https://bugzilla.suse.com/show_bug.cgi?id=1205588 Joey Lee changed: What |Removed |Added ---------------------------------------------------------------------------- CC| |glin@suse.com -- You are receiving this mail because: You are on the CC list for the bug.

https://bugzilla.suse.com/show_bug.cgi?id=1205588 https://bugzilla.suse.com/show_bug.cgi?id=1205588#c2 --- Comment #2 from Michael Chang --- The 2.06 grub set the kernel memory as LOADER_DATA, while it should be LOADER_CODE. We can provide a test package later. -- You are receiving this mail because: You are on the CC list for the bug.

https://bugzilla.suse.com/show_bug.cgi?id=1205588 https://bugzilla.suse.com/show_bug.cgi?id=1205588#c4 --- Comment #4 from Joey Lee --- (In reply to Joey Lee from comment #3)

Created attachment 863004 [details] ovmf-bsc1205588-debug-nx-4k-align.patch

I have applied this patch to enable NV/4K-alignment in OVMF for debugging:

https://build.opensuse.org/package/show/home:joeyli:branches:Virtualization: bsc1205588/ovmf

NX-enabled shim 15.7 is also available here: https://build.opensuse.org/project/show/devel:openSUSE:Factory For testing NX, please use both of the above ovmf and shim. -- You are receiving this mail because: You are on the CC list for the bug.

https://bugzilla.suse.com/show_bug.cgi?id=1205588 https://bugzilla.suse.com/show_bug.cgi?id=1205588#c18 --- Comment #18 from Maintenance Automation --- SUSE-SU-2023:1702-1: An update that solves one vulnerability, contains two features and has 10 fixes can now be installed. Category: security (important) Bug References: 1185232, 1185261, 1185441, 1185621, 1187071, 1187260, 1193282, 1198458, 1201066, 1202120, 1205588 CVE References: CVE-2022-28737 Jira References: PED-127, PED-1273 Sources used: openSUSE Leap Micro 5.3 (src): shim-15.7-150300.4.11.1 openSUSE Leap 15.4 (src): shim-15.7-150300.4.11.1 SUSE Linux Enterprise Micro for Rancher 5.3 (src): shim-15.7-150300.4.11.1 SUSE Linux Enterprise Micro 5.3 (src): shim-15.7-150300.4.11.1 SUSE Linux Enterprise Micro for Rancher 5.4 (src): shim-15.7-150300.4.11.1 SUSE Linux Enterprise Micro 5.4 (src): shim-15.7-150300.4.11.1 Basesystem Module 15-SP4 (src): shim-15.7-150300.4.11.1 SUSE Linux Enterprise High Performance Computing ESPOS 15 SP3 (src): shim-15.7-150300.4.11.1 SUSE Linux Enterprise High Performance Computing LTSS 15 SP3 (src): shim-15.7-150300.4.11.1 SUSE Linux Enterprise Real Time 15 SP3 (src): shim-15.7-150300.4.11.1 SUSE Linux Enterprise Server 15 SP3 LTSS 15-SP3 (src): shim-15.7-150300.4.11.1 SUSE Linux Enterprise Server for SAP Applications 15 SP3 (src): shim-15.7-150300.4.11.1 SUSE Manager Proxy 4.2 (src): shim-15.7-150300.4.11.1 SUSE Manager Retail Branch Server 4.2 (src): shim-15.7-150300.4.11.1 SUSE Manager Server 4.2 (src): shim-15.7-150300.4.11.1 SUSE Enterprise Storage 7.1 (src): shim-15.7-150300.4.11.1 SUSE Linux Enterprise Micro 5.1 (src): shim-15.7-150300.4.11.1 SUSE Linux Enterprise Micro 5.2 (src): shim-15.7-150300.4.11.1 SUSE Linux Enterprise Micro for Rancher 5.2 (src): shim-15.7-150300.4.11.1 NOTE: This line indicates an update has been released for the listed product(s). At times this might be only a partial fix. If you have questions please reach out to maintenance coordination. -- You are receiving this mail because: You are on the CC list for the bug.

https://bugzilla.suse.com/show_bug.cgi?id=1205588 https://bugzilla.suse.com/show_bug.cgi?id=1205588#c19 --- Comment #19 from Joey Lee --- (In reply to Joey Lee from comment #1)

I have tested kernel in kernel-default-6.0.8-1.1.x86_64 rpm for openSUSE TW. It also works for booting with PcdDxeNxMemoryProtectionPolicy=0x4. But the same kernel can not boot with grub2-x86_64-efi-2.06-31.1.noarch.

Just for note, kernel introduced EFI_DXE_MEM_ATTRIBUTES=y by 82e0d6d76a patch since v5.19-rc1. So 15-SP5 and Tumbleweed kernels can boot with NX memory protection firmware. -- You are receiving this mail because: You are on the CC list for the bug.

https://bugzilla.suse.com/show_bug.cgi?id=1205588 https://bugzilla.suse.com/show_bug.cgi?id=1205588#c22 --- Comment #22 from Joey Lee --- Created attachment 866239 --> https://bugzilla.suse.com/attachment.cgi?id=866239&action=edit mu_tiano_platforms-release-202202.tar.bz2 This tarball includes 3 fd images which built from mu_tiano_platforms for testing. Please check the README in tarball https://github.com/microsoft/mu_tiano_platforms -- You are receiving this mail because: You are on the CC list for the bug.