Re: [PATCH V3 0/4] DXE Memory Protection

[Ard Biesheuvel <ard.biesheuvel@linaro.org>]

On 10 February 2017 at 12:59, Yao, Jiewen <jiewen.yao@intel.com> wrote:
> Thanks for the info.
>
>
>
> Mike/Vincent also mentioned that FW does not own page tables after
> ExitBootServices(), so the OS would have to relax NX protection of RT code
> pages across SVA.
>
> Or delay setting NX protections on RT code pages until after SVA.
>
>
>
> I agree with you that we can mark RT region to be RW.
>
> Here is the pseudo code I plan to put to CoreExitBootServices().
>
>
>
> =======================
>
> VOID
>
> MemoryprotectionExitBootServicesCallback (
>
>   VOID
>
>   )
>
> {
>
>   EFI_RUNTIME_IMAGE_ENTRY       *RuntimeImage;
>
>   LIST_ENTRY                    *Link;
>
>
>
>   //
>
>   // We need remove the RT protection, because RT relocation need write code
> segment
>
>   // at SetVirtualAddressMap(). We cannot assume OS/Loader has taken over
> page table at that time.
>
>   //
>
>   // Firmware does not own page tables after ExitBootServices(), so the OS
> would
>
>   // have to relax protection of RT code pages across
> SetVirtualAddressMap(), or
>
>   // delay setting protections on RT code pages until after
> SetVirtualAddressMap().
>
>   // OS may set protection on RT based upon EFI_MEMORY_ATTRIBUTES_TABLE
> later.
>
>   //
>
>   if (mImageProtectionPolicy != 0) {
>
>     for (Link = gRuntime->ImageHead.ForwardLink; Link !=
> &gRuntime->ImageHead; Link = Link->ForwardLink) {
>
>       RuntimeImage = BASE_CR (Link, EFI_RUNTIME_IMAGE_ENTRY, Link);
>
>       SetUefiImageMemoryAttributes ((UINT64)(UINTN)RuntimeImage->ImageBase,
> ALIGN_VALUE(RuntimeImage->ImageSize, EFI_PAGE_SIZE), 0);
>
>     }
>
>   }
>
> }


This looks correct to me, and it is the only place where we can deal
with this situation.