MdeModulePkg: Add new PCD to control the evacuate temporary memory feature (CVE-2019...

[mirror_edk2.git] / MdeModulePkg / MdeModulePkg.dec

diff --git a/MdeModulePkg/MdeModulePkg.dec b/MdeModulePkg/MdeModulePkg.dec
index 843e963ad34b4e6e9e1d6c45889bb30604952260..45874e9c8236a4489593db61056f9b11202ec838 100644 (file)
--- a/MdeModulePkg/MdeModulePkg.dec
+++ b/MdeModulePkg/MdeModulePkg.dec
@@ -1220,6 +1220,15 @@
   # @Prompt Shadow Peim and PeiCore on boot\r
   gEfiMdeModulePkgTokenSpaceGuid.PcdShadowPeimOnBoot|TRUE|BOOLEAN|0x30001029\r
 \r
+  ## Enable the feature that evacuate temporary memory to permanent memory or not<BR><BR>\r
+  #  Set FALSE as default, if the developer need this feature to avoid this vulnerability, please\r
+  #  enable it to shadow all PEIMs no matter the behavior controled by PcdShadowPeimOnBoot or\r
+  #  PcdShadowPeimOnS3Boot<BR>\r
+  #  TRUE - Evacuate temporary memory, the actions include copy memory, convert PPI pointers and so on.<BR>\r
+  #  FALSE - Do nothing, for example, no copy memory, no convert PPI pointers and so on.<BR>\r
+  # @Prompt Evacuate temporary memory to permanent memory\r
+  gEfiMdeModulePkgTokenSpaceGuid.PcdMigrateTemporaryRamFirmwareVolumes|FALSE|BOOLEAN|0x3000102A\r
+\r
   ## The mask is used to control memory profile behavior.<BR><BR>\r
   #  BIT0 - Enable UEFI memory profile.<BR>\r
   #  BIT1 - Enable SMRAM profile.<BR>\r