From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from ams.source.kernel.org (ams.source.kernel.org [145.40.68.75]) by mx.groups.io with SMTP id smtpd.web10.16809.1676301522615212840 for ; Mon, 13 Feb 2023 07:18:43 -0800 Authentication-Results: mx.groups.io; dkim=pass header.i=@kernel.org header.s=k20201202 header.b=vAnZhrSr; spf=pass (domain: kernel.org, ip: 145.40.68.75, mailfrom: ardb@kernel.org) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ams.source.kernel.org (Postfix) with ESMTPS id 0AC9BB8122D; Mon, 13 Feb 2023 15:18:41 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 2F159C433A1; Mon, 13 Feb 2023 15:18:37 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=k20201202; t=1676301519; bh=iBsdTbu0prEiCs/wv1xhNJZoAz2mx2HZfOgToVAC1/E=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=vAnZhrSrBX1JU8b3n06csNWHUkXC8/JdDM0aT6VjsT4dv4bNm1kbmrYomcR3VzN4x BcXQARJanK4UHddtwbLdLcfY0MofunllGNeibNHq6fQ9sNmtPPQfFgN7IwIQ2+SUCD OeZ52YJzQZVY6gimSMdT7R8+JG1qK8f7Xtquoq3vNIL4duSPj7ilhziirHyl60xuNQ 1DQHgFqvcHg5xm98+gIhUgOWvVNFd/vDIqlEMW0tP0RSgjB/E7xR+8QQl0j24CpMgE IJpbx3t5L/azEzLc0hx69NbWvVv7HUqqlcw+9Cl9KhKarJB9RHL2OLg69hlVTVSXhA C+upG45J2nYYA== From: "Ard Biesheuvel" To: devel@edk2.groups.io Cc: Ard Biesheuvel , Michael Kinney , Liming Gao , Jiewen Yao , Michael Kubacki , Sean Brogan , Rebecca Cran , Leif Lindholm , Sami Mujawar , Taylor Beebe , Matthew Garrett , Peter Jones , Kees Cook Subject: [RFC 04/13] MdeModulePkg/DxeIpl: Avoid shadowing IPL PEIM by default Date: Mon, 13 Feb 2023 16:18:01 +0100 Message-Id: <20230213151810.2301480-5-ardb@kernel.org> X-Mailer: git-send-email 2.39.1 In-Reply-To: <20230213151810.2301480-1-ardb@kernel.org> References: <20230213151810.2301480-1-ardb@kernel.org> MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Currently, the DXE IPL relies on permanent memory being available, but does not DEPEX on the associated PPI. Instead, it registers for PEIM shadowing, and only proceeds when running shadowed, and this implies that permanent memory has been installed. While PEIM shadowing is typically good for performance, there are reasons why we might prefer to avoid it, e.g., when running under virtualization in a mode where the write protection of the ROM is an advantage from a safety PoV, and where the performance is identical. This is especially true when code executing from ordinary RAM needs some additional work to be executable, like when enabling WXN on ARM, which only permits execution from memory that is mapped read-only. So permit DXE IPL to run unshadowed, based on the existing PCD that decides whether or not shadowing is preferred. While making this behavior depend on this PCD is strictly redundant (as the IPL PEIM will be shadowed anyway, even if RegisterForShadow() is not called), let's test it anyway to avoid modifying the behavior on existing platforms. Signed-off-by: Ard Biesheuvel --- MdeModulePkg/Core/DxeIplPeim/DxeIpl.inf | 5 +++- MdeModulePkg/Core/DxeIplPeim/DxeLoad.c | 24 +++++++++++--------- 2 files changed, 17 insertions(+), 12 deletions(-) diff --git a/MdeModulePkg/Core/DxeIplPeim/DxeIpl.inf b/MdeModulePkg/Core/Dx= eIplPeim/DxeIpl.inf index 052ea0ec1a6f..62821477d012 100644 --- a/MdeModulePkg/Core/DxeIplPeim/DxeIpl.inf +++ b/MdeModulePkg/Core/DxeIplPeim/DxeIpl.inf @@ -112,6 +112,9 @@ [FeaturePcd.X64] [FeaturePcd]=0D gEfiMdeModulePkgTokenSpaceGuid.PcdDxeIplSupportUefiDecompress ## CONSUME= S=0D =0D +[Pcd]=0D + gEfiMdeModulePkgTokenSpaceGuid.PcdShadowPeimOnBoot ## CONSUME= S=0D +=0D [Pcd.IA32,Pcd.X64]=0D gEfiMdeModulePkgTokenSpaceGuid.PcdUse1GPageTable ##= SOMETIMES_CONSUMES=0D gEfiMdeModulePkgTokenSpaceGuid.PcdPteMemoryEncryptionAddressOrMask ##= CONSUMES=0D @@ -128,7 +131,7 @@ [Pcd.IA32,Pcd.X64,Pcd.ARM,Pcd.AARCH64] gEfiMdeModulePkgTokenSpaceGuid.PcdImageProtectionPolicy ## SOMETIM= ES_CONSUMES=0D =0D [Depex]=0D - gEfiPeiLoadFilePpiGuid AND gEfiPeiMasterBootModePpiGuid=0D + gEfiPeiLoadFilePpiGuid AND gEfiPeiMasterBootModePpiGuid AND gEfiPeiMemor= yDiscoveredPpiGuid=0D =0D #=0D # [BootMode]=0D diff --git a/MdeModulePkg/Core/DxeIplPeim/DxeLoad.c b/MdeModulePkg/Core/Dxe= IplPeim/DxeLoad.c index 2c19f1a507ba..228d39a618d3 100644 --- a/MdeModulePkg/Core/DxeIplPeim/DxeLoad.c +++ b/MdeModulePkg/Core/DxeIplPeim/DxeLoad.c @@ -77,18 +77,20 @@ PeimInitializeDxeIpl ( BootMode =3D GetBootModeHob ();=0D =0D if (BootMode !=3D BOOT_ON_S3_RESUME) {=0D - Status =3D PeiServicesRegisterForShadow (FileHandle);=0D - if (Status =3D=3D EFI_SUCCESS) {=0D - //=0D - // EFI_SUCESS means it is the first time to call register for shadow= .=0D - //=0D - return Status;=0D - }=0D + if (PcdGetBool (PcdShadowPeimOnBoot)) {=0D + Status =3D PeiServicesRegisterForShadow (FileHandle);=0D + if (Status =3D=3D EFI_SUCCESS) {=0D + //=0D + // EFI_SUCESS means it is the first time to call register for shad= ow.=0D + //=0D + return Status;=0D + }=0D =0D - //=0D - // Ensure that DXE IPL is shadowed to permanent memory.=0D - //=0D - ASSERT (Status =3D=3D EFI_ALREADY_STARTED);=0D + //=0D + // Ensure that DXE IPL is shadowed to permanent memory.=0D + //=0D + ASSERT (Status =3D=3D EFI_ALREADY_STARTED);=0D + }=0D =0D //=0D // DXE core load requires permanent memory.=0D --=20 2.39.1