tree decb64beeaa7b3ffe7e2bb399d916f5bfa4e3767
parent d49fa3defa50c6d3f04acbb52fd486c13c14ab6a
author Heinrich Schuchardt <heinrich.schuchardt@canonical.com> 1707943401 +0100
committer Heinrich Schuchardt <heinrich.schuchardt@canonical.com> 1709127466 +0100

efi_loader: set IMAGE_DLLCHARACTERISTICS_NX_COMPAT

The IMAGE_DLLCHARACTERISTICS_NX_COMPAT flag marks an EFI binary where
the following conditions are met [1]:

* Executable and writable sections are separated.
* The application does not run self-modifying code.
* The application uses the EFI_MEMORY_ATTRIBUTE_PROTOCOL when loading
  executable code.
* The application does not assume that all memory ranges are usable.
* The stack is not expected to be executable.

The only EFI binaries U-Boot provides that do not fulfill these
requirements are the EFI app and the EFI payload.

Once we have implemented separation of writable and executable memory in
U-Boot we can use the IMAGE_DLLCHARACTERISTICS_NX_COMPAT flag to decide
if we will load an EFI binary.

[1] New UEFI CA memory mitigation requirements for signing
    https://techcommunity.microsoft.com/t5/hardware-dev-center/new-uefi-ca-memory-mitigation-requirements-for-signing/ba-p/3608714

Signed-off-by: Heinrich Schuchardt <heinrich.schuchardt@canonical.com>