Re: [PATCH] MdeModulePkg/DxeIpl: support more NX related PCDs

["Wang, Jian J" <jian.j.wang@intel.com>]

I have no strong opinion for this proposal. But if we decide to do it finally,
I'd suggest to add some warning messages for any probably surprising setting
combinations.

Regards,
Jian


> -----Original Message-----
> From: Laszlo Ersek [mailto:lersek@redhat.com]
> Sent: Monday, September 17, 2018 6:14 PM
> To: Zeng, Star <star.zeng@intel.com>; Wang, Jian J <jian.j.wang@intel.com>;
> edk2-devel@lists.01.org
> Cc: Ard Biesheuvel <ard.biesheuvel@linaro.org>; Ni, Ruiyu <ruiyu.ni@intel.com>;
> Yao, Jiewen <jiewen.yao@intel.com>
> Subject: Re: [PATCH] MdeModulePkg/DxeIpl: support more NX related PCDs
> 
> On 09/17/18 07:57, Zeng, Star wrote:
> > How about we see the problem in another way?
> >
> > If my understanding is correct, current discussion and patches think FALSE/0
> means disable/clear NX, but that is not the fact.
> > According to the code implementation, FALSE/0 seems mean *AS IS* to do
> thing (no code to disable/clear NX).
> >
> > PcdSetNxForStack
> > TRUE: Set NX for stack.
> > FALSE: No code to clear NX for stack.
> >
> > PcdDxeNxMemoryProtectionPolicy
> > BITX 1: Set NX for that memory type.
> > BITX 0: No code to clear NX for that memory type.
> >
> > PcdImageProtectionPolicy
> > BITX 1: Set NX for the image data section.
> > BITX 0: Not code to clear NX for the image data section.
> >
> > So, how about we think one PCD just works for itself and it does not impact
> other PCDs to protect?
> > That means TRUE/1 is to protect and FALSE/0 is *AS IS* to do nothing.
> > The description of these PCDs could be enhancement if we think it is a good
> way to see the problem.
> 
> Sure, that too could work for me, but then the documentation in the DEC
> / UNI files has to be really clear.
> 
> The initial worry for the current discussion was that some platform might
> - protect e.g. BootServicesData type memory,
> - not set PcdSetNxForStack,
> - expect the stack to remain executable.
> 
> The actual results might surprise the platform owner.
> 
> If the documentation dispelled any possible misconceptions, I think your
> idea could work too (and it would be a lot easier to code).
> 
> Thanks
> Laszlo
> 
> 
> >
> >
> > Thanks,
> > Star
> > -----Original Message-----
> > From: Wang, Jian J
> > Sent: Monday, September 17, 2018 10:11 AM
> > To: Laszlo Ersek <lersek@redhat.com>; edk2-devel@lists.01.org
> > Cc: Zeng, Star <star.zeng@intel.com>; Ard Biesheuvel
> <ard.biesheuvel@linaro.org>; Ni, Ruiyu <ruiyu.ni@intel.com>; Yao, Jiewen
> <jiewen.yao@intel.com>
> > Subject: RE: [PATCH] MdeModulePkg/DxeIpl: support more NX related PCDs
> >
> > Laszlo,
> >
> > Thanks for the comments.
> >
> > Regards,
> > Jian
> >
> >> -----Original Message-----
> >> From: Laszlo Ersek [mailto:lersek@redhat.com]
> >> Sent: Friday, September 14, 2018 5:51 PM
> >> To: Wang, Jian J <jian.j.wang@intel.com>; edk2-devel@lists.01.org
> >> Cc: Zeng, Star <star.zeng@intel.com>; Ard Biesheuvel
> >> <ard.biesheuvel@linaro.org>; Ni, Ruiyu <ruiyu.ni@intel.com>; Yao,
> >> Jiewen <jiewen.yao@intel.com>
> >> Subject: Re: [PATCH] MdeModulePkg/DxeIpl: support more NX related PCDs
> >>
> >> I've got some comments on the code as well:
> >>
> >> On 09/14/18 07:13, Jian J Wang wrote:
> >>>  BZ#1116: https://bugzilla.tianocore.org/show_bug.cgi?id=1116
> >>>
> >>>  Currently IA32_EFER.NXE is only set against PcdSetNxForStack. This
> >>>  confuses developers because following two other PCDs also need NXE
> >>>  to be set, but actually not.
> >>>
> >>>      PcdDxeNxMemoryProtectionPolicy
> >>>      PcdImageProtectionPolicy
> >>>
> >>>  This patch solves this issue by adding logic to enable IA32_EFER.NXE
> >>>  if any of those PCDs have anything enabled.
> >>>
> >>>  Due to the fact that NX memory type of stack (enabled by
> >>> PcdSetNxForStack)
> >>>  and image data section (enabled by PcdImageProtectionPolicy) are
> >>> also
> >>>  part of PcdDxeNxMemoryProtectionPolicy, this patch also add more
> >>> checks
> >>>  to warn (ASSERT) users any unreasonable setting combinations. For
> >>> example,
> >>>
> >>>      PcdSetNxForStack == FALSE &&
> >>>        (PcdDxeNxMemoryProtectionPolicy & (1 <<EfiBootServicesData))
> >>> != 0
> >>>
> >>>      PcdImageProtectionPolicy == 0 &&
> >>>        (PcdDxeNxMemoryProtectionPolicy & (1 <<
> >>> EfiRuntimeServicesData)) != 0
> >>>
> >>>      PcdImageProtectionPolicy == 0 &&
> >>>        (PcdDxeNxMemoryProtectionPolicy & (1 <<EfiBootServicesData))
> >>> != 0
> >>>
> >>>      PcdImageProtectionPolicy == 0 &&
> >>>        (PcdDxeNxMemoryProtectionPolicy & (1 <<EfiLoaderData)) != 0
> >>>
> >>>  In other words, PcdSetNxForStack and PcdImageProtectionPolicy have
> >>>  priority over PcdDxeNxMemoryProtectionPolicy.
> >>>
> >>>  Cc: Star Zeng <star.zeng@intel.com>
> >>>  Cc: Laszlo Ersek <lersek@redhat.com>
> >>>  Cc: Ard Biesheuvel <ard.biesheuvel@linaro.org>
> >>>  Cc: Ruiyu Ni <ruiyu.ni@intel.com>
> >>>  Cc: Jiewen Yao <jiewen.yao@intel.com>
> >>>  Contributed-under: TianoCore Contribution Agreement 1.1
> >>>  Signed-off-by: Jian J Wang <jian.j.wang@intel.com>
> >>>  ---
> >>>   MdeModulePkg/Core/DxeIplPeim/DxeIpl.inf          |  2 +
> >>>   MdeModulePkg/Core/DxeIplPeim/Ia32/DxeLoadFunc.c  |  4 +-
> >>>   MdeModulePkg/Core/DxeIplPeim/X64/VirtualMemory.c | 55 +++++++++++
> ++
> >> ++++++++++-
> >>>   MdeModulePkg/Core/DxeIplPeim/X64/VirtualMemory.h | 33 +++++++++++
> ++
> >> +
> >>>   4 files changed, 91 insertions(+), 3 deletions(-)
> >>>
> >>>  diff --
> >> git a/MdeModulePkg/Core/DxeIplPeim/DxeIpl.inf
> >> b/MdeModulePkg/Core/DxeIp lPeim/DxeIpl.inf
> >>>  index fd82657404..068e700074 100644
> >>>  --- a/MdeModulePkg/Core/DxeIplPeim/DxeIpl.inf
> >>>  +++ b/MdeModulePkg/Core/DxeIplPeim/DxeIpl.inf
> >>>  @@ -117,6 +117,8 @@
> >>>
> >>>   [Pcd.IA32,Pcd.X64,Pcd.ARM,Pcd.AARCH64]
> >>>     gEfiMdeModulePkgTokenSpaceGuid.PcdSetNxForStack               ##
> >>> SOMETIM
> >> ES_CONSUMES
> >>>  +  gEfiMdeModulePkgTokenSpaceGuid.PcdDxeNxMemoryProtectionPolicy
> ##
> >> SOMETIMES_CONSUMES
> >>>  +  gEfiMdeModulePkgTokenSpaceGuid.PcdImageProtectionPolicy       ##
> >>> SOME
> >> TIMES_CONSUMES
> >>>
> >>>   [Depex]
> >>>     gEfiPeiLoadFilePpiGuid AND gEfiPeiMasterBootModePpiGuid
> >>>  diff --
> >>
> git a/MdeModulePkg/Core/DxeIplPeim/Ia32/DxeLoadFunc.c b/MdeModulePkg/
> >> Core/DxeIplPeim/Ia32/DxeLoadFunc.c
> >>>  index d28baa3615..9a97205ef8 100644
> >>>  --- a/MdeModulePkg/Core/DxeIplPeim/Ia32/DxeLoadFunc.c
> >>>  +++ b/MdeModulePkg/Core/DxeIplPeim/Ia32/DxeLoadFunc.c
> >>>  @@ -245,7 +245,7 @@ ToBuildPageTable (
> >>>       return TRUE;
> >>>     }
> >>>
> >>>  -  if (PcdGetBool (PcdSetNxForStack) && IsExecuteDisableBitAvailable
> >>> ()) {
> >>>  +  if (ToEnableExecuteDisableFeature ()) {
> >>>       return TRUE;
> >>>     }
> >>>
> >>>  @@ -436,7 +436,7 @@ HandOffToDxeCore (
> >>>       BuildPageTablesIa32Pae = ToBuildPageTable ();
> >>>       if (BuildPageTablesIa32Pae) {
> >>>         PageTables = Create4GPageTablesIa32Pae (BaseOfStack,
> >>> STACK_SIZE);
> >>>  -      if (IsExecuteDisableBitAvailable ()) {
> >>>  +      if (ToEnableExecuteDisableFeature ()) {
> >>>           EnableExecuteDisableBit();
> >>>         }
> >>>       }
> >>>  diff --
> >>
> git a/MdeModulePkg/Core/DxeIplPeim/X64/VirtualMemory.c b/MdeModulePkg
> >> /Core/DxeIplPeim/X64/VirtualMemory.c
> >>>  index 496e219913..253fe84223 100644
> >>>  --- a/MdeModulePkg/Core/DxeIplPeim/X64/VirtualMemory.c
> >>>  +++ b/MdeModulePkg/Core/DxeIplPeim/X64/VirtualMemory.c
> >>>  @@ -106,6 +106,56 @@ IsNullDetectionEnabled (
> >>>     return ((PcdGet8 (PcdNullPointerDetectionPropertyMask) & BIT0) !=
> >>> 0);
> >>>   }
> >>>
> >>>  +/**
> >>>  +  Check if Execute Disable Bit (IA32_EFER.NXE) should be enabled or not.
> >>>  +
> >>>  +  @retval TRUE    IA32_EFER.NXE should be enabled.
> >>>  +  @retval FALSE   IA32_EFER.NXE should not be enabled.
> >>>  +
> >>>  +**/
> >>>  +BOOLEAN
> >>>  +ToEnableExecuteDisableFeature (
> >>>  +  VOID
> >>>  +  )
> >>
> >> I think we're over-complicating the name of this function. First, "To"
> >> looks unnecessary. Second, "Enable Execute Disable" is just an
> >> engineer's way to say "Disable Execution". Can we say right that:
> >> DisableExec()?
> >>
> >> Or at least, if we consider "NX" a word in its own right, "EnableNX()"?
> >
> > I prefer more general one. Let's use DisableExec().
> >
> >>
> >>>  +{
> >>>  +  if (!IsExecuteDisableBitAvailable ()) {
> >>>  +    return FALSE;
> >>>  +  }
> >>>  +
> >>>  +  //
> >>>  +  // Normally stack is type of EfiBootServicesData. Disabling NX
> >>> for stack
> >>>  +  // but enabling NX for EfiBootServicesData doesn't make any sense.
> >>>  +  //
> >>
> >> This comment is good.
> >>
> >>>  +  if (PcdGetBool (PcdSetNxForStack) == FALSE &&
> >>
> >> Please don't compare PcdGetBool() against TRUE or FALSE, just say
> >> PcdGetBool(), or !PcdGetBool().
> >>
> >>>  +      (PcdGet64 (PcdDxeNxMemoryProtectionPolicy) &
> >>> STACK_MEMORY_TYPE)
> >>  != 0) {
> >>>  +    DEBUG ((DEBUG_ERROR,
> >>>  +            "ERROR: NX for stack is disabled but NX for its memory
> >>> type is enabled
> >> !\r\n"));
> >>>  +    ASSERT(!(PcdGetBool (PcdSetNxForStack) == FALSE &&
> >>>  +             (PcdGet64 (PcdDxeNxMemoryProtectionPolicy) &
> >>> STACK_MEMORY_T
> >> YPE) != 0));
> >>>  +  }
> >>
> >> Please drop both the explicit "if", and the DEBUG message. Just keep
> >> the comment (which is already fine) and the ASSERT(). The ASSERT()
> >> will tell people where to look, and the comment will explain the
> >> assertion. Also, in a RELEASE build, the check should be eliminated
> >> entirely, but that might not work for the explicit "if" (dependent on
> >> compilers and/or fixed vs. dynamic PCDs).
> >>
> >> Furthermore, keeping the logical negation operator as the outermost
> >> operator makes the code a lot harder to read. It's much better to just
> >> assert what we actually require, which is:
> >>
> >>   (DxeNxMemoryProtectionPolicy covers BSD) --> SetNxForStack
> >>
> >> put differently,
> >>
> >>   NOT(DxeNxMemoryProtectionPolicy covers BSD) OR SetNxForStack
> >>
> >> in C:
> >>
> >>   ASSERT (
> >>     (PcdGet64 (PcdDxeNxMemoryProtectionPolicy) & STACK_MEMORY_TYPE)
> ==
> >> 0 ||
> >>     PcdGetBool (PcdSetNxForStack)
> >>     );
> >>
> >
> > I don't have strong opinions on these. So let's do it your way.
> >
> >>>  +
> >>>  +  //
> >>>  +  // Image data section could be type of EfiLoaderData,
> >>> EfiBootServicesData
> >>>  +  // or EfiRuntimeServicesData. Disabling NX for image data but
> >>> enabling NX
> >>>  +  // for any those memory types doesn't make any sense.
> >>>  +  //
> >>
> >> The comment is good, I just suggest extending it with the origin of
> >> the
> >> image: "Disabling NX for image data (regardless of image origin) for
> >> any those memory types ...".
> >>
> >
> > Sure. I'll add it.
> >
> >>>  +  if (PcdGet32 (PcdImageProtectionPolicy) == 0 &&
> >>>  +      (PcdGet64 (PcdDxeNxMemoryProtectionPolicy) & IMAGE_DATA_MEM
> OR
> >> Y_TYPE) != 0) {
> >>>  +    DEBUG ((DEBUG_ERROR,
> >>>  +            "ERROR: NX for image data is disabled but NX for its
> >>> memory type(s) is
> >> enabled!\r\n"));
> >>>  +    ASSERT (!(PcdGet32 (PcdImageProtectionPolicy) == 0 &&
> >>>  +              (PcdGet64 (PcdDxeNxMemoryProtectionPolicy) &
> >>> IMAGE_DATA_ME
> >> MORY_TYPE) != 0));
> >>>  +  }
> >>
> >> Summarizing my points from before, here we should have:
> >>
> >>   ASSERT (
> >>     (PcdGet64 (PcdDxeNxMemoryProtectionPolicy) & IMAGE_DATA_MEMORY
> _TY
> >> PE) == 0 ||
> >>     PcdGet32 (PcdImageProtectionPolicy) == 3
> >>     );
> >>
> >> That is,
> >>
> >> - If we disable DxeNxMemoryProtectionPolicy for all of EfiLoaderData,
> >>   EfiBootServicesData, and EfiRuntimeServicesData, then any
> >>   ImageProtectionPolicy is fine.
> >>
> >> - If we enable  DxeNxMemoryProtectionPolicy for any of EfiLoaderData,
> >>   EfiBootServicesData, and EfiRuntimeServicesData, then we require the
> >>   platform to set ImageProtectionPolicy regardless of image origin.
> >>
> >> Thanks
> >> Laszlo
> >>
> >
> > Good catch. I missed that part. Thanks.
> >
> >>>  +
> >>>  +  //
> >>>  +  // XD flag (BIT63) in page table entry is only valid if IA32_EFER.NXE is set.
> >>>  +  // Features controlled by Following PCDs need this feature to be enabled.
> >>>  +  //
> >>>  +  return (PcdGetBool (PcdSetNxForStack) ||
> >>>  +          PcdGet64 (PcdDxeNxMemoryProtectionPolicy) != 0 ||
> >>>  +          PcdGet32 (PcdImageProtectionPolicy) != 0);
> >>>  +}
> >>>  +
> >>>   /**
> >>>     Enable Execute Disable Bit.
> >>>
> >>>  @@ -755,7 +805,10 @@ CreateIdentityMappingPageTables (
> >>>     //
> >>>     EnablePageTableProtection ((UINTN)PageMap, TRUE);
> >>>
> >>>  -  if (PcdGetBool (PcdSetNxForStack)) {
> >>>  +  //
> >>>  +  // Set IA32_EFER.NXE if necessary.
> >>>  +  //
> >>>  +  if (ToEnableExecuteDisableFeature ()) {
> >>>       EnableExecuteDisableBit ();
> >>>     }
> >>>
> >>>  diff --
> >>
> git a/MdeModulePkg/Core/DxeIplPeim/X64/VirtualMemory.h b/MdeModulePkg
> >> /Core/DxeIplPeim/X64/VirtualMemory.h
> >>>  index 85457ff937..9f152e6531 100644
> >>>  --- a/MdeModulePkg/Core/DxeIplPeim/X64/VirtualMemory.h
> >>>  +++ b/MdeModulePkg/Core/DxeIplPeim/X64/VirtualMemory.h
> >>>  @@ -179,6 +179,39 @@ typedef struct {
> >>>     UINTN           FreePages;
> >>>   } PAGE_TABLE_POOL;
> >>>
> >>>  +//
> >>>  +// Bit field repsentations of some EFI_MEMORY_TYPE, for page table
> >>> initializ
> >> ation.
> >>>  +//
> >>>  +#define STACK_MEMORY_TYPE           (1 << EfiBootServicesData)
> >>> /* 0x10 */
> >>>  +#define IMAGE_DATA_MEMORY_TYPE      ((1 << EfiLoaderData)       |
> >>> /* 0x04
> >> */\
> >>>  +                                     (1 << EfiBootServicesData) |
> >>> /* 0x10 */\
> >>>  +                                     (1 <<
> >>> EfiRuntimeServicesData)/* 0x40 */\
> >>>  +                                    )
> >>> /* 0x54 */
> >>>  +
> >>>  +/**
> >>>  +  Check if Execute Disable Bit (IA32_EFER.NXE) should be enabled or not.
> >>>  +
> >>>  +  @retval TRUE    IA32_EFER.NXE should be enabled.
> >>>  +  @retval FALSE   IA32_EFER.NXE should not be enabled.
> >>>  +
> >>>  +**/
> >>>  +BOOLEAN
> >>>  +ToEnableExecuteDisableFeature (
> >>>  +  VOID
> >>>  +  );
> >>>  +
> >>>  +/**
> >>>  +  The function will check if Execute Disable Bit is available.
> >>>  +
> >>>  +  @retval TRUE      Execute Disable Bit is available.
> >>>  +  @retval FALSE     Execute Disable Bit is not available.
> >>>  +
> >>>  +**/
> >>>  +BOOLEAN
> >>>  +IsExecuteDisableBitAvailable (
> >>>  +  VOID
> >>>  +  );
> >>>  +
> >>>   /**
> >>>     Enable Execute Disable Bit.
> >>>
> >>>