MdeModulePkg/Core/Dxe/Misc/MemoryProtection.c

   1 /** @file
   2   UEFI Memory Protection support.
   3
   4   If the UEFI image is page aligned, the image code section is set to read only
   5   and the image data section is set to non-executable.
   6
   7   1) This policy is applied for all UEFI image including boot service driver,
   8      runtime driver or application.
   9   2) This policy is applied only if the UEFI image meets the page alignment
  10      requirement.
  11   3) This policy is applied only if the Source UEFI image matches the
  12      PcdImageProtectionPolicy definition.
  13   4) This policy is not applied to the non-PE image region.
  14
  15   The DxeCore calls CpuArchProtocol->SetMemoryAttributes() to protect
  16   the image. If the CpuArch protocol is not installed yet, the DxeCore
  17   enqueues the protection request. Once the CpuArch is installed, the
  18   DxeCore dequeues the protection request and applies policy.
  19
  20   Once the image is unloaded, the protection is removed automatically.
  21
  22 Copyright (c) 2017, Intel Corporation. All rights reserved.<BR>
  23 This program and the accompanying materials
  24 are licensed and made available under the terms and conditions of the BSD License
  25 which accompanies this distribution.  The full text of the license may be found at
  26 http://opensource.org/licenses/bsd-license.php
  27
  28 THE PROGRAM IS DISTRIBUTED UNDER THE BSD LICENSE ON AN "AS IS" BASIS,
  29 WITHOUT WARRANTIES OR REPRESENTATIONS OF ANY KIND, EITHER EXPRESS OR IMPLIED.
  30
  31 **/
  32
  33 #include <PiDxe.h>
  34 #include <Library/BaseLib.h>
  35 #include <Library/BaseMemoryLib.h>
  36 #include <Library/MemoryAllocationLib.h>
  37 #include <Library/UefiBootServicesTableLib.h>
  38 #include <Library/DxeServicesTableLib.h>
  39 #include <Library/DebugLib.h>
  40 #include <Library/UefiLib.h>
  41
  42 #include <Guid/EventGroup.h>
  43 #include <Guid/MemoryAttributesTable.h>
  44 #include <Guid/PropertiesTable.h>
  45
  46 #include <Protocol/FirmwareVolume2.h>
  47 #include <Protocol/BlockIo.h>
  48 #include <Protocol/SimpleFileSystem.h>
  49
  50 #include "DxeMain.h"
  51
  52 #define CACHE_ATTRIBUTE_MASK   (EFI_MEMORY_UC | EFI_MEMORY_WC | EFI_MEMORY_WT | EFI_MEMORY_WB | EFI_MEMORY_UCE | EFI_MEMORY_WP)
  53 #define MEMORY_ATTRIBUTE_MASK  (EFI_MEMORY_RP | EFI_MEMORY_XP | EFI_MEMORY_RO)
  54
  55 //
  56 // Image type definitions
  57 //
  58 #define IMAGE_UNKNOWN                         0x00000001
  59 #define IMAGE_FROM_FV                         0x00000002
  60
  61 //
  62 // Protection policy bit definition
  63 //
  64 #define DO_NOT_PROTECT                         0x00000000
  65 #define PROTECT_IF_ALIGNED_ELSE_ALLOW          0x00000001
  66
  67 #define MEMORY_TYPE_OS_RESERVED_MIN            0x80000000
  68 #define MEMORY_TYPE_OEM_RESERVED_MIN           0x70000000
  69
  70 #define PREVIOUS_MEMORY_DESCRIPTOR(MemoryDescriptor, Size) \
  71   ((EFI_MEMORY_DESCRIPTOR *)((UINT8 *)(MemoryDescriptor) - (Size)))
  72
  73 UINT32   mImageProtectionPolicy;
  74
  75 extern LIST_ENTRY         mGcdMemorySpaceMap;
  76
  77 STATIC LIST_ENTRY         mProtectedImageRecordList;
  78
  79 /**
  80   Sort code section in image record, based upon CodeSegmentBase from low to high.
  81
  82   @param  ImageRecord    image record to be sorted
  83 **/
  84 VOID
  85 SortImageRecordCodeSection (
  86   IN IMAGE_PROPERTIES_RECORD              *ImageRecord
  87   );
  88
  89 /**
  90   Check if code section in image record is valid.
  91
  92   @param  ImageRecord    image record to be checked
  93
  94   @retval TRUE  image record is valid
  95   @retval FALSE image record is invalid
  96 **/
  97 BOOLEAN
  98 IsImageRecordCodeSectionValid (
  99   IN IMAGE_PROPERTIES_RECORD              *ImageRecord
 100   );
 101
 102 /**
 103   Get the image type.
 104
 105   @param[in]    File       This is a pointer to the device path of the file that is
 106                            being dispatched.
 107
 108   @return UINT32           Image Type
 109 **/
 110 UINT32
 111 GetImageType (
 112   IN  CONST EFI_DEVICE_PATH_PROTOCOL   *File
 113   )
 114 {
 115   EFI_STATUS                        Status;
 116   EFI_HANDLE                        DeviceHandle;
 117   EFI_DEVICE_PATH_PROTOCOL          *TempDevicePath;
 118
 119   if (File == NULL) {
 120     return IMAGE_UNKNOWN;
 121   }
 122
 123   //
 124   // First check to see if File is from a Firmware Volume
 125   //
 126   DeviceHandle      = NULL;
 127   TempDevicePath = (EFI_DEVICE_PATH_PROTOCOL *) File;
 128   Status = gBS->LocateDevicePath (
 129                   &gEfiFirmwareVolume2ProtocolGuid,
 130                   &TempDevicePath,
 131                   &DeviceHandle
 132                   );
 133   if (!EFI_ERROR (Status)) {
 134     Status = gBS->OpenProtocol (
 135                     DeviceHandle,
 136                     &gEfiFirmwareVolume2ProtocolGuid,
 137                     NULL,
 138                     NULL,
 139                     NULL,
 140                     EFI_OPEN_PROTOCOL_TEST_PROTOCOL
 141                     );
 142     if (!EFI_ERROR (Status)) {
 143       return IMAGE_FROM_FV;
 144     }
 145   }
 146   return IMAGE_UNKNOWN;
 147 }
 148
 149 /**
 150   Get UEFI image protection policy based upon image type.
 151
 152   @param[in]  ImageType    The UEFI image type
 153
 154   @return UEFI image protection policy
 155 **/
 156 UINT32
 157 GetProtectionPolicyFromImageType (
 158   IN UINT32  ImageType
 159   )
 160 {
 161   if ((ImageType & mImageProtectionPolicy) == 0) {
 162     return DO_NOT_PROTECT;
 163   } else {
 164     return PROTECT_IF_ALIGNED_ELSE_ALLOW;
 165   }
 166 }
 167
 168 /**
 169   Get UEFI image protection policy based upon loaded image device path.
 170
 171   @param[in]  LoadedImage              The loaded image protocol
 172   @param[in]  LoadedImageDevicePath    The loaded image device path protocol
 173
 174   @return UEFI image protection policy
 175 **/
 176 UINT32
 177 GetUefiImageProtectionPolicy (
 178   IN EFI_LOADED_IMAGE_PROTOCOL   *LoadedImage,
 179   IN EFI_DEVICE_PATH_PROTOCOL    *LoadedImageDevicePath
 180   )
 181 {
 182   BOOLEAN     InSmm;
 183   UINT32      ImageType;
 184   UINT32      ProtectionPolicy;
 185
 186   //
 187   // Check SMM
 188   //
 189   InSmm = FALSE;
 190   if (gSmmBase2 != NULL) {
 191     gSmmBase2->InSmm (gSmmBase2, &InSmm);
 192   }
 193   if (InSmm) {
 194     return FALSE;
 195   }
 196
 197   //
 198   // Check DevicePath
 199   //
 200   if (LoadedImage == gDxeCoreLoadedImage) {
 201     ImageType = IMAGE_FROM_FV;
 202   } else {
 203     ImageType = GetImageType (LoadedImageDevicePath);
 204   }
 205   ProtectionPolicy = GetProtectionPolicyFromImageType (ImageType);
 206   return ProtectionPolicy;
 207 }
 208
 209
 210 /**
 211   Set UEFI image memory attributes.
 212
 213   @param[in]  BaseAddress            Specified start address
 214   @param[in]  Length                 Specified length
 215   @param[in]  Attributes             Specified attributes
 216 **/
 217 VOID
 218 SetUefiImageMemoryAttributes (
 219   IN UINT64   BaseAddress,
 220   IN UINT64   Length,
 221   IN UINT64   Attributes
 222   )
 223 {
 224   EFI_STATUS                       Status;
 225   EFI_GCD_MEMORY_SPACE_DESCRIPTOR  Descriptor;
 226   UINT64                           FinalAttributes;
 227
 228   Status = CoreGetMemorySpaceDescriptor(BaseAddress, &Descriptor);
 229   ASSERT_EFI_ERROR(Status);
 230
 231   FinalAttributes = (Descriptor.Attributes & CACHE_ATTRIBUTE_MASK) | (Attributes & MEMORY_ATTRIBUTE_MASK);
 232
 233   DEBUG ((DEBUG_INFO, "SetUefiImageMemoryAttributes - 0x%016lx - 0x%016lx (0x%016lx)\n", BaseAddress, Length, FinalAttributes));
 234
 235   ASSERT(gCpu != NULL);
 236   gCpu->SetMemoryAttributes (gCpu, BaseAddress, Length, FinalAttributes);
 237 }
 238
 239 /**
 240   Set UEFI image protection attributes.
 241
 242   @param[in]  ImageRecord    A UEFI image record
 243 **/
 244 VOID
 245 SetUefiImageProtectionAttributes (
 246   IN IMAGE_PROPERTIES_RECORD     *ImageRecord
 247   )
 248 {
 249   IMAGE_PROPERTIES_RECORD_CODE_SECTION      *ImageRecordCodeSection;
 250   LIST_ENTRY                                *ImageRecordCodeSectionLink;
 251   LIST_ENTRY                                *ImageRecordCodeSectionEndLink;
 252   LIST_ENTRY                                *ImageRecordCodeSectionList;
 253   UINT64                                    CurrentBase;
 254   UINT64                                    ImageEnd;
 255
 256   ImageRecordCodeSectionList = &ImageRecord->CodeSegmentList;
 257
 258   CurrentBase = ImageRecord->ImageBase;
 259   ImageEnd    = ImageRecord->ImageBase + ImageRecord->ImageSize;
 260
 261   ImageRecordCodeSectionLink = ImageRecordCodeSectionList->ForwardLink;
 262   ImageRecordCodeSectionEndLink = ImageRecordCodeSectionList;
 263   while (ImageRecordCodeSectionLink != ImageRecordCodeSectionEndLink) {
 264     ImageRecordCodeSection = CR (
 265                                ImageRecordCodeSectionLink,
 266                                IMAGE_PROPERTIES_RECORD_CODE_SECTION,
 267                                Link,
 268                                IMAGE_PROPERTIES_RECORD_CODE_SECTION_SIGNATURE
 269                                );
 270     ImageRecordCodeSectionLink = ImageRecordCodeSectionLink->ForwardLink;
 271
 272     ASSERT (CurrentBase <= ImageRecordCodeSection->CodeSegmentBase);
 273     if (CurrentBase < ImageRecordCodeSection->CodeSegmentBase) {
 274       //
 275       // DATA
 276       //
 277       SetUefiImageMemoryAttributes (
 278         CurrentBase,
 279         ImageRecordCodeSection->CodeSegmentBase - CurrentBase,
 280         EFI_MEMORY_XP
 281         );
 282     }
 283     //
 284     // CODE
 285     //
 286     SetUefiImageMemoryAttributes (
 287       ImageRecordCodeSection->CodeSegmentBase,
 288       ImageRecordCodeSection->CodeSegmentSize,
 289       EFI_MEMORY_RO
 290       );
 291     CurrentBase = ImageRecordCodeSection->CodeSegmentBase + ImageRecordCodeSection->CodeSegmentSize;
 292   }
 293   //
 294   // Last DATA
 295   //
 296   ASSERT (CurrentBase <= ImageEnd);
 297   if (CurrentBase < ImageEnd) {
 298     //
 299     // DATA
 300     //
 301     SetUefiImageMemoryAttributes (
 302       CurrentBase,
 303       ImageEnd - CurrentBase,
 304       EFI_MEMORY_XP
 305       );
 306   }
 307   return ;
 308 }
 309
 310 /**
 311   Return if the PE image section is aligned.
 312
 313   @param[in]  SectionAlignment    PE/COFF section alignment
 314   @param[in]  MemoryType          PE/COFF image memory type
 315
 316   @retval TRUE  The PE image section is aligned.
 317   @retval FALSE The PE image section is not aligned.
 318 **/
 319 BOOLEAN
 320 IsMemoryProtectionSectionAligned (
 321   IN UINT32           SectionAlignment,
 322   IN EFI_MEMORY_TYPE  MemoryType
 323   )
 324 {
 325   UINT32  PageAlignment;
 326
 327   switch (MemoryType) {
 328   case EfiRuntimeServicesCode:
 329   case EfiACPIMemoryNVS:
 330     PageAlignment = RUNTIME_PAGE_ALLOCATION_GRANULARITY;
 331     break;
 332   case EfiRuntimeServicesData:
 333   case EfiACPIReclaimMemory:
 334     ASSERT (FALSE);
 335     PageAlignment = RUNTIME_PAGE_ALLOCATION_GRANULARITY;
 336     break;
 337   case EfiBootServicesCode:
 338   case EfiLoaderCode:
 339   case EfiReservedMemoryType:
 340     PageAlignment = EFI_PAGE_SIZE;
 341     break;
 342   default:
 343     ASSERT (FALSE);
 344     PageAlignment = EFI_PAGE_SIZE;
 345     break;
 346   }
 347
 348   if ((SectionAlignment & (PageAlignment - 1)) != 0) {
 349     return FALSE;
 350   } else {
 351     return TRUE;
 352   }
 353 }
 354
 355 /**
 356   Free Image record.
 357
 358   @param[in]  ImageRecord    A UEFI image record
 359 **/
 360 VOID
 361 FreeImageRecord (
 362   IN IMAGE_PROPERTIES_RECORD              *ImageRecord
 363   )
 364 {
 365   LIST_ENTRY                           *CodeSegmentListHead;
 366   IMAGE_PROPERTIES_RECORD_CODE_SECTION *ImageRecordCodeSection;
 367
 368   CodeSegmentListHead = &ImageRecord->CodeSegmentList;
 369   while (!IsListEmpty (CodeSegmentListHead)) {
 370     ImageRecordCodeSection = CR (
 371                                CodeSegmentListHead->ForwardLink,
 372                                IMAGE_PROPERTIES_RECORD_CODE_SECTION,
 373                                Link,
 374                                IMAGE_PROPERTIES_RECORD_CODE_SECTION_SIGNATURE
 375                                );
 376     RemoveEntryList (&ImageRecordCodeSection->Link);
 377     FreePool (ImageRecordCodeSection);
 378   }
 379
 380   if (ImageRecord->Link.ForwardLink != NULL) {
 381     RemoveEntryList (&ImageRecord->Link);
 382   }
 383   FreePool (ImageRecord);
 384 }
 385
 386 /**
 387   Protect UEFI PE/COFF image.
 388
 389   @param[in]  LoadedImage              The loaded image protocol
 390   @param[in]  LoadedImageDevicePath    The loaded image device path protocol
 391 **/
 392 VOID
 393 ProtectUefiImage (
 394   IN EFI_LOADED_IMAGE_PROTOCOL   *LoadedImage,
 395   IN EFI_DEVICE_PATH_PROTOCOL    *LoadedImageDevicePath
 396   )
 397 {
 398   VOID                                 *ImageAddress;
 399   EFI_IMAGE_DOS_HEADER                 *DosHdr;
 400   UINT32                               PeCoffHeaderOffset;
 401   UINT32                               SectionAlignment;
 402   EFI_IMAGE_SECTION_HEADER             *Section;
 403   EFI_IMAGE_OPTIONAL_HEADER_PTR_UNION  Hdr;
 404   UINT8                                *Name;
 405   UINTN                                Index;
 406   IMAGE_PROPERTIES_RECORD              *ImageRecord;
 407   CHAR8                                *PdbPointer;
 408   IMAGE_PROPERTIES_RECORD_CODE_SECTION *ImageRecordCodeSection;
 409   UINT16                               Magic;
 410   BOOLEAN                              IsAligned;
 411   UINT32                               ProtectionPolicy;
 412
 413   DEBUG ((DEBUG_INFO, "ProtectUefiImageCommon - 0x%x\n", LoadedImage));
 414   DEBUG ((DEBUG_INFO, "  - 0x%016lx - 0x%016lx\n", (EFI_PHYSICAL_ADDRESS)(UINTN)LoadedImage->ImageBase, LoadedImage->ImageSize));
 415
 416   if (gCpu == NULL) {
 417     return ;
 418   }
 419
 420   ProtectionPolicy = GetUefiImageProtectionPolicy (LoadedImage, LoadedImageDevicePath);
 421   switch (ProtectionPolicy) {
 422   case DO_NOT_PROTECT:
 423     return ;
 424   case PROTECT_IF_ALIGNED_ELSE_ALLOW:
 425     break;
 426   default:
 427     ASSERT(FALSE);
 428     return ;
 429   }
 430
 431   ImageRecord = AllocateZeroPool (sizeof(*ImageRecord));
 432   if (ImageRecord == NULL) {
 433     return ;
 434   }
 435   ImageRecord->Signature = IMAGE_PROPERTIES_RECORD_SIGNATURE;
 436
 437   //
 438   // Step 1: record whole region
 439   //
 440   ImageRecord->ImageBase = (EFI_PHYSICAL_ADDRESS)(UINTN)LoadedImage->ImageBase;
 441   ImageRecord->ImageSize = LoadedImage->ImageSize;
 442
 443   ImageAddress = LoadedImage->ImageBase;
 444
 445   PdbPointer = PeCoffLoaderGetPdbPointer ((VOID*) (UINTN) ImageAddress);
 446   if (PdbPointer != NULL) {
 447     DEBUG ((DEBUG_VERBOSE, "  Image - %a\n", PdbPointer));
 448   }
 449
 450   //
 451   // Check PE/COFF image
 452   //
 453   DosHdr = (EFI_IMAGE_DOS_HEADER *) (UINTN) ImageAddress;
 454   PeCoffHeaderOffset = 0;
 455   if (DosHdr->e_magic == EFI_IMAGE_DOS_SIGNATURE) {
 456     PeCoffHeaderOffset = DosHdr->e_lfanew;
 457   }
 458
 459   Hdr.Pe32 = (EFI_IMAGE_NT_HEADERS32 *)((UINT8 *) (UINTN) ImageAddress + PeCoffHeaderOffset);
 460   if (Hdr.Pe32->Signature != EFI_IMAGE_NT_SIGNATURE) {
 461     DEBUG ((DEBUG_VERBOSE, "Hdr.Pe32->Signature invalid - 0x%x\n", Hdr.Pe32->Signature));
 462     // It might be image in SMM.
 463     goto Finish;
 464   }
 465
 466   //
 467   // Get SectionAlignment
 468   //
 469   if (Hdr.Pe32->FileHeader.Machine == IMAGE_FILE_MACHINE_IA64 && Hdr.Pe32->OptionalHeader.Magic == EFI_IMAGE_NT_OPTIONAL_HDR32_MAGIC) {
 470     //
 471     // NOTE: Some versions of Linux ELILO for Itanium have an incorrect magic value
 472     //       in the PE/COFF Header. If the MachineType is Itanium(IA64) and the
 473     //       Magic value in the OptionalHeader is EFI_IMAGE_NT_OPTIONAL_HDR32_MAGIC
 474     //       then override the magic value to EFI_IMAGE_NT_OPTIONAL_HDR64_MAGIC
 475     //
 476     Magic = EFI_IMAGE_NT_OPTIONAL_HDR64_MAGIC;
 477   } else {
 478     //
 479     // Get the magic value from the PE/COFF Optional Header
 480     //
 481     Magic = Hdr.Pe32->OptionalHeader.Magic;
 482   }
 483   if (Magic == EFI_IMAGE_NT_OPTIONAL_HDR32_MAGIC) {
 484     SectionAlignment  = Hdr.Pe32->OptionalHeader.SectionAlignment;
 485   } else {
 486     SectionAlignment  = Hdr.Pe32Plus->OptionalHeader.SectionAlignment;
 487   }
 488
 489   IsAligned = IsMemoryProtectionSectionAligned (SectionAlignment, LoadedImage->ImageCodeType);
 490   if (!IsAligned) {
 491     DEBUG ((DEBUG_VERBOSE, "!!!!!!!!  ProtectUefiImageCommon - Section Alignment(0x%x) is incorrect  !!!!!!!!\n",
 492       SectionAlignment));
 493     PdbPointer = PeCoffLoaderGetPdbPointer ((VOID*) (UINTN) ImageAddress);
 494     if (PdbPointer != NULL) {
 495       DEBUG ((DEBUG_VERBOSE, "!!!!!!!!  Image - %a  !!!!!!!!\n", PdbPointer));
 496     }
 497     goto Finish;
 498   }
 499
 500   Section = (EFI_IMAGE_SECTION_HEADER *) (
 501                (UINT8 *) (UINTN) ImageAddress +
 502                PeCoffHeaderOffset +
 503                sizeof(UINT32) +
 504                sizeof(EFI_IMAGE_FILE_HEADER) +
 505                Hdr.Pe32->FileHeader.SizeOfOptionalHeader
 506                );
 507   ImageRecord->CodeSegmentCount = 0;
 508   InitializeListHead (&ImageRecord->CodeSegmentList);
 509   for (Index = 0; Index < Hdr.Pe32->FileHeader.NumberOfSections; Index++) {
 510     Name = Section[Index].Name;
 511     DEBUG ((
 512       DEBUG_VERBOSE,
 513       "  Section - '%c%c%c%c%c%c%c%c'\n",
 514       Name[0],
 515       Name[1],
 516       Name[2],
 517       Name[3],
 518       Name[4],
 519       Name[5],
 520       Name[6],
 521       Name[7]
 522       ));
 523
 524     //
 525     // Instead of assuming that a PE/COFF section of type EFI_IMAGE_SCN_CNT_CODE
 526     // can always be mapped read-only, classify a section as a code section only
 527     // if it has the executable attribute set and the writable attribute cleared.
 528     //
 529     // This adheres more closely to the PE/COFF spec, and avoids issues with
 530     // Linux OS loaders that may consist of a single read/write/execute section.
 531     //
 532     if ((Section[Index].Characteristics & (EFI_IMAGE_SCN_MEM_WRITE | EFI_IMAGE_SCN_MEM_EXECUTE)) == EFI_IMAGE_SCN_MEM_EXECUTE) {
 533       DEBUG ((DEBUG_VERBOSE, "  VirtualSize          - 0x%08x\n", Section[Index].Misc.VirtualSize));
 534       DEBUG ((DEBUG_VERBOSE, "  VirtualAddress       - 0x%08x\n", Section[Index].VirtualAddress));
 535       DEBUG ((DEBUG_VERBOSE, "  SizeOfRawData        - 0x%08x\n", Section[Index].SizeOfRawData));
 536       DEBUG ((DEBUG_VERBOSE, "  PointerToRawData     - 0x%08x\n", Section[Index].PointerToRawData));
 537       DEBUG ((DEBUG_VERBOSE, "  PointerToRelocations - 0x%08x\n", Section[Index].PointerToRelocations));
 538       DEBUG ((DEBUG_VERBOSE, "  PointerToLinenumbers - 0x%08x\n", Section[Index].PointerToLinenumbers));
 539       DEBUG ((DEBUG_VERBOSE, "  NumberOfRelocations  - 0x%08x\n", Section[Index].NumberOfRelocations));
 540       DEBUG ((DEBUG_VERBOSE, "  NumberOfLinenumbers  - 0x%08x\n", Section[Index].NumberOfLinenumbers));
 541       DEBUG ((DEBUG_VERBOSE, "  Characteristics      - 0x%08x\n", Section[Index].Characteristics));
 542
 543       //
 544       // Step 2: record code section
 545       //
 546       ImageRecordCodeSection = AllocatePool (sizeof(*ImageRecordCodeSection));
 547       if (ImageRecordCodeSection == NULL) {
 548         return ;
 549       }
 550       ImageRecordCodeSection->Signature = IMAGE_PROPERTIES_RECORD_CODE_SECTION_SIGNATURE;
 551
 552       ImageRecordCodeSection->CodeSegmentBase = (UINTN)ImageAddress + Section[Index].VirtualAddress;
 553       ImageRecordCodeSection->CodeSegmentSize = ALIGN_VALUE(Section[Index].SizeOfRawData, SectionAlignment);
 554
 555       DEBUG ((DEBUG_VERBOSE, "ImageCode: 0x%016lx - 0x%016lx\n", ImageRecordCodeSection->CodeSegmentBase, ImageRecordCodeSection->CodeSegmentSize));
 556
 557       InsertTailList (&ImageRecord->CodeSegmentList, &ImageRecordCodeSection->Link);
 558       ImageRecord->CodeSegmentCount++;
 559     }
 560   }
 561
 562   if (ImageRecord->CodeSegmentCount == 0) {
 563     //
 564     // If a UEFI executable consists of a single read+write+exec PE/COFF
 565     // section, that isn't actually an error. The image can be launched
 566     // alright, only image protection cannot be applied to it fully.
 567     //
 568     // One example that elicits this is (some) Linux kernels (with the EFI stub
 569     // of course).
 570     //
 571     DEBUG ((DEBUG_WARN, "!!!!!!!!  ProtectUefiImageCommon - CodeSegmentCount is 0  !!!!!!!!\n"));
 572     PdbPointer = PeCoffLoaderGetPdbPointer ((VOID*) (UINTN) ImageAddress);
 573     if (PdbPointer != NULL) {
 574       DEBUG ((DEBUG_WARN, "!!!!!!!!  Image - %a  !!!!!!!!\n", PdbPointer));
 575     }
 576     goto Finish;
 577   }
 578
 579   //
 580   // Final
 581   //
 582   SortImageRecordCodeSection (ImageRecord);
 583   //
 584   // Check overlap all section in ImageBase/Size
 585   //
 586   if (!IsImageRecordCodeSectionValid (ImageRecord)) {
 587     DEBUG ((DEBUG_ERROR, "IsImageRecordCodeSectionValid - FAIL\n"));
 588     goto Finish;
 589   }
 590
 591   //
 592   // Round up the ImageSize, some CPU arch may return EFI_UNSUPPORTED if ImageSize is not aligned.
 593   // Given that the loader always allocates full pages, we know the space after the image is not used.
 594   //
 595   ImageRecord->ImageSize = ALIGN_VALUE(LoadedImage->ImageSize, EFI_PAGE_SIZE);
 596
 597   //
 598   // CPU ARCH present. Update memory attribute directly.
 599   //
 600   SetUefiImageProtectionAttributes (ImageRecord);
 601
 602   //
 603   // Record the image record in the list so we can undo the protections later
 604   //
 605   InsertTailList (&mProtectedImageRecordList, &ImageRecord->Link);
 606
 607 Finish:
 608   return ;
 609 }
 610
 611 /**
 612   Unprotect UEFI image.
 613
 614   @param[in]  LoadedImage              The loaded image protocol
 615   @param[in]  LoadedImageDevicePath    The loaded image device path protocol
 616 **/
 617 VOID
 618 UnprotectUefiImage (
 619   IN EFI_LOADED_IMAGE_PROTOCOL   *LoadedImage,
 620   IN EFI_DEVICE_PATH_PROTOCOL    *LoadedImageDevicePath
 621   )
 622 {
 623   IMAGE_PROPERTIES_RECORD    *ImageRecord;
 624   LIST_ENTRY                 *ImageRecordLink;
 625
 626   if (PcdGet32(PcdImageProtectionPolicy) != 0) {
 627     for (ImageRecordLink = mProtectedImageRecordList.ForwardLink;
 628          ImageRecordLink != &mProtectedImageRecordList;
 629          ImageRecordLink = ImageRecordLink->ForwardLink) {
 630       ImageRecord = CR (
 631                       ImageRecordLink,
 632                       IMAGE_PROPERTIES_RECORD,
 633                       Link,
 634                       IMAGE_PROPERTIES_RECORD_SIGNATURE
 635                       );
 636
 637       if (ImageRecord->ImageBase == (EFI_PHYSICAL_ADDRESS)(UINTN)LoadedImage->ImageBase) {
 638         SetUefiImageMemoryAttributes (ImageRecord->ImageBase,
 639                                       ImageRecord->ImageSize,
 640                                       0);
 641         FreeImageRecord (ImageRecord);
 642         return;
 643       }
 644     }
 645   }
 646 }
 647
 648 /**
 649   Return the EFI memory permission attribute associated with memory
 650   type 'MemoryType' under the configured DXE memory protection policy.
 651
 652   @param MemoryType       Memory type.
 653 **/
 654 STATIC
 655 UINT64
 656 GetPermissionAttributeForMemoryType (
 657   IN EFI_MEMORY_TYPE    MemoryType
 658   )
 659 {
 660   UINT64 TestBit;
 661
 662   if ((UINT32)MemoryType >= MEMORY_TYPE_OS_RESERVED_MIN) {
 663     TestBit = BIT63;
 664   } else if ((UINT32)MemoryType >= MEMORY_TYPE_OEM_RESERVED_MIN) {
 665     TestBit = BIT62;
 666   } else {
 667     TestBit = LShiftU64 (1, MemoryType);
 668   }
 669
 670   if ((PcdGet64 (PcdDxeNxMemoryProtectionPolicy) & TestBit) != 0) {
 671     return EFI_MEMORY_XP;
 672   } else {
 673     return 0;
 674   }
 675 }
 676
 677 /**
 678   Sort memory map entries based upon PhysicalStart, from low to high.
 679
 680   @param  MemoryMap              A pointer to the buffer in which firmware places
 681                                  the current memory map.
 682   @param  MemoryMapSize          Size, in bytes, of the MemoryMap buffer.
 683   @param  DescriptorSize         Size, in bytes, of an individual EFI_MEMORY_DESCRIPTOR.
 684 **/
 685 STATIC
 686 VOID
 687 SortMemoryMap (
 688   IN OUT EFI_MEMORY_DESCRIPTOR  *MemoryMap,
 689   IN UINTN                      MemoryMapSize,
 690   IN UINTN                      DescriptorSize
 691   )
 692 {
 693   EFI_MEMORY_DESCRIPTOR       *MemoryMapEntry;
 694   EFI_MEMORY_DESCRIPTOR       *NextMemoryMapEntry;
 695   EFI_MEMORY_DESCRIPTOR       *MemoryMapEnd;
 696   EFI_MEMORY_DESCRIPTOR       TempMemoryMap;
 697
 698   MemoryMapEntry = MemoryMap;
 699   NextMemoryMapEntry = NEXT_MEMORY_DESCRIPTOR (MemoryMapEntry, DescriptorSize);
 700   MemoryMapEnd = (EFI_MEMORY_DESCRIPTOR *) ((UINT8 *) MemoryMap + MemoryMapSize);
 701   while (MemoryMapEntry < MemoryMapEnd) {
 702     while (NextMemoryMapEntry < MemoryMapEnd) {
 703       if (MemoryMapEntry->PhysicalStart > NextMemoryMapEntry->PhysicalStart) {
 704         CopyMem (&TempMemoryMap, MemoryMapEntry, sizeof(EFI_MEMORY_DESCRIPTOR));
 705         CopyMem (MemoryMapEntry, NextMemoryMapEntry, sizeof(EFI_MEMORY_DESCRIPTOR));
 706         CopyMem (NextMemoryMapEntry, &TempMemoryMap, sizeof(EFI_MEMORY_DESCRIPTOR));
 707       }
 708
 709       NextMemoryMapEntry = NEXT_MEMORY_DESCRIPTOR (NextMemoryMapEntry, DescriptorSize);
 710     }
 711
 712     MemoryMapEntry      = NEXT_MEMORY_DESCRIPTOR (MemoryMapEntry, DescriptorSize);
 713     NextMemoryMapEntry  = NEXT_MEMORY_DESCRIPTOR (MemoryMapEntry, DescriptorSize);
 714   }
 715 }
 716
 717 /**
 718   Merge adjacent memory map entries if they use the same memory protection policy
 719
 720   @param[in, out]  MemoryMap              A pointer to the buffer in which firmware places
 721                                           the current memory map.
 722   @param[in, out]  MemoryMapSize          A pointer to the size, in bytes, of the
 723                                           MemoryMap buffer. On input, this is the size of
 724                                           the current memory map.  On output,
 725                                           it is the size of new memory map after merge.
 726   @param[in]       DescriptorSize         Size, in bytes, of an individual EFI_MEMORY_DESCRIPTOR.
 727 **/
 728 STATIC
 729 VOID
 730 MergeMemoryMapForProtectionPolicy (
 731   IN OUT EFI_MEMORY_DESCRIPTOR  *MemoryMap,
 732   IN OUT UINTN                  *MemoryMapSize,
 733   IN UINTN                      DescriptorSize
 734   )
 735 {
 736   EFI_MEMORY_DESCRIPTOR       *MemoryMapEntry;
 737   EFI_MEMORY_DESCRIPTOR       *MemoryMapEnd;
 738   UINT64                      MemoryBlockLength;
 739   EFI_MEMORY_DESCRIPTOR       *NewMemoryMapEntry;
 740   EFI_MEMORY_DESCRIPTOR       *NextMemoryMapEntry;
 741   UINT64                      Attributes;
 742
 743   SortMemoryMap (MemoryMap, *MemoryMapSize, DescriptorSize);
 744
 745   MemoryMapEntry = MemoryMap;
 746   NewMemoryMapEntry = MemoryMap;
 747   MemoryMapEnd = (EFI_MEMORY_DESCRIPTOR *) ((UINT8 *) MemoryMap + *MemoryMapSize);
 748   while ((UINTN)MemoryMapEntry < (UINTN)MemoryMapEnd) {
 749     CopyMem (NewMemoryMapEntry, MemoryMapEntry, sizeof(EFI_MEMORY_DESCRIPTOR));
 750     NextMemoryMapEntry = NEXT_MEMORY_DESCRIPTOR (MemoryMapEntry, DescriptorSize);
 751
 752     do {
 753       MemoryBlockLength = (UINT64) (EFI_PAGES_TO_SIZE((UINTN)MemoryMapEntry->NumberOfPages));
 754       Attributes = GetPermissionAttributeForMemoryType (MemoryMapEntry->Type);
 755
 756       if (((UINTN)NextMemoryMapEntry < (UINTN)MemoryMapEnd) &&
 757           Attributes == GetPermissionAttributeForMemoryType (NextMemoryMapEntry->Type) &&
 758           ((MemoryMapEntry->PhysicalStart + MemoryBlockLength) == NextMemoryMapEntry->PhysicalStart)) {
 759         MemoryMapEntry->NumberOfPages += NextMemoryMapEntry->NumberOfPages;
 760         if (NewMemoryMapEntry != MemoryMapEntry) {
 761           NewMemoryMapEntry->NumberOfPages += NextMemoryMapEntry->NumberOfPages;
 762         }
 763
 764         NextMemoryMapEntry = NEXT_MEMORY_DESCRIPTOR (NextMemoryMapEntry, DescriptorSize);
 765         continue;
 766       } else {
 767         MemoryMapEntry = PREVIOUS_MEMORY_DESCRIPTOR (NextMemoryMapEntry, DescriptorSize);
 768         break;
 769       }
 770     } while (TRUE);
 771
 772     MemoryMapEntry = NEXT_MEMORY_DESCRIPTOR (MemoryMapEntry, DescriptorSize);
 773     NewMemoryMapEntry = NEXT_MEMORY_DESCRIPTOR (NewMemoryMapEntry, DescriptorSize);
 774   }
 775
 776   *MemoryMapSize = (UINTN)NewMemoryMapEntry - (UINTN)MemoryMap;
 777
 778   return ;
 779 }
 780
 781
 782 /**
 783   Remove exec permissions from all regions whose type is identified by
 784   PcdDxeNxMemoryProtectionPolicy.
 785 **/
 786 STATIC
 787 VOID
 788 InitializeDxeNxMemoryProtectionPolicy (
 789   VOID
 790   )
 791 {
 792   UINTN                             MemoryMapSize;
 793   UINTN                             MapKey;
 794   UINTN                             DescriptorSize;
 795   UINT32                            DescriptorVersion;
 796   EFI_MEMORY_DESCRIPTOR             *MemoryMap;
 797   EFI_MEMORY_DESCRIPTOR             *MemoryMapEntry;
 798   EFI_MEMORY_DESCRIPTOR             *MemoryMapEnd;
 799   EFI_STATUS                        Status;
 800   UINT64                            Attributes;
 801   LIST_ENTRY                        *Link;
 802   EFI_GCD_MAP_ENTRY                 *Entry;
 803
 804   //
 805   // Get the EFI memory map.
 806   //
 807   MemoryMapSize = 0;
 808   MemoryMap     = NULL;
 809
 810   Status = gBS->GetMemoryMap (
 811                   &MemoryMapSize,
 812                   MemoryMap,
 813                   &MapKey,
 814                   &DescriptorSize,
 815                   &DescriptorVersion
 816                   );
 817   ASSERT (Status == EFI_BUFFER_TOO_SMALL);
 818   do {
 819     MemoryMap = (EFI_MEMORY_DESCRIPTOR *) AllocatePool (MemoryMapSize);
 820     ASSERT (MemoryMap != NULL);
 821     Status = gBS->GetMemoryMap (
 822                     &MemoryMapSize,
 823                     MemoryMap,
 824                     &MapKey,
 825                     &DescriptorSize,
 826                     &DescriptorVersion
 827                     );
 828     if (EFI_ERROR (Status)) {
 829       FreePool (MemoryMap);
 830     }
 831   } while (Status == EFI_BUFFER_TOO_SMALL);
 832   ASSERT_EFI_ERROR (Status);
 833
 834   DEBUG ((
 835     DEBUG_INFO,
 836     "%a: applying strict permissions to active memory regions\n",
 837     __FUNCTION__
 838     ));
 839
 840   MergeMemoryMapForProtectionPolicy (MemoryMap, &MemoryMapSize, DescriptorSize);
 841
 842   MemoryMapEntry = MemoryMap;
 843   MemoryMapEnd = (EFI_MEMORY_DESCRIPTOR *) ((UINT8 *) MemoryMap + MemoryMapSize);
 844   while ((UINTN) MemoryMapEntry < (UINTN) MemoryMapEnd) {
 845
 846     Attributes = GetPermissionAttributeForMemoryType (MemoryMapEntry->Type);
 847     if (Attributes != 0) {
 848       if (MemoryMapEntry->PhysicalStart == 0 &&
 849           PcdGet8 (PcdNullPointerDetectionPropertyMask) != 0) {
 850
 851         ASSERT (MemoryMapEntry->NumberOfPages > 0);
 852         //
 853         // Skip page 0 if NULL pointer detection is enabled to avoid attributes
 854         // overwritten.
 855         //
 856         SetUefiImageMemoryAttributes (
 857           MemoryMapEntry->PhysicalStart + EFI_PAGE_SIZE,
 858           LShiftU64 (MemoryMapEntry->NumberOfPages - 1, EFI_PAGE_SHIFT),
 859           Attributes);
 860       } else {
 861         SetUefiImageMemoryAttributes (
 862           MemoryMapEntry->PhysicalStart,
 863           LShiftU64 (MemoryMapEntry->NumberOfPages, EFI_PAGE_SHIFT),
 864           Attributes);
 865       }
 866     }
 867     MemoryMapEntry = NEXT_MEMORY_DESCRIPTOR (MemoryMapEntry, DescriptorSize);
 868   }
 869   FreePool (MemoryMap);
 870
 871   //
 872   // Apply the policy for RAM regions that we know are present and
 873   // accessible, but have not been added to the UEFI memory map (yet).
 874   //
 875   if (GetPermissionAttributeForMemoryType (EfiConventionalMemory) != 0) {
 876     DEBUG ((
 877       DEBUG_INFO,
 878       "%a: applying strict permissions to inactive memory regions\n",
 879       __FUNCTION__
 880       ));
 881
 882     CoreAcquireGcdMemoryLock ();
 883
 884     Link = mGcdMemorySpaceMap.ForwardLink;
 885     while (Link != &mGcdMemorySpaceMap) {
 886
 887       Entry = CR (Link, EFI_GCD_MAP_ENTRY, Link, EFI_GCD_MAP_SIGNATURE);
 888
 889       if (Entry->GcdMemoryType == EfiGcdMemoryTypeReserved &&
 890           Entry->EndAddress < MAX_ADDRESS &&
 891           (Entry->Capabilities & (EFI_MEMORY_PRESENT | EFI_MEMORY_INITIALIZED | EFI_MEMORY_TESTED)) ==
 892             (EFI_MEMORY_PRESENT | EFI_MEMORY_INITIALIZED)) {
 893
 894         Attributes = GetPermissionAttributeForMemoryType (EfiConventionalMemory) |
 895                      (Entry->Attributes & CACHE_ATTRIBUTE_MASK);
 896
 897         DEBUG ((DEBUG_INFO,
 898           "Untested GCD memory space region: - 0x%016lx - 0x%016lx (0x%016lx)\n",
 899           Entry->BaseAddress, Entry->EndAddress - Entry->BaseAddress + 1,
 900           Attributes));
 901
 902         ASSERT(gCpu != NULL);
 903         gCpu->SetMemoryAttributes (gCpu, Entry->BaseAddress,
 904           Entry->EndAddress - Entry->BaseAddress + 1, Attributes);
 905       }
 906
 907       Link = Link->ForwardLink;
 908     }
 909     CoreReleaseGcdMemoryLock ();
 910   }
 911 }
 912
 913
 914 /**
 915   A notification for CPU_ARCH protocol.
 916
 917   @param[in]  Event                 Event whose notification function is being invoked.
 918   @param[in]  Context               Pointer to the notification function's context,
 919                                     which is implementation-dependent.
 920
 921 **/
 922 VOID
 923 EFIAPI
 924 MemoryProtectionCpuArchProtocolNotify (
 925   IN EFI_EVENT                Event,
 926   IN VOID                     *Context
 927   )
 928 {
 929   EFI_STATUS                  Status;
 930   EFI_LOADED_IMAGE_PROTOCOL   *LoadedImage;
 931   EFI_DEVICE_PATH_PROTOCOL    *LoadedImageDevicePath;
 932   UINTN                       NoHandles;
 933   EFI_HANDLE                  *HandleBuffer;
 934   UINTN                       Index;
 935
 936   DEBUG ((DEBUG_INFO, "MemoryProtectionCpuArchProtocolNotify:\n"));
 937   Status = CoreLocateProtocol (&gEfiCpuArchProtocolGuid, NULL, (VOID **)&gCpu);
 938   if (EFI_ERROR (Status)) {
 939     return;
 940   }
 941
 942   //
 943   // Apply the memory protection policy on non-BScode/RTcode regions.
 944   //
 945   if (PcdGet64 (PcdDxeNxMemoryProtectionPolicy) != 0) {
 946     InitializeDxeNxMemoryProtectionPolicy ();
 947   }
 948
 949   if (mImageProtectionPolicy == 0) {
 950     return;
 951   }
 952
 953   Status = gBS->LocateHandleBuffer (
 954                   ByProtocol,
 955                   &gEfiLoadedImageProtocolGuid,
 956                   NULL,
 957                   &NoHandles,
 958                   &HandleBuffer
 959                   );
 960   if (EFI_ERROR (Status) && (NoHandles == 0)) {
 961     return ;
 962   }
 963
 964   for (Index = 0; Index < NoHandles; Index++) {
 965     Status = gBS->HandleProtocol (
 966                     HandleBuffer[Index],
 967                     &gEfiLoadedImageProtocolGuid,
 968                     (VOID **)&LoadedImage
 969                     );
 970     if (EFI_ERROR(Status)) {
 971       continue;
 972     }
 973     Status = gBS->HandleProtocol (
 974                     HandleBuffer[Index],
 975                     &gEfiLoadedImageDevicePathProtocolGuid,
 976                     (VOID **)&LoadedImageDevicePath
 977                     );
 978     if (EFI_ERROR(Status)) {
 979       LoadedImageDevicePath = NULL;
 980     }
 981
 982     ProtectUefiImage (LoadedImage, LoadedImageDevicePath);
 983   }
 984
 985   CoreCloseEvent (Event);
 986   return;
 987 }
 988
 989 /**
 990   ExitBootServices Callback function for memory protection.
 991 **/
 992 VOID
 993 MemoryProtectionExitBootServicesCallback (
 994   VOID
 995   )
 996 {
 997   EFI_RUNTIME_IMAGE_ENTRY       *RuntimeImage;
 998   LIST_ENTRY                    *Link;
 999
1000   //
1001   // We need remove the RT protection, because RT relocation need write code segment
1002   // at SetVirtualAddressMap(). We cannot assume OS/Loader has taken over page table at that time.
1003   //
1004   // Firmware does not own page tables after ExitBootServices(), so the OS would
1005   // have to relax protection of RT code pages across SetVirtualAddressMap(), or
1006   // delay setting protections on RT code pages until after SetVirtualAddressMap().
1007   // OS may set protection on RT based upon EFI_MEMORY_ATTRIBUTES_TABLE later.
1008   //
1009   if (mImageProtectionPolicy != 0) {
1010     for (Link = gRuntime->ImageHead.ForwardLink; Link != &gRuntime->ImageHead; Link = Link->ForwardLink) {
1011       RuntimeImage = BASE_CR (Link, EFI_RUNTIME_IMAGE_ENTRY, Link);
1012       SetUefiImageMemoryAttributes ((UINT64)(UINTN)RuntimeImage->ImageBase, ALIGN_VALUE(RuntimeImage->ImageSize, EFI_PAGE_SIZE), 0);
1013     }
1014   }
1015 }
1016
1017 /**
1018   Disable NULL pointer detection after EndOfDxe. This is a workaround resort in
1019   order to skip unfixable NULL pointer access issues detected in OptionROM or
1020   boot loaders.
1021
1022   @param[in]  Event     The Event this notify function registered to.
1023   @param[in]  Context   Pointer to the context data registered to the Event.
1024 **/
1025 VOID
1026 EFIAPI
1027 DisableNullDetectionAtTheEndOfDxe (
1028   EFI_EVENT                               Event,
1029   VOID                                    *Context
1030   )
1031 {
1032   EFI_STATUS                        Status;
1033   EFI_GCD_MEMORY_SPACE_DESCRIPTOR   Desc;
1034
1035   DEBUG ((DEBUG_INFO, "DisableNullDetectionAtTheEndOfDxe(): start\r\n"));
1036   //
1037   // Disable NULL pointer detection by enabling first 4K page
1038   //
1039   Status = CoreGetMemorySpaceDescriptor (0, &Desc);
1040   ASSERT_EFI_ERROR (Status);
1041
1042   if ((Desc.Capabilities & EFI_MEMORY_RP) == 0) {
1043     Status = CoreSetMemorySpaceCapabilities (
1044               0,
1045               EFI_PAGE_SIZE,
1046               Desc.Capabilities | EFI_MEMORY_RP
1047               );
1048     ASSERT_EFI_ERROR (Status);
1049   }
1050
1051   Status = CoreSetMemorySpaceAttributes (
1052             0,
1053             EFI_PAGE_SIZE,
1054             Desc.Attributes & ~EFI_MEMORY_RP
1055             );
1056   ASSERT_EFI_ERROR (Status);
1057
1058   CoreCloseEvent (Event);
1059   DEBUG ((DEBUG_INFO, "DisableNullDetectionAtTheEndOfDxe(): end\r\n"));
1060
1061   return;
1062 }
1063
1064 /**
1065   Initialize Memory Protection support.
1066 **/
1067 VOID
1068 EFIAPI
1069 CoreInitializeMemoryProtection (
1070   VOID
1071   )
1072 {
1073   EFI_STATUS  Status;
1074   EFI_EVENT   Event;
1075   EFI_EVENT   EndOfDxeEvent;
1076   VOID        *Registration;
1077
1078   mImageProtectionPolicy = PcdGet32(PcdImageProtectionPolicy);
1079
1080   InitializeListHead (&mProtectedImageRecordList);
1081
1082   //
1083   // Sanity check the PcdDxeNxMemoryProtectionPolicy setting:
1084   // - code regions should have no EFI_MEMORY_XP attribute
1085   // - EfiConventionalMemory and EfiBootServicesData should use the
1086   //   same attribute
1087   //
1088   ASSERT ((GetPermissionAttributeForMemoryType (EfiBootServicesCode) & EFI_MEMORY_XP) == 0);
1089   ASSERT ((GetPermissionAttributeForMemoryType (EfiRuntimeServicesCode) & EFI_MEMORY_XP) == 0);
1090   ASSERT ((GetPermissionAttributeForMemoryType (EfiLoaderCode) & EFI_MEMORY_XP) == 0);
1091   ASSERT (GetPermissionAttributeForMemoryType (EfiBootServicesData) ==
1092           GetPermissionAttributeForMemoryType (EfiConventionalMemory));
1093
1094   if (mImageProtectionPolicy != 0 || PcdGet64 (PcdDxeNxMemoryProtectionPolicy) != 0) {
1095     Status = CoreCreateEvent (
1096                EVT_NOTIFY_SIGNAL,
1097                TPL_CALLBACK,
1098                MemoryProtectionCpuArchProtocolNotify,
1099                NULL,
1100                &Event
1101                );
1102     ASSERT_EFI_ERROR(Status);
1103
1104     //
1105     // Register for protocol notifactions on this event
1106     //
1107     Status = CoreRegisterProtocolNotify (
1108                &gEfiCpuArchProtocolGuid,
1109                Event,
1110                &Registration
1111                );
1112     ASSERT_EFI_ERROR(Status);
1113   }
1114
1115   //
1116   // Register a callback to disable NULL pointer detection at EndOfDxe
1117   //
1118   if ((PcdGet8 (PcdNullPointerDetectionPropertyMask) & (BIT0|BIT7))
1119        == (BIT0|BIT7)) {
1120     Status = CoreCreateEventEx (
1121                     EVT_NOTIFY_SIGNAL,
1122                     TPL_NOTIFY,
1123                     DisableNullDetectionAtTheEndOfDxe,
1124                     NULL,
1125                     &gEfiEndOfDxeEventGroupGuid,
1126                     &EndOfDxeEvent
1127                     );
1128     ASSERT_EFI_ERROR (Status);
1129   }
1130
1131   return ;
1132 }
1133
1134 /**
1135   Returns whether we are currently executing in SMM mode.
1136 **/
1137 STATIC
1138 BOOLEAN
1139 IsInSmm (
1140   VOID
1141   )
1142 {
1143   BOOLEAN     InSmm;
1144
1145   InSmm = FALSE;
1146   if (gSmmBase2 != NULL) {
1147     gSmmBase2->InSmm (gSmmBase2, &InSmm);
1148   }
1149   return InSmm;
1150 }
1151
1152 /**
1153   Manage memory permission attributes on a memory range, according to the
1154   configured DXE memory protection policy.
1155
1156   @param  OldType           The old memory type of the range
1157   @param  NewType           The new memory type of the range
1158   @param  Memory            The base address of the range
1159   @param  Length            The size of the range (in bytes)
1160
1161   @return EFI_SUCCESS       If we are executing in SMM mode. No permission attributes
1162                             are updated in this case
1163   @return EFI_SUCCESS       If the the CPU arch protocol is not installed yet
1164   @return EFI_SUCCESS       If no DXE memory protection policy has been configured
1165   @return EFI_SUCCESS       If OldType and NewType use the same permission attributes
1166   @return other             Return value of gCpu->SetMemoryAttributes()
1167
1168 **/
1169 EFI_STATUS
1170 EFIAPI
1171 ApplyMemoryProtectionPolicy (
1172   IN  EFI_MEMORY_TYPE       OldType,
1173   IN  EFI_MEMORY_TYPE       NewType,
1174   IN  EFI_PHYSICAL_ADDRESS  Memory,
1175   IN  UINT64                Length
1176   )
1177 {
1178   UINT64  OldAttributes;
1179   UINT64  NewAttributes;
1180
1181   //
1182   // The policy configured in PcdDxeNxMemoryProtectionPolicy
1183   // does not apply to allocations performed in SMM mode.
1184   //
1185   if (IsInSmm ()) {
1186     return EFI_SUCCESS;
1187   }
1188
1189   //
1190   // If the CPU arch protocol is not installed yet, we cannot manage memory
1191   // permission attributes, and it is the job of the driver that installs this
1192   // protocol to set the permissions on existing allocations.
1193   //
1194   if (gCpu == NULL) {
1195     return EFI_SUCCESS;
1196   }
1197
1198   //
1199   // Check if a DXE memory protection policy has been configured
1200   //
1201   if (PcdGet64 (PcdDxeNxMemoryProtectionPolicy) == 0) {
1202     return EFI_SUCCESS;
1203   }
1204
1205   //
1206   // Update the executable permissions according to the DXE memory
1207   // protection policy, but only if
1208   // - the policy is different between the old and the new type, or
1209   // - this is a newly added region (OldType == EfiMaxMemoryType)
1210   //
1211   NewAttributes = GetPermissionAttributeForMemoryType (NewType);
1212
1213   if (OldType != EfiMaxMemoryType) {
1214     OldAttributes = GetPermissionAttributeForMemoryType (OldType);
1215     if (OldAttributes == NewAttributes) {
1216       // policy is the same between OldType and NewType
1217       return EFI_SUCCESS;
1218     }
1219   } else if (NewAttributes == 0) {
1220     // newly added region of a type that does not require protection
1221     return EFI_SUCCESS;
1222   }
1223
1224   return gCpu->SetMemoryAttributes (gCpu, Memory, Length, NewAttributes);
1225 }