Re: [PATCH 0/2] Enable page table write protection

[Laszlo Ersek <lersek@redhat.com>]

Hi Jian,

On 11/29/17 09:46, Jian J Wang wrote:
> Write Protect feature (CR0.WP) is always enabled in driver UefiCpuPkg/CpuDxe.
> But the memory pages used for page table are not set as read-only in the driver
> DxeIplPeim, after the paging is setup. This might jeopardize the page table
> integrity if there's buffer overflow occured in other part of system.
> 
> This patch series will change this situation by clearing R/W bit in page attribute
> of the pages used as page table.
> 
> Validation works include booting Windows (10/server 2016) and Linux (Fedora/Ubuntu)
> on OVMF and Intel real platform.
> 
> Jian J Wang (2):
>   UefiCpuPkg/CpuDxe: Check CR0.WP before changing page table
>   MdeModulePkg/DxeIpl: Mark page table as read-only
> 
>  MdeModulePkg/Core/DxeIplPeim/X64/VirtualMemory.c | 166 +++++++++++++++++++++++
>  MdeModulePkg/Core/DxeIplPeim/X64/VirtualMemory.h |  14 ++
>  UefiCpuPkg/CpuDxe/CpuPageTable.c                 |  65 ++++++++-
>  3 files changed, 241 insertions(+), 4 deletions(-)
> 

thanks for the CC -- I'd like to test this feature.

Is it OK if I wait 1-2 days first, to see if there is review feedback
that requires a v2?

Thanks!
Laszlo