From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from mail-pj1-f43.google.com (mail-pj1-f43.google.com [209.85.216.43]) by mx.groups.io with SMTP id smtpd.web09.18484.1627610085440181862 for ; Thu, 29 Jul 2021 18:54:45 -0700 Authentication-Results: mx.groups.io; dkim=pass header.i=@taylorbeebe.com header.s=google header.b=R/tynv12; spf=pass (domain: taylorbeebe.com, ip: 209.85.216.43, mailfrom: t@taylorbeebe.com) Received: by mail-pj1-f43.google.com with SMTP id pj14-20020a17090b4f4eb029017786cf98f9so1555675pjb.2 for ; Thu, 29 Jul 2021 18:54:45 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=taylorbeebe.com; s=google; h=subject:to:cc:references:from:message-id:date:user-agent :mime-version:in-reply-to:content-language:content-transfer-encoding; bh=DiRILMJ146su0FFUi1M4b4bm/8GRsQePhUoQJuOksLg=; b=R/tynv12ZebeWQHUGNHmzSTY8CtcLkCtNBp+rnAXdLPDjkPRnptj7LYPGjTde1fkm9 u2c3DOxqlhUc1s37kI8KTtvvEBxDegDtb9vGsOUFx0Q/dvzrWWJAUObJoQCJ//fAYXFi DZORraSHjHg5+qG3WIaSGjY19aaP7TCt+A2/Y38RUWuKqBv+Z494Gln/PvYfz93CnlOT yJdhw0/D4ugLaMw8eD5YHZGTSW0jhOSaaWCYe4Ew132kQK1vmtaVKJ/Itoj3gJf0Mruu 6DLj0kvpkxRxBRXGaL+snmxc8KWyp3XXj6N5Nslq29HoxBo5CA26sNNWKt7/TA1fjtDI e+2g== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:subject:to:cc:references:from:message-id:date :user-agent:mime-version:in-reply-to:content-language :content-transfer-encoding; bh=DiRILMJ146su0FFUi1M4b4bm/8GRsQePhUoQJuOksLg=; b=R4mc/3N94SgB+IFTBe+vzatFKRxWaKHYyMQ2f5K7Mq+EvNAvY+w8quxkvg7cfHOLft glpyDhmopwEqQNI0uJiU2gvun/6tnujd9t4+ZjWSSJN+2/MGgkP6firPQ8EwiFtWRRc1 Fl4W3bsgvEBv1GK2FM+SIWwdeLRxXyC8ncpg/w1BJK/8M+UKcR+r3WKpe2VMzprbX4Fv b5m72dMwdW9D1UvuWrtj4Cvy+Z9AYCplCLJn1GeEf4G1vM24AwmrRYFd9V+E5VUF0TrR fwebGkeREPNKcWyCblysyVaDEQrEN/dvkfrtOwidYYzpd1+TQzsl/IX7UviHqxi/Bdg6 1W6Q== X-Gm-Message-State: AOAM53181bxH7hVN25t4Qxg0bxaHKgXORlNyIwJM1qPiHT+LhrEE0atc geJ7DBPW3/5wfIcAfw04cdbeYA== X-Google-Smtp-Source: ABdhPJy7gXQLUrtz4hKPGQhCUyEpbRe7iPbIWOT+Abp6bhyOUuAh6dXmRMIQ2IV+3mcyK3/cDKSxHA== X-Received: by 2002:a63:4b0a:: with SMTP id y10mr46002pga.437.1627610085070; Thu, 29 Jul 2021 18:54:45 -0700 (PDT) Return-Path: Received: from [192.168.0.159] ([50.35.69.176]) by smtp.gmail.com with ESMTPSA id 37sm138309pgt.28.2021.07.29.18.54.44 (version=TLS1_3 cipher=TLS_AES_128_GCM_SHA256 bits=128/128); Thu, 29 Jul 2021 18:54:44 -0700 (PDT) Subject: Re: [RFC] MemoryProtectionLib for Dynamic Memory Guard Settings To: "Wang, Jian J" , "devel@edk2.groups.io" Cc: "spbrogan@outlook.com" , "Dong, Eric" , "Ni, Ray" , "Kumar, Rahul1" , "mikuback@linux.microsoft.com" , "Wu, Hao A" , "Bi, Dandan" , "gaoliming@byosoft.com.cn" , "Dong, Guo" , "Ma, Maurice" , "You, Benjamin" , "Yao, Jiewen" References: From: "Taylor Beebe" Message-ID: <5ffb8dce-8a33-537c-2019-ec4666854739@taylorbeebe.com> Date: Thu, 29 Jul 2021 18:54:42 -0700 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:78.0) Gecko/20100101 Thunderbird/78.12.0 MIME-Version: 1.0 In-Reply-To: Content-Type: text/plain; charset=utf-8; format=flowed Content-Language: en-US Content-Transfer-Encoding: 7bit Thanks for your feedback, Jian. In option 2, a most basic implementation would returning the current FixedAtBuild PCDs assuming they are kept. If they aren't, the library implementer could simply hard-code the return value for each memory protection setting. In option 1, the HOB would be published in pre-mem and I'm not an expert on exploiting the pre-mem environment. Jiewen may have more to say on this. -Taylor On 7/28/2021 7:18 PM, Wang, Jian J wrote: > Thanks for the RFC. I'm not object to this idea. The only concern from me > is the potential security holes introduced by the changes. According to your > description, it allows 3rd party software to violate memory protection policy. > I'd like to see more explanations on how to avoid it to be exploited. > > +Jiewen, what's current process to evaluate the security threat? > > Regards, > Jian > >> -----Original Message----- >> From: Taylor Beebe >> Sent: Friday, July 23, 2021 8:33 AM >> To: devel@edk2.groups.io >> Cc: spbrogan@outlook.com; Dong, Eric ; Ni, Ray >> ; Kumar, Rahul1 ; >> mikuback@linux.microsoft.com; Wang, Jian J ; Wu, >> Hao A ; Bi, Dandan ; >> gaoliming@byosoft.com.cn; Dong, Guo ; Ma, Maurice >> ; You, Benjamin >> Subject: [RFC] MemoryProtectionLib for Dynamic Memory Guard Settings >> >> Current memory protection settings rely on FixedAtBuild PCD values >> (minus PcdSetNxForStack). Because of this, the memory protection >> configuration interface is fixed in nature. Cases arise in which memory >> protections might need to be adjusted between boots (if platform design >> allows) to avoid disabling a system. For example, platforms might choose >> to allow the user to control their protection policies such as allow >> execution of critical 3rd party software that might violate memory >> protections. >> >> This RFC seeks your feedback regarding introducing an interface that >> allows dynamic configuration of memory protection settings. >> >> I would like to propose two options: >> 1. Describing the memory protection setting configuration in a HOB that >> is produced by the platform. >> 2. Introducing a library class (e.g. MemoryProtectionLib) that allows >> abstraction of the memory protection setting configuration data source. >> >> In addition, I would like to know if the memory protection FixedAtBuild >> PCDs currently in MdeModulePkg can be removed so we can move the >> configuration interface entirely to an option above. >> >> In any case, I would like the settings to be visible to environments >> such as Standalone MM where dynamic PCDs are not accessible. >> >> I am seeking your feedback on this proposal in preparation for sending >> an edk2 patch series. >> >> -- >> Taylor Beebe >> Software Engineer @ Microsoft -- Taylor Beebe Software Engineer @ Microsoft