From 1acd7c54a72418918d7aaa859884e72bd4933473 Mon Sep 17 00:00:00 2001 From: Ard Biesheuvel Date: Mon, 27 Feb 2017 14:10:59 +0000 Subject: [PATCH] ArmVirtPkg AARCH64: enable NX memory protection for all platforms This sets the recently introduced PCD PcdDxeNxMemoryProtectionPolicy to a value that protects all memory regions except code regions against inadvertent execution. Note that this does not [yet] protect EfiLoaderData regions, due to compatibility issues with shim and GRUB. Contributed-under: TianoCore Contribution Agreement 1.0 Signed-off-by: Ard Biesheuvel Reviewed-by: Jiewen Yao Reviewed-by: Laszlo Ersek Tested-by: Laszlo Ersek --- ArmVirtPkg/ArmVirt.dsc.inc | 7 +++++++ 1 file changed, 7 insertions(+) diff --git a/ArmVirtPkg/ArmVirt.dsc.inc b/ArmVirtPkg/ArmVirt.dsc.inc index 2b0a44e14d..a91b27f13c 100644 --- a/ArmVirtPkg/ArmVirt.dsc.inc +++ b/ArmVirtPkg/ArmVirt.dsc.inc @@ -383,6 +383,13 @@ # gEfiMdeModulePkgTokenSpaceGuid.PcdImageProtectionPolicy|0x3 + # + # Enable NX memory protection for all non-code regions, including OEM and OS + # reserved ones, with the exception of LoaderData regions, of which OS loaders + # (i.e., GRUB) may assume that its contents are executable. + # + gEfiMdeModulePkgTokenSpaceGuid.PcdDxeNxMemoryProtectionPolicy|0xC000000000007FD1 + [Components.common] # # Networking stack