From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id E2F13CCA479 for ; Mon, 18 Jul 2022 18:46:39 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S235384AbiGRSqi (ORCPT ); Mon, 18 Jul 2022 14:46:38 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:44962 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S230171AbiGRSqh (ORCPT ); Mon, 18 Jul 2022 14:46:37 -0400 Received: from smtp-out2.suse.de (smtp-out2.suse.de [IPv6:2001:67c:2178:6::1d]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 11E702E9C9; Mon, 18 Jul 2022 11:46:36 -0700 (PDT) Received: from imap2.suse-dmz.suse.de (imap2.suse-dmz.suse.de [192.168.254.74]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature ECDSA (P-521) server-digest SHA512) (No client certificate requested) by smtp-out2.suse.de (Postfix) with ESMTPS id B8A6A2077E; Mon, 18 Jul 2022 18:46:34 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=suse.de; s=susede2_rsa; t=1658169994; h=from:from:reply-to:date:date:message-id:message-id:to:to:cc:cc: mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding: in-reply-to:in-reply-to:references:references; bh=IEi9Vz+G38C+o5hOJ1yrZT3rdapUJkl0ZlusWRAZA3Y=; b=PBmt63953sU4ntvHe/O4lDUWhLNlStCouc89TG1qj4oyRYUikRKLT9nDc7a1FR9noEb7kd 3KTGn3YIqmNBinlxvIhO86rkmN0SuFmWjOauSSA77poxIzTdIx2s0piwJXjyhF47kGzrf5 oovfUqBNs8O5RF6X+Gc5L/rog70oYww= DKIM-Signature: v=1; a=ed25519-sha256; c=relaxed/relaxed; d=suse.de; s=susede2_ed25519; t=1658169994; h=from:from:reply-to:date:date:message-id:message-id:to:to:cc:cc: mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding: in-reply-to:in-reply-to:references:references; bh=IEi9Vz+G38C+o5hOJ1yrZT3rdapUJkl0ZlusWRAZA3Y=; b=BAT9hQXmWJEFK31Hvu6iX3BQ2einZEoUKLMmV5WZyxpH8E+RKirOwRW2k81ScjCkAkEycG xm425/Qt6Q7Q39Ag== Received: from imap2.suse-dmz.suse.de (imap2.suse-dmz.suse.de [192.168.254.74]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature ECDSA (P-521) server-digest SHA512) (No client certificate requested) by imap2.suse-dmz.suse.de (Postfix) with ESMTPS id 9E9C813A37; Mon, 18 Jul 2022 18:46:34 +0000 (UTC) Received: from dovecot-director2.suse.de ([192.168.254.65]) by imap2.suse-dmz.suse.de with ESMTPSA id h92nJoqq1WIOMAAAMHmgww (envelope-from ); Mon, 18 Jul 2022 18:46:34 +0000 Date: Mon, 18 Jul 2022 20:46:34 +0200 From: Borislav Petkov To: Linus Torvalds Cc: Peter Zijlstra , Thadeu Lima de Souza Cascardo , Linux Kernel Mailing List , linux-efi , the arch/x86 maintainers , Ard Biesheuvel , Thomas Gleixner , Greg Kroah-Hartman , Guenter Roeck , Josh Poimboeuf , stable , Andrew Cooper Subject: Re: [PATCH] efi/x86: use naked RET on mixed mode call wrapper Message-ID: References: <20220715194550.793957-1-cascardo@canonical.com> MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8 Content-Disposition: inline Content-Transfer-Encoding: 8bit In-Reply-To: Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org On Mon, Jul 18, 2022 at 11:34:02AM -0700, Linus Torvalds wrote: > Why would we have to protect the kernel from EFI? Yes, we cleared this up on IRC in the meantime. This was raised as a concern in case we don't trust EFI. But we cannot not (double negation on purpose) trust EFI because it can do whatever it likes anyway, "underneath" the OS. I'm keeping the UNTRAIN_RET-in-C diff in my patches/ folder, though - I get the feeling we might need it soon for something else. :-) -- Regards/Gruss, Boris. SUSE Software Solutions Germany GmbH GF: Ivo Totev, Andrew Myers, Andrew McDonald, Martje Boudien Moerman (HRB 36809, AG Nürnberg)