Re: [PATCH 3/3] MdeModulePkg/DxeCore: Add UEFI image protection.

[Ard Biesheuvel <ard.biesheuvel@linaro.org>]

On 6 February 2017 at 14:51, Yao, Jiewen <jiewen.yao@intel.com> wrote:
> Hi Ard
>
> That is a good question.
>
>
>
> We (Intel) discussed this internally.
>
> We do not know if there is any need to make it configurable, so we start
> from non-configurable, and see if there is any feedback from other one.
>
>
>
> Glad to hear your voice. We can define a policy like below: (I borrow some
> definition from security pkg)
>
>
>
> [PcdsFixedAtBuild, PcdsPatchableInModule]
>
>   ## Set Image protection policy. The policy is bitwise.
>
>   #  If a bit is set, the image will be protected by DxeCore if it is
> aligned.
>
>   #   The code section becomes read-only, and the data section becomes
> non-executable.
>
>   #  If a bit is clear, the image will not be protected.<BR><BR>
>
>   #    BIT0       - Image from unknown device. <BR>
>
>   #    BIT1       - Image from firmware volume.<BR>
>
>   #    BIT2       - Image from OptionRom.<BR>
>
>   #    BIT3       - Image from removable media which includes CD-ROM,
> Floppy, USB and network.<BR>
>
>   #    BIT4       - Image from fixed media device which includes hard
> disk.<BR>
>
>   # @Prompt Set Image protection policy.
>
>   # @ValidRange 0x80000002 | 0x00000000 - 0x0000001F
>
>
> gEfiMdeModulePkgTokenSpaceGuid.PcdImageProtectionPolicy|0x00000002|UINT32|0x30001047
>
>
>
> I will use 0x2 as default policy, to maximize the compatibility. And you can
> set 0x1A or 0x1F for ARM. Is that OK?
>

Yes, that would be perfect. Thanks!