Platforms/AMD/Styx: map the DXE stack as non-executable
Map the DXE stack as non-executable, to prevent stack buffer overflows
from being exploitable.
Contributed-under: TianoCore Contribution Agreement 1.0
Signed-off-by: Ard Biesheuvel <ard.biesheuvel@linaro.org>
Reviewed-by: Leif Lindholm <leif.lindholm@linaro.org>
diff --git a/Platforms/AMD/Styx/CelloBoard/CelloBoard.dsc b/Platforms/AMD/Styx/CelloBoard/CelloBoard.dsc
index 2606a0b..d7e1a53 100644
--- a/Platforms/AMD/Styx/CelloBoard/CelloBoard.dsc
+++ b/Platforms/AMD/Styx/CelloBoard/CelloBoard.dsc
@@ -440,6 +440,9 @@
gAmdModulePkgTokenSpaceGuid.PcdSataSerdesBase|0xE1200000
gAmdModulePkgTokenSpaceGuid.PcdSataSerdesOffset|0x00010000
+ # map the stack as non-executable when entering the DXE phase
+ gEfiMdeModulePkgTokenSpaceGuid.PcdSetNxForStack|TRUE
+
[PcdsPatchableInModule]
# PCIe Configuration: x4x2x2
gAmdModulePkgTokenSpaceGuid.PcdPcieCoreConfiguration|2
diff --git a/Platforms/AMD/Styx/Overdrive1000Board/Overdrive1000Board.dsc b/Platforms/AMD/Styx/Overdrive1000Board/Overdrive1000Board.dsc
index 4f90f94..60ceb71 100644
--- a/Platforms/AMD/Styx/Overdrive1000Board/Overdrive1000Board.dsc
+++ b/Platforms/AMD/Styx/Overdrive1000Board/Overdrive1000Board.dsc
@@ -457,6 +457,9 @@
gAmdModulePkgTokenSpaceGuid.PcdSataSerdesBase|0xE1200000
gAmdModulePkgTokenSpaceGuid.PcdSataSerdesOffset|0x00010000
+ # map the stack as non-executable when entering the DXE phase
+ gEfiMdeModulePkgTokenSpaceGuid.PcdSetNxForStack|TRUE
+
[PcdsPatchableInModule]
# PCIe Configuration: x4x2x2 (=2 See Include/FDKGionb.h)
gAmdModulePkgTokenSpaceGuid.PcdPcieCoreConfiguration|2
diff --git a/Platforms/AMD/Styx/OverdriveBoard/OverdriveBoard.dsc b/Platforms/AMD/Styx/OverdriveBoard/OverdriveBoard.dsc
index c7bf241..a236836 100644
--- a/Platforms/AMD/Styx/OverdriveBoard/OverdriveBoard.dsc
+++ b/Platforms/AMD/Styx/OverdriveBoard/OverdriveBoard.dsc
@@ -459,6 +459,9 @@
gAmdModulePkgTokenSpaceGuid.PcdSataSerdesBase|0xE1200000
gAmdModulePkgTokenSpaceGuid.PcdSataSerdesOffset|0x00010000
+ # map the stack as non-executable when entering the DXE phase
+ gEfiMdeModulePkgTokenSpaceGuid.PcdSetNxForStack|TRUE
+
!if $(DO_XGBE)
gAmdModulePkgTokenSpaceGuid.PcdXgbeEnable|TRUE
