On 7/1/19 3:43 PM, Francois Ozog wrote:

I hope somebody in the kernel community is looking at making sure the piece of memory is RO:

https://wikileaks.org/ciav7p1/cms/page_36896783.html

Anyone knows about that?

The BootServices table is set up by the UEFI firmware, e.g. EDK2 or U-Boot. Write protecting this table would not protect the kernel. Any driver loaded can use CreateEvent() to register a notification function to be called when ExitBootServices() is invoked.

Regards

Heinrich