From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from mail02.groups.io (mail02.groups.io [66.175.222.108]) by spool.mail.gandi.net (Postfix) with ESMTPS id 30F50740038 for ; Mon, 9 Oct 2023 00:08:08 +0000 (UTC) DKIM-Signature: a=rsa-sha256; bh=wyVFKMbf9XiwFgyam+Ksve/gh0MvGshDqhTLgxOzEFo=; c=relaxed/simple; d=groups.io; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References:MIME-Version:Precedence:List-Subscribe:List-Help:Sender:List-Id:Mailing-List:Delivered-To:Reply-To:List-Unsubscribe-Post:List-Unsubscribe:Content-Transfer-Encoding; s=20140610; t=1696810086; v=1; b=oczomw9pdzuEAbUhofzDajizgQBLj7IUWuxM+BDxC+//x+winciag4cO0DQ25eI6pxuTkapo w9DKwlIZqETkIy6ujggZI3fVrj34UFRWq0r27qyrs6mNzpPIa8v3SRDypHjBnWLv6eYaOMhejEY JWcGIhN5cS8+hXDumvAuX0OY= X-Received: by 127.0.0.2 with SMTP id TgrgYY7687511xwSptABjo66; Sun, 08 Oct 2023 17:08:06 -0700 X-Received: from mail-ot1-f45.google.com (mail-ot1-f45.google.com [209.85.210.45]) by mx.groups.io with SMTP id smtpd.web10.50222.1696810082396800524 for ; Sun, 08 Oct 2023 17:08:02 -0700 X-Received: by mail-ot1-f45.google.com with SMTP id 46e09a7af769-6bd04558784so3008860a34.3 for ; Sun, 08 Oct 2023 17:08:02 -0700 (PDT) X-Gm-Message-State: A0LyzevR8fGdd9WJRankwMi5x7686176AA= X-Google-Smtp-Source: AGHT+IHftRUbPkbufcrXf5V5UEXIbES9Ga3/V9szA1SNLfdRLRRWXmxVxRBLiMAPMo1sHAbV0u78gw== X-Received: by 2002:a05:6871:592:b0:1d5:5659:4730 with SMTP id u18-20020a056871059200b001d556594730mr18563501oan.37.1696810081572; Sun, 08 Oct 2023 17:08:01 -0700 (PDT) X-Received: from localhost.localdomain ([50.46.253.1]) by smtp.gmail.com with ESMTPSA id t20-20020a62ea14000000b0068fcc7f6b00sm5048320pfh.74.2023.10.08.17.08.01 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Sun, 08 Oct 2023 17:08:01 -0700 (PDT) From: "Taylor Beebe" To: devel@edk2.groups.io Cc: Ard Biesheuvel , Jiewen Yao , Jordan Justen , Gerd Hoffmann Subject: [edk2-devel] [PATCH v5 11/28] OvmfPkg: Apply Memory Protections via SetMemoryProtectionsLib Date: Sun, 8 Oct 2023 17:07:23 -0700 Message-ID: <20231009000742.1792-12-taylor.d.beebe@gmail.com> In-Reply-To: <20231009000742.1792-1-taylor.d.beebe@gmail.com> References: <20231009000742.1792-1-taylor.d.beebe@gmail.com> MIME-Version: 1.0 Precedence: Bulk List-Subscribe: List-Help: Sender: devel@edk2.groups.io List-Id: Mailing-List: list devel@edk2.groups.io; contact devel+owner@edk2.groups.io Reply-To: devel@edk2.groups.io,taylor.d.beebe@gmail.com List-Unsubscribe-Post: List-Unsubscribe=One-Click List-Unsubscribe: Content-Transfer-Encoding: 8bit X-GND-Status: LEGIT Authentication-Results: spool.mail.gandi.net; dkim=pass header.d=groups.io header.s=20140610 header.b=oczomw9p; dmarc=fail reason="SPF not aligned (relaxed), DKIM not aligned (relaxed)" header.from=gmail.com (policy=none); spf=pass (spool.mail.gandi.net: domain of bounce@groups.io designates 66.175.222.108 as permitted sender) smtp.mailfrom=bounce@groups.io Use SetMemoryProtectionsLib to set the memory protections for the platform in both normal and PEI-less boot. The protections set are equivalent to the PCD settings and the ability to set NxForStack via QemuCfg is preserved. Once the transition to use SetMemoryProtectionsLib and GetMemoryProtectionsLib is complete in the rest of EDK2, the mechanics of setting protections in OvmfPkg will be updated and the memory protection PCDs will be deleted. Signed-off-by: Taylor Beebe Cc: Ard Biesheuvel Cc: Jiewen Yao Cc: Jordan Justen Cc: Gerd Hoffmann --- OvmfPkg/Library/PeilessStartupLib/PeilessStartup.c | 15 +++++++++++++-- OvmfPkg/PlatformPei/Platform.c | 15 +++++++++++++-- OvmfPkg/Library/PeilessStartupLib/PeilessStartupLib.inf | 3 +++ OvmfPkg/PlatformPei/PlatformPei.inf | 1 + 4 files changed, 30 insertions(+), 4 deletions(-) diff --git a/OvmfPkg/Library/PeilessStartupLib/PeilessStartup.c b/OvmfPkg/Library/PeilessStartupLib/PeilessStartup.c index 1632a2317718..cf645aad3246 100644 --- a/OvmfPkg/Library/PeilessStartupLib/PeilessStartup.c +++ b/OvmfPkg/Library/PeilessStartupLib/PeilessStartup.c @@ -14,10 +14,13 @@ #include #include #include +#include #include #include #include #include +#include +#include #include #include #include @@ -42,7 +45,9 @@ InitializePlatform ( EFI_HOB_PLATFORM_INFO *PlatformInfoHob ) { - VOID *VariableStore; + VOID *VariableStore; + DXE_MEMORY_PROTECTION_SETTINGS DxeSettings; + MM_MEMORY_PROTECTION_SETTINGS MmSettings; DEBUG ((DEBUG_INFO, "InitializePlatform in Pei-less boot\n")); PlatformDebugDumpCmos (); @@ -104,7 +109,13 @@ InitializePlatform ( PlatformMemMapInitialization (PlatformInfoHob); - PlatformNoexecDxeInitialization (PlatformInfoHob); + DxeSettings = DxeMemoryProtectionProfiles[DxeMemoryProtectionSettingsPcd].Settings; + MmSettings = MmMemoryProtectionProfiles[MmMemoryProtectionSettingsPcd].Settings; + DxeSettings.StackExecutionProtectionEnabled = PcdGetBool (PcdSetNxForStack); + QemuFwCfgParseBool ("opt/ovmf/PcdSetNxForStack", &DxeSettings.StackExecutionProtectionEnabled); + + SetDxeMemoryProtectionSettings (&DxeSettings, DxeMemoryProtectionSettingsPcd); + SetMmMemoryProtectionSettings (&MmSettings, MmMemoryProtectionSettingsPcd); if (TdIsEnabled ()) { PlatformInfoHob->PcdConfidentialComputingGuestAttr = CCAttrIntelTdx; diff --git a/OvmfPkg/PlatformPei/Platform.c b/OvmfPkg/PlatformPei/Platform.c index f5dc41c3a8c4..bcd8d3a1be14 100644 --- a/OvmfPkg/PlatformPei/Platform.c +++ b/OvmfPkg/PlatformPei/Platform.c @@ -38,6 +38,7 @@ #include #include #include +#include #include "Platform.h" @@ -304,8 +305,10 @@ InitializePlatform ( IN CONST EFI_PEI_SERVICES **PeiServices ) { - EFI_HOB_PLATFORM_INFO *PlatformInfoHob; - EFI_STATUS Status; + EFI_HOB_PLATFORM_INFO *PlatformInfoHob; + EFI_STATUS Status; + DXE_MEMORY_PROTECTION_SETTINGS DxeSettings; + MM_MEMORY_PROTECTION_SETTINGS MmSettings; DEBUG ((DEBUG_INFO, "Platform PEIM Loaded\n")); PlatformInfoHob = BuildPlatformInfoHob (); @@ -342,6 +345,14 @@ InitializePlatform ( PublishPeiMemory (PlatformInfoHob); + DxeSettings = DxeMemoryProtectionProfiles[DxeMemoryProtectionSettingsPcd].Settings; + MmSettings = MmMemoryProtectionProfiles[MmMemoryProtectionSettingsPcd].Settings; + DxeSettings.StackExecutionProtectionEnabled = PcdGetBool (PcdSetNxForStack); + QemuFwCfgParseBool ("opt/ovmf/PcdSetNxForStack", &DxeSettings.StackExecutionProtectionEnabled); + + SetDxeMemoryProtectionSettings (&DxeSettings, DxeMemoryProtectionSettingsPcd); + SetMmMemoryProtectionSettings (&MmSettings, MmMemoryProtectionSettingsPcd); + PlatformQemuUc32BaseInitialization (PlatformInfoHob); InitializeRamRegions (PlatformInfoHob); diff --git a/OvmfPkg/Library/PeilessStartupLib/PeilessStartupLib.inf b/OvmfPkg/Library/PeilessStartupLib/PeilessStartupLib.inf index 585d50463748..f0a8a5a56df4 100644 --- a/OvmfPkg/Library/PeilessStartupLib/PeilessStartupLib.inf +++ b/OvmfPkg/Library/PeilessStartupLib/PeilessStartupLib.inf @@ -56,6 +56,8 @@ [LibraryClasses] PrePiLib QemuFwCfgLib PlatformInitLib + SetMemoryProtectionsLib + QemuFwCfgSimpleParserLib [Guids] gEfiHobMemoryAllocModuleGuid @@ -81,6 +83,7 @@ [Pcd] gEfiMdeModulePkgTokenSpaceGuid.PcdImageProtectionPolicy ## SOMETIMES_CONSUMES gEfiMdeModulePkgTokenSpaceGuid.PcdPteMemoryEncryptionAddressOrMask ## CONSUMES gEfiMdeModulePkgTokenSpaceGuid.PcdNullPointerDetectionPropertyMask ## CONSUMES + gEfiMdeModulePkgTokenSpaceGuid.PcdSetNxForStack ## CONSUMES gUefiOvmfPkgTokenSpaceGuid.PcdOvmfDxeMemFvBase gUefiOvmfPkgTokenSpaceGuid.PcdOvmfDxeMemFvSize gUefiOvmfPkgTokenSpaceGuid.PcdSecureBootSupported diff --git a/OvmfPkg/PlatformPei/PlatformPei.inf b/OvmfPkg/PlatformPei/PlatformPei.inf index 3934aeed9514..6b8442d12b2c 100644 --- a/OvmfPkg/PlatformPei/PlatformPei.inf +++ b/OvmfPkg/PlatformPei/PlatformPei.inf @@ -65,6 +65,7 @@ [LibraryClasses] PcdLib CcExitLib PlatformInitLib + SetMemoryProtectionsLib [Pcd] gUefiOvmfPkgTokenSpaceGuid.PcdOvmfPeiMemFvBase -- 2.42.0.windows.2 -=-=-=-=-=-=-=-=-=-=-=- Groups.io Links: You receive all messages sent to this group. View/Reply Online (#109416): https://edk2.groups.io/g/devel/message/109416 Mute This Topic: https://groups.io/mt/101843353/7686176 Group Owner: devel+owner@edk2.groups.io Unsubscribe: https://edk2.groups.io/g/devel/unsub [rebecca@openfw.io] -=-=-=-=-=-=-=-=-=-=-=-