From nobody Mon Feb 9 07:05:32 2026 Delivered-To: importer@patchew.org Received-SPF: pass (zohomail.com: domain of groups.io designates 66.175.222.108 as permitted sender) client-ip=66.175.222.108; envelope-from=bounce+27952+109416+1787277+3901457@groups.io; helo=mail02.groups.io; Authentication-Results: mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of groups.io designates 66.175.222.108 as permitted sender) smtp.mailfrom=bounce+27952+109416+1787277+3901457@groups.io; dmarc=fail(p=none dis=none) header.from=gmail.com ARC-Seal: i=1; a=rsa-sha256; t=1696810083; cv=none; d=zohomail.com; s=zohoarc; b=Tdh0Fo4DNCohJ9VUzLh50a80y5KwmwdRo/QBOdMaEOyFtsRT/SQf1N1ld1ygWcvmvYNVO0e3Y7qmhAcqWucqiXqpiRwlGXjuyfskSE5yo3b8INhiXHUZCgYXFoRMuVPYzsQMbRI9o7lSzGa2p74a44Nln83x8b6sGCIMpIS0814= ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=zohomail.com; s=zohoarc; t=1696810083; h=Content-Transfer-Encoding:Cc:Cc:Date:Date:From:From:In-Reply-To:List-Subscribe:List-Id:List-Help:List-Unsubscribe:MIME-Version:Message-ID:Reply-To:Reply-To:References:Sender:Subject:Subject:To:To:Message-Id; bh=SdKdkDpbVAT2KU8yPrCrSre/eWczu0i46PXbNtkYFVo=; b=VW40dGGxCDj7Kg6SsA5PNFEhfhRqJQm1+iToGNeuiVONSpcYSJDw6rM/Xxah+Hg8sAoRFTHDRn6nmm9ZYLA0G/NhQEgDuRxp/Fwix3ayeltyW9K1TnI1pFNxkQuO+8TFy4cI5q3RJEM6FX2ri+zGVj0VHOrBnqISqUCdT0vllik= ARC-Authentication-Results: i=1; mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of groups.io designates 66.175.222.108 as permitted sender) smtp.mailfrom=bounce+27952+109416+1787277+3901457@groups.io; dmarc=fail header.from= (p=none dis=none) Received: from mail02.groups.io (mail02.groups.io [66.175.222.108]) by mx.zohomail.com with SMTPS id 1696810083229616.9663493856511; Sun, 8 Oct 2023 17:08:03 -0700 (PDT) Return-Path: DKIM-Signature: a=rsa-sha256; bh=oUBLAsrKOjBi/Gxiw9ExVqHWqwkzU9Ezsq5vUR9NrkA=; c=relaxed/simple; d=groups.io; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References:MIME-Version:Precedence:List-Subscribe:List-Help:Sender:List-Id:Mailing-List:Delivered-To:Reply-To:List-Unsubscribe-Post:List-Unsubscribe:Content-Transfer-Encoding; s=20140610; t=1696810082; v=1; b=klKuMwOOO/2ApzBNyVrTIPMAXSGIohMJ250QIdhCD9T5QYrN79Wo7XmLxvCAHhaGFsSXPEip 9JC8u7wDV5Knc9S0bEedNhzJmcavYdC1SjgyeGo8va1GzHsRpVUIbPmbhED+bymxnKnK8dBQdCf oZjZe/zMl+Ana/R+hPM1TVn4= X-Received: by 127.0.0.2 with SMTP id OieYYY1788612x4qiijHZvKO; Sun, 08 Oct 2023 17:08:02 -0700 X-Received: from mail-ot1-f45.google.com (mail-ot1-f45.google.com [209.85.210.45]) by mx.groups.io with SMTP id smtpd.web10.50222.1696810082396800524 for ; Sun, 08 Oct 2023 17:08:02 -0700 X-Received: by mail-ot1-f45.google.com with SMTP id 46e09a7af769-6bd04558784so3008860a34.3 for ; Sun, 08 Oct 2023 17:08:02 -0700 (PDT) X-Gm-Message-State: Tze71OmKhSrzlFhYttXq3Ujux1787277AA= X-Google-Smtp-Source: AGHT+IHftRUbPkbufcrXf5V5UEXIbES9Ga3/V9szA1SNLfdRLRRWXmxVxRBLiMAPMo1sHAbV0u78gw== X-Received: by 2002:a05:6871:592:b0:1d5:5659:4730 with SMTP id u18-20020a056871059200b001d556594730mr18563501oan.37.1696810081572; Sun, 08 Oct 2023 17:08:01 -0700 (PDT) X-Received: from localhost.localdomain ([50.46.253.1]) by smtp.gmail.com with ESMTPSA id t20-20020a62ea14000000b0068fcc7f6b00sm5048320pfh.74.2023.10.08.17.08.01 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Sun, 08 Oct 2023 17:08:01 -0700 (PDT) From: "Taylor Beebe" To: devel@edk2.groups.io Cc: Ard Biesheuvel , Jiewen Yao , Jordan Justen , Gerd Hoffmann Subject: [edk2-devel] [PATCH v5 11/28] OvmfPkg: Apply Memory Protections via SetMemoryProtectionsLib Date: Sun, 8 Oct 2023 17:07:23 -0700 Message-ID: <20231009000742.1792-12-taylor.d.beebe@gmail.com> In-Reply-To: <20231009000742.1792-1-taylor.d.beebe@gmail.com> References: <20231009000742.1792-1-taylor.d.beebe@gmail.com> MIME-Version: 1.0 Precedence: Bulk List-Subscribe: List-Help: Sender: devel@edk2.groups.io List-Id: Mailing-List: list devel@edk2.groups.io; contact devel+owner@edk2.groups.io Reply-To: devel@edk2.groups.io,taylor.d.beebe@gmail.com List-Unsubscribe-Post: List-Unsubscribe=One-Click List-Unsubscribe: Content-Transfer-Encoding: quoted-printable X-ZohoMail-DKIM: pass (identity @groups.io) X-ZM-MESSAGEID: 1696810084333100042 Content-Type: text/plain; charset="utf-8" Use SetMemoryProtectionsLib to set the memory protections for the platform in both normal and PEI-less boot. The protections set are equivalent to the PCD settings and the ability to set NxForStack via QemuCfg is preserved. Once the transition to use SetMemoryProtectionsLib and GetMemoryProtectionsLib is complete in the rest of EDK2, the mechanics of setting protections in OvmfPkg will be updated and the memory protection PCDs will be deleted. Signed-off-by: Taylor Beebe Cc: Ard Biesheuvel Cc: Jiewen Yao Cc: Jordan Justen Cc: Gerd Hoffmann --- OvmfPkg/Library/PeilessStartupLib/PeilessStartup.c | 15 +++++++++++++= -- OvmfPkg/PlatformPei/Platform.c | 15 +++++++++++++= -- OvmfPkg/Library/PeilessStartupLib/PeilessStartupLib.inf | 3 +++ OvmfPkg/PlatformPei/PlatformPei.inf | 1 + 4 files changed, 30 insertions(+), 4 deletions(-) diff --git a/OvmfPkg/Library/PeilessStartupLib/PeilessStartup.c b/OvmfPkg/L= ibrary/PeilessStartupLib/PeilessStartup.c index 1632a2317718..cf645aad3246 100644 --- a/OvmfPkg/Library/PeilessStartupLib/PeilessStartup.c +++ b/OvmfPkg/Library/PeilessStartupLib/PeilessStartup.c @@ -14,10 +14,13 @@ #include #include #include +#include #include #include #include #include +#include +#include #include #include #include @@ -42,7 +45,9 @@ InitializePlatform ( EFI_HOB_PLATFORM_INFO *PlatformInfoHob ) { - VOID *VariableStore; + VOID *VariableStore; + DXE_MEMORY_PROTECTION_SETTINGS DxeSettings; + MM_MEMORY_PROTECTION_SETTINGS MmSettings; =20 DEBUG ((DEBUG_INFO, "InitializePlatform in Pei-less boot\n")); PlatformDebugDumpCmos (); @@ -104,7 +109,13 @@ InitializePlatform ( =20 PlatformMemMapInitialization (PlatformInfoHob); =20 - PlatformNoexecDxeInitialization (PlatformInfoHob); + DxeSettings =3D DxeMemoryProtectionProfi= les[DxeMemoryProtectionSettingsPcd].Settings; + MmSettings =3D MmMemoryProtectionProfil= es[MmMemoryProtectionSettingsPcd].Settings; + DxeSettings.StackExecutionProtectionEnabled =3D PcdGetBool (PcdSetNxForS= tack); + QemuFwCfgParseBool ("opt/ovmf/PcdSetNxForStack", &DxeSettings.StackExecu= tionProtectionEnabled); + + SetDxeMemoryProtectionSettings (&DxeSettings, DxeMemoryProtectionSetting= sPcd); + SetMmMemoryProtectionSettings (&MmSettings, MmMemoryProtectionSettingsPc= d); =20 if (TdIsEnabled ()) { PlatformInfoHob->PcdConfidentialComputingGuestAttr =3D CCAttrIntelTdx; diff --git a/OvmfPkg/PlatformPei/Platform.c b/OvmfPkg/PlatformPei/Platform.c index f5dc41c3a8c4..bcd8d3a1be14 100644 --- a/OvmfPkg/PlatformPei/Platform.c +++ b/OvmfPkg/PlatformPei/Platform.c @@ -38,6 +38,7 @@ #include #include #include +#include =20 #include "Platform.h" =20 @@ -304,8 +305,10 @@ InitializePlatform ( IN CONST EFI_PEI_SERVICES **PeiServices ) { - EFI_HOB_PLATFORM_INFO *PlatformInfoHob; - EFI_STATUS Status; + EFI_HOB_PLATFORM_INFO *PlatformInfoHob; + EFI_STATUS Status; + DXE_MEMORY_PROTECTION_SETTINGS DxeSettings; + MM_MEMORY_PROTECTION_SETTINGS MmSettings; =20 DEBUG ((DEBUG_INFO, "Platform PEIM Loaded\n")); PlatformInfoHob =3D BuildPlatformInfoHob (); @@ -342,6 +345,14 @@ InitializePlatform ( =20 PublishPeiMemory (PlatformInfoHob); =20 + DxeSettings =3D DxeMemoryProtectionProfi= les[DxeMemoryProtectionSettingsPcd].Settings; + MmSettings =3D MmMemoryProtectionProfil= es[MmMemoryProtectionSettingsPcd].Settings; + DxeSettings.StackExecutionProtectionEnabled =3D PcdGetBool (PcdSetNxForS= tack); + QemuFwCfgParseBool ("opt/ovmf/PcdSetNxForStack", &DxeSettings.StackExecu= tionProtectionEnabled); + + SetDxeMemoryProtectionSettings (&DxeSettings, DxeMemoryProtectionSetting= sPcd); + SetMmMemoryProtectionSettings (&MmSettings, MmMemoryProtectionSettingsPc= d); + PlatformQemuUc32BaseInitialization (PlatformInfoHob); =20 InitializeRamRegions (PlatformInfoHob); diff --git a/OvmfPkg/Library/PeilessStartupLib/PeilessStartupLib.inf b/Ovmf= Pkg/Library/PeilessStartupLib/PeilessStartupLib.inf index 585d50463748..f0a8a5a56df4 100644 --- a/OvmfPkg/Library/PeilessStartupLib/PeilessStartupLib.inf +++ b/OvmfPkg/Library/PeilessStartupLib/PeilessStartupLib.inf @@ -56,6 +56,8 @@ [LibraryClasses] PrePiLib QemuFwCfgLib PlatformInitLib + SetMemoryProtectionsLib + QemuFwCfgSimpleParserLib =20 [Guids] gEfiHobMemoryAllocModuleGuid @@ -81,6 +83,7 @@ [Pcd] gEfiMdeModulePkgTokenSpaceGuid.PcdImageProtectionPolicy ## SOMETIM= ES_CONSUMES gEfiMdeModulePkgTokenSpaceGuid.PcdPteMemoryEncryptionAddressOrMask ##= CONSUMES gEfiMdeModulePkgTokenSpaceGuid.PcdNullPointerDetectionPropertyMask ##= CONSUMES + gEfiMdeModulePkgTokenSpaceGuid.PcdSetNxForStack ##= CONSUMES gUefiOvmfPkgTokenSpaceGuid.PcdOvmfDxeMemFvBase gUefiOvmfPkgTokenSpaceGuid.PcdOvmfDxeMemFvSize gUefiOvmfPkgTokenSpaceGuid.PcdSecureBootSupported diff --git a/OvmfPkg/PlatformPei/PlatformPei.inf b/OvmfPkg/PlatformPei/Plat= formPei.inf index 3934aeed9514..6b8442d12b2c 100644 --- a/OvmfPkg/PlatformPei/PlatformPei.inf +++ b/OvmfPkg/PlatformPei/PlatformPei.inf @@ -65,6 +65,7 @@ [LibraryClasses] PcdLib CcExitLib PlatformInitLib + SetMemoryProtectionsLib =20 [Pcd] gUefiOvmfPkgTokenSpaceGuid.PcdOvmfPeiMemFvBase --=20 2.42.0.windows.2 -=3D-=3D-=3D-=3D-=3D-=3D-=3D-=3D-=3D-=3D-=3D- Groups.io Links: You receive all messages sent to this group. View/Reply Online (#109416): https://edk2.groups.io/g/devel/message/109416 Mute This Topic: https://groups.io/mt/101843353/1787277 Group Owner: devel+owner@edk2.groups.io Unsubscribe: https://edk2.groups.io/g/devel/unsub [importer@patchew.org] -=3D-=3D-=3D-=3D-=3D-=3D-=3D-=3D-=3D-=3D-=3D-