From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from mail-wr0-x22c.google.com (mail-wr0-x22c.google.com [IPv6:2a00:1450:400c:c0c::22c]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ml01.01.org (Postfix) with ESMTPS id 8CAD781F56 for ; Mon, 27 Feb 2017 06:38:35 -0800 (PST) Received: by mail-wr0-x22c.google.com with SMTP id g10so53551598wrg.2 for ; Mon, 27 Feb 2017 06:38:35 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=linaro.org; s=google; h=from:to:cc:subject:date:message-id:in-reply-to:references; bh=2jC2rfxhmHu8dd9AtYRX9an6k0vebHHCCsQsTZhB190=; b=ZGuiD0dje9CGUEZXUhivFgADlr8pbuYiiQxngvHPKBFOCJtVRlYVDhaHfq3DJ5RCKl YT9Z/K4bX52PGZgBe2gfZw5SjcFrKGWe+5EfbernNqs7Wun6jEJ624ppNJmxF5hTb+5F WvtnQCbuTL5fAhcrAD+Yi+raCAUWo8eYGiXTI= X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:from:to:cc:subject:date:message-id:in-reply-to :references; bh=2jC2rfxhmHu8dd9AtYRX9an6k0vebHHCCsQsTZhB190=; b=nr1T3BgIiN+HUnsINHu6YTTGPR9feTGzITcbT7GScSBOQtJcz8FfkbJEwLoAmYugKt en66EZEy7p24IoDopNIB2EkX/3EyFpqCuw0F/pWj2SdQ2hJ+XJXz5WmXmPxvq0Z7+bSN CP87q7BvBsPJ7BN59VHqcqREkptNRl30Ihi1zAeZ1qAh+OudwNcAUX+MT8AS3SwWlBqG +S4Ir0bOHHu0lGFWpsyfVogdjy/gC0A1sJ/hixOQHkC5Own3Z4b3M6z/VAOk1DLbsRzo nxnV0d9Gy7LS+Lc16UWevlUri/HMrui5urkPiNYzstf44N2LGFLuJMS6hVrF6LaRTbt9 BITA== X-Gm-Message-State: AMke39mjcCmks5z7DuqbXyQuCEvB6jqAxCKq0nsA/DpDn3APF4dbr2zvDzYAvvnUyE49EBx5 X-Received: by 10.223.182.133 with SMTP id j5mr5595549wre.19.1488206314063; Mon, 27 Feb 2017 06:38:34 -0800 (PST) Received: from localhost.localdomain ([105.149.201.216]) by smtp.gmail.com with ESMTPSA id z134sm14475167wmc.20.2017.02.27.06.38.31 (version=TLS1_2 cipher=ECDHE-RSA-AES128-SHA bits=128/128); Mon, 27 Feb 2017 06:38:33 -0800 (PST) From: Ard Biesheuvel To: edk2-devel@lists.01.org, afish@apple.com, leif.lindholm@linaro.org, michael.d.kinney@intel.com, liming.gao@intel.com, jiewen.yao@intel.com Cc: lersek@redhat.com, feng.tian@intel.com, star.zeng@intel.com, Ard Biesheuvel Date: Mon, 27 Feb 2017 14:38:09 +0000 Message-Id: <1488206291-25768-6-git-send-email-ard.biesheuvel@linaro.org> X-Mailer: git-send-email 2.7.4 In-Reply-To: <1488206291-25768-1-git-send-email-ard.biesheuvel@linaro.org> References: <1488206291-25768-1-git-send-email-ard.biesheuvel@linaro.org> Subject: [PATCH v4 5/7] MdeModulePkg: define PCD for DXE memory protection policy X-BeenThere: edk2-devel@lists.01.org X-Mailman-Version: 2.1.21 Precedence: list List-Id: EDK II Development List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 27 Feb 2017 14:38:36 -0000 Define a new fixed/patchable PCD that sets the DXE memory protection policy: its primary use is to define which memory types should have their executable permissions removed. Combined with the image protection policy, this can be used to implement a strict W^X policy, i.e.. a policy where no regions exist that are both executable and writable at the same time. Contributed-under: TianoCore Contribution Agreement 1.0 Signed-off-by: Ard Biesheuvel --- MdeModulePkg/MdeModulePkg.dec | 32 ++++++++++++++++++++ 1 file changed, 32 insertions(+) diff --git a/MdeModulePkg/MdeModulePkg.dec b/MdeModulePkg/MdeModulePkg.dec index 426634fbbd4d..10f460818915 100644 --- a/MdeModulePkg/MdeModulePkg.dec +++ b/MdeModulePkg/MdeModulePkg.dec @@ -1107,6 +1107,38 @@ [PcdsFixedAtBuild, PcdsPatchableInModule] # @ValidRange 0x80000002 | 0x00000000 - 0x0000001F gEfiMdeModulePkgTokenSpaceGuid.PcdImageProtectionPolicy|0x00000002|UINT32|0x00001047 + ## Set DXE memory protection policy. The policy is bitwise. + # If a bit is set, memory regions of the associated type will be mapped + # non-executable.

+ # + # Below is bit mask for this PCD: (Order is same as UEFI spec)
+ # EfiReservedMemoryType 0x0001
+ # EfiLoaderCode 0x0002
+ # EfiLoaderData 0x0004
+ # EfiBootServicesCode 0x0008
+ # EfiBootServicesData 0x0010
+ # EfiRuntimeServicesCode 0x0020
+ # EfiRuntimeServicesData 0x0040
+ # EfiConventionalMemory 0x0080
+ # EfiUnusableMemory 0x0100
+ # EfiACPIReclaimMemory 0x0200
+ # EfiACPIMemoryNVS 0x0400
+ # EfiMemoryMappedIO 0x0800
+ # EfiMemoryMappedIOPortSpace 0x1000
+ # EfiPalCode 0x2000
+ # EfiPersistentMemory 0x4000
+ # OEM Reserved 0x4000000000000000
+ # OS Reserved 0x8000000000000000
+ # + # NOTE: User must NOT set NX protection for EfiLoaderCode / EfiBootServicesCode / EfiRuntimeServicesCode.
+ # User MUST set the same NX protection for EfiBootServicesData and EfiConventionalMemory.
+ # + # e.g. 0x7FD5 can be used for all memory except Code.
+ # e.g. 0x7BD4 can be used for all memory except Code and ACPINVS/Reserved.
+ # + # @Prompt Set DXE memory protection policy. + gEfiMdeModulePkgTokenSpaceGuid.PcdDxeNxMemoryProtectionPolicy|0x0000000|UINT64|0x00001048 + ## PCI Serial Device Info. It is an array of Device, Function, and Power Management # information that describes the path that contains zero or more PCI to PCI briges # followed by a PCI serial device. Each array entry is 4-bytes in length. The -- 2.7.4