MdeModulePkg/Core/Dxe/Misc/MemoryProtection.c

   1 /** @file
   2   UEFI Memory Protection support.
   3
   4   If the UEFI image is page aligned, the image code section is set to read only
   5   and the image data section is set to non-executable.
   6
   7   1) This policy is applied for all UEFI image including boot service driver,
   8      runtime driver or application.
   9   2) This policy is applied only if the UEFI image meets the page alignment
  10      requirement.
  11   3) This policy is applied only if the Source UEFI image matches the
  12      PcdImageProtectionPolicy definition.
  13   4) This policy is not applied to the non-PE image region.
  14
  15   The DxeCore calls CpuArchProtocol->SetMemoryAttributes() to protect
  16   the image. If the CpuArch protocol is not installed yet, the DxeCore
  17   enqueues the protection request. Once the CpuArch is installed, the
  18   DxeCore dequeues the protection request and applies policy.
  19
  20   Once the image is unloaded, the protection is removed automatically.
  21
  22 Copyright (c) 2017 - 2018, Intel Corporation. All rights reserved.<BR>
  23 This program and the accompanying materials
  24 are licensed and made available under the terms and conditions of the BSD License
  25 which accompanies this distribution.  The full text of the license may be found at
  26 http://opensource.org/licenses/bsd-license.php
  27
  28 THE PROGRAM IS DISTRIBUTED UNDER THE BSD LICENSE ON AN "AS IS" BASIS,
  29 WITHOUT WARRANTIES OR REPRESENTATIONS OF ANY KIND, EITHER EXPRESS OR IMPLIED.
  30
  31 **/
  32
  33 #include <PiDxe.h>
  34 #include <Library/BaseLib.h>
  35 #include <Library/BaseMemoryLib.h>
  36 #include <Library/MemoryAllocationLib.h>
  37 #include <Library/UefiBootServicesTableLib.h>
  38 #include <Library/DxeServicesTableLib.h>
  39 #include <Library/DebugLib.h>
  40 #include <Library/UefiLib.h>
  41
  42 #include <Guid/EventGroup.h>
  43 #include <Guid/MemoryAttributesTable.h>
  44 #include <Guid/PropertiesTable.h>
  45
  46 #include <Protocol/FirmwareVolume2.h>
  47 #include <Protocol/BlockIo.h>
  48 #include <Protocol/SimpleFileSystem.h>
  49
  50 #include "DxeMain.h"
  51 #include "Mem/HeapGuard.h"
  52
  53 #define CACHE_ATTRIBUTE_MASK   (EFI_MEMORY_UC | EFI_MEMORY_WC | EFI_MEMORY_WT | EFI_MEMORY_WB | EFI_MEMORY_UCE | EFI_MEMORY_WP)
  54 #define MEMORY_ATTRIBUTE_MASK  (EFI_MEMORY_RP | EFI_MEMORY_XP | EFI_MEMORY_RO)
  55
  56 //
  57 // Image type definitions
  58 //
  59 #define IMAGE_UNKNOWN                         0x00000001
  60 #define IMAGE_FROM_FV                         0x00000002
  61
  62 //
  63 // Protection policy bit definition
  64 //
  65 #define DO_NOT_PROTECT                         0x00000000
  66 #define PROTECT_IF_ALIGNED_ELSE_ALLOW          0x00000001
  67
  68 #define MEMORY_TYPE_OS_RESERVED_MIN            0x80000000
  69 #define MEMORY_TYPE_OEM_RESERVED_MIN           0x70000000
  70
  71 #define PREVIOUS_MEMORY_DESCRIPTOR(MemoryDescriptor, Size) \
  72   ((EFI_MEMORY_DESCRIPTOR *)((UINT8 *)(MemoryDescriptor) - (Size)))
  73
  74 UINT32   mImageProtectionPolicy;
  75
  76 extern LIST_ENTRY         mGcdMemorySpaceMap;
  77
  78 STATIC LIST_ENTRY         mProtectedImageRecordList;
  79
  80 /**
  81   Sort code section in image record, based upon CodeSegmentBase from low to high.
  82
  83   @param  ImageRecord    image record to be sorted
  84 **/
  85 VOID
  86 SortImageRecordCodeSection (
  87   IN IMAGE_PROPERTIES_RECORD              *ImageRecord
  88   );
  89
  90 /**
  91   Check if code section in image record is valid.
  92
  93   @param  ImageRecord    image record to be checked
  94
  95   @retval TRUE  image record is valid
  96   @retval FALSE image record is invalid
  97 **/
  98 BOOLEAN
  99 IsImageRecordCodeSectionValid (
 100   IN IMAGE_PROPERTIES_RECORD              *ImageRecord
 101   );
 102
 103 /**
 104   Get the image type.
 105
 106   @param[in]    File       This is a pointer to the device path of the file that is
 107                            being dispatched.
 108
 109   @return UINT32           Image Type
 110 **/
 111 UINT32
 112 GetImageType (
 113   IN  CONST EFI_DEVICE_PATH_PROTOCOL   *File
 114   )
 115 {
 116   EFI_STATUS                        Status;
 117   EFI_HANDLE                        DeviceHandle;
 118   EFI_DEVICE_PATH_PROTOCOL          *TempDevicePath;
 119
 120   if (File == NULL) {
 121     return IMAGE_UNKNOWN;
 122   }
 123
 124   //
 125   // First check to see if File is from a Firmware Volume
 126   //
 127   DeviceHandle      = NULL;
 128   TempDevicePath = (EFI_DEVICE_PATH_PROTOCOL *) File;
 129   Status = gBS->LocateDevicePath (
 130                   &gEfiFirmwareVolume2ProtocolGuid,
 131                   &TempDevicePath,
 132                   &DeviceHandle
 133                   );
 134   if (!EFI_ERROR (Status)) {
 135     Status = gBS->OpenProtocol (
 136                     DeviceHandle,
 137                     &gEfiFirmwareVolume2ProtocolGuid,
 138                     NULL,
 139                     NULL,
 140                     NULL,
 141                     EFI_OPEN_PROTOCOL_TEST_PROTOCOL
 142                     );
 143     if (!EFI_ERROR (Status)) {
 144       return IMAGE_FROM_FV;
 145     }
 146   }
 147   return IMAGE_UNKNOWN;
 148 }
 149
 150 /**
 151   Get UEFI image protection policy based upon image type.
 152
 153   @param[in]  ImageType    The UEFI image type
 154
 155   @return UEFI image protection policy
 156 **/
 157 UINT32
 158 GetProtectionPolicyFromImageType (
 159   IN UINT32  ImageType
 160   )
 161 {
 162   if ((ImageType & mImageProtectionPolicy) == 0) {
 163     return DO_NOT_PROTECT;
 164   } else {
 165     return PROTECT_IF_ALIGNED_ELSE_ALLOW;
 166   }
 167 }
 168
 169 /**
 170   Get UEFI image protection policy based upon loaded image device path.
 171
 172   @param[in]  LoadedImage              The loaded image protocol
 173   @param[in]  LoadedImageDevicePath    The loaded image device path protocol
 174
 175   @return UEFI image protection policy
 176 **/
 177 UINT32
 178 GetUefiImageProtectionPolicy (
 179   IN EFI_LOADED_IMAGE_PROTOCOL   *LoadedImage,
 180   IN EFI_DEVICE_PATH_PROTOCOL    *LoadedImageDevicePath
 181   )
 182 {
 183   BOOLEAN     InSmm;
 184   UINT32      ImageType;
 185   UINT32      ProtectionPolicy;
 186
 187   //
 188   // Check SMM
 189   //
 190   InSmm = FALSE;
 191   if (gSmmBase2 != NULL) {
 192     gSmmBase2->InSmm (gSmmBase2, &InSmm);
 193   }
 194   if (InSmm) {
 195     return FALSE;
 196   }
 197
 198   //
 199   // Check DevicePath
 200   //
 201   if (LoadedImage == gDxeCoreLoadedImage) {
 202     ImageType = IMAGE_FROM_FV;
 203   } else {
 204     ImageType = GetImageType (LoadedImageDevicePath);
 205   }
 206   ProtectionPolicy = GetProtectionPolicyFromImageType (ImageType);
 207   return ProtectionPolicy;
 208 }
 209
 210
 211 /**
 212   Set UEFI image memory attributes.
 213
 214   @param[in]  BaseAddress            Specified start address
 215   @param[in]  Length                 Specified length
 216   @param[in]  Attributes             Specified attributes
 217 **/
 218 VOID
 219 SetUefiImageMemoryAttributes (
 220   IN UINT64   BaseAddress,
 221   IN UINT64   Length,
 222   IN UINT64   Attributes
 223   )
 224 {
 225   EFI_STATUS                       Status;
 226   EFI_GCD_MEMORY_SPACE_DESCRIPTOR  Descriptor;
 227   UINT64                           FinalAttributes;
 228
 229   Status = CoreGetMemorySpaceDescriptor(BaseAddress, &Descriptor);
 230   ASSERT_EFI_ERROR(Status);
 231
 232   FinalAttributes = (Descriptor.Attributes & CACHE_ATTRIBUTE_MASK) | (Attributes & MEMORY_ATTRIBUTE_MASK);
 233
 234   DEBUG ((DEBUG_INFO, "SetUefiImageMemoryAttributes - 0x%016lx - 0x%016lx (0x%016lx)\n", BaseAddress, Length, FinalAttributes));
 235
 236   ASSERT(gCpu != NULL);
 237   gCpu->SetMemoryAttributes (gCpu, BaseAddress, Length, FinalAttributes);
 238 }
 239
 240 /**
 241   Set UEFI image protection attributes.
 242
 243   @param[in]  ImageRecord    A UEFI image record
 244 **/
 245 VOID
 246 SetUefiImageProtectionAttributes (
 247   IN IMAGE_PROPERTIES_RECORD     *ImageRecord
 248   )
 249 {
 250   IMAGE_PROPERTIES_RECORD_CODE_SECTION      *ImageRecordCodeSection;
 251   LIST_ENTRY                                *ImageRecordCodeSectionLink;
 252   LIST_ENTRY                                *ImageRecordCodeSectionEndLink;
 253   LIST_ENTRY                                *ImageRecordCodeSectionList;
 254   UINT64                                    CurrentBase;
 255   UINT64                                    ImageEnd;
 256
 257   ImageRecordCodeSectionList = &ImageRecord->CodeSegmentList;
 258
 259   CurrentBase = ImageRecord->ImageBase;
 260   ImageEnd    = ImageRecord->ImageBase + ImageRecord->ImageSize;
 261
 262   ImageRecordCodeSectionLink = ImageRecordCodeSectionList->ForwardLink;
 263   ImageRecordCodeSectionEndLink = ImageRecordCodeSectionList;
 264   while (ImageRecordCodeSectionLink != ImageRecordCodeSectionEndLink) {
 265     ImageRecordCodeSection = CR (
 266                                ImageRecordCodeSectionLink,
 267                                IMAGE_PROPERTIES_RECORD_CODE_SECTION,
 268                                Link,
 269                                IMAGE_PROPERTIES_RECORD_CODE_SECTION_SIGNATURE
 270                                );
 271     ImageRecordCodeSectionLink = ImageRecordCodeSectionLink->ForwardLink;
 272
 273     ASSERT (CurrentBase <= ImageRecordCodeSection->CodeSegmentBase);
 274     if (CurrentBase < ImageRecordCodeSection->CodeSegmentBase) {
 275       //
 276       // DATA
 277       //
 278       SetUefiImageMemoryAttributes (
 279         CurrentBase,
 280         ImageRecordCodeSection->CodeSegmentBase - CurrentBase,
 281         EFI_MEMORY_XP
 282         );
 283     }
 284     //
 285     // CODE
 286     //
 287     SetUefiImageMemoryAttributes (
 288       ImageRecordCodeSection->CodeSegmentBase,
 289       ImageRecordCodeSection->CodeSegmentSize,
 290       EFI_MEMORY_RO
 291       );
 292     CurrentBase = ImageRecordCodeSection->CodeSegmentBase + ImageRecordCodeSection->CodeSegmentSize;
 293   }
 294   //
 295   // Last DATA
 296   //
 297   ASSERT (CurrentBase <= ImageEnd);
 298   if (CurrentBase < ImageEnd) {
 299     //
 300     // DATA
 301     //
 302     SetUefiImageMemoryAttributes (
 303       CurrentBase,
 304       ImageEnd - CurrentBase,
 305       EFI_MEMORY_XP
 306       );
 307   }
 308   return ;
 309 }
 310
 311 /**
 312   Return if the PE image section is aligned.
 313
 314   @param[in]  SectionAlignment    PE/COFF section alignment
 315   @param[in]  MemoryType          PE/COFF image memory type
 316
 317   @retval TRUE  The PE image section is aligned.
 318   @retval FALSE The PE image section is not aligned.
 319 **/
 320 BOOLEAN
 321 IsMemoryProtectionSectionAligned (
 322   IN UINT32           SectionAlignment,
 323   IN EFI_MEMORY_TYPE  MemoryType
 324   )
 325 {
 326   UINT32  PageAlignment;
 327
 328   switch (MemoryType) {
 329   case EfiRuntimeServicesCode:
 330   case EfiACPIMemoryNVS:
 331     PageAlignment = RUNTIME_PAGE_ALLOCATION_GRANULARITY;
 332     break;
 333   case EfiRuntimeServicesData:
 334   case EfiACPIReclaimMemory:
 335     ASSERT (FALSE);
 336     PageAlignment = RUNTIME_PAGE_ALLOCATION_GRANULARITY;
 337     break;
 338   case EfiBootServicesCode:
 339   case EfiLoaderCode:
 340   case EfiReservedMemoryType:
 341     PageAlignment = EFI_PAGE_SIZE;
 342     break;
 343   default:
 344     ASSERT (FALSE);
 345     PageAlignment = EFI_PAGE_SIZE;
 346     break;
 347   }
 348
 349   if ((SectionAlignment & (PageAlignment - 1)) != 0) {
 350     return FALSE;
 351   } else {
 352     return TRUE;
 353   }
 354 }
 355
 356 /**
 357   Free Image record.
 358
 359   @param[in]  ImageRecord    A UEFI image record
 360 **/
 361 VOID
 362 FreeImageRecord (
 363   IN IMAGE_PROPERTIES_RECORD              *ImageRecord
 364   )
 365 {
 366   LIST_ENTRY                           *CodeSegmentListHead;
 367   IMAGE_PROPERTIES_RECORD_CODE_SECTION *ImageRecordCodeSection;
 368
 369   CodeSegmentListHead = &ImageRecord->CodeSegmentList;
 370   while (!IsListEmpty (CodeSegmentListHead)) {
 371     ImageRecordCodeSection = CR (
 372                                CodeSegmentListHead->ForwardLink,
 373                                IMAGE_PROPERTIES_RECORD_CODE_SECTION,
 374                                Link,
 375                                IMAGE_PROPERTIES_RECORD_CODE_SECTION_SIGNATURE
 376                                );
 377     RemoveEntryList (&ImageRecordCodeSection->Link);
 378     FreePool (ImageRecordCodeSection);
 379   }
 380
 381   if (ImageRecord->Link.ForwardLink != NULL) {
 382     RemoveEntryList (&ImageRecord->Link);
 383   }
 384   FreePool (ImageRecord);
 385 }
 386
 387 /**
 388   Protect UEFI PE/COFF image.
 389
 390   @param[in]  LoadedImage              The loaded image protocol
 391   @param[in]  LoadedImageDevicePath    The loaded image device path protocol
 392 **/
 393 VOID
 394 ProtectUefiImage (
 395   IN EFI_LOADED_IMAGE_PROTOCOL   *LoadedImage,
 396   IN EFI_DEVICE_PATH_PROTOCOL    *LoadedImageDevicePath
 397   )
 398 {
 399   VOID                                 *ImageAddress;
 400   EFI_IMAGE_DOS_HEADER                 *DosHdr;
 401   UINT32                               PeCoffHeaderOffset;
 402   UINT32                               SectionAlignment;
 403   EFI_IMAGE_SECTION_HEADER             *Section;
 404   EFI_IMAGE_OPTIONAL_HEADER_PTR_UNION  Hdr;
 405   UINT8                                *Name;
 406   UINTN                                Index;
 407   IMAGE_PROPERTIES_RECORD              *ImageRecord;
 408   CHAR8                                *PdbPointer;
 409   IMAGE_PROPERTIES_RECORD_CODE_SECTION *ImageRecordCodeSection;
 410   UINT16                               Magic;
 411   BOOLEAN                              IsAligned;
 412   UINT32                               ProtectionPolicy;
 413
 414   DEBUG ((DEBUG_INFO, "ProtectUefiImageCommon - 0x%x\n", LoadedImage));
 415   DEBUG ((DEBUG_INFO, "  - 0x%016lx - 0x%016lx\n", (EFI_PHYSICAL_ADDRESS)(UINTN)LoadedImage->ImageBase, LoadedImage->ImageSize));
 416
 417   if (gCpu == NULL) {
 418     return ;
 419   }
 420
 421   ProtectionPolicy = GetUefiImageProtectionPolicy (LoadedImage, LoadedImageDevicePath);
 422   switch (ProtectionPolicy) {
 423   case DO_NOT_PROTECT:
 424     return ;
 425   case PROTECT_IF_ALIGNED_ELSE_ALLOW:
 426     break;
 427   default:
 428     ASSERT(FALSE);
 429     return ;
 430   }
 431
 432   ImageRecord = AllocateZeroPool (sizeof(*ImageRecord));
 433   if (ImageRecord == NULL) {
 434     return ;
 435   }
 436   ImageRecord->Signature = IMAGE_PROPERTIES_RECORD_SIGNATURE;
 437
 438   //
 439   // Step 1: record whole region
 440   //
 441   ImageRecord->ImageBase = (EFI_PHYSICAL_ADDRESS)(UINTN)LoadedImage->ImageBase;
 442   ImageRecord->ImageSize = LoadedImage->ImageSize;
 443
 444   ImageAddress = LoadedImage->ImageBase;
 445
 446   PdbPointer = PeCoffLoaderGetPdbPointer ((VOID*) (UINTN) ImageAddress);
 447   if (PdbPointer != NULL) {
 448     DEBUG ((DEBUG_VERBOSE, "  Image - %a\n", PdbPointer));
 449   }
 450
 451   //
 452   // Check PE/COFF image
 453   //
 454   DosHdr = (EFI_IMAGE_DOS_HEADER *) (UINTN) ImageAddress;
 455   PeCoffHeaderOffset = 0;
 456   if (DosHdr->e_magic == EFI_IMAGE_DOS_SIGNATURE) {
 457     PeCoffHeaderOffset = DosHdr->e_lfanew;
 458   }
 459
 460   Hdr.Pe32 = (EFI_IMAGE_NT_HEADERS32 *)((UINT8 *) (UINTN) ImageAddress + PeCoffHeaderOffset);
 461   if (Hdr.Pe32->Signature != EFI_IMAGE_NT_SIGNATURE) {
 462     DEBUG ((DEBUG_VERBOSE, "Hdr.Pe32->Signature invalid - 0x%x\n", Hdr.Pe32->Signature));
 463     // It might be image in SMM.
 464     goto Finish;
 465   }
 466
 467   //
 468   // Get SectionAlignment
 469   //
 470   if (Hdr.Pe32->FileHeader.Machine == IMAGE_FILE_MACHINE_IA64 && Hdr.Pe32->OptionalHeader.Magic == EFI_IMAGE_NT_OPTIONAL_HDR32_MAGIC) {
 471     //
 472     // NOTE: Some versions of Linux ELILO for Itanium have an incorrect magic value
 473     //       in the PE/COFF Header. If the MachineType is Itanium(IA64) and the
 474     //       Magic value in the OptionalHeader is EFI_IMAGE_NT_OPTIONAL_HDR32_MAGIC
 475     //       then override the magic value to EFI_IMAGE_NT_OPTIONAL_HDR64_MAGIC
 476     //
 477     Magic = EFI_IMAGE_NT_OPTIONAL_HDR64_MAGIC;
 478   } else {
 479     //
 480     // Get the magic value from the PE/COFF Optional Header
 481     //
 482     Magic = Hdr.Pe32->OptionalHeader.Magic;
 483   }
 484   if (Magic == EFI_IMAGE_NT_OPTIONAL_HDR32_MAGIC) {
 485     SectionAlignment  = Hdr.Pe32->OptionalHeader.SectionAlignment;
 486   } else {
 487     SectionAlignment  = Hdr.Pe32Plus->OptionalHeader.SectionAlignment;
 488   }
 489
 490   IsAligned = IsMemoryProtectionSectionAligned (SectionAlignment, LoadedImage->ImageCodeType);
 491   if (!IsAligned) {
 492     DEBUG ((DEBUG_VERBOSE, "!!!!!!!!  ProtectUefiImageCommon - Section Alignment(0x%x) is incorrect  !!!!!!!!\n",
 493       SectionAlignment));
 494     PdbPointer = PeCoffLoaderGetPdbPointer ((VOID*) (UINTN) ImageAddress);
 495     if (PdbPointer != NULL) {
 496       DEBUG ((DEBUG_VERBOSE, "!!!!!!!!  Image - %a  !!!!!!!!\n", PdbPointer));
 497     }
 498     goto Finish;
 499   }
 500
 501   Section = (EFI_IMAGE_SECTION_HEADER *) (
 502                (UINT8 *) (UINTN) ImageAddress +
 503                PeCoffHeaderOffset +
 504                sizeof(UINT32) +
 505                sizeof(EFI_IMAGE_FILE_HEADER) +
 506                Hdr.Pe32->FileHeader.SizeOfOptionalHeader
 507                );
 508   ImageRecord->CodeSegmentCount = 0;
 509   InitializeListHead (&ImageRecord->CodeSegmentList);
 510   for (Index = 0; Index < Hdr.Pe32->FileHeader.NumberOfSections; Index++) {
 511     Name = Section[Index].Name;
 512     DEBUG ((
 513       DEBUG_VERBOSE,
 514       "  Section - '%c%c%c%c%c%c%c%c'\n",
 515       Name[0],
 516       Name[1],
 517       Name[2],
 518       Name[3],
 519       Name[4],
 520       Name[5],
 521       Name[6],
 522       Name[7]
 523       ));
 524
 525     //
 526     // Instead of assuming that a PE/COFF section of type EFI_IMAGE_SCN_CNT_CODE
 527     // can always be mapped read-only, classify a section as a code section only
 528     // if it has the executable attribute set and the writable attribute cleared.
 529     //
 530     // This adheres more closely to the PE/COFF spec, and avoids issues with
 531     // Linux OS loaders that may consist of a single read/write/execute section.
 532     //
 533     if ((Section[Index].Characteristics & (EFI_IMAGE_SCN_MEM_WRITE | EFI_IMAGE_SCN_MEM_EXECUTE)) == EFI_IMAGE_SCN_MEM_EXECUTE) {
 534       DEBUG ((DEBUG_VERBOSE, "  VirtualSize          - 0x%08x\n", Section[Index].Misc.VirtualSize));
 535       DEBUG ((DEBUG_VERBOSE, "  VirtualAddress       - 0x%08x\n", Section[Index].VirtualAddress));
 536       DEBUG ((DEBUG_VERBOSE, "  SizeOfRawData        - 0x%08x\n", Section[Index].SizeOfRawData));
 537       DEBUG ((DEBUG_VERBOSE, "  PointerToRawData     - 0x%08x\n", Section[Index].PointerToRawData));
 538       DEBUG ((DEBUG_VERBOSE, "  PointerToRelocations - 0x%08x\n", Section[Index].PointerToRelocations));
 539       DEBUG ((DEBUG_VERBOSE, "  PointerToLinenumbers - 0x%08x\n", Section[Index].PointerToLinenumbers));
 540       DEBUG ((DEBUG_VERBOSE, "  NumberOfRelocations  - 0x%08x\n", Section[Index].NumberOfRelocations));
 541       DEBUG ((DEBUG_VERBOSE, "  NumberOfLinenumbers  - 0x%08x\n", Section[Index].NumberOfLinenumbers));
 542       DEBUG ((DEBUG_VERBOSE, "  Characteristics      - 0x%08x\n", Section[Index].Characteristics));
 543
 544       //
 545       // Step 2: record code section
 546       //
 547       ImageRecordCodeSection = AllocatePool (sizeof(*ImageRecordCodeSection));
 548       if (ImageRecordCodeSection == NULL) {
 549         return ;
 550       }
 551       ImageRecordCodeSection->Signature = IMAGE_PROPERTIES_RECORD_CODE_SECTION_SIGNATURE;
 552
 553       ImageRecordCodeSection->CodeSegmentBase = (UINTN)ImageAddress + Section[Index].VirtualAddress;
 554       ImageRecordCodeSection->CodeSegmentSize = ALIGN_VALUE(Section[Index].SizeOfRawData, SectionAlignment);
 555
 556       DEBUG ((DEBUG_VERBOSE, "ImageCode: 0x%016lx - 0x%016lx\n", ImageRecordCodeSection->CodeSegmentBase, ImageRecordCodeSection->CodeSegmentSize));
 557
 558       InsertTailList (&ImageRecord->CodeSegmentList, &ImageRecordCodeSection->Link);
 559       ImageRecord->CodeSegmentCount++;
 560     }
 561   }
 562
 563   if (ImageRecord->CodeSegmentCount == 0) {
 564     //
 565     // If a UEFI executable consists of a single read+write+exec PE/COFF
 566     // section, that isn't actually an error. The image can be launched
 567     // alright, only image protection cannot be applied to it fully.
 568     //
 569     // One example that elicits this is (some) Linux kernels (with the EFI stub
 570     // of course).
 571     //
 572     DEBUG ((DEBUG_WARN, "!!!!!!!!  ProtectUefiImageCommon - CodeSegmentCount is 0  !!!!!!!!\n"));
 573     PdbPointer = PeCoffLoaderGetPdbPointer ((VOID*) (UINTN) ImageAddress);
 574     if (PdbPointer != NULL) {
 575       DEBUG ((DEBUG_WARN, "!!!!!!!!  Image - %a  !!!!!!!!\n", PdbPointer));
 576     }
 577     goto Finish;
 578   }
 579
 580   //
 581   // Final
 582   //
 583   SortImageRecordCodeSection (ImageRecord);
 584   //
 585   // Check overlap all section in ImageBase/Size
 586   //
 587   if (!IsImageRecordCodeSectionValid (ImageRecord)) {
 588     DEBUG ((DEBUG_ERROR, "IsImageRecordCodeSectionValid - FAIL\n"));
 589     goto Finish;
 590   }
 591
 592   //
 593   // Round up the ImageSize, some CPU arch may return EFI_UNSUPPORTED if ImageSize is not aligned.
 594   // Given that the loader always allocates full pages, we know the space after the image is not used.
 595   //
 596   ImageRecord->ImageSize = ALIGN_VALUE(LoadedImage->ImageSize, EFI_PAGE_SIZE);
 597
 598   //
 599   // CPU ARCH present. Update memory attribute directly.
 600   //
 601   SetUefiImageProtectionAttributes (ImageRecord);
 602
 603   //
 604   // Record the image record in the list so we can undo the protections later
 605   //
 606   InsertTailList (&mProtectedImageRecordList, &ImageRecord->Link);
 607
 608 Finish:
 609   return ;
 610 }
 611
 612 /**
 613   Unprotect UEFI image.
 614
 615   @param[in]  LoadedImage              The loaded image protocol
 616   @param[in]  LoadedImageDevicePath    The loaded image device path protocol
 617 **/
 618 VOID
 619 UnprotectUefiImage (
 620   IN EFI_LOADED_IMAGE_PROTOCOL   *LoadedImage,
 621   IN EFI_DEVICE_PATH_PROTOCOL    *LoadedImageDevicePath
 622   )
 623 {
 624   IMAGE_PROPERTIES_RECORD    *ImageRecord;
 625   LIST_ENTRY                 *ImageRecordLink;
 626
 627   if (PcdGet32(PcdImageProtectionPolicy) != 0) {
 628     for (ImageRecordLink = mProtectedImageRecordList.ForwardLink;
 629          ImageRecordLink != &mProtectedImageRecordList;
 630          ImageRecordLink = ImageRecordLink->ForwardLink) {
 631       ImageRecord = CR (
 632                       ImageRecordLink,
 633                       IMAGE_PROPERTIES_RECORD,
 634                       Link,
 635                       IMAGE_PROPERTIES_RECORD_SIGNATURE
 636                       );
 637
 638       if (ImageRecord->ImageBase == (EFI_PHYSICAL_ADDRESS)(UINTN)LoadedImage->ImageBase) {
 639         SetUefiImageMemoryAttributes (ImageRecord->ImageBase,
 640                                       ImageRecord->ImageSize,
 641                                       0);
 642         FreeImageRecord (ImageRecord);
 643         return;
 644       }
 645     }
 646   }
 647 }
 648
 649 /**
 650   Return the EFI memory permission attribute associated with memory
 651   type 'MemoryType' under the configured DXE memory protection policy.
 652
 653   @param MemoryType       Memory type.
 654 **/
 655 STATIC
 656 UINT64
 657 GetPermissionAttributeForMemoryType (
 658   IN EFI_MEMORY_TYPE    MemoryType
 659   )
 660 {
 661   UINT64 TestBit;
 662
 663   if ((UINT32)MemoryType >= MEMORY_TYPE_OS_RESERVED_MIN) {
 664     TestBit = BIT63;
 665   } else if ((UINT32)MemoryType >= MEMORY_TYPE_OEM_RESERVED_MIN) {
 666     TestBit = BIT62;
 667   } else {
 668     TestBit = LShiftU64 (1, MemoryType);
 669   }
 670
 671   if ((PcdGet64 (PcdDxeNxMemoryProtectionPolicy) & TestBit) != 0) {
 672     return EFI_MEMORY_XP;
 673   } else {
 674     return 0;
 675   }
 676 }
 677
 678 /**
 679   Sort memory map entries based upon PhysicalStart, from low to high.
 680
 681   @param  MemoryMap              A pointer to the buffer in which firmware places
 682                                  the current memory map.
 683   @param  MemoryMapSize          Size, in bytes, of the MemoryMap buffer.
 684   @param  DescriptorSize         Size, in bytes, of an individual EFI_MEMORY_DESCRIPTOR.
 685 **/
 686 STATIC
 687 VOID
 688 SortMemoryMap (
 689   IN OUT EFI_MEMORY_DESCRIPTOR  *MemoryMap,
 690   IN UINTN                      MemoryMapSize,
 691   IN UINTN                      DescriptorSize
 692   )
 693 {
 694   EFI_MEMORY_DESCRIPTOR       *MemoryMapEntry;
 695   EFI_MEMORY_DESCRIPTOR       *NextMemoryMapEntry;
 696   EFI_MEMORY_DESCRIPTOR       *MemoryMapEnd;
 697   EFI_MEMORY_DESCRIPTOR       TempMemoryMap;
 698
 699   MemoryMapEntry = MemoryMap;
 700   NextMemoryMapEntry = NEXT_MEMORY_DESCRIPTOR (MemoryMapEntry, DescriptorSize);
 701   MemoryMapEnd = (EFI_MEMORY_DESCRIPTOR *) ((UINT8 *) MemoryMap + MemoryMapSize);
 702   while (MemoryMapEntry < MemoryMapEnd) {
 703     while (NextMemoryMapEntry < MemoryMapEnd) {
 704       if (MemoryMapEntry->PhysicalStart > NextMemoryMapEntry->PhysicalStart) {
 705         CopyMem (&TempMemoryMap, MemoryMapEntry, sizeof(EFI_MEMORY_DESCRIPTOR));
 706         CopyMem (MemoryMapEntry, NextMemoryMapEntry, sizeof(EFI_MEMORY_DESCRIPTOR));
 707         CopyMem (NextMemoryMapEntry, &TempMemoryMap, sizeof(EFI_MEMORY_DESCRIPTOR));
 708       }
 709
 710       NextMemoryMapEntry = NEXT_MEMORY_DESCRIPTOR (NextMemoryMapEntry, DescriptorSize);
 711     }
 712
 713     MemoryMapEntry      = NEXT_MEMORY_DESCRIPTOR (MemoryMapEntry, DescriptorSize);
 714     NextMemoryMapEntry  = NEXT_MEMORY_DESCRIPTOR (MemoryMapEntry, DescriptorSize);
 715   }
 716 }
 717
 718 /**
 719   Merge adjacent memory map entries if they use the same memory protection policy
 720
 721   @param[in, out]  MemoryMap              A pointer to the buffer in which firmware places
 722                                           the current memory map.
 723   @param[in, out]  MemoryMapSize          A pointer to the size, in bytes, of the
 724                                           MemoryMap buffer. On input, this is the size of
 725                                           the current memory map.  On output,
 726                                           it is the size of new memory map after merge.
 727   @param[in]       DescriptorSize         Size, in bytes, of an individual EFI_MEMORY_DESCRIPTOR.
 728 **/
 729 STATIC
 730 VOID
 731 MergeMemoryMapForProtectionPolicy (
 732   IN OUT EFI_MEMORY_DESCRIPTOR  *MemoryMap,
 733   IN OUT UINTN                  *MemoryMapSize,
 734   IN UINTN                      DescriptorSize
 735   )
 736 {
 737   EFI_MEMORY_DESCRIPTOR       *MemoryMapEntry;
 738   EFI_MEMORY_DESCRIPTOR       *MemoryMapEnd;
 739   UINT64                      MemoryBlockLength;
 740   EFI_MEMORY_DESCRIPTOR       *NewMemoryMapEntry;
 741   EFI_MEMORY_DESCRIPTOR       *NextMemoryMapEntry;
 742   UINT64                      Attributes;
 743
 744   SortMemoryMap (MemoryMap, *MemoryMapSize, DescriptorSize);
 745
 746   MemoryMapEntry = MemoryMap;
 747   NewMemoryMapEntry = MemoryMap;
 748   MemoryMapEnd = (EFI_MEMORY_DESCRIPTOR *) ((UINT8 *) MemoryMap + *MemoryMapSize);
 749   while ((UINTN)MemoryMapEntry < (UINTN)MemoryMapEnd) {
 750     CopyMem (NewMemoryMapEntry, MemoryMapEntry, sizeof(EFI_MEMORY_DESCRIPTOR));
 751     NextMemoryMapEntry = NEXT_MEMORY_DESCRIPTOR (MemoryMapEntry, DescriptorSize);
 752
 753     do {
 754       MemoryBlockLength = (UINT64) (EFI_PAGES_TO_SIZE((UINTN)MemoryMapEntry->NumberOfPages));
 755       Attributes = GetPermissionAttributeForMemoryType (MemoryMapEntry->Type);
 756
 757       if (((UINTN)NextMemoryMapEntry < (UINTN)MemoryMapEnd) &&
 758           Attributes == GetPermissionAttributeForMemoryType (NextMemoryMapEntry->Type) &&
 759           ((MemoryMapEntry->PhysicalStart + MemoryBlockLength) == NextMemoryMapEntry->PhysicalStart)) {
 760         MemoryMapEntry->NumberOfPages += NextMemoryMapEntry->NumberOfPages;
 761         if (NewMemoryMapEntry != MemoryMapEntry) {
 762           NewMemoryMapEntry->NumberOfPages += NextMemoryMapEntry->NumberOfPages;
 763         }
 764
 765         NextMemoryMapEntry = NEXT_MEMORY_DESCRIPTOR (NextMemoryMapEntry, DescriptorSize);
 766         continue;
 767       } else {
 768         MemoryMapEntry = PREVIOUS_MEMORY_DESCRIPTOR (NextMemoryMapEntry, DescriptorSize);
 769         break;
 770       }
 771     } while (TRUE);
 772
 773     MemoryMapEntry = NEXT_MEMORY_DESCRIPTOR (MemoryMapEntry, DescriptorSize);
 774     NewMemoryMapEntry = NEXT_MEMORY_DESCRIPTOR (NewMemoryMapEntry, DescriptorSize);
 775   }
 776
 777   *MemoryMapSize = (UINTN)NewMemoryMapEntry - (UINTN)MemoryMap;
 778
 779   return ;
 780 }
 781
 782
 783 /**
 784   Remove exec permissions from all regions whose type is identified by
 785   PcdDxeNxMemoryProtectionPolicy.
 786 **/
 787 STATIC
 788 VOID
 789 InitializeDxeNxMemoryProtectionPolicy (
 790   VOID
 791   )
 792 {
 793   UINTN                             MemoryMapSize;
 794   UINTN                             MapKey;
 795   UINTN                             DescriptorSize;
 796   UINT32                            DescriptorVersion;
 797   EFI_MEMORY_DESCRIPTOR             *MemoryMap;
 798   EFI_MEMORY_DESCRIPTOR             *MemoryMapEntry;
 799   EFI_MEMORY_DESCRIPTOR             *MemoryMapEnd;
 800   EFI_STATUS                        Status;
 801   UINT64                            Attributes;
 802   LIST_ENTRY                        *Link;
 803   EFI_GCD_MAP_ENTRY                 *Entry;
 804   EFI_PEI_HOB_POINTERS              Hob;
 805   EFI_HOB_MEMORY_ALLOCATION         *MemoryHob;
 806   EFI_PHYSICAL_ADDRESS              StackBase;
 807
 808   //
 809   // Get the EFI memory map.
 810   //
 811   MemoryMapSize = 0;
 812   MemoryMap     = NULL;
 813
 814   Status = gBS->GetMemoryMap (
 815                   &MemoryMapSize,
 816                   MemoryMap,
 817                   &MapKey,
 818                   &DescriptorSize,
 819                   &DescriptorVersion
 820                   );
 821   ASSERT (Status == EFI_BUFFER_TOO_SMALL);
 822   do {
 823     MemoryMap = (EFI_MEMORY_DESCRIPTOR *) AllocatePool (MemoryMapSize);
 824     ASSERT (MemoryMap != NULL);
 825     Status = gBS->GetMemoryMap (
 826                     &MemoryMapSize,
 827                     MemoryMap,
 828                     &MapKey,
 829                     &DescriptorSize,
 830                     &DescriptorVersion
 831                     );
 832     if (EFI_ERROR (Status)) {
 833       FreePool (MemoryMap);
 834     }
 835   } while (Status == EFI_BUFFER_TOO_SMALL);
 836   ASSERT_EFI_ERROR (Status);
 837
 838   StackBase = 0;
 839   if (PcdGetBool (PcdCpuStackGuard)) {
 840     //
 841     // Get the base of stack from Hob.
 842     //
 843     Hob.Raw = GetHobList ();
 844     while ((Hob.Raw = GetNextHob (EFI_HOB_TYPE_MEMORY_ALLOCATION, Hob.Raw)) != NULL) {
 845       MemoryHob = Hob.MemoryAllocation;
 846       if (CompareGuid(&gEfiHobMemoryAllocStackGuid, &MemoryHob->AllocDescriptor.Name)) {
 847         DEBUG ((
 848           DEBUG_INFO,
 849           "%a: StackBase = 0x%016lx  StackSize = 0x%016lx\n",
 850           __FUNCTION__,
 851           MemoryHob->AllocDescriptor.MemoryBaseAddress,
 852           MemoryHob->AllocDescriptor.MemoryLength
 853           ));
 854
 855         StackBase = MemoryHob->AllocDescriptor.MemoryBaseAddress;
 856         //
 857         // Ensure the base of the stack is page-size aligned.
 858         //
 859         ASSERT ((StackBase & EFI_PAGE_MASK) == 0);
 860         break;
 861       }
 862       Hob.Raw = GET_NEXT_HOB (Hob);
 863     }
 864
 865     //
 866     // Ensure the base of stack can be found from Hob when stack guard is
 867     // enabled.
 868     //
 869     ASSERT (StackBase != 0);
 870   }
 871
 872   DEBUG ((
 873     DEBUG_INFO,
 874     "%a: applying strict permissions to active memory regions\n",
 875     __FUNCTION__
 876     ));
 877
 878   MergeMemoryMapForProtectionPolicy (MemoryMap, &MemoryMapSize, DescriptorSize);
 879
 880   MemoryMapEntry = MemoryMap;
 881   MemoryMapEnd = (EFI_MEMORY_DESCRIPTOR *) ((UINT8 *) MemoryMap + MemoryMapSize);
 882   while ((UINTN) MemoryMapEntry < (UINTN) MemoryMapEnd) {
 883
 884     Attributes = GetPermissionAttributeForMemoryType (MemoryMapEntry->Type);
 885     if (Attributes != 0) {
 886       SetUefiImageMemoryAttributes (
 887         MemoryMapEntry->PhysicalStart,
 888         LShiftU64 (MemoryMapEntry->NumberOfPages, EFI_PAGE_SHIFT),
 889         Attributes);
 890
 891       //
 892       // Add EFI_MEMORY_RP attribute for page 0 if NULL pointer detection is
 893       // enabled.
 894       //
 895       if (MemoryMapEntry->PhysicalStart == 0 &&
 896           PcdGet8 (PcdNullPointerDetectionPropertyMask) != 0) {
 897
 898         ASSERT (MemoryMapEntry->NumberOfPages > 0);
 899         SetUefiImageMemoryAttributes (
 900           0,
 901           EFI_PAGES_TO_SIZE (1),
 902           EFI_MEMORY_RP | Attributes);
 903       }
 904
 905       //
 906       // Add EFI_MEMORY_RP attribute for the first page of the stack if stack
 907       // guard is enabled.
 908       //
 909       if (StackBase != 0 &&
 910           (StackBase >= MemoryMapEntry->PhysicalStart &&
 911            StackBase <  MemoryMapEntry->PhysicalStart +
 912                         LShiftU64 (MemoryMapEntry->NumberOfPages, EFI_PAGE_SHIFT)) &&
 913           PcdGetBool (PcdCpuStackGuard)) {
 914
 915         SetUefiImageMemoryAttributes (
 916           StackBase,
 917           EFI_PAGES_TO_SIZE (1),
 918           EFI_MEMORY_RP | Attributes);
 919       }
 920
 921     }
 922     MemoryMapEntry = NEXT_MEMORY_DESCRIPTOR (MemoryMapEntry, DescriptorSize);
 923   }
 924   FreePool (MemoryMap);
 925
 926   //
 927   // Apply the policy for RAM regions that we know are present and
 928   // accessible, but have not been added to the UEFI memory map (yet).
 929   //
 930   if (GetPermissionAttributeForMemoryType (EfiConventionalMemory) != 0) {
 931     DEBUG ((
 932       DEBUG_INFO,
 933       "%a: applying strict permissions to inactive memory regions\n",
 934       __FUNCTION__
 935       ));
 936
 937     CoreAcquireGcdMemoryLock ();
 938
 939     Link = mGcdMemorySpaceMap.ForwardLink;
 940     while (Link != &mGcdMemorySpaceMap) {
 941
 942       Entry = CR (Link, EFI_GCD_MAP_ENTRY, Link, EFI_GCD_MAP_SIGNATURE);
 943
 944       if (Entry->GcdMemoryType == EfiGcdMemoryTypeReserved &&
 945           Entry->EndAddress < MAX_ADDRESS &&
 946           (Entry->Capabilities & (EFI_MEMORY_PRESENT | EFI_MEMORY_INITIALIZED | EFI_MEMORY_TESTED)) ==
 947             (EFI_MEMORY_PRESENT | EFI_MEMORY_INITIALIZED)) {
 948
 949         Attributes = GetPermissionAttributeForMemoryType (EfiConventionalMemory) |
 950                      (Entry->Attributes & CACHE_ATTRIBUTE_MASK);
 951
 952         DEBUG ((DEBUG_INFO,
 953           "Untested GCD memory space region: - 0x%016lx - 0x%016lx (0x%016lx)\n",
 954           Entry->BaseAddress, Entry->EndAddress - Entry->BaseAddress + 1,
 955           Attributes));
 956
 957         ASSERT(gCpu != NULL);
 958         gCpu->SetMemoryAttributes (gCpu, Entry->BaseAddress,
 959           Entry->EndAddress - Entry->BaseAddress + 1, Attributes);
 960       }
 961
 962       Link = Link->ForwardLink;
 963     }
 964     CoreReleaseGcdMemoryLock ();
 965   }
 966 }
 967
 968
 969 /**
 970   A notification for CPU_ARCH protocol.
 971
 972   @param[in]  Event                 Event whose notification function is being invoked.
 973   @param[in]  Context               Pointer to the notification function's context,
 974                                     which is implementation-dependent.
 975
 976 **/
 977 VOID
 978 EFIAPI
 979 MemoryProtectionCpuArchProtocolNotify (
 980   IN EFI_EVENT                Event,
 981   IN VOID                     *Context
 982   )
 983 {
 984   EFI_STATUS                  Status;
 985   EFI_LOADED_IMAGE_PROTOCOL   *LoadedImage;
 986   EFI_DEVICE_PATH_PROTOCOL    *LoadedImageDevicePath;
 987   UINTN                       NoHandles;
 988   EFI_HANDLE                  *HandleBuffer;
 989   UINTN                       Index;
 990
 991   DEBUG ((DEBUG_INFO, "MemoryProtectionCpuArchProtocolNotify:\n"));
 992   Status = CoreLocateProtocol (&gEfiCpuArchProtocolGuid, NULL, (VOID **)&gCpu);
 993   if (EFI_ERROR (Status)) {
 994     return;
 995   }
 996
 997   //
 998   // Apply the memory protection policy on non-BScode/RTcode regions.
 999   //
1000   if (PcdGet64 (PcdDxeNxMemoryProtectionPolicy) != 0) {
1001     InitializeDxeNxMemoryProtectionPolicy ();
1002   }
1003
1004   //
1005   // Call notify function meant for Heap Guard.
1006   //
1007   HeapGuardCpuArchProtocolNotify ();
1008
1009   if (mImageProtectionPolicy == 0) {
1010     return;
1011   }
1012
1013   Status = gBS->LocateHandleBuffer (
1014                   ByProtocol,
1015                   &gEfiLoadedImageProtocolGuid,
1016                   NULL,
1017                   &NoHandles,
1018                   &HandleBuffer
1019                   );
1020   if (EFI_ERROR (Status) && (NoHandles == 0)) {
1021     return ;
1022   }
1023
1024   for (Index = 0; Index < NoHandles; Index++) {
1025     Status = gBS->HandleProtocol (
1026                     HandleBuffer[Index],
1027                     &gEfiLoadedImageProtocolGuid,
1028                     (VOID **)&LoadedImage
1029                     );
1030     if (EFI_ERROR(Status)) {
1031       continue;
1032     }
1033     Status = gBS->HandleProtocol (
1034                     HandleBuffer[Index],
1035                     &gEfiLoadedImageDevicePathProtocolGuid,
1036                     (VOID **)&LoadedImageDevicePath
1037                     );
1038     if (EFI_ERROR(Status)) {
1039       LoadedImageDevicePath = NULL;
1040     }
1041
1042     ProtectUefiImage (LoadedImage, LoadedImageDevicePath);
1043   }
1044
1045   CoreCloseEvent (Event);
1046   return;
1047 }
1048
1049 /**
1050   ExitBootServices Callback function for memory protection.
1051 **/
1052 VOID
1053 MemoryProtectionExitBootServicesCallback (
1054   VOID
1055   )
1056 {
1057   EFI_RUNTIME_IMAGE_ENTRY       *RuntimeImage;
1058   LIST_ENTRY                    *Link;
1059
1060   //
1061   // We need remove the RT protection, because RT relocation need write code segment
1062   // at SetVirtualAddressMap(). We cannot assume OS/Loader has taken over page table at that time.
1063   //
1064   // Firmware does not own page tables after ExitBootServices(), so the OS would
1065   // have to relax protection of RT code pages across SetVirtualAddressMap(), or
1066   // delay setting protections on RT code pages until after SetVirtualAddressMap().
1067   // OS may set protection on RT based upon EFI_MEMORY_ATTRIBUTES_TABLE later.
1068   //
1069   if (mImageProtectionPolicy != 0) {
1070     for (Link = gRuntime->ImageHead.ForwardLink; Link != &gRuntime->ImageHead; Link = Link->ForwardLink) {
1071       RuntimeImage = BASE_CR (Link, EFI_RUNTIME_IMAGE_ENTRY, Link);
1072       SetUefiImageMemoryAttributes ((UINT64)(UINTN)RuntimeImage->ImageBase, ALIGN_VALUE(RuntimeImage->ImageSize, EFI_PAGE_SIZE), 0);
1073     }
1074   }
1075 }
1076
1077 /**
1078   Disable NULL pointer detection after EndOfDxe. This is a workaround resort in
1079   order to skip unfixable NULL pointer access issues detected in OptionROM or
1080   boot loaders.
1081
1082   @param[in]  Event     The Event this notify function registered to.
1083   @param[in]  Context   Pointer to the context data registered to the Event.
1084 **/
1085 VOID
1086 EFIAPI
1087 DisableNullDetectionAtTheEndOfDxe (
1088   EFI_EVENT                               Event,
1089   VOID                                    *Context
1090   )
1091 {
1092   EFI_STATUS                        Status;
1093   EFI_GCD_MEMORY_SPACE_DESCRIPTOR   Desc;
1094
1095   DEBUG ((DEBUG_INFO, "DisableNullDetectionAtTheEndOfDxe(): start\r\n"));
1096   //
1097   // Disable NULL pointer detection by enabling first 4K page
1098   //
1099   Status = CoreGetMemorySpaceDescriptor (0, &Desc);
1100   ASSERT_EFI_ERROR (Status);
1101
1102   if ((Desc.Capabilities & EFI_MEMORY_RP) == 0) {
1103     Status = CoreSetMemorySpaceCapabilities (
1104               0,
1105               EFI_PAGE_SIZE,
1106               Desc.Capabilities | EFI_MEMORY_RP
1107               );
1108     ASSERT_EFI_ERROR (Status);
1109   }
1110
1111   Status = CoreSetMemorySpaceAttributes (
1112             0,
1113             EFI_PAGE_SIZE,
1114             Desc.Attributes & ~EFI_MEMORY_RP
1115             );
1116   ASSERT_EFI_ERROR (Status);
1117
1118   CoreCloseEvent (Event);
1119   DEBUG ((DEBUG_INFO, "DisableNullDetectionAtTheEndOfDxe(): end\r\n"));
1120
1121   return;
1122 }
1123
1124 /**
1125   Initialize Memory Protection support.
1126 **/
1127 VOID
1128 EFIAPI
1129 CoreInitializeMemoryProtection (
1130   VOID
1131   )
1132 {
1133   EFI_STATUS  Status;
1134   EFI_EVENT   Event;
1135   EFI_EVENT   EndOfDxeEvent;
1136   VOID        *Registration;
1137
1138   mImageProtectionPolicy = PcdGet32(PcdImageProtectionPolicy);
1139
1140   InitializeListHead (&mProtectedImageRecordList);
1141
1142   //
1143   // Sanity check the PcdDxeNxMemoryProtectionPolicy setting:
1144   // - code regions should have no EFI_MEMORY_XP attribute
1145   // - EfiConventionalMemory and EfiBootServicesData should use the
1146   //   same attribute
1147   //
1148   ASSERT ((GetPermissionAttributeForMemoryType (EfiBootServicesCode) & EFI_MEMORY_XP) == 0);
1149   ASSERT ((GetPermissionAttributeForMemoryType (EfiRuntimeServicesCode) & EFI_MEMORY_XP) == 0);
1150   ASSERT ((GetPermissionAttributeForMemoryType (EfiLoaderCode) & EFI_MEMORY_XP) == 0);
1151   ASSERT (GetPermissionAttributeForMemoryType (EfiBootServicesData) ==
1152           GetPermissionAttributeForMemoryType (EfiConventionalMemory));
1153
1154   if (mImageProtectionPolicy != 0 || PcdGet64 (PcdDxeNxMemoryProtectionPolicy) != 0) {
1155     Status = CoreCreateEvent (
1156                EVT_NOTIFY_SIGNAL,
1157                TPL_CALLBACK,
1158                MemoryProtectionCpuArchProtocolNotify,
1159                NULL,
1160                &Event
1161                );
1162     ASSERT_EFI_ERROR(Status);
1163
1164     //
1165     // Register for protocol notifactions on this event
1166     //
1167     Status = CoreRegisterProtocolNotify (
1168                &gEfiCpuArchProtocolGuid,
1169                Event,
1170                &Registration
1171                );
1172     ASSERT_EFI_ERROR(Status);
1173   }
1174
1175   //
1176   // Register a callback to disable NULL pointer detection at EndOfDxe
1177   //
1178   if ((PcdGet8 (PcdNullPointerDetectionPropertyMask) & (BIT0|BIT7))
1179        == (BIT0|BIT7)) {
1180     Status = CoreCreateEventEx (
1181                     EVT_NOTIFY_SIGNAL,
1182                     TPL_NOTIFY,
1183                     DisableNullDetectionAtTheEndOfDxe,
1184                     NULL,
1185                     &gEfiEndOfDxeEventGroupGuid,
1186                     &EndOfDxeEvent
1187                     );
1188     ASSERT_EFI_ERROR (Status);
1189   }
1190
1191   return ;
1192 }
1193
1194 /**
1195   Returns whether we are currently executing in SMM mode.
1196 **/
1197 STATIC
1198 BOOLEAN
1199 IsInSmm (
1200   VOID
1201   )
1202 {
1203   BOOLEAN     InSmm;
1204
1205   InSmm = FALSE;
1206   if (gSmmBase2 != NULL) {
1207     gSmmBase2->InSmm (gSmmBase2, &InSmm);
1208   }
1209   return InSmm;
1210 }
1211
1212 /**
1213   Manage memory permission attributes on a memory range, according to the
1214   configured DXE memory protection policy.
1215
1216   @param  OldType           The old memory type of the range
1217   @param  NewType           The new memory type of the range
1218   @param  Memory            The base address of the range
1219   @param  Length            The size of the range (in bytes)
1220
1221   @return EFI_SUCCESS       If we are executing in SMM mode. No permission attributes
1222                             are updated in this case
1223   @return EFI_SUCCESS       If the the CPU arch protocol is not installed yet
1224   @return EFI_SUCCESS       If no DXE memory protection policy has been configured
1225   @return EFI_SUCCESS       If OldType and NewType use the same permission attributes
1226   @return other             Return value of gCpu->SetMemoryAttributes()
1227
1228 **/
1229 EFI_STATUS
1230 EFIAPI
1231 ApplyMemoryProtectionPolicy (
1232   IN  EFI_MEMORY_TYPE       OldType,
1233   IN  EFI_MEMORY_TYPE       NewType,
1234   IN  EFI_PHYSICAL_ADDRESS  Memory,
1235   IN  UINT64                Length
1236   )
1237 {
1238   UINT64  OldAttributes;
1239   UINT64  NewAttributes;
1240
1241   //
1242   // The policy configured in PcdDxeNxMemoryProtectionPolicy
1243   // does not apply to allocations performed in SMM mode.
1244   //
1245   if (IsInSmm ()) {
1246     return EFI_SUCCESS;
1247   }
1248
1249   //
1250   // If the CPU arch protocol is not installed yet, we cannot manage memory
1251   // permission attributes, and it is the job of the driver that installs this
1252   // protocol to set the permissions on existing allocations.
1253   //
1254   if (gCpu == NULL) {
1255     return EFI_SUCCESS;
1256   }
1257
1258   //
1259   // Check if a DXE memory protection policy has been configured
1260   //
1261   if (PcdGet64 (PcdDxeNxMemoryProtectionPolicy) == 0) {
1262     return EFI_SUCCESS;
1263   }
1264
1265   //
1266   // Don't overwrite Guard pages, which should be the first and/or last page,
1267   // if any.
1268   //
1269   if (IsHeapGuardEnabled ()) {
1270     if (IsGuardPage (Memory))  {
1271       Memory += EFI_PAGE_SIZE;
1272       Length -= EFI_PAGE_SIZE;
1273       if (Length == 0) {
1274         return EFI_SUCCESS;
1275       }
1276     }
1277
1278     if (IsGuardPage (Memory + Length - EFI_PAGE_SIZE))  {
1279       Length -= EFI_PAGE_SIZE;
1280       if (Length == 0) {
1281         return EFI_SUCCESS;
1282       }
1283     }
1284   }
1285
1286   //
1287   // Update the executable permissions according to the DXE memory
1288   // protection policy, but only if
1289   // - the policy is different between the old and the new type, or
1290   // - this is a newly added region (OldType == EfiMaxMemoryType)
1291   //
1292   NewAttributes = GetPermissionAttributeForMemoryType (NewType);
1293
1294   if (OldType != EfiMaxMemoryType) {
1295     OldAttributes = GetPermissionAttributeForMemoryType (OldType);
1296     if (OldAttributes == NewAttributes) {
1297       // policy is the same between OldType and NewType
1298       return EFI_SUCCESS;
1299     }
1300   } else if (NewAttributes == 0) {
1301     // newly added region of a type that does not require protection
1302     return EFI_SUCCESS;
1303   }
1304
1305   return gCpu->SetMemoryAttributes (gCpu, Memory, Length, NewAttributes);
1306 }