Re: [edk2-devel] [PATCH v2] ArmVirt: Allow memory attributes protocol to be disabled on first boot

["Alexander Graf via groups.io" <graf=amazon.com@groups.io>]

On 08.12.23 12:20, Ard Biesheuvel wrote:
> On Thu, 7 Dec 2023 at 11:06, Ard Biesheuvel <ardb@google.com> wrote:
>> From: Ard Biesheuvel <ardb@kernel.org>
>>
>> Shim's PE loader uses the EFI memory attributes protocol in a way that
>> results in an immediate crash when invoking the loaded image, unless the
>> base and size of its executable segment are both aligned to 4k.
>>
>> If this is not the case, it will strip the memory allocation of its
>> executable permissions, but fail to add them back for the executable
>> region, resulting in non-executable code. Unfortunately, the PE loader
>> does not even bother invoking the protocol in this case (as it notices
>> the misalignment), making it very hard for system firmware to work
>> around this by attempting to infer the intent of the caller.
>>
>> So let's introduce a QEMU command line option to indicate that the
>> protocol should not be exposed at all on the first boot, which is when
>> the issue is triggered. (fbaa64.efi is broken but grubaa64.efi boots
>> fine)
>>
>>    -fw_cfg opt/org.tianocore/UninstallMemAttrProtocolOnFirstBoot,string=y
>>
>> Also introduce a fixed boolean PCD that sets the default.
>>
>> Cc: Laszlo Ersek <lersek@redhat.com>
>> Cc: Gerd Hoffmann <kraxel@redhat.com>
>> Cc: Oliver Steffen <osteffen@redhat.com>
>> Cc: Alexander Graf <graf@amazon.com>
>> Cc: Oliver Smith-Denny <osde@linux.microsoft.com>
>> Cc: Taylor Beebe <taylor.d.beebe@gmail.com>
>> Cc: Peter Jones <pjones@redhat.com>
>> Cc: Leif Lindholm <quic_llindhol@quicinc.com>
>> Link: https://gitlab.com/qemu-project/qemu/-/issues/1990
>> Signed-off-by: Ard Biesheuvel <ardb@kernel.org>
> OK, if nobody has problems with this approach, I intend to merge it
> and give a snapshot build to the lima folks to incorporate in their
> scripts.


No concerns from me :)

Alex





Amazon Development Center Germany GmbH
Krausenstr. 38
10117 Berlin
Geschaeftsfuehrung: Christian Schlaeger, Jonathan Weiss
Eingetragen am Amtsgericht Charlottenburg unter HRB 149173 B
Sitz: Berlin
Ust-ID: DE 289 237 879




-=-=-=-=-=-=-=-=-=-=-=-
Groups.io Links: You receive all messages sent to this group.
View/Reply Online (#112264): https://edk2.groups.io/g/devel/message/112264
Mute This Topic: https://groups.io/mt/103031504/7686176
Group Owner: devel+owner@edk2.groups.io
Unsubscribe: https://edk2.groups.io/g/devel/unsub [rebecca@openfw.io]
-=-=-=-=-=-=-=-=-=-=-=-