From patchwork Fri Feb 24 15:04:54 2017 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Ard Biesheuvel X-Patchwork-Id: 94483 Delivered-To: patch@linaro.org Received: by 10.140.20.99 with SMTP id 90csp728284qgi; Fri, 24 Feb 2017 07:05:10 -0800 (PST) X-Received: by 10.99.185.74 with SMTP id v10mr4018354pgo.98.1487948710015; Fri, 24 Feb 2017 07:05:10 -0800 (PST) Return-Path: Received: from ml01.01.org (ml01.01.org. [2001:19d0:306:5::1]) by mx.google.com with ESMTPS id m14si7586067pln.225.2017.02.24.07.05.09 (version=TLS1_2 cipher=ECDHE-RSA-AES128-GCM-SHA256 bits=128/128); Fri, 24 Feb 2017 07:05:09 -0800 (PST) Received-SPF: pass (google.com: best guess record for domain of edk2-devel-bounces@lists.01.org designates 2001:19d0:306:5::1 as permitted sender) client-ip=2001:19d0:306:5::1; Authentication-Results: mx.google.com; dkim=neutral (body hash did not verify) header.i=@linaro.org; spf=pass (google.com: best guess record for domain of edk2-devel-bounces@lists.01.org designates 2001:19d0:306:5::1 as permitted sender) smtp.mailfrom=edk2-devel-bounces@lists.01.org; dmarc=fail (p=NONE sp=NONE dis=NONE) header.from=linaro.org Received: from [127.0.0.1] (localhost [IPv6:::1]) by ml01.01.org (Postfix) with ESMTP id 4898582168; Fri, 24 Feb 2017 07:05:09 -0800 (PST) X-Original-To: edk2-devel@lists.01.org Delivered-To: edk2-devel@lists.01.org Received: from mail-wm0-x236.google.com (mail-wm0-x236.google.com [IPv6:2a00:1450:400c:c09::236]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ml01.01.org (Postfix) with ESMTPS id EB17782161 for ; Fri, 24 Feb 2017 07:05:07 -0800 (PST) Received: by mail-wm0-x236.google.com with SMTP id v77so16581773wmv.0 for ; Fri, 24 Feb 2017 07:05:07 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=linaro.org; s=google; h=from:to:cc:subject:date:message-id; bh=EgFwrydAKernhD3WKA3BEtj8DFb10/JTLBMnSUuq3gw=; b=hZIOVa8+l3WBmvf1VPj9KxnTH9qJIvJMqV/UGKIbJuQBIkL/pkFl7jg+IvA/d3SOWh kuV3261jZEixwskZYTJKbwst0jlh1vxRsSjRVUP+Zjsw9Q2mAOQN4qC6rXzbPXuu+sFl j3vVnLNKLCpmZ8BfNrq8rEocfTL87tGY2aDEs= X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:from:to:cc:subject:date:message-id; bh=EgFwrydAKernhD3WKA3BEtj8DFb10/JTLBMnSUuq3gw=; b=dBGD6TpMc87PK1z3/fxBfO3ExG7gRojfV8eJrly1gtuJHLpldqattkJP7oM87usgBs HN5ZgFjRqqIhJK0zphNZLdEUgMwi4wCAj5UEyxSKglu0FSfFMszK+rYQhlacPJ72Hlrg cKmrPvjpIrF8zlSnNrKriURYhWDtgvo1sG1WKCod1aPa6kICcTqA8n8CpcAjZ/m3k6ap YjzAV2XJJc6RB8XeKTkrIrSpli00dtDxb/JgN1SOsrmphNeemHpenAq5aRC+e14Jm8sJ wBgG4M+YgUTZ/zU5R1hMIic/JVdRM6yqRvh30RsG40B64uU95674HF72IE010ivAhfZL 1JnQ== X-Gm-Message-State: AMke39nBM/5QRY3EQFvVbBTLimMhv/rACb0mr/5G3iXqTJc4duYzHk1fv6JRwoI4inS+9YsN X-Received: by 10.28.194.5 with SMTP id s5mr3241560wmf.98.1487948706241; Fri, 24 Feb 2017 07:05:06 -0800 (PST) Received: from localhost.localdomain ([105.149.201.216]) by smtp.gmail.com with ESMTPSA id w207sm2687048wmw.1.2017.02.24.07.05.03 (version=TLS1_2 cipher=ECDHE-RSA-AES128-SHA bits=128/128); Fri, 24 Feb 2017 07:05:05 -0800 (PST) From: Ard Biesheuvel To: edk2-devel@lists.01.org, afish@apple.com, leif.lindholm@linaro.org, michael.d.kinney@intel.com, liming.gao@intel.com, jiewen.yao@intel.com Date: Fri, 24 Feb 2017 15:04:54 +0000 Message-Id: <1487948699-3179-1-git-send-email-ard.biesheuvel@linaro.org> X-Mailer: git-send-email 2.7.4 Subject: [edk2] [PATCH v2 0/5] RFC: increased memory protection X-BeenThere: edk2-devel@lists.01.org X-Mailman-Version: 2.1.21 Precedence: list List-Id: EDK II Development List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Cc: feng.tian@intel.com, lersek@redhat.com, star.zeng@intel.com, Ard Biesheuvel MIME-Version: 1.0 Errors-To: edk2-devel-bounces@lists.01.org Sender: "edk2-devel" Hello all, This is a proof of concept implementation that removes all executable permissions from writable memory regions, which greatly enhances security. It is based on Jiewen's recent work, which is a step in the right direction, but still leaves most of memory exploitable due to the default R+W+X permissions. The idea is that the implementation of the CPU arch protocol goes over the memory map and removes exec permissions from all regions that are not already marked as 'code. This requires some preparatory work to ensure that the DxeCore itself is covered by a BootServicesCode region, not a BootServicesData region. Exec permissions are re-granted selectively, when the PE/COFF loader allocates the space for it. Combined with Jiewen's code/data split, this removes all RWX mapped regions. Changes since v1: - allocate code pages for PE/COFF images in PeiCore, so that DxeCore pages have the expected memory type (as suggested by Jiewen) - add patch to inhibit page table updates while syncing the GCD memory space map with the page tables - add PCD to set memory protection policy, which allows the policy for reserved and ACPI/NVS memory to be configured separately - move attribute manipulation into DxeCore page allocation code: this way, we should be able to solve the EBC case by allocating BootServicesCode pool memory explicitly. Ard Biesheuvel (5): ArmPkg/CpuDxe: ignore attribute changes during SyncCacheConfig() MdeModulePkg/PeiCore: allocate BootServicesCode memory for PE/COFF images MdeModulePkg/DxeCore: pass pool type to CoreFreePoolPages () MdeModulePkg: define PCD for DXE memory protection policy MdeModulePkg/DxeCore: implement memory protection policy ArmPkg/Drivers/CpuDxe/CpuDxe.c | 3 + ArmPkg/Drivers/CpuDxe/CpuDxe.h | 1 + ArmPkg/Drivers/CpuDxe/CpuMmuCommon.c | 4 + MdeModulePkg/Core/Dxe/DxeMain.inf | 1 + MdeModulePkg/Core/Dxe/Mem/Imem.h | 2 + MdeModulePkg/Core/Dxe/Mem/Page.c | 106 ++++++++++++++++++++ MdeModulePkg/Core/Dxe/Mem/Pool.c | 5 +- MdeModulePkg/Core/Dxe/Misc/MemoryProtection.c | 104 ++++++++++++++++++- MdeModulePkg/Core/Pei/Image/Image.c | 10 +- MdeModulePkg/MdeModulePkg.dec | 16 +++ 10 files changed, 246 insertions(+), 6 deletions(-) -- 2.7.4 _______________________________________________ edk2-devel mailing list edk2-devel@lists.01.org https://lists.01.org/mailman/listinfo/edk2-devel