[PATCH v2 4/5] MdeModulePkg: define PCD for DXE memory protection policy

[Ard Biesheuvel <ard.biesheuvel@linaro.org>]

Define a new fixed/patchable PCD that sets the DXE memory protection
policy: its primary use is to define which memory types should have
their executable permissions removed. Combined with the image protection
policy, this can be used to implement a strict W^X policy, i.e.. a policy
where no regions exist that are both executable and writable at the same
time.

Contributed-under: TianoCore Contribution Agreement 1.0
Signed-off-by: Ard Biesheuvel <ard.biesheuvel@linaro.org>
---
 MdeModulePkg/MdeModulePkg.dec | 16 ++++++++++++++++
 1 file changed, 16 insertions(+)

diff --git a/MdeModulePkg/MdeModulePkg.dec b/MdeModulePkg/MdeModulePkg.dec
index 426634fbbd4d..ea64cdf3772d 100644
--- a/MdeModulePkg/MdeModulePkg.dec
+++ b/MdeModulePkg/MdeModulePkg.dec
@@ -1107,6 +1107,22 @@ [PcdsFixedAtBuild, PcdsPatchableInModule]
   # @ValidRange 0x80000002 | 0x00000000 - 0x0000001F
   gEfiMdeModulePkgTokenSpaceGuid.PcdImageProtectionPolicy|0x00000002|UINT32|0x00001047
 
+  ## Set DXE memory protection policy. The policy is bitwise.
+  #  If a bit is set, memory regions of the associated type will be mapped
+  #  non-executable.<BR><BR>
+  #    BIT0       - EfiLoaderData.              <BR>
+  #               - EfiBootServicesData.        <BR>
+  #               - EfiRuntimeServicesData.     <BR>
+  #               - EfiConventionalMemory.      <BR>
+  #               - EfiUnusableMemory.          <BR>
+  #               - EfiPersistentMemory.        <BR>
+  #               - EfiACPIReclaimMemory.       <BR>
+  #    BIT1       - EfiReservedMemoryType.      <BR>
+  #    BIT2       - EfiACPIMemoryNVS.           <BR>
+  # @Prompt Set DXE memory protection policy.
+  # @ValidRange 0x80000002 | 0x00000000 - 0x00000007
+  gEfiMdeModulePkgTokenSpaceGuid.PcdDxeMemoryProtectionPolicy|0x0000007|UINT32|0x00001048
+
   ## PCI Serial Device Info. It is an array of Device, Function, and Power Management
   #  information that describes the path that contains zero or more PCI to PCI briges
   #  followed by a PCI serial device.  Each array entry is 4-bytes in length.  The
-- 
2.7.4