Re: [edk2-devel] [Patch V6 02/14] MdeModulePkg: Remove other attribute protection in UnsetGuardPage

["Wang, Jian J" <jian.j.wang@intel.com>]

Reviewed-by: Jian J Wang <jian.j.wang@intel.com>

Regards,
Jian



> -----Original Message-----
> From: devel@edk2.groups.io <devel@edk2.groups.io> On Behalf Of duntan
> Sent: Friday, June 09, 2023 5:16 PM
> To: devel@edk2.groups.io
> Cc: Gao, Liming <gaoliming@byosoft.com.cn>; Ni, Ray <ray.ni@intel.com>;
> Wang, Jian J <jian.j.wang@intel.com>; Ard Biesheuvel
> <ardb+tianocore@kernel.org>
> Subject: [edk2-devel] [Patch V6 02/14] MdeModulePkg: Remove other attribute
> protection in UnsetGuardPage
> 
> In UnsetGuardPage(), before SmmReadyToLock, remove NX and RO
> memory attribute protection for guarded page since
> EfiConventionalMemory in SMRAM is RW and executable before
> SmmReadyToLock. If UnsetGuardPage() happens after SmmReadyToLock,
> then apply EFI_MEMORY_XP to the guarded page to make sure
> EfiConventionalMemory in SMRAM is NX since EfiConventionalMemory
> in SMRAM is marked as NX in PiSmmCpuDxe driver when SmmReadyToLock.
> 
> Signed-off-by: Dun Tan <dun.tan@intel.com>
> Cc: Liming Gao <gaoliming@byosoft.com.cn>
> Cc: Ray Ni <ray.ni@intel.com>
> Cc: Jian J Wang <jian.j.wang@intel.com>
> Cc: Ard Biesheuvel <ardb+tianocore@kernel.org>
> ---
>  MdeModulePkg/Core/PiSmmCore/HeapGuard.c | 16 +++++++++++++++-
>  1 file changed, 15 insertions(+), 1 deletion(-)
> 
> diff --git a/MdeModulePkg/Core/PiSmmCore/HeapGuard.c
> b/MdeModulePkg/Core/PiSmmCore/HeapGuard.c
> index 8f3bab6fee..25310122ca 100644
> --- a/MdeModulePkg/Core/PiSmmCore/HeapGuard.c
> +++ b/MdeModulePkg/Core/PiSmmCore/HeapGuard.c
> @@ -553,9 +553,23 @@ UnsetGuardPage (
>                                           mSmmMemoryAttribute,
>                                           BaseAddress,
>                                           EFI_PAGE_SIZE,
> -                                         EFI_MEMORY_RP
> +                                         EFI_MEMORY_RP|EFI_MEMORY_RO|EFI_MEMORY_XP
>                                           );
>      ASSERT_EFI_ERROR (Status);
> +
> +    if (gST == NULL) {
> +      //
> +      // Make sure EfiConventionalMemory is NX after SmmReadyToLock
> +      //
> +      Status = mSmmMemoryAttribute->SetMemoryAttributes (
> +                                      mSmmMemoryAttribute,
> +                                      BaseAddress,
> +                                      EFI_PAGE_SIZE,
> +                                      EFI_MEMORY_XP
> +                                      );
> +      ASSERT_EFI_ERROR (Status);
> +    }
> +
>      mOnGuarding = FALSE;
>    }
>  }
> --
> 2.31.1.windows.1
> 
> 
> 
> 
>