-
Notifications
You must be signed in to change notification settings - Fork 288
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Is 15.8 being prepared? #615
Comments
More or less NX support is a bit um broken and people are trying to sort it out. Also nobody is actively reviewing shims right now to my knowledge so it's likely just useless work to try to go and build now. Some systems discover the NX flag on shim and enable NX mode, but then kernels are not ready and your grub also needs to be and the patches are not merged either, so then you regress vs older shim because these systems fail to boot. But you cannot submit a shim without that flag even if we managed to review it because MS doesn't sign without the flag anymore, so it's all a bit stuck. |
Why couldn't the firmware have simply checked the actually alignment instead of relying on a notification bit flag? So that then sounds like we will have to upgrade GRUB again? Please please please, put together a single ready-to-use grub source directory so it's not so confusing with all the required patches. People could still provide small patches for custom things that aren't security related to that secure baseline. Also please consider my patch for mainline to deal with booting things not called "grubx64.efi". I'll attach here again (it was from 15.4 - had a couple bug fixes as well - and removed some stuff peter put in for me (different than my actual patch) back in the early days - mine was actually 32kernel on 64bit uefi - but that no longer works on the modern systems, I guess 32bit UEFI on 64bit system could still allow 64bit kernel but I think the logic is in that other location mentioned). Of course my Acme stuff doesn't apply. Thanks!! |
@julian-klode Could you please explain a bit more on the state of NX_Compat support?
I've been reading all comments in shim/shim-review and I can't find clarity. Example: what would happen if I were to build my shim using HEAD from git (it has NX_Compat enabled by default right) and a 6.6 kernel? Would that boot? Thanks a lot in advance for your help |
Work on NX is ongoing also see the NX Exception https://techcommunity.microsoft.com/t5/hardware-dev-center/nx-exception-for-shim-community/ba-p/3976522#M147 Kernel patches should be in 6.7 AFAIK |
@julian-klode Does this mean we can submit a new shim (new vendor) for review with NX Compat turned off? (and then wait for the kernel to support it properly?) |
Per my understood, v6.6 kernel includes the following patches of x86/decompressor. It also supports EFI memory attributes protocol : 264b82fdb4989cf6a44a2bcd0c6ea05e8026b2ac x86/decompressor: Don't rely on upper 32 bits of GPRs being preserved Do we have more patches relate to NX support in v6.7 kernel? I think that shim-review should provide a patches list for supporting NX. It's useful for shi-review and also good for kernel backporting. Because distro should maintains old kernel version with shim for NX. |
@julian-klode you mentioned grub upstream not being ready either? |
I'd like to just get a clean 15.8 to update without having to use 15.7 with patches. Is that almost ready? Otherwise I guess I'll have to do the 15.7 with patch since it appears some new mobo/bios now stop loading the 15. 4 version.
The text was updated successfully, but these errors were encountered: