From nobody Sun Feb 8 03:11:36 2026 Delivered-To: importer@patchew.org Received-SPF: pass (zohomail.com: domain of groups.io designates 66.175.222.108 as permitted sender) client-ip=66.175.222.108; envelope-from=bounce+27952+99891+1787277+3901457@groups.io; helo=mail02.groups.io; Authentication-Results: mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of groups.io designates 66.175.222.108 as permitted sender) smtp.mailfrom=bounce+27952+99891+1787277+3901457@groups.io; dmarc=fail(p=none dis=none) header.from=kernel.org ARC-Seal: i=1; a=rsa-sha256; t=1675951206; cv=none; d=zohomail.com; s=zohoarc; b=KorzcODDBcQY6sZpsK7dkPiHYcME2RiDC9jyjcOvdEW9Eesj9OdNPB0W9aY4FAo7l7x+vgh90HDBvTlkTWEZbAospGfjB0CW1Bedwzpl/IID8vI4jzywSusLYyJSi/AQ7xfXcOiCp8MaZtfkne2/Kr7CrOqT4mPI9qCeeQRkuCM= ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=zohomail.com; s=zohoarc; t=1675951206; h=Content-Transfer-Encoding:Cc:Date:From:In-Reply-To:List-Subscribe:List-Id:List-Help:List-Unsubscribe:MIME-Version:Message-ID:Reply-To:References:Sender:Subject:To; bh=kemRtWOZQ8sYKodM/Syrqa5mcBHD+G1E6eXcWSzchoU=; b=LMHQDYNCyuhix7uOt9NDrzJW/YPB2speI6TDXh/PRPqnCmVvMJhhyKoHldaiMPttBSPyWcPJz3BSXTwYkdyHrV2OIKhX5Zr2uPG7hxnxw5Y3tDDIqL+cB7MXIVt6Sn1kM+efWvMwBJ1Kop9416hwEy9bjd8EVESZpwhCVWm8wVQ= ARC-Authentication-Results: i=1; mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of groups.io designates 66.175.222.108 as permitted sender) smtp.mailfrom=bounce+27952+99891+1787277+3901457@groups.io; dmarc=fail header.from= (p=none dis=none) Received: from mail02.groups.io (mail02.groups.io [66.175.222.108]) by mx.zohomail.com with SMTPS id 167595120604878.67493974225124; Thu, 9 Feb 2023 06:00:06 -0800 (PST) Return-Path: X-Received: by 127.0.0.2 with SMTP id 3mb8YY1788612xQrMjqMsMqj; Thu, 09 Feb 2023 06:00:05 -0800 X-Received: from ams.source.kernel.org (ams.source.kernel.org [145.40.68.75]) by mx.groups.io with SMTP id smtpd.web11.15548.1675951204128486673 for ; Thu, 09 Feb 2023 06:00:04 -0800 X-Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ams.source.kernel.org (Postfix) with ESMTPS id 7530CB82147; Thu, 9 Feb 2023 14:00:02 +0000 (UTC) X-Received: by smtp.kernel.org (Postfix) with ESMTPSA id EFB3EC4339C; Thu, 9 Feb 2023 13:59:58 +0000 (UTC) From: "Ard Biesheuvel" To: devel@edk2.groups.io Cc: Ard Biesheuvel , Michael Kinney , Liming Gao , Jiewen Yao , Michael Kubacki , Sean Brogan , Rebecca Cran , Leif Lindholm , Sami Mujawar , Taylor Beebe Subject: [edk2-devel] [PATCH v4 05/11] ArmPkg/ArmMmuLib ARM: Clear individual permission bits Date: Thu, 9 Feb 2023 14:59:30 +0100 Message-Id: <20230209135936.789983-6-ardb@kernel.org> In-Reply-To: <20230209135936.789983-1-ardb@kernel.org> References: <20230209135936.789983-1-ardb@kernel.org> MIME-Version: 1.0 Precedence: Bulk List-Unsubscribe: List-Subscribe: List-Help: Sender: devel@edk2.groups.io List-Id: Mailing-List: list devel@edk2.groups.io; contact devel+owner@edk2.groups.io Reply-To: devel@edk2.groups.io,ardb@kernel.org X-Gm-Message-State: vy2HSoUyUfRM1fCZ8t4wv60Dx1787277AA= Content-Transfer-Encoding: quoted-printable DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=groups.io; q=dns/txt; s=20140610; t=1675951205; bh=uJH90ucDz/Id3E2CD0ZakuOitsJNux0uf/Rxrhb4RHQ=; h=Cc:Date:From:Reply-To:Subject:To; b=iYmDDYQnTgqIp7LjFZCu9RlbVtKtUia6sS/Nd8EYMKpjuvP2iMbM+XcfdMqBtiNyECe ec+ggZlPjdp2cUOz6kfxXarkLaNSs9ng2jTbcZaM5cqjbqEGZB8PtCWjfzSroOEAGvU2d kPyRL9hu6lD/3ZHKCjN1c0sNUbTPurjbZ/E= X-ZohoMail-DKIM: pass (identity @groups.io) X-ZM-MESSAGEID: 1675951208202100007 Content-Type: text/plain; charset="utf-8" Currently, the MMU code that is supposed to clear the RO or XP attributes from a region just clears both unconditionally. This approximates the desired behavior to some extent, but it does mean that setting the RO bit first on a code region, and then clearing the XP bit results both RO and XP being cleared, and we end up with writable code, and avoiding that is the point of all these protections. Once we introduce RP support, this will only get worse, so let's fix this up, by reshuffling the attribute update code to take the entry mask from the caller, and use the mask to preserve other attributes when clearing RO or XP. Signed-off-by: Ard Biesheuvel --- ArmPkg/Library/ArmMmuLib/Arm/ArmMmuLibUpdate.c | 94 +++++++++++++++++--- 1 file changed, 81 insertions(+), 13 deletions(-) diff --git a/ArmPkg/Library/ArmMmuLib/Arm/ArmMmuLibUpdate.c b/ArmPkg/Librar= y/ArmMmuLib/Arm/ArmMmuLibUpdate.c index 484c67476619..23f613f5dbb0 100644 --- a/ArmPkg/Library/ArmMmuLib/Arm/ArmMmuLibUpdate.c +++ b/ArmPkg/Library/ArmMmuLib/Arm/ArmMmuLibUpdate.c @@ -81,12 +81,12 @@ UpdatePageEntries ( IN EFI_PHYSICAL_ADDRESS BaseAddress, IN UINT64 Length, IN UINT64 Attributes, + IN UINT32 EntryMask, OUT BOOLEAN *FlushTlbs OPTIONAL ) { EFI_STATUS Status; UINT32 EntryValue; - UINT32 EntryMask; UINT32 FirstLevelIdx; UINT32 Offset; UINT32 NumPageEntries; @@ -104,7 +104,6 @@ UpdatePageEntries ( =20 // EntryMask: bitmask of values to change (1 =3D change this value, 0 = =3D leave alone) // EntryValue: values at bit positions specified by EntryMask - EntryMask =3D TT_DESCRIPTOR_PAGE_TYPE_MASK | TT_DESCRIPTOR_PAGE_AP_MASK = | TT_DESCRIPTOR_PAGE_XN_MASK | TT_DESCRIPTOR_PAGE_AF; EntryValue =3D TT_DESCRIPTOR_PAGE_TYPE_PAGE; =20 // Although the PI spec is unclear on this, the GCD guarantees that only @@ -220,11 +219,11 @@ EFI_STATUS UpdateSectionEntries ( IN EFI_PHYSICAL_ADDRESS BaseAddress, IN UINT64 Length, - IN UINT64 Attributes + IN UINT64 Attributes, + IN UINT32 EntryMask ) { EFI_STATUS Status; - UINT32 EntryMask; UINT32 EntryValue; UINT32 FirstLevelIdx; UINT32 NumSections; @@ -240,8 +239,6 @@ UpdateSectionEntries ( // EntryValue: values at bit positions specified by EntryMask =20 // Make sure we handle a section range that is unmapped - EntryMask =3D TT_DESCRIPTOR_SECTION_TYPE_MASK | TT_DESCRIPTOR_SECTION_XN= _MASK | - TT_DESCRIPTOR_SECTION_AP_MASK | TT_DESCRIPTOR_SECTION_AF; EntryValue =3D TT_DESCRIPTOR_SECTION_TYPE_SECTION; =20 // Although the PI spec is unclear on this, the GCD guarantees that only @@ -310,6 +307,7 @@ UpdateSectionEntries ( (FirstLevelIdx + i) << TT_DESCRIPTOR_SECTION_BASE_SHIFT, TT_DESCRIPTOR_SECTION_SIZE, Attributes, + ConvertSectionAttributesToPageAttributes (EntryMask), NULL ); } else { @@ -340,11 +338,26 @@ UpdateSectionEntries ( return Status; } =20 +/** + Update the permission or memory type attributes on a range of memory. + + @param BaseAddress The start of the region. + @param Length The size of the region. + @param Attributes A mask of EFI_MEMORY_xx constants. + @param SectionMask A mask of short descriptor section attribu= tes + describing which descriptor bits to update. + + @retval EFI_SUCCESS The attributes were set successfully. + @retval EFI_OUT_OF_RESOURCES The operation failed due to insufficient m= emory. + +**/ +STATIC EFI_STATUS -ArmSetMemoryAttributes ( +SetMemoryAttributes ( IN EFI_PHYSICAL_ADDRESS BaseAddress, IN UINT64 Length, - IN UINT64 Attributes + IN UINT64 Attributes, + IN UINT32 SectionMask ) { EFI_STATUS Status; @@ -375,7 +388,12 @@ ArmSetMemoryAttributes ( Attributes )); =20 - Status =3D UpdateSectionEntries (BaseAddress, ChunkLength, Attribute= s); + Status =3D UpdateSectionEntries ( + BaseAddress, + ChunkLength, + Attributes, + SectionMask + ); =20 FlushTlbs =3D TRUE; } else { @@ -401,6 +419,7 @@ ArmSetMemoryAttributes ( BaseAddress, ChunkLength, Attributes, + ConvertSectionAttributesToPageAttributes (SectionMask), &FlushTlbs ); } @@ -420,13 +439,47 @@ ArmSetMemoryAttributes ( return Status; } =20 +/** + Update the permission or memory type attributes on a range of memory. + + @param BaseAddress The start of the region. + @param Length The size of the region. + @param Attributes A mask of EFI_MEMORY_xx constants. + + @retval EFI_SUCCESS The attributes were set successfully. + @retval EFI_OUT_OF_RESOURCES The operation failed due to insufficient m= emory. + +**/ +EFI_STATUS +ArmSetMemoryAttributes ( + IN EFI_PHYSICAL_ADDRESS BaseAddress, + IN UINT64 Length, + IN UINT64 Attributes + ) +{ + return SetMemoryAttributes ( + BaseAddress, + Length, + Attributes, + TT_DESCRIPTOR_SECTION_TYPE_MASK | + TT_DESCRIPTOR_SECTION_XN_MASK | + TT_DESCRIPTOR_SECTION_AP_MASK | + TT_DESCRIPTOR_SECTION_AF + ); +} + EFI_STATUS ArmSetMemoryRegionNoExec ( IN EFI_PHYSICAL_ADDRESS BaseAddress, IN UINT64 Length ) { - return ArmSetMemoryAttributes (BaseAddress, Length, EFI_MEMORY_XP); + return SetMemoryAttributes ( + BaseAddress, + Length, + EFI_MEMORY_XP, + TT_DESCRIPTOR_SECTION_XN_MASK + ); } =20 EFI_STATUS @@ -435,7 +488,12 @@ ArmClearMemoryRegionNoExec ( IN UINT64 Length ) { - return ArmSetMemoryAttributes (BaseAddress, Length, __EFI_MEMORY_RWX); + return SetMemoryAttributes ( + BaseAddress, + Length, + 0, + TT_DESCRIPTOR_SECTION_XN_MASK + ); } =20 EFI_STATUS @@ -444,7 +502,12 @@ ArmSetMemoryRegionReadOnly ( IN UINT64 Length ) { - return ArmSetMemoryAttributes (BaseAddress, Length, EFI_MEMORY_RO); + return SetMemoryAttributes ( + BaseAddress, + Length, + EFI_MEMORY_RO, + TT_DESCRIPTOR_SECTION_AP_MASK + ); } =20 EFI_STATUS @@ -453,5 +516,10 @@ ArmClearMemoryRegionReadOnly ( IN UINT64 Length ) { - return ArmSetMemoryAttributes (BaseAddress, Length, __EFI_MEMORY_RWX); + return SetMemoryAttributes ( + BaseAddress, + Length, + 0, + TT_DESCRIPTOR_SECTION_AP_MASK + ); } --=20 2.39.1 -=3D-=3D-=3D-=3D-=3D-=3D-=3D-=3D-=3D-=3D-=3D- Groups.io Links: You receive all messages sent to this group. View/Reply Online (#99891): https://edk2.groups.io/g/devel/message/99891 Mute This Topic: https://groups.io/mt/96853175/1787277 Group Owner: devel+owner@edk2.groups.io Unsubscribe: https://edk2.groups.io/g/devel/unsub [importer@patchew.org] -=3D-=3D-=3D-=3D-=3D-=3D-=3D-=3D-=3D-=3D-=3D-