linux-kernel - Re: [PATCH RFC v2 0/2] Handle UEFI NX-restricted page tables

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <9b8493626c3c6c0af415e0b277147f9e@ispras.ru>
Date:   Thu, 17 Mar 2022 16:26:28 +0300
From:   baskov@...ras.ru
To:     Matthew Garrett <mjg59@...f.ucam.org>
Cc:     Ard Biesheuvel <ardb@...nel.org>, Peter Jones <pjones@...hat.com>,
        Thomas Gleixner <tglx@...utronix.de>,
        Ingo Molnar <mingo@...hat.com>, Borislav Petkov <bp@...en8.de>,
        Dave Hansen <dave.hansen@...ux.intel.com>,
        X86 ML <x86@...nel.org>, linux-efi <linux-efi@...r.kernel.org>,
        Linux Kernel Mailing List <linux-kernel@...r.kernel.org>,
        bret.barkelew@...rosoft.com
Subject: Re: [PATCH RFC v2 0/2] Handle UEFI NX-restricted page tables

On 2022-03-03 23:47, Matthew Garrett wrote:
> 
> Ok. I think this should really go through the UEFI spec process - I
> agree that from a strict interpretation of the spec, what this firmware
> is doing is legitimate, but I don't like having a situation where we
> have to depend on the DXE spec.
> 
> How does Windows handle this? Just update the page tables itself for 
> any
> regions it needs during boot?

Sorry for delay.

Windows is closed source, so we cannot give guarantees on its
behavior, but this is our belief regarding its behavior.
Added Bret Barkelew (bret.barkelew@...rosoft.com)
to the CC-list in case he can add something.

Regarding the spec changes, we agree it is reasonable,
but whether the spec changes or not it will take some time
to update the edk2.

Our first solution was safer in regards to the use of the services,
yet as Ard suggested, using DXE services is much cleaner
as long as it works.

We can post it to edk2-devel, but our opinion
is that these issues are independent.

Thanks,
Baskov Evgeniy