From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from dfw.source.kernel.org (dfw.source.kernel.org [139.178.84.217]) by mx.groups.io with SMTP id smtpd.web10.5346.1675879110960255578 for ; Wed, 08 Feb 2023 09:58:31 -0800 Authentication-Results: mx.groups.io; dkim=pass header.i=@kernel.org header.s=k20201202 header.b=WQW7+9Ef; spf=pass (domain: kernel.org, ip: 139.178.84.217, mailfrom: ardb@kernel.org) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by dfw.source.kernel.org (Postfix) with ESMTPS id 69D0C61784; Wed, 8 Feb 2023 17:58:30 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id D3DDFC4339E; Wed, 8 Feb 2023 17:58:27 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=k20201202; t=1675879110; bh=BvUkm1Tpli+dwnQJrecUGwsPJL+mqYRes1RNs+aOH28=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=WQW7+9EfbvR3i6KF8pwOKmzPmHjRgwCbFGbpd5FNTNpVSU3/xz6QU5VIDgbPX1GOo tfZRTYcMruglkZIXMgjdmAxwisq+vttsV9F9cqkRTEM6PF9mDyQj9sjV0SVdQ6NB4B mcDD59IKKTLDMxzyfLSP1PgMUBrsWeSN14TBnkYayFtOftNxfk3TgmvRXPQeXM7a4D FIvcDH5aFDKfzGVCnQmdoj/q7Oz+pTcAbD0mf3JMawbs2XIIJeizM33kfJg6uLfLYL H8XBIivCcIMA/FORjVB6Yz0XVY2fAMDvzsFz4daCWGYLdij5ZMXQZDsbkpCJv2HBIq D2b4SqqTkQEvQ== From: "Ard Biesheuvel" To: devel@edk2.groups.io Cc: Ard Biesheuvel , Michael Kinney , Liming Gao , Jiewen Yao , Michael Kubacki , Sean Brogan , Rebecca Cran , Leif Lindholm , Sami Mujawar , Taylor Beebe , =?UTF-8?q?Marvin=20H=C3=A4user?= Subject: [PATCH 3/3] MdeModulePkg/DxeCore: Unconditionally set memory protections Date: Wed, 8 Feb 2023 18:58:12 +0100 Message-Id: <20230208175812.700129-4-ardb@kernel.org> X-Mailer: git-send-email 2.39.1 In-Reply-To: <20230208175812.700129-1-ardb@kernel.org> References: <20230208175812.700129-1-ardb@kernel.org> MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Instead of relying on a questionable heuristic that avoids calling into the SetMemoryAttributes () DXE service when the old memory type and the new one are subjected to the same NX memory protection policy, make this call unconditionally. This avoids corner cases where memory region attributes are out of sync with the policy, either due to the fact that we are in the middle of ramping up the protections, or due to explicit invocations of SetMemoryAttributes() by drivers. This requires the architecture page table code to be able to deal with this, in particular, it needs to be robust against potential recursion due to NX policies being applied to newly allocated page tables. Signed-off-by: Ard Biesheuvel --- MdeModulePkg/Core/Dxe/Misc/MemoryProtection.c | 29 -------------------- 1 file changed, 29 deletions(-) diff --git a/MdeModulePkg/Core/Dxe/Misc/MemoryProtection.c b/MdeModulePkg/C= ore/Dxe/Misc/MemoryProtection.c index 36987843f142..503feb72b5d0 100644 --- a/MdeModulePkg/Core/Dxe/Misc/MemoryProtection.c +++ b/MdeModulePkg/Core/Dxe/Misc/MemoryProtection.c @@ -1263,9 +1263,7 @@ ApplyMemoryProtectionPolicy ( IN UINT64 Length=0D )=0D {=0D - UINT64 OldAttributes;=0D UINT64 NewAttributes;=0D - EFI_STATUS Status;=0D =0D //=0D // The policy configured in PcdDxeNxMemoryProtectionPolicy=0D @@ -1320,32 +1318,5 @@ ApplyMemoryProtectionPolicy ( //=0D NewAttributes =3D GetPermissionAttributeForMemoryType (NewType);=0D =0D - if (OldType !=3D EfiMaxMemoryType) {=0D - OldAttributes =3D GetPermissionAttributeForMemoryType (OldType);=0D - if (!mAfterDxeNxMemoryProtectionInit &&=0D - (OldAttributes =3D=3D NewAttributes)) {=0D - return EFI_SUCCESS;=0D - }=0D -=0D - //=0D - // If available, use the EFI memory attribute protocol to obtain=0D - // the current attributes of the region. If the entire region is=0D - // covered and the attributes match, we don't have to do anything.=0D - //=0D - if (mMemoryAttribute !=3D NULL) {=0D - Status =3D mMemoryAttribute->GetMemoryAttributes (mMemoryAttribute,= =0D - Memory,=0D - Length,=0D - &OldAttributes=0D - );=0D - if (!EFI_ERROR (Status) && (OldAttributes =3D=3D NewAttributes)) {=0D - return EFI_SUCCESS;=0D - }=0D - }=0D - } else if (NewAttributes =3D=3D 0) {=0D - // newly added region of a type that does not require protection=0D - return EFI_SUCCESS;=0D - }=0D -=0D return gCpu->SetMemoryAttributes (gCpu, Memory, Length, NewAttributes);= =0D }=0D --=20 2.39.1