diff options
| author | Ard Biesheuvel <ard.biesheuvel@linaro.org> | 2017-02-23 10:36:38 +0000 |
|---|---|---|
| committer | Ard Biesheuvel <ard.biesheuvel@linaro.org> | 2017-02-28 14:59:50 +0000 |
| commit | 973e388af2f8f35dce3aaa924a0372eedceeba96 (patch) | |
| tree | 5c164d3948e4ca07fb39759500810530d859ad2a /MdeModulePkg/MdeModulePkg.dec | |
| parent | f31c36c2938d5857008d674e913e3fc0783fab49 (diff) | |
| download | edk2-platforms-973e388af2f8f35dce3aaa924a0372eedceeba96.tar.xz | |
MdeModulePkg: define PCD for DXE memory protection policy
Define a new fixed/patchable PCD that sets the DXE memory protection
policy: its primary use is to define which memory types should have
their executable permissions removed. Combined with the image protection
policy, this can be used to implement a strict W^X policy, i.e.. a policy
where no regions exist that are both executable and writable at the same
time.
Contributed-under: TianoCore Contribution Agreement 1.0
Signed-off-by: Ard Biesheuvel <ard.biesheuvel@linaro.org>
Reviewed-by: Jiewen Yao <jiewen.yao@intel.com>
Diffstat (limited to 'MdeModulePkg/MdeModulePkg.dec')
| -rw-r--r-- | MdeModulePkg/MdeModulePkg.dec | 32 |
1 files changed, 32 insertions, 0 deletions
diff --git a/MdeModulePkg/MdeModulePkg.dec b/MdeModulePkg/MdeModulePkg.dec index 426634fbbd..10f4608189 100644 --- a/MdeModulePkg/MdeModulePkg.dec +++ b/MdeModulePkg/MdeModulePkg.dec @@ -1107,6 +1107,38 @@ # @ValidRange 0x80000002 | 0x00000000 - 0x0000001F
gEfiMdeModulePkgTokenSpaceGuid.PcdImageProtectionPolicy|0x00000002|UINT32|0x00001047
+ ## Set DXE memory protection policy. The policy is bitwise.
+ # If a bit is set, memory regions of the associated type will be mapped
+ # non-executable.<BR><BR>
+ #
+ # Below is bit mask for this PCD: (Order is same as UEFI spec)<BR>
+ # EfiReservedMemoryType 0x0001<BR>
+ # EfiLoaderCode 0x0002<BR>
+ # EfiLoaderData 0x0004<BR>
+ # EfiBootServicesCode 0x0008<BR>
+ # EfiBootServicesData 0x0010<BR>
+ # EfiRuntimeServicesCode 0x0020<BR>
+ # EfiRuntimeServicesData 0x0040<BR>
+ # EfiConventionalMemory 0x0080<BR>
+ # EfiUnusableMemory 0x0100<BR>
+ # EfiACPIReclaimMemory 0x0200<BR>
+ # EfiACPIMemoryNVS 0x0400<BR>
+ # EfiMemoryMappedIO 0x0800<BR>
+ # EfiMemoryMappedIOPortSpace 0x1000<BR>
+ # EfiPalCode 0x2000<BR>
+ # EfiPersistentMemory 0x4000<BR>
+ # OEM Reserved 0x4000000000000000<BR>
+ # OS Reserved 0x8000000000000000<BR>
+ #
+ # NOTE: User must NOT set NX protection for EfiLoaderCode / EfiBootServicesCode / EfiRuntimeServicesCode. <BR>
+ # User MUST set the same NX protection for EfiBootServicesData and EfiConventionalMemory. <BR>
+ #
+ # e.g. 0x7FD5 can be used for all memory except Code. <BR>
+ # e.g. 0x7BD4 can be used for all memory except Code and ACPINVS/Reserved. <BR>
+ #
+ # @Prompt Set DXE memory protection policy.
+ gEfiMdeModulePkgTokenSpaceGuid.PcdDxeNxMemoryProtectionPolicy|0x0000000|UINT64|0x00001048
+
## PCI Serial Device Info. It is an array of Device, Function, and Power Management
# information that describes the path that contains zero or more PCI to PCI briges
# followed by a PCI serial device. Each array entry is 4-bytes in length. The
|