Policy Control
Stack Guard: Detect Stack Overflow
gEfiMdeModulePkgTokenSpaceGuid.PcdCpuStackGuard
## Indicates if UEFI Stack Guard will be enabled.
# If enabled, stack overflow in UEFI can be caught, preventing chaotic consequences.<BR><BR>
# TRUE - UEFI Stack Guard will be enabled.<BR>
# FALSE - UEFI Stack Guard will be disabled.<BR>
gUefiCpuPkgTokenSpaceGuid.PcdCpuSmmStackGuard
## Indicates if SMM Stack Guard will be enabled.
# If enabled, stack overflow in SMM can be caught, preventing chaotic consequences.<BR><BR>
# TRUE - SMM Stack Guard will be enabled.<BR>
# FALSE - SMM Stack Guard will be disabled.<BR>NULL pointer detection: Detect NULL pointer access
gEfiMdeModulePkgTokenSpaceGuid.PcdNullPointerDetectionPropertyMask
## Mask to control the NULL address detection in code for different phases.
# If enabled, accessing NULL address in UEFI or SMM code can be caught.<BR><BR>
# BIT0 - Enable NULL pointer detection for UEFI.<BR>
# BIT1 - Enable NULL pointer detection for SMM.<BR>
# BIT2..6 - Reserved for future uses.<BR>
# BIT7 - Disable NULL pointer detection just after EndOfDxe. <BR>
# This is a workaround for those unsolvable NULL access issues in
# OptionROM, boot loader, etc. It can also help to avoid unnecessary
# exception caused by legacy memory (0-4095) access after EndOfDxe,
# such as Windows 7 boot on Qemu.<BR>Heap Guard: Detect Heap Overflow.
gEfiMdeModulePkgTokenSpaceGuid.PcdHeapGuardPageType
## Indicates which type allocation need guard page.
#
# If a bit is set, a head guard page and a tail guard page will be added just
# before and after corresponding type of pages allocated if there's enough
# free pages for all of them. The page allocation for the type related to
# cleared bits keeps the same as ususal.
#
# Below is bit mask for this PCD: (Order is same as UEFI spec)<BR>
# EfiReservedMemoryType 0x0000000000000001<BR>
# EfiLoaderCode 0x0000000000000002<BR>
# EfiLoaderData 0x0000000000000004<BR>
# EfiBootServicesCode 0x0000000000000008<BR>
# EfiBootServicesData 0x0000000000000010<BR>
# EfiRuntimeServicesCode 0x0000000000000020<BR>
# EfiRuntimeServicesData 0x0000000000000040<BR>
# EfiConventionalMemory 0x0000000000000080<BR>
# EfiUnusableMemory 0x0000000000000100<BR>
# EfiACPIReclaimMemory 0x0000000000000200<BR>
# EfiACPIMemoryNVS 0x0000000000000400<BR>
# EfiMemoryMappedIO 0x0000000000000800<BR>
# EfiMemoryMappedIOPortSpace 0x0000000000001000<BR>
# EfiPalCode 0x0000000000002000<BR>
# EfiPersistentMemory 0x0000000000004000<BR>
# OEM Reserved 0x4000000000000000<BR>
# OS Reserved 0x8000000000000000<BR>
# e.g. LoaderCode+LoaderData+BootServicesCode+BootServicesData are needed, 0x1E should be used.<BR>gEfiMdeModulePkgTokenSpaceGuid.PcdHeapGuardPoolType
## Indicates which type allocation need guard page.
#
# If a bit is set, a head guard page and a tail guard page will be added just
# before and after corresponding type of pages which the allocated pool occupies,
# if there's enough free memory for all of them. The pool allocation for the
# type related to cleared bits keeps the same as ususal.
#
# Below is bit mask for this PCD: (Order is same as UEFI spec)<BR>
# EfiReservedMemoryType 0x0000000000000001<BR>
# EfiLoaderCode 0x0000000000000002<BR>
# EfiLoaderData 0x0000000000000004<BR>
# EfiBootServicesCode 0x0000000000000008<BR>
# EfiBootServicesData 0x0000000000000010<BR>
# EfiRuntimeServicesCode 0x0000000000000020<BR>
# EfiRuntimeServicesData 0x0000000000000040<BR>
# EfiConventionalMemory 0x0000000000000080<BR>
# EfiUnusableMemory 0x0000000000000100<BR>
# EfiACPIReclaimMemory 0x0000000000000200<BR>
# EfiACPIMemoryNVS 0x0000000000000400<BR>
# EfiMemoryMappedIO 0x0000000000000800<BR>
# EfiMemoryMappedIOPortSpace 0x0000000000001000<BR>
# EfiPalCode 0x0000000000002000<BR>
# EfiPersistentMemory 0x0000000000004000<BR>
# OEM Reserved 0x4000000000000000<BR>
# OS Reserved 0x8000000000000000<BR>
# e.g. LoaderCode+LoaderData+BootServicesCode+BootServicesData are needed, 0x1E should be used.<BR>
gEfiMdeModulePkgTokenSpaceGuid.PcdHeapGuardPropertyMask
## This mask is to control Heap Guard behavior.
# Note that due to the limit of pool memory implementation and the alignment
# requirement of UEFI spec, BIT7 is a try-best setting which cannot guarantee
# that the returned pool is exactly adjacent to head guard page or tail guard
# page.
# BIT0 - Enable UEFI page guard.<BR>
# BIT1 - Enable UEFI pool guard.<BR>
# BIT2 - Enable SMM page guard.<BR>
# BIT3 - Enable SMM pool guard.<BR>
# BIT7 - The direction of Guard Page for Pool Guard.
# 0 - The returned pool is near the tail guard page.<BR>
# 1 - The returned pool is near the head guard page.<BR>Memory Profile: Provide memory usage information, detect memory leak
gEfiMdeModulePkgTokenSpaceGuid.PcdMemoryProfilePropertyMask
## The mask is used to control memory profile behavior.<BR><BR>
# BIT0 - Enable UEFI memory profile.<BR>
# BIT1 - Enable SMRAM profile.<BR>
# BIT7 - Disable recording at the start.<BR>
gEfiMdeModulePkgTokenSpaceGuid.PcdMemoryProfileMemoryType
## This flag is to control which memory types of alloc info will be recorded by DxeCore & SmmCore.<BR><BR>
# For SmmCore, only EfiRuntimeServicesCode and EfiRuntimeServicesData are valid.<BR>
#
# Below is bit mask for this PCD: (Order is same as UEFI spec)<BR>
# EfiReservedMemoryType 0x0001<BR>
# EfiLoaderCode 0x0002<BR>
# EfiLoaderData 0x0004<BR>
# EfiBootServicesCode 0x0008<BR>
# EfiBootServicesData 0x0010<BR>
# EfiRuntimeServicesCode 0x0020<BR>
# EfiRuntimeServicesData 0x0040<BR>
# EfiConventionalMemory 0x0080<BR>
# EfiUnusableMemory 0x0100<BR>
# EfiACPIReclaimMemory 0x0200<BR>
# EfiACPIMemoryNVS 0x0400<BR>
# EfiMemoryMappedIO 0x0800<BR>
# EfiMemoryMappedIOPortSpace 0x1000<BR>
# EfiPalCode 0x2000<BR>
# EfiPersistentMemory 0x4000<BR>
# OEM Reserved 0x4000000000000000<BR>
# OS Reserved 0x8000000000000000<BR>
#
# e.g. Reserved+ACPINvs+ACPIReclaim+RuntimeCode+RuntimeData are needed, 0x661 should be used.<BR>
gEfiMdeModulePkgTokenSpaceGuid.PcdMemoryProfileDriverPath
## This PCD is to control which drivers need memory profile data.<BR><BR>
# For example:<BR>
# One image only (Shell):<BR>
# Header GUID<BR>
# {0x04, 0x06, 0x14, 0x00, 0x83, 0xA5, 0x04, 0x7C, 0x3E, 0x9E, 0x1C, 0x4F, 0xAD, 0x65, 0xE0, 0x52, 0x68, 0xD0, 0xB4, 0xD1,<BR>
# 0x7F, 0xFF, 0x04, 0x00}<BR>
# Two or more images (Shell + WinNtSimpleFileSystem):<BR>
# {0x04, 0x06, 0x14, 0x00, 0x83, 0xA5, 0x04, 0x7C, 0x3E, 0x9E, 0x1C, 0x4F, 0xAD, 0x65, 0xE0, 0x52, 0x68, 0xD0, 0xB4, 0xD1,<BR>
# 0x7F, 0x01, 0x04, 0x00,<BR>
# 0x04, 0x06, 0x14, 0x00, 0x8B, 0xE1, 0x25, 0x9C, 0xBA, 0x76, 0xDA, 0x43, 0xA1, 0x32, 0xDB, 0xB0, 0x99, 0x7C, 0xEF, 0xEF,<BR>
# 0x7F, 0xFF, 0x04, 0x00}<BR>NX stack: Prevent code execution in stack
gEfiMdeModulePkgTokenSpaceGuid.PcdSetNxForStack
## Indicates if to set NX for stack.<BR><BR>
# For the DxeIpl and the DxeCore are both X64, set NX for stack feature also require PcdDxeIplBuildPageTables be TRUE.<BR>
# For the DxeIpl and the DxeCore are both IA32 (PcdDxeIplSwitchToLongMode is FALSE), set NX for stack feature also require
# IA32 PAE is supported and Execute Disable Bit is available.<BR>
# TRUE - to set NX for stack.<BR>
# FALSE - Not to set NX for stack.<BR>DXE NX/RO Protection: Prevent code injection
gEfiMdeModulePkgTokenSpaceGuid.PcdDxeNxMemoryProtectionPolicy
## Set DXE memory protection policy. The policy is bitwise.
# If a bit is set, memory regions of the associated type will be mapped
# non-executable.<BR><BR>
#
# Below is bit mask for this PCD: (Order is same as UEFI spec)<BR>
# EfiReservedMemoryType 0x0001<BR>
# EfiLoaderCode 0x0002<BR>
# EfiLoaderData 0x0004<BR>
# EfiBootServicesCode 0x0008<BR>
# EfiBootServicesData 0x0010<BR>
# EfiRuntimeServicesCode 0x0020<BR>
# EfiRuntimeServicesData 0x0040<BR>
# EfiConventionalMemory 0x0080<BR>
# EfiUnusableMemory 0x0100<BR>
# EfiACPIReclaimMemory 0x0200<BR>
# EfiACPIMemoryNVS 0x0400<BR>
# EfiMemoryMappedIO 0x0800<BR>
# EfiMemoryMappedIOPortSpace 0x1000<BR>
# EfiPalCode 0x2000<BR>
# EfiPersistentMemory 0x4000<BR>
# OEM Reserved 0x4000000000000000<BR>
# OS Reserved 0x8000000000000000<BR>
#
# NOTE: User must NOT set NX protection for EfiLoaderCode / EfiBootServicesCode / EfiRuntimeServicesCode. <BR>
# User MUST set the same NX protection for EfiBootServicesData and EfiConventionalMemory. <BR>
#
# e.g. 0x7FD5 can be used for all memory except Code. <BR>
# e.g. 0x7BD4 can be used for all memory except Code and ACPINVS/Reserved. <BR>DXE image Protection: Prevent code injection
gEfiMdeModulePkgTokenSpaceGuid.PcdImageProtectionPolicy
## Set image protection policy. The policy is bitwise.
# If a bit is set, the image will be protected by DxeCore if it is aligned.
# The code section becomes read-only, and the data section becomes non-executable.
# If a bit is clear, the image will not be protected.<BR><BR>
# BIT0 - Image from unknown device. <BR>
# BIT1 - Image from firmware volume.<BR>System Management Mode (SMM) static paging: Provide code injection in SMM
gUefiCpuPkgTokenSpaceGuid.PcdCpuSmmStaticPageTable
## Indicates if SMM uses static page table.
# If enabled, SMM will not use on-demand paging. SMM will build static page table for all memory.
# This flag only impacts X64 build, because SMM always builds static page table for IA32.
# It could not be enabled at the same time with SMM profile feature (PcdCpuSmmProfileEnable).
# It could not be enabled also at the same time with heap guard feature for SMM
# (PcdHeapGuardPropertyMask in MdeModulePkg).<BR><BR>
# TRUE - SMM uses static page table for all memory.<BR>
# FALSE - SMM uses static page table for below 4G memory and use on-demand paging for above 4G memory.<BR>System Management Mode Interrupt (SMI) Handler Profile: Provide SMI handler information
gEfiMdeModulePkgTokenSpaceGuid.PcdSmiHandlerProfilePropertyMask
## The mask is used to control SmiHandlerProfile behavior.<BR><BR>
# BIT0 - Enable SmiHandlerProfile.<BR>SMM Profile: Provide non-SMRAM access in SMM
gUefiCpuPkgTokenSpaceGuid.PcdCpuSmmProfileEnable
## Indicates if SMM Profile will be enabled.Last updated