[RFC PATCH 4/4] ArmPkg/CpuDxe: remap all data regions non-executable

[Ard Biesheuvel <ard.biesheuvel@linaro.org>]

When installing the CPU arch protocol, iterate over the UEFI memory map
and remove the executable permissions from each encountered non-code
region. Those will be re-added later selectively, to the extent required
according to the image protection policy and section alignment.

With a strict image protection policy in place, this all but eliminates
any regions that are mapped both writable and executable, which is an
significant improvement in security.

Contributed-under: TianoCore Contribution Agreement 1.0
Signed-off-by: Ard Biesheuvel <ard.biesheuvel@linaro.org>
---
 ArmPkg/Drivers/CpuDxe/CpuDxe.c | 76 ++++++++++++++++++++
 1 file changed, 76 insertions(+)

diff --git a/ArmPkg/Drivers/CpuDxe/CpuDxe.c b/ArmPkg/Drivers/CpuDxe/CpuDxe.c
index 7d328d096b1e..dd3bf44a00b3 100644
--- a/ArmPkg/Drivers/CpuDxe/CpuDxe.c
+++ b/ArmPkg/Drivers/CpuDxe/CpuDxe.c
@@ -15,6 +15,9 @@
 
 #include "CpuDxe.h"
 
+#include <Library/MemoryAllocationLib.h>
+#include <Library/UefiBootServicesTableLib.h>
+
 #include <Guid/IdleLoopEvent.h>
 
 
@@ -237,6 +240,74 @@ InitializeDma (
   CpuArchProtocol->DmaBufferAlignment = ArmCacheWritebackGranule ();
 }
 
+STATIC
+VOID
+RemapAllDataRegionsNonExec (
+  VOID
+  )
+{
+  UINTN                         MemoryMapSize;
+  UINTN                         MapKey;
+  UINTN                         DescriptorSize;
+  UINT32                        DescriptorVersion;
+  EFI_MEMORY_DESCRIPTOR         *MemoryMap;
+  EFI_MEMORY_DESCRIPTOR         *MemoryMapEntry;
+  EFI_MEMORY_DESCRIPTOR         *MemoryMapEnd;
+  EFI_STATUS                    Status;
+
+  //
+  // Iterate over the memory map, and remove execute permissions from all
+  // memory regions that are not BootServiceCode or RuntimeServicesCode.
+  //
+
+  //
+  // Get the EFI memory map.
+  //
+  MemoryMapSize = 0;
+  MemoryMap     = NULL;
+
+  Status = gBS->GetMemoryMap (
+                  &MemoryMapSize,
+                  MemoryMap,
+                  &MapKey,
+                  &DescriptorSize,
+                  &DescriptorVersion
+                  );
+  ASSERT (Status == EFI_BUFFER_TOO_SMALL);
+  do {
+    MemoryMap = (EFI_MEMORY_DESCRIPTOR *) AllocatePool (MemoryMapSize);
+    ASSERT (MemoryMap != NULL);
+    Status = gBS->GetMemoryMap (
+                    &MemoryMapSize,
+                    MemoryMap,
+                    &MapKey,
+                    &DescriptorSize,
+                    &DescriptorVersion
+                    );
+    if (EFI_ERROR (Status)) {
+      FreePool (MemoryMap);
+    }
+  } while (Status == EFI_BUFFER_TOO_SMALL);
+  ASSERT_EFI_ERROR (Status);
+
+  MemoryMapEntry = MemoryMap;
+  MemoryMapEnd   = (EFI_MEMORY_DESCRIPTOR *) ((UINT8 *) MemoryMap + MemoryMapSize);
+  while ((UINTN) MemoryMapEntry < (UINTN) MemoryMapEnd) {
+    if ((MemoryMapEntry->Type != EfiBootServicesCode) &&
+        (MemoryMapEntry->Type != EfiRuntimeServicesCode)) {
+
+      CpuSetMemoryAttributes (&mCpu, MemoryMapEntry->PhysicalStart,
+        EFI_PAGES_TO_SIZE(MemoryMapEntry->NumberOfPages), EFI_MEMORY_XP);
+      DEBUG((DEBUG_ERROR, "%a: removing exec permissions from 0x%lx - 0x%lx (Type == 0x%x)\n",
+        __FUNCTION__, MemoryMapEntry->PhysicalStart,
+        MemoryMapEntry->PhysicalStart + EFI_PAGES_TO_SIZE(MemoryMapEntry->NumberOfPages) - 1,
+        MemoryMapEntry->Type));
+    }
+    MemoryMapEntry = NEXT_MEMORY_DESCRIPTOR (MemoryMapEntry, DescriptorSize);
+  }
+  FreePool (MemoryMap);
+}
+
 EFI_STATUS
 CpuDxeInitialize (
   IN EFI_HANDLE         ImageHandle,
@@ -264,6 +335,11 @@ CpuDxeInitialize (
   //
   SyncCacheConfig (&mCpu);
 
+  //
+  // Remap all conventional memory as non-executable.
+  //
+  RemapAllDataRegionsNonExec ();
+
   // If the platform is a MPCore system then install the Configuration Table describing the
   // secondary core states
   if (ArmIsMpCore()) {
-- 
2.7.4