From 973e388af2f8f35dce3aaa924a0372eedceeba96 Mon Sep 17 00:00:00 2001 From: Ard Biesheuvel Date: Thu, 23 Feb 2017 10:36:38 +0000 Subject: [PATCH] MdeModulePkg: define PCD for DXE memory protection policy Define a new fixed/patchable PCD that sets the DXE memory protection policy: its primary use is to define which memory types should have their executable permissions removed. Combined with the image protection policy, this can be used to implement a strict W^X policy, i.e.. a policy where no regions exist that are both executable and writable at the same time. Contributed-under: TianoCore Contribution Agreement 1.0 Signed-off-by: Ard Biesheuvel Reviewed-by: Jiewen Yao --- MdeModulePkg/MdeModulePkg.dec | 32 ++++++++++++++++++++++++++++++++ 1 file changed, 32 insertions(+) diff --git a/MdeModulePkg/MdeModulePkg.dec b/MdeModulePkg/MdeModulePkg.dec index 426634fbbd..10f4608189 100644 --- a/MdeModulePkg/MdeModulePkg.dec +++ b/MdeModulePkg/MdeModulePkg.dec @@ -1107,6 +1107,38 @@ # @ValidRange 0x80000002 | 0x00000000 - 0x0000001F gEfiMdeModulePkgTokenSpaceGuid.PcdImageProtectionPolicy|0x00000002|UINT32|0x00001047 + ## Set DXE memory protection policy. The policy is bitwise. + # If a bit is set, memory regions of the associated type will be mapped + # non-executable.

+ # + # Below is bit mask for this PCD: (Order is same as UEFI spec)
+ # EfiReservedMemoryType 0x0001
+ # EfiLoaderCode 0x0002
+ # EfiLoaderData 0x0004
+ # EfiBootServicesCode 0x0008
+ # EfiBootServicesData 0x0010
+ # EfiRuntimeServicesCode 0x0020
+ # EfiRuntimeServicesData 0x0040
+ # EfiConventionalMemory 0x0080
+ # EfiUnusableMemory 0x0100
+ # EfiACPIReclaimMemory 0x0200
+ # EfiACPIMemoryNVS 0x0400
+ # EfiMemoryMappedIO 0x0800
+ # EfiMemoryMappedIOPortSpace 0x1000
+ # EfiPalCode 0x2000
+ # EfiPersistentMemory 0x4000
+ # OEM Reserved 0x4000000000000000
+ # OS Reserved 0x8000000000000000
+ # + # NOTE: User must NOT set NX protection for EfiLoaderCode / EfiBootServicesCode / EfiRuntimeServicesCode.
+ # User MUST set the same NX protection for EfiBootServicesData and EfiConventionalMemory.
+ # + # e.g. 0x7FD5 can be used for all memory except Code.
+ # e.g. 0x7BD4 can be used for all memory except Code and ACPINVS/Reserved.
+ # + # @Prompt Set DXE memory protection policy. + gEfiMdeModulePkgTokenSpaceGuid.PcdDxeNxMemoryProtectionPolicy|0x0000000|UINT64|0x00001048 + ## PCI Serial Device Info. It is an array of Device, Function, and Power Management # information that describes the path that contains zero or more PCI to PCI briges # followed by a PCI serial device. Each array entry is 4-bytes in length. The -- 2.39.2