MdeModulePkg: define PCD for DXE memory protection policy

Define a new fixed/patchable PCD that sets the DXE memory protection
policy: its primary use is to define which memory types should have
their executable permissions removed. Combined with the image protection
policy, this can be used to implement a strict W^X policy, i.e.. a policy
where no regions exist that are both executable and writable at the same
time.

Contributed-under: TianoCore Contribution Agreement 1.0
Signed-off-by: Ard Biesheuvel <ard.biesheuvel@linaro.org>
Reviewed-by: Jiewen Yao <jiewen.yao@intel.com>

diff --git a/MdeModulePkg/MdeModulePkg.dec b/MdeModulePkg/MdeModulePkg.dec
index 426634fbbd4dadc41f2c3499acb4473bebc3668f..10f46081891550b3f427b6ca569c46cff135320b 100644 (file)
--- a/MdeModulePkg/MdeModulePkg.dec
+++ b/MdeModulePkg/MdeModulePkg.dec
@@ -1107,6 +1107,38 @@
   # @ValidRange 0x80000002 | 0x00000000 - 0x0000001F\r
   gEfiMdeModulePkgTokenSpaceGuid.PcdImageProtectionPolicy|0x00000002|UINT32|0x00001047\r
 \r
+  ## Set DXE memory protection policy. The policy is bitwise.\r
+  #  If a bit is set, memory regions of the associated type will be mapped\r
+  #  non-executable.<BR><BR>\r
+  #\r
+  # Below is bit mask for this PCD: (Order is same as UEFI spec)<BR>\r
+  #  EfiReservedMemoryType          0x0001<BR>\r
+  #  EfiLoaderCode                  0x0002<BR>\r
+  #  EfiLoaderData                  0x0004<BR>\r
+  #  EfiBootServicesCode            0x0008<BR>\r
+  #  EfiBootServicesData            0x0010<BR>\r
+  #  EfiRuntimeServicesCode         0x0020<BR>\r
+  #  EfiRuntimeServicesData         0x0040<BR>\r
+  #  EfiConventionalMemory          0x0080<BR>\r
+  #  EfiUnusableMemory              0x0100<BR>\r
+  #  EfiACPIReclaimMemory           0x0200<BR>\r
+  #  EfiACPIMemoryNVS               0x0400<BR>\r
+  #  EfiMemoryMappedIO              0x0800<BR>\r
+  #  EfiMemoryMappedIOPortSpace     0x1000<BR>\r
+  #  EfiPalCode                     0x2000<BR>\r
+  #  EfiPersistentMemory            0x4000<BR>\r
+  #  OEM Reserved       0x4000000000000000<BR>\r
+  #  OS Reserved        0x8000000000000000<BR>\r
+  #\r
+  # NOTE: User must NOT set NX protection for EfiLoaderCode / EfiBootServicesCode / EfiRuntimeServicesCode. <BR>\r
+  #       User MUST set the same NX protection for EfiBootServicesData and EfiConventionalMemory. <BR>\r
+  #\r
+  # e.g. 0x7FD5 can be used for all memory except Code. <BR>\r
+  # e.g. 0x7BD4 can be used for all memory except Code and ACPINVS/Reserved. <BR>\r
+  #\r
+  # @Prompt Set DXE memory protection policy.\r
+  gEfiMdeModulePkgTokenSpaceGuid.PcdDxeNxMemoryProtectionPolicy|0x0000000|UINT64|0x00001048\r
+\r
   ## PCI Serial Device Info. It is an array of Device, Function, and Power Management\r
   #  information that describes the path that contains zero or more PCI to PCI briges\r
   #  followed by a PCI serial device.  Each array entry is 4-bytes in length.  The\r