Re: [PATCH V3 0/4] DXE Memory Protection

[Ard Biesheuvel <ard.biesheuvel@linaro.org>]

On 9 February 2017 at 07:43, Yao, Jiewen <jiewen.yao@intel.com> wrote:
> Hi Lindholm/Ard
> This version 3 contains both of your feedback before.
>
> If you can do me a favor to evaluated the impact to ARM, that will be great.
>

I will take a look right away.

> Thank you
> Yao Jiewen
>
>> -----Original Message-----
>> From: edk2-devel [mailto:edk2-devel-bounces@lists.01.org] On Behalf Of Jiewen
>> Yao
>> Sent: Wednesday, February 8, 2017 11:20 PM
>> To: edk2-devel@lists.01.org
>> Cc: Tian, Feng <feng.tian@intel.com>; Ard Biesheuvel
>> <ard.biesheuvel@linaro.org>; Leif Lindholm <leif.lindholm@linaro.org>; Kinney,
>> Michael D <michael.d.kinney@intel.com>; Fan, Jeff <jeff.fan@intel.com>; Zeng,
>> Star <star.zeng@intel.com>
>> Subject: [edk2] [PATCH V3 0/4] DXE Memory Protection
>>
>> ==== V3 ====
>> 1) Add PCD for policy control (feedback from Ard Biesheuvel)
>> (Discussed with Mike Kinney)
>> +  #    BIT0       - Image from unknown device. <BR>
>> +  #    BIT1       - Image from firmware volume.<BR>
>> +  # @Prompt Set image protection policy.
>> +  # @ValidRange 0x80000002 | 0x00000000 - 0x0000001F
>> +
>> gEfiMdeModulePkgTokenSpaceGuid.PcdImageProtectionPolicy|0x00000002|UIN
>> T32|0x00001047
>>
>> 2) Remove unused function in CpuDxe.(feedback from Liming Gao)
>> 3) Add commit log on link option assumption (feedback from Feng Tian)
>>
>> ==== V2 ====
>> 1) Clean up ArmPkg, (feedback from Leif Lindholm)
>>
>> ==== V1 ====
>> This series patch provides capability to protect PE/COFF image
>> in DXE memory.
>> If the UEFI image is page aligned, the image code section is set to read
>> only and the image data section is set to non-executable.
>>
>> The DxeCore calls CpuArchProtocol->SetMemoryAttributes() to protect
>> the image.
>>
>> Tested platform: NT32/Quark IA32/OVMF IA32/OVMF IA32X64/Intel internal X64/
>> Tested OS: UEFI Win10, UEFI Ubuntu 16.04.
>>
>> Untested platform: ARM/AARCH64.
>> Can ARM/AARCH64 owner help to take a look and try the ARM platform?
>>
>>
>> Cc: Jeff Fan <jeff.fan@intel.com>
>> Cc: Michael Kinney <michael.d.kinney@intel.com>
>> Cc: Leif Lindholm <leif.lindholm@linaro.org>
>> Cc: Ard Biesheuvel <ard.biesheuvel@linaro.org>
>> Cc: Star Zeng <star.zeng@intel.com>
>> Cc: Feng Tian <feng.tian@intel.com>
>> Contributed-under: TianoCore Contribution Agreement 1.0
>> Signed-off-by: Jiewen Yao <jiewen.yao@intel.com>
>>
>> Jiewen Yao (4):
>>   UefiCpuPkg/CpuDxe: Add memory attribute setting.
>>   ArmPkg/CpuDxe: Correct EFI_MEMORY_RO usage
>>   MdeModulePkg/dec: add PcdImageProtectionPolicy.
>>   MdeModulePkg/DxeCore: Add UEFI image protection.
>>
>>  ArmPkg/Drivers/CpuDxe/AArch64/Mmu.c              |   3 +-
>>  ArmPkg/Drivers/CpuDxe/Arm/Mmu.c                  |  14 +-
>>  ArmPkg/Drivers/CpuDxe/CpuMmuCommon.c             |   5 +-
>>  ArmPkg/Library/ArmMmuLib/AArch64/ArmMmuLibCore.c |   3 +-
>>  MdeModulePkg/Core/Dxe/DxeMain.h                  |  53 ++
>>  MdeModulePkg/Core/Dxe/DxeMain.inf                |   5 +-
>>  MdeModulePkg/Core/Dxe/DxeMain/DxeMain.c          |   3 +-
>>  MdeModulePkg/Core/Dxe/Image/Image.c              |   7 +-
>>  MdeModulePkg/Core/Dxe/Misc/MemoryProtection.c    | 735
>> ++++++++++++++++++
>>  MdeModulePkg/Core/Dxe/Misc/PropertiesTable.c     |  24 +-
>>  MdeModulePkg/MdeModulePkg.dec                    |  10 +
>>  UefiCpuPkg/CpuDxe/CpuDxe.c                       | 141 ++--
>>  UefiCpuPkg/CpuDxe/CpuDxe.inf                     |   5 +-
>>  UefiCpuPkg/CpuDxe/CpuPageTable.c                 | 779
>> ++++++++++++++++++++
>>  UefiCpuPkg/CpuDxe/CpuPageTable.h                 | 113 +++
>>  15 files changed, 1801 insertions(+), 99 deletions(-)
>>  create mode 100644 MdeModulePkg/Core/Dxe/Misc/MemoryProtection.c
>>  create mode 100644 UefiCpuPkg/CpuDxe/CpuPageTable.c
>>  create mode 100644 UefiCpuPkg/CpuDxe/CpuPageTable.h
>>
>> --
>> 2.7.4.windows.1
>>
>> _______________________________________________
>> edk2-devel mailing list
>> edk2-devel@lists.01.org
>> https://lists.01.org/mailman/listinfo/edk2-devel