From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from mail-wm0-x22f.google.com (mail-wm0-x22f.google.com [IPv6:2a00:1450:400c:c09::22f]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ml01.01.org (Postfix) with ESMTPS id 9A6C181F56 for ; Mon, 27 Feb 2017 06:38:20 -0800 (PST) Received: by mail-wm0-x22f.google.com with SMTP id v186so62848466wmd.0 for ; Mon, 27 Feb 2017 06:38:20 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=linaro.org; s=google; h=from:to:cc:subject:date:message-id; bh=yX22Bz2zedfMUp8h5eAXFbTMllw1nTaYcQdNs7/OZQo=; b=B5eoncYpfO0waGSlaYvml68QsOHvxGYSSsor5Zytv2F/gV2x1+X6eFJJKSoFkpJ8SQ lObmCfbVdvVP1yietKpne6cROR/kv5d/8oyLRyJaTM2HZ4Nxbt4+qcui5jGtLckJnK1x ht/VlgtAXXCSqTY6k8eScdlmnzK/P7H21HzIU= X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:from:to:cc:subject:date:message-id; bh=yX22Bz2zedfMUp8h5eAXFbTMllw1nTaYcQdNs7/OZQo=; b=nU+EWakznLTZWxS3x6U4Zg5RHUvie9DJ562F7OS9aEOCGFJaemxgsU1EhYQf3a4Pcd PYw22GktbbqtZB1zqjeI76nD3iZfXlP2G0WWPtuqMgkGD9Enft+I+qzy3oeurKqL51X1 ZviaWECyThq1kUJ1IPpgGW2P/9Tfn0P3EFpdgOdPXVckR1ED9G+vE99ZnFyTUx/wa1i1 RgXTrpgaVg9Vp7wEs8cwTDXStsIhsm+scmarU5LKwoMZhII7Ik9XTWV90TY7VNXVtbXq 4lMBLEEVC04LwDpseifo/zgb5Y0RCsuBxS6QQnPkHfkXh5+Zy+2Ty7RRfssNk0O74Hjz TNng== X-Gm-Message-State: AMke39naZcV+JV1iarCPQkPA2dhWf72+OHyZlTugKq8G0JB0nslaUKXgxVvyen9yVTMAvOuY X-Received: by 10.28.57.131 with SMTP id g125mr13674693wma.33.1488206298616; Mon, 27 Feb 2017 06:38:18 -0800 (PST) Received: from localhost.localdomain ([105.149.201.216]) by smtp.gmail.com with ESMTPSA id z134sm14475167wmc.20.2017.02.27.06.38.16 (version=TLS1_2 cipher=ECDHE-RSA-AES128-SHA bits=128/128); Mon, 27 Feb 2017 06:38:17 -0800 (PST) From: Ard Biesheuvel To: edk2-devel@lists.01.org, afish@apple.com, leif.lindholm@linaro.org, michael.d.kinney@intel.com, liming.gao@intel.com, jiewen.yao@intel.com Cc: lersek@redhat.com, feng.tian@intel.com, star.zeng@intel.com, Ard Biesheuvel Date: Mon, 27 Feb 2017 14:38:04 +0000 Message-Id: <1488206291-25768-1-git-send-email-ard.biesheuvel@linaro.org> X-Mailer: git-send-email 2.7.4 Subject: [PATCH v4 0/7] MdeModulePkg/DxeCore: increased memory protection X-BeenThere: edk2-devel@lists.01.org X-Mailman-Version: 2.1.21 Precedence: list List-Id: EDK II Development List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 27 Feb 2017 14:38:21 -0000 Hello all, First of all, thanks for the reviews and regression testing. However, I did not add the tested-by tags nor some of the R-b's, given the changes in this v4. This series implements a memory protection policy that removes all executable permissions from writable memory regions, which greatly enhances security. It is based on Jiewen's recent work, which is a step in the right direction, but still leaves most of memory exploitable due to the default R+W+X permissions. The idea is that the implementation of the CPU arch protocol goes over the memory map and removes exec permissions from all regions that are not already marked as 'code. This requires some preparatory work to ensure that the DxeCore itself is covered by a BootServicesCode region, not a BootServicesData region. Exec permissions are re-granted selectively, when the PE/COFF loader allocates the space for it. Combined with Jiewen's code/data split, this removes all RWX mapped regions. Changes since v3: - mandate that the same policy applies to EfiConventionalMemory regions and EfiBootServicesData regions: they are unlikely to differ in practice, and dealing with that corner case greatly complicates the implementation, given the way DxeCore allocates memory for itself in the implementation of the page and pool allocation routines. - apply the EfiConventionalMemory policy to untested RAM regions in the GCD memory space map: without this, we may still have a large region of RAM that is exploitable, and it also removes the need to apply memory protections in PromoteMemoryResource (), which is very difficult to achieve without a major restructuring of the code due to the way locking is implemented here. - add missing ApplyMemoryProtectionPolicy() call to CoreAddMemoryDescriptor() - use CoreAcquireLockOrFail() on gMemoryLock for CoreAllocatePoolPages (#4) - incorporate feedback from Liming (#2, #6) - add patch to enable the NX memory protection policy for ArmVirtPkg (#7) Changes since v2: - added patch to make EBC use EfiBootServicesCode pool allocations for thunks - redefine PCD according to Jiewen's feedback, including default value - use sorted memory map and merge adjacent entries with the same policy, to prevent unnecessary page table splitting - ignore policy when executing in SMM - refactor the logic for managing permission attributes of pool allocations - added some R-b's Changes since v1: - allocate code pages for PE/COFF images in PeiCore, so that DxeCore pages have the expected memory type (as suggested by Jiewen) - add patch to inhibit page table updates while syncing the GCD memory space map with the page tables - add PCD to set memory protection policy, which allows the policy for reserved and ACPI/NVS memory to be configured separately - move attribute manipulation into DxeCore page allocation code: this way, we should be able to solve the EBC case by allocating BootServicesCode pool memory explicitly. Series can be found here: https://git.linaro.org/people/ard.biesheuvel/uefi-next.git/log/?h=memprot-take2-v4 Ard Biesheuvel (7): ArmPkg/CpuDxe: ignore attribute changes during SyncCacheConfig() MdeModulePkg/PeiCore: allocate BootServicesCode memory for PE/COFF images MdeModulePkg/EbcDxe: use EfiBootServicesCode memory for thunks MdeModulePkg/DxeCore: use separate lock for pool allocations MdeModulePkg: define PCD for DXE memory protection policy MdeModulePkg/DxeCore: implement memory protection policy ArmVirtPkg/ArmVirt.dsc.inc: enable NX memory protection for all platforms ArmPkg/Drivers/CpuDxe/CpuDxe.c | 3 + ArmPkg/Drivers/CpuDxe/CpuDxe.h | 1 + ArmPkg/Drivers/CpuDxe/CpuMmuCommon.c | 4 + ArmVirtPkg/ArmVirt.dsc.inc | 6 + MdeModulePkg/Core/Dxe/DxeMain.h | 24 ++ MdeModulePkg/Core/Dxe/DxeMain.inf | 1 + MdeModulePkg/Core/Dxe/Mem/Page.c | 7 + MdeModulePkg/Core/Dxe/Mem/Pool.c | 65 +++- MdeModulePkg/Core/Dxe/Misc/MemoryProtection.c | 371 +++++++++++++++++++- MdeModulePkg/Core/Pei/Image/Image.c | 23 +- MdeModulePkg/MdeModulePkg.dec | 32 ++ MdeModulePkg/Universal/EbcDxe/AArch64/EbcSupport.c | 2 +- MdeModulePkg/Universal/EbcDxe/EbcInt.c | 23 ++ MdeModulePkg/Universal/EbcDxe/EbcInt.h | 14 + MdeModulePkg/Universal/EbcDxe/Ia32/EbcSupport.c | 2 +- MdeModulePkg/Universal/EbcDxe/Ipf/EbcSupport.c | 2 +- MdeModulePkg/Universal/EbcDxe/X64/EbcSupport.c | 2 +- 17 files changed, 558 insertions(+), 24 deletions(-) -- 2.7.4