MdeModulePkg/Core: fix feature conflict between NX and heap guard
[mirror_edk2.git] / MdeModulePkg / Core / Dxe / Misc / MemoryProtection.c
CommitLineData
d0e92aad
JY
1/** @file\r
2 UEFI Memory Protection support.\r
3\r
4 If the UEFI image is page aligned, the image code section is set to read only\r
5 and the image data section is set to non-executable.\r
6\r
7 1) This policy is applied for all UEFI image including boot service driver,\r
8 runtime driver or application.\r
9 2) This policy is applied only if the UEFI image meets the page alignment\r
10 requirement.\r
11 3) This policy is applied only if the Source UEFI image matches the\r
12 PcdImageProtectionPolicy definition.\r
13 4) This policy is not applied to the non-PE image region.\r
14\r
15 The DxeCore calls CpuArchProtocol->SetMemoryAttributes() to protect\r
16 the image. If the CpuArch protocol is not installed yet, the DxeCore\r
17 enqueues the protection request. Once the CpuArch is installed, the\r
18 DxeCore dequeues the protection request and applies policy.\r
19\r
20 Once the image is unloaded, the protection is removed automatically.\r
21\r
22Copyright (c) 2017, Intel Corporation. All rights reserved.<BR>\r
23This program and the accompanying materials\r
24are licensed and made available under the terms and conditions of the BSD License\r
25which accompanies this distribution. The full text of the license may be found at\r
26http://opensource.org/licenses/bsd-license.php\r
27\r
28THE PROGRAM IS DISTRIBUTED UNDER THE BSD LICENSE ON AN "AS IS" BASIS,\r
29WITHOUT WARRANTIES OR REPRESENTATIONS OF ANY KIND, EITHER EXPRESS OR IMPLIED.\r
30\r
31**/\r
32\r
33#include <PiDxe.h>\r
34#include <Library/BaseLib.h>\r
35#include <Library/BaseMemoryLib.h>\r
36#include <Library/MemoryAllocationLib.h>\r
37#include <Library/UefiBootServicesTableLib.h>\r
38#include <Library/DxeServicesTableLib.h>\r
39#include <Library/DebugLib.h>\r
40#include <Library/UefiLib.h>\r
41\r
42#include <Guid/EventGroup.h>\r
43#include <Guid/MemoryAttributesTable.h>\r
44#include <Guid/PropertiesTable.h>\r
45\r
46#include <Protocol/FirmwareVolume2.h>\r
47#include <Protocol/BlockIo.h>\r
48#include <Protocol/SimpleFileSystem.h>\r
49\r
50#include "DxeMain.h"\r
a6a0a597 51#include "Mem/HeapGuard.h"\r
d0e92aad
JY
52\r
53#define CACHE_ATTRIBUTE_MASK (EFI_MEMORY_UC | EFI_MEMORY_WC | EFI_MEMORY_WT | EFI_MEMORY_WB | EFI_MEMORY_UCE | EFI_MEMORY_WP)\r
54#define MEMORY_ATTRIBUTE_MASK (EFI_MEMORY_RP | EFI_MEMORY_XP | EFI_MEMORY_RO)\r
55\r
56//\r
57// Image type definitions\r
58//\r
59#define IMAGE_UNKNOWN 0x00000001\r
60#define IMAGE_FROM_FV 0x00000002\r
61\r
62//\r
63// Protection policy bit definition\r
64//\r
65#define DO_NOT_PROTECT 0x00000000\r
66#define PROTECT_IF_ALIGNED_ELSE_ALLOW 0x00000001\r
67\r
7eb927db
AB
68#define MEMORY_TYPE_OS_RESERVED_MIN 0x80000000\r
69#define MEMORY_TYPE_OEM_RESERVED_MIN 0x70000000\r
70\r
71#define PREVIOUS_MEMORY_DESCRIPTOR(MemoryDescriptor, Size) \\r
72 ((EFI_MEMORY_DESCRIPTOR *)((UINT8 *)(MemoryDescriptor) - (Size)))\r
73\r
d0e92aad
JY
74UINT32 mImageProtectionPolicy;\r
75\r
7eb927db
AB
76extern LIST_ENTRY mGcdMemorySpaceMap;\r
77\r
5920a9d1
AB
78STATIC LIST_ENTRY mProtectedImageRecordList;\r
79\r
d0e92aad
JY
80/**\r
81 Sort code section in image record, based upon CodeSegmentBase from low to high.\r
82\r
83 @param ImageRecord image record to be sorted\r
84**/\r
85VOID\r
86SortImageRecordCodeSection (\r
87 IN IMAGE_PROPERTIES_RECORD *ImageRecord\r
88 );\r
89\r
90/**\r
91 Check if code section in image record is valid.\r
92\r
93 @param ImageRecord image record to be checked\r
94\r
95 @retval TRUE image record is valid\r
96 @retval FALSE image record is invalid\r
97**/\r
98BOOLEAN\r
99IsImageRecordCodeSectionValid (\r
100 IN IMAGE_PROPERTIES_RECORD *ImageRecord\r
101 );\r
102\r
103/**\r
104 Get the image type.\r
105\r
106 @param[in] File This is a pointer to the device path of the file that is\r
107 being dispatched.\r
108\r
109 @return UINT32 Image Type\r
110**/\r
111UINT32\r
112GetImageType (\r
113 IN CONST EFI_DEVICE_PATH_PROTOCOL *File\r
114 )\r
115{\r
116 EFI_STATUS Status;\r
117 EFI_HANDLE DeviceHandle;\r
118 EFI_DEVICE_PATH_PROTOCOL *TempDevicePath;\r
119\r
120 if (File == NULL) {\r
121 return IMAGE_UNKNOWN;\r
122 }\r
123\r
124 //\r
125 // First check to see if File is from a Firmware Volume\r
126 //\r
127 DeviceHandle = NULL;\r
128 TempDevicePath = (EFI_DEVICE_PATH_PROTOCOL *) File;\r
129 Status = gBS->LocateDevicePath (\r
130 &gEfiFirmwareVolume2ProtocolGuid,\r
131 &TempDevicePath,\r
132 &DeviceHandle\r
133 );\r
134 if (!EFI_ERROR (Status)) {\r
135 Status = gBS->OpenProtocol (\r
136 DeviceHandle,\r
137 &gEfiFirmwareVolume2ProtocolGuid,\r
138 NULL,\r
139 NULL,\r
140 NULL,\r
141 EFI_OPEN_PROTOCOL_TEST_PROTOCOL\r
142 );\r
143 if (!EFI_ERROR (Status)) {\r
144 return IMAGE_FROM_FV;\r
145 }\r
146 }\r
147 return IMAGE_UNKNOWN;\r
148}\r
149\r
150/**\r
151 Get UEFI image protection policy based upon image type.\r
152\r
153 @param[in] ImageType The UEFI image type\r
154\r
155 @return UEFI image protection policy\r
156**/\r
157UINT32\r
158GetProtectionPolicyFromImageType (\r
159 IN UINT32 ImageType\r
160 )\r
161{\r
162 if ((ImageType & mImageProtectionPolicy) == 0) {\r
163 return DO_NOT_PROTECT;\r
164 } else {\r
165 return PROTECT_IF_ALIGNED_ELSE_ALLOW;\r
166 }\r
167}\r
168\r
169/**\r
170 Get UEFI image protection policy based upon loaded image device path.\r
171\r
172 @param[in] LoadedImage The loaded image protocol\r
173 @param[in] LoadedImageDevicePath The loaded image device path protocol\r
174\r
175 @return UEFI image protection policy\r
176**/\r
177UINT32\r
178GetUefiImageProtectionPolicy (\r
179 IN EFI_LOADED_IMAGE_PROTOCOL *LoadedImage,\r
180 IN EFI_DEVICE_PATH_PROTOCOL *LoadedImageDevicePath\r
181 )\r
182{\r
183 BOOLEAN InSmm;\r
184 UINT32 ImageType;\r
185 UINT32 ProtectionPolicy;\r
186\r
187 //\r
188 // Check SMM\r
189 //\r
190 InSmm = FALSE;\r
191 if (gSmmBase2 != NULL) {\r
192 gSmmBase2->InSmm (gSmmBase2, &InSmm);\r
193 }\r
194 if (InSmm) {\r
195 return FALSE;\r
196 }\r
197\r
198 //\r
199 // Check DevicePath\r
200 //\r
201 if (LoadedImage == gDxeCoreLoadedImage) {\r
202 ImageType = IMAGE_FROM_FV;\r
203 } else {\r
204 ImageType = GetImageType (LoadedImageDevicePath);\r
205 }\r
206 ProtectionPolicy = GetProtectionPolicyFromImageType (ImageType);\r
207 return ProtectionPolicy;\r
208}\r
209\r
210\r
211/**\r
212 Set UEFI image memory attributes.\r
213\r
214 @param[in] BaseAddress Specified start address\r
215 @param[in] Length Specified length\r
216 @param[in] Attributes Specified attributes\r
217**/\r
218VOID\r
219SetUefiImageMemoryAttributes (\r
220 IN UINT64 BaseAddress,\r
221 IN UINT64 Length,\r
222 IN UINT64 Attributes\r
223 )\r
224{\r
225 EFI_STATUS Status;\r
226 EFI_GCD_MEMORY_SPACE_DESCRIPTOR Descriptor;\r
227 UINT64 FinalAttributes;\r
228\r
229 Status = CoreGetMemorySpaceDescriptor(BaseAddress, &Descriptor);\r
230 ASSERT_EFI_ERROR(Status);\r
231\r
232 FinalAttributes = (Descriptor.Attributes & CACHE_ATTRIBUTE_MASK) | (Attributes & MEMORY_ATTRIBUTE_MASK);\r
233\r
234 DEBUG ((DEBUG_INFO, "SetUefiImageMemoryAttributes - 0x%016lx - 0x%016lx (0x%016lx)\n", BaseAddress, Length, FinalAttributes));\r
235\r
236 ASSERT(gCpu != NULL);\r
237 gCpu->SetMemoryAttributes (gCpu, BaseAddress, Length, FinalAttributes);\r
238}\r
239\r
240/**\r
241 Set UEFI image protection attributes.\r
242\r
243 @param[in] ImageRecord A UEFI image record\r
d0e92aad
JY
244**/\r
245VOID\r
246SetUefiImageProtectionAttributes (\r
5920a9d1 247 IN IMAGE_PROPERTIES_RECORD *ImageRecord\r
d0e92aad
JY
248 )\r
249{\r
250 IMAGE_PROPERTIES_RECORD_CODE_SECTION *ImageRecordCodeSection;\r
251 LIST_ENTRY *ImageRecordCodeSectionLink;\r
252 LIST_ENTRY *ImageRecordCodeSectionEndLink;\r
253 LIST_ENTRY *ImageRecordCodeSectionList;\r
254 UINT64 CurrentBase;\r
255 UINT64 ImageEnd;\r
d0e92aad
JY
256\r
257 ImageRecordCodeSectionList = &ImageRecord->CodeSegmentList;\r
258\r
259 CurrentBase = ImageRecord->ImageBase;\r
260 ImageEnd = ImageRecord->ImageBase + ImageRecord->ImageSize;\r
261\r
262 ImageRecordCodeSectionLink = ImageRecordCodeSectionList->ForwardLink;\r
263 ImageRecordCodeSectionEndLink = ImageRecordCodeSectionList;\r
264 while (ImageRecordCodeSectionLink != ImageRecordCodeSectionEndLink) {\r
265 ImageRecordCodeSection = CR (\r
266 ImageRecordCodeSectionLink,\r
267 IMAGE_PROPERTIES_RECORD_CODE_SECTION,\r
268 Link,\r
269 IMAGE_PROPERTIES_RECORD_CODE_SECTION_SIGNATURE\r
270 );\r
271 ImageRecordCodeSectionLink = ImageRecordCodeSectionLink->ForwardLink;\r
272\r
273 ASSERT (CurrentBase <= ImageRecordCodeSection->CodeSegmentBase);\r
274 if (CurrentBase < ImageRecordCodeSection->CodeSegmentBase) {\r
275 //\r
276 // DATA\r
277 //\r
d0e92aad
JY
278 SetUefiImageMemoryAttributes (\r
279 CurrentBase,\r
280 ImageRecordCodeSection->CodeSegmentBase - CurrentBase,\r
5920a9d1 281 EFI_MEMORY_XP\r
d0e92aad
JY
282 );\r
283 }\r
284 //\r
285 // CODE\r
286 //\r
d0e92aad
JY
287 SetUefiImageMemoryAttributes (\r
288 ImageRecordCodeSection->CodeSegmentBase,\r
289 ImageRecordCodeSection->CodeSegmentSize,\r
5920a9d1 290 EFI_MEMORY_RO\r
d0e92aad
JY
291 );\r
292 CurrentBase = ImageRecordCodeSection->CodeSegmentBase + ImageRecordCodeSection->CodeSegmentSize;\r
293 }\r
294 //\r
295 // Last DATA\r
296 //\r
297 ASSERT (CurrentBase <= ImageEnd);\r
298 if (CurrentBase < ImageEnd) {\r
299 //\r
300 // DATA\r
301 //\r
d0e92aad
JY
302 SetUefiImageMemoryAttributes (\r
303 CurrentBase,\r
304 ImageEnd - CurrentBase,\r
5920a9d1 305 EFI_MEMORY_XP\r
d0e92aad
JY
306 );\r
307 }\r
308 return ;\r
309}\r
310\r
311/**\r
312 Return if the PE image section is aligned.\r
313\r
314 @param[in] SectionAlignment PE/COFF section alignment\r
315 @param[in] MemoryType PE/COFF image memory type\r
316\r
317 @retval TRUE The PE image section is aligned.\r
318 @retval FALSE The PE image section is not aligned.\r
319**/\r
320BOOLEAN\r
321IsMemoryProtectionSectionAligned (\r
322 IN UINT32 SectionAlignment,\r
323 IN EFI_MEMORY_TYPE MemoryType\r
324 )\r
325{\r
326 UINT32 PageAlignment;\r
327\r
328 switch (MemoryType) {\r
329 case EfiRuntimeServicesCode:\r
330 case EfiACPIMemoryNVS:\r
d4731a98 331 PageAlignment = RUNTIME_PAGE_ALLOCATION_GRANULARITY;\r
d0e92aad
JY
332 break;\r
333 case EfiRuntimeServicesData:\r
334 case EfiACPIReclaimMemory:\r
335 ASSERT (FALSE);\r
d4731a98 336 PageAlignment = RUNTIME_PAGE_ALLOCATION_GRANULARITY;\r
d0e92aad
JY
337 break;\r
338 case EfiBootServicesCode:\r
339 case EfiLoaderCode:\r
340 case EfiReservedMemoryType:\r
341 PageAlignment = EFI_PAGE_SIZE;\r
342 break;\r
343 default:\r
344 ASSERT (FALSE);\r
345 PageAlignment = EFI_PAGE_SIZE;\r
346 break;\r
347 }\r
348\r
349 if ((SectionAlignment & (PageAlignment - 1)) != 0) {\r
350 return FALSE;\r
351 } else {\r
352 return TRUE;\r
353 }\r
354}\r
355\r
356/**\r
357 Free Image record.\r
358\r
359 @param[in] ImageRecord A UEFI image record\r
360**/\r
361VOID\r
362FreeImageRecord (\r
363 IN IMAGE_PROPERTIES_RECORD *ImageRecord\r
364 )\r
365{\r
366 LIST_ENTRY *CodeSegmentListHead;\r
367 IMAGE_PROPERTIES_RECORD_CODE_SECTION *ImageRecordCodeSection;\r
368\r
369 CodeSegmentListHead = &ImageRecord->CodeSegmentList;\r
370 while (!IsListEmpty (CodeSegmentListHead)) {\r
371 ImageRecordCodeSection = CR (\r
372 CodeSegmentListHead->ForwardLink,\r
373 IMAGE_PROPERTIES_RECORD_CODE_SECTION,\r
374 Link,\r
375 IMAGE_PROPERTIES_RECORD_CODE_SECTION_SIGNATURE\r
376 );\r
377 RemoveEntryList (&ImageRecordCodeSection->Link);\r
378 FreePool (ImageRecordCodeSection);\r
379 }\r
380\r
381 if (ImageRecord->Link.ForwardLink != NULL) {\r
382 RemoveEntryList (&ImageRecord->Link);\r
383 }\r
384 FreePool (ImageRecord);\r
385}\r
386\r
387/**\r
13425af7 388 Protect UEFI PE/COFF image.\r
d0e92aad
JY
389\r
390 @param[in] LoadedImage The loaded image protocol\r
391 @param[in] LoadedImageDevicePath The loaded image device path protocol\r
d0e92aad
JY
392**/\r
393VOID\r
5920a9d1 394ProtectUefiImage (\r
d0e92aad 395 IN EFI_LOADED_IMAGE_PROTOCOL *LoadedImage,\r
5920a9d1 396 IN EFI_DEVICE_PATH_PROTOCOL *LoadedImageDevicePath\r
d0e92aad
JY
397 )\r
398{\r
399 VOID *ImageAddress;\r
400 EFI_IMAGE_DOS_HEADER *DosHdr;\r
401 UINT32 PeCoffHeaderOffset;\r
402 UINT32 SectionAlignment;\r
403 EFI_IMAGE_SECTION_HEADER *Section;\r
404 EFI_IMAGE_OPTIONAL_HEADER_PTR_UNION Hdr;\r
405 UINT8 *Name;\r
406 UINTN Index;\r
407 IMAGE_PROPERTIES_RECORD *ImageRecord;\r
408 CHAR8 *PdbPointer;\r
409 IMAGE_PROPERTIES_RECORD_CODE_SECTION *ImageRecordCodeSection;\r
410 UINT16 Magic;\r
411 BOOLEAN IsAligned;\r
412 UINT32 ProtectionPolicy;\r
413\r
414 DEBUG ((DEBUG_INFO, "ProtectUefiImageCommon - 0x%x\n", LoadedImage));\r
415 DEBUG ((DEBUG_INFO, " - 0x%016lx - 0x%016lx\n", (EFI_PHYSICAL_ADDRESS)(UINTN)LoadedImage->ImageBase, LoadedImage->ImageSize));\r
416\r
417 if (gCpu == NULL) {\r
418 return ;\r
419 }\r
420\r
421 ProtectionPolicy = GetUefiImageProtectionPolicy (LoadedImage, LoadedImageDevicePath);\r
422 switch (ProtectionPolicy) {\r
423 case DO_NOT_PROTECT:\r
424 return ;\r
425 case PROTECT_IF_ALIGNED_ELSE_ALLOW:\r
426 break;\r
427 default:\r
428 ASSERT(FALSE);\r
429 return ;\r
430 }\r
431\r
432 ImageRecord = AllocateZeroPool (sizeof(*ImageRecord));\r
433 if (ImageRecord == NULL) {\r
434 return ;\r
435 }\r
436 ImageRecord->Signature = IMAGE_PROPERTIES_RECORD_SIGNATURE;\r
437\r
438 //\r
439 // Step 1: record whole region\r
440 //\r
441 ImageRecord->ImageBase = (EFI_PHYSICAL_ADDRESS)(UINTN)LoadedImage->ImageBase;\r
442 ImageRecord->ImageSize = LoadedImage->ImageSize;\r
443\r
444 ImageAddress = LoadedImage->ImageBase;\r
445\r
446 PdbPointer = PeCoffLoaderGetPdbPointer ((VOID*) (UINTN) ImageAddress);\r
447 if (PdbPointer != NULL) {\r
448 DEBUG ((DEBUG_VERBOSE, " Image - %a\n", PdbPointer));\r
449 }\r
450\r
451 //\r
452 // Check PE/COFF image\r
453 //\r
454 DosHdr = (EFI_IMAGE_DOS_HEADER *) (UINTN) ImageAddress;\r
455 PeCoffHeaderOffset = 0;\r
456 if (DosHdr->e_magic == EFI_IMAGE_DOS_SIGNATURE) {\r
457 PeCoffHeaderOffset = DosHdr->e_lfanew;\r
458 }\r
459\r
460 Hdr.Pe32 = (EFI_IMAGE_NT_HEADERS32 *)((UINT8 *) (UINTN) ImageAddress + PeCoffHeaderOffset);\r
461 if (Hdr.Pe32->Signature != EFI_IMAGE_NT_SIGNATURE) {\r
462 DEBUG ((DEBUG_VERBOSE, "Hdr.Pe32->Signature invalid - 0x%x\n", Hdr.Pe32->Signature));\r
463 // It might be image in SMM.\r
464 goto Finish;\r
465 }\r
466\r
467 //\r
468 // Get SectionAlignment\r
469 //\r
470 if (Hdr.Pe32->FileHeader.Machine == IMAGE_FILE_MACHINE_IA64 && Hdr.Pe32->OptionalHeader.Magic == EFI_IMAGE_NT_OPTIONAL_HDR32_MAGIC) {\r
471 //\r
472 // NOTE: Some versions of Linux ELILO for Itanium have an incorrect magic value\r
473 // in the PE/COFF Header. If the MachineType is Itanium(IA64) and the\r
474 // Magic value in the OptionalHeader is EFI_IMAGE_NT_OPTIONAL_HDR32_MAGIC\r
475 // then override the magic value to EFI_IMAGE_NT_OPTIONAL_HDR64_MAGIC\r
476 //\r
477 Magic = EFI_IMAGE_NT_OPTIONAL_HDR64_MAGIC;\r
478 } else {\r
479 //\r
480 // Get the magic value from the PE/COFF Optional Header\r
481 //\r
482 Magic = Hdr.Pe32->OptionalHeader.Magic;\r
483 }\r
484 if (Magic == EFI_IMAGE_NT_OPTIONAL_HDR32_MAGIC) {\r
485 SectionAlignment = Hdr.Pe32->OptionalHeader.SectionAlignment;\r
486 } else {\r
487 SectionAlignment = Hdr.Pe32Plus->OptionalHeader.SectionAlignment;\r
488 }\r
489\r
490 IsAligned = IsMemoryProtectionSectionAligned (SectionAlignment, LoadedImage->ImageCodeType);\r
491 if (!IsAligned) {\r
492 DEBUG ((DEBUG_VERBOSE, "!!!!!!!! ProtectUefiImageCommon - Section Alignment(0x%x) is incorrect !!!!!!!!\n",\r
493 SectionAlignment));\r
494 PdbPointer = PeCoffLoaderGetPdbPointer ((VOID*) (UINTN) ImageAddress);\r
495 if (PdbPointer != NULL) {\r
496 DEBUG ((DEBUG_VERBOSE, "!!!!!!!! Image - %a !!!!!!!!\n", PdbPointer));\r
497 }\r
498 goto Finish;\r
499 }\r
500\r
501 Section = (EFI_IMAGE_SECTION_HEADER *) (\r
502 (UINT8 *) (UINTN) ImageAddress +\r
503 PeCoffHeaderOffset +\r
504 sizeof(UINT32) +\r
505 sizeof(EFI_IMAGE_FILE_HEADER) +\r
506 Hdr.Pe32->FileHeader.SizeOfOptionalHeader\r
507 );\r
508 ImageRecord->CodeSegmentCount = 0;\r
509 InitializeListHead (&ImageRecord->CodeSegmentList);\r
510 for (Index = 0; Index < Hdr.Pe32->FileHeader.NumberOfSections; Index++) {\r
511 Name = Section[Index].Name;\r
512 DEBUG ((\r
513 DEBUG_VERBOSE,\r
514 " Section - '%c%c%c%c%c%c%c%c'\n",\r
515 Name[0],\r
516 Name[1],\r
517 Name[2],\r
518 Name[3],\r
519 Name[4],\r
520 Name[5],\r
521 Name[6],\r
522 Name[7]\r
523 ));\r
524\r
a2ed40c0
AB
525 //\r
526 // Instead of assuming that a PE/COFF section of type EFI_IMAGE_SCN_CNT_CODE\r
527 // can always be mapped read-only, classify a section as a code section only\r
528 // if it has the executable attribute set and the writable attribute cleared.\r
529 //\r
530 // This adheres more closely to the PE/COFF spec, and avoids issues with\r
531 // Linux OS loaders that may consist of a single read/write/execute section.\r
532 //\r
533 if ((Section[Index].Characteristics & (EFI_IMAGE_SCN_MEM_WRITE | EFI_IMAGE_SCN_MEM_EXECUTE)) == EFI_IMAGE_SCN_MEM_EXECUTE) {\r
d0e92aad
JY
534 DEBUG ((DEBUG_VERBOSE, " VirtualSize - 0x%08x\n", Section[Index].Misc.VirtualSize));\r
535 DEBUG ((DEBUG_VERBOSE, " VirtualAddress - 0x%08x\n", Section[Index].VirtualAddress));\r
536 DEBUG ((DEBUG_VERBOSE, " SizeOfRawData - 0x%08x\n", Section[Index].SizeOfRawData));\r
537 DEBUG ((DEBUG_VERBOSE, " PointerToRawData - 0x%08x\n", Section[Index].PointerToRawData));\r
538 DEBUG ((DEBUG_VERBOSE, " PointerToRelocations - 0x%08x\n", Section[Index].PointerToRelocations));\r
539 DEBUG ((DEBUG_VERBOSE, " PointerToLinenumbers - 0x%08x\n", Section[Index].PointerToLinenumbers));\r
540 DEBUG ((DEBUG_VERBOSE, " NumberOfRelocations - 0x%08x\n", Section[Index].NumberOfRelocations));\r
541 DEBUG ((DEBUG_VERBOSE, " NumberOfLinenumbers - 0x%08x\n", Section[Index].NumberOfLinenumbers));\r
542 DEBUG ((DEBUG_VERBOSE, " Characteristics - 0x%08x\n", Section[Index].Characteristics));\r
543\r
544 //\r
545 // Step 2: record code section\r
546 //\r
547 ImageRecordCodeSection = AllocatePool (sizeof(*ImageRecordCodeSection));\r
548 if (ImageRecordCodeSection == NULL) {\r
549 return ;\r
550 }\r
551 ImageRecordCodeSection->Signature = IMAGE_PROPERTIES_RECORD_CODE_SECTION_SIGNATURE;\r
552\r
553 ImageRecordCodeSection->CodeSegmentBase = (UINTN)ImageAddress + Section[Index].VirtualAddress;\r
554 ImageRecordCodeSection->CodeSegmentSize = ALIGN_VALUE(Section[Index].SizeOfRawData, SectionAlignment);\r
555\r
556 DEBUG ((DEBUG_VERBOSE, "ImageCode: 0x%016lx - 0x%016lx\n", ImageRecordCodeSection->CodeSegmentBase, ImageRecordCodeSection->CodeSegmentSize));\r
557\r
558 InsertTailList (&ImageRecord->CodeSegmentList, &ImageRecordCodeSection->Link);\r
559 ImageRecord->CodeSegmentCount++;\r
560 }\r
561 }\r
562\r
563 if (ImageRecord->CodeSegmentCount == 0) {\r
38b15ebe
LE
564 //\r
565 // If a UEFI executable consists of a single read+write+exec PE/COFF\r
566 // section, that isn't actually an error. The image can be launched\r
567 // alright, only image protection cannot be applied to it fully.\r
568 //\r
569 // One example that elicits this is (some) Linux kernels (with the EFI stub\r
570 // of course).\r
571 //\r
572 DEBUG ((DEBUG_WARN, "!!!!!!!! ProtectUefiImageCommon - CodeSegmentCount is 0 !!!!!!!!\n"));\r
d0e92aad
JY
573 PdbPointer = PeCoffLoaderGetPdbPointer ((VOID*) (UINTN) ImageAddress);\r
574 if (PdbPointer != NULL) {\r
38b15ebe 575 DEBUG ((DEBUG_WARN, "!!!!!!!! Image - %a !!!!!!!!\n", PdbPointer));\r
d0e92aad
JY
576 }\r
577 goto Finish;\r
578 }\r
579\r
580 //\r
581 // Final\r
582 //\r
583 SortImageRecordCodeSection (ImageRecord);\r
584 //\r
585 // Check overlap all section in ImageBase/Size\r
586 //\r
587 if (!IsImageRecordCodeSectionValid (ImageRecord)) {\r
588 DEBUG ((DEBUG_ERROR, "IsImageRecordCodeSectionValid - FAIL\n"));\r
589 goto Finish;\r
590 }\r
591\r
592 //\r
593 // Round up the ImageSize, some CPU arch may return EFI_UNSUPPORTED if ImageSize is not aligned.\r
594 // Given that the loader always allocates full pages, we know the space after the image is not used.\r
595 //\r
596 ImageRecord->ImageSize = ALIGN_VALUE(LoadedImage->ImageSize, EFI_PAGE_SIZE);\r
597\r
598 //\r
599 // CPU ARCH present. Update memory attribute directly.\r
600 //\r
5920a9d1 601 SetUefiImageProtectionAttributes (ImageRecord);\r
d0e92aad
JY
602\r
603 //\r
5920a9d1 604 // Record the image record in the list so we can undo the protections later\r
d0e92aad 605 //\r
5920a9d1 606 InsertTailList (&mProtectedImageRecordList, &ImageRecord->Link);\r
d0e92aad
JY
607\r
608Finish:\r
609 return ;\r
610}\r
611\r
d0e92aad
JY
612/**\r
613 Unprotect UEFI image.\r
614\r
615 @param[in] LoadedImage The loaded image protocol\r
616 @param[in] LoadedImageDevicePath The loaded image device path protocol\r
617**/\r
618VOID\r
619UnprotectUefiImage (\r
620 IN EFI_LOADED_IMAGE_PROTOCOL *LoadedImage,\r
621 IN EFI_DEVICE_PATH_PROTOCOL *LoadedImageDevicePath\r
622 )\r
623{\r
5920a9d1
AB
624 IMAGE_PROPERTIES_RECORD *ImageRecord;\r
625 LIST_ENTRY *ImageRecordLink;\r
626\r
d0e92aad 627 if (PcdGet32(PcdImageProtectionPolicy) != 0) {\r
5920a9d1
AB
628 for (ImageRecordLink = mProtectedImageRecordList.ForwardLink;\r
629 ImageRecordLink != &mProtectedImageRecordList;\r
630 ImageRecordLink = ImageRecordLink->ForwardLink) {\r
631 ImageRecord = CR (\r
632 ImageRecordLink,\r
633 IMAGE_PROPERTIES_RECORD,\r
634 Link,\r
635 IMAGE_PROPERTIES_RECORD_SIGNATURE\r
636 );\r
637\r
638 if (ImageRecord->ImageBase == (EFI_PHYSICAL_ADDRESS)(UINTN)LoadedImage->ImageBase) {\r
639 SetUefiImageMemoryAttributes (ImageRecord->ImageBase,\r
640 ImageRecord->ImageSize,\r
641 0);\r
642 FreeImageRecord (ImageRecord);\r
643 return;\r
644 }\r
645 }\r
d0e92aad
JY
646 }\r
647}\r
648\r
7eb927db
AB
649/**\r
650 Return the EFI memory permission attribute associated with memory\r
651 type 'MemoryType' under the configured DXE memory protection policy.\r
7babb437
BD
652\r
653 @param MemoryType Memory type.\r
7eb927db
AB
654**/\r
655STATIC\r
656UINT64\r
657GetPermissionAttributeForMemoryType (\r
658 IN EFI_MEMORY_TYPE MemoryType\r
659 )\r
660{\r
661 UINT64 TestBit;\r
662\r
663 if ((UINT32)MemoryType >= MEMORY_TYPE_OS_RESERVED_MIN) {\r
664 TestBit = BIT63;\r
665 } else if ((UINT32)MemoryType >= MEMORY_TYPE_OEM_RESERVED_MIN) {\r
666 TestBit = BIT62;\r
667 } else {\r
668 TestBit = LShiftU64 (1, MemoryType);\r
669 }\r
670\r
671 if ((PcdGet64 (PcdDxeNxMemoryProtectionPolicy) & TestBit) != 0) {\r
672 return EFI_MEMORY_XP;\r
673 } else {\r
674 return 0;\r
675 }\r
676}\r
677\r
678/**\r
679 Sort memory map entries based upon PhysicalStart, from low to high.\r
680\r
681 @param MemoryMap A pointer to the buffer in which firmware places\r
682 the current memory map.\r
683 @param MemoryMapSize Size, in bytes, of the MemoryMap buffer.\r
684 @param DescriptorSize Size, in bytes, of an individual EFI_MEMORY_DESCRIPTOR.\r
685**/\r
686STATIC\r
687VOID\r
688SortMemoryMap (\r
689 IN OUT EFI_MEMORY_DESCRIPTOR *MemoryMap,\r
690 IN UINTN MemoryMapSize,\r
691 IN UINTN DescriptorSize\r
692 )\r
693{\r
694 EFI_MEMORY_DESCRIPTOR *MemoryMapEntry;\r
695 EFI_MEMORY_DESCRIPTOR *NextMemoryMapEntry;\r
696 EFI_MEMORY_DESCRIPTOR *MemoryMapEnd;\r
697 EFI_MEMORY_DESCRIPTOR TempMemoryMap;\r
698\r
699 MemoryMapEntry = MemoryMap;\r
700 NextMemoryMapEntry = NEXT_MEMORY_DESCRIPTOR (MemoryMapEntry, DescriptorSize);\r
701 MemoryMapEnd = (EFI_MEMORY_DESCRIPTOR *) ((UINT8 *) MemoryMap + MemoryMapSize);\r
702 while (MemoryMapEntry < MemoryMapEnd) {\r
703 while (NextMemoryMapEntry < MemoryMapEnd) {\r
704 if (MemoryMapEntry->PhysicalStart > NextMemoryMapEntry->PhysicalStart) {\r
705 CopyMem (&TempMemoryMap, MemoryMapEntry, sizeof(EFI_MEMORY_DESCRIPTOR));\r
706 CopyMem (MemoryMapEntry, NextMemoryMapEntry, sizeof(EFI_MEMORY_DESCRIPTOR));\r
707 CopyMem (NextMemoryMapEntry, &TempMemoryMap, sizeof(EFI_MEMORY_DESCRIPTOR));\r
708 }\r
709\r
710 NextMemoryMapEntry = NEXT_MEMORY_DESCRIPTOR (NextMemoryMapEntry, DescriptorSize);\r
711 }\r
712\r
713 MemoryMapEntry = NEXT_MEMORY_DESCRIPTOR (MemoryMapEntry, DescriptorSize);\r
714 NextMemoryMapEntry = NEXT_MEMORY_DESCRIPTOR (MemoryMapEntry, DescriptorSize);\r
715 }\r
716}\r
717\r
718/**\r
719 Merge adjacent memory map entries if they use the same memory protection policy\r
720\r
721 @param[in, out] MemoryMap A pointer to the buffer in which firmware places\r
722 the current memory map.\r
723 @param[in, out] MemoryMapSize A pointer to the size, in bytes, of the\r
724 MemoryMap buffer. On input, this is the size of\r
725 the current memory map. On output,\r
726 it is the size of new memory map after merge.\r
727 @param[in] DescriptorSize Size, in bytes, of an individual EFI_MEMORY_DESCRIPTOR.\r
728**/\r
729STATIC\r
730VOID\r
731MergeMemoryMapForProtectionPolicy (\r
732 IN OUT EFI_MEMORY_DESCRIPTOR *MemoryMap,\r
733 IN OUT UINTN *MemoryMapSize,\r
734 IN UINTN DescriptorSize\r
735 )\r
736{\r
737 EFI_MEMORY_DESCRIPTOR *MemoryMapEntry;\r
738 EFI_MEMORY_DESCRIPTOR *MemoryMapEnd;\r
739 UINT64 MemoryBlockLength;\r
740 EFI_MEMORY_DESCRIPTOR *NewMemoryMapEntry;\r
741 EFI_MEMORY_DESCRIPTOR *NextMemoryMapEntry;\r
742 UINT64 Attributes;\r
743\r
744 SortMemoryMap (MemoryMap, *MemoryMapSize, DescriptorSize);\r
745\r
746 MemoryMapEntry = MemoryMap;\r
747 NewMemoryMapEntry = MemoryMap;\r
748 MemoryMapEnd = (EFI_MEMORY_DESCRIPTOR *) ((UINT8 *) MemoryMap + *MemoryMapSize);\r
749 while ((UINTN)MemoryMapEntry < (UINTN)MemoryMapEnd) {\r
750 CopyMem (NewMemoryMapEntry, MemoryMapEntry, sizeof(EFI_MEMORY_DESCRIPTOR));\r
751 NextMemoryMapEntry = NEXT_MEMORY_DESCRIPTOR (MemoryMapEntry, DescriptorSize);\r
752\r
753 do {\r
754 MemoryBlockLength = (UINT64) (EFI_PAGES_TO_SIZE((UINTN)MemoryMapEntry->NumberOfPages));\r
755 Attributes = GetPermissionAttributeForMemoryType (MemoryMapEntry->Type);\r
756\r
757 if (((UINTN)NextMemoryMapEntry < (UINTN)MemoryMapEnd) &&\r
758 Attributes == GetPermissionAttributeForMemoryType (NextMemoryMapEntry->Type) &&\r
759 ((MemoryMapEntry->PhysicalStart + MemoryBlockLength) == NextMemoryMapEntry->PhysicalStart)) {\r
760 MemoryMapEntry->NumberOfPages += NextMemoryMapEntry->NumberOfPages;\r
761 if (NewMemoryMapEntry != MemoryMapEntry) {\r
762 NewMemoryMapEntry->NumberOfPages += NextMemoryMapEntry->NumberOfPages;\r
763 }\r
764\r
765 NextMemoryMapEntry = NEXT_MEMORY_DESCRIPTOR (NextMemoryMapEntry, DescriptorSize);\r
766 continue;\r
767 } else {\r
768 MemoryMapEntry = PREVIOUS_MEMORY_DESCRIPTOR (NextMemoryMapEntry, DescriptorSize);\r
769 break;\r
770 }\r
771 } while (TRUE);\r
772\r
773 MemoryMapEntry = NEXT_MEMORY_DESCRIPTOR (MemoryMapEntry, DescriptorSize);\r
774 NewMemoryMapEntry = NEXT_MEMORY_DESCRIPTOR (NewMemoryMapEntry, DescriptorSize);\r
775 }\r
776\r
777 *MemoryMapSize = (UINTN)NewMemoryMapEntry - (UINTN)MemoryMap;\r
778\r
779 return ;\r
780}\r
781\r
782\r
783/**\r
784 Remove exec permissions from all regions whose type is identified by\r
7babb437 785 PcdDxeNxMemoryProtectionPolicy.\r
7eb927db
AB
786**/\r
787STATIC\r
788VOID\r
789InitializeDxeNxMemoryProtectionPolicy (\r
790 VOID\r
791 )\r
792{\r
793 UINTN MemoryMapSize;\r
794 UINTN MapKey;\r
795 UINTN DescriptorSize;\r
796 UINT32 DescriptorVersion;\r
797 EFI_MEMORY_DESCRIPTOR *MemoryMap;\r
798 EFI_MEMORY_DESCRIPTOR *MemoryMapEntry;\r
799 EFI_MEMORY_DESCRIPTOR *MemoryMapEnd;\r
800 EFI_STATUS Status;\r
801 UINT64 Attributes;\r
802 LIST_ENTRY *Link;\r
803 EFI_GCD_MAP_ENTRY *Entry;\r
804\r
805 //\r
806 // Get the EFI memory map.\r
807 //\r
808 MemoryMapSize = 0;\r
809 MemoryMap = NULL;\r
810\r
811 Status = gBS->GetMemoryMap (\r
812 &MemoryMapSize,\r
813 MemoryMap,\r
814 &MapKey,\r
815 &DescriptorSize,\r
816 &DescriptorVersion\r
817 );\r
818 ASSERT (Status == EFI_BUFFER_TOO_SMALL);\r
819 do {\r
820 MemoryMap = (EFI_MEMORY_DESCRIPTOR *) AllocatePool (MemoryMapSize);\r
821 ASSERT (MemoryMap != NULL);\r
822 Status = gBS->GetMemoryMap (\r
823 &MemoryMapSize,\r
824 MemoryMap,\r
825 &MapKey,\r
826 &DescriptorSize,\r
827 &DescriptorVersion\r
828 );\r
829 if (EFI_ERROR (Status)) {\r
830 FreePool (MemoryMap);\r
831 }\r
832 } while (Status == EFI_BUFFER_TOO_SMALL);\r
833 ASSERT_EFI_ERROR (Status);\r
834\r
a9212288
LE
835 DEBUG ((\r
836 DEBUG_INFO,\r
837 "%a: applying strict permissions to active memory regions\n",\r
838 __FUNCTION__\r
839 ));\r
7eb927db
AB
840\r
841 MergeMemoryMapForProtectionPolicy (MemoryMap, &MemoryMapSize, DescriptorSize);\r
842\r
843 MemoryMapEntry = MemoryMap;\r
844 MemoryMapEnd = (EFI_MEMORY_DESCRIPTOR *) ((UINT8 *) MemoryMap + MemoryMapSize);\r
845 while ((UINTN) MemoryMapEntry < (UINTN) MemoryMapEnd) {\r
846\r
847 Attributes = GetPermissionAttributeForMemoryType (MemoryMapEntry->Type);\r
848 if (Attributes != 0) {\r
9b17c651
JW
849 if (MemoryMapEntry->PhysicalStart == 0 &&\r
850 PcdGet8 (PcdNullPointerDetectionPropertyMask) != 0) {\r
851\r
852 ASSERT (MemoryMapEntry->NumberOfPages > 0);\r
853 //\r
854 // Skip page 0 if NULL pointer detection is enabled to avoid attributes\r
855 // overwritten.\r
856 //\r
857 SetUefiImageMemoryAttributes (\r
858 MemoryMapEntry->PhysicalStart + EFI_PAGE_SIZE,\r
859 LShiftU64 (MemoryMapEntry->NumberOfPages - 1, EFI_PAGE_SHIFT),\r
860 Attributes);\r
861 } else {\r
862 SetUefiImageMemoryAttributes (\r
863 MemoryMapEntry->PhysicalStart,\r
864 LShiftU64 (MemoryMapEntry->NumberOfPages, EFI_PAGE_SHIFT),\r
865 Attributes);\r
866 }\r
7eb927db
AB
867 }\r
868 MemoryMapEntry = NEXT_MEMORY_DESCRIPTOR (MemoryMapEntry, DescriptorSize);\r
869 }\r
870 FreePool (MemoryMap);\r
871\r
872 //\r
873 // Apply the policy for RAM regions that we know are present and\r
874 // accessible, but have not been added to the UEFI memory map (yet).\r
875 //\r
876 if (GetPermissionAttributeForMemoryType (EfiConventionalMemory) != 0) {\r
a9212288
LE
877 DEBUG ((\r
878 DEBUG_INFO,\r
7eb927db 879 "%a: applying strict permissions to inactive memory regions\n",\r
a9212288
LE
880 __FUNCTION__\r
881 ));\r
7eb927db
AB
882\r
883 CoreAcquireGcdMemoryLock ();\r
884\r
885 Link = mGcdMemorySpaceMap.ForwardLink;\r
886 while (Link != &mGcdMemorySpaceMap) {\r
887\r
888 Entry = CR (Link, EFI_GCD_MAP_ENTRY, Link, EFI_GCD_MAP_SIGNATURE);\r
889\r
890 if (Entry->GcdMemoryType == EfiGcdMemoryTypeReserved &&\r
891 Entry->EndAddress < MAX_ADDRESS &&\r
892 (Entry->Capabilities & (EFI_MEMORY_PRESENT | EFI_MEMORY_INITIALIZED | EFI_MEMORY_TESTED)) ==\r
893 (EFI_MEMORY_PRESENT | EFI_MEMORY_INITIALIZED)) {\r
894\r
895 Attributes = GetPermissionAttributeForMemoryType (EfiConventionalMemory) |\r
896 (Entry->Attributes & CACHE_ATTRIBUTE_MASK);\r
897\r
898 DEBUG ((DEBUG_INFO,\r
899 "Untested GCD memory space region: - 0x%016lx - 0x%016lx (0x%016lx)\n",\r
900 Entry->BaseAddress, Entry->EndAddress - Entry->BaseAddress + 1,\r
901 Attributes));\r
902\r
903 ASSERT(gCpu != NULL);\r
904 gCpu->SetMemoryAttributes (gCpu, Entry->BaseAddress,\r
905 Entry->EndAddress - Entry->BaseAddress + 1, Attributes);\r
906 }\r
907\r
908 Link = Link->ForwardLink;\r
909 }\r
910 CoreReleaseGcdMemoryLock ();\r
911 }\r
912}\r
913\r
914\r
d0e92aad
JY
915/**\r
916 A notification for CPU_ARCH protocol.\r
917\r
918 @param[in] Event Event whose notification function is being invoked.\r
919 @param[in] Context Pointer to the notification function's context,\r
920 which is implementation-dependent.\r
921\r
922**/\r
923VOID\r
924EFIAPI\r
925MemoryProtectionCpuArchProtocolNotify (\r
926 IN EFI_EVENT Event,\r
927 IN VOID *Context\r
928 )\r
929{\r
930 EFI_STATUS Status;\r
931 EFI_LOADED_IMAGE_PROTOCOL *LoadedImage;\r
932 EFI_DEVICE_PATH_PROTOCOL *LoadedImageDevicePath;\r
933 UINTN NoHandles;\r
934 EFI_HANDLE *HandleBuffer;\r
935 UINTN Index;\r
936\r
937 DEBUG ((DEBUG_INFO, "MemoryProtectionCpuArchProtocolNotify:\n"));\r
938 Status = CoreLocateProtocol (&gEfiCpuArchProtocolGuid, NULL, (VOID **)&gCpu);\r
939 if (EFI_ERROR (Status)) {\r
940 return;\r
941 }\r
942\r
7eb927db
AB
943 //\r
944 // Apply the memory protection policy on non-BScode/RTcode regions.\r
945 //\r
946 if (PcdGet64 (PcdDxeNxMemoryProtectionPolicy) != 0) {\r
947 InitializeDxeNxMemoryProtectionPolicy ();\r
948 }\r
949\r
950 if (mImageProtectionPolicy == 0) {\r
951 return;\r
952 }\r
953\r
d0e92aad
JY
954 Status = gBS->LocateHandleBuffer (\r
955 ByProtocol,\r
956 &gEfiLoadedImageProtocolGuid,\r
957 NULL,\r
958 &NoHandles,\r
959 &HandleBuffer\r
960 );\r
961 if (EFI_ERROR (Status) && (NoHandles == 0)) {\r
962 return ;\r
963 }\r
964\r
965 for (Index = 0; Index < NoHandles; Index++) {\r
966 Status = gBS->HandleProtocol (\r
967 HandleBuffer[Index],\r
968 &gEfiLoadedImageProtocolGuid,\r
969 (VOID **)&LoadedImage\r
970 );\r
971 if (EFI_ERROR(Status)) {\r
972 continue;\r
973 }\r
974 Status = gBS->HandleProtocol (\r
975 HandleBuffer[Index],\r
976 &gEfiLoadedImageDevicePathProtocolGuid,\r
977 (VOID **)&LoadedImageDevicePath\r
978 );\r
979 if (EFI_ERROR(Status)) {\r
980 LoadedImageDevicePath = NULL;\r
981 }\r
982\r
983 ProtectUefiImage (LoadedImage, LoadedImageDevicePath);\r
984 }\r
985\r
986 CoreCloseEvent (Event);\r
987 return;\r
988}\r
989\r
990/**\r
991 ExitBootServices Callback function for memory protection.\r
992**/\r
993VOID\r
994MemoryProtectionExitBootServicesCallback (\r
995 VOID\r
996 )\r
997{\r
998 EFI_RUNTIME_IMAGE_ENTRY *RuntimeImage;\r
999 LIST_ENTRY *Link;\r
1000\r
1001 //\r
1002 // We need remove the RT protection, because RT relocation need write code segment\r
1003 // at SetVirtualAddressMap(). We cannot assume OS/Loader has taken over page table at that time.\r
1004 //\r
1005 // Firmware does not own page tables after ExitBootServices(), so the OS would\r
1006 // have to relax protection of RT code pages across SetVirtualAddressMap(), or\r
1007 // delay setting protections on RT code pages until after SetVirtualAddressMap().\r
1008 // OS may set protection on RT based upon EFI_MEMORY_ATTRIBUTES_TABLE later.\r
1009 //\r
1010 if (mImageProtectionPolicy != 0) {\r
1011 for (Link = gRuntime->ImageHead.ForwardLink; Link != &gRuntime->ImageHead; Link = Link->ForwardLink) {\r
1012 RuntimeImage = BASE_CR (Link, EFI_RUNTIME_IMAGE_ENTRY, Link);\r
1013 SetUefiImageMemoryAttributes ((UINT64)(UINTN)RuntimeImage->ImageBase, ALIGN_VALUE(RuntimeImage->ImageSize, EFI_PAGE_SIZE), 0);\r
1014 }\r
1015 }\r
1016}\r
1017\r
a7181d95
JW
1018/**\r
1019 Disable NULL pointer detection after EndOfDxe. This is a workaround resort in\r
1020 order to skip unfixable NULL pointer access issues detected in OptionROM or\r
1021 boot loaders.\r
1022\r
1023 @param[in] Event The Event this notify function registered to.\r
1024 @param[in] Context Pointer to the context data registered to the Event.\r
1025**/\r
1026VOID\r
1027EFIAPI\r
1028DisableNullDetectionAtTheEndOfDxe (\r
1029 EFI_EVENT Event,\r
1030 VOID *Context\r
1031 )\r
1032{\r
1033 EFI_STATUS Status;\r
1034 EFI_GCD_MEMORY_SPACE_DESCRIPTOR Desc;\r
1035\r
1036 DEBUG ((DEBUG_INFO, "DisableNullDetectionAtTheEndOfDxe(): start\r\n"));\r
1037 //\r
1038 // Disable NULL pointer detection by enabling first 4K page\r
1039 //\r
1040 Status = CoreGetMemorySpaceDescriptor (0, &Desc);\r
1041 ASSERT_EFI_ERROR (Status);\r
1042\r
1043 if ((Desc.Capabilities & EFI_MEMORY_RP) == 0) {\r
1044 Status = CoreSetMemorySpaceCapabilities (\r
1045 0,\r
1046 EFI_PAGE_SIZE,\r
1047 Desc.Capabilities | EFI_MEMORY_RP\r
1048 );\r
1049 ASSERT_EFI_ERROR (Status);\r
1050 }\r
1051\r
1052 Status = CoreSetMemorySpaceAttributes (\r
1053 0,\r
1054 EFI_PAGE_SIZE,\r
1055 Desc.Attributes & ~EFI_MEMORY_RP\r
1056 );\r
1057 ASSERT_EFI_ERROR (Status);\r
1058\r
1059 CoreCloseEvent (Event);\r
1060 DEBUG ((DEBUG_INFO, "DisableNullDetectionAtTheEndOfDxe(): end\r\n"));\r
1061\r
1062 return;\r
1063}\r
1064\r
d0e92aad
JY
1065/**\r
1066 Initialize Memory Protection support.\r
1067**/\r
1068VOID\r
1069EFIAPI\r
1070CoreInitializeMemoryProtection (\r
1071 VOID\r
1072 )\r
1073{\r
1074 EFI_STATUS Status;\r
1075 EFI_EVENT Event;\r
a7181d95 1076 EFI_EVENT EndOfDxeEvent;\r
d0e92aad
JY
1077 VOID *Registration;\r
1078\r
1079 mImageProtectionPolicy = PcdGet32(PcdImageProtectionPolicy);\r
1080\r
5920a9d1
AB
1081 InitializeListHead (&mProtectedImageRecordList);\r
1082\r
7eb927db
AB
1083 //\r
1084 // Sanity check the PcdDxeNxMemoryProtectionPolicy setting:\r
1085 // - code regions should have no EFI_MEMORY_XP attribute\r
1086 // - EfiConventionalMemory and EfiBootServicesData should use the\r
1087 // same attribute\r
1088 //\r
1089 ASSERT ((GetPermissionAttributeForMemoryType (EfiBootServicesCode) & EFI_MEMORY_XP) == 0);\r
1090 ASSERT ((GetPermissionAttributeForMemoryType (EfiRuntimeServicesCode) & EFI_MEMORY_XP) == 0);\r
1091 ASSERT ((GetPermissionAttributeForMemoryType (EfiLoaderCode) & EFI_MEMORY_XP) == 0);\r
1092 ASSERT (GetPermissionAttributeForMemoryType (EfiBootServicesData) ==\r
1093 GetPermissionAttributeForMemoryType (EfiConventionalMemory));\r
1094\r
1095 if (mImageProtectionPolicy != 0 || PcdGet64 (PcdDxeNxMemoryProtectionPolicy) != 0) {\r
d0e92aad
JY
1096 Status = CoreCreateEvent (\r
1097 EVT_NOTIFY_SIGNAL,\r
1098 TPL_CALLBACK,\r
1099 MemoryProtectionCpuArchProtocolNotify,\r
1100 NULL,\r
1101 &Event\r
1102 );\r
1103 ASSERT_EFI_ERROR(Status);\r
1104\r
1105 //\r
1106 // Register for protocol notifactions on this event\r
1107 //\r
1108 Status = CoreRegisterProtocolNotify (\r
1109 &gEfiCpuArchProtocolGuid,\r
1110 Event,\r
1111 &Registration\r
1112 );\r
1113 ASSERT_EFI_ERROR(Status);\r
1114 }\r
a7181d95
JW
1115\r
1116 //\r
1117 // Register a callback to disable NULL pointer detection at EndOfDxe\r
1118 //\r
1119 if ((PcdGet8 (PcdNullPointerDetectionPropertyMask) & (BIT0|BIT7))\r
1120 == (BIT0|BIT7)) {\r
1121 Status = CoreCreateEventEx (\r
1122 EVT_NOTIFY_SIGNAL,\r
1123 TPL_NOTIFY,\r
1124 DisableNullDetectionAtTheEndOfDxe,\r
1125 NULL,\r
1126 &gEfiEndOfDxeEventGroupGuid,\r
1127 &EndOfDxeEvent\r
1128 );\r
1129 ASSERT_EFI_ERROR (Status);\r
1130 }\r
1131\r
d0e92aad
JY
1132 return ;\r
1133}\r
7eb927db
AB
1134\r
1135/**\r
7babb437 1136 Returns whether we are currently executing in SMM mode.\r
7eb927db
AB
1137**/\r
1138STATIC\r
1139BOOLEAN\r
1140IsInSmm (\r
1141 VOID\r
1142 )\r
1143{\r
1144 BOOLEAN InSmm;\r
1145\r
1146 InSmm = FALSE;\r
1147 if (gSmmBase2 != NULL) {\r
1148 gSmmBase2->InSmm (gSmmBase2, &InSmm);\r
1149 }\r
1150 return InSmm;\r
1151}\r
1152\r
1153/**\r
1154 Manage memory permission attributes on a memory range, according to the\r
1155 configured DXE memory protection policy.\r
1156\r
1157 @param OldType The old memory type of the range\r
1158 @param NewType The new memory type of the range\r
1159 @param Memory The base address of the range\r
1160 @param Length The size of the range (in bytes)\r
1161\r
1162 @return EFI_SUCCESS If we are executing in SMM mode. No permission attributes\r
1163 are updated in this case\r
1164 @return EFI_SUCCESS If the the CPU arch protocol is not installed yet\r
1165 @return EFI_SUCCESS If no DXE memory protection policy has been configured\r
1166 @return EFI_SUCCESS If OldType and NewType use the same permission attributes\r
1167 @return other Return value of gCpu->SetMemoryAttributes()\r
1168\r
1169**/\r
1170EFI_STATUS\r
1171EFIAPI\r
1172ApplyMemoryProtectionPolicy (\r
1173 IN EFI_MEMORY_TYPE OldType,\r
1174 IN EFI_MEMORY_TYPE NewType,\r
1175 IN EFI_PHYSICAL_ADDRESS Memory,\r
1176 IN UINT64 Length\r
1177 )\r
1178{\r
1179 UINT64 OldAttributes;\r
1180 UINT64 NewAttributes;\r
1181\r
1182 //\r
1183 // The policy configured in PcdDxeNxMemoryProtectionPolicy\r
1184 // does not apply to allocations performed in SMM mode.\r
1185 //\r
1186 if (IsInSmm ()) {\r
1187 return EFI_SUCCESS;\r
1188 }\r
1189\r
1190 //\r
1191 // If the CPU arch protocol is not installed yet, we cannot manage memory\r
1192 // permission attributes, and it is the job of the driver that installs this\r
1193 // protocol to set the permissions on existing allocations.\r
1194 //\r
1195 if (gCpu == NULL) {\r
1196 return EFI_SUCCESS;\r
1197 }\r
1198\r
1199 //\r
1200 // Check if a DXE memory protection policy has been configured\r
1201 //\r
1202 if (PcdGet64 (PcdDxeNxMemoryProtectionPolicy) == 0) {\r
1203 return EFI_SUCCESS;\r
1204 }\r
1205\r
a6a0a597
JW
1206 //\r
1207 // Don't overwrite Guard pages, which should be the first and/or last page,\r
1208 // if any.\r
1209 //\r
1210 if (IsHeapGuardEnabled ()) {\r
1211 if (IsGuardPage (Memory)) {\r
1212 Memory += EFI_PAGE_SIZE;\r
1213 Length -= EFI_PAGE_SIZE;\r
1214 if (Length == 0) {\r
1215 return EFI_SUCCESS;\r
1216 }\r
1217 }\r
1218\r
1219 if (IsGuardPage (Memory + Length - EFI_PAGE_SIZE)) {\r
1220 Length -= EFI_PAGE_SIZE;\r
1221 if (Length == 0) {\r
1222 return EFI_SUCCESS;\r
1223 }\r
1224 }\r
1225 }\r
1226\r
7eb927db
AB
1227 //\r
1228 // Update the executable permissions according to the DXE memory\r
1229 // protection policy, but only if\r
1230 // - the policy is different between the old and the new type, or\r
1231 // - this is a newly added region (OldType == EfiMaxMemoryType)\r
1232 //\r
1233 NewAttributes = GetPermissionAttributeForMemoryType (NewType);\r
1234\r
1235 if (OldType != EfiMaxMemoryType) {\r
1236 OldAttributes = GetPermissionAttributeForMemoryType (OldType);\r
1237 if (OldAttributes == NewAttributes) {\r
1238 // policy is the same between OldType and NewType\r
1239 return EFI_SUCCESS;\r
1240 }\r
1241 } else if (NewAttributes == 0) {\r
1242 // newly added region of a type that does not require protection\r
1243 return EFI_SUCCESS;\r
1244 }\r
1245\r
1246 return gCpu->SetMemoryAttributes (gCpu, Memory, Length, NewAttributes);\r
1247}\r