Before removing exec permissions from all non-code regions, ensure that
the DXE core itself is covered by a BootServicesCode region, by adding
a new function ConvertDxeCoreImage () and calling it at the right time
from DxeMain ().
Contributed-under: TianoCore Contribution Agreement 1.0
Signed-off-by: Ard Biesheuvel <ard.biesheu...@linaro.org>
---
MdeModulePkg/Core/Dxe/DxeMain.h | 8 ++++++++
MdeModulePkg/Core/Dxe/DxeMain/DxeMain.c | 2 ++
MdeModulePkg/Core/Dxe/Mem/Page.c | 15 +++++++++++++++
3 files changed, 25 insertions(+)
diff --git a/MdeModulePkg/Core/Dxe/DxeMain.h b/MdeModulePkg/Core/Dxe/DxeMain.h
index b14be9a74d8e..300f19a3aa58 100644
--- a/MdeModulePkg/Core/Dxe/DxeMain.h
+++ b/MdeModulePkg/Core/Dxe/DxeMain.h
@@ -2949,4 +2949,12 @@ MemoryProtectionExitBootServicesCallback (
VOID
);
+/**
+ Convert DXE core image to BootServicesCode memory
+**/
+VOID
+ConvertDxeCoreImage (
+ VOID
+ );
+
#endif
diff --git a/MdeModulePkg/Core/Dxe/DxeMain/DxeMain.c
b/MdeModulePkg/Core/Dxe/DxeMain/DxeMain.c
index 91e94a78d205..d3a873e737b1 100644
--- a/MdeModulePkg/Core/Dxe/DxeMain/DxeMain.c
+++ b/MdeModulePkg/Core/Dxe/DxeMain/DxeMain.c
@@ -396,6 +396,8 @@ DxeMain (
MemoryProfileInstallProtocol ();
+ ConvertDxeCoreImage ();
+
CoreInitializePropertiesTable ();
CoreInitializeMemoryAttributesTable ();
CoreInitializeMemoryProtection ();
diff --git a/MdeModulePkg/Core/Dxe/Mem/Page.c b/MdeModulePkg/Core/Dxe/Mem/Page.c
index b0939c596991..73b56fccf965 100644
--- a/MdeModulePkg/Core/Dxe/Mem/Page.c
+++ b/MdeModulePkg/Core/Dxe/Mem/Page.c
@@ -1951,8 +1951,23 @@ Done:
}
+VOID
+ConvertDxeCoreImage (
+ VOID
+ )
+{
+ CoreAcquireMemoryLock ();
+ //
+ // Convert the memory region that backs the DXE core to a 'code' region, so
+ // that the strict permissions handling doesn't take our exec permissions
+ // away.
+ //
+ CoreConvertPages ((UINTN)gDxeCoreLoadedImage->ImageBase,
+ EFI_SIZE_TO_PAGES (gDxeCoreLoadedImage->ImageSize), EfiBootServicesCode);
+ CoreReleaseMemoryLock ();
+}
--
2.7.4
_______________________________________________
edk2-devel mailing list
edk2-devel@lists.01.org
https://lists.01.org/mailman/listinfo/edk2-devel
