| Message ID | 1488378977-15398-1-git-send-email-ard.biesheuvel@linaro.org |
|---|---|
| State | Accepted |
| Commit | 1acd7c54a72418918d7aaa859884e72bd4933473 |
| Headers | show |
On 03/01/17 15:36, Ard Biesheuvel wrote: > This sets the recently introduced PCD PcdDxeNxMemoryProtectionPolicy to > a value that protects all memory regions except code regions against > inadvertent execution. > > Note that this does not [yet] protect EfiLoaderData regions, due to > compatibility issues with shim and GRUB. > > Contributed-under: TianoCore Contribution Agreement 1.0 > Signed-off-by: Ard Biesheuvel <ard.biesheuvel@linaro.org> > Reviewed-by: Jiewen Yao <jiewen.yao@intel.com> > --- > v2: leave EfiLoaderData executable for the time being > > ArmVirtPkg/ArmVirt.dsc.inc | 7 +++++++ > 1 file changed, 7 insertions(+) > > diff --git a/ArmVirtPkg/ArmVirt.dsc.inc b/ArmVirtPkg/ArmVirt.dsc.inc > index 2b0a44e14d24..a91b27f13cf2 100644 > --- a/ArmVirtPkg/ArmVirt.dsc.inc > +++ b/ArmVirtPkg/ArmVirt.dsc.inc > @@ -383,6 +383,13 @@ [PcdsFixedAtBuild.AARCH64] > # > gEfiMdeModulePkgTokenSpaceGuid.PcdImageProtectionPolicy|0x3 > > + # > + # Enable NX memory protection for all non-code regions, including OEM and OS > + # reserved ones, with the exception of LoaderData regions, of which OS loaders > + # (i.e., GRUB) may assume that its contents are executable. > + # > + gEfiMdeModulePkgTokenSpaceGuid.PcdDxeNxMemoryProtectionPolicy|0xC000000000007FD1 > + > [Components.common] > # > # Networking stack > Reviewed-by: Laszlo Ersek <lersek@redhat.com> Tested-by: Laszlo Ersek <lersek@redhat.com> _______________________________________________ edk2-devel mailing list edk2-devel@lists.01.org https://lists.01.org/mailman/listinfo/edk2-devel
On 1 March 2017 at 18:32, Laszlo Ersek <lersek@redhat.com> wrote: > On 03/01/17 15:36, Ard Biesheuvel wrote: >> This sets the recently introduced PCD PcdDxeNxMemoryProtectionPolicy to >> a value that protects all memory regions except code regions against >> inadvertent execution. >> >> Note that this does not [yet] protect EfiLoaderData regions, due to >> compatibility issues with shim and GRUB. >> >> Contributed-under: TianoCore Contribution Agreement 1.0 >> Signed-off-by: Ard Biesheuvel <ard.biesheuvel@linaro.org> >> Reviewed-by: Jiewen Yao <jiewen.yao@intel.com> >> --- >> v2: leave EfiLoaderData executable for the time being >> >> ArmVirtPkg/ArmVirt.dsc.inc | 7 +++++++ >> 1 file changed, 7 insertions(+) >> >> diff --git a/ArmVirtPkg/ArmVirt.dsc.inc b/ArmVirtPkg/ArmVirt.dsc.inc >> index 2b0a44e14d24..a91b27f13cf2 100644 >> --- a/ArmVirtPkg/ArmVirt.dsc.inc >> +++ b/ArmVirtPkg/ArmVirt.dsc.inc >> @@ -383,6 +383,13 @@ [PcdsFixedAtBuild.AARCH64] >> # >> gEfiMdeModulePkgTokenSpaceGuid.PcdImageProtectionPolicy|0x3 >> >> + # >> + # Enable NX memory protection for all non-code regions, including OEM and OS >> + # reserved ones, with the exception of LoaderData regions, of which OS loaders >> + # (i.e., GRUB) may assume that its contents are executable. >> + # >> + gEfiMdeModulePkgTokenSpaceGuid.PcdDxeNxMemoryProtectionPolicy|0xC000000000007FD1 >> + >> [Components.common] >> # >> # Networking stack >> > > Reviewed-by: Laszlo Ersek <lersek@redhat.com> > Tested-by: Laszlo Ersek <lersek@redhat.com> Pushed, thanks. _______________________________________________ edk2-devel mailing list edk2-devel@lists.01.org https://lists.01.org/mailman/listinfo/edk2-devel
diff --git a/ArmVirtPkg/ArmVirt.dsc.inc b/ArmVirtPkg/ArmVirt.dsc.inc index 2b0a44e14d24..a91b27f13cf2 100644 --- a/ArmVirtPkg/ArmVirt.dsc.inc +++ b/ArmVirtPkg/ArmVirt.dsc.inc @@ -383,6 +383,13 @@ [PcdsFixedAtBuild.AARCH64] # gEfiMdeModulePkgTokenSpaceGuid.PcdImageProtectionPolicy|0x3 + # + # Enable NX memory protection for all non-code regions, including OEM and OS + # reserved ones, with the exception of LoaderData regions, of which OS loaders + # (i.e., GRUB) may assume that its contents are executable. + # + gEfiMdeModulePkgTokenSpaceGuid.PcdDxeNxMemoryProtectionPolicy|0xC000000000007FD1 + [Components.common] # # Networking stack