From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received-SPF: Pass (sender SPF authorized) identity=mailfrom; client-ip=134.134.136.65; helo=mga03.intel.com; envelope-from=jiewen.yao@intel.com; receiver=edk2-devel@lists.01.org Received: from mga03.intel.com (mga03.intel.com [134.134.136.65]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ml01.01.org (Postfix) with ESMTPS id 5A2932034BBDE for ; Wed, 8 Nov 2017 18:50:20 -0800 (PST) Received: from orsmga002.jf.intel.com ([10.7.209.21]) by orsmga103.jf.intel.com with ESMTP/TLS/DHE-RSA-AES256-GCM-SHA384; 08 Nov 2017 18:54:20 -0800 X-ExtLoop1: 1 X-IronPort-AV: E=Sophos;i="5.44,367,1505804400"; d="scan'208";a="5493610" Received: from fmsmsx104.amr.corp.intel.com ([10.18.124.202]) by orsmga002.jf.intel.com with ESMTP; 08 Nov 2017 18:54:20 -0800 Received: from shsmsx151.ccr.corp.intel.com (10.239.6.50) by fmsmsx104.amr.corp.intel.com (10.18.124.202) with Microsoft SMTP Server (TLS) id 14.3.319.2; Wed, 8 Nov 2017 18:53:55 -0800 Received: from shsmsx102.ccr.corp.intel.com ([169.254.2.175]) by SHSMSX151.ccr.corp.intel.com ([169.254.3.218]) with mapi id 14.03.0319.002; Thu, 9 Nov 2017 10:53:27 +0800 From: "Yao, Jiewen" To: "Wang, Jian J" , "Dong, Eric" , "Zeng, Star" , "Ni, Ruiyu" , Laszlo Ersek , "Kinney, Michael D" CC: "edk2-devel@lists.01.org" Thread-Topic: [edk2] [PATCH v4 0/7] Implement heap guard feature Thread-Index: AQHTTuqVfVdW+/iG3kSXEPE52OX3oaMK2OqAgACOmzA= Date: Thu, 9 Nov 2017 02:53:27 +0000 Message-ID: <74D8A39837DF1E4DA445A8C0B3885C503AA15CB4@shsmsx102.ccr.corp.intel.com> References: <20171027061140.17160-1-jian.j.wang@intel.com> In-Reply-To: Accept-Language: zh-CN, en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: x-titus-metadata-40: eyJDYXRlZ29yeUxhYmVscyI6IiIsIk1ldGFkYXRhIjp7Im5zIjoiaHR0cDpcL1wvd3d3LnRpdHVzLmNvbVwvbnNcL0ludGVsMyIsImlkIjoiYzZmYWJmNzgtN2YxMC00ZWE4LTkxMzUtMWFjZGY3ODY1NWFjIiwicHJvcHMiOlt7Im4iOiJDVFBDbGFzc2lmaWNhdGlvbiIsInZhbHMiOlt7InZhbHVlIjoiQ1RQX0lDIn1dfV19LCJTdWJqZWN0TGFiZWxzIjpbXSwiVE1DVmVyc2lvbiI6IjE3LjIuNS4xOCIsIlRydXN0ZWRMYWJlbEhhc2giOiJMUGlrd25OTzNXT1pxZWdSY0FobFRVc3d3K2hPaGo5QkZZejlXRDljb0UwXC9vUHN4andiS3RFS2VnNVdpMWVhNyJ9 x-ctpclassification: CTP_IC dlp-product: dlpe-windows dlp-version: 11.0.0.116 dlp-reaction: no-action x-originating-ip: [10.239.127.40] MIME-Version: 1.0 Subject: Re: [PATCH v4 0/7] Implement heap guard feature X-BeenThere: edk2-devel@lists.01.org X-Mailman-Version: 2.1.22 Precedence: list List-Id: EDK II Development List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 09 Nov 2017 02:50:20 -0000 Content-Language: en-US Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: quoted-printable That is great. I have minor suggestion below: 1) Since StaticPaging and HeapGuard are conflicted feature, I suggest we us= e ASSERT to tell the end user, instead of disable StaticPaging silently. + // + // Don't mark page table as read-only if heap guard is enabled. + // + // BIT2: SMM page guard enabled + // BIT3: SMM pool guard enabled + // + if ((PcdGet8 (PcdHeapGuardPropertyMask) & (BIT3 | BIT2)) !=3D 0) { + return ; + } + 2) I do not think we need add below in MdeModulePkg/Core/PiSmmCore/PiSmmCor= e.inf. Would you please double confirm? + CpuLib + gEfiMdeModulePkgTokenSpaceGuid.PcdPteMemoryEncryptionAddressOrMask ##= CONSUMES With ASSERT added and cleanup in PiSmmCore.inf, reviewed-by: Jiewen.yao@int= el.com Thank you Yao Jiewen > -----Original Message----- > From: Wang, Jian J > Sent: Thursday, November 9, 2017 10:00 AM > To: Yao, Jiewen ; Dong, Eric ; > Zeng, Star ; Ni, Ruiyu ; Laszlo = Ersek > ; Kinney, Michael D > Cc: Wang, Jian J ; edk2-devel@lists.01.org > Subject: RE: [edk2] [PATCH v4 0/7] Implement heap guard feature >=20 > Just a friendly reminder. >=20 > The recent commits have fixed two blocking issues for checking in heap gu= ard > feature. >=20 > 6fe575d052e36b243657a5885b5457decac41f03 (BaseCryptLib memory > overflow) > cf8197a39d07179027455421a182598bd6989999 > 5df73e2cc8e39da97d56da058667607f1c43acac (AllocateCopyPool memory > overflow) > 2a6ede28fd8efd3051794e1f2727a692d2725fe9 > 469293f8ee406f2b0bad2cf3bbbc510b2a1364eb >=20 > Please give your r-b if no more comments. I'd be happy to check in this p= atch > soon. >=20 > Thanks, > Jian >=20 > > -----Original Message----- > > From: edk2-devel [mailto:edk2-devel-bounces@lists.01.org] On Behalf Of = Jian J > > Wang > > Sent: Friday, October 27, 2017 2:12 PM > > To: edk2-devel@lists.01.org > > Subject: [edk2] [PATCH v4 0/7] Implement heap guard feature > > > > > Path V4 changes: > > > a. Change names of gEdkiiSmmMemoryAttributeProtocolGuid related > > > definitions from EFI_ to EDKII_ > > > b. Coding style cleanup > > > c. Split patches in a more reasonable order and groups > > > > > Patch V3 changes: > > > a. Add new protocol gEdkiiSmmMemoryAttributeProtocolGuid to do > > > memory attributes update instead of doing it directly in SmmCore > > > b. Fix GCC build error > > > > > Patch V2 changes: > > > a. Remove local variable initializer with memory copy from globals > > > b. Change map table dump code to use DEBUG_PAGE|DEBUG_POOL level > > > message > > > c. Fix malfunction in 32-bit boot mode > > > d. Add comment for the use of mOnGuarding > > > e. Change name of function InitializePageTableLib to > > > InitializePageTableGlobals > > > f. Add code in 32-bit code to bypass setting page table to read-only > > > g. Coding style clean-up > > > > > > > This feature makes use of paging mechanism to add a hidden (not present= ) > > page just before and after the allocated memory block. If the code trie= s > > to access memory outside of the allocated part, page fault exception wi= ll > > be triggered. > > > > This feature is disabled by default and is not recommended to enable it > > in production build of BIOS. > > > > This patch has passed following validations: > > > > a. Boot to shell (OVMF, Intel real platform)(32/64) > > b. Boot to Fedora 25 (64) > > > > NT32 emulation platform was not validated with this feature enabled > > due to the fact that it doesn't support paging which is needed for > > this feature to work. But all are validated with feature is disabled. > > > > Suggested-by: Ayellet Wolman > > Contributed-under: TianoCore Contribution Agreement 1.1 > > Signed-off-by: Jian J Wang > > > > Jian J Wang (7): > > MdeModulePkg/MdeModulePkg.dec,.uni: Add Protocol, PCDs and string > > tokens > > MdeModulePkg/SmmMemoryAttribute.h: Add new protocol definitions > > UefiCpuPkg/CpuDxe: Reduce debug message > > MdeModulePkg/DxeIpl: Enable paging for heap guard > > MdeModulePkg/DxeCore: Implement heap guard feature for UEFI > > UefiCpuPkg/PiSmmCpuDxeSmm: Add SmmMemoryAttribute protocol > > MdeModulePkg/PiSmmCore: Implement heap guard feature for SMM > mode > > > > MdeModulePkg/Core/Dxe/DxeMain.inf | 4 + > > MdeModulePkg/Core/Dxe/Mem/HeapGuard.c | 1182 > > ++++++++++++++++ > > MdeModulePkg/Core/Dxe/Mem/HeapGuard.h | 394 > ++++++ > > MdeModulePkg/Core/Dxe/Mem/Imem.h | 38 +- > > MdeModulePkg/Core/Dxe/Mem/Page.c | 130 +- > > MdeModulePkg/Core/Dxe/Mem/Pool.c | 154 +- > > MdeModulePkg/Core/DxeIplPeim/DxeIpl.inf | 1 + > > MdeModulePkg/Core/DxeIplPeim/Ia32/DxeLoadFunc.c | 36 +- > > MdeModulePkg/Core/PiSmmCore/HeapGuard.c | 1467 > > ++++++++++++++++++++ > > MdeModulePkg/Core/PiSmmCore/HeapGuard.h | 398 > ++++++ > > MdeModulePkg/Core/PiSmmCore/Page.c | 52 +- > > MdeModulePkg/Core/PiSmmCore/PiSmmCore.c | 7 +- > > MdeModulePkg/Core/PiSmmCore/PiSmmCore.h | 81 +- > > MdeModulePkg/Core/PiSmmCore/PiSmmCore.inf | 8 + > > MdeModulePkg/Core/PiSmmCore/Pool.c | 81 +- > > MdeModulePkg/Include/Protocol/SmmMemoryAttribute.h | 136 ++ > > MdeModulePkg/MdeModulePkg.dec | 60 + > > MdeModulePkg/MdeModulePkg.uni | 58 + > > UefiCpuPkg/CpuDxe/CpuPageTable.c | 5 +- > > UefiCpuPkg/PiSmmCpuDxeSmm/Ia32/PageTbl.c | 10 + > > UefiCpuPkg/PiSmmCpuDxeSmm/PiSmmCpuDxeSmm.c | 20 + > > UefiCpuPkg/PiSmmCpuDxeSmm/PiSmmCpuDxeSmm.h | 98 ++ > > UefiCpuPkg/PiSmmCpuDxeSmm/PiSmmCpuDxeSmm.inf | 2 + > > UefiCpuPkg/PiSmmCpuDxeSmm/SmmCpuMemoryManagement.c | 163 > +++ > > UefiCpuPkg/PiSmmCpuDxeSmm/X64/PageTbl.c | 10 +- > > 25 files changed, 4496 insertions(+), 99 deletions(-) > > create mode 100644 MdeModulePkg/Core/Dxe/Mem/HeapGuard.c > > create mode 100644 MdeModulePkg/Core/Dxe/Mem/HeapGuard.h > > create mode 100644 MdeModulePkg/Core/PiSmmCore/HeapGuard.c > > create mode 100644 MdeModulePkg/Core/PiSmmCore/HeapGuard.h > > create mode 100644 > MdeModulePkg/Include/Protocol/SmmMemoryAttribute.h > > > > -- > > 2.14.1.windows.1 > > > > _______________________________________________ > > edk2-devel mailing list > > edk2-devel@lists.01.org > > https://lists.01.org/mailman/listinfo/edk2-devel