MdeModulePkg/Core/Dxe/Misc/MemoryProtection.c

   1 /** @file
   2   UEFI Memory Protection support.
   3
   4   If the UEFI image is page aligned, the image code section is set to read only
   5   and the image data section is set to non-executable.
   6
   7   1) This policy is applied for all UEFI image including boot service driver,
   8      runtime driver or application.
   9   2) This policy is applied only if the UEFI image meets the page alignment
  10      requirement.
  11   3) This policy is applied only if the Source UEFI image matches the
  12      PcdImageProtectionPolicy definition.
  13   4) This policy is not applied to the non-PE image region.
  14
  15   The DxeCore calls CpuArchProtocol->SetMemoryAttributes() to protect
  16   the image. If the CpuArch protocol is not installed yet, the DxeCore
  17   enqueues the protection request. Once the CpuArch is installed, the
  18   DxeCore dequeues the protection request and applies policy.
  19
  20   Once the image is unloaded, the protection is removed automatically.
  21
  22 Copyright (c) 2017 - 2018, Intel Corporation. All rights reserved.<BR>
  23 This program and the accompanying materials
  24 are licensed and made available under the terms and conditions of the BSD License
  25 which accompanies this distribution.  The full text of the license may be found at
  26 http://opensource.org/licenses/bsd-license.php
  27
  28 THE PROGRAM IS DISTRIBUTED UNDER THE BSD LICENSE ON AN "AS IS" BASIS,
  29 WITHOUT WARRANTIES OR REPRESENTATIONS OF ANY KIND, EITHER EXPRESS OR IMPLIED.
  30
  31 **/
  32
  33 #include <PiDxe.h>
  34 #include <Library/BaseLib.h>
  35 #include <Library/BaseMemoryLib.h>
  36 #include <Library/MemoryAllocationLib.h>
  37 #include <Library/UefiBootServicesTableLib.h>
  38 #include <Library/DxeServicesTableLib.h>
  39 #include <Library/DebugLib.h>
  40 #include <Library/UefiLib.h>
  41
  42 #include <Guid/EventGroup.h>
  43 #include <Guid/MemoryAttributesTable.h>
  44 #include <Guid/PropertiesTable.h>
  45
  46 #include <Protocol/FirmwareVolume2.h>
  47 #include <Protocol/SimpleFileSystem.h>
  48
  49 #include "DxeMain.h"
  50 #include "Mem/HeapGuard.h"
  51
  52 #define CACHE_ATTRIBUTE_MASK   (EFI_MEMORY_UC | EFI_MEMORY_WC | EFI_MEMORY_WT | EFI_MEMORY_WB | EFI_MEMORY_UCE | EFI_MEMORY_WP)
  53 #define MEMORY_ATTRIBUTE_MASK  (EFI_MEMORY_RP | EFI_MEMORY_XP | EFI_MEMORY_RO)
  54
  55 //
  56 // Image type definitions
  57 //
  58 #define IMAGE_UNKNOWN                         0x00000001
  59 #define IMAGE_FROM_FV                         0x00000002
  60
  61 //
  62 // Protection policy bit definition
  63 //
  64 #define DO_NOT_PROTECT                         0x00000000
  65 #define PROTECT_IF_ALIGNED_ELSE_ALLOW          0x00000001
  66
  67 #define MEMORY_TYPE_OS_RESERVED_MIN            0x80000000
  68 #define MEMORY_TYPE_OEM_RESERVED_MIN           0x70000000
  69
  70 #define PREVIOUS_MEMORY_DESCRIPTOR(MemoryDescriptor, Size) \
  71   ((EFI_MEMORY_DESCRIPTOR *)((UINT8 *)(MemoryDescriptor) - (Size)))
  72
  73 UINT32   mImageProtectionPolicy;
  74
  75 extern LIST_ENTRY         mGcdMemorySpaceMap;
  76
  77 STATIC LIST_ENTRY         mProtectedImageRecordList;
  78
  79 /**
  80   Sort code section in image record, based upon CodeSegmentBase from low to high.
  81
  82   @param  ImageRecord    image record to be sorted
  83 **/
  84 VOID
  85 SortImageRecordCodeSection (
  86   IN IMAGE_PROPERTIES_RECORD              *ImageRecord
  87   );
  88
  89 /**
  90   Check if code section in image record is valid.
  91
  92   @param  ImageRecord    image record to be checked
  93
  94   @retval TRUE  image record is valid
  95   @retval FALSE image record is invalid
  96 **/
  97 BOOLEAN
  98 IsImageRecordCodeSectionValid (
  99   IN IMAGE_PROPERTIES_RECORD              *ImageRecord
 100   );
 101
 102 /**
 103   Get the image type.
 104
 105   @param[in]    File       This is a pointer to the device path of the file that is
 106                            being dispatched.
 107
 108   @return UINT32           Image Type
 109 **/
 110 UINT32
 111 GetImageType (
 112   IN  CONST EFI_DEVICE_PATH_PROTOCOL   *File
 113   )
 114 {
 115   EFI_STATUS                        Status;
 116   EFI_HANDLE                        DeviceHandle;
 117   EFI_DEVICE_PATH_PROTOCOL          *TempDevicePath;
 118
 119   if (File == NULL) {
 120     return IMAGE_UNKNOWN;
 121   }
 122
 123   //
 124   // First check to see if File is from a Firmware Volume
 125   //
 126   DeviceHandle      = NULL;
 127   TempDevicePath = (EFI_DEVICE_PATH_PROTOCOL *) File;
 128   Status = gBS->LocateDevicePath (
 129                   &gEfiFirmwareVolume2ProtocolGuid,
 130                   &TempDevicePath,
 131                   &DeviceHandle
 132                   );
 133   if (!EFI_ERROR (Status)) {
 134     Status = gBS->OpenProtocol (
 135                     DeviceHandle,
 136                     &gEfiFirmwareVolume2ProtocolGuid,
 137                     NULL,
 138                     NULL,
 139                     NULL,
 140                     EFI_OPEN_PROTOCOL_TEST_PROTOCOL
 141                     );
 142     if (!EFI_ERROR (Status)) {
 143       return IMAGE_FROM_FV;
 144     }
 145   }
 146   return IMAGE_UNKNOWN;
 147 }
 148
 149 /**
 150   Get UEFI image protection policy based upon image type.
 151
 152   @param[in]  ImageType    The UEFI image type
 153
 154   @return UEFI image protection policy
 155 **/
 156 UINT32
 157 GetProtectionPolicyFromImageType (
 158   IN UINT32  ImageType
 159   )
 160 {
 161   if ((ImageType & mImageProtectionPolicy) == 0) {
 162     return DO_NOT_PROTECT;
 163   } else {
 164     return PROTECT_IF_ALIGNED_ELSE_ALLOW;
 165   }
 166 }
 167
 168 /**
 169   Get UEFI image protection policy based upon loaded image device path.
 170
 171   @param[in]  LoadedImage              The loaded image protocol
 172   @param[in]  LoadedImageDevicePath    The loaded image device path protocol
 173
 174   @return UEFI image protection policy
 175 **/
 176 UINT32
 177 GetUefiImageProtectionPolicy (
 178   IN EFI_LOADED_IMAGE_PROTOCOL   *LoadedImage,
 179   IN EFI_DEVICE_PATH_PROTOCOL    *LoadedImageDevicePath
 180   )
 181 {
 182   BOOLEAN     InSmm;
 183   UINT32      ImageType;
 184   UINT32      ProtectionPolicy;
 185
 186   //
 187   // Check SMM
 188   //
 189   InSmm = FALSE;
 190   if (gSmmBase2 != NULL) {
 191     gSmmBase2->InSmm (gSmmBase2, &InSmm);
 192   }
 193   if (InSmm) {
 194     return FALSE;
 195   }
 196
 197   //
 198   // Check DevicePath
 199   //
 200   if (LoadedImage == gDxeCoreLoadedImage) {
 201     ImageType = IMAGE_FROM_FV;
 202   } else {
 203     ImageType = GetImageType (LoadedImageDevicePath);
 204   }
 205   ProtectionPolicy = GetProtectionPolicyFromImageType (ImageType);
 206   return ProtectionPolicy;
 207 }
 208
 209
 210 /**
 211   Set UEFI image memory attributes.
 212
 213   @param[in]  BaseAddress            Specified start address
 214   @param[in]  Length                 Specified length
 215   @param[in]  Attributes             Specified attributes
 216 **/
 217 VOID
 218 SetUefiImageMemoryAttributes (
 219   IN UINT64   BaseAddress,
 220   IN UINT64   Length,
 221   IN UINT64   Attributes
 222   )
 223 {
 224   EFI_STATUS                       Status;
 225   EFI_GCD_MEMORY_SPACE_DESCRIPTOR  Descriptor;
 226   UINT64                           FinalAttributes;
 227
 228   Status = CoreGetMemorySpaceDescriptor(BaseAddress, &Descriptor);
 229   ASSERT_EFI_ERROR(Status);
 230
 231   FinalAttributes = (Descriptor.Attributes & CACHE_ATTRIBUTE_MASK) | (Attributes & MEMORY_ATTRIBUTE_MASK);
 232
 233   DEBUG ((DEBUG_INFO, "SetUefiImageMemoryAttributes - 0x%016lx - 0x%016lx (0x%016lx)\n", BaseAddress, Length, FinalAttributes));
 234
 235   ASSERT(gCpu != NULL);
 236   gCpu->SetMemoryAttributes (gCpu, BaseAddress, Length, FinalAttributes);
 237 }
 238
 239 /**
 240   Set UEFI image protection attributes.
 241
 242   @param[in]  ImageRecord    A UEFI image record
 243 **/
 244 VOID
 245 SetUefiImageProtectionAttributes (
 246   IN IMAGE_PROPERTIES_RECORD     *ImageRecord
 247   )
 248 {
 249   IMAGE_PROPERTIES_RECORD_CODE_SECTION      *ImageRecordCodeSection;
 250   LIST_ENTRY                                *ImageRecordCodeSectionLink;
 251   LIST_ENTRY                                *ImageRecordCodeSectionEndLink;
 252   LIST_ENTRY                                *ImageRecordCodeSectionList;
 253   UINT64                                    CurrentBase;
 254   UINT64                                    ImageEnd;
 255
 256   ImageRecordCodeSectionList = &ImageRecord->CodeSegmentList;
 257
 258   CurrentBase = ImageRecord->ImageBase;
 259   ImageEnd    = ImageRecord->ImageBase + ImageRecord->ImageSize;
 260
 261   ImageRecordCodeSectionLink = ImageRecordCodeSectionList->ForwardLink;
 262   ImageRecordCodeSectionEndLink = ImageRecordCodeSectionList;
 263   while (ImageRecordCodeSectionLink != ImageRecordCodeSectionEndLink) {
 264     ImageRecordCodeSection = CR (
 265                                ImageRecordCodeSectionLink,
 266                                IMAGE_PROPERTIES_RECORD_CODE_SECTION,
 267                                Link,
 268                                IMAGE_PROPERTIES_RECORD_CODE_SECTION_SIGNATURE
 269                                );
 270     ImageRecordCodeSectionLink = ImageRecordCodeSectionLink->ForwardLink;
 271
 272     ASSERT (CurrentBase <= ImageRecordCodeSection->CodeSegmentBase);
 273     if (CurrentBase < ImageRecordCodeSection->CodeSegmentBase) {
 274       //
 275       // DATA
 276       //
 277       SetUefiImageMemoryAttributes (
 278         CurrentBase,
 279         ImageRecordCodeSection->CodeSegmentBase - CurrentBase,
 280         EFI_MEMORY_XP
 281         );
 282     }
 283     //
 284     // CODE
 285     //
 286     SetUefiImageMemoryAttributes (
 287       ImageRecordCodeSection->CodeSegmentBase,
 288       ImageRecordCodeSection->CodeSegmentSize,
 289       EFI_MEMORY_RO
 290       );
 291     CurrentBase = ImageRecordCodeSection->CodeSegmentBase + ImageRecordCodeSection->CodeSegmentSize;
 292   }
 293   //
 294   // Last DATA
 295   //
 296   ASSERT (CurrentBase <= ImageEnd);
 297   if (CurrentBase < ImageEnd) {
 298     //
 299     // DATA
 300     //
 301     SetUefiImageMemoryAttributes (
 302       CurrentBase,
 303       ImageEnd - CurrentBase,
 304       EFI_MEMORY_XP
 305       );
 306   }
 307   return ;
 308 }
 309
 310 /**
 311   Return if the PE image section is aligned.
 312
 313   @param[in]  SectionAlignment    PE/COFF section alignment
 314   @param[in]  MemoryType          PE/COFF image memory type
 315
 316   @retval TRUE  The PE image section is aligned.
 317   @retval FALSE The PE image section is not aligned.
 318 **/
 319 BOOLEAN
 320 IsMemoryProtectionSectionAligned (
 321   IN UINT32           SectionAlignment,
 322   IN EFI_MEMORY_TYPE  MemoryType
 323   )
 324 {
 325   UINT32  PageAlignment;
 326
 327   switch (MemoryType) {
 328   case EfiRuntimeServicesCode:
 329   case EfiACPIMemoryNVS:
 330     PageAlignment = RUNTIME_PAGE_ALLOCATION_GRANULARITY;
 331     break;
 332   case EfiRuntimeServicesData:
 333   case EfiACPIReclaimMemory:
 334     ASSERT (FALSE);
 335     PageAlignment = RUNTIME_PAGE_ALLOCATION_GRANULARITY;
 336     break;
 337   case EfiBootServicesCode:
 338   case EfiLoaderCode:
 339   case EfiReservedMemoryType:
 340     PageAlignment = EFI_PAGE_SIZE;
 341     break;
 342   default:
 343     ASSERT (FALSE);
 344     PageAlignment = EFI_PAGE_SIZE;
 345     break;
 346   }
 347
 348   if ((SectionAlignment & (PageAlignment - 1)) != 0) {
 349     return FALSE;
 350   } else {
 351     return TRUE;
 352   }
 353 }
 354
 355 /**
 356   Free Image record.
 357
 358   @param[in]  ImageRecord    A UEFI image record
 359 **/
 360 VOID
 361 FreeImageRecord (
 362   IN IMAGE_PROPERTIES_RECORD              *ImageRecord
 363   )
 364 {
 365   LIST_ENTRY                           *CodeSegmentListHead;
 366   IMAGE_PROPERTIES_RECORD_CODE_SECTION *ImageRecordCodeSection;
 367
 368   CodeSegmentListHead = &ImageRecord->CodeSegmentList;
 369   while (!IsListEmpty (CodeSegmentListHead)) {
 370     ImageRecordCodeSection = CR (
 371                                CodeSegmentListHead->ForwardLink,
 372                                IMAGE_PROPERTIES_RECORD_CODE_SECTION,
 373                                Link,
 374                                IMAGE_PROPERTIES_RECORD_CODE_SECTION_SIGNATURE
 375                                );
 376     RemoveEntryList (&ImageRecordCodeSection->Link);
 377     FreePool (ImageRecordCodeSection);
 378   }
 379
 380   if (ImageRecord->Link.ForwardLink != NULL) {
 381     RemoveEntryList (&ImageRecord->Link);
 382   }
 383   FreePool (ImageRecord);
 384 }
 385
 386 /**
 387   Protect UEFI PE/COFF image.
 388
 389   @param[in]  LoadedImage              The loaded image protocol
 390   @param[in]  LoadedImageDevicePath    The loaded image device path protocol
 391 **/
 392 VOID
 393 ProtectUefiImage (
 394   IN EFI_LOADED_IMAGE_PROTOCOL   *LoadedImage,
 395   IN EFI_DEVICE_PATH_PROTOCOL    *LoadedImageDevicePath
 396   )
 397 {
 398   VOID                                 *ImageAddress;
 399   EFI_IMAGE_DOS_HEADER                 *DosHdr;
 400   UINT32                               PeCoffHeaderOffset;
 401   UINT32                               SectionAlignment;
 402   EFI_IMAGE_SECTION_HEADER             *Section;
 403   EFI_IMAGE_OPTIONAL_HEADER_PTR_UNION  Hdr;
 404   UINT8                                *Name;
 405   UINTN                                Index;
 406   IMAGE_PROPERTIES_RECORD              *ImageRecord;
 407   CHAR8                                *PdbPointer;
 408   IMAGE_PROPERTIES_RECORD_CODE_SECTION *ImageRecordCodeSection;
 409   BOOLEAN                              IsAligned;
 410   UINT32                               ProtectionPolicy;
 411
 412   DEBUG ((DEBUG_INFO, "ProtectUefiImageCommon - 0x%x\n", LoadedImage));
 413   DEBUG ((DEBUG_INFO, "  - 0x%016lx - 0x%016lx\n", (EFI_PHYSICAL_ADDRESS)(UINTN)LoadedImage->ImageBase, LoadedImage->ImageSize));
 414
 415   if (gCpu == NULL) {
 416     return ;
 417   }
 418
 419   ProtectionPolicy = GetUefiImageProtectionPolicy (LoadedImage, LoadedImageDevicePath);
 420   switch (ProtectionPolicy) {
 421   case DO_NOT_PROTECT:
 422     return ;
 423   case PROTECT_IF_ALIGNED_ELSE_ALLOW:
 424     break;
 425   default:
 426     ASSERT(FALSE);
 427     return ;
 428   }
 429
 430   ImageRecord = AllocateZeroPool (sizeof(*ImageRecord));
 431   if (ImageRecord == NULL) {
 432     return ;
 433   }
 434   ImageRecord->Signature = IMAGE_PROPERTIES_RECORD_SIGNATURE;
 435
 436   //
 437   // Step 1: record whole region
 438   //
 439   ImageRecord->ImageBase = (EFI_PHYSICAL_ADDRESS)(UINTN)LoadedImage->ImageBase;
 440   ImageRecord->ImageSize = LoadedImage->ImageSize;
 441
 442   ImageAddress = LoadedImage->ImageBase;
 443
 444   PdbPointer = PeCoffLoaderGetPdbPointer ((VOID*) (UINTN) ImageAddress);
 445   if (PdbPointer != NULL) {
 446     DEBUG ((DEBUG_VERBOSE, "  Image - %a\n", PdbPointer));
 447   }
 448
 449   //
 450   // Check PE/COFF image
 451   //
 452   DosHdr = (EFI_IMAGE_DOS_HEADER *) (UINTN) ImageAddress;
 453   PeCoffHeaderOffset = 0;
 454   if (DosHdr->e_magic == EFI_IMAGE_DOS_SIGNATURE) {
 455     PeCoffHeaderOffset = DosHdr->e_lfanew;
 456   }
 457
 458   Hdr.Pe32 = (EFI_IMAGE_NT_HEADERS32 *)((UINT8 *) (UINTN) ImageAddress + PeCoffHeaderOffset);
 459   if (Hdr.Pe32->Signature != EFI_IMAGE_NT_SIGNATURE) {
 460     DEBUG ((DEBUG_VERBOSE, "Hdr.Pe32->Signature invalid - 0x%x\n", Hdr.Pe32->Signature));
 461     // It might be image in SMM.
 462     goto Finish;
 463   }
 464
 465   //
 466   // Get SectionAlignment
 467   //
 468   if (Hdr.Pe32->OptionalHeader.Magic == EFI_IMAGE_NT_OPTIONAL_HDR32_MAGIC) {
 469     SectionAlignment  = Hdr.Pe32->OptionalHeader.SectionAlignment;
 470   } else {
 471     SectionAlignment  = Hdr.Pe32Plus->OptionalHeader.SectionAlignment;
 472   }
 473
 474   IsAligned = IsMemoryProtectionSectionAligned (SectionAlignment, LoadedImage->ImageCodeType);
 475   if (!IsAligned) {
 476     DEBUG ((DEBUG_VERBOSE, "!!!!!!!!  ProtectUefiImageCommon - Section Alignment(0x%x) is incorrect  !!!!!!!!\n",
 477       SectionAlignment));
 478     PdbPointer = PeCoffLoaderGetPdbPointer ((VOID*) (UINTN) ImageAddress);
 479     if (PdbPointer != NULL) {
 480       DEBUG ((DEBUG_VERBOSE, "!!!!!!!!  Image - %a  !!!!!!!!\n", PdbPointer));
 481     }
 482     goto Finish;
 483   }
 484
 485   Section = (EFI_IMAGE_SECTION_HEADER *) (
 486                (UINT8 *) (UINTN) ImageAddress +
 487                PeCoffHeaderOffset +
 488                sizeof(UINT32) +
 489                sizeof(EFI_IMAGE_FILE_HEADER) +
 490                Hdr.Pe32->FileHeader.SizeOfOptionalHeader
 491                );
 492   ImageRecord->CodeSegmentCount = 0;
 493   InitializeListHead (&ImageRecord->CodeSegmentList);
 494   for (Index = 0; Index < Hdr.Pe32->FileHeader.NumberOfSections; Index++) {
 495     Name = Section[Index].Name;
 496     DEBUG ((
 497       DEBUG_VERBOSE,
 498       "  Section - '%c%c%c%c%c%c%c%c'\n",
 499       Name[0],
 500       Name[1],
 501       Name[2],
 502       Name[3],
 503       Name[4],
 504       Name[5],
 505       Name[6],
 506       Name[7]
 507       ));
 508
 509     //
 510     // Instead of assuming that a PE/COFF section of type EFI_IMAGE_SCN_CNT_CODE
 511     // can always be mapped read-only, classify a section as a code section only
 512     // if it has the executable attribute set and the writable attribute cleared.
 513     //
 514     // This adheres more closely to the PE/COFF spec, and avoids issues with
 515     // Linux OS loaders that may consist of a single read/write/execute section.
 516     //
 517     if ((Section[Index].Characteristics & (EFI_IMAGE_SCN_MEM_WRITE | EFI_IMAGE_SCN_MEM_EXECUTE)) == EFI_IMAGE_SCN_MEM_EXECUTE) {
 518       DEBUG ((DEBUG_VERBOSE, "  VirtualSize          - 0x%08x\n", Section[Index].Misc.VirtualSize));
 519       DEBUG ((DEBUG_VERBOSE, "  VirtualAddress       - 0x%08x\n", Section[Index].VirtualAddress));
 520       DEBUG ((DEBUG_VERBOSE, "  SizeOfRawData        - 0x%08x\n", Section[Index].SizeOfRawData));
 521       DEBUG ((DEBUG_VERBOSE, "  PointerToRawData     - 0x%08x\n", Section[Index].PointerToRawData));
 522       DEBUG ((DEBUG_VERBOSE, "  PointerToRelocations - 0x%08x\n", Section[Index].PointerToRelocations));
 523       DEBUG ((DEBUG_VERBOSE, "  PointerToLinenumbers - 0x%08x\n", Section[Index].PointerToLinenumbers));
 524       DEBUG ((DEBUG_VERBOSE, "  NumberOfRelocations  - 0x%08x\n", Section[Index].NumberOfRelocations));
 525       DEBUG ((DEBUG_VERBOSE, "  NumberOfLinenumbers  - 0x%08x\n", Section[Index].NumberOfLinenumbers));
 526       DEBUG ((DEBUG_VERBOSE, "  Characteristics      - 0x%08x\n", Section[Index].Characteristics));
 527
 528       //
 529       // Step 2: record code section
 530       //
 531       ImageRecordCodeSection = AllocatePool (sizeof(*ImageRecordCodeSection));
 532       if (ImageRecordCodeSection == NULL) {
 533         return ;
 534       }
 535       ImageRecordCodeSection->Signature = IMAGE_PROPERTIES_RECORD_CODE_SECTION_SIGNATURE;
 536
 537       ImageRecordCodeSection->CodeSegmentBase = (UINTN)ImageAddress + Section[Index].VirtualAddress;
 538       ImageRecordCodeSection->CodeSegmentSize = ALIGN_VALUE(Section[Index].SizeOfRawData, SectionAlignment);
 539
 540       DEBUG ((DEBUG_VERBOSE, "ImageCode: 0x%016lx - 0x%016lx\n", ImageRecordCodeSection->CodeSegmentBase, ImageRecordCodeSection->CodeSegmentSize));
 541
 542       InsertTailList (&ImageRecord->CodeSegmentList, &ImageRecordCodeSection->Link);
 543       ImageRecord->CodeSegmentCount++;
 544     }
 545   }
 546
 547   if (ImageRecord->CodeSegmentCount == 0) {
 548     //
 549     // If a UEFI executable consists of a single read+write+exec PE/COFF
 550     // section, that isn't actually an error. The image can be launched
 551     // alright, only image protection cannot be applied to it fully.
 552     //
 553     // One example that elicits this is (some) Linux kernels (with the EFI stub
 554     // of course).
 555     //
 556     DEBUG ((DEBUG_WARN, "!!!!!!!!  ProtectUefiImageCommon - CodeSegmentCount is 0  !!!!!!!!\n"));
 557     PdbPointer = PeCoffLoaderGetPdbPointer ((VOID*) (UINTN) ImageAddress);
 558     if (PdbPointer != NULL) {
 559       DEBUG ((DEBUG_WARN, "!!!!!!!!  Image - %a  !!!!!!!!\n", PdbPointer));
 560     }
 561     goto Finish;
 562   }
 563
 564   //
 565   // Final
 566   //
 567   SortImageRecordCodeSection (ImageRecord);
 568   //
 569   // Check overlap all section in ImageBase/Size
 570   //
 571   if (!IsImageRecordCodeSectionValid (ImageRecord)) {
 572     DEBUG ((DEBUG_ERROR, "IsImageRecordCodeSectionValid - FAIL\n"));
 573     goto Finish;
 574   }
 575
 576   //
 577   // Round up the ImageSize, some CPU arch may return EFI_UNSUPPORTED if ImageSize is not aligned.
 578   // Given that the loader always allocates full pages, we know the space after the image is not used.
 579   //
 580   ImageRecord->ImageSize = ALIGN_VALUE(LoadedImage->ImageSize, EFI_PAGE_SIZE);
 581
 582   //
 583   // CPU ARCH present. Update memory attribute directly.
 584   //
 585   SetUefiImageProtectionAttributes (ImageRecord);
 586
 587   //
 588   // Record the image record in the list so we can undo the protections later
 589   //
 590   InsertTailList (&mProtectedImageRecordList, &ImageRecord->Link);
 591
 592 Finish:
 593   return ;
 594 }
 595
 596 /**
 597   Unprotect UEFI image.
 598
 599   @param[in]  LoadedImage              The loaded image protocol
 600   @param[in]  LoadedImageDevicePath    The loaded image device path protocol
 601 **/
 602 VOID
 603 UnprotectUefiImage (
 604   IN EFI_LOADED_IMAGE_PROTOCOL   *LoadedImage,
 605   IN EFI_DEVICE_PATH_PROTOCOL    *LoadedImageDevicePath
 606   )
 607 {
 608   IMAGE_PROPERTIES_RECORD    *ImageRecord;
 609   LIST_ENTRY                 *ImageRecordLink;
 610
 611   if (PcdGet32(PcdImageProtectionPolicy) != 0) {
 612     for (ImageRecordLink = mProtectedImageRecordList.ForwardLink;
 613          ImageRecordLink != &mProtectedImageRecordList;
 614          ImageRecordLink = ImageRecordLink->ForwardLink) {
 615       ImageRecord = CR (
 616                       ImageRecordLink,
 617                       IMAGE_PROPERTIES_RECORD,
 618                       Link,
 619                       IMAGE_PROPERTIES_RECORD_SIGNATURE
 620                       );
 621
 622       if (ImageRecord->ImageBase == (EFI_PHYSICAL_ADDRESS)(UINTN)LoadedImage->ImageBase) {
 623         SetUefiImageMemoryAttributes (ImageRecord->ImageBase,
 624                                       ImageRecord->ImageSize,
 625                                       0);
 626         FreeImageRecord (ImageRecord);
 627         return;
 628       }
 629     }
 630   }
 631 }
 632
 633 /**
 634   Return the EFI memory permission attribute associated with memory
 635   type 'MemoryType' under the configured DXE memory protection policy.
 636
 637   @param MemoryType       Memory type.
 638 **/
 639 STATIC
 640 UINT64
 641 GetPermissionAttributeForMemoryType (
 642   IN EFI_MEMORY_TYPE    MemoryType
 643   )
 644 {
 645   UINT64 TestBit;
 646
 647   if ((UINT32)MemoryType >= MEMORY_TYPE_OS_RESERVED_MIN) {
 648     TestBit = BIT63;
 649   } else if ((UINT32)MemoryType >= MEMORY_TYPE_OEM_RESERVED_MIN) {
 650     TestBit = BIT62;
 651   } else {
 652     TestBit = LShiftU64 (1, MemoryType);
 653   }
 654
 655   if ((PcdGet64 (PcdDxeNxMemoryProtectionPolicy) & TestBit) != 0) {
 656     return EFI_MEMORY_XP;
 657   } else {
 658     return 0;
 659   }
 660 }
 661
 662 /**
 663   Sort memory map entries based upon PhysicalStart, from low to high.
 664
 665   @param  MemoryMap              A pointer to the buffer in which firmware places
 666                                  the current memory map.
 667   @param  MemoryMapSize          Size, in bytes, of the MemoryMap buffer.
 668   @param  DescriptorSize         Size, in bytes, of an individual EFI_MEMORY_DESCRIPTOR.
 669 **/
 670 STATIC
 671 VOID
 672 SortMemoryMap (
 673   IN OUT EFI_MEMORY_DESCRIPTOR  *MemoryMap,
 674   IN UINTN                      MemoryMapSize,
 675   IN UINTN                      DescriptorSize
 676   )
 677 {
 678   EFI_MEMORY_DESCRIPTOR       *MemoryMapEntry;
 679   EFI_MEMORY_DESCRIPTOR       *NextMemoryMapEntry;
 680   EFI_MEMORY_DESCRIPTOR       *MemoryMapEnd;
 681   EFI_MEMORY_DESCRIPTOR       TempMemoryMap;
 682
 683   MemoryMapEntry = MemoryMap;
 684   NextMemoryMapEntry = NEXT_MEMORY_DESCRIPTOR (MemoryMapEntry, DescriptorSize);
 685   MemoryMapEnd = (EFI_MEMORY_DESCRIPTOR *) ((UINT8 *) MemoryMap + MemoryMapSize);
 686   while (MemoryMapEntry < MemoryMapEnd) {
 687     while (NextMemoryMapEntry < MemoryMapEnd) {
 688       if (MemoryMapEntry->PhysicalStart > NextMemoryMapEntry->PhysicalStart) {
 689         CopyMem (&TempMemoryMap, MemoryMapEntry, sizeof(EFI_MEMORY_DESCRIPTOR));
 690         CopyMem (MemoryMapEntry, NextMemoryMapEntry, sizeof(EFI_MEMORY_DESCRIPTOR));
 691         CopyMem (NextMemoryMapEntry, &TempMemoryMap, sizeof(EFI_MEMORY_DESCRIPTOR));
 692       }
 693
 694       NextMemoryMapEntry = NEXT_MEMORY_DESCRIPTOR (NextMemoryMapEntry, DescriptorSize);
 695     }
 696
 697     MemoryMapEntry      = NEXT_MEMORY_DESCRIPTOR (MemoryMapEntry, DescriptorSize);
 698     NextMemoryMapEntry  = NEXT_MEMORY_DESCRIPTOR (MemoryMapEntry, DescriptorSize);
 699   }
 700 }
 701
 702 /**
 703   Merge adjacent memory map entries if they use the same memory protection policy
 704
 705   @param[in, out]  MemoryMap              A pointer to the buffer in which firmware places
 706                                           the current memory map.
 707   @param[in, out]  MemoryMapSize          A pointer to the size, in bytes, of the
 708                                           MemoryMap buffer. On input, this is the size of
 709                                           the current memory map.  On output,
 710                                           it is the size of new memory map after merge.
 711   @param[in]       DescriptorSize         Size, in bytes, of an individual EFI_MEMORY_DESCRIPTOR.
 712 **/
 713 STATIC
 714 VOID
 715 MergeMemoryMapForProtectionPolicy (
 716   IN OUT EFI_MEMORY_DESCRIPTOR  *MemoryMap,
 717   IN OUT UINTN                  *MemoryMapSize,
 718   IN UINTN                      DescriptorSize
 719   )
 720 {
 721   EFI_MEMORY_DESCRIPTOR       *MemoryMapEntry;
 722   EFI_MEMORY_DESCRIPTOR       *MemoryMapEnd;
 723   UINT64                      MemoryBlockLength;
 724   EFI_MEMORY_DESCRIPTOR       *NewMemoryMapEntry;
 725   EFI_MEMORY_DESCRIPTOR       *NextMemoryMapEntry;
 726   UINT64                      Attributes;
 727
 728   SortMemoryMap (MemoryMap, *MemoryMapSize, DescriptorSize);
 729
 730   MemoryMapEntry = MemoryMap;
 731   NewMemoryMapEntry = MemoryMap;
 732   MemoryMapEnd = (EFI_MEMORY_DESCRIPTOR *) ((UINT8 *) MemoryMap + *MemoryMapSize);
 733   while ((UINTN)MemoryMapEntry < (UINTN)MemoryMapEnd) {
 734     CopyMem (NewMemoryMapEntry, MemoryMapEntry, sizeof(EFI_MEMORY_DESCRIPTOR));
 735     NextMemoryMapEntry = NEXT_MEMORY_DESCRIPTOR (MemoryMapEntry, DescriptorSize);
 736
 737     do {
 738       MemoryBlockLength = (UINT64) (EFI_PAGES_TO_SIZE((UINTN)MemoryMapEntry->NumberOfPages));
 739       Attributes = GetPermissionAttributeForMemoryType (MemoryMapEntry->Type);
 740
 741       if (((UINTN)NextMemoryMapEntry < (UINTN)MemoryMapEnd) &&
 742           Attributes == GetPermissionAttributeForMemoryType (NextMemoryMapEntry->Type) &&
 743           ((MemoryMapEntry->PhysicalStart + MemoryBlockLength) == NextMemoryMapEntry->PhysicalStart)) {
 744         MemoryMapEntry->NumberOfPages += NextMemoryMapEntry->NumberOfPages;
 745         if (NewMemoryMapEntry != MemoryMapEntry) {
 746           NewMemoryMapEntry->NumberOfPages += NextMemoryMapEntry->NumberOfPages;
 747         }
 748
 749         NextMemoryMapEntry = NEXT_MEMORY_DESCRIPTOR (NextMemoryMapEntry, DescriptorSize);
 750         continue;
 751       } else {
 752         MemoryMapEntry = PREVIOUS_MEMORY_DESCRIPTOR (NextMemoryMapEntry, DescriptorSize);
 753         break;
 754       }
 755     } while (TRUE);
 756
 757     MemoryMapEntry = NEXT_MEMORY_DESCRIPTOR (MemoryMapEntry, DescriptorSize);
 758     NewMemoryMapEntry = NEXT_MEMORY_DESCRIPTOR (NewMemoryMapEntry, DescriptorSize);
 759   }
 760
 761   *MemoryMapSize = (UINTN)NewMemoryMapEntry - (UINTN)MemoryMap;
 762
 763   return ;
 764 }
 765
 766
 767 /**
 768   Remove exec permissions from all regions whose type is identified by
 769   PcdDxeNxMemoryProtectionPolicy.
 770 **/
 771 STATIC
 772 VOID
 773 InitializeDxeNxMemoryProtectionPolicy (
 774   VOID
 775   )
 776 {
 777   UINTN                             MemoryMapSize;
 778   UINTN                             MapKey;
 779   UINTN                             DescriptorSize;
 780   UINT32                            DescriptorVersion;
 781   EFI_MEMORY_DESCRIPTOR             *MemoryMap;
 782   EFI_MEMORY_DESCRIPTOR             *MemoryMapEntry;
 783   EFI_MEMORY_DESCRIPTOR             *MemoryMapEnd;
 784   EFI_STATUS                        Status;
 785   UINT64                            Attributes;
 786   LIST_ENTRY                        *Link;
 787   EFI_GCD_MAP_ENTRY                 *Entry;
 788   EFI_PEI_HOB_POINTERS              Hob;
 789   EFI_HOB_MEMORY_ALLOCATION         *MemoryHob;
 790   EFI_PHYSICAL_ADDRESS              StackBase;
 791
 792   //
 793   // Get the EFI memory map.
 794   //
 795   MemoryMapSize = 0;
 796   MemoryMap     = NULL;
 797
 798   Status = gBS->GetMemoryMap (
 799                   &MemoryMapSize,
 800                   MemoryMap,
 801                   &MapKey,
 802                   &DescriptorSize,
 803                   &DescriptorVersion
 804                   );
 805   ASSERT (Status == EFI_BUFFER_TOO_SMALL);
 806   do {
 807     MemoryMap = (EFI_MEMORY_DESCRIPTOR *) AllocatePool (MemoryMapSize);
 808     ASSERT (MemoryMap != NULL);
 809     Status = gBS->GetMemoryMap (
 810                     &MemoryMapSize,
 811                     MemoryMap,
 812                     &MapKey,
 813                     &DescriptorSize,
 814                     &DescriptorVersion
 815                     );
 816     if (EFI_ERROR (Status)) {
 817       FreePool (MemoryMap);
 818     }
 819   } while (Status == EFI_BUFFER_TOO_SMALL);
 820   ASSERT_EFI_ERROR (Status);
 821
 822   StackBase = 0;
 823   if (PcdGetBool (PcdCpuStackGuard)) {
 824     //
 825     // Get the base of stack from Hob.
 826     //
 827     Hob.Raw = GetHobList ();
 828     while ((Hob.Raw = GetNextHob (EFI_HOB_TYPE_MEMORY_ALLOCATION, Hob.Raw)) != NULL) {
 829       MemoryHob = Hob.MemoryAllocation;
 830       if (CompareGuid(&gEfiHobMemoryAllocStackGuid, &MemoryHob->AllocDescriptor.Name)) {
 831         DEBUG ((
 832           DEBUG_INFO,
 833           "%a: StackBase = 0x%016lx  StackSize = 0x%016lx\n",
 834           __FUNCTION__,
 835           MemoryHob->AllocDescriptor.MemoryBaseAddress,
 836           MemoryHob->AllocDescriptor.MemoryLength
 837           ));
 838
 839         StackBase = MemoryHob->AllocDescriptor.MemoryBaseAddress;
 840         //
 841         // Ensure the base of the stack is page-size aligned.
 842         //
 843         ASSERT ((StackBase & EFI_PAGE_MASK) == 0);
 844         break;
 845       }
 846       Hob.Raw = GET_NEXT_HOB (Hob);
 847     }
 848
 849     //
 850     // Ensure the base of stack can be found from Hob when stack guard is
 851     // enabled.
 852     //
 853     ASSERT (StackBase != 0);
 854   }
 855
 856   DEBUG ((
 857     DEBUG_INFO,
 858     "%a: applying strict permissions to active memory regions\n",
 859     __FUNCTION__
 860     ));
 861
 862   MergeMemoryMapForProtectionPolicy (MemoryMap, &MemoryMapSize, DescriptorSize);
 863
 864   MemoryMapEntry = MemoryMap;
 865   MemoryMapEnd = (EFI_MEMORY_DESCRIPTOR *) ((UINT8 *) MemoryMap + MemoryMapSize);
 866   while ((UINTN) MemoryMapEntry < (UINTN) MemoryMapEnd) {
 867
 868     Attributes = GetPermissionAttributeForMemoryType (MemoryMapEntry->Type);
 869     if (Attributes != 0) {
 870       SetUefiImageMemoryAttributes (
 871         MemoryMapEntry->PhysicalStart,
 872         LShiftU64 (MemoryMapEntry->NumberOfPages, EFI_PAGE_SHIFT),
 873         Attributes);
 874
 875       //
 876       // Add EFI_MEMORY_RP attribute for page 0 if NULL pointer detection is
 877       // enabled.
 878       //
 879       if (MemoryMapEntry->PhysicalStart == 0 &&
 880           PcdGet8 (PcdNullPointerDetectionPropertyMask) != 0) {
 881
 882         ASSERT (MemoryMapEntry->NumberOfPages > 0);
 883         SetUefiImageMemoryAttributes (
 884           0,
 885           EFI_PAGES_TO_SIZE (1),
 886           EFI_MEMORY_RP | Attributes);
 887       }
 888
 889       //
 890       // Add EFI_MEMORY_RP attribute for the first page of the stack if stack
 891       // guard is enabled.
 892       //
 893       if (StackBase != 0 &&
 894           (StackBase >= MemoryMapEntry->PhysicalStart &&
 895            StackBase <  MemoryMapEntry->PhysicalStart +
 896                         LShiftU64 (MemoryMapEntry->NumberOfPages, EFI_PAGE_SHIFT)) &&
 897           PcdGetBool (PcdCpuStackGuard)) {
 898
 899         SetUefiImageMemoryAttributes (
 900           StackBase,
 901           EFI_PAGES_TO_SIZE (1),
 902           EFI_MEMORY_RP | Attributes);
 903       }
 904
 905     }
 906     MemoryMapEntry = NEXT_MEMORY_DESCRIPTOR (MemoryMapEntry, DescriptorSize);
 907   }
 908   FreePool (MemoryMap);
 909
 910   //
 911   // Apply the policy for RAM regions that we know are present and
 912   // accessible, but have not been added to the UEFI memory map (yet).
 913   //
 914   if (GetPermissionAttributeForMemoryType (EfiConventionalMemory) != 0) {
 915     DEBUG ((
 916       DEBUG_INFO,
 917       "%a: applying strict permissions to inactive memory regions\n",
 918       __FUNCTION__
 919       ));
 920
 921     CoreAcquireGcdMemoryLock ();
 922
 923     Link = mGcdMemorySpaceMap.ForwardLink;
 924     while (Link != &mGcdMemorySpaceMap) {
 925
 926       Entry = CR (Link, EFI_GCD_MAP_ENTRY, Link, EFI_GCD_MAP_SIGNATURE);
 927
 928       if (Entry->GcdMemoryType == EfiGcdMemoryTypeReserved &&
 929           Entry->EndAddress < MAX_ADDRESS &&
 930           (Entry->Capabilities & (EFI_MEMORY_PRESENT | EFI_MEMORY_INITIALIZED | EFI_MEMORY_TESTED)) ==
 931             (EFI_MEMORY_PRESENT | EFI_MEMORY_INITIALIZED)) {
 932
 933         Attributes = GetPermissionAttributeForMemoryType (EfiConventionalMemory) |
 934                      (Entry->Attributes & CACHE_ATTRIBUTE_MASK);
 935
 936         DEBUG ((DEBUG_INFO,
 937           "Untested GCD memory space region: - 0x%016lx - 0x%016lx (0x%016lx)\n",
 938           Entry->BaseAddress, Entry->EndAddress - Entry->BaseAddress + 1,
 939           Attributes));
 940
 941         ASSERT(gCpu != NULL);
 942         gCpu->SetMemoryAttributes (gCpu, Entry->BaseAddress,
 943           Entry->EndAddress - Entry->BaseAddress + 1, Attributes);
 944       }
 945
 946       Link = Link->ForwardLink;
 947     }
 948     CoreReleaseGcdMemoryLock ();
 949   }
 950 }
 951
 952
 953 /**
 954   A notification for CPU_ARCH protocol.
 955
 956   @param[in]  Event                 Event whose notification function is being invoked.
 957   @param[in]  Context               Pointer to the notification function's context,
 958                                     which is implementation-dependent.
 959
 960 **/
 961 VOID
 962 EFIAPI
 963 MemoryProtectionCpuArchProtocolNotify (
 964   IN EFI_EVENT                Event,
 965   IN VOID                     *Context
 966   )
 967 {
 968   EFI_STATUS                  Status;
 969   EFI_LOADED_IMAGE_PROTOCOL   *LoadedImage;
 970   EFI_DEVICE_PATH_PROTOCOL    *LoadedImageDevicePath;
 971   UINTN                       NoHandles;
 972   EFI_HANDLE                  *HandleBuffer;
 973   UINTN                       Index;
 974
 975   DEBUG ((DEBUG_INFO, "MemoryProtectionCpuArchProtocolNotify:\n"));
 976   Status = CoreLocateProtocol (&gEfiCpuArchProtocolGuid, NULL, (VOID **)&gCpu);
 977   if (EFI_ERROR (Status)) {
 978     return;
 979   }
 980
 981   //
 982   // Apply the memory protection policy on non-BScode/RTcode regions.
 983   //
 984   if (PcdGet64 (PcdDxeNxMemoryProtectionPolicy) != 0) {
 985     InitializeDxeNxMemoryProtectionPolicy ();
 986   }
 987
 988   //
 989   // Call notify function meant for Heap Guard.
 990   //
 991   HeapGuardCpuArchProtocolNotify ();
 992
 993   if (mImageProtectionPolicy == 0) {
 994     return;
 995   }
 996
 997   Status = gBS->LocateHandleBuffer (
 998                   ByProtocol,
 999                   &gEfiLoadedImageProtocolGuid,
1000                   NULL,
1001                   &NoHandles,
1002                   &HandleBuffer
1003                   );
1004   if (EFI_ERROR (Status) && (NoHandles == 0)) {
1005     return ;
1006   }
1007
1008   for (Index = 0; Index < NoHandles; Index++) {
1009     Status = gBS->HandleProtocol (
1010                     HandleBuffer[Index],
1011                     &gEfiLoadedImageProtocolGuid,
1012                     (VOID **)&LoadedImage
1013                     );
1014     if (EFI_ERROR(Status)) {
1015       continue;
1016     }
1017     Status = gBS->HandleProtocol (
1018                     HandleBuffer[Index],
1019                     &gEfiLoadedImageDevicePathProtocolGuid,
1020                     (VOID **)&LoadedImageDevicePath
1021                     );
1022     if (EFI_ERROR(Status)) {
1023       LoadedImageDevicePath = NULL;
1024     }
1025
1026     ProtectUefiImage (LoadedImage, LoadedImageDevicePath);
1027   }
1028
1029   CoreCloseEvent (Event);
1030   return;
1031 }
1032
1033 /**
1034   ExitBootServices Callback function for memory protection.
1035 **/
1036 VOID
1037 MemoryProtectionExitBootServicesCallback (
1038   VOID
1039   )
1040 {
1041   EFI_RUNTIME_IMAGE_ENTRY       *RuntimeImage;
1042   LIST_ENTRY                    *Link;
1043
1044   //
1045   // We need remove the RT protection, because RT relocation need write code segment
1046   // at SetVirtualAddressMap(). We cannot assume OS/Loader has taken over page table at that time.
1047   //
1048   // Firmware does not own page tables after ExitBootServices(), so the OS would
1049   // have to relax protection of RT code pages across SetVirtualAddressMap(), or
1050   // delay setting protections on RT code pages until after SetVirtualAddressMap().
1051   // OS may set protection on RT based upon EFI_MEMORY_ATTRIBUTES_TABLE later.
1052   //
1053   if (mImageProtectionPolicy != 0) {
1054     for (Link = gRuntime->ImageHead.ForwardLink; Link != &gRuntime->ImageHead; Link = Link->ForwardLink) {
1055       RuntimeImage = BASE_CR (Link, EFI_RUNTIME_IMAGE_ENTRY, Link);
1056       SetUefiImageMemoryAttributes ((UINT64)(UINTN)RuntimeImage->ImageBase, ALIGN_VALUE(RuntimeImage->ImageSize, EFI_PAGE_SIZE), 0);
1057     }
1058   }
1059 }
1060
1061 /**
1062   Disable NULL pointer detection after EndOfDxe. This is a workaround resort in
1063   order to skip unfixable NULL pointer access issues detected in OptionROM or
1064   boot loaders.
1065
1066   @param[in]  Event     The Event this notify function registered to.
1067   @param[in]  Context   Pointer to the context data registered to the Event.
1068 **/
1069 VOID
1070 EFIAPI
1071 DisableNullDetectionAtTheEndOfDxe (
1072   EFI_EVENT                               Event,
1073   VOID                                    *Context
1074   )
1075 {
1076   EFI_STATUS                        Status;
1077   EFI_GCD_MEMORY_SPACE_DESCRIPTOR   Desc;
1078
1079   DEBUG ((DEBUG_INFO, "DisableNullDetectionAtTheEndOfDxe(): start\r\n"));
1080   //
1081   // Disable NULL pointer detection by enabling first 4K page
1082   //
1083   Status = CoreGetMemorySpaceDescriptor (0, &Desc);
1084   ASSERT_EFI_ERROR (Status);
1085
1086   if ((Desc.Capabilities & EFI_MEMORY_RP) == 0) {
1087     Status = CoreSetMemorySpaceCapabilities (
1088               0,
1089               EFI_PAGE_SIZE,
1090               Desc.Capabilities | EFI_MEMORY_RP
1091               );
1092     ASSERT_EFI_ERROR (Status);
1093   }
1094
1095   Status = CoreSetMemorySpaceAttributes (
1096             0,
1097             EFI_PAGE_SIZE,
1098             Desc.Attributes & ~EFI_MEMORY_RP
1099             );
1100   ASSERT_EFI_ERROR (Status);
1101
1102   CoreCloseEvent (Event);
1103   DEBUG ((DEBUG_INFO, "DisableNullDetectionAtTheEndOfDxe(): end\r\n"));
1104
1105   return;
1106 }
1107
1108 /**
1109   Initialize Memory Protection support.
1110 **/
1111 VOID
1112 EFIAPI
1113 CoreInitializeMemoryProtection (
1114   VOID
1115   )
1116 {
1117   EFI_STATUS  Status;
1118   EFI_EVENT   Event;
1119   EFI_EVENT   EndOfDxeEvent;
1120   VOID        *Registration;
1121
1122   mImageProtectionPolicy = PcdGet32(PcdImageProtectionPolicy);
1123
1124   InitializeListHead (&mProtectedImageRecordList);
1125
1126   //
1127   // Sanity check the PcdDxeNxMemoryProtectionPolicy setting:
1128   // - code regions should have no EFI_MEMORY_XP attribute
1129   // - EfiConventionalMemory and EfiBootServicesData should use the
1130   //   same attribute
1131   //
1132   ASSERT ((GetPermissionAttributeForMemoryType (EfiBootServicesCode) & EFI_MEMORY_XP) == 0);
1133   ASSERT ((GetPermissionAttributeForMemoryType (EfiRuntimeServicesCode) & EFI_MEMORY_XP) == 0);
1134   ASSERT ((GetPermissionAttributeForMemoryType (EfiLoaderCode) & EFI_MEMORY_XP) == 0);
1135   ASSERT (GetPermissionAttributeForMemoryType (EfiBootServicesData) ==
1136           GetPermissionAttributeForMemoryType (EfiConventionalMemory));
1137
1138   if (mImageProtectionPolicy != 0 || PcdGet64 (PcdDxeNxMemoryProtectionPolicy) != 0) {
1139     Status = CoreCreateEvent (
1140                EVT_NOTIFY_SIGNAL,
1141                TPL_CALLBACK,
1142                MemoryProtectionCpuArchProtocolNotify,
1143                NULL,
1144                &Event
1145                );
1146     ASSERT_EFI_ERROR(Status);
1147
1148     //
1149     // Register for protocol notifactions on this event
1150     //
1151     Status = CoreRegisterProtocolNotify (
1152                &gEfiCpuArchProtocolGuid,
1153                Event,
1154                &Registration
1155                );
1156     ASSERT_EFI_ERROR(Status);
1157   }
1158
1159   //
1160   // Register a callback to disable NULL pointer detection at EndOfDxe
1161   //
1162   if ((PcdGet8 (PcdNullPointerDetectionPropertyMask) & (BIT0|BIT7))
1163        == (BIT0|BIT7)) {
1164     Status = CoreCreateEventEx (
1165                     EVT_NOTIFY_SIGNAL,
1166                     TPL_NOTIFY,
1167                     DisableNullDetectionAtTheEndOfDxe,
1168                     NULL,
1169                     &gEfiEndOfDxeEventGroupGuid,
1170                     &EndOfDxeEvent
1171                     );
1172     ASSERT_EFI_ERROR (Status);
1173   }
1174
1175   return ;
1176 }
1177
1178 /**
1179   Returns whether we are currently executing in SMM mode.
1180 **/
1181 STATIC
1182 BOOLEAN
1183 IsInSmm (
1184   VOID
1185   )
1186 {
1187   BOOLEAN     InSmm;
1188
1189   InSmm = FALSE;
1190   if (gSmmBase2 != NULL) {
1191     gSmmBase2->InSmm (gSmmBase2, &InSmm);
1192   }
1193   return InSmm;
1194 }
1195
1196 /**
1197   Manage memory permission attributes on a memory range, according to the
1198   configured DXE memory protection policy.
1199
1200   @param  OldType           The old memory type of the range
1201   @param  NewType           The new memory type of the range
1202   @param  Memory            The base address of the range
1203   @param  Length            The size of the range (in bytes)
1204
1205   @return EFI_SUCCESS       If we are executing in SMM mode. No permission attributes
1206                             are updated in this case
1207   @return EFI_SUCCESS       If the the CPU arch protocol is not installed yet
1208   @return EFI_SUCCESS       If no DXE memory protection policy has been configured
1209   @return EFI_SUCCESS       If OldType and NewType use the same permission attributes
1210   @return other             Return value of gCpu->SetMemoryAttributes()
1211
1212 **/
1213 EFI_STATUS
1214 EFIAPI
1215 ApplyMemoryProtectionPolicy (
1216   IN  EFI_MEMORY_TYPE       OldType,
1217   IN  EFI_MEMORY_TYPE       NewType,
1218   IN  EFI_PHYSICAL_ADDRESS  Memory,
1219   IN  UINT64                Length
1220   )
1221 {
1222   UINT64  OldAttributes;
1223   UINT64  NewAttributes;
1224
1225   //
1226   // The policy configured in PcdDxeNxMemoryProtectionPolicy
1227   // does not apply to allocations performed in SMM mode.
1228   //
1229   if (IsInSmm ()) {
1230     return EFI_SUCCESS;
1231   }
1232
1233   //
1234   // If the CPU arch protocol is not installed yet, we cannot manage memory
1235   // permission attributes, and it is the job of the driver that installs this
1236   // protocol to set the permissions on existing allocations.
1237   //
1238   if (gCpu == NULL) {
1239     return EFI_SUCCESS;
1240   }
1241
1242   //
1243   // Check if a DXE memory protection policy has been configured
1244   //
1245   if (PcdGet64 (PcdDxeNxMemoryProtectionPolicy) == 0) {
1246     return EFI_SUCCESS;
1247   }
1248
1249   //
1250   // Don't overwrite Guard pages, which should be the first and/or last page,
1251   // if any.
1252   //
1253   if (IsHeapGuardEnabled ()) {
1254     if (IsGuardPage (Memory))  {
1255       Memory += EFI_PAGE_SIZE;
1256       Length -= EFI_PAGE_SIZE;
1257       if (Length == 0) {
1258         return EFI_SUCCESS;
1259       }
1260     }
1261
1262     if (IsGuardPage (Memory + Length - EFI_PAGE_SIZE))  {
1263       Length -= EFI_PAGE_SIZE;
1264       if (Length == 0) {
1265         return EFI_SUCCESS;
1266       }
1267     }
1268   }
1269
1270   //
1271   // Update the executable permissions according to the DXE memory
1272   // protection policy, but only if
1273   // - the policy is different between the old and the new type, or
1274   // - this is a newly added region (OldType == EfiMaxMemoryType)
1275   //
1276   NewAttributes = GetPermissionAttributeForMemoryType (NewType);
1277
1278   if (OldType != EfiMaxMemoryType) {
1279     OldAttributes = GetPermissionAttributeForMemoryType (OldType);
1280     if (OldAttributes == NewAttributes) {
1281       // policy is the same between OldType and NewType
1282       return EFI_SUCCESS;
1283     }
1284   } else if (NewAttributes == 0) {
1285     // newly added region of a type that does not require protection
1286     return EFI_SUCCESS;
1287   }
1288
1289   return gCpu->SetMemoryAttributes (gCpu, Memory, Length, NewAttributes);
1290 }