Re: [PATCH V3 0/4] DXE Memory Protection

["Yao, Jiewen" <jiewen.yao@intel.com>]

Hi Lindholm/Ard
This version 3 contains both of your feedback before.

If you can do me a favor to evaluated the impact to ARM, that will be great.

Thank you
Yao Jiewen

> -----Original Message-----
> From: edk2-devel [mailto:edk2-devel-bounces@lists.01.org] On Behalf Of Jiewen
> Yao
> Sent: Wednesday, February 8, 2017 11:20 PM
> To: edk2-devel@lists.01.org
> Cc: Tian, Feng <feng.tian@intel.com>; Ard Biesheuvel
> <ard.biesheuvel@linaro.org>; Leif Lindholm <leif.lindholm@linaro.org>; Kinney,
> Michael D <michael.d.kinney@intel.com>; Fan, Jeff <jeff.fan@intel.com>; Zeng,
> Star <star.zeng@intel.com>
> Subject: [edk2] [PATCH V3 0/4] DXE Memory Protection
> 
> ==== V3 ====
> 1) Add PCD for policy control (feedback from Ard Biesheuvel)
> (Discussed with Mike Kinney)
> +  #    BIT0       - Image from unknown device. <BR>
> +  #    BIT1       - Image from firmware volume.<BR>
> +  # @Prompt Set image protection policy.
> +  # @ValidRange 0x80000002 | 0x00000000 - 0x0000001F
> +
> gEfiMdeModulePkgTokenSpaceGuid.PcdImageProtectionPolicy|0x00000002|UIN
> T32|0x00001047
> 
> 2) Remove unused function in CpuDxe.(feedback from Liming Gao)
> 3) Add commit log on link option assumption (feedback from Feng Tian)
> 
> ==== V2 ====
> 1) Clean up ArmPkg, (feedback from Leif Lindholm)
> 
> ==== V1 ====
> This series patch provides capability to protect PE/COFF image
> in DXE memory.
> If the UEFI image is page aligned, the image code section is set to read
> only and the image data section is set to non-executable.
> 
> The DxeCore calls CpuArchProtocol->SetMemoryAttributes() to protect
> the image.
> 
> Tested platform: NT32/Quark IA32/OVMF IA32/OVMF IA32X64/Intel internal X64/
> Tested OS: UEFI Win10, UEFI Ubuntu 16.04.
> 
> Untested platform: ARM/AARCH64.
> Can ARM/AARCH64 owner help to take a look and try the ARM platform?
> 
> 
> Cc: Jeff Fan <jeff.fan@intel.com>
> Cc: Michael Kinney <michael.d.kinney@intel.com>
> Cc: Leif Lindholm <leif.lindholm@linaro.org>
> Cc: Ard Biesheuvel <ard.biesheuvel@linaro.org>
> Cc: Star Zeng <star.zeng@intel.com>
> Cc: Feng Tian <feng.tian@intel.com>
> Contributed-under: TianoCore Contribution Agreement 1.0
> Signed-off-by: Jiewen Yao <jiewen.yao@intel.com>
> 
> Jiewen Yao (4):
>   UefiCpuPkg/CpuDxe: Add memory attribute setting.
>   ArmPkg/CpuDxe: Correct EFI_MEMORY_RO usage
>   MdeModulePkg/dec: add PcdImageProtectionPolicy.
>   MdeModulePkg/DxeCore: Add UEFI image protection.
> 
>  ArmPkg/Drivers/CpuDxe/AArch64/Mmu.c              |   3 +-
>  ArmPkg/Drivers/CpuDxe/Arm/Mmu.c                  |  14 +-
>  ArmPkg/Drivers/CpuDxe/CpuMmuCommon.c             |   5 +-
>  ArmPkg/Library/ArmMmuLib/AArch64/ArmMmuLibCore.c |   3 +-
>  MdeModulePkg/Core/Dxe/DxeMain.h                  |  53 ++
>  MdeModulePkg/Core/Dxe/DxeMain.inf                |   5 +-
>  MdeModulePkg/Core/Dxe/DxeMain/DxeMain.c          |   3 +-
>  MdeModulePkg/Core/Dxe/Image/Image.c              |   7 +-
>  MdeModulePkg/Core/Dxe/Misc/MemoryProtection.c    | 735
> ++++++++++++++++++
>  MdeModulePkg/Core/Dxe/Misc/PropertiesTable.c     |  24 +-
>  MdeModulePkg/MdeModulePkg.dec                    |  10 +
>  UefiCpuPkg/CpuDxe/CpuDxe.c                       | 141 ++--
>  UefiCpuPkg/CpuDxe/CpuDxe.inf                     |   5 +-
>  UefiCpuPkg/CpuDxe/CpuPageTable.c                 | 779
> ++++++++++++++++++++
>  UefiCpuPkg/CpuDxe/CpuPageTable.h                 | 113 +++
>  15 files changed, 1801 insertions(+), 99 deletions(-)
>  create mode 100644 MdeModulePkg/Core/Dxe/Misc/MemoryProtection.c
>  create mode 100644 UefiCpuPkg/CpuDxe/CpuPageTable.c
>  create mode 100644 UefiCpuPkg/CpuDxe/CpuPageTable.h
> 
> --
> 2.7.4.windows.1
> 
> _______________________________________________
> edk2-devel mailing list
> edk2-devel@lists.01.org
> https://lists.01.org/mailman/listinfo/edk2-devel