MdeModulePkg/Core/Dxe/Misc/MemoryProtection.c

   1 /** @file
   2   UEFI Memory Protection support.
   3
   4   If the UEFI image is page aligned, the image code section is set to read only
   5   and the image data section is set to non-executable.
   6
   7   1) This policy is applied for all UEFI image including boot service driver,
   8      runtime driver or application.
   9   2) This policy is applied only if the UEFI image meets the page alignment
  10      requirement.
  11   3) This policy is applied only if the Source UEFI image matches the
  12      PcdImageProtectionPolicy definition.
  13   4) This policy is not applied to the non-PE image region.
  14
  15   The DxeCore calls CpuArchProtocol->SetMemoryAttributes() to protect
  16   the image. If the CpuArch protocol is not installed yet, the DxeCore
  17   enqueues the protection request. Once the CpuArch is installed, the
  18   DxeCore dequeues the protection request and applies policy.
  19
  20   Once the image is unloaded, the protection is removed automatically.
  21
  22 Copyright (c) 2017, Intel Corporation. All rights reserved.<BR>
  23 This program and the accompanying materials
  24 are licensed and made available under the terms and conditions of the BSD License
  25 which accompanies this distribution.  The full text of the license may be found at
  26 http://opensource.org/licenses/bsd-license.php
  27
  28 THE PROGRAM IS DISTRIBUTED UNDER THE BSD LICENSE ON AN "AS IS" BASIS,
  29 WITHOUT WARRANTIES OR REPRESENTATIONS OF ANY KIND, EITHER EXPRESS OR IMPLIED.
  30
  31 **/
  32
  33 #include <PiDxe.h>
  34 #include <Library/BaseLib.h>
  35 #include <Library/BaseMemoryLib.h>
  36 #include <Library/MemoryAllocationLib.h>
  37 #include <Library/UefiBootServicesTableLib.h>
  38 #include <Library/DxeServicesTableLib.h>
  39 #include <Library/DebugLib.h>
  40 #include <Library/UefiLib.h>
  41
  42 #include <Guid/EventGroup.h>
  43 #include <Guid/MemoryAttributesTable.h>
  44 #include <Guid/PropertiesTable.h>
  45
  46 #include <Protocol/FirmwareVolume2.h>
  47 #include <Protocol/BlockIo.h>
  48 #include <Protocol/SimpleFileSystem.h>
  49
  50 #include "DxeMain.h"
  51
  52 #define CACHE_ATTRIBUTE_MASK   (EFI_MEMORY_UC | EFI_MEMORY_WC | EFI_MEMORY_WT | EFI_MEMORY_WB | EFI_MEMORY_UCE | EFI_MEMORY_WP)
  53 #define MEMORY_ATTRIBUTE_MASK  (EFI_MEMORY_RP | EFI_MEMORY_XP | EFI_MEMORY_RO)
  54
  55 //
  56 // Image type definitions
  57 //
  58 #define IMAGE_UNKNOWN                         0x00000001
  59 #define IMAGE_FROM_FV                         0x00000002
  60
  61 //
  62 // Protection policy bit definition
  63 //
  64 #define DO_NOT_PROTECT                         0x00000000
  65 #define PROTECT_IF_ALIGNED_ELSE_ALLOW          0x00000001
  66
  67 #define MEMORY_TYPE_OS_RESERVED_MIN            0x80000000
  68 #define MEMORY_TYPE_OEM_RESERVED_MIN           0x70000000
  69
  70 #define PREVIOUS_MEMORY_DESCRIPTOR(MemoryDescriptor, Size) \
  71   ((EFI_MEMORY_DESCRIPTOR *)((UINT8 *)(MemoryDescriptor) - (Size)))
  72
  73 UINT32   mImageProtectionPolicy;
  74
  75 extern LIST_ENTRY         mGcdMemorySpaceMap;
  76
  77 STATIC LIST_ENTRY         mProtectedImageRecordList;
  78
  79 /**
  80   Sort code section in image record, based upon CodeSegmentBase from low to high.
  81
  82   @param  ImageRecord    image record to be sorted
  83 **/
  84 VOID
  85 SortImageRecordCodeSection (
  86   IN IMAGE_PROPERTIES_RECORD              *ImageRecord
  87   );
  88
  89 /**
  90   Check if code section in image record is valid.
  91
  92   @param  ImageRecord    image record to be checked
  93
  94   @retval TRUE  image record is valid
  95   @retval FALSE image record is invalid
  96 **/
  97 BOOLEAN
  98 IsImageRecordCodeSectionValid (
  99   IN IMAGE_PROPERTIES_RECORD              *ImageRecord
 100   );
 101
 102 /**
 103   Get the image type.
 104
 105   @param[in]    File       This is a pointer to the device path of the file that is
 106                            being dispatched.
 107
 108   @return UINT32           Image Type
 109 **/
 110 UINT32
 111 GetImageType (
 112   IN  CONST EFI_DEVICE_PATH_PROTOCOL   *File
 113   )
 114 {
 115   EFI_STATUS                        Status;
 116   EFI_HANDLE                        DeviceHandle;
 117   EFI_DEVICE_PATH_PROTOCOL          *TempDevicePath;
 118
 119   if (File == NULL) {
 120     return IMAGE_UNKNOWN;
 121   }
 122
 123   //
 124   // First check to see if File is from a Firmware Volume
 125   //
 126   DeviceHandle      = NULL;
 127   TempDevicePath = (EFI_DEVICE_PATH_PROTOCOL *) File;
 128   Status = gBS->LocateDevicePath (
 129                   &gEfiFirmwareVolume2ProtocolGuid,
 130                   &TempDevicePath,
 131                   &DeviceHandle
 132                   );
 133   if (!EFI_ERROR (Status)) {
 134     Status = gBS->OpenProtocol (
 135                     DeviceHandle,
 136                     &gEfiFirmwareVolume2ProtocolGuid,
 137                     NULL,
 138                     NULL,
 139                     NULL,
 140                     EFI_OPEN_PROTOCOL_TEST_PROTOCOL
 141                     );
 142     if (!EFI_ERROR (Status)) {
 143       return IMAGE_FROM_FV;
 144     }
 145   }
 146   return IMAGE_UNKNOWN;
 147 }
 148
 149 /**
 150   Get UEFI image protection policy based upon image type.
 151
 152   @param[in]  ImageType    The UEFI image type
 153
 154   @return UEFI image protection policy
 155 **/
 156 UINT32
 157 GetProtectionPolicyFromImageType (
 158   IN UINT32  ImageType
 159   )
 160 {
 161   if ((ImageType & mImageProtectionPolicy) == 0) {
 162     return DO_NOT_PROTECT;
 163   } else {
 164     return PROTECT_IF_ALIGNED_ELSE_ALLOW;
 165   }
 166 }
 167
 168 /**
 169   Get UEFI image protection policy based upon loaded image device path.
 170
 171   @param[in]  LoadedImage              The loaded image protocol
 172   @param[in]  LoadedImageDevicePath    The loaded image device path protocol
 173
 174   @return UEFI image protection policy
 175 **/
 176 UINT32
 177 GetUefiImageProtectionPolicy (
 178   IN EFI_LOADED_IMAGE_PROTOCOL   *LoadedImage,
 179   IN EFI_DEVICE_PATH_PROTOCOL    *LoadedImageDevicePath
 180   )
 181 {
 182   BOOLEAN     InSmm;
 183   UINT32      ImageType;
 184   UINT32      ProtectionPolicy;
 185
 186   //
 187   // Check SMM
 188   //
 189   InSmm = FALSE;
 190   if (gSmmBase2 != NULL) {
 191     gSmmBase2->InSmm (gSmmBase2, &InSmm);
 192   }
 193   if (InSmm) {
 194     return FALSE;
 195   }
 196
 197   //
 198   // Check DevicePath
 199   //
 200   if (LoadedImage == gDxeCoreLoadedImage) {
 201     ImageType = IMAGE_FROM_FV;
 202   } else {
 203     ImageType = GetImageType (LoadedImageDevicePath);
 204   }
 205   ProtectionPolicy = GetProtectionPolicyFromImageType (ImageType);
 206   return ProtectionPolicy;
 207 }
 208
 209
 210 /**
 211   Set UEFI image memory attributes.
 212
 213   @param[in]  BaseAddress            Specified start address
 214   @param[in]  Length                 Specified length
 215   @param[in]  Attributes             Specified attributes
 216 **/
 217 VOID
 218 SetUefiImageMemoryAttributes (
 219   IN UINT64   BaseAddress,
 220   IN UINT64   Length,
 221   IN UINT64   Attributes
 222   )
 223 {
 224   EFI_STATUS                       Status;
 225   EFI_GCD_MEMORY_SPACE_DESCRIPTOR  Descriptor;
 226   UINT64                           FinalAttributes;
 227
 228   Status = CoreGetMemorySpaceDescriptor(BaseAddress, &Descriptor);
 229   ASSERT_EFI_ERROR(Status);
 230
 231   FinalAttributes = (Descriptor.Attributes & CACHE_ATTRIBUTE_MASK) | (Attributes & MEMORY_ATTRIBUTE_MASK);
 232
 233   DEBUG ((DEBUG_INFO, "SetUefiImageMemoryAttributes - 0x%016lx - 0x%016lx (0x%016lx)\n", BaseAddress, Length, FinalAttributes));
 234
 235   ASSERT(gCpu != NULL);
 236   gCpu->SetMemoryAttributes (gCpu, BaseAddress, Length, FinalAttributes);
 237 }
 238
 239 /**
 240   Set UEFI image protection attributes.
 241
 242   @param[in]  ImageRecord    A UEFI image record
 243 **/
 244 VOID
 245 SetUefiImageProtectionAttributes (
 246   IN IMAGE_PROPERTIES_RECORD     *ImageRecord
 247   )
 248 {
 249   IMAGE_PROPERTIES_RECORD_CODE_SECTION      *ImageRecordCodeSection;
 250   LIST_ENTRY                                *ImageRecordCodeSectionLink;
 251   LIST_ENTRY                                *ImageRecordCodeSectionEndLink;
 252   LIST_ENTRY                                *ImageRecordCodeSectionList;
 253   UINT64                                    CurrentBase;
 254   UINT64                                    ImageEnd;
 255
 256   ImageRecordCodeSectionList = &ImageRecord->CodeSegmentList;
 257
 258   CurrentBase = ImageRecord->ImageBase;
 259   ImageEnd    = ImageRecord->ImageBase + ImageRecord->ImageSize;
 260
 261   ImageRecordCodeSectionLink = ImageRecordCodeSectionList->ForwardLink;
 262   ImageRecordCodeSectionEndLink = ImageRecordCodeSectionList;
 263   while (ImageRecordCodeSectionLink != ImageRecordCodeSectionEndLink) {
 264     ImageRecordCodeSection = CR (
 265                                ImageRecordCodeSectionLink,
 266                                IMAGE_PROPERTIES_RECORD_CODE_SECTION,
 267                                Link,
 268                                IMAGE_PROPERTIES_RECORD_CODE_SECTION_SIGNATURE
 269                                );
 270     ImageRecordCodeSectionLink = ImageRecordCodeSectionLink->ForwardLink;
 271
 272     ASSERT (CurrentBase <= ImageRecordCodeSection->CodeSegmentBase);
 273     if (CurrentBase < ImageRecordCodeSection->CodeSegmentBase) {
 274       //
 275       // DATA
 276       //
 277       SetUefiImageMemoryAttributes (
 278         CurrentBase,
 279         ImageRecordCodeSection->CodeSegmentBase - CurrentBase,
 280         EFI_MEMORY_XP
 281         );
 282     }
 283     //
 284     // CODE
 285     //
 286     SetUefiImageMemoryAttributes (
 287       ImageRecordCodeSection->CodeSegmentBase,
 288       ImageRecordCodeSection->CodeSegmentSize,
 289       EFI_MEMORY_RO
 290       );
 291     CurrentBase = ImageRecordCodeSection->CodeSegmentBase + ImageRecordCodeSection->CodeSegmentSize;
 292   }
 293   //
 294   // Last DATA
 295   //
 296   ASSERT (CurrentBase <= ImageEnd);
 297   if (CurrentBase < ImageEnd) {
 298     //
 299     // DATA
 300     //
 301     SetUefiImageMemoryAttributes (
 302       CurrentBase,
 303       ImageEnd - CurrentBase,
 304       EFI_MEMORY_XP
 305       );
 306   }
 307   return ;
 308 }
 309
 310 /**
 311   Return if the PE image section is aligned.
 312
 313   @param[in]  SectionAlignment    PE/COFF section alignment
 314   @param[in]  MemoryType          PE/COFF image memory type
 315
 316   @retval TRUE  The PE image section is aligned.
 317   @retval FALSE The PE image section is not aligned.
 318 **/
 319 BOOLEAN
 320 IsMemoryProtectionSectionAligned (
 321   IN UINT32           SectionAlignment,
 322   IN EFI_MEMORY_TYPE  MemoryType
 323   )
 324 {
 325   UINT32  PageAlignment;
 326
 327   switch (MemoryType) {
 328   case EfiRuntimeServicesCode:
 329   case EfiACPIMemoryNVS:
 330     PageAlignment = RUNTIME_PAGE_ALLOCATION_GRANULARITY;
 331     break;
 332   case EfiRuntimeServicesData:
 333   case EfiACPIReclaimMemory:
 334     ASSERT (FALSE);
 335     PageAlignment = RUNTIME_PAGE_ALLOCATION_GRANULARITY;
 336     break;
 337   case EfiBootServicesCode:
 338   case EfiLoaderCode:
 339   case EfiReservedMemoryType:
 340     PageAlignment = EFI_PAGE_SIZE;
 341     break;
 342   default:
 343     ASSERT (FALSE);
 344     PageAlignment = EFI_PAGE_SIZE;
 345     break;
 346   }
 347
 348   if ((SectionAlignment & (PageAlignment - 1)) != 0) {
 349     return FALSE;
 350   } else {
 351     return TRUE;
 352   }
 353 }
 354
 355 /**
 356   Free Image record.
 357
 358   @param[in]  ImageRecord    A UEFI image record
 359 **/
 360 VOID
 361 FreeImageRecord (
 362   IN IMAGE_PROPERTIES_RECORD              *ImageRecord
 363   )
 364 {
 365   LIST_ENTRY                           *CodeSegmentListHead;
 366   IMAGE_PROPERTIES_RECORD_CODE_SECTION *ImageRecordCodeSection;
 367
 368   CodeSegmentListHead = &ImageRecord->CodeSegmentList;
 369   while (!IsListEmpty (CodeSegmentListHead)) {
 370     ImageRecordCodeSection = CR (
 371                                CodeSegmentListHead->ForwardLink,
 372                                IMAGE_PROPERTIES_RECORD_CODE_SECTION,
 373                                Link,
 374                                IMAGE_PROPERTIES_RECORD_CODE_SECTION_SIGNATURE
 375                                );
 376     RemoveEntryList (&ImageRecordCodeSection->Link);
 377     FreePool (ImageRecordCodeSection);
 378   }
 379
 380   if (ImageRecord->Link.ForwardLink != NULL) {
 381     RemoveEntryList (&ImageRecord->Link);
 382   }
 383   FreePool (ImageRecord);
 384 }
 385
 386 /**
 387   Protect UEFI PE/COFF image.
 388
 389   @param[in]  LoadedImage              The loaded image protocol
 390   @param[in]  LoadedImageDevicePath    The loaded image device path protocol
 391 **/
 392 VOID
 393 ProtectUefiImage (
 394   IN EFI_LOADED_IMAGE_PROTOCOL   *LoadedImage,
 395   IN EFI_DEVICE_PATH_PROTOCOL    *LoadedImageDevicePath
 396   )
 397 {
 398   VOID                                 *ImageAddress;
 399   EFI_IMAGE_DOS_HEADER                 *DosHdr;
 400   UINT32                               PeCoffHeaderOffset;
 401   UINT32                               SectionAlignment;
 402   EFI_IMAGE_SECTION_HEADER             *Section;
 403   EFI_IMAGE_OPTIONAL_HEADER_PTR_UNION  Hdr;
 404   UINT8                                *Name;
 405   UINTN                                Index;
 406   IMAGE_PROPERTIES_RECORD              *ImageRecord;
 407   CHAR8                                *PdbPointer;
 408   IMAGE_PROPERTIES_RECORD_CODE_SECTION *ImageRecordCodeSection;
 409   UINT16                               Magic;
 410   BOOLEAN                              IsAligned;
 411   UINT32                               ProtectionPolicy;
 412
 413   DEBUG ((DEBUG_INFO, "ProtectUefiImageCommon - 0x%x\n", LoadedImage));
 414   DEBUG ((DEBUG_INFO, "  - 0x%016lx - 0x%016lx\n", (EFI_PHYSICAL_ADDRESS)(UINTN)LoadedImage->ImageBase, LoadedImage->ImageSize));
 415
 416   if (gCpu == NULL) {
 417     return ;
 418   }
 419
 420   ProtectionPolicy = GetUefiImageProtectionPolicy (LoadedImage, LoadedImageDevicePath);
 421   switch (ProtectionPolicy) {
 422   case DO_NOT_PROTECT:
 423     return ;
 424   case PROTECT_IF_ALIGNED_ELSE_ALLOW:
 425     break;
 426   default:
 427     ASSERT(FALSE);
 428     return ;
 429   }
 430
 431   ImageRecord = AllocateZeroPool (sizeof(*ImageRecord));
 432   if (ImageRecord == NULL) {
 433     return ;
 434   }
 435   ImageRecord->Signature = IMAGE_PROPERTIES_RECORD_SIGNATURE;
 436
 437   //
 438   // Step 1: record whole region
 439   //
 440   ImageRecord->ImageBase = (EFI_PHYSICAL_ADDRESS)(UINTN)LoadedImage->ImageBase;
 441   ImageRecord->ImageSize = LoadedImage->ImageSize;
 442
 443   ImageAddress = LoadedImage->ImageBase;
 444
 445   PdbPointer = PeCoffLoaderGetPdbPointer ((VOID*) (UINTN) ImageAddress);
 446   if (PdbPointer != NULL) {
 447     DEBUG ((DEBUG_VERBOSE, "  Image - %a\n", PdbPointer));
 448   }
 449
 450   //
 451   // Check PE/COFF image
 452   //
 453   DosHdr = (EFI_IMAGE_DOS_HEADER *) (UINTN) ImageAddress;
 454   PeCoffHeaderOffset = 0;
 455   if (DosHdr->e_magic == EFI_IMAGE_DOS_SIGNATURE) {
 456     PeCoffHeaderOffset = DosHdr->e_lfanew;
 457   }
 458
 459   Hdr.Pe32 = (EFI_IMAGE_NT_HEADERS32 *)((UINT8 *) (UINTN) ImageAddress + PeCoffHeaderOffset);
 460   if (Hdr.Pe32->Signature != EFI_IMAGE_NT_SIGNATURE) {
 461     DEBUG ((DEBUG_VERBOSE, "Hdr.Pe32->Signature invalid - 0x%x\n", Hdr.Pe32->Signature));
 462     // It might be image in SMM.
 463     goto Finish;
 464   }
 465
 466   //
 467   // Get SectionAlignment
 468   //
 469   if (Hdr.Pe32->FileHeader.Machine == IMAGE_FILE_MACHINE_IA64 && Hdr.Pe32->OptionalHeader.Magic == EFI_IMAGE_NT_OPTIONAL_HDR32_MAGIC) {
 470     //
 471     // NOTE: Some versions of Linux ELILO for Itanium have an incorrect magic value
 472     //       in the PE/COFF Header. If the MachineType is Itanium(IA64) and the
 473     //       Magic value in the OptionalHeader is EFI_IMAGE_NT_OPTIONAL_HDR32_MAGIC
 474     //       then override the magic value to EFI_IMAGE_NT_OPTIONAL_HDR64_MAGIC
 475     //
 476     Magic = EFI_IMAGE_NT_OPTIONAL_HDR64_MAGIC;
 477   } else {
 478     //
 479     // Get the magic value from the PE/COFF Optional Header
 480     //
 481     Magic = Hdr.Pe32->OptionalHeader.Magic;
 482   }
 483   if (Magic == EFI_IMAGE_NT_OPTIONAL_HDR32_MAGIC) {
 484     SectionAlignment  = Hdr.Pe32->OptionalHeader.SectionAlignment;
 485   } else {
 486     SectionAlignment  = Hdr.Pe32Plus->OptionalHeader.SectionAlignment;
 487   }
 488
 489   IsAligned = IsMemoryProtectionSectionAligned (SectionAlignment, LoadedImage->ImageCodeType);
 490   if (!IsAligned) {
 491     DEBUG ((DEBUG_VERBOSE, "!!!!!!!!  ProtectUefiImageCommon - Section Alignment(0x%x) is incorrect  !!!!!!!!\n",
 492       SectionAlignment));
 493     PdbPointer = PeCoffLoaderGetPdbPointer ((VOID*) (UINTN) ImageAddress);
 494     if (PdbPointer != NULL) {
 495       DEBUG ((DEBUG_VERBOSE, "!!!!!!!!  Image - %a  !!!!!!!!\n", PdbPointer));
 496     }
 497     goto Finish;
 498   }
 499
 500   Section = (EFI_IMAGE_SECTION_HEADER *) (
 501                (UINT8 *) (UINTN) ImageAddress +
 502                PeCoffHeaderOffset +
 503                sizeof(UINT32) +
 504                sizeof(EFI_IMAGE_FILE_HEADER) +
 505                Hdr.Pe32->FileHeader.SizeOfOptionalHeader
 506                );
 507   ImageRecord->CodeSegmentCount = 0;
 508   InitializeListHead (&ImageRecord->CodeSegmentList);
 509   for (Index = 0; Index < Hdr.Pe32->FileHeader.NumberOfSections; Index++) {
 510     Name = Section[Index].Name;
 511     DEBUG ((
 512       DEBUG_VERBOSE,
 513       "  Section - '%c%c%c%c%c%c%c%c'\n",
 514       Name[0],
 515       Name[1],
 516       Name[2],
 517       Name[3],
 518       Name[4],
 519       Name[5],
 520       Name[6],
 521       Name[7]
 522       ));
 523
 524     //
 525     // Instead of assuming that a PE/COFF section of type EFI_IMAGE_SCN_CNT_CODE
 526     // can always be mapped read-only, classify a section as a code section only
 527     // if it has the executable attribute set and the writable attribute cleared.
 528     //
 529     // This adheres more closely to the PE/COFF spec, and avoids issues with
 530     // Linux OS loaders that may consist of a single read/write/execute section.
 531     //
 532     if ((Section[Index].Characteristics & (EFI_IMAGE_SCN_MEM_WRITE | EFI_IMAGE_SCN_MEM_EXECUTE)) == EFI_IMAGE_SCN_MEM_EXECUTE) {
 533       DEBUG ((DEBUG_VERBOSE, "  VirtualSize          - 0x%08x\n", Section[Index].Misc.VirtualSize));
 534       DEBUG ((DEBUG_VERBOSE, "  VirtualAddress       - 0x%08x\n", Section[Index].VirtualAddress));
 535       DEBUG ((DEBUG_VERBOSE, "  SizeOfRawData        - 0x%08x\n", Section[Index].SizeOfRawData));
 536       DEBUG ((DEBUG_VERBOSE, "  PointerToRawData     - 0x%08x\n", Section[Index].PointerToRawData));
 537       DEBUG ((DEBUG_VERBOSE, "  PointerToRelocations - 0x%08x\n", Section[Index].PointerToRelocations));
 538       DEBUG ((DEBUG_VERBOSE, "  PointerToLinenumbers - 0x%08x\n", Section[Index].PointerToLinenumbers));
 539       DEBUG ((DEBUG_VERBOSE, "  NumberOfRelocations  - 0x%08x\n", Section[Index].NumberOfRelocations));
 540       DEBUG ((DEBUG_VERBOSE, "  NumberOfLinenumbers  - 0x%08x\n", Section[Index].NumberOfLinenumbers));
 541       DEBUG ((DEBUG_VERBOSE, "  Characteristics      - 0x%08x\n", Section[Index].Characteristics));
 542
 543       //
 544       // Step 2: record code section
 545       //
 546       ImageRecordCodeSection = AllocatePool (sizeof(*ImageRecordCodeSection));
 547       if (ImageRecordCodeSection == NULL) {
 548         return ;
 549       }
 550       ImageRecordCodeSection->Signature = IMAGE_PROPERTIES_RECORD_CODE_SECTION_SIGNATURE;
 551
 552       ImageRecordCodeSection->CodeSegmentBase = (UINTN)ImageAddress + Section[Index].VirtualAddress;
 553       ImageRecordCodeSection->CodeSegmentSize = ALIGN_VALUE(Section[Index].SizeOfRawData, SectionAlignment);
 554
 555       DEBUG ((DEBUG_VERBOSE, "ImageCode: 0x%016lx - 0x%016lx\n", ImageRecordCodeSection->CodeSegmentBase, ImageRecordCodeSection->CodeSegmentSize));
 556
 557       InsertTailList (&ImageRecord->CodeSegmentList, &ImageRecordCodeSection->Link);
 558       ImageRecord->CodeSegmentCount++;
 559     }
 560   }
 561
 562   if (ImageRecord->CodeSegmentCount == 0) {
 563     //
 564     // If a UEFI executable consists of a single read+write+exec PE/COFF
 565     // section, that isn't actually an error. The image can be launched
 566     // alright, only image protection cannot be applied to it fully.
 567     //
 568     // One example that elicits this is (some) Linux kernels (with the EFI stub
 569     // of course).
 570     //
 571     DEBUG ((DEBUG_WARN, "!!!!!!!!  ProtectUefiImageCommon - CodeSegmentCount is 0  !!!!!!!!\n"));
 572     PdbPointer = PeCoffLoaderGetPdbPointer ((VOID*) (UINTN) ImageAddress);
 573     if (PdbPointer != NULL) {
 574       DEBUG ((DEBUG_WARN, "!!!!!!!!  Image - %a  !!!!!!!!\n", PdbPointer));
 575     }
 576     goto Finish;
 577   }
 578
 579   //
 580   // Final
 581   //
 582   SortImageRecordCodeSection (ImageRecord);
 583   //
 584   // Check overlap all section in ImageBase/Size
 585   //
 586   if (!IsImageRecordCodeSectionValid (ImageRecord)) {
 587     DEBUG ((DEBUG_ERROR, "IsImageRecordCodeSectionValid - FAIL\n"));
 588     goto Finish;
 589   }
 590
 591   //
 592   // Round up the ImageSize, some CPU arch may return EFI_UNSUPPORTED if ImageSize is not aligned.
 593   // Given that the loader always allocates full pages, we know the space after the image is not used.
 594   //
 595   ImageRecord->ImageSize = ALIGN_VALUE(LoadedImage->ImageSize, EFI_PAGE_SIZE);
 596
 597   //
 598   // CPU ARCH present. Update memory attribute directly.
 599   //
 600   SetUefiImageProtectionAttributes (ImageRecord);
 601
 602   //
 603   // Record the image record in the list so we can undo the protections later
 604   //
 605   InsertTailList (&mProtectedImageRecordList, &ImageRecord->Link);
 606
 607 Finish:
 608   return ;
 609 }
 610
 611 /**
 612   Unprotect UEFI image.
 613
 614   @param[in]  LoadedImage              The loaded image protocol
 615   @param[in]  LoadedImageDevicePath    The loaded image device path protocol
 616 **/
 617 VOID
 618 UnprotectUefiImage (
 619   IN EFI_LOADED_IMAGE_PROTOCOL   *LoadedImage,
 620   IN EFI_DEVICE_PATH_PROTOCOL    *LoadedImageDevicePath
 621   )
 622 {
 623   IMAGE_PROPERTIES_RECORD    *ImageRecord;
 624   LIST_ENTRY                 *ImageRecordLink;
 625
 626   if (PcdGet32(PcdImageProtectionPolicy) != 0) {
 627     for (ImageRecordLink = mProtectedImageRecordList.ForwardLink;
 628          ImageRecordLink != &mProtectedImageRecordList;
 629          ImageRecordLink = ImageRecordLink->ForwardLink) {
 630       ImageRecord = CR (
 631                       ImageRecordLink,
 632                       IMAGE_PROPERTIES_RECORD,
 633                       Link,
 634                       IMAGE_PROPERTIES_RECORD_SIGNATURE
 635                       );
 636
 637       if (ImageRecord->ImageBase == (EFI_PHYSICAL_ADDRESS)(UINTN)LoadedImage->ImageBase) {
 638         SetUefiImageMemoryAttributes (ImageRecord->ImageBase,
 639                                       ImageRecord->ImageSize,
 640                                       0);
 641         FreeImageRecord (ImageRecord);
 642         return;
 643       }
 644     }
 645   }
 646 }
 647
 648 /**
 649   Return the EFI memory permission attribute associated with memory
 650   type 'MemoryType' under the configured DXE memory protection policy.
 651
 652   @param MemoryType       Memory type.
 653 **/
 654 STATIC
 655 UINT64
 656 GetPermissionAttributeForMemoryType (
 657   IN EFI_MEMORY_TYPE    MemoryType
 658   )
 659 {
 660   UINT64 TestBit;
 661
 662   if ((UINT32)MemoryType >= MEMORY_TYPE_OS_RESERVED_MIN) {
 663     TestBit = BIT63;
 664   } else if ((UINT32)MemoryType >= MEMORY_TYPE_OEM_RESERVED_MIN) {
 665     TestBit = BIT62;
 666   } else {
 667     TestBit = LShiftU64 (1, MemoryType);
 668   }
 669
 670   if ((PcdGet64 (PcdDxeNxMemoryProtectionPolicy) & TestBit) != 0) {
 671     return EFI_MEMORY_XP;
 672   } else {
 673     return 0;
 674   }
 675 }
 676
 677 /**
 678   Sort memory map entries based upon PhysicalStart, from low to high.
 679
 680   @param  MemoryMap              A pointer to the buffer in which firmware places
 681                                  the current memory map.
 682   @param  MemoryMapSize          Size, in bytes, of the MemoryMap buffer.
 683   @param  DescriptorSize         Size, in bytes, of an individual EFI_MEMORY_DESCRIPTOR.
 684 **/
 685 STATIC
 686 VOID
 687 SortMemoryMap (
 688   IN OUT EFI_MEMORY_DESCRIPTOR  *MemoryMap,
 689   IN UINTN                      MemoryMapSize,
 690   IN UINTN                      DescriptorSize
 691   )
 692 {
 693   EFI_MEMORY_DESCRIPTOR       *MemoryMapEntry;
 694   EFI_MEMORY_DESCRIPTOR       *NextMemoryMapEntry;
 695   EFI_MEMORY_DESCRIPTOR       *MemoryMapEnd;
 696   EFI_MEMORY_DESCRIPTOR       TempMemoryMap;
 697
 698   MemoryMapEntry = MemoryMap;
 699   NextMemoryMapEntry = NEXT_MEMORY_DESCRIPTOR (MemoryMapEntry, DescriptorSize);
 700   MemoryMapEnd = (EFI_MEMORY_DESCRIPTOR *) ((UINT8 *) MemoryMap + MemoryMapSize);
 701   while (MemoryMapEntry < MemoryMapEnd) {
 702     while (NextMemoryMapEntry < MemoryMapEnd) {
 703       if (MemoryMapEntry->PhysicalStart > NextMemoryMapEntry->PhysicalStart) {
 704         CopyMem (&TempMemoryMap, MemoryMapEntry, sizeof(EFI_MEMORY_DESCRIPTOR));
 705         CopyMem (MemoryMapEntry, NextMemoryMapEntry, sizeof(EFI_MEMORY_DESCRIPTOR));
 706         CopyMem (NextMemoryMapEntry, &TempMemoryMap, sizeof(EFI_MEMORY_DESCRIPTOR));
 707       }
 708
 709       NextMemoryMapEntry = NEXT_MEMORY_DESCRIPTOR (NextMemoryMapEntry, DescriptorSize);
 710     }
 711
 712     MemoryMapEntry      = NEXT_MEMORY_DESCRIPTOR (MemoryMapEntry, DescriptorSize);
 713     NextMemoryMapEntry  = NEXT_MEMORY_DESCRIPTOR (MemoryMapEntry, DescriptorSize);
 714   }
 715 }
 716
 717 /**
 718   Merge adjacent memory map entries if they use the same memory protection policy
 719
 720   @param[in, out]  MemoryMap              A pointer to the buffer in which firmware places
 721                                           the current memory map.
 722   @param[in, out]  MemoryMapSize          A pointer to the size, in bytes, of the
 723                                           MemoryMap buffer. On input, this is the size of
 724                                           the current memory map.  On output,
 725                                           it is the size of new memory map after merge.
 726   @param[in]       DescriptorSize         Size, in bytes, of an individual EFI_MEMORY_DESCRIPTOR.
 727 **/
 728 STATIC
 729 VOID
 730 MergeMemoryMapForProtectionPolicy (
 731   IN OUT EFI_MEMORY_DESCRIPTOR  *MemoryMap,
 732   IN OUT UINTN                  *MemoryMapSize,
 733   IN UINTN                      DescriptorSize
 734   )
 735 {
 736   EFI_MEMORY_DESCRIPTOR       *MemoryMapEntry;
 737   EFI_MEMORY_DESCRIPTOR       *MemoryMapEnd;
 738   UINT64                      MemoryBlockLength;
 739   EFI_MEMORY_DESCRIPTOR       *NewMemoryMapEntry;
 740   EFI_MEMORY_DESCRIPTOR       *NextMemoryMapEntry;
 741   UINT64                      Attributes;
 742
 743   SortMemoryMap (MemoryMap, *MemoryMapSize, DescriptorSize);
 744
 745   MemoryMapEntry = MemoryMap;
 746   NewMemoryMapEntry = MemoryMap;
 747   MemoryMapEnd = (EFI_MEMORY_DESCRIPTOR *) ((UINT8 *) MemoryMap + *MemoryMapSize);
 748   while ((UINTN)MemoryMapEntry < (UINTN)MemoryMapEnd) {
 749     CopyMem (NewMemoryMapEntry, MemoryMapEntry, sizeof(EFI_MEMORY_DESCRIPTOR));
 750     NextMemoryMapEntry = NEXT_MEMORY_DESCRIPTOR (MemoryMapEntry, DescriptorSize);
 751
 752     do {
 753       MemoryBlockLength = (UINT64) (EFI_PAGES_TO_SIZE((UINTN)MemoryMapEntry->NumberOfPages));
 754       Attributes = GetPermissionAttributeForMemoryType (MemoryMapEntry->Type);
 755
 756       if (((UINTN)NextMemoryMapEntry < (UINTN)MemoryMapEnd) &&
 757           Attributes == GetPermissionAttributeForMemoryType (NextMemoryMapEntry->Type) &&
 758           ((MemoryMapEntry->PhysicalStart + MemoryBlockLength) == NextMemoryMapEntry->PhysicalStart)) {
 759         MemoryMapEntry->NumberOfPages += NextMemoryMapEntry->NumberOfPages;
 760         if (NewMemoryMapEntry != MemoryMapEntry) {
 761           NewMemoryMapEntry->NumberOfPages += NextMemoryMapEntry->NumberOfPages;
 762         }
 763
 764         NextMemoryMapEntry = NEXT_MEMORY_DESCRIPTOR (NextMemoryMapEntry, DescriptorSize);
 765         continue;
 766       } else {
 767         MemoryMapEntry = PREVIOUS_MEMORY_DESCRIPTOR (NextMemoryMapEntry, DescriptorSize);
 768         break;
 769       }
 770     } while (TRUE);
 771
 772     MemoryMapEntry = NEXT_MEMORY_DESCRIPTOR (MemoryMapEntry, DescriptorSize);
 773     NewMemoryMapEntry = NEXT_MEMORY_DESCRIPTOR (NewMemoryMapEntry, DescriptorSize);
 774   }
 775
 776   *MemoryMapSize = (UINTN)NewMemoryMapEntry - (UINTN)MemoryMap;
 777
 778   return ;
 779 }
 780
 781
 782 /**
 783   Remove exec permissions from all regions whose type is identified by
 784   PcdDxeNxMemoryProtectionPolicy.
 785 **/
 786 STATIC
 787 VOID
 788 InitializeDxeNxMemoryProtectionPolicy (
 789   VOID
 790   )
 791 {
 792   UINTN                             MemoryMapSize;
 793   UINTN                             MapKey;
 794   UINTN                             DescriptorSize;
 795   UINT32                            DescriptorVersion;
 796   EFI_MEMORY_DESCRIPTOR             *MemoryMap;
 797   EFI_MEMORY_DESCRIPTOR             *MemoryMapEntry;
 798   EFI_MEMORY_DESCRIPTOR             *MemoryMapEnd;
 799   EFI_STATUS                        Status;
 800   UINT64                            Attributes;
 801   LIST_ENTRY                        *Link;
 802   EFI_GCD_MAP_ENTRY                 *Entry;
 803
 804   //
 805   // Get the EFI memory map.
 806   //
 807   MemoryMapSize = 0;
 808   MemoryMap     = NULL;
 809
 810   Status = gBS->GetMemoryMap (
 811                   &MemoryMapSize,
 812                   MemoryMap,
 813                   &MapKey,
 814                   &DescriptorSize,
 815                   &DescriptorVersion
 816                   );
 817   ASSERT (Status == EFI_BUFFER_TOO_SMALL);
 818   do {
 819     MemoryMap = (EFI_MEMORY_DESCRIPTOR *) AllocatePool (MemoryMapSize);
 820     ASSERT (MemoryMap != NULL);
 821     Status = gBS->GetMemoryMap (
 822                     &MemoryMapSize,
 823                     MemoryMap,
 824                     &MapKey,
 825                     &DescriptorSize,
 826                     &DescriptorVersion
 827                     );
 828     if (EFI_ERROR (Status)) {
 829       FreePool (MemoryMap);
 830     }
 831   } while (Status == EFI_BUFFER_TOO_SMALL);
 832   ASSERT_EFI_ERROR (Status);
 833
 834   DEBUG ((
 835     DEBUG_INFO,
 836     "%a: applying strict permissions to active memory regions\n",
 837     __FUNCTION__
 838     ));
 839
 840   MergeMemoryMapForProtectionPolicy (MemoryMap, &MemoryMapSize, DescriptorSize);
 841
 842   MemoryMapEntry = MemoryMap;
 843   MemoryMapEnd = (EFI_MEMORY_DESCRIPTOR *) ((UINT8 *) MemoryMap + MemoryMapSize);
 844   while ((UINTN) MemoryMapEntry < (UINTN) MemoryMapEnd) {
 845
 846     Attributes = GetPermissionAttributeForMemoryType (MemoryMapEntry->Type);
 847     if (Attributes != 0) {
 848       SetUefiImageMemoryAttributes (
 849         MemoryMapEntry->PhysicalStart,
 850         LShiftU64 (MemoryMapEntry->NumberOfPages, EFI_PAGE_SHIFT),
 851         Attributes);
 852     }
 853     MemoryMapEntry = NEXT_MEMORY_DESCRIPTOR (MemoryMapEntry, DescriptorSize);
 854   }
 855   FreePool (MemoryMap);
 856
 857   //
 858   // Apply the policy for RAM regions that we know are present and
 859   // accessible, but have not been added to the UEFI memory map (yet).
 860   //
 861   if (GetPermissionAttributeForMemoryType (EfiConventionalMemory) != 0) {
 862     DEBUG ((
 863       DEBUG_INFO,
 864       "%a: applying strict permissions to inactive memory regions\n",
 865       __FUNCTION__
 866       ));
 867
 868     CoreAcquireGcdMemoryLock ();
 869
 870     Link = mGcdMemorySpaceMap.ForwardLink;
 871     while (Link != &mGcdMemorySpaceMap) {
 872
 873       Entry = CR (Link, EFI_GCD_MAP_ENTRY, Link, EFI_GCD_MAP_SIGNATURE);
 874
 875       if (Entry->GcdMemoryType == EfiGcdMemoryTypeReserved &&
 876           Entry->EndAddress < MAX_ADDRESS &&
 877           (Entry->Capabilities & (EFI_MEMORY_PRESENT | EFI_MEMORY_INITIALIZED | EFI_MEMORY_TESTED)) ==
 878             (EFI_MEMORY_PRESENT | EFI_MEMORY_INITIALIZED)) {
 879
 880         Attributes = GetPermissionAttributeForMemoryType (EfiConventionalMemory) |
 881                      (Entry->Attributes & CACHE_ATTRIBUTE_MASK);
 882
 883         DEBUG ((DEBUG_INFO,
 884           "Untested GCD memory space region: - 0x%016lx - 0x%016lx (0x%016lx)\n",
 885           Entry->BaseAddress, Entry->EndAddress - Entry->BaseAddress + 1,
 886           Attributes));
 887
 888         ASSERT(gCpu != NULL);
 889         gCpu->SetMemoryAttributes (gCpu, Entry->BaseAddress,
 890           Entry->EndAddress - Entry->BaseAddress + 1, Attributes);
 891       }
 892
 893       Link = Link->ForwardLink;
 894     }
 895     CoreReleaseGcdMemoryLock ();
 896   }
 897 }
 898
 899
 900 /**
 901   A notification for CPU_ARCH protocol.
 902
 903   @param[in]  Event                 Event whose notification function is being invoked.
 904   @param[in]  Context               Pointer to the notification function's context,
 905                                     which is implementation-dependent.
 906
 907 **/
 908 VOID
 909 EFIAPI
 910 MemoryProtectionCpuArchProtocolNotify (
 911   IN EFI_EVENT                Event,
 912   IN VOID                     *Context
 913   )
 914 {
 915   EFI_STATUS                  Status;
 916   EFI_LOADED_IMAGE_PROTOCOL   *LoadedImage;
 917   EFI_DEVICE_PATH_PROTOCOL    *LoadedImageDevicePath;
 918   UINTN                       NoHandles;
 919   EFI_HANDLE                  *HandleBuffer;
 920   UINTN                       Index;
 921
 922   DEBUG ((DEBUG_INFO, "MemoryProtectionCpuArchProtocolNotify:\n"));
 923   Status = CoreLocateProtocol (&gEfiCpuArchProtocolGuid, NULL, (VOID **)&gCpu);
 924   if (EFI_ERROR (Status)) {
 925     return;
 926   }
 927
 928   //
 929   // Apply the memory protection policy on non-BScode/RTcode regions.
 930   //
 931   if (PcdGet64 (PcdDxeNxMemoryProtectionPolicy) != 0) {
 932     InitializeDxeNxMemoryProtectionPolicy ();
 933   }
 934
 935   if (mImageProtectionPolicy == 0) {
 936     return;
 937   }
 938
 939   Status = gBS->LocateHandleBuffer (
 940                   ByProtocol,
 941                   &gEfiLoadedImageProtocolGuid,
 942                   NULL,
 943                   &NoHandles,
 944                   &HandleBuffer
 945                   );
 946   if (EFI_ERROR (Status) && (NoHandles == 0)) {
 947     return ;
 948   }
 949
 950   for (Index = 0; Index < NoHandles; Index++) {
 951     Status = gBS->HandleProtocol (
 952                     HandleBuffer[Index],
 953                     &gEfiLoadedImageProtocolGuid,
 954                     (VOID **)&LoadedImage
 955                     );
 956     if (EFI_ERROR(Status)) {
 957       continue;
 958     }
 959     Status = gBS->HandleProtocol (
 960                     HandleBuffer[Index],
 961                     &gEfiLoadedImageDevicePathProtocolGuid,
 962                     (VOID **)&LoadedImageDevicePath
 963                     );
 964     if (EFI_ERROR(Status)) {
 965       LoadedImageDevicePath = NULL;
 966     }
 967
 968     ProtectUefiImage (LoadedImage, LoadedImageDevicePath);
 969   }
 970
 971   CoreCloseEvent (Event);
 972   return;
 973 }
 974
 975 /**
 976   ExitBootServices Callback function for memory protection.
 977 **/
 978 VOID
 979 MemoryProtectionExitBootServicesCallback (
 980   VOID
 981   )
 982 {
 983   EFI_RUNTIME_IMAGE_ENTRY       *RuntimeImage;
 984   LIST_ENTRY                    *Link;
 985
 986   //
 987   // We need remove the RT protection, because RT relocation need write code segment
 988   // at SetVirtualAddressMap(). We cannot assume OS/Loader has taken over page table at that time.
 989   //
 990   // Firmware does not own page tables after ExitBootServices(), so the OS would
 991   // have to relax protection of RT code pages across SetVirtualAddressMap(), or
 992   // delay setting protections on RT code pages until after SetVirtualAddressMap().
 993   // OS may set protection on RT based upon EFI_MEMORY_ATTRIBUTES_TABLE later.
 994   //
 995   if (mImageProtectionPolicy != 0) {
 996     for (Link = gRuntime->ImageHead.ForwardLink; Link != &gRuntime->ImageHead; Link = Link->ForwardLink) {
 997       RuntimeImage = BASE_CR (Link, EFI_RUNTIME_IMAGE_ENTRY, Link);
 998       SetUefiImageMemoryAttributes ((UINT64)(UINTN)RuntimeImage->ImageBase, ALIGN_VALUE(RuntimeImage->ImageSize, EFI_PAGE_SIZE), 0);
 999     }
1000   }
1001 }
1002
1003 /**
1004   Disable NULL pointer detection after EndOfDxe. This is a workaround resort in
1005   order to skip unfixable NULL pointer access issues detected in OptionROM or
1006   boot loaders.
1007
1008   @param[in]  Event     The Event this notify function registered to.
1009   @param[in]  Context   Pointer to the context data registered to the Event.
1010 **/
1011 VOID
1012 EFIAPI
1013 DisableNullDetectionAtTheEndOfDxe (
1014   EFI_EVENT                               Event,
1015   VOID                                    *Context
1016   )
1017 {
1018   EFI_STATUS                        Status;
1019   EFI_GCD_MEMORY_SPACE_DESCRIPTOR   Desc;
1020
1021   DEBUG ((DEBUG_INFO, "DisableNullDetectionAtTheEndOfDxe(): start\r\n"));
1022   //
1023   // Disable NULL pointer detection by enabling first 4K page
1024   //
1025   Status = CoreGetMemorySpaceDescriptor (0, &Desc);
1026   ASSERT_EFI_ERROR (Status);
1027
1028   if ((Desc.Capabilities & EFI_MEMORY_RP) == 0) {
1029     Status = CoreSetMemorySpaceCapabilities (
1030               0,
1031               EFI_PAGE_SIZE,
1032               Desc.Capabilities | EFI_MEMORY_RP
1033               );
1034     ASSERT_EFI_ERROR (Status);
1035   }
1036
1037   Status = CoreSetMemorySpaceAttributes (
1038             0,
1039             EFI_PAGE_SIZE,
1040             Desc.Attributes & ~EFI_MEMORY_RP
1041             );
1042   ASSERT_EFI_ERROR (Status);
1043
1044   CoreCloseEvent (Event);
1045   DEBUG ((DEBUG_INFO, "DisableNullDetectionAtTheEndOfDxe(): end\r\n"));
1046
1047   return;
1048 }
1049
1050 /**
1051   Initialize Memory Protection support.
1052 **/
1053 VOID
1054 EFIAPI
1055 CoreInitializeMemoryProtection (
1056   VOID
1057   )
1058 {
1059   EFI_STATUS  Status;
1060   EFI_EVENT   Event;
1061   EFI_EVENT   EndOfDxeEvent;
1062   VOID        *Registration;
1063
1064   mImageProtectionPolicy = PcdGet32(PcdImageProtectionPolicy);
1065
1066   InitializeListHead (&mProtectedImageRecordList);
1067
1068   //
1069   // Sanity check the PcdDxeNxMemoryProtectionPolicy setting:
1070   // - code regions should have no EFI_MEMORY_XP attribute
1071   // - EfiConventionalMemory and EfiBootServicesData should use the
1072   //   same attribute
1073   // - heap guard should not be enabled for the same type of memory
1074   //
1075   ASSERT ((GetPermissionAttributeForMemoryType (EfiBootServicesCode) & EFI_MEMORY_XP) == 0);
1076   ASSERT ((GetPermissionAttributeForMemoryType (EfiRuntimeServicesCode) & EFI_MEMORY_XP) == 0);
1077   ASSERT ((GetPermissionAttributeForMemoryType (EfiLoaderCode) & EFI_MEMORY_XP) == 0);
1078   ASSERT (GetPermissionAttributeForMemoryType (EfiBootServicesData) ==
1079           GetPermissionAttributeForMemoryType (EfiConventionalMemory));
1080   ASSERT ((PcdGet64 (PcdDxeNxMemoryProtectionPolicy) & PcdGet64 (PcdHeapGuardPoolType)) == 0);
1081   ASSERT ((PcdGet64 (PcdDxeNxMemoryProtectionPolicy) & PcdGet64 (PcdHeapGuardPageType)) == 0);
1082
1083   if (mImageProtectionPolicy != 0 || PcdGet64 (PcdDxeNxMemoryProtectionPolicy) != 0) {
1084     Status = CoreCreateEvent (
1085                EVT_NOTIFY_SIGNAL,
1086                TPL_CALLBACK,
1087                MemoryProtectionCpuArchProtocolNotify,
1088                NULL,
1089                &Event
1090                );
1091     ASSERT_EFI_ERROR(Status);
1092
1093     //
1094     // Register for protocol notifactions on this event
1095     //
1096     Status = CoreRegisterProtocolNotify (
1097                &gEfiCpuArchProtocolGuid,
1098                Event,
1099                &Registration
1100                );
1101     ASSERT_EFI_ERROR(Status);
1102   }
1103
1104   //
1105   // Register a callback to disable NULL pointer detection at EndOfDxe
1106   //
1107   if ((PcdGet8 (PcdNullPointerDetectionPropertyMask) & (BIT0|BIT7))
1108        == (BIT0|BIT7)) {
1109     Status = CoreCreateEventEx (
1110                     EVT_NOTIFY_SIGNAL,
1111                     TPL_NOTIFY,
1112                     DisableNullDetectionAtTheEndOfDxe,
1113                     NULL,
1114                     &gEfiEndOfDxeEventGroupGuid,
1115                     &EndOfDxeEvent
1116                     );
1117     ASSERT_EFI_ERROR (Status);
1118   }
1119
1120   return ;
1121 }
1122
1123 /**
1124   Returns whether we are currently executing in SMM mode.
1125 **/
1126 STATIC
1127 BOOLEAN
1128 IsInSmm (
1129   VOID
1130   )
1131 {
1132   BOOLEAN     InSmm;
1133
1134   InSmm = FALSE;
1135   if (gSmmBase2 != NULL) {
1136     gSmmBase2->InSmm (gSmmBase2, &InSmm);
1137   }
1138   return InSmm;
1139 }
1140
1141 /**
1142   Manage memory permission attributes on a memory range, according to the
1143   configured DXE memory protection policy.
1144
1145   @param  OldType           The old memory type of the range
1146   @param  NewType           The new memory type of the range
1147   @param  Memory            The base address of the range
1148   @param  Length            The size of the range (in bytes)
1149
1150   @return EFI_SUCCESS       If we are executing in SMM mode. No permission attributes
1151                             are updated in this case
1152   @return EFI_SUCCESS       If the the CPU arch protocol is not installed yet
1153   @return EFI_SUCCESS       If no DXE memory protection policy has been configured
1154   @return EFI_SUCCESS       If OldType and NewType use the same permission attributes
1155   @return other             Return value of gCpu->SetMemoryAttributes()
1156
1157 **/
1158 EFI_STATUS
1159 EFIAPI
1160 ApplyMemoryProtectionPolicy (
1161   IN  EFI_MEMORY_TYPE       OldType,
1162   IN  EFI_MEMORY_TYPE       NewType,
1163   IN  EFI_PHYSICAL_ADDRESS  Memory,
1164   IN  UINT64                Length
1165   )
1166 {
1167   UINT64  OldAttributes;
1168   UINT64  NewAttributes;
1169
1170   //
1171   // The policy configured in PcdDxeNxMemoryProtectionPolicy
1172   // does not apply to allocations performed in SMM mode.
1173   //
1174   if (IsInSmm ()) {
1175     return EFI_SUCCESS;
1176   }
1177
1178   //
1179   // If the CPU arch protocol is not installed yet, we cannot manage memory
1180   // permission attributes, and it is the job of the driver that installs this
1181   // protocol to set the permissions on existing allocations.
1182   //
1183   if (gCpu == NULL) {
1184     return EFI_SUCCESS;
1185   }
1186
1187   //
1188   // Check if a DXE memory protection policy has been configured
1189   //
1190   if (PcdGet64 (PcdDxeNxMemoryProtectionPolicy) == 0) {
1191     return EFI_SUCCESS;
1192   }
1193
1194   //
1195   // Update the executable permissions according to the DXE memory
1196   // protection policy, but only if
1197   // - the policy is different between the old and the new type, or
1198   // - this is a newly added region (OldType == EfiMaxMemoryType)
1199   //
1200   NewAttributes = GetPermissionAttributeForMemoryType (NewType);
1201
1202   if (OldType != EfiMaxMemoryType) {
1203     OldAttributes = GetPermissionAttributeForMemoryType (OldType);
1204     if (OldAttributes == NewAttributes) {
1205       // policy is the same between OldType and NewType
1206       return EFI_SUCCESS;
1207     }
1208   } else if (NewAttributes == 0) {
1209     // newly added region of a type that does not require protection
1210     return EFI_SUCCESS;
1211   }
1212
1213   return gCpu->SetMemoryAttributes (gCpu, Memory, Length, NewAttributes);
1214 }