From a7a3220c9ef839e7fed13bb47ff66e57732ee2fa Mon Sep 17 00:00:00 2001
From: Sami Mujawar <sami.mujawar@arm.com>
Date: Thu, 18 Jun 2026 18:32:25 +0100
Subject: [PATCH] UefiCpuPkg/ArmMmuLib: Validate CCA protection attribute bit

When deriving the CCA protection attribute from the memory descriptor
virtual and physical addresses, assert that the descriptor uses either a
protected mapping or the expected Realm protection bit.

This catches malformed initial MMU descriptors without rejecting valid
protected IPA mappings.

Signed-off-by: Sami Mujawar <sami.mujawar@arm.com>
---
 .../Library/ArmMmuLib/AArch64/ArmMmuLibCore.c | 25 ++++++++++++++++++-
 1 file changed, 24 insertions(+), 1 deletion(-)

diff --git a/UefiCpuPkg/Library/ArmMmuLib/AArch64/ArmMmuLibCore.c b/UefiCpuPkg/Library/ArmMmuLib/AArch64/ArmMmuLibCore.c
index 22ace6478b..08a67fc2b1 100644
--- a/UefiCpuPkg/Library/ArmMmuLib/AArch64/ArmMmuLibCore.c
+++ b/UefiCpuPkg/Library/ArmMmuLib/AArch64/ArmMmuLibCore.c
@@ -552,7 +552,9 @@ FillTranslationTable (
   IN  BOOLEAN                       Lpa2Enabled
   )
 {
-  UINT64  CcaProtectionAttribute;
+  EFI_STATUS  Status;
+  UINT64      CcaProtectionAttribute;
+  UINT64      CcaProtectionAttributeMask;
 
   //
   // The CCA protection attribute corresponds to the (IPA_WIDTH - 1) bit of the
@@ -560,6 +562,9 @@ FillTranslationTable (
   // in this bit. Derive the attribute by XORing the two addresses.
   //
   // NOTE: If more than one bit differs, the memory map is misconfigured.
+  //       In case of LPA2 if the CCA protection attribute bit falls in the top
+  //       bits, i.e. 50 & 51; we expect these to be shifted appropriately when
+  //       the memory map is setup.
   //
   CcaProtectionAttribute = MemoryRegion->VirtualBase ^ MemoryRegion->PhysicalBase;
 
@@ -568,6 +573,24 @@ FillTranslationTable (
   //
   ASSERT (((CcaProtectionAttribute & (CcaProtectionAttribute - 1)) == 0));
 
+  //
+  // Get the CCA Protection Attribute mask.
+  //
+  Status = ArmCcaGetMemoryProtectionAttribute (&CcaProtectionAttributeMask);
+  if (EFI_ERROR (Status)) {
+    return Status;
+  }
+
+  //
+  // The CCA protection attribute is either absent for protected IPA mappings,
+  // or equal to the expected Realm protection attribute mask for unprotected
+  // IPA mappings.
+  //
+  ASSERT (
+    (CcaProtectionAttribute == 0) ||
+    (CcaProtectionAttribute == CcaProtectionAttributeMask)
+    );
+
   return UpdateRegionMapping (
            MemoryRegion->VirtualBase,
            MemoryRegion->Length,