[PATCH 0/3] DXE Memory Protection

[Jiewen Yao <jiewen.yao@intel.com>]

This series patch provides capability to protect PE/COFF image
in DXE memory.
If the UEFI image is page aligned, the image code section is set to read
only and the image data section is set to non-executable.

The DxeCore calls CpuArchProtocol->SetMemoryAttributes() to protect
the image.

Tested platform: NT32/Quark IA32/OVMF IA32/OVMF IA32X64/Intel internal X64/
Tested OS: UEFI Win10, UEFI Ubuntu 16.04.

Untested platform: ARM/AARCH64.
Can ARM/AARCH64 owner help to take a look and try the ARM platform?

Cc: Jeff Fan <jeff.fan@intel.com>
Cc: Michael Kinney <michael.d.kinney@intel.com>
Cc: Leif Lindholm <leif.lindholm@linaro.org>
Cc: Ard Biesheuvel <ard.biesheuvel@linaro.org>
Cc: Star Zeng <star.zeng@intel.com>
Cc: Feng Tian <feng.tian@intel.com>
Contributed-under: TianoCore Contribution Agreement 1.0
Signed-off-by: Jiewen Yao <jiewen.yao@intel.com>


Jiewen Yao (3):
  UefiCpuPkg/CpuDxe: Add memory attribute setting.
  ArmPkg/CpuDxe: Correct EFI_MEMORY_RO usage
  MdeModulePkg/DxeCore: Add UEFI image protection.

 ArmPkg/Drivers/CpuDxe/AArch64/Mmu.c           |   2 +-
 ArmPkg/Drivers/CpuDxe/Arm/Mmu.c               |   5 +-
 MdeModulePkg/Core/Dxe/DxeMain.h               |  53 ++
 MdeModulePkg/Core/Dxe/DxeMain.inf             |   2 +
 MdeModulePkg/Core/Dxe/DxeMain/DxeMain.c       |   1 +
 MdeModulePkg/Core/Dxe/Image/Image.c           |   5 +
 MdeModulePkg/Core/Dxe/Misc/MemoryProtection.c | 822 ++++++++++++++++
 MdeModulePkg/Core/Dxe/Misc/PropertiesTable.c  |  22 -
 UefiCpuPkg/CpuDxe/CpuDxe.c                    | 137 +--
 UefiCpuPkg/CpuDxe/CpuDxe.inf                  |   4 +-
 UefiCpuPkg/CpuDxe/PageTableLib.h              | 204 ++++
 UefiCpuPkg/CpuDxe/PageTableLibX86Pae.c        | 997 ++++++++++++++++++++
 12 files changed, 2168 insertions(+), 86 deletions(-)
 create mode 100644 MdeModulePkg/Core/Dxe/Misc/MemoryProtection.c
 create mode 100644 UefiCpuPkg/CpuDxe/PageTableLib.h
 create mode 100644 UefiCpuPkg/CpuDxe/PageTableLibX86Pae.c

-- 
2.7.4.windows.1