Re: [edk2-devel] [PATCH v2] ArmVirt: Allow memory attributes protocol to be disabled on first boot

["Ard Biesheuvel" <ardb@kernel.org>]

On Mon, Dec 11, 2023 at 10:06 AM Gerd Hoffmann <kraxel@redhat.com> wrote:
>
> On Thu, Dec 07, 2023 at 11:06:03AM +0100, Ard Biesheuvel wrote:
> > From: Ard Biesheuvel <ardb@kernel.org>
> >
> > Shim's PE loader uses the EFI memory attributes protocol in a way that
> > results in an immediate crash when invoking the loaded image, unless the
> > base and size of its executable segment are both aligned to 4k.
> >
> > If this is not the case, it will strip the memory allocation of its
> > executable permissions, but fail to add them back for the executable
> > region, resulting in non-executable code. Unfortunately, the PE loader
> > does not even bother invoking the protocol in this case (as it notices
> > the misalignment), making it very hard for system firmware to work
> > around this by attempting to infer the intent of the caller.
> >
> > So let's introduce a QEMU command line option to indicate that the
> > protocol should not be exposed at all on the first boot, which is when
> > the issue is triggered. (fbaa64.efi is broken but grubaa64.efi boots
> > fine)
> >
> >   -fw_cfg opt/org.tianocore/UninstallMemAttrProtocolOnFirstBoot,string=y
> >
> > Also introduce a fixed boolean PCD that sets the default.
>
> Did some more testing meanwhile with latest shim.  Noticed things can
> explode in other ways as well in case the memory attribute protocol is
> present.
>
> Specifically rhel-9.3 grub on aa64 crashes with latest shim.  Which I
> suspect is that grub version not being NX-clean, and shim setting page
> permissions via memory attribute protocol triggers that bug.  Didn't
> analyze it yet though.
>
> So, while I'd love to see some automatic way here I suspect trying to be
> too clever does more harm than good.
>

OK, so not worth the trouble of trying to detect the first boot, I guess.

For my info, is rhel-9.3 an old GRUB?


-=-=-=-=-=-=-=-=-=-=-=-
Groups.io Links: You receive all messages sent to this group.
View/Reply Online (#112277): https://edk2.groups.io/g/devel/message/112277
Mute This Topic: https://groups.io/mt/103031504/7686176
Group Owner: devel+owner@edk2.groups.io
Unsubscribe: https://edk2.groups.io/g/devel/unsub [rebecca@openfw.io]
-=-=-=-=-=-=-=-=-=-=-=-