linux-kernel - Re: [PATCH] x86/efi: Apply EFI Memory Attributes after kexec

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <D5K2TFWWW4RA.11BRVB9L59S0V@amazon.com>
Date: Tue, 12 Nov 2024 09:01:30 +0000
From: Nicolas Saenz Julienne <nsaenz@...zon.com>
To: Ard Biesheuvel <ardb@...nel.org>
CC: Thomas Gleixner <tglx@...utronix.de>, Ingo Molnar <mingo@...hat.com>,
	Borislav Petkov <bp@...en8.de>, Dave Hansen <dave.hansen@...ux.intel.com>,
	<x86@...nel.org>, "H . Peter Anvin" <hpa@...or.com>, Sai Praneeth
	<sai.praneeth.prakhya@...el.com>, Matt Fleming <matt@...eblueprint.co.uk>,
	<linux-efi@...r.kernel.org>, <linux-kernel@...r.kernel.org>,
	<stanspas@...zon.de>, <nh-open-source@...zon.com>, <stable@...r.kernel.org>
Subject: Re: [PATCH] x86/efi: Apply EFI Memory Attributes after kexec

On Tue Nov 12, 2024 at 7:55 AM UTC, Ard Biesheuvel wrote:
> On Mon, 11 Nov 2024 at 22:45, Nicolas Saenz Julienne <nsaenz@...zon.com> wrote:
>>
>> - Although care is taken to make sure the memory backing the EFI Memory
>>   Attributes table is preserved during runtime and reachable after kexec
>>   (see efi_memattr_init()). I don't see the same happening for the EFI
>>   properties table. Maybe it's just unnecessary as there's an assumption
>>   that the table will fall in memory preserved during runtime? Or for
>>   another reason? Otherwise, we'd need to make sure it isn't possible to
>>   set EFI_NX_PE_DATA on kexec.
>
> Thanks.
>
> I think we should just drop support for the EFI_PROPERTIES_TABLE - it
> was a failed, short-lived experiment that broke the boot on both Linux
> and Windows, and was replaced with the memory attributes table shortly
> after.

Isn't there a tiny posibility some platorm might be using the feature?
Otherwise I'll send a v2 right away.

Nicolas