From patchwork Tue Mar 7 08:42:05 2017 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Ard Biesheuvel X-Patchwork-Id: 94958 Delivered-To: patch@linaro.org Received: by 10.140.82.71 with SMTP id g65csp1788812qgd; Tue, 7 Mar 2017 00:42:22 -0800 (PST) X-Received: by 10.84.136.34 with SMTP id 31mr32705507plk.52.1488876142205; Tue, 07 Mar 2017 00:42:22 -0800 (PST) Return-Path: Received: from ml01.01.org (ml01.01.org. [2001:19d0:306:5::1]) by mx.google.com with ESMTPS id 83si16364917pgc.122.2017.03.07.00.42.21 (version=TLS1_2 cipher=ECDHE-RSA-AES128-GCM-SHA256 bits=128/128); Tue, 07 Mar 2017 00:42:22 -0800 (PST) Received-SPF: pass (google.com: best guess record for domain of edk2-devel-bounces@lists.01.org designates 2001:19d0:306:5::1 as permitted sender) client-ip=2001:19d0:306:5::1; Authentication-Results: mx.google.com; dkim=neutral (body hash did not verify) header.i=@linaro.org; spf=pass (google.com: best guess record for domain of edk2-devel-bounces@lists.01.org designates 2001:19d0:306:5::1 as permitted sender) smtp.mailfrom=edk2-devel-bounces@lists.01.org; dmarc=fail (p=NONE sp=NONE dis=NONE) header.from=linaro.org Received: from [127.0.0.1] (localhost [IPv6:::1]) by ml01.01.org (Postfix) with ESMTP id 4279680357; Tue, 7 Mar 2017 00:42:19 -0800 (PST) X-Original-To: edk2-devel@lists.01.org Delivered-To: edk2-devel@lists.01.org Received: from mail-wm0-x234.google.com (mail-wm0-x234.google.com [IPv6:2a00:1450:400c:c09::234]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ml01.01.org (Postfix) with ESMTPS id 37D5780354 for ; Tue, 7 Mar 2017 00:42:17 -0800 (PST) Received: by mail-wm0-x234.google.com with SMTP id v186so83433295wmd.0 for ; Tue, 07 Mar 2017 00:42:17 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=linaro.org; s=google; h=from:to:cc:subject:date:message-id:in-reply-to:references; bh=3+RThqt92MW5pnVcCKlJsKIdiir8EPBqT09lJeTAoi4=; b=DNbAjZBNlkIYLvCk2Ww+CCgX2xkZEDeqiXWO3WGPmxMtLQC8K6PoRNns+snrlF76GI yAharAolKVGxxSdQW/EjjoszrcIVI3CW7WfdADBOfasDP9zBvzYmzu+oCrU+hPvpAdy8 nQFPb8EUWWT5kFCD2R7RHgThNXxl4mg7ynppQ= X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:from:to:cc:subject:date:message-id:in-reply-to :references; bh=3+RThqt92MW5pnVcCKlJsKIdiir8EPBqT09lJeTAoi4=; b=IB8mmxqQmcPNstqYJ6AY1VF4YjGS3ObrvMZH0GlnpXkBiYLj43Q1PVhnGAos3lf30u u2kZ98uXGybEZmTWRfaeWyPnYXJCEudnBKkyi7FmPLWeZerv77r9hqulZJPbdpKBPFQd lt0I+GccqCod6IWR4rGOJbmT4akAdgNPkCRmTrrBrAoYWrkgLoM6eDO/9kwvfkwFuCBJ v2fb5DzxHdLTyOmJXDl4MB35hDbRd6ocuMCoVxLeltSm5GpDMTrc+uhNgmxZ69d1A+KF si0plxPhcDh4OWnmfGnp3h0GelA0IBDSJ/Dvsdlwq2sNsKQJt0zwRjIYmMgSt3GqdPA5 /nYA== X-Gm-Message-State: AMke39nP+dWnQLjwNOLRiUzsbw4mYquoObTH9fk3y8G9ALTSZZbLX2CfCB6hLr2F1+zSLK7z X-Received: by 10.28.144.65 with SMTP id s62mr1101139wmd.141.1488876135851; Tue, 07 Mar 2017 00:42:15 -0800 (PST) Received: from ards-macbook-pro.c.hoisthospitality.com ([109.74.56.122]) by smtp.gmail.com with ESMTPSA id u41sm30097838wrc.24.2017.03.07.00.42.14 (version=TLS1_2 cipher=ECDHE-RSA-AES128-SHA bits=128/128); Tue, 07 Mar 2017 00:42:15 -0800 (PST) From: Ard Biesheuvel To: edk2-devel@lists.01.org, leif.lindholm@linaro.org Date: Tue, 7 Mar 2017 09:42:05 +0100 Message-Id: <1488876125-24396-5-git-send-email-ard.biesheuvel@linaro.org> X-Mailer: git-send-email 2.7.4 In-Reply-To: <1488876125-24396-1-git-send-email-ard.biesheuvel@linaro.org> References: <1488876125-24396-1-git-send-email-ard.biesheuvel@linaro.org> Subject: [edk2] [PATCH v2 4/4] ArmVirtPkg: enable non-executable DXE stack for all platforms X-BeenThere: edk2-devel@lists.01.org X-Mailman-Version: 2.1.21 Precedence: list List-Id: EDK II Development List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Cc: lersek@redhat.com, Ard Biesheuvel MIME-Version: 1.0 Errors-To: edk2-devel-bounces@lists.01.org Sender: "edk2-devel" Now that ARM has grown support for managing memory permissions in ArmMmuLib, we can enable the non-executable DXE stack for all virt platforms. Note that this includes the AARCH64 Xen platform as well. Note that this is not [entirely] redundant: the non-executable stack is configured before DxeCore is invoked. The image and memory protection features configured during DXE only take affect when the CPU arch protocol implementation is registered. Contributed-under: TianoCore Contribution Agreement 1.0 Signed-off-by: Ard Biesheuvel Reviewed-by: Laszlo Ersek --- ArmVirtPkg/ArmVirt.dsc.inc | 5 +++++ ArmVirtPkg/ArmVirtQemu.dsc | 2 -- ArmVirtPkg/ArmVirtQemuKernel.dsc | 2 -- 3 files changed, 5 insertions(+), 4 deletions(-) -- 2.7.4 _______________________________________________ edk2-devel mailing list edk2-devel@lists.01.org https://lists.01.org/mailman/listinfo/edk2-devel diff --git a/ArmVirtPkg/ArmVirt.dsc.inc b/ArmVirtPkg/ArmVirt.dsc.inc index acfb71d3ff6c..e2d3dcce7945 100644 --- a/ArmVirtPkg/ArmVirt.dsc.inc +++ b/ArmVirtPkg/ArmVirt.dsc.inc @@ -386,6 +386,11 @@ [PcdsFixedAtBuild.common] # gEfiMdeModulePkgTokenSpaceGuid.PcdDxeNxMemoryProtectionPolicy|0xC000000000007FD1 + # + # Enable the non-executable DXE stack. (This gets set up by DxeIpl) + # + gEfiMdeModulePkgTokenSpaceGuid.PcdSetNxForStack|TRUE + [PcdsFixedAtBuild.ARM] gEmbeddedTokenSpaceGuid.PcdPrePiCpuMemorySize|40 diff --git a/ArmVirtPkg/ArmVirtQemu.dsc b/ArmVirtPkg/ArmVirtQemu.dsc index 615e1fca4877..477dfdcfc764 100644 --- a/ArmVirtPkg/ArmVirtQemu.dsc +++ b/ArmVirtPkg/ArmVirtQemu.dsc @@ -152,8 +152,6 @@ [PcdsFixedAtBuild.common] gEmbeddedTokenSpaceGuid.PcdPrePiCpuIoSize|16 [PcdsFixedAtBuild.AARCH64] - gEfiMdeModulePkgTokenSpaceGuid.PcdSetNxForStack|TRUE - # KVM limits it IPA space to 40 bits (1 TB), so there is no need to # support anything bigger, even if the host hardware does gEmbeddedTokenSpaceGuid.PcdPrePiCpuMemorySize|40 diff --git a/ArmVirtPkg/ArmVirtQemuKernel.dsc b/ArmVirtPkg/ArmVirtQemuKernel.dsc index e4902690123c..fd39c2802a85 100644 --- a/ArmVirtPkg/ArmVirtQemuKernel.dsc +++ b/ArmVirtPkg/ArmVirtQemuKernel.dsc @@ -163,8 +163,6 @@ [PcdsFixedAtBuild.AARCH64] # gEmbeddedTokenSpaceGuid.PcdPrePiCpuIoSize|16 - gEfiMdeModulePkgTokenSpaceGuid.PcdSetNxForStack|TRUE - # KVM limits it IPA space to 40 bits (1 TB), so there is no need to # support anything bigger, even if the host hardware does gEmbeddedTokenSpaceGuid.PcdPrePiCpuMemorySize|40