From patchwork Mon Feb 27 14:38:05 2017 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Ard Biesheuvel X-Patchwork-Id: 94543 Delivered-To: patch@linaro.org Received: by 10.140.20.113 with SMTP id 104csp889544qgi; Mon, 27 Feb 2017 06:38:25 -0800 (PST) X-Received: by 10.84.198.164 with SMTP id p33mr24493916pld.85.1488206305176; Mon, 27 Feb 2017 06:38:25 -0800 (PST) Return-Path: Received: from ml01.01.org (ml01.01.org. [2001:19d0:306:5::1]) by mx.google.com with ESMTPS id x5si15297432pgf.20.2017.02.27.06.38.24 (version=TLS1_2 cipher=ECDHE-RSA-AES128-GCM-SHA256 bits=128/128); Mon, 27 Feb 2017 06:38:25 -0800 (PST) Received-SPF: pass (google.com: best guess record for domain of edk2-devel-bounces@lists.01.org designates 2001:19d0:306:5::1 as permitted sender) client-ip=2001:19d0:306:5::1; Authentication-Results: mx.google.com; dkim=neutral (body hash did not verify) header.i=@linaro.org; spf=pass (google.com: best guess record for domain of edk2-devel-bounces@lists.01.org designates 2001:19d0:306:5::1 as permitted sender) smtp.mailfrom=edk2-devel-bounces@lists.01.org; dmarc=fail (p=NONE sp=NONE dis=NONE) header.from=linaro.org Received: from [127.0.0.1] (localhost [IPv6:::1]) by ml01.01.org (Postfix) with ESMTP id B3E1281F68; Mon, 27 Feb 2017 06:38:24 -0800 (PST) X-Original-To: edk2-devel@lists.01.org Delivered-To: edk2-devel@lists.01.org Received: from mail-wr0-x234.google.com (mail-wr0-x234.google.com [IPv6:2a00:1450:400c:c0c::234]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ml01.01.org (Postfix) with ESMTPS id C8CD781F68 for ; Mon, 27 Feb 2017 06:38:22 -0800 (PST) Received: by mail-wr0-x234.google.com with SMTP id l37so9543975wrc.1 for ; Mon, 27 Feb 2017 06:38:22 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=linaro.org; s=google; h=from:to:cc:subject:date:message-id:in-reply-to:references; bh=ZLo/mBL996UMzCYelE+fogyf+t/RimtJ0Aw/ZCfm+o4=; b=SB/IufSdv3f0XgzjbgTYm6NqJQFq2GWZvPZlpTIBnB4SlH55Ezqx3qnAmnVQZgTZwS ln4iHtVtyAyr36Ax/n05jZE130YjM11cpdJ+JWfmKzbZkR98dJNKhCvTVlGMBRykTdro cjUHeNKF9UDY8lbSKbM9E2iO0OHobhCsZo5yU= X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:from:to:cc:subject:date:message-id:in-reply-to :references; bh=ZLo/mBL996UMzCYelE+fogyf+t/RimtJ0Aw/ZCfm+o4=; b=koOubkF0z8hcWhkanGjk6UgAaSVoMuEIIRdCwF04FtYXloF9RByvTQjuVddwu6o7iq 2VMOXLKNOrv1xtN2jhC3rdjillahHW1Ms6UeYTR5VhxOReUXumsoqDHVmfazKGl3upxD IWkRvjBcP/KA+k6L4KzIwoziGjjdH+zKuF8EUBBkSqYTwyOzN2GEwcJJondF8gg1YNZT hKmnVz3d2LkABrx+4ZFE+UpoLtDra7314+pwD9++tSt0Avw4880OfYTEE/508jBaBcVC Br1q9kxJWF6F79N4J56PsIFQe6c9nX3Vo64yUUcraaL/0GWKl0yO5g/HiwDX0GVEbPXA 9xiA== X-Gm-Message-State: AMke39nAGT0eN89B6XA4tFCh7b/bNqQ1RzzY98O1qtqgsh1kNjBRW+7XLb3LgsENzw7AoTsV X-Received: by 10.223.130.101 with SMTP id 92mr6061487wrb.192.1488206301349; Mon, 27 Feb 2017 06:38:21 -0800 (PST) Received: from localhost.localdomain ([105.149.201.216]) by smtp.gmail.com with ESMTPSA id z134sm14475167wmc.20.2017.02.27.06.38.18 (version=TLS1_2 cipher=ECDHE-RSA-AES128-SHA bits=128/128); Mon, 27 Feb 2017 06:38:20 -0800 (PST) From: Ard Biesheuvel To: edk2-devel@lists.01.org, afish@apple.com, leif.lindholm@linaro.org, michael.d.kinney@intel.com, liming.gao@intel.com, jiewen.yao@intel.com Date: Mon, 27 Feb 2017 14:38:05 +0000 Message-Id: <1488206291-25768-2-git-send-email-ard.biesheuvel@linaro.org> X-Mailer: git-send-email 2.7.4 In-Reply-To: <1488206291-25768-1-git-send-email-ard.biesheuvel@linaro.org> References: <1488206291-25768-1-git-send-email-ard.biesheuvel@linaro.org> Subject: [edk2] [PATCH v4 1/7] ArmPkg/CpuDxe: ignore attribute changes during SyncCacheConfig() X-BeenThere: edk2-devel@lists.01.org X-Mailman-Version: 2.1.21 Precedence: list List-Id: EDK II Development List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Cc: feng.tian@intel.com, lersek@redhat.com, star.zeng@intel.com, Ard Biesheuvel MIME-Version: 1.0 Errors-To: edk2-devel-bounces@lists.01.org Sender: "edk2-devel" To prevent the initial MMU->GCD memory space map synchronization from stripping permissions attributes [which we cannot use in the GCD memory space map, unfortunately], implement the same approach as x86, and ignore SetMemoryAttributes() calls during the time SyncCacheConfig() is in progress. This is a horrible hack, but is currently the only way we can implement strict permissions on arbitrary memory regions [as opposed to PE/COFF text/data sections only] Contributed-under: TianoCore Contribution Agreement 1.0 Signed-off-by: Ard Biesheuvel Reviewed-by: Jiewen Yao --- ArmPkg/Drivers/CpuDxe/CpuDxe.c | 3 +++ ArmPkg/Drivers/CpuDxe/CpuDxe.h | 1 + ArmPkg/Drivers/CpuDxe/CpuMmuCommon.c | 4 ++++ 3 files changed, 8 insertions(+) -- 2.7.4 _______________________________________________ edk2-devel mailing list edk2-devel@lists.01.org https://lists.01.org/mailman/listinfo/edk2-devel Reviewed-by: Leif Lindholm diff --git a/ArmPkg/Drivers/CpuDxe/CpuDxe.c b/ArmPkg/Drivers/CpuDxe/CpuDxe.c index 5aa5b874144a..1955d1dece03 100644 --- a/ArmPkg/Drivers/CpuDxe/CpuDxe.c +++ b/ArmPkg/Drivers/CpuDxe/CpuDxe.c @@ -17,6 +17,7 @@ #include +BOOLEAN gIsFlushingGCD; /** This function flushes the range of addresses from Start to Start+Length @@ -261,7 +262,9 @@ CpuDxeInitialize ( // and that calls EFI_CPU_ARCH_PROTOCOL.SetMemoryAttributes, so this code needs to go // after the protocol is installed // + gIsFlushingGCD = TRUE; SyncCacheConfig (&mCpu); + gIsFlushingGCD = FALSE; // If the platform is a MPCore system then install the Configuration Table describing the // secondary core states diff --git a/ArmPkg/Drivers/CpuDxe/CpuDxe.h b/ArmPkg/Drivers/CpuDxe/CpuDxe.h index a00fc3064362..085e4cab2921 100644 --- a/ArmPkg/Drivers/CpuDxe/CpuDxe.h +++ b/ArmPkg/Drivers/CpuDxe/CpuDxe.h @@ -37,6 +37,7 @@ #include #include +extern BOOLEAN gIsFlushingGCD; /** This function registers and enables the handler specified by InterruptHandler for a processor diff --git a/ArmPkg/Drivers/CpuDxe/CpuMmuCommon.c b/ArmPkg/Drivers/CpuDxe/CpuMmuCommon.c index ebe593d1c325..6dfec7e55888 100644 --- a/ArmPkg/Drivers/CpuDxe/CpuMmuCommon.c +++ b/ArmPkg/Drivers/CpuDxe/CpuMmuCommon.c @@ -188,6 +188,10 @@ CpuSetMemoryAttributes ( UINTN RegionLength; UINTN RegionArmAttributes; + if (gIsFlushingGCD) { + return EFI_SUCCESS; + } + if ((BaseAddress & (SIZE_4KB - 1)) != 0) { // Minimum granularity is SIZE_4KB (4KB on ARM) DEBUG ((EFI_D_PAGE, "CpuSetMemoryAttributes(%lx, %lx, %lx): Minimum ganularity is SIZE_4KB\n", BaseAddress, Length, EfiAttributes)); From patchwork Mon Feb 27 14:38:06 2017 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Ard Biesheuvel X-Patchwork-Id: 94544 Delivered-To: patch@linaro.org Received: by 10.140.20.113 with SMTP id 104csp889562qgi; Mon, 27 Feb 2017 06:38:28 -0800 (PST) X-Received: by 10.84.141.1 with SMTP id 1mr24925788plu.178.1488206308438; Mon, 27 Feb 2017 06:38:28 -0800 (PST) Return-Path: Received: from ml01.01.org (ml01.01.org. [2001:19d0:306:5::1]) by mx.google.com with ESMTPS id v5si15277130pgv.254.2017.02.27.06.38.28 (version=TLS1_2 cipher=ECDHE-RSA-AES128-GCM-SHA256 bits=128/128); Mon, 27 Feb 2017 06:38:28 -0800 (PST) Received-SPF: pass (google.com: best guess record for domain of edk2-devel-bounces@lists.01.org designates 2001:19d0:306:5::1 as permitted sender) client-ip=2001:19d0:306:5::1; Authentication-Results: mx.google.com; dkim=neutral (body hash did not verify) header.i=@linaro.org; spf=pass (google.com: best guess record for domain of edk2-devel-bounces@lists.01.org designates 2001:19d0:306:5::1 as permitted sender) smtp.mailfrom=edk2-devel-bounces@lists.01.org; dmarc=fail (p=NONE sp=NONE dis=NONE) header.from=linaro.org Received: from [127.0.0.1] (localhost [IPv6:::1]) by ml01.01.org (Postfix) with ESMTP id EB8CD82027; Mon, 27 Feb 2017 06:38:27 -0800 (PST) X-Original-To: edk2-devel@lists.01.org Delivered-To: edk2-devel@lists.01.org Received: from mail-wm0-x22f.google.com (mail-wm0-x22f.google.com [IPv6:2a00:1450:400c:c09::22f]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ml01.01.org (Postfix) with ESMTPS id B983282027 for ; Mon, 27 Feb 2017 06:38:25 -0800 (PST) Received: by mail-wm0-x22f.google.com with SMTP id u199so20322674wmd.1 for ; Mon, 27 Feb 2017 06:38:25 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=linaro.org; s=google; h=from:to:cc:subject:date:message-id:in-reply-to:references; bh=iLx+xDseTqp8U73TljZHW6dZA5m+LgKqMo5zaY1D41s=; b=FUXNWntsyLR3rmAivXR4ExJc8HjBBPIgmNAnMN1+WtpJKaHqvjcpaz7CpwBruFa8hd L9CA2oDWqz0Fs0qAZcNR/Zti8Anjt6g09ZNnnzZ6h142+eXO2yBMmYoclQilBM2pxoSM 2Bgd3HtoRukD+jPC9iPhY/AhF6LGSkgCYezBU= X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:from:to:cc:subject:date:message-id:in-reply-to :references; bh=iLx+xDseTqp8U73TljZHW6dZA5m+LgKqMo5zaY1D41s=; b=KnwWjaB4T3Wq/MT3C6g9xeEjvDJ8toJBRrAmsnr63l/vMtBSzRU77Ar7opvNBNJwS8 +hQa31YciQuZOwXvbvxd8Jb4nID8sxUZ+kIZJLBtvEGwiaZzmQKjNAtN1+J3x0dPiBMN wiStcmb2cfnK8g0l9vghSS0dd5J2SGDLuYuigN0C34V4mAaA0CqsE4aLVHFcogyNUlH7 IpLLEchxn/fy26byia9e/2KhWDwPQZUo/NZ2dNw32SwgOpED5KKZna6XdP66msG1aO6X 1V24s5XWuQ3bsI4aYqIL28DZBlWF6VlgIy9/XhwO0teelOzL7LaXRancjbwLRwJCJ79Z WSkg== X-Gm-Message-State: AMke39ngs0m3Wq7hscvbCs5YnndNayvDZYj0SnW+0U2dv44SCDHjIF/cINZo9B+ZHU3KHNl8 X-Received: by 10.28.145.3 with SMTP id t3mr14435406wmd.47.1488206304377; Mon, 27 Feb 2017 06:38:24 -0800 (PST) Received: from localhost.localdomain ([105.149.201.216]) by smtp.gmail.com with ESMTPSA id z134sm14475167wmc.20.2017.02.27.06.38.21 (version=TLS1_2 cipher=ECDHE-RSA-AES128-SHA bits=128/128); Mon, 27 Feb 2017 06:38:23 -0800 (PST) From: Ard Biesheuvel To: edk2-devel@lists.01.org, afish@apple.com, leif.lindholm@linaro.org, michael.d.kinney@intel.com, liming.gao@intel.com, jiewen.yao@intel.com Date: Mon, 27 Feb 2017 14:38:06 +0000 Message-Id: <1488206291-25768-3-git-send-email-ard.biesheuvel@linaro.org> X-Mailer: git-send-email 2.7.4 In-Reply-To: <1488206291-25768-1-git-send-email-ard.biesheuvel@linaro.org> References: <1488206291-25768-1-git-send-email-ard.biesheuvel@linaro.org> Subject: [edk2] [PATCH v4 2/7] MdeModulePkg/PeiCore: allocate BootServicesCode memory for PE/COFF images X-BeenThere: edk2-devel@lists.01.org X-Mailman-Version: 2.1.21 Precedence: list List-Id: EDK II Development List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Cc: feng.tian@intel.com, lersek@redhat.com, star.zeng@intel.com, Ard Biesheuvel MIME-Version: 1.0 Errors-To: edk2-devel-bounces@lists.01.org Sender: "edk2-devel" Ensure that any memory allocated for PE/COFF images is identifiable as a boot services code region, so that we know it requires its executable permissions to be preserved when we tighten mapping permissions later on. Contributed-under: TianoCore Contribution Agreement 1.0 Signed-off-by: Ard Biesheuvel Reviewed-by: Jiewen Yao --- MdeModulePkg/Core/Pei/Image/Image.c | 23 ++++++++++++-------- 1 file changed, 14 insertions(+), 9 deletions(-) -- 2.7.4 _______________________________________________ edk2-devel mailing list edk2-devel@lists.01.org https://lists.01.org/mailman/listinfo/edk2-devel Reviewed-by: Liming Gao diff --git a/MdeModulePkg/Core/Pei/Image/Image.c b/MdeModulePkg/Core/Pei/Image/Image.c index d659de8b3e64..68e40c027e63 100644 --- a/MdeModulePkg/Core/Pei/Image/Image.c +++ b/MdeModulePkg/Core/Pei/Image/Image.c @@ -112,11 +112,12 @@ GetImageReadFunction ( IN PE_COFF_LOADER_IMAGE_CONTEXT *ImageContext ) { - PEI_CORE_INSTANCE *Private; - VOID* MemoryBuffer; + PEI_CORE_INSTANCE *Private; + EFI_PHYSICAL_ADDRESS MemoryBuffer; Private = PEI_CORE_INSTANCE_FROM_PS_THIS (GetPeiServicesTablePointer ()); - + MemoryBuffer = 0; + if (Private->PeiMemoryInstalled && (((Private->HobList.HandoffInformationTable->BootMode != BOOT_ON_S3_RESUME) && PcdGetBool (PcdShadowPeimOnBoot)) || ((Private->HobList.HandoffInformationTable->BootMode == BOOT_ON_S3_RESUME) && PcdGetBool (PcdShadowPeimOnS3Boot))) && (EFI_IMAGE_MACHINE_TYPE_SUPPORTED(EFI_IMAGE_MACHINE_X64) || EFI_IMAGE_MACHINE_TYPE_SUPPORTED(EFI_IMAGE_MACHINE_IA32))) { @@ -125,9 +126,9 @@ GetImageReadFunction ( // compilers that have been tested // if (Private->ShadowedImageRead == NULL) { - MemoryBuffer = AllocatePages (0x400 / EFI_PAGE_SIZE + 1); - ASSERT (MemoryBuffer != NULL); - CopyMem (MemoryBuffer, (CONST VOID *) (UINTN) PeiImageReadForShadow, 0x400); + PeiServicesAllocatePages (EfiBootServicesCode, 0x400 / EFI_PAGE_SIZE + 1, &MemoryBuffer); + ASSERT (MemoryBuffer != 0); + CopyMem ((VOID *)(UINTN)MemoryBuffer, (CONST VOID *) (UINTN) PeiImageReadForShadow, 0x400); Private->ShadowedImageRead = (PE_COFF_LOADER_READ_FILE) (UINTN) MemoryBuffer; } @@ -453,12 +454,16 @@ LoadAndRelocatePeCoffImage ( // // The PEIM is not assiged valid address, try to allocate page to load it. // - ImageContext.ImageAddress = (EFI_PHYSICAL_ADDRESS)(UINTN) AllocatePages (EFI_SIZE_TO_PAGES ((UINT32) AlignImageSize)); + Status = PeiServicesAllocatePages (EfiBootServicesCode, + EFI_SIZE_TO_PAGES ((UINT32) AlignImageSize), + &ImageContext.ImageAddress); } } else { - ImageContext.ImageAddress = (EFI_PHYSICAL_ADDRESS)(UINTN) AllocatePages (EFI_SIZE_TO_PAGES ((UINT32) AlignImageSize)); + Status = PeiServicesAllocatePages (EfiBootServicesCode, + EFI_SIZE_TO_PAGES ((UINT32) AlignImageSize), + &ImageContext.ImageAddress); } - if (ImageContext.ImageAddress != 0) { + if (!EFI_ERROR (Status)) { // // Adjust the Image Address to make sure it is section alignment. // From patchwork Mon Feb 27 14:38:07 2017 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Ard Biesheuvel X-Patchwork-Id: 94545 Delivered-To: patch@linaro.org Received: by 10.140.20.113 with SMTP id 104csp889581qgi; Mon, 27 Feb 2017 06:38:31 -0800 (PST) X-Received: by 10.99.142.193 with SMTP id k184mr9584514pge.176.1488206311641; Mon, 27 Feb 2017 06:38:31 -0800 (PST) Return-Path: Received: from ml01.01.org (ml01.01.org. [2001:19d0:306:5::1]) by mx.google.com with ESMTPS id g29si15313020plj.102.2017.02.27.06.38.31 (version=TLS1_2 cipher=ECDHE-RSA-AES128-GCM-SHA256 bits=128/128); Mon, 27 Feb 2017 06:38:31 -0800 (PST) Received-SPF: pass (google.com: best guess record for domain of edk2-devel-bounces@lists.01.org designates 2001:19d0:306:5::1 as permitted sender) client-ip=2001:19d0:306:5::1; Authentication-Results: mx.google.com; dkim=neutral (body hash did not verify) header.i=@linaro.org; spf=pass (google.com: best guess record for domain of edk2-devel-bounces@lists.01.org designates 2001:19d0:306:5::1 as permitted sender) smtp.mailfrom=edk2-devel-bounces@lists.01.org; dmarc=fail (p=NONE sp=NONE dis=NONE) header.from=linaro.org Received: from [127.0.0.1] (localhost [IPv6:::1]) by ml01.01.org (Postfix) with ESMTP id 2DCB58209A; Mon, 27 Feb 2017 06:38:31 -0800 (PST) X-Original-To: edk2-devel@lists.01.org Delivered-To: edk2-devel@lists.01.org Received: from mail-wr0-x235.google.com (mail-wr0-x235.google.com [IPv6:2a00:1450:400c:c0c::235]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ml01.01.org (Postfix) with ESMTPS id 2BB38820A5 for ; Mon, 27 Feb 2017 06:38:29 -0800 (PST) Received: by mail-wr0-x235.google.com with SMTP id g10so53549404wrg.2 for ; Mon, 27 Feb 2017 06:38:29 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=linaro.org; s=google; h=from:to:cc:subject:date:message-id:in-reply-to:references; bh=EtMGbFVrAb6DR9eX+hKfKKfagTwxW/AmwizB1EgFfFs=; b=YaR7VUQK7CoB+7M5ICa8o0VBxh0eF1mfSLFkCWbheixJEM9b380c/eoC8rG14Rcg2f HhRzzp05UNCtDL3PpEsoFFvmvGVez2/7Z5g57HV2RpzoYzB+z5ha9KjoOMEyKzQapULH +0PYDZedPUAx4dXLZhOJWaqFnE51WI+7HjOBw= X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:from:to:cc:subject:date:message-id:in-reply-to :references; bh=EtMGbFVrAb6DR9eX+hKfKKfagTwxW/AmwizB1EgFfFs=; b=LPPW82LuI2cARWE6WyTw332uuAn+R0MUD8r11q/o1Ogum5MGOQPCc6crD8HUVHU2h9 743xrM0l70UXe3I+kg0dypyxY0L3Gjd79o85Td5VRDmhb0V+5GgsDek4kCej6cevr96m 6bRP48YCtgmU5FmPvQXZZOfPr0wDwERP5I7NAur4x3iiW1Ve8ZC4VP+XwReCSdipXCw2 LgDQcyZAeooP7m0QcnwPlI/i+tYEfTLrbX8bIN48U6HNBjRECOVIx4t6H+sLx/7hYKE8 JVSMA3vlKljRGaAw17QJGvuYIpGWBC71y2cjEyiEeNRtuMMmLN73rLDU9qSm5phc6N2q mfCQ== X-Gm-Message-State: AMke39nV/nNRQ9SaQbFQpMmvY1uC/3hyoh5VA+/SR4OXS5IbCqnKGkH4S5sH6bH+2ESY3MqE X-Received: by 10.223.154.149 with SMTP id a21mr9110033wrc.145.1488206307698; Mon, 27 Feb 2017 06:38:27 -0800 (PST) Received: from localhost.localdomain ([105.149.201.216]) by smtp.gmail.com with ESMTPSA id z134sm14475167wmc.20.2017.02.27.06.38.24 (version=TLS1_2 cipher=ECDHE-RSA-AES128-SHA bits=128/128); Mon, 27 Feb 2017 06:38:26 -0800 (PST) From: Ard Biesheuvel To: edk2-devel@lists.01.org, afish@apple.com, leif.lindholm@linaro.org, michael.d.kinney@intel.com, liming.gao@intel.com, jiewen.yao@intel.com Date: Mon, 27 Feb 2017 14:38:07 +0000 Message-Id: <1488206291-25768-4-git-send-email-ard.biesheuvel@linaro.org> X-Mailer: git-send-email 2.7.4 In-Reply-To: <1488206291-25768-1-git-send-email-ard.biesheuvel@linaro.org> References: <1488206291-25768-1-git-send-email-ard.biesheuvel@linaro.org> Subject: [edk2] [PATCH v4 3/7] MdeModulePkg/EbcDxe: use EfiBootServicesCode memory for thunks X-BeenThere: edk2-devel@lists.01.org X-Mailman-Version: 2.1.21 Precedence: list List-Id: EDK II Development List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Cc: feng.tian@intel.com, lersek@redhat.com, star.zeng@intel.com, Ard Biesheuvel MIME-Version: 1.0 Errors-To: edk2-devel-bounces@lists.01.org Sender: "edk2-devel" The EBC driver emits thunks for native to EBC calls, which are short instructions sequences that bridge the gap between the native execution environment and the EBC virtual machine. Since these thunks are allocated using MemoryAllocationLib::AllocatePool(), they are emitted into EfiBootServicesData regions, which does not reflect the nature of these thunks accurately, and interferes with strict memory protection policies that map data regions non-executable. So instead, create a new helper EbcAllocatePoolForThunk() that invokes the AllocatePool() boot services directly to allocate EfiBootServicesCode pool memory explicitly, and wire up this helper for the various architecture specific thunk generation routines. Contributed-under: TianoCore Contribution Agreement 1.0 Signed-off-by: Ard Biesheuvel Reviewed-by: Jiewen Yao --- MdeModulePkg/Universal/EbcDxe/AArch64/EbcSupport.c | 2 +- MdeModulePkg/Universal/EbcDxe/EbcInt.c | 23 ++++++++++++++++++++ MdeModulePkg/Universal/EbcDxe/EbcInt.h | 14 ++++++++++++ MdeModulePkg/Universal/EbcDxe/Ia32/EbcSupport.c | 2 +- MdeModulePkg/Universal/EbcDxe/Ipf/EbcSupport.c | 2 +- MdeModulePkg/Universal/EbcDxe/X64/EbcSupport.c | 2 +- 6 files changed, 41 insertions(+), 4 deletions(-) -- 2.7.4 _______________________________________________ edk2-devel mailing list edk2-devel@lists.01.org https://lists.01.org/mailman/listinfo/edk2-devel diff --git a/MdeModulePkg/Universal/EbcDxe/AArch64/EbcSupport.c b/MdeModulePkg/Universal/EbcDxe/AArch64/EbcSupport.c index ade47c4d0622..7c13ce12a38b 100644 --- a/MdeModulePkg/Universal/EbcDxe/AArch64/EbcSupport.c +++ b/MdeModulePkg/Universal/EbcDxe/AArch64/EbcSupport.c @@ -383,7 +383,7 @@ EbcCreateThunks ( return EFI_INVALID_PARAMETER; } - InstructionBuffer = AllocatePool (sizeof (EBC_INSTRUCTION_BUFFER)); + InstructionBuffer = EbcAllocatePoolForThunk (sizeof (EBC_INSTRUCTION_BUFFER)); if (InstructionBuffer == NULL) { return EFI_OUT_OF_RESOURCES; } diff --git a/MdeModulePkg/Universal/EbcDxe/EbcInt.c b/MdeModulePkg/Universal/EbcDxe/EbcInt.c index 6fd2aaf5af27..727ba8bcae44 100644 --- a/MdeModulePkg/Universal/EbcDxe/EbcInt.c +++ b/MdeModulePkg/Universal/EbcDxe/EbcInt.c @@ -1410,3 +1410,26 @@ EbcVmTestUnsupported ( return EFI_UNSUPPORTED; } +/** + Allocates a buffer of type EfiBootServicesCode. + + @param AllocationSize The number of bytes to allocate. + + @return A pointer to the allocated buffer or NULL if allocation fails. + +**/ +VOID * +EFIAPI +EbcAllocatePoolForThunk ( + IN UINTN AllocationSize + ) +{ + VOID *Buffer; + EFI_STATUS Status; + + Status = gBS->AllocatePool (EfiBootServicesCode, AllocationSize, &Buffer); + if (EFI_ERROR (Status)) { + return NULL; + } + return Buffer; +} diff --git a/MdeModulePkg/Universal/EbcDxe/EbcInt.h b/MdeModulePkg/Universal/EbcDxe/EbcInt.h index 75017a23e75e..8aa7a4abbd63 100644 --- a/MdeModulePkg/Universal/EbcDxe/EbcInt.h +++ b/MdeModulePkg/Universal/EbcDxe/EbcInt.h @@ -246,4 +246,18 @@ typedef struct { CR(a, EBC_PROTOCOL_PRIVATE_DATA, EbcProtocol, EBC_PROTOCOL_PRIVATE_DATA_SIGNATURE) +/** + Allocates a buffer of type EfiBootServicesCode. + + @param AllocationSize The number of bytes to allocate. + + @return A pointer to the allocated buffer or NULL if allocation fails. + +**/ +VOID * +EFIAPI +EbcAllocatePoolForThunk ( + IN UINTN AllocationSize + ); + #endif // #ifndef _EBC_INT_H_ diff --git a/MdeModulePkg/Universal/EbcDxe/Ia32/EbcSupport.c b/MdeModulePkg/Universal/EbcDxe/Ia32/EbcSupport.c index 8e660b93ad64..a825846f89c3 100644 --- a/MdeModulePkg/Universal/EbcDxe/Ia32/EbcSupport.c +++ b/MdeModulePkg/Universal/EbcDxe/Ia32/EbcSupport.c @@ -484,7 +484,7 @@ EbcCreateThunks ( ThunkSize = sizeof(mInstructionBufferTemplate); - Ptr = AllocatePool (sizeof(mInstructionBufferTemplate)); + Ptr = EbcAllocatePoolForThunk (sizeof(mInstructionBufferTemplate)); if (Ptr == NULL) { return EFI_OUT_OF_RESOURCES; diff --git a/MdeModulePkg/Universal/EbcDxe/Ipf/EbcSupport.c b/MdeModulePkg/Universal/EbcDxe/Ipf/EbcSupport.c index 95837cb67865..f99348f181a9 100644 --- a/MdeModulePkg/Universal/EbcDxe/Ipf/EbcSupport.c +++ b/MdeModulePkg/Universal/EbcDxe/Ipf/EbcSupport.c @@ -403,7 +403,7 @@ EbcCreateThunks ( // Size = EBC_THUNK_SIZE + EBC_THUNK_ALIGNMENT - 1; ThunkSize = Size; - Ptr = AllocatePool (Size); + Ptr = EbcAllocatePoolForThunk (Size); if (Ptr == NULL) { return EFI_OUT_OF_RESOURCES; diff --git a/MdeModulePkg/Universal/EbcDxe/X64/EbcSupport.c b/MdeModulePkg/Universal/EbcDxe/X64/EbcSupport.c index 4325e2e52710..33a174917b69 100644 --- a/MdeModulePkg/Universal/EbcDxe/X64/EbcSupport.c +++ b/MdeModulePkg/Universal/EbcDxe/X64/EbcSupport.c @@ -441,7 +441,7 @@ EbcCreateThunks ( ThunkSize = sizeof(mInstructionBufferTemplate); - Ptr = AllocatePool (sizeof(mInstructionBufferTemplate)); + Ptr = EbcAllocatePoolForThunk (sizeof(mInstructionBufferTemplate)); if (Ptr == NULL) { return EFI_OUT_OF_RESOURCES; From patchwork Mon Feb 27 14:38:08 2017 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Ard Biesheuvel X-Patchwork-Id: 94546 Delivered-To: patch@linaro.org Received: by 10.140.20.113 with SMTP id 104csp889596qgi; Mon, 27 Feb 2017 06:38:33 -0800 (PST) X-Received: by 10.99.247.83 with SMTP id f19mr21238651pgk.158.1488206313883; Mon, 27 Feb 2017 06:38:33 -0800 (PST) Return-Path: Received: from ml01.01.org (ml01.01.org. [2001:19d0:306:5::1]) by mx.google.com with ESMTPS id k1si15296651pgp.246.2017.02.27.06.38.33 (version=TLS1_2 cipher=ECDHE-RSA-AES128-GCM-SHA256 bits=128/128); Mon, 27 Feb 2017 06:38:33 -0800 (PST) Received-SPF: pass (google.com: best guess record for domain of edk2-devel-bounces@lists.01.org designates 2001:19d0:306:5::1 as permitted sender) client-ip=2001:19d0:306:5::1; Authentication-Results: mx.google.com; dkim=neutral (body hash did not verify) header.i=@linaro.org; spf=pass (google.com: best guess record for domain of edk2-devel-bounces@lists.01.org designates 2001:19d0:306:5::1 as permitted sender) smtp.mailfrom=edk2-devel-bounces@lists.01.org; dmarc=fail (p=NONE sp=NONE dis=NONE) header.from=linaro.org Received: from [127.0.0.1] (localhost [IPv6:::1]) by ml01.01.org (Postfix) with ESMTP id 698DE82005; Mon, 27 Feb 2017 06:38:33 -0800 (PST) X-Original-To: edk2-devel@lists.01.org Delivered-To: edk2-devel@lists.01.org Received: from mail-wr0-x231.google.com (mail-wr0-x231.google.com [IPv6:2a00:1450:400c:c0c::231]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ml01.01.org (Postfix) with ESMTPS id 6ABB3820AC for ; Mon, 27 Feb 2017 06:38:32 -0800 (PST) Received: by mail-wr0-x231.google.com with SMTP id u48so3829292wrc.0 for ; Mon, 27 Feb 2017 06:38:32 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=linaro.org; s=google; h=from:to:cc:subject:date:message-id:in-reply-to:references; bh=3SN/BVIGB5oBtsK8q9l7rGXraQe7/1dHPpE3DII+aEk=; b=ekRO3cRe3m1+n5WoTfokA1a7epajKrK6jkUG7TjnaY3owOmAAit6IAFrYJ4HVB9PUq lK7IJQz4z4ViUWcuj4mrT+QuxLP9skmFPslkVBZTrurUPBBtPDQdTHo4GyomXKoZogOV x1q9LobeBfJIjHmMH0CiNSydn74uIEXsnRcII= X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:from:to:cc:subject:date:message-id:in-reply-to :references; bh=3SN/BVIGB5oBtsK8q9l7rGXraQe7/1dHPpE3DII+aEk=; b=K162RyOxesZayHJS5gTPyZxolgDUC1OlLhHeOelITeZqzMnjGyFa0mEODAH2x78lEl LnLl4t2q3xNMfe+gwfCbFGb/OlWQhKbPJgsbS8e4DLNZe75fpila44st5c7l/UyEJpNi NwVKoHaOZK+11Z0BmnxC6QsMIYMUz3pwn3NROETmzm29kG18Lt+WjrMxMvs1Jp0rBt9c 1Av+EcTtJL2gxPUnUCbQi6otv+1CKc7ZzlR5xfeT9IkkbdeyHpWFE5W7/bemAK1jIxDv 3GtcX0IeApgds/BAMvk5azjzrIfhXq0A0R4FWZy6C8wHfrKfit99G9QawlFrz91B7DM6 jpyw== X-Gm-Message-State: AMke39mHrCHwlEbJfp0VFuSa6K+qLo+9y1D6QAoHLXPpaJ30iTneXVF06KSjhLrmPmOvNKAp X-Received: by 10.223.135.163 with SMTP id b32mr7755641wrb.170.1488206310993; Mon, 27 Feb 2017 06:38:30 -0800 (PST) Received: from localhost.localdomain ([105.149.201.216]) by smtp.gmail.com with ESMTPSA id z134sm14475167wmc.20.2017.02.27.06.38.27 (version=TLS1_2 cipher=ECDHE-RSA-AES128-SHA bits=128/128); Mon, 27 Feb 2017 06:38:30 -0800 (PST) From: Ard Biesheuvel To: edk2-devel@lists.01.org, afish@apple.com, leif.lindholm@linaro.org, michael.d.kinney@intel.com, liming.gao@intel.com, jiewen.yao@intel.com Date: Mon, 27 Feb 2017 14:38:08 +0000 Message-Id: <1488206291-25768-5-git-send-email-ard.biesheuvel@linaro.org> X-Mailer: git-send-email 2.7.4 In-Reply-To: <1488206291-25768-1-git-send-email-ard.biesheuvel@linaro.org> References: <1488206291-25768-1-git-send-email-ard.biesheuvel@linaro.org> Subject: [edk2] [PATCH v4 4/7] MdeModulePkg/DxeCore: use separate lock for pool allocations X-BeenThere: edk2-devel@lists.01.org X-Mailman-Version: 2.1.21 Precedence: list List-Id: EDK II Development List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Cc: feng.tian@intel.com, lersek@redhat.com, star.zeng@intel.com, Ard Biesheuvel MIME-Version: 1.0 Errors-To: edk2-devel-bounces@lists.01.org Sender: "edk2-devel" In preparation of adding memory permission attribute management to the pool allocator, split off the locking of the pool metadata into a separate lock. This is an improvement in itself, given that pool allocation can only interfere with the page allocation bookkeeping if pool pages are allocated or released. But it is also required to ensure that the permission attribute management does not deadlock, given that it may trigger page table splits leading to additional page tables being allocated. Contributed-under: TianoCore Contribution Agreement 1.0 Signed-off-by: Ard Biesheuvel --- MdeModulePkg/Core/Dxe/Mem/Pool.c | 58 ++++++++++++++++---- 1 file changed, 48 insertions(+), 10 deletions(-) -- 2.7.4 _______________________________________________ edk2-devel mailing list edk2-devel@lists.01.org https://lists.01.org/mailman/listinfo/edk2-devel Reviewed-by: Liming Gao Signed-off-by: Ard Biesheuvel diff --git a/MdeModulePkg/Core/Dxe/Mem/Pool.c b/MdeModulePkg/Core/Dxe/Mem/Pool.c index 7afd2d312c1d..ebb2fceedd80 100644 --- a/MdeModulePkg/Core/Dxe/Mem/Pool.c +++ b/MdeModulePkg/Core/Dxe/Mem/Pool.c @@ -15,6 +15,8 @@ WITHOUT WARRANTIES OR REPRESENTATIONS OF ANY KIND, EITHER EXPRESS OR IMPLIED. #include "DxeMain.h" #include "Imem.h" +STATIC EFI_LOCK mPoolMemoryLock = EFI_INITIALIZE_LOCK_VARIABLE (TPL_NOTIFY); + #define POOL_FREE_SIGNATURE SIGNATURE_32('p','f','r','0') typedef struct { UINT32 Signature; @@ -239,13 +241,13 @@ CoreInternalAllocatePool ( // // Acquire the memory lock and make the allocation // - Status = CoreAcquireLockOrFail (&gMemoryLock); + Status = CoreAcquireLockOrFail (&mPoolMemoryLock); if (EFI_ERROR (Status)) { return EFI_OUT_OF_RESOURCES; } *Buffer = CoreAllocatePoolI (PoolType, Size); - CoreReleaseMemoryLock (); + CoreReleaseLock (&mPoolMemoryLock); return (*Buffer != NULL) ? EFI_SUCCESS : EFI_OUT_OF_RESOURCES; } @@ -289,6 +291,28 @@ CoreAllocatePool ( return Status; } +STATIC +VOID * +CoreAllocatePoolPagesI ( + IN EFI_MEMORY_TYPE PoolType, + IN UINTN NoPages, + IN UINTN Granularity + ) +{ + VOID *Buffer; + EFI_STATUS Status; + + Status = CoreAcquireLockOrFail (&gMemoryLock); + if (EFI_ERROR (Status)) { + return NULL; + } + + Buffer = CoreAllocatePoolPages (PoolType, NoPages, Granularity); + CoreReleaseMemoryLock (); + + return Buffer; +} + /** Internal function to allocate pool of a particular type. Caller must have the memory lock held @@ -317,7 +341,7 @@ CoreAllocatePoolI ( UINTN NoPages; UINTN Granularity; - ASSERT_LOCKED (&gMemoryLock); + ASSERT_LOCKED (&mPoolMemoryLock); if (PoolType == EfiACPIReclaimMemory || PoolType == EfiACPIMemoryNVS || @@ -355,7 +379,7 @@ CoreAllocatePoolI ( if (Index >= SIZE_TO_LIST (Granularity)) { NoPages = EFI_SIZE_TO_PAGES(Size) + EFI_SIZE_TO_PAGES (Granularity) - 1; NoPages &= ~(UINTN)(EFI_SIZE_TO_PAGES (Granularity) - 1); - Head = CoreAllocatePoolPages (PoolType, NoPages, Granularity); + Head = CoreAllocatePoolPagesI (PoolType, NoPages, Granularity); goto Done; } @@ -383,7 +407,7 @@ CoreAllocatePoolI ( // // Get another page // - NewPage = CoreAllocatePoolPages(PoolType, EFI_SIZE_TO_PAGES (Granularity), Granularity); + NewPage = CoreAllocatePoolPagesI (PoolType, EFI_SIZE_TO_PAGES (Granularity), Granularity); if (NewPage == NULL) { goto Done; } @@ -486,9 +510,9 @@ CoreInternalFreePool ( return EFI_INVALID_PARAMETER; } - CoreAcquireMemoryLock (); + CoreAcquireLock (&mPoolMemoryLock); Status = CoreFreePoolI (Buffer, PoolType); - CoreReleaseMemoryLock (); + CoreReleaseLock (&mPoolMemoryLock); return Status; } @@ -525,6 +549,19 @@ CoreFreePool ( return Status; } +STATIC +VOID +CoreFreePoolPagesI ( + IN EFI_MEMORY_TYPE PoolType, + IN EFI_PHYSICAL_ADDRESS Memory, + IN UINTN NoPages + ) +{ + CoreAcquireMemoryLock (); + CoreFreePoolPages (Memory, NoPages); + CoreReleaseMemoryLock (); +} + /** Internal function to free a pool entry. Caller must have the memory lock held @@ -573,7 +610,7 @@ CoreFreePoolI ( // ASSERT (Tail->Signature == POOL_TAIL_SIGNATURE); ASSERT (Head->Size == Tail->Size); - ASSERT_LOCKED (&gMemoryLock); + ASSERT_LOCKED (&mPoolMemoryLock); if (Tail->Signature != POOL_TAIL_SIGNATURE) { return EFI_INVALID_PARAMETER; @@ -624,7 +661,7 @@ CoreFreePoolI ( // NoPages = EFI_SIZE_TO_PAGES(Size) + EFI_SIZE_TO_PAGES (Granularity) - 1; NoPages &= ~(UINTN)(EFI_SIZE_TO_PAGES (Granularity) - 1); - CoreFreePoolPages ((EFI_PHYSICAL_ADDRESS) (UINTN) Head, NoPages); + CoreFreePoolPagesI (Pool->MemoryType, (EFI_PHYSICAL_ADDRESS) (UINTN) Head, NoPages); } else { @@ -680,7 +717,8 @@ CoreFreePoolI ( // // Free the page // - CoreFreePoolPages ((EFI_PHYSICAL_ADDRESS) (UINTN)NewPage, EFI_SIZE_TO_PAGES (Granularity)); + CoreFreePoolPagesI (Pool->MemoryType, (EFI_PHYSICAL_ADDRESS) (UINTN)NewPage, + EFI_SIZE_TO_PAGES (Granularity)); } } } From patchwork Mon Feb 27 14:38:09 2017 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Ard Biesheuvel X-Patchwork-Id: 94547 Delivered-To: patch@linaro.org Received: by 10.140.20.113 with SMTP id 104csp889624qgi; Mon, 27 Feb 2017 06:38:37 -0800 (PST) X-Received: by 10.99.147.16 with SMTP id b16mr21572334pge.126.1488206317105; Mon, 27 Feb 2017 06:38:37 -0800 (PST) Return-Path: Received: from ml01.01.org (ml01.01.org. [198.145.21.10]) by mx.google.com with ESMTPS id 30si15293767pla.317.2017.02.27.06.38.36 (version=TLS1_2 cipher=ECDHE-RSA-AES128-GCM-SHA256 bits=128/128); Mon, 27 Feb 2017 06:38:37 -0800 (PST) Received-SPF: pass (google.com: best guess record for domain of edk2-devel-bounces@lists.01.org designates 198.145.21.10 as permitted sender) client-ip=198.145.21.10; Authentication-Results: mx.google.com; dkim=neutral (body hash did not verify) header.i=@linaro.org; spf=pass (google.com: best guess record for domain of edk2-devel-bounces@lists.01.org designates 198.145.21.10 as permitted sender) smtp.mailfrom=edk2-devel-bounces@lists.01.org; dmarc=fail (p=NONE sp=NONE dis=NONE) header.from=linaro.org Received: from [127.0.0.1] (localhost [IPv6:::1]) by ml01.01.org (Postfix) with ESMTP id A1A00820B2; Mon, 27 Feb 2017 06:38:36 -0800 (PST) X-Original-To: edk2-devel@lists.01.org Delivered-To: edk2-devel@lists.01.org Received: from mail-wr0-x22c.google.com (mail-wr0-x22c.google.com [IPv6:2a00:1450:400c:c0c::22c]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ml01.01.org (Postfix) with ESMTPS id 8CAD781F56 for ; Mon, 27 Feb 2017 06:38:35 -0800 (PST) Received: by mail-wr0-x22c.google.com with SMTP id g10so53551598wrg.2 for ; Mon, 27 Feb 2017 06:38:35 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=linaro.org; s=google; h=from:to:cc:subject:date:message-id:in-reply-to:references; bh=2jC2rfxhmHu8dd9AtYRX9an6k0vebHHCCsQsTZhB190=; b=ZGuiD0dje9CGUEZXUhivFgADlr8pbuYiiQxngvHPKBFOCJtVRlYVDhaHfq3DJ5RCKl YT9Z/K4bX52PGZgBe2gfZw5SjcFrKGWe+5EfbernNqs7Wun6jEJ624ppNJmxF5hTb+5F WvtnQCbuTL5fAhcrAD+Yi+raCAUWo8eYGiXTI= X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:from:to:cc:subject:date:message-id:in-reply-to :references; bh=2jC2rfxhmHu8dd9AtYRX9an6k0vebHHCCsQsTZhB190=; b=nr1T3BgIiN+HUnsINHu6YTTGPR9feTGzITcbT7GScSBOQtJcz8FfkbJEwLoAmYugKt en66EZEy7p24IoDopNIB2EkX/3EyFpqCuw0F/pWj2SdQ2hJ+XJXz5WmXmPxvq0Z7+bSN CP87q7BvBsPJ7BN59VHqcqREkptNRl30Ihi1zAeZ1qAh+OudwNcAUX+MT8AS3SwWlBqG +S4Ir0bOHHu0lGFWpsyfVogdjy/gC0A1sJ/hixOQHkC5Own3Z4b3M6z/VAOk1DLbsRzo nxnV0d9Gy7LS+Lc16UWevlUri/HMrui5urkPiNYzstf44N2LGFLuJMS6hVrF6LaRTbt9 BITA== X-Gm-Message-State: AMke39mjcCmks5z7DuqbXyQuCEvB6jqAxCKq0nsA/DpDn3APF4dbr2zvDzYAvvnUyE49EBx5 X-Received: by 10.223.182.133 with SMTP id j5mr5595549wre.19.1488206314063; Mon, 27 Feb 2017 06:38:34 -0800 (PST) Received: from localhost.localdomain ([105.149.201.216]) by smtp.gmail.com with ESMTPSA id z134sm14475167wmc.20.2017.02.27.06.38.31 (version=TLS1_2 cipher=ECDHE-RSA-AES128-SHA bits=128/128); Mon, 27 Feb 2017 06:38:33 -0800 (PST) From: Ard Biesheuvel To: edk2-devel@lists.01.org, afish@apple.com, leif.lindholm@linaro.org, michael.d.kinney@intel.com, liming.gao@intel.com, jiewen.yao@intel.com Date: Mon, 27 Feb 2017 14:38:09 +0000 Message-Id: <1488206291-25768-6-git-send-email-ard.biesheuvel@linaro.org> X-Mailer: git-send-email 2.7.4 In-Reply-To: <1488206291-25768-1-git-send-email-ard.biesheuvel@linaro.org> References: <1488206291-25768-1-git-send-email-ard.biesheuvel@linaro.org> Subject: [edk2] [PATCH v4 5/7] MdeModulePkg: define PCD for DXE memory protection policy X-BeenThere: edk2-devel@lists.01.org X-Mailman-Version: 2.1.21 Precedence: list List-Id: EDK II Development List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Cc: feng.tian@intel.com, lersek@redhat.com, star.zeng@intel.com, Ard Biesheuvel MIME-Version: 1.0 Errors-To: edk2-devel-bounces@lists.01.org Sender: "edk2-devel" Define a new fixed/patchable PCD that sets the DXE memory protection policy: its primary use is to define which memory types should have their executable permissions removed. Combined with the image protection policy, this can be used to implement a strict W^X policy, i.e.. a policy where no regions exist that are both executable and writable at the same time. Contributed-under: TianoCore Contribution Agreement 1.0 Signed-off-by: Ard Biesheuvel --- MdeModulePkg/MdeModulePkg.dec | 32 ++++++++++++++++++++ 1 file changed, 32 insertions(+) -- 2.7.4 _______________________________________________ edk2-devel mailing list edk2-devel@lists.01.org https://lists.01.org/mailman/listinfo/edk2-devel diff --git a/MdeModulePkg/MdeModulePkg.dec b/MdeModulePkg/MdeModulePkg.dec index 426634fbbd4d..10f460818915 100644 --- a/MdeModulePkg/MdeModulePkg.dec +++ b/MdeModulePkg/MdeModulePkg.dec @@ -1107,6 +1107,38 @@ [PcdsFixedAtBuild, PcdsPatchableInModule] # @ValidRange 0x80000002 | 0x00000000 - 0x0000001F gEfiMdeModulePkgTokenSpaceGuid.PcdImageProtectionPolicy|0x00000002|UINT32|0x00001047 + ## Set DXE memory protection policy. The policy is bitwise. + # If a bit is set, memory regions of the associated type will be mapped + # non-executable.

+ # + # Below is bit mask for this PCD: (Order is same as UEFI spec)
+ # EfiReservedMemoryType 0x0001
+ # EfiLoaderCode 0x0002
+ # EfiLoaderData 0x0004
+ # EfiBootServicesCode 0x0008
+ # EfiBootServicesData 0x0010
+ # EfiRuntimeServicesCode 0x0020
+ # EfiRuntimeServicesData 0x0040
+ # EfiConventionalMemory 0x0080
+ # EfiUnusableMemory 0x0100
+ # EfiACPIReclaimMemory 0x0200
+ # EfiACPIMemoryNVS 0x0400
+ # EfiMemoryMappedIO 0x0800
+ # EfiMemoryMappedIOPortSpace 0x1000
+ # EfiPalCode 0x2000
+ # EfiPersistentMemory 0x4000
+ # OEM Reserved 0x4000000000000000
+ # OS Reserved 0x8000000000000000
+ # + # NOTE: User must NOT set NX protection for EfiLoaderCode / EfiBootServicesCode / EfiRuntimeServicesCode.
+ # User MUST set the same NX protection for EfiBootServicesData and EfiConventionalMemory.
+ # + # e.g. 0x7FD5 can be used for all memory except Code.
+ # e.g. 0x7BD4 can be used for all memory except Code and ACPINVS/Reserved.
+ # + # @Prompt Set DXE memory protection policy. + gEfiMdeModulePkgTokenSpaceGuid.PcdDxeNxMemoryProtectionPolicy|0x0000000|UINT64|0x00001048 + ## PCI Serial Device Info. It is an array of Device, Function, and Power Management # information that describes the path that contains zero or more PCI to PCI briges # followed by a PCI serial device. Each array entry is 4-bytes in length. The From patchwork Mon Feb 27 14:38:10 2017 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Ard Biesheuvel X-Patchwork-Id: 94548 Delivered-To: patch@linaro.org Received: by 10.140.20.113 with SMTP id 104csp889654qgi; Mon, 27 Feb 2017 06:38:41 -0800 (PST) X-Received: by 10.84.218.78 with SMTP id f14mr24715664plm.146.1488206321388; Mon, 27 Feb 2017 06:38:41 -0800 (PST) Return-Path: Received: from ml01.01.org (ml01.01.org. [2001:19d0:306:5::1]) by mx.google.com with ESMTPS id e5si15326372pgj.60.2017.02.27.06.38.41 (version=TLS1_2 cipher=ECDHE-RSA-AES128-GCM-SHA256 bits=128/128); Mon, 27 Feb 2017 06:38:41 -0800 (PST) Received-SPF: pass (google.com: best guess record for domain of edk2-devel-bounces@lists.01.org designates 2001:19d0:306:5::1 as permitted sender) client-ip=2001:19d0:306:5::1; Authentication-Results: mx.google.com; dkim=neutral (body hash did not verify) header.i=@linaro.org; spf=pass (google.com: best guess record for domain of edk2-devel-bounces@lists.01.org designates 2001:19d0:306:5::1 as permitted sender) smtp.mailfrom=edk2-devel-bounces@lists.01.org; dmarc=fail (p=NONE sp=NONE dis=NONE) header.from=linaro.org Received: from [127.0.0.1] (localhost [IPv6:::1]) by ml01.01.org (Postfix) with ESMTP id DD57482101; Mon, 27 Feb 2017 06:38:40 -0800 (PST) X-Original-To: edk2-devel@lists.01.org Delivered-To: edk2-devel@lists.01.org Received: from mail-wm0-x22e.google.com (mail-wm0-x22e.google.com [IPv6:2a00:1450:400c:c09::22e]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ml01.01.org (Postfix) with ESMTPS id A4D3C81F56 for ; Mon, 27 Feb 2017 06:38:38 -0800 (PST) Received: by mail-wm0-x22e.google.com with SMTP id v77so62590720wmv.1 for ; Mon, 27 Feb 2017 06:38:38 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=linaro.org; s=google; h=from:to:cc:subject:date:message-id:in-reply-to:references; bh=hjtZYmlWaiPkwrAoSZNJHaMzD20E3mG7KxRvlNW12Jo=; b=gQv9DVzRI2eZuFV1Ikl4VNgQOm9Sl8Eu2FyaC/BS4qVDiU6kvMfAdFLfsYE+oBrrGl BDO9YNZ533T+gjkK3Gh6q7gMSLobA9t565ZDyk1ZQ4VIcMUx+qWkb2CTCqFs1SVD8ZXf GieqQt09LQ1l1uALtGNtOczSw1PIOPCgZfKrA= X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:from:to:cc:subject:date:message-id:in-reply-to :references; bh=hjtZYmlWaiPkwrAoSZNJHaMzD20E3mG7KxRvlNW12Jo=; b=OBKgQ67HnZFI+Zh95Am/hN/YUcRHIS56HSQLGFIV+CgnH0IC+71cgjnE6XZoYBz912 ociMUD2yKOiwnV0Yg32jyz2xGhYJhSu4+/SrQdbEryPugfPaHKV2AGWk4GmzxjwppSk+ b1W9RaCyK0YsPhckV5qoBrWhFuN1VHYgco0cCY8ieGj2B9RMt3M/ohXhIjwkV9d2iNHP irLu5agqUHRJ/szOgrsrswdRaMwJGrMvVu53gyaOHWeZtYoiRvGY19ZvH0e6KT34Jdge jQWqNP93WxDCEuEdBrFN8aOJRvRR0ykxQYKWH1bPnFt8oFQTsIxk/qiHaUVcEUgs/SW0 ujxA== X-Gm-Message-State: AMke39ncGZ+MQSVP9ZJ7byHxEJCoJKpNtBMn1u0ISo/LvIv3hicQXbqgfSv1XAwtlPcrz7DW X-Received: by 10.28.62.144 with SMTP id l138mr13735496wma.50.1488206316925; Mon, 27 Feb 2017 06:38:36 -0800 (PST) Received: from localhost.localdomain ([105.149.201.216]) by smtp.gmail.com with ESMTPSA id z134sm14475167wmc.20.2017.02.27.06.38.34 (version=TLS1_2 cipher=ECDHE-RSA-AES128-SHA bits=128/128); Mon, 27 Feb 2017 06:38:36 -0800 (PST) From: Ard Biesheuvel To: edk2-devel@lists.01.org, afish@apple.com, leif.lindholm@linaro.org, michael.d.kinney@intel.com, liming.gao@intel.com, jiewen.yao@intel.com Date: Mon, 27 Feb 2017 14:38:10 +0000 Message-Id: <1488206291-25768-7-git-send-email-ard.biesheuvel@linaro.org> X-Mailer: git-send-email 2.7.4 In-Reply-To: <1488206291-25768-1-git-send-email-ard.biesheuvel@linaro.org> References: <1488206291-25768-1-git-send-email-ard.biesheuvel@linaro.org> Subject: [edk2] [PATCH v4 6/7] MdeModulePkg/DxeCore: implement memory protection policy X-BeenThere: edk2-devel@lists.01.org X-Mailman-Version: 2.1.21 Precedence: list List-Id: EDK II Development List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Cc: feng.tian@intel.com, lersek@redhat.com, star.zeng@intel.com, Ard Biesheuvel MIME-Version: 1.0 Errors-To: edk2-devel-bounces@lists.01.org Sender: "edk2-devel" This implements a DXE memory protection policy that ensure that regions that don't require executable permissions are mapped with the non-exec attribute set. First of all, it iterates over all entries in the UEFI memory map, and removes executable permissions according to the configured DXE memory protection policy, as recorded in PcdDxeMemoryProtectionPolicy. Secondly, it sets or clears the non-executable attribute when allocating or freeing pages, both for page based or pool based allocations. Note that this complements the image protection facility, which applies strict permissions to BootServicesCode/RuntimeServicesCode regions when the section alignment allows it. The memory protection configured by this patch operates on non-code regions only. Contributed-under: TianoCore Contribution Agreement 1.0 Signed-off-by: Ard Biesheuvel --- MdeModulePkg/Core/Dxe/DxeMain.h | 24 ++ MdeModulePkg/Core/Dxe/DxeMain.inf | 1 + MdeModulePkg/Core/Dxe/Mem/Page.c | 7 + MdeModulePkg/Core/Dxe/Mem/Pool.c | 7 + MdeModulePkg/Core/Dxe/Misc/MemoryProtection.c | 371 +++++++++++++++++++- 5 files changed, 409 insertions(+), 1 deletion(-) -- 2.7.4 _______________________________________________ edk2-devel mailing list edk2-devel@lists.01.org https://lists.01.org/mailman/listinfo/edk2-devel Reviewed-by: Liming Gao Signed-off-by: Ard Biesheuvel diff --git a/MdeModulePkg/Core/Dxe/DxeMain.h b/MdeModulePkg/Core/Dxe/DxeMain.h index b14be9a74d8e..5668c1f2d648 100644 --- a/MdeModulePkg/Core/Dxe/DxeMain.h +++ b/MdeModulePkg/Core/Dxe/DxeMain.h @@ -2949,4 +2949,28 @@ MemoryProtectionExitBootServicesCallback ( VOID ); +/** + Manage memory permission attributes on a memory range, according to the + configured DXE memory protection policy. + + @param OldType The old memory type of the range + @param NewType The new memory type of the range + @param Memory The base address of the range + @param Length The size of the range (in bytes) + + @return EFI_SUCCESS If the the CPU arch protocol is not installed yet + @return EFI_SUCCESS If no DXE memory protection policy has been configured + @return EFI_SUCCESS If OldType and NewType use the same permission attributes + @return other Return value of gCpu->SetMemoryAttributes() + +**/ +EFI_STATUS +EFIAPI +ApplyMemoryProtectionPolicy ( + IN EFI_MEMORY_TYPE OldType, + IN EFI_MEMORY_TYPE NewType, + IN EFI_PHYSICAL_ADDRESS Memory, + IN UINT64 Length + ); + #endif diff --git a/MdeModulePkg/Core/Dxe/DxeMain.inf b/MdeModulePkg/Core/Dxe/DxeMain.inf index 371e91cb0d7e..30d5984f7c1f 100644 --- a/MdeModulePkg/Core/Dxe/DxeMain.inf +++ b/MdeModulePkg/Core/Dxe/DxeMain.inf @@ -191,6 +191,7 @@ [Pcd] gEfiMdeModulePkgTokenSpaceGuid.PcdMemoryProfileDriverPath ## CONSUMES gEfiMdeModulePkgTokenSpaceGuid.PcdPropertiesTableEnable ## CONSUMES gEfiMdeModulePkgTokenSpaceGuid.PcdImageProtectionPolicy ## CONSUMES + gEfiMdeModulePkgTokenSpaceGuid.PcdDxeNxMemoryProtectionPolicy ## CONSUMES # [Hob] # RESOURCE_DESCRIPTOR ## CONSUMES diff --git a/MdeModulePkg/Core/Dxe/Mem/Page.c b/MdeModulePkg/Core/Dxe/Mem/Page.c index bda4f6397e91..d596db7ad427 100644 --- a/MdeModulePkg/Core/Dxe/Mem/Page.c +++ b/MdeModulePkg/Core/Dxe/Mem/Page.c @@ -553,6 +553,9 @@ CoreAddMemoryDescriptor ( CoreFreeMemoryMapStack (); CoreReleaseMemoryLock (); + ApplyMemoryProtectionPolicy (EfiMaxMemoryType, Type, Start, + EFI_PAGES_TO_SIZE (NumberOfPages)); + // // If Loading Module At Fixed Address feature is enabled. try to allocate memory with Runtime code & Boot time code type // @@ -1344,6 +1347,8 @@ CoreAllocatePages ( NULL ); InstallMemoryAttributesTableOnMemoryAllocation (MemoryType); + ApplyMemoryProtectionPolicy (EfiConventionalMemory, MemoryType, *Memory, + EFI_PAGES_TO_SIZE (NumberOfPages)); } return Status; } @@ -1460,6 +1465,8 @@ CoreFreePages ( NULL ); InstallMemoryAttributesTableOnMemoryAllocation (MemoryType); + ApplyMemoryProtectionPolicy (MemoryType, EfiConventionalMemory, Memory, + EFI_PAGES_TO_SIZE (NumberOfPages)); } return Status; } diff --git a/MdeModulePkg/Core/Dxe/Mem/Pool.c b/MdeModulePkg/Core/Dxe/Mem/Pool.c index ebb2fceedd80..ced64443c77d 100644 --- a/MdeModulePkg/Core/Dxe/Mem/Pool.c +++ b/MdeModulePkg/Core/Dxe/Mem/Pool.c @@ -310,6 +310,10 @@ CoreAllocatePoolPagesI ( Buffer = CoreAllocatePoolPages (PoolType, NoPages, Granularity); CoreReleaseMemoryLock (); + if (Buffer != NULL) { + ApplyMemoryProtectionPolicy (EfiConventionalMemory, PoolType, + (EFI_PHYSICAL_ADDRESS)(UINTN)Buffer, EFI_PAGES_TO_SIZE (NoPages)); + } return Buffer; } @@ -560,6 +564,9 @@ CoreFreePoolPagesI ( CoreAcquireMemoryLock (); CoreFreePoolPages (Memory, NoPages); CoreReleaseMemoryLock (); + + ApplyMemoryProtectionPolicy (PoolType, EfiConventionalMemory, + (EFI_PHYSICAL_ADDRESS)(UINTN)Memory, EFI_PAGES_TO_SIZE (NoPages)); } /** diff --git a/MdeModulePkg/Core/Dxe/Misc/MemoryProtection.c b/MdeModulePkg/Core/Dxe/Misc/MemoryProtection.c index 46d88463d417..172d6679857a 100644 --- a/MdeModulePkg/Core/Dxe/Misc/MemoryProtection.c +++ b/MdeModulePkg/Core/Dxe/Misc/MemoryProtection.c @@ -64,8 +64,16 @@ WITHOUT WARRANTIES OR REPRESENTATIONS OF ANY KIND, EITHER EXPRESS OR IMPLIED. #define DO_NOT_PROTECT 0x00000000 #define PROTECT_IF_ALIGNED_ELSE_ALLOW 0x00000001 +#define MEMORY_TYPE_OS_RESERVED_MIN 0x80000000 +#define MEMORY_TYPE_OEM_RESERVED_MIN 0x70000000 + +#define PREVIOUS_MEMORY_DESCRIPTOR(MemoryDescriptor, Size) \ + ((EFI_MEMORY_DESCRIPTOR *)((UINT8 *)(MemoryDescriptor) - (Size))) + UINT32 mImageProtectionPolicy; +extern LIST_ENTRY mGcdMemorySpaceMap; + /** Sort code section in image record, based upon CodeSegmentBase from low to high. @@ -647,6 +655,251 @@ UnprotectUefiImage ( } /** + Return the EFI memory permission attribute associated with memory + type 'MemoryType' under the configured DXE memory protection policy. +**/ +STATIC +UINT64 +GetPermissionAttributeForMemoryType ( + IN EFI_MEMORY_TYPE MemoryType + ) +{ + UINT64 TestBit; + + if ((UINT32)MemoryType >= MEMORY_TYPE_OS_RESERVED_MIN) { + TestBit = BIT63; + } else if ((UINT32)MemoryType >= MEMORY_TYPE_OEM_RESERVED_MIN) { + TestBit = BIT62; + } else { + TestBit = LShiftU64 (1, MemoryType); + } + + if ((PcdGet64 (PcdDxeNxMemoryProtectionPolicy) & TestBit) != 0) { + return EFI_MEMORY_XP; + } else { + return 0; + } +} + +/** + Sort memory map entries based upon PhysicalStart, from low to high. + + @param MemoryMap A pointer to the buffer in which firmware places + the current memory map. + @param MemoryMapSize Size, in bytes, of the MemoryMap buffer. + @param DescriptorSize Size, in bytes, of an individual EFI_MEMORY_DESCRIPTOR. +**/ +STATIC +VOID +SortMemoryMap ( + IN OUT EFI_MEMORY_DESCRIPTOR *MemoryMap, + IN UINTN MemoryMapSize, + IN UINTN DescriptorSize + ) +{ + EFI_MEMORY_DESCRIPTOR *MemoryMapEntry; + EFI_MEMORY_DESCRIPTOR *NextMemoryMapEntry; + EFI_MEMORY_DESCRIPTOR *MemoryMapEnd; + EFI_MEMORY_DESCRIPTOR TempMemoryMap; + + MemoryMapEntry = MemoryMap; + NextMemoryMapEntry = NEXT_MEMORY_DESCRIPTOR (MemoryMapEntry, DescriptorSize); + MemoryMapEnd = (EFI_MEMORY_DESCRIPTOR *) ((UINT8 *) MemoryMap + MemoryMapSize); + while (MemoryMapEntry < MemoryMapEnd) { + while (NextMemoryMapEntry < MemoryMapEnd) { + if (MemoryMapEntry->PhysicalStart > NextMemoryMapEntry->PhysicalStart) { + CopyMem (&TempMemoryMap, MemoryMapEntry, sizeof(EFI_MEMORY_DESCRIPTOR)); + CopyMem (MemoryMapEntry, NextMemoryMapEntry, sizeof(EFI_MEMORY_DESCRIPTOR)); + CopyMem (NextMemoryMapEntry, &TempMemoryMap, sizeof(EFI_MEMORY_DESCRIPTOR)); + } + + NextMemoryMapEntry = NEXT_MEMORY_DESCRIPTOR (NextMemoryMapEntry, DescriptorSize); + } + + MemoryMapEntry = NEXT_MEMORY_DESCRIPTOR (MemoryMapEntry, DescriptorSize); + NextMemoryMapEntry = NEXT_MEMORY_DESCRIPTOR (MemoryMapEntry, DescriptorSize); + } +} + +/** + Merge adjacent memory map entries if they use the same memory protection policy + + @param[in, out] MemoryMap A pointer to the buffer in which firmware places + the current memory map. + @param[in, out] MemoryMapSize A pointer to the size, in bytes, of the + MemoryMap buffer. On input, this is the size of + the current memory map. On output, + it is the size of new memory map after merge. + @param[in] DescriptorSize Size, in bytes, of an individual EFI_MEMORY_DESCRIPTOR. +**/ +STATIC +VOID +MergeMemoryMapForProtectionPolicy ( + IN OUT EFI_MEMORY_DESCRIPTOR *MemoryMap, + IN OUT UINTN *MemoryMapSize, + IN UINTN DescriptorSize + ) +{ + EFI_MEMORY_DESCRIPTOR *MemoryMapEntry; + EFI_MEMORY_DESCRIPTOR *MemoryMapEnd; + UINT64 MemoryBlockLength; + EFI_MEMORY_DESCRIPTOR *NewMemoryMapEntry; + EFI_MEMORY_DESCRIPTOR *NextMemoryMapEntry; + UINT64 Attributes; + + SortMemoryMap (MemoryMap, *MemoryMapSize, DescriptorSize); + + MemoryMapEntry = MemoryMap; + NewMemoryMapEntry = MemoryMap; + MemoryMapEnd = (EFI_MEMORY_DESCRIPTOR *) ((UINT8 *) MemoryMap + *MemoryMapSize); + while ((UINTN)MemoryMapEntry < (UINTN)MemoryMapEnd) { + CopyMem (NewMemoryMapEntry, MemoryMapEntry, sizeof(EFI_MEMORY_DESCRIPTOR)); + NextMemoryMapEntry = NEXT_MEMORY_DESCRIPTOR (MemoryMapEntry, DescriptorSize); + + do { + MemoryBlockLength = (UINT64) (EFI_PAGES_TO_SIZE((UINTN)MemoryMapEntry->NumberOfPages)); + Attributes = GetPermissionAttributeForMemoryType (MemoryMapEntry->Type); + + if (((UINTN)NextMemoryMapEntry < (UINTN)MemoryMapEnd) && + Attributes == GetPermissionAttributeForMemoryType (NextMemoryMapEntry->Type) && + ((MemoryMapEntry->PhysicalStart + MemoryBlockLength) == NextMemoryMapEntry->PhysicalStart)) { + MemoryMapEntry->NumberOfPages += NextMemoryMapEntry->NumberOfPages; + if (NewMemoryMapEntry != MemoryMapEntry) { + NewMemoryMapEntry->NumberOfPages += NextMemoryMapEntry->NumberOfPages; + } + + NextMemoryMapEntry = NEXT_MEMORY_DESCRIPTOR (NextMemoryMapEntry, DescriptorSize); + continue; + } else { + MemoryMapEntry = PREVIOUS_MEMORY_DESCRIPTOR (NextMemoryMapEntry, DescriptorSize); + break; + } + } while (TRUE); + + MemoryMapEntry = NEXT_MEMORY_DESCRIPTOR (MemoryMapEntry, DescriptorSize); + NewMemoryMapEntry = NEXT_MEMORY_DESCRIPTOR (NewMemoryMapEntry, DescriptorSize); + } + + *MemoryMapSize = (UINTN)NewMemoryMapEntry - (UINTN)MemoryMap; + + return ; +} + + +/** + Remove exec permissions from all regions whose type is identified by + PcdDxeNxMemoryProtectionPolicy +**/ +STATIC +VOID +InitializeDxeNxMemoryProtectionPolicy ( + VOID + ) +{ + UINTN MemoryMapSize; + UINTN MapKey; + UINTN DescriptorSize; + UINT32 DescriptorVersion; + EFI_MEMORY_DESCRIPTOR *MemoryMap; + EFI_MEMORY_DESCRIPTOR *MemoryMapEntry; + EFI_MEMORY_DESCRIPTOR *MemoryMapEnd; + EFI_STATUS Status; + UINT64 Attributes; + LIST_ENTRY *Link; + EFI_GCD_MAP_ENTRY *Entry; + + // + // Get the EFI memory map. + // + MemoryMapSize = 0; + MemoryMap = NULL; + + Status = gBS->GetMemoryMap ( + &MemoryMapSize, + MemoryMap, + &MapKey, + &DescriptorSize, + &DescriptorVersion + ); + ASSERT (Status == EFI_BUFFER_TOO_SMALL); + do { + MemoryMap = (EFI_MEMORY_DESCRIPTOR *) AllocatePool (MemoryMapSize); + ASSERT (MemoryMap != NULL); + Status = gBS->GetMemoryMap ( + &MemoryMapSize, + MemoryMap, + &MapKey, + &DescriptorSize, + &DescriptorVersion + ); + if (EFI_ERROR (Status)) { + FreePool (MemoryMap); + } + } while (Status == EFI_BUFFER_TOO_SMALL); + ASSERT_EFI_ERROR (Status); + + DEBUG((DEBUG_ERROR, "%a: applying strict permissions to active memory regions\n", + __FUNCTION__)); + + MergeMemoryMapForProtectionPolicy (MemoryMap, &MemoryMapSize, DescriptorSize); + + MemoryMapEntry = MemoryMap; + MemoryMapEnd = (EFI_MEMORY_DESCRIPTOR *) ((UINT8 *) MemoryMap + MemoryMapSize); + while ((UINTN) MemoryMapEntry < (UINTN) MemoryMapEnd) { + + Attributes = GetPermissionAttributeForMemoryType (MemoryMapEntry->Type); + if (Attributes != 0) { + SetUefiImageMemoryAttributes ( + MemoryMapEntry->PhysicalStart, + EFI_PAGES_TO_SIZE (MemoryMapEntry->NumberOfPages), + Attributes); + } + MemoryMapEntry = NEXT_MEMORY_DESCRIPTOR (MemoryMapEntry, DescriptorSize); + } + FreePool (MemoryMap); + + // + // Apply the policy for RAM regions that we know are present and + // accessible, but have not been added to the UEFI memory map (yet). + // + if (GetPermissionAttributeForMemoryType (EfiConventionalMemory) != 0) { + DEBUG((DEBUG_ERROR, + "%a: applying strict permissions to inactive memory regions\n", + __FUNCTION__)); + + CoreAcquireGcdMemoryLock (); + + Link = mGcdMemorySpaceMap.ForwardLink; + while (Link != &mGcdMemorySpaceMap) { + + Entry = CR (Link, EFI_GCD_MAP_ENTRY, Link, EFI_GCD_MAP_SIGNATURE); + + if (Entry->GcdMemoryType == EfiGcdMemoryTypeReserved && + Entry->EndAddress < MAX_ADDRESS && + (Entry->Capabilities & (EFI_MEMORY_PRESENT | EFI_MEMORY_INITIALIZED | EFI_MEMORY_TESTED)) == + (EFI_MEMORY_PRESENT | EFI_MEMORY_INITIALIZED)) { + + Attributes = GetPermissionAttributeForMemoryType (EfiConventionalMemory) | + (Entry->Attributes & CACHE_ATTRIBUTE_MASK); + + DEBUG ((DEBUG_INFO, + "Untested GCD memory space region: - 0x%016lx - 0x%016lx (0x%016lx)\n", + Entry->BaseAddress, Entry->EndAddress - Entry->BaseAddress + 1, + Attributes)); + + ASSERT(gCpu != NULL); + gCpu->SetMemoryAttributes (gCpu, Entry->BaseAddress, + Entry->EndAddress - Entry->BaseAddress + 1, Attributes); + } + + Link = Link->ForwardLink; + } + CoreReleaseGcdMemoryLock (); + } +} + + +/** A notification for CPU_ARCH protocol. @param[in] Event Event whose notification function is being invoked. @@ -674,6 +927,17 @@ MemoryProtectionCpuArchProtocolNotify ( return; } + // + // Apply the memory protection policy on non-BScode/RTcode regions. + // + if (PcdGet64 (PcdDxeNxMemoryProtectionPolicy) != 0) { + InitializeDxeNxMemoryProtectionPolicy (); + } + + if (mImageProtectionPolicy == 0) { + return; + } + Status = gBS->LocateHandleBuffer ( ByProtocol, &gEfiLoadedImageProtocolGuid, @@ -753,7 +1017,19 @@ CoreInitializeMemoryProtection ( mImageProtectionPolicy = PcdGet32(PcdImageProtectionPolicy); - if (mImageProtectionPolicy != 0) { + // + // Sanity check the PcdDxeNxMemoryProtectionPolicy setting: + // - code regions should have no EFI_MEMORY_XP attribute + // - EfiConventionalMemory and EfiBootServicesData should use the + // same attribute + // + ASSERT ((GetPermissionAttributeForMemoryType (EfiBootServicesCode) & EFI_MEMORY_XP) == 0); + ASSERT ((GetPermissionAttributeForMemoryType (EfiRuntimeServicesCode) & EFI_MEMORY_XP) == 0); + ASSERT ((GetPermissionAttributeForMemoryType (EfiLoaderCode) & EFI_MEMORY_XP) == 0); + ASSERT (GetPermissionAttributeForMemoryType (EfiBootServicesData) == + GetPermissionAttributeForMemoryType (EfiConventionalMemory)); + + if (mImageProtectionPolicy != 0 || PcdGet64 (PcdDxeNxMemoryProtectionPolicy) != 0) { Status = CoreCreateEvent ( EVT_NOTIFY_SIGNAL, TPL_CALLBACK, @@ -775,3 +1051,96 @@ CoreInitializeMemoryProtection ( } return ; } + +/** + Returns whether we are currently executing in SMM mode +**/ +STATIC +BOOLEAN +IsInSmm ( + VOID + ) +{ + BOOLEAN InSmm; + + InSmm = FALSE; + if (gSmmBase2 != NULL) { + gSmmBase2->InSmm (gSmmBase2, &InSmm); + } + return InSmm; +} + +/** + Manage memory permission attributes on a memory range, according to the + configured DXE memory protection policy. + + @param OldType The old memory type of the range + @param NewType The new memory type of the range + @param Memory The base address of the range + @param Length The size of the range (in bytes) + + @return EFI_SUCCESS If we are executing in SMM mode. No permission attributes + are updated in this case + @return EFI_SUCCESS If the the CPU arch protocol is not installed yet + @return EFI_SUCCESS If no DXE memory protection policy has been configured + @return EFI_SUCCESS If OldType and NewType use the same permission attributes + @return other Return value of gCpu->SetMemoryAttributes() + +**/ +EFI_STATUS +EFIAPI +ApplyMemoryProtectionPolicy ( + IN EFI_MEMORY_TYPE OldType, + IN EFI_MEMORY_TYPE NewType, + IN EFI_PHYSICAL_ADDRESS Memory, + IN UINT64 Length + ) +{ + UINT64 OldAttributes; + UINT64 NewAttributes; + + // + // The policy configured in PcdDxeNxMemoryProtectionPolicy + // does not apply to allocations performed in SMM mode. + // + if (IsInSmm ()) { + return EFI_SUCCESS; + } + + // + // If the CPU arch protocol is not installed yet, we cannot manage memory + // permission attributes, and it is the job of the driver that installs this + // protocol to set the permissions on existing allocations. + // + if (gCpu == NULL) { + return EFI_SUCCESS; + } + + // + // Check if a DXE memory protection policy has been configured + // + if (PcdGet64 (PcdDxeNxMemoryProtectionPolicy) == 0) { + return EFI_SUCCESS; + } + + // + // Update the executable permissions according to the DXE memory + // protection policy, but only if + // - the policy is different between the old and the new type, or + // - this is a newly added region (OldType == EfiMaxMemoryType) + // + NewAttributes = GetPermissionAttributeForMemoryType (NewType); + + if (OldType != EfiMaxMemoryType) { + OldAttributes = GetPermissionAttributeForMemoryType (OldType); + if (OldAttributes == NewAttributes) { + // policy is the same between OldType and NewType + return EFI_SUCCESS; + } + } else if (NewAttributes == 0) { + // newly added region of a type that does not require protection + return EFI_SUCCESS; + } + + return gCpu->SetMemoryAttributes (gCpu, Memory, Length, NewAttributes); +} From patchwork Mon Feb 27 14:38:11 2017 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Ard Biesheuvel X-Patchwork-Id: 94549 Delivered-To: patch@linaro.org Received: by 10.140.20.113 with SMTP id 104csp889665qgi; Mon, 27 Feb 2017 06:38:43 -0800 (PST) X-Received: by 10.99.117.3 with SMTP id q3mr9073101pgc.222.1488206323117; Mon, 27 Feb 2017 06:38:43 -0800 (PST) Return-Path: Received: from ml01.01.org (ml01.01.org. [198.145.21.10]) by mx.google.com with ESMTPS id a4si15258769pgn.328.2017.02.27.06.38.42 (version=TLS1_2 cipher=ECDHE-RSA-AES128-GCM-SHA256 bits=128/128); Mon, 27 Feb 2017 06:38:43 -0800 (PST) Received-SPF: pass (google.com: best guess record for domain of edk2-devel-bounces@lists.01.org designates 198.145.21.10 as permitted sender) client-ip=198.145.21.10; Authentication-Results: mx.google.com; dkim=neutral (body hash did not verify) header.i=@linaro.org; spf=pass (google.com: best guess record for domain of edk2-devel-bounces@lists.01.org designates 198.145.21.10 as permitted sender) smtp.mailfrom=edk2-devel-bounces@lists.01.org; dmarc=fail (p=NONE sp=NONE dis=NONE) header.from=linaro.org Received: from [127.0.0.1] (localhost [IPv6:::1]) by ml01.01.org (Postfix) with ESMTP id 0C8FB82125; Mon, 27 Feb 2017 06:38:42 -0800 (PST) X-Original-To: edk2-devel@lists.01.org Delivered-To: edk2-devel@lists.01.org Received: from mail-wm0-x231.google.com (mail-wm0-x231.google.com [IPv6:2a00:1450:400c:c09::231]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ml01.01.org (Postfix) with ESMTPS id 7D41981F56 for ; Mon, 27 Feb 2017 06:38:40 -0800 (PST) Received: by mail-wm0-x231.google.com with SMTP id v186so62856130wmd.0 for ; Mon, 27 Feb 2017 06:38:40 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=linaro.org; s=google; h=from:to:cc:subject:date:message-id:in-reply-to:references; bh=nb8SGWLAE5lMcobcIuLS9BJVgytWpLPoAS1SPVfrMd4=; b=SN0VJkm/RN9qoT8krhFFmUSM4bUV2Tzhf4vXnEyif9KCjuOG2DxeX6lfWA6IFbiS2J DOzeDenFlBsEhbCerGH773jvbRWeP0MGhZm0LCjzRUbN6FLJ52xLpXpZp6/c+Agjpjgi Pk7zZNf4O7TujzOJYYWQxXob0DxGBGRx+onW8= X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:from:to:cc:subject:date:message-id:in-reply-to :references; bh=nb8SGWLAE5lMcobcIuLS9BJVgytWpLPoAS1SPVfrMd4=; b=ZURBTRzxJrsasY2vJqXbM+2f0G7DuSNhmh3FaBiLg86tBpkhB2cJ2y0P/EXcCRcCLm 3XR4epobiiHygXJlQpv/sacXMVAY4qvDw0OVEcTzDHSiNHWfUTmi6pzUndt6Hczhvu36 AEipjloPSjSKgLKu5OP/k37b7YwQH6DaItIbVmg6BJv3CAOO3hODqgiZ2l8t/aQVUIqN yp+Gr6Jl0ePuzDBn/HsyiV9o4Db/fSMCVu2riQo2cJHXquo5Pk6jfY0gtZI3my7UUmWt XyIwASdk7pc8koC9zQ6sZgPCbAH/+zEllly/NlhTslHJ24so34TTLYyYzAu81eJrUqHx 8/VQ== X-Gm-Message-State: AMke39maqfoP7kNvhGftXhCrVYra3yWysEQsGC/3wm24VY3dYwsqWtF5k4y73E3oxy4TVIby X-Received: by 10.28.113.200 with SMTP id d69mr9632479wmi.10.1488206319164; Mon, 27 Feb 2017 06:38:39 -0800 (PST) Received: from localhost.localdomain ([105.149.201.216]) by smtp.gmail.com with ESMTPSA id z134sm14475167wmc.20.2017.02.27.06.38.37 (version=TLS1_2 cipher=ECDHE-RSA-AES128-SHA bits=128/128); Mon, 27 Feb 2017 06:38:38 -0800 (PST) From: Ard Biesheuvel To: edk2-devel@lists.01.org, afish@apple.com, leif.lindholm@linaro.org, michael.d.kinney@intel.com, liming.gao@intel.com, jiewen.yao@intel.com Date: Mon, 27 Feb 2017 14:38:11 +0000 Message-Id: <1488206291-25768-8-git-send-email-ard.biesheuvel@linaro.org> X-Mailer: git-send-email 2.7.4 In-Reply-To: <1488206291-25768-1-git-send-email-ard.biesheuvel@linaro.org> References: <1488206291-25768-1-git-send-email-ard.biesheuvel@linaro.org> Subject: [edk2] [PATCH v4 7/7] ArmVirtPkg/ArmVirt.dsc.inc: enable NX memory protection for all platforms X-BeenThere: edk2-devel@lists.01.org X-Mailman-Version: 2.1.21 Precedence: list List-Id: EDK II Development List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Cc: feng.tian@intel.com, lersek@redhat.com, star.zeng@intel.com, Ard Biesheuvel MIME-Version: 1.0 Errors-To: edk2-devel-bounces@lists.01.org Sender: "edk2-devel" This sets the recently introduced PCD PcdDxeNxMemoryProtectionPolicy to a value that protects all memory regions except code regions against inadvertent execution. Contributed-under: TianoCore Contribution Agreement 1.0 Signed-off-by: Ard Biesheuvel --- ArmVirtPkg/ArmVirt.dsc.inc | 6 ++++++ 1 file changed, 6 insertions(+) -- 2.7.4 _______________________________________________ edk2-devel mailing list edk2-devel@lists.01.org https://lists.01.org/mailman/listinfo/edk2-devel diff --git a/ArmVirtPkg/ArmVirt.dsc.inc b/ArmVirtPkg/ArmVirt.dsc.inc index 151f413f1b2b..c9f20d570049 100644 --- a/ArmVirtPkg/ArmVirt.dsc.inc +++ b/ArmVirtPkg/ArmVirt.dsc.inc @@ -383,6 +383,12 @@ [PcdsFixedAtBuild.AARCH64] # gEfiMdeModulePkgTokenSpaceGuid.PcdImageProtectionPolicy|0x3 + # + # Enable NX memory protection for all non-code regions, including OEM and OS + # reserved ones. + # + gEfiMdeModulePkgTokenSpaceGuid.PcdDxeNxMemoryProtectionPolicy|0xC000000000007FD5 + [Components.common] # # Networking stack