linux-kernel - Re: [regression, bisected] x86: efi: Pass boot services variable info to runtime code

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <20130531144826.GB5850@srcf.ucam.org>
Date:	Fri, 31 May 2013 15:48:26 +0100
From:	Matthew Garrett <mjg59@...f.ucam.org>
To:	James Bottomley <James.Bottomley@...senPartnership.com>
Cc:	Ingo Molnar <mingo@...nel.org>, Borislav Petkov <bp@...en8.de>,
	Jiri Kosina <jkosina@...e.cz>, Russ Anderson <rja@....com>,
	joeyli <jlee@...e.com>, Matt Fleming <matt@...sole-pimps.org>,
	matt.fleming@...el.com, linux-efi@...r.kernel.org, x86@...nel.org,
	linux-kernel@...r.kernel.org, Thomas Gleixner <tglx@...utronix.de>,
	"H. Peter Anvin" <hpa@...ux.intel.com>,
	Linus Torvalds <torvalds@...ux-foundation.org>,
	Andrew Morton <akpm@...ux-foundation.org>
Subject: Re: [regression, bisected] x86: efi: Pass boot services variable
 info to runtime code

On Fri, May 31, 2013 at 07:42:37AM -0700, James Bottomley wrote:
> On Fri, 2013-05-31 at 15:34 +0100, Matthew Garrett wrote:
> > I agree that a revert is probably the right thing to do here, but the 
> > original patch was there to permit a more accurate calculation of the 
> > amount of nvram in use, not to provide additional debug information. 
> > Reverting it is going to differently break a different set of systems
> 
> The only ones that are broken are the Samsung ones.  Samsung claims to
> have fixed their UEFI firmware, so we could refer any problems to them.

No, reverting this gets us back to the old state of refusing any writes 
if more than 50% of the variable store *appears* to be used, regardless 
of whether it's actually used. Which, unfortunately, makes it impossible 
to install Linux on most UEFI machines. In any case, Samsung clearly 
haven't fixed this problem on a pile of machines that have already 
shipped.

> Could we hedge the QueryVariableInfo checks with a test for Samsung in
> the UEFI identity strings?

We could, but apparently some Lenovos also have a similar problem. We 
just don't have the information we need to implement a comprehensive 
blacklist, and if we get it wrong we're back to destroying people's 
hardware.

-- 
Matthew Garrett | mjg59@...f.ucam.org
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/