From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from mail02.groups.io (mail02.groups.io [66.175.222.108]) by spool.mail.gandi.net (Postfix) with ESMTPS id A7459740037 for ; Wed, 30 Aug 2023 23:19:15 +0000 (UTC) DKIM-Signature: a=rsa-sha256; bh=+U4QKEPAkVXL6Eb3kg3n7KfU3WoAKpk1vxyiVTq2pM0=; c=relaxed/simple; d=groups.io; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References:MIME-Version:Precedence:List-Subscribe:List-Help:Sender:List-Id:Mailing-List:Delivered-To:Reply-To:List-Unsubscribe-Post:List-Unsubscribe:Content-Transfer-Encoding; s=20140610; t=1693437554; v=1; b=uStcN+mq727yVxeLFej0YRYvu14Z8q1DbvMZi9L3owepF2Nw4g0Y32cELEc46gW1DGvQFodl 1Jvx7572xpWSQL/hV8JJID7WY3QfpK1eZJDoDXhc3HJG6vQ8aErCRPPW9EmdSeA75HnfDY7Zlw8 yyVx7Zm8Ldb7HMl8gYT1prI8= X-Received: by 127.0.0.2 with SMTP id 5d4aYY7687511xrZXGFNmOSy; Wed, 30 Aug 2023 16:19:14 -0700 X-Received: from mail-pf1-f176.google.com (mail-pf1-f176.google.com [209.85.210.176]) by mx.groups.io with SMTP id smtpd.web11.4953.1693437551612791262 for ; Wed, 30 Aug 2023 16:19:11 -0700 X-Received: by mail-pf1-f176.google.com with SMTP id d2e1a72fcca58-68a529e1974so149856b3a.3 for ; Wed, 30 Aug 2023 16:19:11 -0700 (PDT) X-Gm-Message-State: WKjYKW2CihJit37YO8UqWDMyx7686176AA= X-Google-Smtp-Source: AGHT+IHwbZz66e9vqB/e51zlFpbii/BcXqwlDMjcfqjONFe04qG5mGWbCJsciCrKmaTXh9b94ZDaZw== X-Received: by 2002:a05:6a21:6811:b0:14c:4dfc:9766 with SMTP id wr17-20020a056a21681100b0014c4dfc9766mr3291657pzb.46.1693437550759; Wed, 30 Aug 2023 16:19:10 -0700 (PDT) X-Received: from localhost.localdomain ([50.46.253.1]) by smtp.gmail.com with ESMTPSA id x16-20020a62fb10000000b0064398fe3451sm102550pfm.217.2023.08.30.16.19.10 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Wed, 30 Aug 2023 16:19:10 -0700 (PDT) From: "Taylor Beebe" To: devel@edk2.groups.io Cc: Ard Biesheuvel , Jiewen Yao , Jordan Justen , Gerd Hoffmann Subject: [edk2-devel] [PATCH v3 11/26] OvmfPkg: Apply Memory Protections via SetMemoryProtectionsLib Date: Wed, 30 Aug 2023 16:18:19 -0700 Message-ID: <20230830231851.779-12-taylor.d.beebe@gmail.com> In-Reply-To: <20230830231851.779-1-taylor.d.beebe@gmail.com> References: <20230830231851.779-1-taylor.d.beebe@gmail.com> MIME-Version: 1.0 Precedence: Bulk List-Subscribe: List-Help: Sender: devel@edk2.groups.io List-Id: Mailing-List: list devel@edk2.groups.io; contact devel+owner@edk2.groups.io Reply-To: devel@edk2.groups.io,taylor.d.beebe@gmail.com List-Unsubscribe-Post: List-Unsubscribe=One-Click List-Unsubscribe: Content-Transfer-Encoding: 8bit X-GND-Status: LEGIT Authentication-Results: spool.mail.gandi.net; dkim=pass header.d=groups.io header.s=20140610 header.b=uStcN+mq; dmarc=fail reason="SPF not aligned (relaxed), DKIM not aligned (relaxed)" header.from=gmail.com (policy=none); spf=pass (spool.mail.gandi.net: domain of bounce@groups.io designates 66.175.222.108 as permitted sender) smtp.mailfrom=bounce@groups.io Use SetMemoryProtectionsLib to set the memory protections for the platform in both normal and PEI-less boot. The protections set are equivalent to the PCD settings and the ability to set NxForStack via QemuCfg is preserved. Once the transition to use SetMemoryProtectionsLib and GetMemoryProtectionsLib is complete in the rest of EDK2, the mechanics of setting protections in OvmfPkg will be updated and the memory protection PCDs will be deleted. Signed-off-by: Taylor Beebe Cc: Ard Biesheuvel Cc: Jiewen Yao Cc: Jordan Justen Cc: Gerd Hoffmann --- OvmfPkg/Library/PeilessStartupLib/PeilessStartup.c | 15 +++++++++++++-- OvmfPkg/PlatformPei/Platform.c | 15 +++++++++++++-- OvmfPkg/Library/PeilessStartupLib/PeilessStartupLib.inf | 3 +++ OvmfPkg/PlatformPei/PlatformPei.inf | 1 + 4 files changed, 30 insertions(+), 4 deletions(-) diff --git a/OvmfPkg/Library/PeilessStartupLib/PeilessStartup.c b/OvmfPkg/Library/PeilessStartupLib/PeilessStartup.c index 1632a2317718..cf645aad3246 100644 --- a/OvmfPkg/Library/PeilessStartupLib/PeilessStartup.c +++ b/OvmfPkg/Library/PeilessStartupLib/PeilessStartup.c @@ -14,10 +14,13 @@ #include #include #include +#include #include #include #include #include +#include +#include #include #include #include @@ -42,7 +45,9 @@ InitializePlatform ( EFI_HOB_PLATFORM_INFO *PlatformInfoHob ) { - VOID *VariableStore; + VOID *VariableStore; + DXE_MEMORY_PROTECTION_SETTINGS DxeSettings; + MM_MEMORY_PROTECTION_SETTINGS MmSettings; DEBUG ((DEBUG_INFO, "InitializePlatform in Pei-less boot\n")); PlatformDebugDumpCmos (); @@ -104,7 +109,13 @@ InitializePlatform ( PlatformMemMapInitialization (PlatformInfoHob); - PlatformNoexecDxeInitialization (PlatformInfoHob); + DxeSettings = DxeMemoryProtectionProfiles[DxeMemoryProtectionSettingsPcd].Settings; + MmSettings = MmMemoryProtectionProfiles[MmMemoryProtectionSettingsPcd].Settings; + DxeSettings.StackExecutionProtectionEnabled = PcdGetBool (PcdSetNxForStack); + QemuFwCfgParseBool ("opt/ovmf/PcdSetNxForStack", &DxeSettings.StackExecutionProtectionEnabled); + + SetDxeMemoryProtectionSettings (&DxeSettings, DxeMemoryProtectionSettingsPcd); + SetMmMemoryProtectionSettings (&MmSettings, MmMemoryProtectionSettingsPcd); if (TdIsEnabled ()) { PlatformInfoHob->PcdConfidentialComputingGuestAttr = CCAttrIntelTdx; diff --git a/OvmfPkg/PlatformPei/Platform.c b/OvmfPkg/PlatformPei/Platform.c index f5dc41c3a8c4..bcd8d3a1be14 100644 --- a/OvmfPkg/PlatformPei/Platform.c +++ b/OvmfPkg/PlatformPei/Platform.c @@ -38,6 +38,7 @@ #include #include #include +#include #include "Platform.h" @@ -304,8 +305,10 @@ InitializePlatform ( IN CONST EFI_PEI_SERVICES **PeiServices ) { - EFI_HOB_PLATFORM_INFO *PlatformInfoHob; - EFI_STATUS Status; + EFI_HOB_PLATFORM_INFO *PlatformInfoHob; + EFI_STATUS Status; + DXE_MEMORY_PROTECTION_SETTINGS DxeSettings; + MM_MEMORY_PROTECTION_SETTINGS MmSettings; DEBUG ((DEBUG_INFO, "Platform PEIM Loaded\n")); PlatformInfoHob = BuildPlatformInfoHob (); @@ -342,6 +345,14 @@ InitializePlatform ( PublishPeiMemory (PlatformInfoHob); + DxeSettings = DxeMemoryProtectionProfiles[DxeMemoryProtectionSettingsPcd].Settings; + MmSettings = MmMemoryProtectionProfiles[MmMemoryProtectionSettingsPcd].Settings; + DxeSettings.StackExecutionProtectionEnabled = PcdGetBool (PcdSetNxForStack); + QemuFwCfgParseBool ("opt/ovmf/PcdSetNxForStack", &DxeSettings.StackExecutionProtectionEnabled); + + SetDxeMemoryProtectionSettings (&DxeSettings, DxeMemoryProtectionSettingsPcd); + SetMmMemoryProtectionSettings (&MmSettings, MmMemoryProtectionSettingsPcd); + PlatformQemuUc32BaseInitialization (PlatformInfoHob); InitializeRamRegions (PlatformInfoHob); diff --git a/OvmfPkg/Library/PeilessStartupLib/PeilessStartupLib.inf b/OvmfPkg/Library/PeilessStartupLib/PeilessStartupLib.inf index 585d50463748..f0a8a5a56df4 100644 --- a/OvmfPkg/Library/PeilessStartupLib/PeilessStartupLib.inf +++ b/OvmfPkg/Library/PeilessStartupLib/PeilessStartupLib.inf @@ -56,6 +56,8 @@ [LibraryClasses] PrePiLib QemuFwCfgLib PlatformInitLib + SetMemoryProtectionsLib + QemuFwCfgSimpleParserLib [Guids] gEfiHobMemoryAllocModuleGuid @@ -81,6 +83,7 @@ [Pcd] gEfiMdeModulePkgTokenSpaceGuid.PcdImageProtectionPolicy ## SOMETIMES_CONSUMES gEfiMdeModulePkgTokenSpaceGuid.PcdPteMemoryEncryptionAddressOrMask ## CONSUMES gEfiMdeModulePkgTokenSpaceGuid.PcdNullPointerDetectionPropertyMask ## CONSUMES + gEfiMdeModulePkgTokenSpaceGuid.PcdSetNxForStack ## CONSUMES gUefiOvmfPkgTokenSpaceGuid.PcdOvmfDxeMemFvBase gUefiOvmfPkgTokenSpaceGuid.PcdOvmfDxeMemFvSize gUefiOvmfPkgTokenSpaceGuid.PcdSecureBootSupported diff --git a/OvmfPkg/PlatformPei/PlatformPei.inf b/OvmfPkg/PlatformPei/PlatformPei.inf index 3934aeed9514..6b8442d12b2c 100644 --- a/OvmfPkg/PlatformPei/PlatformPei.inf +++ b/OvmfPkg/PlatformPei/PlatformPei.inf @@ -65,6 +65,7 @@ [LibraryClasses] PcdLib CcExitLib PlatformInitLib + SetMemoryProtectionsLib [Pcd] gUefiOvmfPkgTokenSpaceGuid.PcdOvmfPeiMemFvBase -- 2.42.0.windows.1 -=-=-=-=-=-=-=-=-=-=-=- Groups.io Links: You receive all messages sent to this group. View/Reply Online (#108165): https://edk2.groups.io/g/devel/message/108165 Mute This Topic: https://groups.io/mt/101064083/7686176 Group Owner: devel+owner@edk2.groups.io Unsubscribe: https://edk2.groups.io/g/devel/unsub [rebecca@openfw.io] -=-=-=-=-=-=-=-=-=-=-=-