@@ -1107,6 +1107,22 @@ [PcdsFixedAtBuild, PcdsPatchableInModule]
# @ValidRange 0x80000002 | 0x00000000 - 0x0000001F
gEfiMdeModulePkgTokenSpaceGuid.PcdImageProtectionPolicy|0x00000002|UINT32|0x00001047
+ ## Set DXE memory protection policy. The policy is bitwise.
+ # If a bit is set, memory regions of the associated type will be mapped
+ # non-executable.<BR><BR>
+ # BIT0 - EfiLoaderData. <BR>
+ # - EfiBootServicesData. <BR>
+ # - EfiRuntimeServicesData. <BR>
+ # - EfiConventionalMemory. <BR>
+ # - EfiUnusableMemory. <BR>
+ # - EfiPersistentMemory. <BR>
+ # - EfiACPIReclaimMemory. <BR>
+ # BIT1 - EfiReservedMemoryType. <BR>
+ # BIT2 - EfiACPIMemoryNVS. <BR>
+ # @Prompt Set DXE memory protection policy.
+ # @ValidRange 0x80000002 | 0x00000000 - 0x00000007
+ gEfiMdeModulePkgTokenSpaceGuid.PcdDxeMemoryProtectionPolicy|0x0000007|UINT32|0x00001048
+
## PCI Serial Device Info. It is an array of Device, Function, and Power Management
# information that describes the path that contains zero or more PCI to PCI briges
# followed by a PCI serial device. Each array entry is 4-bytes in length. The
Define a new fixed/patchable PCD that sets the DXE memory protection policy: its primary use is to define which memory types should have their executable permissions removed. Combined with the image protection policy, this can be used to implement a strict W^X policy, i.e.. a policy where no regions exist that are both executable and writable at the same time. Contributed-under: TianoCore Contribution Agreement 1.0 Signed-off-by: Ard Biesheuvel <ard.biesheuvel@linaro.org> --- MdeModulePkg/MdeModulePkg.dec | 16 ++++++++++++++++ 1 file changed, 16 insertions(+) -- 2.7.4 _______________________________________________ edk2-devel mailing list edk2-devel@lists.01.org https://lists.01.org/mailman/listinfo/edk2-devel