelope-from ) id 1tBXbC-0001tK-P2; Thu, 14 Nov 2024 06:01:18 -0500 Received: from eggs.gnu.org ([2001:470:142:3::10]) by lists.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1tBXbB-0001su-H3 for qemu-devel@nongnu.org; Thu, 14 Nov 2024 06:01:17 -0500 Received: from us-smtp-delivery-124.mimecast.com ([170.10.133.124]) by eggs.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1tBXbA-0006v2-2G for qemu-devel@nongnu.org; Thu, 14 Nov 2024 06:01:17 -0500 Received: from mx-prod-mc-02.mail-002.prod.us-west-2.aws.redhat.com (ec2-54-186-198-63.us-west-2.compute.amazonaws.com [54.186.198.63]) by relay.mimecast.com with ESMTP with STARTTLS (version=TLSv1.3, cipher=TLS_AES_256_GCM_SHA384) id us-mta-464-RREJZOkLOHif_s2belNM6Q-1; Thu, 14 Nov 2024 06:01:10 -0500 Received: from mx-prod-int-01.mail-002.prod.us-west-2.aws.redhat.com (mx-prod-int-01.mail-002.prod.us-west-2.aws.redhat.com [10.30.177.4]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (2048 bits) server-digest SHA256) (No client certificate requested) by mx-prod-mc-02.mail-002.prod.us-west-2.aws.redhat.com (Postfix) with ESMTPS id 3EEEF19540EF; Thu, 14 Nov 2024 11:01:08 +0000 (UTC) Received: from sirius.home.kraxel.org (unknown [10.39.193.143]) by mx-prod-int-01.mail-002.prod.us-west-2.aws.redhat.com (Postfix) with ESMTPS id 1B81930000DF; Thu, 14 Nov 2024 11:01:07 +0000 (UTC) Received: by sirius.home.kraxel.org (Postfix, from userid 1000) id B1C3E18009A8; Thu, 14 Nov 2024 12:01:01 +0100 (CET) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=redhat.com; s=mimecast20190719; t=1731582075; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version: content-transfer-encoding:content-transfer-encoding: in-reply-to:in-reply-to:references:references; bh=82tSYR4nPqAOKacioK5+vZbuqxoj+kBi00Fqe4SIAZo=; b=UlPh0NMz/OqOIpwFCj6acU+FKVyi3iRCyoTlKxj32LyxYjx1cJY7xNeKlf90bQZ3+hPUBE JVDc1mdQlHWTwORbt3Plj3HAh/Ob4LP5Z3YqiCT0Hu6lRmLmFcffs9xU34jgXSvY7c0Hde tW5lLUU918hGgGoSCJomtUUJCj23/To= X-MC-Unique: RREJZOkLOHif_s2belNM6Q-1 X-Mimecast-MFC-AGG-ID: RREJZOkLOHif_s2belNM6Q From: Gerd Hoffmann To: qemu-devel@nongnu.org Cc: Yanan Wang , Paolo Bonzini , =?UTF-8?q?Philippe=20Mathieu-Daud=C3=A9?= , Zhao Liu , Marcel Apfelbaum , "Michael S. Tsirkin" , Richard Henderson , Eduardo Habkost , Gerd Hoffmann Subject: [PULL 2/5] x86/loader: only patch linux kernels Date: Thu, 14 Nov 2024 12:00:58 +0100 Message-ID: <20241114110101.44322-3-kraxel@redhat.com> In-Reply-To: <20241114110101.44322-1-kraxel@redhat.com> References: <20241114110101.44322-1-kraxel@redhat.com> MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable X-Scanned-By: MIMEDefang 3.4.1 on 10.30.177.4 Received-SPF: pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) client-ip=209.51.188.17; envelope-from=qemu-devel-bounces+importer=patchew.org@nongnu.org; helo=lists.gnu.org; Received-SPF: pass client-ip=170.10.133.124; envelope-from=kraxel@redhat.com; helo=us-smtp-delivery-124.mimecast.com X-Spam_score_int: -21 X-Spam_score: -2.2 X-Spam_bar: -- X-Spam_report: (-2.2 / 5.0 requ) BAYES_00=-1.9, DKIMWL_WL_HIGH=-0.119, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1, RCVD_IN_DNSWL_NONE=-0.0001, RCVD_IN_MSPIKE_H3=0.001, RCVD_IN_MSPIKE_WL=0.001, RCVD_IN_VALIDITY_RPBL_BLOCKED=0.001, RCVD_IN_VALIDITY_SAFE_BLOCKED=0.001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001 autolearn=ham autolearn_force=no X-Spam_action: no action X-BeenThere: qemu-devel@nongnu.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: qemu-devel-bounces+importer=patchew.org@nongnu.org Sender: qemu-devel-bounces+importer=patchew.org@nongnu.org X-ZohoMail-DKIM: pass (identity @redhat.com) X-ZM-MESSAGEID: 1731582117126116600 Content-Type: text/plain; charset="utf-8" If the binary loaded via -kernel is *not* a linux kernel (in which case protocol =3D=3D 0), do not patch the linux kernel header fields. It's (a) pointless and (b) might break binaries by random patching and (c) changes the binary hash which in turn breaks secure boot verification. Background: OVMF happily loads and runs not only linux kernels but any efi binary via direct kernel boot. Note: Breaking the secure boot verification is a problem for linux kernels too, but fixed that is left for another day ... Signed-off-by: Gerd Hoffmann Message-ID: <20240905141211.1253307-3-kraxel@redhat.com> --- hw/i386/x86-common.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/hw/i386/x86-common.c b/hw/i386/x86-common.c index bc360a9ea44b..ee047308331a 100644 --- a/hw/i386/x86-common.c +++ b/hw/i386/x86-common.c @@ -943,7 +943,7 @@ void x86_load_linux(X86MachineState *x86ms, * kernel on the other side of the fw_cfg interface matches the hash o= f the * file the user passed in. */ - if (!sev_enabled()) { + if (!sev_enabled() && protocol > 0) { memcpy(setup, header, MIN(sizeof(header), setup_size)); } =20 --=20 2.47.0