linux-kernel - RE: [PATCH v2 0/5] Allow the trampoline to use EFI boot services RAM

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <c86800c08057449eaab71cc11344902d@ausx13mpc120.AMER.DELL.COM>
Date:	Wed, 10 Aug 2016 16:08:15 +0000
From:	<Mario_Limonciello@...l.com>
To:	<luto@...capital.net>, <mingo@...nel.org>
CC:	<luto@...nel.org>, <hpa@...or.com>, <x86@...nel.org>,
	<mjg59@...f.ucam.org>, <bp@...en8.de>, <mfleming@...e.de>,
	<linux-kernel@...r.kernel.org>
Subject: RE: [PATCH v2 0/5] Allow the trampoline to use EFI boot services RAM

> -----Original Message-----
> From: Andy Lutomirski [mailto:luto@...capital.net]
> Sent: Wednesday, August 10, 2016 8:22 AM
> To: Ingo Molnar <mingo@...nel.org>
> Cc: Andy Lutomirski <luto@...nel.org>; H. Peter Anvin <hpa@...or.com>;
> X86 ML <x86@...nel.org>; Limonciello, Mario
> <Mario_Limonciello@...l.com>; Matthew Garrett <mjg59@...f.ucam.org>;
> Borislav Petkov <bp@...en8.de>; Matt Fleming <mfleming@...e.de>; linux-
> kernel@...r.kernel.org
> Subject: Re: [PATCH v2 0/5] Allow the trampoline to use EFI boot services
> RAM
> 
> On Wed, Aug 10, 2016 at 5:28 AM, Ingo Molnar <mingo@...nel.org> wrote:
> >
> > * Andy Lutomirski <luto@...nel.org> wrote:
> >
> >> As currently configured, my laptop cannot boot any existing kernel
> >> because the real mode trampoline can't be reserved.  The ranges in
> >> which it could live are rejected by the kernel: one is EFI boot
> >> services data and the other is above the EBDA.
> >
> > Ok, so I like this series - if Matt acks it I can apply it.
> >
> > How urgent is it? The 'laptop does not boot' aspect worries me - how
> frequently
> > are systems hit by this?
> 
> As far as I know, I'm the only affected user unless Mario has heard
> otherwise.  I pinged the Fedora kernel maintainers and no one else has
> reported this issue.  I think it needs a fully up-to-date BIOS on a
> particular laptop with a non-default BIOS setting enabled that runs
> Fedora (or maybe RHEL or CentOS) -- my best guess is that this is only
> triggered when using Red Hat / Fedora's patched GRUB, and I have no
> clue why.  I've checked, and the reported EFI memory map is different
> if I boot using Fedora's GRUB and if I boot exactly the same system
> off a live USB stick.
> 

I haven't heard otherwise.  I've asked around for reports of problems
like this, but nothing has come up.  
Keep in mind two it's just recently SGX is getting availability in Linux; it's 
not upstream yet.  It's also not default to on for any BIOS Dell ships today.

So admittedly, the particular configuration that caused failures for Andy 
isn't tested by anyone in Dell or our partners with Linux to my knowledge.


> >
> > The approach you chose looks sufficiently robust and straightforward to
> me, so it
> > ought to work fine even for x86/urgent - but we can phase it into efi/core
> as well
> > if Matt prefers that.
> >
> 
> I like x86/urgent because I like to be able to boot stock kernels :)
> 

I'd agree if possible, if this does turn out to be something systemic with the
perfect storm that Andy created on his box but eventually can reproduce in 
other places I would prefer that the kernel was on top of it.