Re: [PATCH] ArmVirtPkg/ArmVirt.dsc.inc: AARCH64: enable DXE image protection feature

[Laszlo Ersek <lersek@redhat.com>]

On 02/22/17 12:54, Ard Biesheuvel wrote:
> Enable the new DXE image protection for all image, i.e., FV images but
> also external images that originate from disk or the network, such as
> OS loaders.
> 
> This complements work that is underway on the arm64/Linux kernel side,
> to emit the OS loader with 4 KB section alignment, and a suitable split
> between code and data.
> 
> http://marc.info/?l=linux-arm-kernel&m=148655557227819
> 
> Contributed-under: TianoCore Contribution Agreement 1.0
> Signed-off-by: Ard Biesheuvel <ard.biesheuvel@linaro.org>
> ---
>  ArmVirtPkg/ArmVirt.dsc.inc | 10 ++++++++++
>  1 file changed, 10 insertions(+)
> 
> diff --git a/ArmVirtPkg/ArmVirt.dsc.inc b/ArmVirtPkg/ArmVirt.dsc.inc
> index dbd6678accde..c0d5e7c6aa6d 100644
> --- a/ArmVirtPkg/ArmVirt.dsc.inc
> +++ b/ArmVirtPkg/ArmVirt.dsc.inc
> @@ -17,6 +17,9 @@ [Defines]
>    DEFINE DEBUG_PRINT_ERROR_LEVEL = 0x8000004F
>    DEFINE TTY_TERMINAL            = FALSE
>  
> +[BuildOptions.common.EDKII.DXE_DRIVER,BuildOptions.common.EDKII.UEFI_DRIVER,BuildOptions.common.EDKII.UEFI_APPLICATION]
> +  GCC:*_*_AARCH64_DLINK_FLAGS = -z common-page-size=0x1000
> +
>  [BuildOptions.common.EDKII.DXE_RUNTIME_DRIVER]
>    GCC:*_*_ARM_DLINK_FLAGS = -z common-page-size=0x1000
>    GCC:*_*_AARCH64_DLINK_FLAGS = -z common-page-size=0x10000
> @@ -380,6 +383,13 @@ [PcdsFixedAtBuild.common]
>  [PcdsFixedAtBuild.ARM]
>    gEmbeddedTokenSpaceGuid.PcdPrePiCpuMemorySize|40
>  
> +[PcdsFixedAtBuild.AARCH64]
> +  #
> +  # Enable strict image permissions for all images. (This applies
> +  # only to images that were built with >= 4 KB section alignment.)
> +  #
> +  gEfiMdeModulePkgTokenSpaceGuid.PcdImageProtectionPolicy|0x3
> +
>  [Components.common]
>    #
>    # Networking stack
> 

So, if I understand correctly, setting BIT0 will not break external
images with unaligned sections, they just won't be protected, and
they'll trigger loud warnings. OK.

Reviewed-by: Laszlo Ersek <lersek@redhat.com>

Thanks
Laszlo