Hi Sorry, I am not able to follow the discussion. Is there any sample or POC code to show the concept?
> -----Original Message----- > From: Taylor Beebe <t...@taylorbeebe.com> > Sent: Friday, July 30, 2021 9:55 AM > To: Wang, Jian J <jian.j.w...@intel.com>; devel@edk2.groups.io > Cc: spbro...@outlook.com; Dong, Eric <eric.d...@intel.com>; Ni, Ray > <ray...@intel.com>; Kumar, Rahul1 <rahul1.ku...@intel.com>; > mikub...@linux.microsoft.com; Wu, Hao A <hao.a...@intel.com>; Bi, Dandan > <dandan...@intel.com>; gaolim...@byosoft.com.cn; Dong, Guo > <guo.d...@intel.com>; Ma, Maurice <maurice...@intel.com>; You, Benjamin > <benjamin....@intel.com>; Yao, Jiewen <jiewen....@intel.com> > Subject: Re: [RFC] MemoryProtectionLib for Dynamic Memory Guard Settings > > Thanks for your feedback, Jian. > > In option 2, a most basic implementation would returning the current > FixedAtBuild PCDs assuming they are kept. If they aren't, the library > implementer could simply hard-code the return value for each memory > protection setting. > > In option 1, the HOB would be published in pre-mem and I'm not an expert > on exploiting the pre-mem environment. Jiewen may have more to say on this. > > -Taylor > > On 7/28/2021 7:18 PM, Wang, Jian J wrote: > > Thanks for the RFC. I'm not object to this idea. The only concern from me > > is the potential security holes introduced by the changes. According to your > > description, it allows 3rd party software to violate memory protection > > policy. > > I'd like to see more explanations on how to avoid it to be exploited. > > > > +Jiewen, what's current process to evaluate the security threat? > > > > Regards, > > Jian > > > >> -----Original Message----- > >> From: Taylor Beebe <t...@taylorbeebe.com> > >> Sent: Friday, July 23, 2021 8:33 AM > >> To: devel@edk2.groups.io > >> Cc: spbro...@outlook.com; Dong, Eric <eric.d...@intel.com>; Ni, Ray > >> <ray...@intel.com>; Kumar, Rahul1 <rahul1.ku...@intel.com>; > >> mikub...@linux.microsoft.com; Wang, Jian J <jian.j.w...@intel.com>; Wu, > >> Hao A <hao.a...@intel.com>; Bi, Dandan <dandan...@intel.com>; > >> gaolim...@byosoft.com.cn; Dong, Guo <guo.d...@intel.com>; Ma, > Maurice > >> <maurice...@intel.com>; You, Benjamin <benjamin....@intel.com> > >> Subject: [RFC] MemoryProtectionLib for Dynamic Memory Guard Settings > >> > >> Current memory protection settings rely on FixedAtBuild PCD values > >> (minus PcdSetNxForStack). Because of this, the memory protection > >> configuration interface is fixed in nature. Cases arise in which memory > >> protections might need to be adjusted between boots (if platform design > >> allows) to avoid disabling a system. For example, platforms might choose > >> to allow the user to control their protection policies such as allow > >> execution of critical 3rd party software that might violate memory > >> protections. > >> > >> This RFC seeks your feedback regarding introducing an interface that > >> allows dynamic configuration of memory protection settings. > >> > >> I would like to propose two options: > >> 1. Describing the memory protection setting configuration in a HOB that > >> is produced by the platform. > >> 2. Introducing a library class (e.g. MemoryProtectionLib) that allows > >> abstraction of the memory protection setting configuration data source. > >> > >> In addition, I would like to know if the memory protection FixedAtBuild > >> PCDs currently in MdeModulePkg can be removed so we can move the > >> configuration interface entirely to an option above. > >> > >> In any case, I would like the settings to be visible to environments > >> such as Standalone MM where dynamic PCDs are not accessible. > >> > >> I am seeking your feedback on this proposal in preparation for sending > >> an edk2 patch series. > >> > >> -- > >> Taylor Beebe > >> Software Engineer @ Microsoft > > -- > Taylor Beebe > Software Engineer @ Microsoft -=-=-=-=-=-=-=-=-=-=-=- Groups.io Links: You receive all messages sent to this group. View/Reply Online (#78387): https://edk2.groups.io/g/devel/message/78387 Mute This Topic: https://groups.io/mt/84392478/21656 Group Owner: devel+ow...@edk2.groups.io Unsubscribe: https://edk2.groups.io/g/devel/unsub [arch...@mail-archive.com] -=-=-=-=-=-=-=-=-=-=-=-
