Re: [PATCH 3/3] MdeModulePkg/DxeCore: Add UEFI image protection.

["Kinney, Michael D" <michael.d.kinney@intel.com>]

Jiewen,

Can we simplify the policy setting to 2 bits?  

One for FV images and one for non-FV images?

Thanks,

Mike


> -----Original Message-----
> From: Ard Biesheuvel [mailto:ard.biesheuvel@linaro.org]
> Sent: Monday, February 6, 2017 6:53 AM
> To: Yao, Jiewen <jiewen.yao@intel.com>
> Cc: Kinney, Michael D <michael.d.kinney@intel.com>; edk2-devel@lists.01.org; Tian,
> Feng <feng.tian@intel.com>; Zeng, Star <star.zeng@intel.com>
> Subject: Re: [edk2] [PATCH 3/3] MdeModulePkg/DxeCore: Add UEFI image protection.
> 
> On 6 February 2017 at 14:51, Yao, Jiewen <jiewen.yao@intel.com> wrote:
> > Hi Ard
> >
> > That is a good question.
> >
> >
> >
> > We (Intel) discussed this internally.
> >
> > We do not know if there is any need to make it configurable, so we start
> > from non-configurable, and see if there is any feedback from other one.
> >
> >
> >
> > Glad to hear your voice. We can define a policy like below: (I borrow some
> > definition from security pkg)
> >
> >
> >
> > [PcdsFixedAtBuild, PcdsPatchableInModule]
> >
> >   ## Set Image protection policy. The policy is bitwise.
> >
> >   #  If a bit is set, the image will be protected by DxeCore if it is
> > aligned.
> >
> >   #   The code section becomes read-only, and the data section becomes
> > non-executable.
> >
> >   #  If a bit is clear, the image will not be protected.<BR><BR>
> >
> >   #    BIT0       - Image from unknown device. <BR>
> >
> >   #    BIT1       - Image from firmware volume.<BR>
> >
> >   #    BIT2       - Image from OptionRom.<BR>
> >
> >   #    BIT3       - Image from removable media which includes CD-ROM,
> > Floppy, USB and network.<BR>
> >
> >   #    BIT4       - Image from fixed media device which includes hard
> > disk.<BR>
> >
> >   # @Prompt Set Image protection policy.
> >
> >   # @ValidRange 0x80000002 | 0x00000000 - 0x0000001F
> >
> >
> >
> gEfiMdeModulePkgTokenSpaceGuid.PcdImageProtectionPolicy|0x00000002|UINT32|0x30001047
> >
> >
> >
> > I will use 0x2 as default policy, to maximize the compatibility. And you can
> > set 0x1A or 0x1F for ARM. Is that OK?
> >
> 
> Yes, that would be perfect. Thanks!