Weekly edition	Kernel	Security	Distributions	Contact Us	Search
Archives	Calendar	Subscribe	Write for LWN	LWN.net FAQ	Sponsors

Details on Ubuntu's UEFI secure boot plan

Posted Jun 24, 2012 14:50 UTC (Sun) by slashdot (guest, #22014)
Parent article: Details on Ubuntu's UEFI secure boot plan

Why is not executing unsigned code before ExitBootServices so important, while it's fine to do afterwards?

Anyway, if that's the goal it seems that it's simple to do: just patch GRUB2 to call ExitBootServices immediately, and then proceed to boot using the legacy BIOS interfaces, or just direct hardware access.

(Log in to post comments)

Posted Jun 24, 2012 15:04 UTC (Sun) by mjg59 (subscriber, #23239) [Link]

I don't think there's any meaningful distinction between executing arbitrary code before and after ExitBootServices() - the only real difference is that the flash is guaranteed to be locked down afterwards. UEFI doesn't give you access to any legacy BIOS interfaces (the legacy video ROM has tended to be there for various reasons, but that'll be vanishing now), and direct hardware access would mean porting a large number of drivers to grub.