#define DO_NOT_PROTECT 0x00000000\r
#define PROTECT_IF_ALIGNED_ELSE_ALLOW 0x00000001\r
\r
+#define MEMORY_TYPE_OS_RESERVED_MIN 0x80000000\r
+#define MEMORY_TYPE_OEM_RESERVED_MIN 0x70000000\r
+\r
+#define PREVIOUS_MEMORY_DESCRIPTOR(MemoryDescriptor, Size) \\r
+ ((EFI_MEMORY_DESCRIPTOR *)((UINT8 *)(MemoryDescriptor) - (Size)))\r
+\r
UINT32 mImageProtectionPolicy;\r
\r
+extern LIST_ENTRY mGcdMemorySpaceMap;\r
+\r
/**\r
Sort code section in image record, based upon CodeSegmentBase from low to high.\r
\r
}\r
}\r
\r
+/**\r
+ Return the EFI memory permission attribute associated with memory\r
+ type 'MemoryType' under the configured DXE memory protection policy.\r
+**/\r
+STATIC\r
+UINT64\r
+GetPermissionAttributeForMemoryType (\r
+ IN EFI_MEMORY_TYPE MemoryType\r
+ )\r
+{\r
+ UINT64 TestBit;\r
+\r
+ if ((UINT32)MemoryType >= MEMORY_TYPE_OS_RESERVED_MIN) {\r
+ TestBit = BIT63;\r
+ } else if ((UINT32)MemoryType >= MEMORY_TYPE_OEM_RESERVED_MIN) {\r
+ TestBit = BIT62;\r
+ } else {\r
+ TestBit = LShiftU64 (1, MemoryType);\r
+ }\r
+\r
+ if ((PcdGet64 (PcdDxeNxMemoryProtectionPolicy) & TestBit) != 0) {\r
+ return EFI_MEMORY_XP;\r
+ } else {\r
+ return 0;\r
+ }\r
+}\r
+\r
+/**\r
+ Sort memory map entries based upon PhysicalStart, from low to high.\r
+\r
+ @param MemoryMap A pointer to the buffer in which firmware places\r
+ the current memory map.\r
+ @param MemoryMapSize Size, in bytes, of the MemoryMap buffer.\r
+ @param DescriptorSize Size, in bytes, of an individual EFI_MEMORY_DESCRIPTOR.\r
+**/\r
+STATIC\r
+VOID\r
+SortMemoryMap (\r
+ IN OUT EFI_MEMORY_DESCRIPTOR *MemoryMap,\r
+ IN UINTN MemoryMapSize,\r
+ IN UINTN DescriptorSize\r
+ )\r
+{\r
+ EFI_MEMORY_DESCRIPTOR *MemoryMapEntry;\r
+ EFI_MEMORY_DESCRIPTOR *NextMemoryMapEntry;\r
+ EFI_MEMORY_DESCRIPTOR *MemoryMapEnd;\r
+ EFI_MEMORY_DESCRIPTOR TempMemoryMap;\r
+\r
+ MemoryMapEntry = MemoryMap;\r
+ NextMemoryMapEntry = NEXT_MEMORY_DESCRIPTOR (MemoryMapEntry, DescriptorSize);\r
+ MemoryMapEnd = (EFI_MEMORY_DESCRIPTOR *) ((UINT8 *) MemoryMap + MemoryMapSize);\r
+ while (MemoryMapEntry < MemoryMapEnd) {\r
+ while (NextMemoryMapEntry < MemoryMapEnd) {\r
+ if (MemoryMapEntry->PhysicalStart > NextMemoryMapEntry->PhysicalStart) {\r
+ CopyMem (&TempMemoryMap, MemoryMapEntry, sizeof(EFI_MEMORY_DESCRIPTOR));\r
+ CopyMem (MemoryMapEntry, NextMemoryMapEntry, sizeof(EFI_MEMORY_DESCRIPTOR));\r
+ CopyMem (NextMemoryMapEntry, &TempMemoryMap, sizeof(EFI_MEMORY_DESCRIPTOR));\r
+ }\r
+\r
+ NextMemoryMapEntry = NEXT_MEMORY_DESCRIPTOR (NextMemoryMapEntry, DescriptorSize);\r
+ }\r
+\r
+ MemoryMapEntry = NEXT_MEMORY_DESCRIPTOR (MemoryMapEntry, DescriptorSize);\r
+ NextMemoryMapEntry = NEXT_MEMORY_DESCRIPTOR (MemoryMapEntry, DescriptorSize);\r
+ }\r
+}\r
+\r
+/**\r
+ Merge adjacent memory map entries if they use the same memory protection policy\r
+\r
+ @param[in, out] MemoryMap A pointer to the buffer in which firmware places\r
+ the current memory map.\r
+ @param[in, out] MemoryMapSize A pointer to the size, in bytes, of the\r
+ MemoryMap buffer. On input, this is the size of\r
+ the current memory map. On output,\r
+ it is the size of new memory map after merge.\r
+ @param[in] DescriptorSize Size, in bytes, of an individual EFI_MEMORY_DESCRIPTOR.\r
+**/\r
+STATIC\r
+VOID\r
+MergeMemoryMapForProtectionPolicy (\r
+ IN OUT EFI_MEMORY_DESCRIPTOR *MemoryMap,\r
+ IN OUT UINTN *MemoryMapSize,\r
+ IN UINTN DescriptorSize\r
+ )\r
+{\r
+ EFI_MEMORY_DESCRIPTOR *MemoryMapEntry;\r
+ EFI_MEMORY_DESCRIPTOR *MemoryMapEnd;\r
+ UINT64 MemoryBlockLength;\r
+ EFI_MEMORY_DESCRIPTOR *NewMemoryMapEntry;\r
+ EFI_MEMORY_DESCRIPTOR *NextMemoryMapEntry;\r
+ UINT64 Attributes;\r
+\r
+ SortMemoryMap (MemoryMap, *MemoryMapSize, DescriptorSize);\r
+\r
+ MemoryMapEntry = MemoryMap;\r
+ NewMemoryMapEntry = MemoryMap;\r
+ MemoryMapEnd = (EFI_MEMORY_DESCRIPTOR *) ((UINT8 *) MemoryMap + *MemoryMapSize);\r
+ while ((UINTN)MemoryMapEntry < (UINTN)MemoryMapEnd) {\r
+ CopyMem (NewMemoryMapEntry, MemoryMapEntry, sizeof(EFI_MEMORY_DESCRIPTOR));\r
+ NextMemoryMapEntry = NEXT_MEMORY_DESCRIPTOR (MemoryMapEntry, DescriptorSize);\r
+\r
+ do {\r
+ MemoryBlockLength = (UINT64) (EFI_PAGES_TO_SIZE((UINTN)MemoryMapEntry->NumberOfPages));\r
+ Attributes = GetPermissionAttributeForMemoryType (MemoryMapEntry->Type);\r
+\r
+ if (((UINTN)NextMemoryMapEntry < (UINTN)MemoryMapEnd) &&\r
+ Attributes == GetPermissionAttributeForMemoryType (NextMemoryMapEntry->Type) &&\r
+ ((MemoryMapEntry->PhysicalStart + MemoryBlockLength) == NextMemoryMapEntry->PhysicalStart)) {\r
+ MemoryMapEntry->NumberOfPages += NextMemoryMapEntry->NumberOfPages;\r
+ if (NewMemoryMapEntry != MemoryMapEntry) {\r
+ NewMemoryMapEntry->NumberOfPages += NextMemoryMapEntry->NumberOfPages;\r
+ }\r
+\r
+ NextMemoryMapEntry = NEXT_MEMORY_DESCRIPTOR (NextMemoryMapEntry, DescriptorSize);\r
+ continue;\r
+ } else {\r
+ MemoryMapEntry = PREVIOUS_MEMORY_DESCRIPTOR (NextMemoryMapEntry, DescriptorSize);\r
+ break;\r
+ }\r
+ } while (TRUE);\r
+\r
+ MemoryMapEntry = NEXT_MEMORY_DESCRIPTOR (MemoryMapEntry, DescriptorSize);\r
+ NewMemoryMapEntry = NEXT_MEMORY_DESCRIPTOR (NewMemoryMapEntry, DescriptorSize);\r
+ }\r
+\r
+ *MemoryMapSize = (UINTN)NewMemoryMapEntry - (UINTN)MemoryMap;\r
+\r
+ return ;\r
+}\r
+\r
+\r
+/**\r
+ Remove exec permissions from all regions whose type is identified by\r
+ PcdDxeNxMemoryProtectionPolicy\r
+**/\r
+STATIC\r
+VOID\r
+InitializeDxeNxMemoryProtectionPolicy (\r
+ VOID\r
+ )\r
+{\r
+ UINTN MemoryMapSize;\r
+ UINTN MapKey;\r
+ UINTN DescriptorSize;\r
+ UINT32 DescriptorVersion;\r
+ EFI_MEMORY_DESCRIPTOR *MemoryMap;\r
+ EFI_MEMORY_DESCRIPTOR *MemoryMapEntry;\r
+ EFI_MEMORY_DESCRIPTOR *MemoryMapEnd;\r
+ EFI_STATUS Status;\r
+ UINT64 Attributes;\r
+ LIST_ENTRY *Link;\r
+ EFI_GCD_MAP_ENTRY *Entry;\r
+\r
+ //\r
+ // Get the EFI memory map.\r
+ //\r
+ MemoryMapSize = 0;\r
+ MemoryMap = NULL;\r
+\r
+ Status = gBS->GetMemoryMap (\r
+ &MemoryMapSize,\r
+ MemoryMap,\r
+ &MapKey,\r
+ &DescriptorSize,\r
+ &DescriptorVersion\r
+ );\r
+ ASSERT (Status == EFI_BUFFER_TOO_SMALL);\r
+ do {\r
+ MemoryMap = (EFI_MEMORY_DESCRIPTOR *) AllocatePool (MemoryMapSize);\r
+ ASSERT (MemoryMap != NULL);\r
+ Status = gBS->GetMemoryMap (\r
+ &MemoryMapSize,\r
+ MemoryMap,\r
+ &MapKey,\r
+ &DescriptorSize,\r
+ &DescriptorVersion\r
+ );\r
+ if (EFI_ERROR (Status)) {\r
+ FreePool (MemoryMap);\r
+ }\r
+ } while (Status == EFI_BUFFER_TOO_SMALL);\r
+ ASSERT_EFI_ERROR (Status);\r
+\r
+ DEBUG((DEBUG_ERROR, "%a: applying strict permissions to active memory regions\n",\r
+ __FUNCTION__));\r
+\r
+ MergeMemoryMapForProtectionPolicy (MemoryMap, &MemoryMapSize, DescriptorSize);\r
+\r
+ MemoryMapEntry = MemoryMap;\r
+ MemoryMapEnd = (EFI_MEMORY_DESCRIPTOR *) ((UINT8 *) MemoryMap + MemoryMapSize);\r
+ while ((UINTN) MemoryMapEntry < (UINTN) MemoryMapEnd) {\r
+\r
+ Attributes = GetPermissionAttributeForMemoryType (MemoryMapEntry->Type);\r
+ if (Attributes != 0) {\r
+ SetUefiImageMemoryAttributes (\r
+ MemoryMapEntry->PhysicalStart,\r
+ EFI_PAGES_TO_SIZE (MemoryMapEntry->NumberOfPages),\r
+ Attributes);\r
+ }\r
+ MemoryMapEntry = NEXT_MEMORY_DESCRIPTOR (MemoryMapEntry, DescriptorSize);\r
+ }\r
+ FreePool (MemoryMap);\r
+\r
+ //\r
+ // Apply the policy for RAM regions that we know are present and\r
+ // accessible, but have not been added to the UEFI memory map (yet).\r
+ //\r
+ if (GetPermissionAttributeForMemoryType (EfiConventionalMemory) != 0) {\r
+ DEBUG((DEBUG_ERROR,\r
+ "%a: applying strict permissions to inactive memory regions\n",\r
+ __FUNCTION__));\r
+\r
+ CoreAcquireGcdMemoryLock ();\r
+\r
+ Link = mGcdMemorySpaceMap.ForwardLink;\r
+ while (Link != &mGcdMemorySpaceMap) {\r
+\r
+ Entry = CR (Link, EFI_GCD_MAP_ENTRY, Link, EFI_GCD_MAP_SIGNATURE);\r
+\r
+ if (Entry->GcdMemoryType == EfiGcdMemoryTypeReserved &&\r
+ Entry->EndAddress < MAX_ADDRESS &&\r
+ (Entry->Capabilities & (EFI_MEMORY_PRESENT | EFI_MEMORY_INITIALIZED | EFI_MEMORY_TESTED)) ==\r
+ (EFI_MEMORY_PRESENT | EFI_MEMORY_INITIALIZED)) {\r
+\r
+ Attributes = GetPermissionAttributeForMemoryType (EfiConventionalMemory) |\r
+ (Entry->Attributes & CACHE_ATTRIBUTE_MASK);\r
+\r
+ DEBUG ((DEBUG_INFO,\r
+ "Untested GCD memory space region: - 0x%016lx - 0x%016lx (0x%016lx)\n",\r
+ Entry->BaseAddress, Entry->EndAddress - Entry->BaseAddress + 1,\r
+ Attributes));\r
+\r
+ ASSERT(gCpu != NULL);\r
+ gCpu->SetMemoryAttributes (gCpu, Entry->BaseAddress,\r
+ Entry->EndAddress - Entry->BaseAddress + 1, Attributes);\r
+ }\r
+\r
+ Link = Link->ForwardLink;\r
+ }\r
+ CoreReleaseGcdMemoryLock ();\r
+ }\r
+}\r
+\r
+\r
/**\r
A notification for CPU_ARCH protocol.\r
\r
return;\r
}\r
\r
+ //\r
+ // Apply the memory protection policy on non-BScode/RTcode regions.\r
+ //\r
+ if (PcdGet64 (PcdDxeNxMemoryProtectionPolicy) != 0) {\r
+ InitializeDxeNxMemoryProtectionPolicy ();\r
+ }\r
+\r
+ if (mImageProtectionPolicy == 0) {\r
+ return;\r
+ }\r
+\r
Status = gBS->LocateHandleBuffer (\r
ByProtocol,\r
&gEfiLoadedImageProtocolGuid,\r
\r
mImageProtectionPolicy = PcdGet32(PcdImageProtectionPolicy);\r
\r
- if (mImageProtectionPolicy != 0) {\r
+ //\r
+ // Sanity check the PcdDxeNxMemoryProtectionPolicy setting:\r
+ // - code regions should have no EFI_MEMORY_XP attribute\r
+ // - EfiConventionalMemory and EfiBootServicesData should use the\r
+ // same attribute\r
+ //\r
+ ASSERT ((GetPermissionAttributeForMemoryType (EfiBootServicesCode) & EFI_MEMORY_XP) == 0);\r
+ ASSERT ((GetPermissionAttributeForMemoryType (EfiRuntimeServicesCode) & EFI_MEMORY_XP) == 0);\r
+ ASSERT ((GetPermissionAttributeForMemoryType (EfiLoaderCode) & EFI_MEMORY_XP) == 0);\r
+ ASSERT (GetPermissionAttributeForMemoryType (EfiBootServicesData) ==\r
+ GetPermissionAttributeForMemoryType (EfiConventionalMemory));\r
+\r
+ if (mImageProtectionPolicy != 0 || PcdGet64 (PcdDxeNxMemoryProtectionPolicy) != 0) {\r
Status = CoreCreateEvent (\r
EVT_NOTIFY_SIGNAL,\r
TPL_CALLBACK,\r
}\r
return ;\r
}\r
+\r
+/**\r
+ Returns whether we are currently executing in SMM mode\r
+**/\r
+STATIC\r
+BOOLEAN\r
+IsInSmm (\r
+ VOID\r
+ )\r
+{\r
+ BOOLEAN InSmm;\r
+\r
+ InSmm = FALSE;\r
+ if (gSmmBase2 != NULL) {\r
+ gSmmBase2->InSmm (gSmmBase2, &InSmm);\r
+ }\r
+ return InSmm;\r
+}\r
+\r
+/**\r
+ Manage memory permission attributes on a memory range, according to the\r
+ configured DXE memory protection policy.\r
+\r
+ @param OldType The old memory type of the range\r
+ @param NewType The new memory type of the range\r
+ @param Memory The base address of the range\r
+ @param Length The size of the range (in bytes)\r
+\r
+ @return EFI_SUCCESS If we are executing in SMM mode. No permission attributes\r
+ are updated in this case\r
+ @return EFI_SUCCESS If the the CPU arch protocol is not installed yet\r
+ @return EFI_SUCCESS If no DXE memory protection policy has been configured\r
+ @return EFI_SUCCESS If OldType and NewType use the same permission attributes\r
+ @return other Return value of gCpu->SetMemoryAttributes()\r
+\r
+**/\r
+EFI_STATUS\r
+EFIAPI\r
+ApplyMemoryProtectionPolicy (\r
+ IN EFI_MEMORY_TYPE OldType,\r
+ IN EFI_MEMORY_TYPE NewType,\r
+ IN EFI_PHYSICAL_ADDRESS Memory,\r
+ IN UINT64 Length\r
+ )\r
+{\r
+ UINT64 OldAttributes;\r
+ UINT64 NewAttributes;\r
+\r
+ //\r
+ // The policy configured in PcdDxeNxMemoryProtectionPolicy\r
+ // does not apply to allocations performed in SMM mode.\r
+ //\r
+ if (IsInSmm ()) {\r
+ return EFI_SUCCESS;\r
+ }\r
+\r
+ //\r
+ // If the CPU arch protocol is not installed yet, we cannot manage memory\r
+ // permission attributes, and it is the job of the driver that installs this\r
+ // protocol to set the permissions on existing allocations.\r
+ //\r
+ if (gCpu == NULL) {\r
+ return EFI_SUCCESS;\r
+ }\r
+\r
+ //\r
+ // Check if a DXE memory protection policy has been configured\r
+ //\r
+ if (PcdGet64 (PcdDxeNxMemoryProtectionPolicy) == 0) {\r
+ return EFI_SUCCESS;\r
+ }\r
+\r
+ //\r
+ // Update the executable permissions according to the DXE memory\r
+ // protection policy, but only if\r
+ // - the policy is different between the old and the new type, or\r
+ // - this is a newly added region (OldType == EfiMaxMemoryType)\r
+ //\r
+ NewAttributes = GetPermissionAttributeForMemoryType (NewType);\r
+\r
+ if (OldType != EfiMaxMemoryType) {\r
+ OldAttributes = GetPermissionAttributeForMemoryType (OldType);\r
+ if (OldAttributes == NewAttributes) {\r
+ // policy is the same between OldType and NewType\r
+ return EFI_SUCCESS;\r
+ }\r
+ } else if (NewAttributes == 0) {\r
+ // newly added region of a type that does not require protection\r
+ return EFI_SUCCESS;\r
+ }\r
+\r
+ return gCpu->SetMemoryAttributes (gCpu, Memory, Length, NewAttributes);\r
+}\r
projects / mirror_edk2.git / commitdiff