Re: [PATCH v4 0/7] MdeModulePkg/DxeCore: increased memory protection

[Laszlo Ersek <lersek@redhat.com>]

On 02/28/17 11:59, Ard Biesheuvel wrote:
> On 28 February 2017 at 10:52, Ard Biesheuvel <ard.biesheuvel@linaro.org> wrote:
>> On 28 February 2017 at 10:46, Laszlo Ersek <lersek@redhat.com> wrote:

>>> I regression-tested this series for x86 / OVMF as under v3, with the zero PCD default, and experienced no issues.
>>>
>>> However, v4 breaks booting Fedora 24 on my Mustang (aarch64/KVM):

>> Hmm, that is disappointing. This is probably due to GRUB's modular
>> nature, which means it allocates memory and loads executable code into
>> it, under the assumption that memory is always executable in UEFI.
>>
>> The short term fix is to remove the NX bit from LoaderData regions,
>> but in the mean time, I will work with Leif to get this fixed properly
>> (assuming there is a proper way to fix this)
>>
> 
> Care to have a quick go at using 0xC000000000007FD1 instead? (if you
> are not already doing so)


With the following patch on top:

> commit ef6be33275e45045a15201a15a2be26e6fbabcaa
> Author: Laszlo Ersek <lersek@redhat.com>
> Date:   Wed Mar 1 00:06:37 2017 +0100
>
>     ArmVirtPkg: remove the NX bit from LoaderData regions
>
>     msgid <CAKv+Gu8V4o0-s9jhQSM5hFaaC6yppdC001MiuBX830WrXi_VKQ@mail.gmail.com>
>
>     Suggested-by: Ard Biesheuvel <ard.biesheuvel@linaro.org>
>     Contributed-under: TianoCore Contribution Agreement 1.0
>     Signed-off-by: Laszlo Ersek <lersek@redhat.com>
>
> diff --git a/ArmVirtPkg/ArmVirt.dsc.inc b/ArmVirtPkg/ArmVirt.dsc.inc
> index 23b601a199ed..4d3ae5d0bc80 100644
> --- a/ArmVirtPkg/ArmVirt.dsc.inc
> +++ b/ArmVirtPkg/ArmVirt.dsc.inc
> @@ -386,7 +386,7 @@ [PcdsFixedAtBuild.AARCH64]
>    # Enable NX memory protection for all non-code regions, including OEM and OS
>    # reserved ones.
>    #
> -  gEfiMdeModulePkgTokenSpaceGuid.PcdDxeNxMemoryProtectionPolicy|0xC000000000007FD5
> +  gEfiMdeModulePkgTokenSpaceGuid.PcdDxeNxMemoryProtectionPolicy|0xC000000000007FD1
>
>  [Components.common]
>    #

all three guests mentioned previously boot okay.

(I also made sure that the "applying strict permissions..." messages showed up in the firmware log for each.)

Thanks
Laszlo