From 17e144ec0f67fba37d766f0a01a1a2fa3fcf2bf3 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Vincent=20Stehl=C3=A9?= Date: Thu, 20 Aug 2026 14:41:25 +0200 Subject: [PATCH] chapter2: require memory attribute conditionally MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Require the EFI_MEMORY_ATTRIBUTE_PROTOCOL when the firmware supports Enhanced Memory Protection, to allow boot components such as shim, systemd or the Linux EFI stub to control memory permissions. Signed-off-by: Vincent Stehlé --- source/chapter2-uefi.rst | 12 ++++++++++++ 1 file changed, 12 insertions(+) diff --git a/source/chapter2-uefi.rst b/source/chapter2-uefi.rst index 243b1980..3afff269 100644 --- a/source/chapter2-uefi.rst +++ b/source/chapter2-uefi.rst @@ -115,11 +115,23 @@ All of the following UEFI elements are required for EBBR compliance. - .. versionadded:: 2.1.0 Required on RISC-V platforms. (:UEFI:`2.3.7.1` and [RVUEFI]_) + * - `EFI_MEMORY_ATTRIBUTE_PROTOCOL` + - Required if the firmware supports Enhanced Memory Protection. [#EMPNote]_ + (:UEFI:`37.7`) .. [#COLNote] The `EFI_UNICODE_COLLATION_PROTOCOL` defined in :UEFI:`21.1` is also sometimes called the `EFI_UNICODE_COLLATION2_PROTOCOL` or even the `EFI_UNICODE_COLLATION_PROTOCOL2`. +.. [#EMPNote] Enhanced Memory Protection increases security by tightening + memory permissions. This includes making sure that writable memory is not + also executable (W^X). + + The `EFI_MEMORY_ATTRIBUTE_PROTOCOL` allows boot components to configure + memory permissions. + + https://microsoft.github.io/mu/WhatAndWhy/enhancedmemoryprotection/ + When the platform has a graphical console device, it is recommended that firmware implements the `EFI_GRAPHICS_OUTPUT_PROTOCOL` as defined in :UEFI:`12.9`.