diff mbox series

[edk2,5/5] ArmPkg/CpuDxe: switch to read-only page tables at EndOfDxe

Message ID 20190107071504.2431-6-ard.biesheuvel@linaro.org
State New
Headers show
Series memory/MMU hardening for AArch64 | expand

Commit Message

Ard Biesheuvel Jan. 7, 2019, 7:15 a.m. UTC 
Register for the EndOfDxe event, and use it to invoke the new
ArmMmuLib code that remaps all page tables as read-only. This
should limit the impact of arbitrary write exploits, since they
can no longer be abused to modify tightened memory permissions.

Contributed-under: TianoCore Contribution Agreement 1.1
Signed-off-by: Ard Biesheuvel <ard.biesheuvel@linaro.org>

---
 ArmPkg/Drivers/CpuDxe/CpuDxe.c   | 23 ++++++++++++++++++++
 ArmPkg/Drivers/CpuDxe/CpuDxe.inf |  1 +
 2 files changed, 24 insertions(+)

-- 
2.20.1

_______________________________________________
edk2-devel mailing list
edk2-devel@lists.01.org
https://lists.01.org/mailman/listinfo/edk2-devel
diff mbox series

Patch

diff --git a/ArmPkg/Drivers/CpuDxe/CpuDxe.c b/ArmPkg/Drivers/CpuDxe/CpuDxe.c
index 5e923d45b715..11f4a2ccf5c8 100644
--- a/ArmPkg/Drivers/CpuDxe/CpuDxe.c
+++ b/ArmPkg/Drivers/CpuDxe/CpuDxe.c
@@ -238,6 +238,17 @@  InitializeDma (
   CpuArchProtocol->DmaBufferAlignment = ArmCacheWritebackGranule ();
 }
 
+STATIC
+VOID
+EFIAPI
+OnEndOfDxe (
+  IN EFI_EVENT                Event,
+  IN VOID                     *Context
+  )
+{
+  MapAllPageTablesReadOnly ();
+}
+
 EFI_STATUS
 CpuDxeInitialize (
   IN EFI_HANDLE         ImageHandle,
@@ -246,6 +257,7 @@  CpuDxeInitialize (
 {
   EFI_STATUS  Status;
   EFI_EVENT    IdleLoopEvent;
+  EFI_EVENT    EndOfDxeEvent;
 
   InitializeExceptions (&mCpu);
 
@@ -285,5 +297,16 @@  CpuDxeInitialize (
                   );
   ASSERT_EFI_ERROR (Status);
 
+
+  Status = gBS->CreateEventEx (
+                  EVT_NOTIFY_SIGNAL,
+                  TPL_CALLBACK,
+                  OnEndOfDxe,
+                  NULL,
+                  &gEfiEndOfDxeEventGroupGuid,
+                  &EndOfDxeEvent
+                  );
+  ASSERT_EFI_ERROR (Status);
+
   return Status;
 }
diff --git a/ArmPkg/Drivers/CpuDxe/CpuDxe.inf b/ArmPkg/Drivers/CpuDxe/CpuDxe.inf
index c32d2cb9c7d4..0788a2ab27c0 100644
--- a/ArmPkg/Drivers/CpuDxe/CpuDxe.inf
+++ b/ArmPkg/Drivers/CpuDxe/CpuDxe.inf
@@ -63,6 +63,7 @@ 
 
 [Guids]
   gEfiDebugImageInfoTableGuid
+  gEfiEndOfDxeEventGroupGuid
   gArmMpCoreInfoGuid
   gIdleLoopEventGuid
   gEfiVectorHandoffTableGuid