From: "Ni, Ruiyu" <ruiyu.ni@Intel.com>
To: edk2-devel@lists.01.org
Subject: Re: [PATCH 0/5] expire the use of PcdSetNxForStack
Date: Tue, 11 Sep 2018 17:13:31 +0800 [thread overview]
Message-ID: <599615e1-130a-79cb-467f-4afce7c13bda@Intel.com> (raw)
In-Reply-To: <CAKv+Gu97xS0YCU1BGKmG0Xn8nsUUTHAR0EY6S1-nivv5OWxxSw@mail.gmail.com>
On 9/11/2018 4:57 PM, Ard Biesheuvel wrote:
> On 11 September 2018 at 07:16, Jian J Wang <jian.j.wang@intel.com> wrote:
>> BZ#: https://bugzilla.tianocore.org/show_bug.cgi?id=1116
>>
>> Since the stack memory is allocated as EfiBootServicesData, its NX protection
>> can be covered by BIT4 of PcdDxeNxMemoryProtectionPolicy. To avoid confusing
>> in setting related PCDs, PcdSetNxForStack will be expired. Instead, If BIT4
>> of PcdDxeNxMemoryProtectionPolicy is set, the DxeIpl will set NX bit in page
>> table entries mapping the stack memory.
>>
>
> I disagree. This removes the possibility to map EfiBootServicesData as
> executable while still mapping the stack NX. As we all know, an
> executable stack is in a class of its own when it comes to
> exploitability, and should *never* be mapped executable unless in
> highly exceptional cases. Mapping all EfiBootServicesData as
> non-executable may cause backward compatibility problems.
Ard,
Are you saying you want the capability of setting certain range of BS
data as executable? Why does ARM need such capability?
>
> In particular, this makes it impossible for AArch64 to populate the
> 1:1 mapping using 64k pages (which is necessary for 52-bit address
> support) and still have a non-executable stack, since
> PcdDxeNxMemoryProtectionPolicy is disabled in that scenario.
>
> So please disregard these patches.
>
>
>> Jian J Wang (5):
>> MdeModulePkg/DxeIplPeim: expire the use of PcdSetNxForStack
>> OvmfPkg/PlatformPei: expire the use of PcdSetNxForStack
>> OvmfPkg: expire the use of PcdSetNxForStack
>> ArmVirtPkg/ArmVirt.dsc.inc: expire the use of PcdSetNxForStack
>> MdeModulePkg: expire PcdSetNxForStack
>>
>> ArmVirtPkg/ArmVirt.dsc.inc | 5 -----
>> MdeModulePkg/Core/DxeIplPeim/Arm/DxeLoadFunc.c | 6 +++++-
>> MdeModulePkg/Core/DxeIplPeim/DxeIpl.inf | 2 +-
>> MdeModulePkg/Core/DxeIplPeim/Ia32/DxeLoadFunc.c | 3 ++-
>> MdeModulePkg/Core/DxeIplPeim/X64/DxeLoadFunc.c | 2 +-
>> MdeModulePkg/Core/DxeIplPeim/X64/VirtualMemory.c | 14 +++++++++++---
>> MdeModulePkg/MdeModulePkg.dec | 10 +---------
>> MdeModulePkg/MdeModulePkg.uni | 10 +---------
>> OvmfPkg/OvmfPkgIa32.dsc | 1 -
>> OvmfPkg/OvmfPkgIa32X64.dsc | 1 -
>> OvmfPkg/OvmfPkgX64.dsc | 1 -
>> OvmfPkg/PlatformPei/Platform.c | 1 -
>> OvmfPkg/PlatformPei/PlatformPei.inf | 1 -
>> 13 files changed, 22 insertions(+), 35 deletions(-)
>>
>> --
>> 2.16.2.windows.1
>>
>> _______________________________________________
>> edk2-devel mailing list
>> edk2-devel@lists.01.org
>> https://lists.01.org/mailman/listinfo/edk2-devel
> _______________________________________________
> edk2-devel mailing list
> edk2-devel@lists.01.org
> https://lists.01.org/mailman/listinfo/edk2-devel
>
--
Thanks,
Ray
next prev parent reply other threads:[~2018-09-11 9:12 UTC|newest]
Thread overview: 18+ messages / expand[flat|nested] mbox.gz Atom feed top
2018-09-11 5:16 [PATCH 0/5] expire the use of PcdSetNxForStack Jian J Wang
2018-09-11 5:16 ` [PATCH 1/5] MdeModulePkg/DxeIplPeim: " Jian J Wang
2018-09-11 9:00 ` Ni, Ruiyu
2018-09-11 5:16 ` [PATCH 2/5] OvmfPkg/PlatformPei: " Jian J Wang
2018-09-11 15:53 ` Laszlo Ersek
2018-09-12 2:11 ` Wang, Jian J
2018-09-12 10:41 ` Laszlo Ersek
2018-09-13 0:45 ` Wang, Jian J
2018-09-11 5:16 ` [PATCH 3/5] OvmfPkg: " Jian J Wang
2018-09-11 5:16 ` [PATCH 4/5] ArmVirtPkg/ArmVirt.dsc.inc: " Jian J Wang
2018-09-11 5:16 ` [PATCH 5/5] MdeModulePkg: expire PcdSetNxForStack Jian J Wang
2018-09-11 5:52 ` [PATCH 0/5] expire the use of PcdSetNxForStack Yao, Jiewen
2018-09-11 8:57 ` Ard Biesheuvel
2018-09-11 9:13 ` Ni, Ruiyu [this message]
2018-09-11 21:02 ` Ard Biesheuvel
2018-09-12 0:55 ` Ni, Ruiyu
2018-09-12 15:04 ` Ard Biesheuvel
2018-09-11 11:07 ` Wang, Jian J
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-list from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=599615e1-130a-79cb-467f-4afce7c13bda@Intel.com \
--to=devel@edk2.groups.io \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox