s390/boot: add secure boot trailer

[ Upstream commit aa127a069ef312aca02b730d5137e1778d0c3ba7 ]

This patch enhances the kernel image adding a trailer as required for
secure boot by future firmware versions.

Cc: <stable@vger.kernel.org> # 5.2+
Signed-off-by: Peter Oberparleiter <oberpar@linux.ibm.com>
Reviewed-by: Sven Schnelle <svens@linux.ibm.com>
Signed-off-by: Vasily Gorbik <gor@linux.ibm.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>

diff --git a/arch/s390/boot/compressed/vmlinux.lds.S b/arch/s390/boot/compressed/vmlinux.lds.S
index 918e051..1686a85 100644 (file)
--- a/arch/s390/boot/compressed/vmlinux.lds.S
+++ b/arch/s390/boot/compressed/vmlinux.lds.S
@@ -93,8 +93,17 @@ SECTIONS
                _compressed_start = .;
                *(.vmlinux.bin.compressed)
                _compressed_end = .;
-               FILL(0xff);
-               . = ALIGN(4096);
+       }
+
+#define SB_TRAILER_SIZE 32
+       /* Trailer needed for Secure Boot */
+       . += SB_TRAILER_SIZE; /* make sure .sb.trailer does not overwrite the previous section */
+       . = ALIGN(4096) - SB_TRAILER_SIZE;
+       .sb.trailer : {
+               QUAD(0)
+               QUAD(0)
+               QUAD(0)
+               QUAD(0x000000207a49504c)
        }
        _end = .;