ArmVirtPkg AARCH64: enable NX memory protection for all platforms

[edk2] [PATCH v2] ArmVirtPkg AARCH64: enable NX memory protection for all platforms

Posted by Ard Biesheuvel 7 years, 8 months ago

This sets the recently introduced PCD PcdDxeNxMemoryProtectionPolicy to
a value that protects all memory regions except code regions against
inadvertent execution.

Note that this does not [yet] protect EfiLoaderData regions, due to
compatibility issues with shim and GRUB.

Contributed-under: TianoCore Contribution Agreement 1.0
Signed-off-by: Ard Biesheuvel <ard.biesheuvel@linaro.org>
Reviewed-by: Jiewen Yao <jiewen.yao@intel.com>
---
v2: leave EfiLoaderData executable for the time being

 ArmVirtPkg/ArmVirt.dsc.inc | 7 +++++++
 1 file changed, 7 insertions(+)

diff --git a/ArmVirtPkg/ArmVirt.dsc.inc b/ArmVirtPkg/ArmVirt.dsc.inc
index 2b0a44e14d24..a91b27f13cf2 100644
--- a/ArmVirtPkg/ArmVirt.dsc.inc
+++ b/ArmVirtPkg/ArmVirt.dsc.inc
@@ -383,6 +383,13 @@ [PcdsFixedAtBuild.AARCH64]
   #
   gEfiMdeModulePkgTokenSpaceGuid.PcdImageProtectionPolicy|0x3
 
+  #
+  # Enable NX memory protection for all non-code regions, including OEM and OS
+  # reserved ones, with the exception of LoaderData regions, of which OS loaders
+  # (i.e., GRUB) may assume that its contents are executable.
+  #
+  gEfiMdeModulePkgTokenSpaceGuid.PcdDxeNxMemoryProtectionPolicy|0xC000000000007FD1
+
 [Components.common]
   #
   # Networking stack
-- 
2.7.4

_______________________________________________
edk2-devel mailing list
edk2-devel@lists.01.org
https://lists.01.org/mailman/listinfo/edk2-devel

Re: [edk2] [PATCH v2] ArmVirtPkg AARCH64: enable NX memory protection for all platforms

Posted by Laszlo Ersek 7 years, 8 months ago

On 03/01/17 15:36, Ard Biesheuvel wrote:
> This sets the recently introduced PCD PcdDxeNxMemoryProtectionPolicy to
> a value that protects all memory regions except code regions against
> inadvertent execution.
> 
> Note that this does not [yet] protect EfiLoaderData regions, due to
> compatibility issues with shim and GRUB.
> 
> Contributed-under: TianoCore Contribution Agreement 1.0
> Signed-off-by: Ard Biesheuvel <ard.biesheuvel@linaro.org>
> Reviewed-by: Jiewen Yao <jiewen.yao@intel.com>
> ---
> v2: leave EfiLoaderData executable for the time being
> 
>  ArmVirtPkg/ArmVirt.dsc.inc | 7 +++++++
>  1 file changed, 7 insertions(+)
> 
> diff --git a/ArmVirtPkg/ArmVirt.dsc.inc b/ArmVirtPkg/ArmVirt.dsc.inc
> index 2b0a44e14d24..a91b27f13cf2 100644
> --- a/ArmVirtPkg/ArmVirt.dsc.inc
> +++ b/ArmVirtPkg/ArmVirt.dsc.inc
> @@ -383,6 +383,13 @@ [PcdsFixedAtBuild.AARCH64]
>    #
>    gEfiMdeModulePkgTokenSpaceGuid.PcdImageProtectionPolicy|0x3
>  
> +  #
> +  # Enable NX memory protection for all non-code regions, including OEM and OS
> +  # reserved ones, with the exception of LoaderData regions, of which OS loaders
> +  # (i.e., GRUB) may assume that its contents are executable.
> +  #
> +  gEfiMdeModulePkgTokenSpaceGuid.PcdDxeNxMemoryProtectionPolicy|0xC000000000007FD1
> +
>  [Components.common]
>    #
>    # Networking stack
> 

Reviewed-by: Laszlo Ersek <lersek@redhat.com>
Tested-by:  Laszlo Ersek <lersek@redhat.com>
_______________________________________________
edk2-devel mailing list
edk2-devel@lists.01.org
https://lists.01.org/mailman/listinfo/edk2-devel

Re: [edk2] [PATCH v2] ArmVirtPkg AARCH64: enable NX memory protection for all platforms

Posted by Ard Biesheuvel 7 years, 8 months ago

On 1 March 2017 at 18:32, Laszlo Ersek <lersek@redhat.com> wrote:
> On 03/01/17 15:36, Ard Biesheuvel wrote:
>> This sets the recently introduced PCD PcdDxeNxMemoryProtectionPolicy to
>> a value that protects all memory regions except code regions against
>> inadvertent execution.
>>
>> Note that this does not [yet] protect EfiLoaderData regions, due to
>> compatibility issues with shim and GRUB.
>>
>> Contributed-under: TianoCore Contribution Agreement 1.0
>> Signed-off-by: Ard Biesheuvel <ard.biesheuvel@linaro.org>
>> Reviewed-by: Jiewen Yao <jiewen.yao@intel.com>
>> ---
>> v2: leave EfiLoaderData executable for the time being
>>
>>  ArmVirtPkg/ArmVirt.dsc.inc | 7 +++++++
>>  1 file changed, 7 insertions(+)
>>
>> diff --git a/ArmVirtPkg/ArmVirt.dsc.inc b/ArmVirtPkg/ArmVirt.dsc.inc
>> index 2b0a44e14d24..a91b27f13cf2 100644
>> --- a/ArmVirtPkg/ArmVirt.dsc.inc
>> +++ b/ArmVirtPkg/ArmVirt.dsc.inc
>> @@ -383,6 +383,13 @@ [PcdsFixedAtBuild.AARCH64]
>>    #
>>    gEfiMdeModulePkgTokenSpaceGuid.PcdImageProtectionPolicy|0x3
>>
>> +  #
>> +  # Enable NX memory protection for all non-code regions, including OEM and OS
>> +  # reserved ones, with the exception of LoaderData regions, of which OS loaders
>> +  # (i.e., GRUB) may assume that its contents are executable.
>> +  #
>> +  gEfiMdeModulePkgTokenSpaceGuid.PcdDxeNxMemoryProtectionPolicy|0xC000000000007FD1
>> +
>>  [Components.common]
>>    #
>>    # Networking stack
>>
>
> Reviewed-by: Laszlo Ersek <lersek@redhat.com>
> Tested-by:  Laszlo Ersek <lersek@redhat.com>

Pushed, thanks.
_______________________________________________
edk2-devel mailing list
edk2-devel@lists.01.org
https://lists.01.org/mailman/listinfo/edk2-devel