Nick Kossifidis wrote:
You don't need to do a ROP attack on BootROM to remove the rules, anyI'd like to point out that my own proposal does always allow for the
locking of regions for the next boot stages, when that's appropriate.
When defining security controls there are guarantees we put in place.If unlocked M-mode PMP entries can't be called security controls, then
fine, let's call them something else. As I see it, the point is that
there is a demand/need for such an ability, it obviously involves PMP,
and furthermore it's been shown that the physical mechanisms are very
close to one another. If you ignore this other need and adopt the
current proposal, there's a very good chance we'll end up having to
retrofit the PMP table to support this other need later, creating a
bigger mess than if we learn to accomodate it now.
I understand you're afraid that offering any compromises in the PMP
mechanism will allow developers to choose the not-totally-secure
options and delude themselves that it gives them true security.
But that's not a hardware-mechanisms problem; that's a problem for
software policies and their enforcement. That concern needs to be
dealt with in a different way than by hobbling the hardware.
For my part, I will try to be much more careful about my use of the
words "secure" and "security" going forward.
- John Hauser