Instead of relying on a questionable heuristic that avoids calling into
the SetMemoryAttributes () DXE service when the old memory type and the
new one are subjected to the same NX memory protection policy, make this
call unconditionally. This avoids corner cases where memory region
attributes are out of sync with the policy, either due to the fact that
we are in the middle of ramping up the protections, or due to explicit
invocations of SetMemoryAttributes() by drivers.
This requires the architecture page table code to be able to deal with
this, in particular, it needs to be robust against potential recursion
due to NX policies being applied to newly allocated page tables.
Signed-off-by: Ard Biesheuvel <a...@kernel.org>
---
MdeModulePkg/Core/Dxe/Misc/MemoryProtection.c | 12 ------------
1 file changed, 12 deletions(-)
diff --git a/MdeModulePkg/Core/Dxe/Misc/MemoryProtection.c
b/MdeModulePkg/Core/Dxe/Misc/MemoryProtection.c
index b89ab046fa73..5a82eee80781 100644
--- a/MdeModulePkg/Core/Dxe/Misc/MemoryProtection.c
+++ b/MdeModulePkg/Core/Dxe/Misc/MemoryProtection.c
@@ -1246,7 +1246,6 @@ ApplyMemoryProtectionPolicy (
IN UINT64 Length
)
{
- UINT64 OldAttributes;
UINT64 NewAttributes;
//
@@ -1302,16 +1301,5 @@ ApplyMemoryProtectionPolicy (
//
NewAttributes = GetPermissionAttributeForMemoryType (NewType);
- if (OldType != EfiMaxMemoryType) {
- OldAttributes = GetPermissionAttributeForMemoryType (OldType);
- if (OldAttributes == NewAttributes) {
- // policy is the same between OldType and NewType
- return EFI_SUCCESS;
- }
- } else if (NewAttributes == 0) {
- // newly added region of a type that does not require protection
- return EFI_SUCCESS;
- }
-
return gCpu->SetMemoryAttributes (gCpu, Memory, Length, NewAttributes);
}
--
2.39.2
-=-=-=-=-=-=-=-=-=-=-=-
Groups.io Links: You receive all messages sent to this group.
View/Reply Online (#101117): https://edk2.groups.io/g/devel/message/101117
Mute This Topic: https://groups.io/mt/97586011/21656
Group Owner: devel+ow...@edk2.groups.io
Unsubscribe: https://edk2.groups.io/g/devel/unsub [arch...@mail-archive.com]
-=-=-=-=-=-=-=-=-=-=-=-
