MdeModulePkg/DxeIpl: support more NX related PCDs

BZ#1116: https://bugzilla.tianocore.org/show_bug.cgi?id=1116

Currently IA32_EFER.NXE is only set against PcdSetNxForStack. This
confuses developers because following two other PCDs also need NXE
to be set, but actually not.

    PcdDxeNxMemoryProtectionPolicy
    PcdImageProtectionPolicy

This patch solves this issue by adding logic to enable IA32_EFER.NXE
if any of those PCDs have anything enabled.

Cc: Star Zeng <star.zeng@intel.com>
Cc: Laszlo Ersek <lersek@redhat.com>
Cc: Ard Biesheuvel <ard.biesheuvel@linaro.org>
Cc: Ruiyu Ni <ruiyu.ni@intel.com>
Cc: Jiewen Yao <jiewen.yao@intel.com>
Contributed-under: TianoCore Contribution Agreement 1.1
Signed-off-by: Jian J Wang <jian.j.wang@intel.com>
Reviewed-by: Star Zeng <star.zeng@intel.com>
Reviewed-by: Laszlo Ersek <lersek@redhat.com>

diff --git a/MdeModulePkg/Core/DxeIplPeim/DxeIpl.inf b/MdeModulePkg/Core/DxeIplPeim/DxeIpl.inf
index fd82657404c43238803c2867aa64a6aaa94197e0..068e70007444cee643b69b011e5e7129f77d7182 100644 (file)
--- a/MdeModulePkg/Core/DxeIplPeim/DxeIpl.inf
+++ b/MdeModulePkg/Core/DxeIplPeim/DxeIpl.inf
@@ -117,6 +117,8 @@
 \r
 [Pcd.IA32,Pcd.X64,Pcd.ARM,Pcd.AARCH64]\r
   gEfiMdeModulePkgTokenSpaceGuid.PcdSetNxForStack               ## SOMETIMES_CONSUMES\r
+  gEfiMdeModulePkgTokenSpaceGuid.PcdDxeNxMemoryProtectionPolicy ## SOMETIMES_CONSUMES\r
+  gEfiMdeModulePkgTokenSpaceGuid.PcdImageProtectionPolicy       ## SOMETIMES_CONSUMES\r
 \r
 [Depex]\r
   gEfiPeiLoadFilePpiGuid AND gEfiPeiMasterBootModePpiGuid\r

diff --git a/MdeModulePkg/Core/DxeIplPeim/Ia32/DxeLoadFunc.c b/MdeModulePkg/Core/DxeIplPeim/Ia32/DxeLoadFunc.c
index d28baa3615988ef43632ec67c566c9e21d8014b2..0bf99bc77e08037654c56efb470756ae6e21f8fc 100644 (file)
--- a/MdeModulePkg/Core/DxeIplPeim/Ia32/DxeLoadFunc.c
+++ b/MdeModulePkg/Core/DxeIplPeim/Ia32/DxeLoadFunc.c
@@ -186,37 +186,6 @@ IsIa32PaeSupport (
   return Ia32PaeSupport;\r
 }\r
 \r
-/**\r
-  The function will check if Execute Disable Bit is available.\r
-\r
-  @retval TRUE      Execute Disable Bit is available.\r
-  @retval FALSE     Execute Disable Bit is not available.\r
-\r
-**/\r
-BOOLEAN\r
-IsExecuteDisableBitAvailable (\r
-  VOID\r
-  )\r
-{\r
-  UINT32            RegEax;\r
-  UINT32            RegEdx;\r
-  BOOLEAN           Available;\r
-\r
-  Available = FALSE;\r
-  AsmCpuid (0x80000000, &RegEax, NULL, NULL, NULL);\r
-  if (RegEax >= 0x80000001) {\r
-    AsmCpuid (0x80000001, NULL, NULL, NULL, &RegEdx);\r
-    if ((RegEdx & BIT20) != 0) {\r
-      //\r
-      // Bit 20: Execute Disable Bit available.\r
-      //\r
-      Available = TRUE;\r
-    }\r
-  }\r
-\r
-  return Available;\r
-}\r
-\r
 /**\r
   The function will check if page table should be setup or not.\r
 \r
@@ -245,7 +214,7 @@ ToBuildPageTable (
     return TRUE;\r
   }\r
 \r
-  if (PcdGetBool (PcdSetNxForStack) && IsExecuteDisableBitAvailable ()) {\r
+  if (IsEnableNonExecNeeded ()) {\r
     return TRUE;\r
   }\r
 \r
@@ -436,7 +405,7 @@ HandOffToDxeCore (
     BuildPageTablesIa32Pae = ToBuildPageTable ();\r
     if (BuildPageTablesIa32Pae) {\r
       PageTables = Create4GPageTablesIa32Pae (BaseOfStack, STACK_SIZE);\r
-      if (IsExecuteDisableBitAvailable ()) {\r
+      if (IsEnableNonExecNeeded ()) {\r
         EnableExecuteDisableBit();\r
       }\r
     }\r

diff --git a/MdeModulePkg/Core/DxeIplPeim/X64/VirtualMemory.c b/MdeModulePkg/Core/DxeIplPeim/X64/VirtualMemory.c
index 496e21991347c0a6bbe8d3cea6ee1a3d88493f34..cf3c3f94d864130d1d4ac545ad699a6059a64875 100644 (file)
--- a/MdeModulePkg/Core/DxeIplPeim/X64/VirtualMemory.c
+++ b/MdeModulePkg/Core/DxeIplPeim/X64/VirtualMemory.c
@@ -106,6 +106,62 @@ IsNullDetectionEnabled (
   return ((PcdGet8 (PcdNullPointerDetectionPropertyMask) & BIT0) != 0);\r
 }\r
 \r
+/**\r
+  The function will check if Execute Disable Bit is available.\r
+\r
+  @retval TRUE      Execute Disable Bit is available.\r
+  @retval FALSE     Execute Disable Bit is not available.\r
+\r
+**/\r
+BOOLEAN\r
+IsExecuteDisableBitAvailable (\r
+  VOID\r
+  )\r
+{\r
+  UINT32            RegEax;\r
+  UINT32            RegEdx;\r
+  BOOLEAN           Available;\r
+\r
+  Available = FALSE;\r
+  AsmCpuid (0x80000000, &RegEax, NULL, NULL, NULL);\r
+  if (RegEax >= 0x80000001) {\r
+    AsmCpuid (0x80000001, NULL, NULL, NULL, &RegEdx);\r
+    if ((RegEdx & BIT20) != 0) {\r
+      //\r
+      // Bit 20: Execute Disable Bit available.\r
+      //\r
+      Available = TRUE;\r
+    }\r
+  }\r
+\r
+  return Available;\r
+}\r
+\r
+/**\r
+  Check if Execute Disable Bit (IA32_EFER.NXE) should be enabled or not.\r
+\r
+  @retval TRUE    IA32_EFER.NXE should be enabled.\r
+  @retval FALSE   IA32_EFER.NXE should not be enabled.\r
+\r
+**/\r
+BOOLEAN\r
+IsEnableNonExecNeeded (\r
+  VOID\r
+  )\r
+{\r
+  if (!IsExecuteDisableBitAvailable ()) {\r
+    return FALSE;\r
+  }\r
+\r
+  //\r
+  // XD flag (BIT63) in page table entry is only valid if IA32_EFER.NXE is set.\r
+  // Features controlled by Following PCDs need this feature to be enabled.\r
+  //\r
+  return (PcdGetBool (PcdSetNxForStack) ||\r
+          PcdGet64 (PcdDxeNxMemoryProtectionPolicy) != 0 ||\r
+          PcdGet32 (PcdImageProtectionPolicy) != 0);\r
+}\r
+\r
 /**\r
   Enable Execute Disable Bit.\r
 \r
@@ -755,7 +811,10 @@ CreateIdentityMappingPageTables (
   //\r
   EnablePageTableProtection ((UINTN)PageMap, TRUE);\r
 \r
-  if (PcdGetBool (PcdSetNxForStack)) {\r
+  //\r
+  // Set IA32_EFER.NXE if necessary.\r
+  //\r
+  if (IsEnableNonExecNeeded ()) {\r
     EnableExecuteDisableBit ();\r
   }\r
 \r

diff --git a/MdeModulePkg/Core/DxeIplPeim/X64/VirtualMemory.h b/MdeModulePkg/Core/DxeIplPeim/X64/VirtualMemory.h
index 85457ff93712af6bc0ec2dbe00514102bc579ad9..8ae92d3bf66b68129b78b593cbe6a9891ad5721f 100644 (file)
--- a/MdeModulePkg/Core/DxeIplPeim/X64/VirtualMemory.h
+++ b/MdeModulePkg/Core/DxeIplPeim/X64/VirtualMemory.h
@@ -179,6 +179,18 @@ typedef struct {
   UINTN           FreePages;\r
 } PAGE_TABLE_POOL;\r
 \r
+/**\r
+  Check if Execute Disable Bit (IA32_EFER.NXE) should be enabled or not.\r
+\r
+  @retval TRUE    IA32_EFER.NXE should be enabled.\r
+  @retval FALSE   IA32_EFER.NXE should not be enabled.\r
+\r
+**/\r
+BOOLEAN\r
+IsEnableNonExecNeeded (\r
+  VOID\r
+  );\r
+\r
 /**\r
   Enable Execute Disable Bit.\r
 \r