From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from mail02.groups.io (mail02.groups.io [66.175.222.108]) by spool.mail.gandi.net (Postfix) with ESMTPS id 98C61D80110 for ; Fri, 18 Aug 2023 22:58:01 +0000 (UTC) DKIM-Signature: a=rsa-sha256; bh=6grD5RKUKO3sqJW2QuCucxXrJnu8vNlRoM62azkAY1M=; c=relaxed/simple; d=groups.io; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References:MIME-Version:Precedence:List-Subscribe:List-Help:Sender:List-Id:Mailing-List:Delivered-To:Reply-To:List-Unsubscribe-Post:List-Unsubscribe:Content-Transfer-Encoding; s=20140610; t=1692399480; v=1; b=Vm63MRES19uQKPXQVUYB0gOHyA7Y0aUmNK8E842bvT4mM/S8ZHO3dUvvGf3z5l4eLOG4uUj7 hgK7HTR5VsdDfqH15sKT3BXzujAzlI6HVa215VhiDkxuk8xMKcLs0y2bQKinbYcaxbYzEXtT2rs O94m0ZMRXUIBrhVluFqcNSDk= X-Received: by 127.0.0.2 with SMTP id eboZYY7687511xtBYvH1gfFk; Fri, 18 Aug 2023 15:58:00 -0700 X-Received: from mail-pf1-f179.google.com (mail-pf1-f179.google.com [209.85.210.179]) by mx.groups.io with SMTP id smtpd.web11.3236.1692397951732557050 for ; Fri, 18 Aug 2023 15:32:31 -0700 X-Received: by mail-pf1-f179.google.com with SMTP id d2e1a72fcca58-68730bafa6bso1759015b3a.1 for ; Fri, 18 Aug 2023 15:32:31 -0700 (PDT) X-Gm-Message-State: Wl16eIhq9m3rqScTPqaT2SNvx7686176AA= X-Google-Smtp-Source: AGHT+IEaIjHkTc0dpmWHvhE9Yan4j2COF1fe+oLbKwqvLC96OCjyHq3Ww1wXtEnrlnjOypg1pt1EhA== X-Received: by 2002:a05:6a20:1615:b0:13d:71f4:fd8a with SMTP id l21-20020a056a20161500b0013d71f4fd8amr707431pzj.13.1692397950892; Fri, 18 Aug 2023 15:32:30 -0700 (PDT) X-Received: from localhost.localdomain ([50.46.253.1]) by smtp.gmail.com with ESMTPSA id 7-20020aa79207000000b0068779015507sm1989330pfo.194.2023.08.18.15.32.30 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Fri, 18 Aug 2023 15:32:30 -0700 (PDT) From: "Taylor Beebe" To: devel@edk2.groups.io Cc: Ard Biesheuvel , Jiewen Yao , Jordan Justen , Gerd Hoffmann Subject: [edk2-devel] [PATCH v2 10/25] OvmfPkg: Apply Memory Protections via SetMemoryProtectionsLib Date: Fri, 18 Aug 2023 15:31:42 -0700 Message-ID: <20230818223159.1073-11-taylor.d.beebe@gmail.com> In-Reply-To: <20230818223159.1073-1-taylor.d.beebe@gmail.com> References: <20230818223159.1073-1-taylor.d.beebe@gmail.com> MIME-Version: 1.0 Precedence: Bulk List-Subscribe: List-Help: Sender: devel@edk2.groups.io List-Id: Mailing-List: list devel@edk2.groups.io; contact devel+owner@edk2.groups.io Reply-To: devel@edk2.groups.io,taylor.d.beebe@gmail.com List-Unsubscribe-Post: List-Unsubscribe=One-Click List-Unsubscribe: Content-Transfer-Encoding: 8bit X-GND-Status: LEGIT Authentication-Results: spool.mail.gandi.net; dkim=pass header.d=groups.io header.s=20140610 header.b=Vm63MRES; spf=pass (spool.mail.gandi.net: domain of bounce@groups.io designates 66.175.222.108 as permitted sender) smtp.mailfrom=bounce@groups.io; dmarc=fail reason="SPF not aligned (relaxed), DKIM not aligned (relaxed)" header.from=gmail.com (policy=none) Use SetMemoryProtectionsLib to set the memory protections for the platform in both normal and PEI-less boot. The protections set are equivalent to the PCD settings and the ability to set NxForStack via QemuCfg is preserved. Once the transition to use SetMemoryProtectionsLib and GetMemoryProtectionsLib is complete in the rest of EDK2, the mechanics of setting protections in OvmfPkg will be updated and the memory protection PCDs will be deleted. Signed-off-by: Taylor Beebe Cc: Ard Biesheuvel Cc: Jiewen Yao Cc: Jordan Justen Cc: Gerd Hoffmann --- OvmfPkg/Library/PeilessStartupLib/PeilessStartup.c | 15 +++++++++++++-- OvmfPkg/PlatformPei/Platform.c | 15 +++++++++++++-- OvmfPkg/Library/PeilessStartupLib/PeilessStartupLib.inf | 3 +++ OvmfPkg/PlatformPei/PlatformPei.inf | 1 + 4 files changed, 30 insertions(+), 4 deletions(-) diff --git a/OvmfPkg/Library/PeilessStartupLib/PeilessStartup.c b/OvmfPkg/Library/PeilessStartupLib/PeilessStartup.c index 1632a2317718..cf645aad3246 100644 --- a/OvmfPkg/Library/PeilessStartupLib/PeilessStartup.c +++ b/OvmfPkg/Library/PeilessStartupLib/PeilessStartup.c @@ -14,10 +14,13 @@ #include #include #include +#include #include #include #include #include +#include +#include #include #include #include @@ -42,7 +45,9 @@ InitializePlatform ( EFI_HOB_PLATFORM_INFO *PlatformInfoHob ) { - VOID *VariableStore; + VOID *VariableStore; + DXE_MEMORY_PROTECTION_SETTINGS DxeSettings; + MM_MEMORY_PROTECTION_SETTINGS MmSettings; DEBUG ((DEBUG_INFO, "InitializePlatform in Pei-less boot\n")); PlatformDebugDumpCmos (); @@ -104,7 +109,13 @@ InitializePlatform ( PlatformMemMapInitialization (PlatformInfoHob); - PlatformNoexecDxeInitialization (PlatformInfoHob); + DxeSettings = DxeMemoryProtectionProfiles[DxeMemoryProtectionSettingsPcd].Settings; + MmSettings = MmMemoryProtectionProfiles[MmMemoryProtectionSettingsPcd].Settings; + DxeSettings.StackExecutionProtectionEnabled = PcdGetBool (PcdSetNxForStack); + QemuFwCfgParseBool ("opt/ovmf/PcdSetNxForStack", &DxeSettings.StackExecutionProtectionEnabled); + + SetDxeMemoryProtectionSettings (&DxeSettings, DxeMemoryProtectionSettingsPcd); + SetMmMemoryProtectionSettings (&MmSettings, MmMemoryProtectionSettingsPcd); if (TdIsEnabled ()) { PlatformInfoHob->PcdConfidentialComputingGuestAttr = CCAttrIntelTdx; diff --git a/OvmfPkg/PlatformPei/Platform.c b/OvmfPkg/PlatformPei/Platform.c index f5dc41c3a8c4..bcd8d3a1be14 100644 --- a/OvmfPkg/PlatformPei/Platform.c +++ b/OvmfPkg/PlatformPei/Platform.c @@ -38,6 +38,7 @@ #include #include #include +#include #include "Platform.h" @@ -304,8 +305,10 @@ InitializePlatform ( IN CONST EFI_PEI_SERVICES **PeiServices ) { - EFI_HOB_PLATFORM_INFO *PlatformInfoHob; - EFI_STATUS Status; + EFI_HOB_PLATFORM_INFO *PlatformInfoHob; + EFI_STATUS Status; + DXE_MEMORY_PROTECTION_SETTINGS DxeSettings; + MM_MEMORY_PROTECTION_SETTINGS MmSettings; DEBUG ((DEBUG_INFO, "Platform PEIM Loaded\n")); PlatformInfoHob = BuildPlatformInfoHob (); @@ -342,6 +345,14 @@ InitializePlatform ( PublishPeiMemory (PlatformInfoHob); + DxeSettings = DxeMemoryProtectionProfiles[DxeMemoryProtectionSettingsPcd].Settings; + MmSettings = MmMemoryProtectionProfiles[MmMemoryProtectionSettingsPcd].Settings; + DxeSettings.StackExecutionProtectionEnabled = PcdGetBool (PcdSetNxForStack); + QemuFwCfgParseBool ("opt/ovmf/PcdSetNxForStack", &DxeSettings.StackExecutionProtectionEnabled); + + SetDxeMemoryProtectionSettings (&DxeSettings, DxeMemoryProtectionSettingsPcd); + SetMmMemoryProtectionSettings (&MmSettings, MmMemoryProtectionSettingsPcd); + PlatformQemuUc32BaseInitialization (PlatformInfoHob); InitializeRamRegions (PlatformInfoHob); diff --git a/OvmfPkg/Library/PeilessStartupLib/PeilessStartupLib.inf b/OvmfPkg/Library/PeilessStartupLib/PeilessStartupLib.inf index 585d50463748..f0a8a5a56df4 100644 --- a/OvmfPkg/Library/PeilessStartupLib/PeilessStartupLib.inf +++ b/OvmfPkg/Library/PeilessStartupLib/PeilessStartupLib.inf @@ -56,6 +56,8 @@ [LibraryClasses] PrePiLib QemuFwCfgLib PlatformInitLib + SetMemoryProtectionsLib + QemuFwCfgSimpleParserLib [Guids] gEfiHobMemoryAllocModuleGuid @@ -81,6 +83,7 @@ [Pcd] gEfiMdeModulePkgTokenSpaceGuid.PcdImageProtectionPolicy ## SOMETIMES_CONSUMES gEfiMdeModulePkgTokenSpaceGuid.PcdPteMemoryEncryptionAddressOrMask ## CONSUMES gEfiMdeModulePkgTokenSpaceGuid.PcdNullPointerDetectionPropertyMask ## CONSUMES + gEfiMdeModulePkgTokenSpaceGuid.PcdSetNxForStack ## CONSUMES gUefiOvmfPkgTokenSpaceGuid.PcdOvmfDxeMemFvBase gUefiOvmfPkgTokenSpaceGuid.PcdOvmfDxeMemFvSize gUefiOvmfPkgTokenSpaceGuid.PcdSecureBootSupported diff --git a/OvmfPkg/PlatformPei/PlatformPei.inf b/OvmfPkg/PlatformPei/PlatformPei.inf index 3934aeed9514..6b8442d12b2c 100644 --- a/OvmfPkg/PlatformPei/PlatformPei.inf +++ b/OvmfPkg/PlatformPei/PlatformPei.inf @@ -65,6 +65,7 @@ [LibraryClasses] PcdLib CcExitLib PlatformInitLib + SetMemoryProtectionsLib [Pcd] gUefiOvmfPkgTokenSpaceGuid.PcdOvmfPeiMemFvBase -- 2.41.0.windows.3 -=-=-=-=-=-=-=-=-=-=-=- Groups.io Links: You receive all messages sent to this group. View/Reply Online (#107865): https://edk2.groups.io/g/devel/message/107865 Mute This Topic: https://groups.io/mt/100830908/7686176 Group Owner: devel+owner@edk2.groups.io Unsubscribe: https://edk2.groups.io/g/devel/unsub [rebecca@openfw.io] -=-=-=-=-=-=-=-=-=-=-=-