From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from us-smtp-delivery-124.mimecast.com (us-smtp-delivery-124.mimecast.com [170.10.129.124]) by mx.groups.io with SMTP id smtpd.web10.9514.1672830707979028611 for ; Wed, 04 Jan 2023 03:11:48 -0800 Authentication-Results: mx.groups.io; dkim=pass header.i=@redhat.com header.s=mimecast20190719 header.b=FAwjENwl; spf=pass (domain: redhat.com, ip: 170.10.129.124, mailfrom: kraxel@redhat.com) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=redhat.com; s=mimecast20190719; t=1672830707; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version:content-type:content-type: in-reply-to:in-reply-to:references:references; bh=v/zX3W703doEF3BxLzXmigmj0HeFIOKYg4iyIz+LNu8=; b=FAwjENwlYJ+2tEeU6wy56N3jeMo8TdwM1e8i0KFj5AY/UwFAvXXvyZc3f5btHITZ/Xq2Od q8OmF9PUSn9AliEJK5tg34nSbfigTkwJBU/L4/kzvFXqkukj6i9urvFyoF9I4/6SYf9rwu u5iJAuhxEyASPfItcHgc/mSnBoKIzOs= Received: from mimecast-mx02.redhat.com (mimecast-mx02.redhat.com [66.187.233.88]) by relay.mimecast.com with ESMTP with STARTTLS (version=TLSv1.2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id us-mta-353-P6zisBrTPs68lLkGgUrKWw-1; Wed, 04 Jan 2023 06:11:42 -0500 X-MC-Unique: P6zisBrTPs68lLkGgUrKWw-1 Received: from smtp.corp.redhat.com (int-mx06.intmail.prod.int.rdu2.redhat.com [10.11.54.6]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by mimecast-mx02.redhat.com (Postfix) with ESMTPS id 788D88533DB; Wed, 4 Jan 2023 11:11:41 +0000 (UTC) Received: from sirius.home.kraxel.org (unknown [10.39.192.238]) by smtp.corp.redhat.com (Postfix) with ESMTPS id 3B6D02166B30; Wed, 4 Jan 2023 11:11:41 +0000 (UTC) Received: by sirius.home.kraxel.org (Postfix, from userid 1000) id 8A68A180039D; Wed, 4 Jan 2023 12:11:34 +0100 (CET) Date: Wed, 4 Jan 2023 12:11:34 +0100 From: "Gerd Hoffmann" To: Ard Biesheuvel Cc: dann frazier , Alexander Graf , devel@edk2.groups.io, Leif Lindholm Subject: Re: [edk2-devel] [PATCH v3 03/16] ArmVirtPkg: make EFI_LOADER_DATA non-executable Message-ID: <20230104111134.ewioietmprrrprad@sirius.home.kraxel.org> References: <20220926082511.2110797-1-ardb@kernel.org> <20220926082511.2110797-4-ardb@kernel.org> <20221128154610.wik3f65bhbfrdpva@sirius.home.kraxel.org> <7bba7344-fc37-abde-a792-5ae40621c70f@csgraf.de> MIME-Version: 1.0 In-Reply-To: X-Scanned-By: MIMEDefang 3.1 on 10.11.54.6 X-Mimecast-Spam-Score: 0 X-Mimecast-Originator: redhat.com Content-Type: text/plain; charset=us-ascii Content-Disposition: inline Hi, > > > > You can override PCDs on the build command line, so I suggest you use > > > > that for building these images as long as it is needed. > > > > > > > > E.g,, append this to the build.sh command line > > > > > > > > --pcd PcdDxeNxMemoryProtectionPolicy=0xC000000000007FD1 > > > > > > > > to undo the effects of this patch. Can this also be flipped at runtime? Does this pcd work the same way on all architectures? > I don't think having different versions of the image makes sense, tbh, > but of course, this is up to the distros. Fedora has reverted the patch for now, and I don't see how we can enable that anytime soon given that RHEL-8,9 with loooooong support times ship broken grub binaries today. > Compatibility with ancient downstream GRUB builds is not a goal of the > EDK2 upstream, so as long as distros can tweak the build to their > needs, I don't see a reason to revert this change upstream. The versions are not that ancient. The problem is more that upstream grub is really slow on integrating patches so every distro does carry a huge pile of downstream patches. And they seem to re-introduce the bug ... But, yes, just reverting upstream too doesn't look like a good option either, we need at least a little pressure to get things fixed. take care, Gerd