From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from mga05.intel.com (mga05.intel.com [192.55.52.43]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ml01.01.org (Postfix) with ESMTPS id 3FFD281EC1 for ; Wed, 16 Nov 2016 08:14:45 -0800 (PST) Received: from fmsmga005.fm.intel.com ([10.253.24.32]) by fmsmga105.fm.intel.com with ESMTP; 16 Nov 2016 08:14:50 -0800 X-ExtLoop1: 1 X-IronPort-AV: E=Sophos;i="5.31,500,1473145200"; d="scan'208,217";a="32062730" Received: from fmsmsx107.amr.corp.intel.com ([10.18.124.205]) by fmsmga005.fm.intel.com with ESMTP; 16 Nov 2016 08:14:50 -0800 Received: from fmsmsx112.amr.corp.intel.com (10.18.116.6) by fmsmsx107.amr.corp.intel.com (10.18.124.205) with Microsoft SMTP Server (TLS) id 14.3.248.2; Wed, 16 Nov 2016 08:14:49 -0800 Received: from shsmsx152.ccr.corp.intel.com (10.239.6.52) by FMSMSX112.amr.corp.intel.com (10.18.116.6) with Microsoft SMTP Server (TLS) id 14.3.248.2; Wed, 16 Nov 2016 08:14:49 -0800 Received: from shsmsx102.ccr.corp.intel.com ([169.254.2.239]) by SHSMSX152.ccr.corp.intel.com ([169.254.6.138]) with mapi id 14.03.0248.002; Thu, 17 Nov 2016 00:14:47 +0800 From: "Yao, Jiewen" To: Laszlo Ersek , "Fan, Jeff" , "edk2-devel@lists.01.org" CC: "Kinney, Michael D" , Paolo Bonzini , "Tian, Feng" , "Zeng, Star" Thread-Topic: [edk2] [PATCH V3 0/6] Enable SMM page level protection. Thread-Index: AQHSO/pAI7G2Yg21Yk2nIlgPeIwk7qDTfLhA//+y34CAAANGAIAAiEmg//99ngCABZ5ZgIACbfWAgACLr6A= Date: Wed, 16 Nov 2016 16:14:46 +0000 Message-ID: <74D8A39837DF1E4DA445A8C0B3885C50386D5D57@shsmsx102.ccr.corp.intel.com> References: <1478854859-11096-1-git-send-email-jiewen.yao@intel.com> <74D8A39837DF1E4DA445A8C0B3885C50386CF501@shsmsx102.ccr.corp.intel.com> <542CF652F8836A4AB8DBFAAD40ED192A4A2DAC96@shsmsx102.ccr.corp.intel.com> <74D8A39837DF1E4DA445A8C0B3885C50386CF65D@shsmsx102.ccr.corp.intel.com> <437279e7-879f-af4f-03d8-babdd3576e84@redhat.com> In-Reply-To: Accept-Language: zh-CN, en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: x-originating-ip: [10.239.127.40] MIME-Version: 1.0 X-Content-Filtered-By: Mailman/MimeDel 2.1.21 Subject: Re: [PATCH V3 0/6] Enable SMM page level protection. X-BeenThere: edk2-devel@lists.01.org X-Mailman-Version: 2.1.21 Precedence: list List-Id: EDK II Development List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 16 Nov 2016 16:14:45 -0000 Content-Language: en-US Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: quoted-printable Sounds great. Many thanks! I will prefer checking at first. I will create another patch for OVMF, do some basic test, then submit it. Thank you Yao Jiewen From: Laszlo Ersek [mailto:lersek@redhat.com] Sent: Wednesday, November 16, 2016 11:53 PM To: Yao, Jiewen ; Fan, Jeff ; edk= 2-devel@lists.01.org Cc: Kinney, Michael D ; Paolo Bonzini ; Tian, Feng ; Zeng, Star Subject: Re: [edk2] [PATCH V3 0/6] Enable SMM page level protection. On 11/15/16 03:47, Laszlo Ersek wrote: > On 11/11/16 13:59, Laszlo Ersek wrote: >> On 11/11/16 13:53, Yao, Jiewen wrote: >>> Sorry, I did not explain it clear enough before. >>> >>> Jeff is right. The NX fix is introduced in this patch series. >>> The reason is that when we update page table to protect the SMRAM, we w= ould like enable the protection as early as possible. >>> We moved the NX enabling code from C function to ASM function to achiev= e that. >>> >>> You can see my GIT message in 5/6. >>> =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D >>> The XD enabling code is moved to SmiEntry to let NX take effect. >>> =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D >>> >>> Unfortunately, I introduced a bug there. You help to catch it and now I= fix it. >>> It is not related to current code. >>> >>> What about your idea? >> >> Right, I missed that the XD handling in SmiEntry.nasm was brand new code >> added by this series. So, the current structure of both series should be >> fine; I should be able to start testing them (hopefully) soon. > > Jeff's v2 series was fine, and it is now committed (see > ). > > However, in order to test it successfully with OVMF, I needed the > patches linked in . > I intend to test this v3 series too with those (QEMU and OVMF) patches > applied. I hope I can get to it tomorrow or so. (1) I tested this series as fetched from Jiewen's public SmmProtection_V3_R= ebase branch (which is based on current master, ec8a38770090 "UefiCpuPkg/Pi= SmmCpuDxeSmm: Decrease mNumberToFinish in AP safe code"), *plus* I applied = the QEMU and OVMF patches listed in and . series OVMF = VCPU boot S3 resume # applied platform PcdCpuMaxLogicalProcessorNumber PcdCpuSmmStaticPageTabl= e topology result result -- ------- -------- ------------------------------- -----------------------= - -------- ------ --------- 1 no Ia32 64 n/a = 1x2x2 pass pass 4 no Ia32X64 64 n/a = 1x2x2 pass pass 7 v3 Ia32 64 FALSE = 1x2x2 pass pass (40 cycles) 8 v3 Ia32 64 TRUE = 1x2x2 pass pass (40 cycles) 13 v3 Ia32X64 64 FALSE = 1x2x2 pass pass (40 cycles) 14 v3 Ia32X64 64 TRUE = 1x2x2 pass pass (40 cycles) For patches #1 through #5: Tested-by: Laszlo Ersek > (2) Jiewen, after this series is reviewed and you commit it, can you please= submit an OvmfPkg patch for addressing the following messages in the log: > SMM !!!!!!!! InsertImageRecord - Section Alignment(0x20) is not 4K !!!!= !!!! For that, I believe we need a patch similar to: commit ddd89cd50dd3a989e58a75ed38011168e3ec0954 Author: Ard Biesheuvel > Date: Wed Sep 30 08:53:00 2015 +0000 OvmfPkg: set 4 KB section alignment for DXE_RUNTIME_DRIVER modules Increase the section alignment to 4 KB for DXE_RUNTIME_DRIVER modules. This allows the OS to map them with tightened permissions (i.e., R-X fo= r .text and RW- for .data). This is a prerequisite for enabling the EFI_PROPERTIES_RUNTIME_MEMORY_PROTECTION_NON_EXECUTABLE_PE_DATA (sic) feature that was introduced in UEFIv2.5. Contributed-under: TianoCore Contribution Agreement 1.0 Signed-off-by: Ard Biesheuvel > Reviewed-by: Laszlo Ersek > Reviewed-by: Jordan Justen > Tested-by: Laszlo Ersek > git-svn-id: https://svn.code.sf.net/p/edk2/code/trunk/edk2@18564 6f1925= 9b-4bc3-4df7-8a09-765794883524 just that it should be for DXE_SMM_DRIVER and for SMM_CORE. ... Basically, please submit patch #6 for OvmfPkg as well. (I can test that= too for you, but I prefer to see this series committed first, so this patc= h should be separate.) Thank you, Laszlo