From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from mx0b-0031df01.pphosted.com (mx0b-0031df01.pphosted.com [205.220.180.131]) by mx.groups.io with SMTP id smtpd.web10.12884.1678975474912091006 for ; Thu, 16 Mar 2023 07:04:35 -0700 Authentication-Results: mx.groups.io; dkim=pass header.i=@quicinc.com header.s=qcppdkim1 header.b=D1qxMboB; spf=permerror, err=parse error for token &{10 18 %{ir}.%{v}.%{d}.spf.has.pphosted.com}: invalid domain name (domain: quicinc.com, ip: 205.220.180.131, mailfrom: quic_llindhol@quicinc.com) Received: from pps.filterd (m0279868.ppops.net [127.0.0.1]) by mx0a-0031df01.pphosted.com (8.17.1.19/8.17.1.19) with ESMTP id 32G77cCf015760; Thu, 16 Mar 2023 14:04:24 GMT DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=quicinc.com; h=date : from : to : cc : subject : message-id : references : mime-version : content-type : in-reply-to; s=qcppdkim1; bh=/KxuDdcReh9UB/N3YEaGlUYNgK2sYTyjKPD3BgVOinE=; b=D1qxMboBGTLJdI1J3+9Bl4AL2CHZdmUSZ3KQzylZzC7pThM7P5y6w9vD7EyMVzpk5Gmh VMCrNAAQO2OFmDyabZJ3WoR6QjGGDx5rQtUA7IrOIhOj3XmWLuxp8kAKGnSea3CjC4xh VuJBwUcauBAY/C6ZjHKcGcYScivv1t6IQtOi7mR1GbFzjDMf2UgW9VcxVgrlowrB4dRc L6VOCVDtw7rrEIYFbURadQWEToC7+/59PLd8VOhhYXbQqV28HJl7nCfijamORWoMQU3A uAL75uqtt4SWhfpZWwf3D2yaO5D/1wIW3ox+xX2Qm8gyniYPf8vyNFcznnYnn1VWG7m0 vQ== Received: from nasanppmta05.qualcomm.com (i-global254.qualcomm.com [199.106.103.254]) by mx0a-0031df01.pphosted.com (PPS) with ESMTPS id 3pbpya20ve-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=NOT); Thu, 16 Mar 2023 14:04:24 +0000 Received: from nasanex01c.na.qualcomm.com (nasanex01c.na.qualcomm.com [10.45.79.139]) by NASANPPMTA05.qualcomm.com (8.17.1.5/8.17.1.5) with ESMTPS id 32GE4NYt021874 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=NOT); Thu, 16 Mar 2023 14:04:23 GMT Received: from qc-i7.hemma.eciton.net (10.80.80.8) by nasanex01c.na.qualcomm.com (10.45.79.139) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.2.986.41; Thu, 16 Mar 2023 07:04:20 -0700 Date: Thu, 16 Mar 2023 14:04:17 +0000 From: "Leif Lindholm" To: , CC: Michael Kinney , Liming Gao , Jiewen Yao , Michael Kubacki , Sean Brogan , Rebecca Cran , Sami Mujawar , Taylor Beebe Subject: Re: [edk2-devel] [PATCH v5 00/38] Implement strict memory permissions throughout Message-ID: References: <20230313171714.3866151-1-ardb@kernel.org> MIME-Version: 1.0 In-Reply-To: <20230313171714.3866151-1-ardb@kernel.org> X-Originating-IP: [10.80.80.8] X-ClientProxiedBy: nasanex01a.na.qualcomm.com (10.52.223.231) To nasanex01c.na.qualcomm.com (10.45.79.139) X-QCInternal: smtphost X-Proofpoint-Virus-Version: vendor=nai engine=6200 definitions=5800 signatures=585085 X-Proofpoint-ORIG-GUID: DyqqWchPlJ6mJQ4cjV_JfA7vDfg6KWSM X-Proofpoint-GUID: DyqqWchPlJ6mJQ4cjV_JfA7vDfg6KWSM X-Proofpoint-Virus-Version: vendor=baseguard engine=ICAP:2.0.254,Aquarius:18.0.942,Hydra:6.0.573,FMLib:17.11.170.22 definitions=2023-03-16_08,2023-03-16_01,2023-02-09_01 X-Proofpoint-Spam-Details: rule=outbound_notspam policy=outbound score=0 lowpriorityscore=0 mlxlogscore=917 spamscore=0 phishscore=0 bulkscore=0 impostorscore=0 adultscore=0 priorityscore=1501 malwarescore=0 suspectscore=0 clxscore=1015 mlxscore=0 classifier=spam adjust=0 reason=mlx scancount=1 engine=8.12.0-2303150002 definitions=main-2303160112 Content-Type: text/plain; charset="us-ascii" Content-Disposition: inline Hi Ard, For all the patches I haven't explicitly asked any questions about: Reviewed-by: Leif Lindholm On Mon, Mar 13, 2023 at 18:16:36 +0100, Ard Biesheuvel wrote: > Link: https://bugzilla.tianocore.org/show_bug.cgi?id=4369 > > This v5 now covers a lot more ground, and has ballooned quite > substantially as a result. The series is essentially a proof of concept > of a way to implement rigorous W^X memory protections from SEC all the > way to booting the OS. > > In particular: > - the AArch64 WXN control is enabled so that NX is implied for all > writable memory regions, which is rather helpful when testing changes > such as these; > - avoid PEIM shadowing where possible, as that would involve managing > the executable permissions of the shadowed code > - remap the DXE core code section read-only explicitly from IPL > - equip the DXE core with a way to manage memory permissions before the > CPU arch protocol driver is dispatched; > - permit the NX memory protection policy to apply to code memory type > regions as well > - check the NX compat DLL flag and section alignment to decide whether > an image can be loaded when the NX policy is applied to such a code > region > - implement the EFI memory attributes protocol (for ARM and AArch64 > only) so that such NX compat compliant images have a way to create > executable mappings > > v4: > - major cleanup of the 32-bit ARM code > - add support for EFI_MEMORY_RP using the access flag > - enable stack guard in ArmVirtPkg (which uses EFI_MEMORY_RP) > - incorporate optimization from other series [0] to avoid splitting > block entries unnecessarily > > v3: > - fix ARM32 bug in attribute conversion > - add Liming's ack to patch #1 > - include draft patch (NOT FOR MERGE) used to test the changes > > v2: > - drop patch to bump exposed UEFI revision to v2.10 > - add missing permitted return values to protocol definition > > [0] https://edk2.groups.io/g/devel/message/99801 > > Cc: Michael Kinney > Cc: Liming Gao > Cc: Jiewen Yao > Cc: Michael Kubacki > Cc: Sean Brogan > Cc: Rebecca Cran > Cc: Leif Lindholm > Cc: Sami Mujawar > Cc: Taylor Beebe > > Ard Biesheuvel (38): > ArmPkg/ArmMmuLib ARM: Remove half baked large page support > ArmPkg/ArmMmuLib ARM: Split off XN page descriptor bit from type field > ArmPkg/CpuDxe ARM: Fix page-to-section attribute conversion > ArmPkg/ArmMmuLib ARM: Isolate the access flag from AP mask > ArmPkg/ArmMmuLib ARM: Clear individual permission bits > ArmPkg/ArmMmuLib: Implement EFI_MEMORY_RP using access flag > ArmVirtPkg: Enable stack guard > ArmPkg/ArmMmuLib: Avoid splitting block entries if possible > ArmPkg/CpuDxe: Expose unified region-to-EFI attribute conversion > MdePkg: Add Memory Attribute Protocol definition > ArmPkg/CpuDxe: Implement EFI memory attributes protocol > ArmPkg/CpuDxe: Perform preliminary NX remap of free memory > MdeModulePkg/DxeCore: Unconditionally set memory protections > ArmPkg/Mmu: Remove handling of NONSECURE memory regions > ArmPkg/ArmMmuLib: Introduce region types for RO/XP WB cached memory > MdePkg/BasePeCoffLib: Add API to keep track of relocation range > MdeModulePkg/DxeIpl: Avoid shadowing IPL PEIM by default > MdeModulePkg/DxeIpl AARCH64: Remap DXE core code section before launch > MdeModulePkg/DxeCore: Reduce range of W+X remaps at EBS time > MdeModulePkg/DxeCore: Permit preliminary CPU arch fallback > ArmPkg: Implement ArmSetMemoryOverrideLib > MdeModulePkg/PcdPeim: Permit unshadowed execution > EmbeddedPkg/PrePiLib AARCH64: Remap DXE core before execution > ArmVirtPkg/ArmVirtQemu: Use XP memory mappings by default > ArmVirtPkg/ArmVirtQemu: Use PEI flavor of ArmMmuLib for all PEIMs > ArmVirtPkg/ArmVirtQemu: Use read-only memory region type for code > flash > BaseTools/GccBase AARCH64: Avoid page sharing between code and data > ArmVirtPkg/ArmVirtQemu: Enable hardware enforced W^X memory > permissions > MdePkg/PeCoffLib: Capture DLL characteristics field in image context > MdePkg/IndustryStandard: PeImage.h: Import DLL characteristics > MdeModulePkg/DxeCore: Remove redundant DEBUG statements > MdeModulePkg/DxeCore: Update memory protections before freeing a > region > MdeModulePkg/DxeCore: Disregard runtime alignment for image protection > MdeModulePkg/DxeCore: Deal with failure in UefiProtectImage() > MdeModulePkg/DxeCore: Clear NX permissions on non-protected images > MdeModulePkg/DxeCore: Permit NX protection for code regions > MdeModulePkg/DxeCore: Check NX compat when using restricted code > regions > MdeModulePkg DEC: Remove inaccurate comment > > ArmPkg/ArmPkg.dec | 5 + > ArmPkg/ArmPkg.dsc | 1 + > ArmPkg/Drivers/CpuDxe/AArch64/Mmu.c | 25 +- > ArmPkg/Drivers/CpuDxe/Arm/Mmu.c | 96 +++++-- > ArmPkg/Drivers/CpuDxe/CpuDxe.c | 87 ++++++ > ArmPkg/Drivers/CpuDxe/CpuDxe.h | 17 ++ > ArmPkg/Drivers/CpuDxe/CpuDxe.inf | 5 + > ArmPkg/Drivers/CpuDxe/MemoryAttribute.c | 271 ++++++++++++++++++ > ArmPkg/Include/Chipset/ArmV7Mmu.h | 131 ++++----- > ArmPkg/Include/Library/ArmLib.h | 17 +- > ArmPkg/Include/Library/ArmMmuLib.h | 34 +++ > ArmPkg/Library/ArmLib/Arm/ArmV7Support.S | 2 + > ArmPkg/Library/ArmMmuLib/AArch64/ArmMmuLibCore.c | 103 ++++++- > ArmPkg/Library/ArmMmuLib/Arm/ArmMmuLibConvert.c | 8 +- > ArmPkg/Library/ArmMmuLib/Arm/ArmMmuLibCore.c | 51 ++-- > ArmPkg/Library/ArmMmuLib/Arm/ArmMmuLibUpdate.c | 173 ++++++++++-- > ArmPkg/Library/ArmSetMemoryOverrideLib/ArmSetMemoryOverrideLib.c | 78 ++++++ > ArmPkg/Library/ArmSetMemoryOverrideLib/ArmSetMemoryOverrideLib.inf | 28 ++ > ArmVirtPkg/ArmVirt.dsc.inc | 3 + > ArmVirtPkg/ArmVirtQemu.dsc | 11 +- > ArmVirtPkg/ArmVirtQemuKernel.dsc | 1 + > ArmVirtPkg/Library/ArmPlatformLibQemu/AArch64/ArmPlatformHelper.S | 2 +- > ArmVirtPkg/Library/QemuVirtMemInfoLib/QemuVirtMemInfoLib.c | 4 +- > BaseTools/Scripts/GccBase.lds | 13 +- > EmbeddedPkg/Include/Library/PrePiLib.h | 16 -- > EmbeddedPkg/Library/PrePiLib/Arm/RemapDxeCore.c | 51 ++++ > EmbeddedPkg/Library/PrePiLib/PrePi.h | 13 + > EmbeddedPkg/Library/PrePiLib/PrePiLib.c | 4 + > EmbeddedPkg/Library/PrePiLib/PrePiLib.inf | 12 + > EmbeddedPkg/Library/PrePiLib/X86/RemapDxeCore.c | 23 ++ > MdeModulePkg/Core/Dxe/DxeMain.h | 6 +- > MdeModulePkg/Core/Dxe/Image/Image.c | 8 +- > MdeModulePkg/Core/Dxe/Mem/Page.c | 15 +- > MdeModulePkg/Core/Dxe/Misc/MemoryProtection.c | 288 +++++++++++--------- > MdeModulePkg/Core/DxeIplPeim/Arm/DxeLoadFunc.c | 73 +++++ > MdeModulePkg/Core/DxeIplPeim/DxeIpl.inf | 6 +- > MdeModulePkg/Core/DxeIplPeim/DxeLoad.c | 24 +- > MdeModulePkg/MdeModulePkg.dec | 7 +- > MdeModulePkg/Universal/PCD/Pei/Pcd.c | 112 ++++---- > MdeModulePkg/Universal/PCD/Pei/Pcd.inf | 1 + > MdePkg/Include/IndustryStandard/PeImage.h | 15 + > MdePkg/Include/Library/PeCoffLib.h | 27 ++ > MdePkg/Include/Protocol/MemoryAttribute.h | 142 ++++++++++ > MdePkg/Library/BasePeCoffLib/BasePeCoff.c | 105 ++++++- > MdePkg/MdePkg.dec | 3 + > 45 files changed, 1682 insertions(+), 435 deletions(-) > create mode 100644 ArmPkg/Drivers/CpuDxe/MemoryAttribute.c > create mode 100644 ArmPkg/Library/ArmSetMemoryOverrideLib/ArmSetMemoryOverrideLib.c > create mode 100644 ArmPkg/Library/ArmSetMemoryOverrideLib/ArmSetMemoryOverrideLib.inf > create mode 100644 EmbeddedPkg/Library/PrePiLib/Arm/RemapDxeCore.c > create mode 100644 EmbeddedPkg/Library/PrePiLib/X86/RemapDxeCore.c > create mode 100644 MdePkg/Include/Protocol/MemoryAttribute.h > > -- > 2.39.2 > > > > > >