* [PATCH v2] ArmVirtPkg AARCH64: enable NX memory protection for all platforms
@ 2017-03-01 14:36 Ard Biesheuvel
2017-03-01 18:32 ` Laszlo Ersek
0 siblings, 1 reply; 3+ messages in thread
From: Ard Biesheuvel @ 2017-03-01 14:36 UTC (permalink / raw)
To: lersek, edk2-devel; +Cc: leif.lindholm, Ard Biesheuvel
This sets the recently introduced PCD PcdDxeNxMemoryProtectionPolicy to
a value that protects all memory regions except code regions against
inadvertent execution.
Note that this does not [yet] protect EfiLoaderData regions, due to
compatibility issues with shim and GRUB.
Contributed-under: TianoCore Contribution Agreement 1.0
Signed-off-by: Ard Biesheuvel <ard.biesheuvel@linaro.org>
Reviewed-by: Jiewen Yao <jiewen.yao@intel.com>
---
v2: leave EfiLoaderData executable for the time being
ArmVirtPkg/ArmVirt.dsc.inc | 7 +++++++
1 file changed, 7 insertions(+)
diff --git a/ArmVirtPkg/ArmVirt.dsc.inc b/ArmVirtPkg/ArmVirt.dsc.inc
index 2b0a44e14d24..a91b27f13cf2 100644
--- a/ArmVirtPkg/ArmVirt.dsc.inc
+++ b/ArmVirtPkg/ArmVirt.dsc.inc
@@ -383,6 +383,13 @@ [PcdsFixedAtBuild.AARCH64]
#
gEfiMdeModulePkgTokenSpaceGuid.PcdImageProtectionPolicy|0x3
+ #
+ # Enable NX memory protection for all non-code regions, including OEM and OS
+ # reserved ones, with the exception of LoaderData regions, of which OS loaders
+ # (i.e., GRUB) may assume that its contents are executable.
+ #
+ gEfiMdeModulePkgTokenSpaceGuid.PcdDxeNxMemoryProtectionPolicy|0xC000000000007FD1
+
[Components.common]
#
# Networking stack
--
2.7.4
^ permalink raw reply related [flat|nested] 3+ messages in thread
* Re: [PATCH v2] ArmVirtPkg AARCH64: enable NX memory protection for all platforms
2017-03-01 14:36 [PATCH v2] ArmVirtPkg AARCH64: enable NX memory protection for all platforms Ard Biesheuvel
@ 2017-03-01 18:32 ` Laszlo Ersek
2017-03-01 18:37 ` Ard Biesheuvel
0 siblings, 1 reply; 3+ messages in thread
From: Laszlo Ersek @ 2017-03-01 18:32 UTC (permalink / raw)
To: Ard Biesheuvel, edk2-devel; +Cc: leif.lindholm
On 03/01/17 15:36, Ard Biesheuvel wrote:
> This sets the recently introduced PCD PcdDxeNxMemoryProtectionPolicy to
> a value that protects all memory regions except code regions against
> inadvertent execution.
>
> Note that this does not [yet] protect EfiLoaderData regions, due to
> compatibility issues with shim and GRUB.
>
> Contributed-under: TianoCore Contribution Agreement 1.0
> Signed-off-by: Ard Biesheuvel <ard.biesheuvel@linaro.org>
> Reviewed-by: Jiewen Yao <jiewen.yao@intel.com>
> ---
> v2: leave EfiLoaderData executable for the time being
>
> ArmVirtPkg/ArmVirt.dsc.inc | 7 +++++++
> 1 file changed, 7 insertions(+)
>
> diff --git a/ArmVirtPkg/ArmVirt.dsc.inc b/ArmVirtPkg/ArmVirt.dsc.inc
> index 2b0a44e14d24..a91b27f13cf2 100644
> --- a/ArmVirtPkg/ArmVirt.dsc.inc
> +++ b/ArmVirtPkg/ArmVirt.dsc.inc
> @@ -383,6 +383,13 @@ [PcdsFixedAtBuild.AARCH64]
> #
> gEfiMdeModulePkgTokenSpaceGuid.PcdImageProtectionPolicy|0x3
>
> + #
> + # Enable NX memory protection for all non-code regions, including OEM and OS
> + # reserved ones, with the exception of LoaderData regions, of which OS loaders
> + # (i.e., GRUB) may assume that its contents are executable.
> + #
> + gEfiMdeModulePkgTokenSpaceGuid.PcdDxeNxMemoryProtectionPolicy|0xC000000000007FD1
> +
> [Components.common]
> #
> # Networking stack
>
Reviewed-by: Laszlo Ersek <lersek@redhat.com>
Tested-by: Laszlo Ersek <lersek@redhat.com>
^ permalink raw reply [flat|nested] 3+ messages in thread
* Re: [PATCH v2] ArmVirtPkg AARCH64: enable NX memory protection for all platforms
2017-03-01 18:32 ` Laszlo Ersek
@ 2017-03-01 18:37 ` Ard Biesheuvel
0 siblings, 0 replies; 3+ messages in thread
From: Ard Biesheuvel @ 2017-03-01 18:37 UTC (permalink / raw)
To: Laszlo Ersek; +Cc: edk2-devel@lists.01.org, Leif Lindholm
On 1 March 2017 at 18:32, Laszlo Ersek <lersek@redhat.com> wrote:
> On 03/01/17 15:36, Ard Biesheuvel wrote:
>> This sets the recently introduced PCD PcdDxeNxMemoryProtectionPolicy to
>> a value that protects all memory regions except code regions against
>> inadvertent execution.
>>
>> Note that this does not [yet] protect EfiLoaderData regions, due to
>> compatibility issues with shim and GRUB.
>>
>> Contributed-under: TianoCore Contribution Agreement 1.0
>> Signed-off-by: Ard Biesheuvel <ard.biesheuvel@linaro.org>
>> Reviewed-by: Jiewen Yao <jiewen.yao@intel.com>
>> ---
>> v2: leave EfiLoaderData executable for the time being
>>
>> ArmVirtPkg/ArmVirt.dsc.inc | 7 +++++++
>> 1 file changed, 7 insertions(+)
>>
>> diff --git a/ArmVirtPkg/ArmVirt.dsc.inc b/ArmVirtPkg/ArmVirt.dsc.inc
>> index 2b0a44e14d24..a91b27f13cf2 100644
>> --- a/ArmVirtPkg/ArmVirt.dsc.inc
>> +++ b/ArmVirtPkg/ArmVirt.dsc.inc
>> @@ -383,6 +383,13 @@ [PcdsFixedAtBuild.AARCH64]
>> #
>> gEfiMdeModulePkgTokenSpaceGuid.PcdImageProtectionPolicy|0x3
>>
>> + #
>> + # Enable NX memory protection for all non-code regions, including OEM and OS
>> + # reserved ones, with the exception of LoaderData regions, of which OS loaders
>> + # (i.e., GRUB) may assume that its contents are executable.
>> + #
>> + gEfiMdeModulePkgTokenSpaceGuid.PcdDxeNxMemoryProtectionPolicy|0xC000000000007FD1
>> +
>> [Components.common]
>> #
>> # Networking stack
>>
>
> Reviewed-by: Laszlo Ersek <lersek@redhat.com>
> Tested-by: Laszlo Ersek <lersek@redhat.com>
Pushed, thanks.
^ permalink raw reply [flat|nested] 3+ messages in thread
end of thread, other threads:[~2017-03-01 18:37 UTC | newest]
Thread overview: 3+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2017-03-01 14:36 [PATCH v2] ArmVirtPkg AARCH64: enable NX memory protection for all platforms Ard Biesheuvel
2017-03-01 18:32 ` Laszlo Ersek
2017-03-01 18:37 ` Ard Biesheuvel
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox