diff options
| author | Brijesh Singh <brijesh.singh@amd.com> | 2021-12-09 11:27:46 +0800 |
|---|---|---|
| committer | mergify[bot] <37929162+mergify[bot]@users.noreply.github.com> | 2021-12-09 06:28:10 +0000 |
| commit | 202fb22be6e9100c2ce6329f1b09f885dfdb514a (patch) | |
| tree | d937c25f4180dc8dedcc25d539df317a0051a620 /OvmfPkg/Sec | |
| parent | d39f8d88ecb31df46e2f95bcc5c20100d1f14681 (diff) | |
| download | edk2-202fb22be6e9100c2ce6329f1b09f885dfdb514a.tar.gz edk2-202fb22be6e9100c2ce6329f1b09f885dfdb514a.tar.bz2 edk2-202fb22be6e9100c2ce6329f1b09f885dfdb514a.zip | |
OvmfPkg/SecMain: validate the memory used for decompressing Fv
BZ: https://bugzilla.tianocore.org/show_bug.cgi?id=3275
The VMM launch sequence should have pre-validated all the data pages used
in the Reset vector. The range does not cover the data pages used during
the SEC phase (mainly PEI and DXE firmware volume decompression memory).
When SEV-SNP is active, the memory must be pre-validated before the access.
Add support to pre-validate the memory range from SnpSecPreValidatedStart
to SnpSecPreValidatedEnd. This should be sufficent to enter into the PEI
phase.
Cc: Michael Roth <michael.roth@amd.com>
Cc: James Bottomley <jejb@linux.ibm.com>
Cc: Min Xu <min.m.xu@intel.com>
Cc: Jiewen Yao <jiewen.yao@intel.com>
Cc: Tom Lendacky <thomas.lendacky@amd.com>
Cc: Jordan Justen <jordan.l.justen@intel.com>
Cc: Ard Biesheuvel <ardb+tianocore@kernel.org>
Cc: Erdem Aktas <erdemaktas@google.com>
Cc: Gerd Hoffmann <kraxel@redhat.com>
Acked-by: Jiewen Yao <Jiewen.yao@intel.com>
Acked-by: Gerd Hoffmann <kraxel@redhat.com>
Signed-off-by: Brijesh Singh <brijesh.singh@amd.com>
Diffstat (limited to 'OvmfPkg/Sec')
| -rw-r--r-- | OvmfPkg/Sec/AmdSev.c | 22 | ||||
| -rw-r--r-- | OvmfPkg/Sec/AmdSev.h | 23 | ||||
| -rw-r--r-- | OvmfPkg/Sec/SecMain.c | 5 | ||||
| -rw-r--r-- | OvmfPkg/Sec/SecMain.inf | 3 |
4 files changed, 52 insertions, 1 deletions
diff --git a/OvmfPkg/Sec/AmdSev.c b/OvmfPkg/Sec/AmdSev.c index aa655fd9cb..499d0c27d8 100644 --- a/OvmfPkg/Sec/AmdSev.c +++ b/OvmfPkg/Sec/AmdSev.c @@ -55,7 +55,6 @@ SevEsProtocolFailure ( @retval FALSE SEV-SNP is not enabled
**/
-STATIC
BOOLEAN
SevSnpIsEnabled (
VOID
@@ -281,3 +280,24 @@ SevEsIsEnabled ( return (SevEsWorkArea->SevEsEnabled != 0);
}
+
+/**
+ Validate System RAM used for decompressing the PEI and DXE firmware volumes
+ when SEV-SNP is active. The PCDs SecValidatedStart and SecValidatedEnd are
+ set in OvmfPkg/FvmainCompactScratchEnd.fdf.inc.
+
+**/
+VOID
+SecValidateSystemRam (
+ VOID
+ )
+{
+ PHYSICAL_ADDRESS Start, End;
+
+ if (IsSevGuest () && SevSnpIsEnabled ()) {
+ Start = (EFI_PHYSICAL_ADDRESS)(UINTN)PcdGet32 (PcdOvmfSecValidatedStart);
+ End = (EFI_PHYSICAL_ADDRESS)(UINTN)PcdGet32 (PcdOvmfSecValidatedEnd);
+
+ MemEncryptSevSnpPreValidateSystemRam (Start, EFI_SIZE_TO_PAGES ((UINTN)(End - Start)));
+ }
+}
diff --git a/OvmfPkg/Sec/AmdSev.h b/OvmfPkg/Sec/AmdSev.h index c0b1ca9618..dffd2ceb96 100644 --- a/OvmfPkg/Sec/AmdSev.h +++ b/OvmfPkg/Sec/AmdSev.h @@ -68,4 +68,27 @@ SevEsIsEnabled ( VOID
);
+/**
+ Validate System RAM used for decompressing the PEI and DXE firmware volumes
+ when SEV-SNP is active. The PCDs SecValidatedStart and SecValidatedEnd are
+ set in OvmfPkg/FvmainCompactScratchEnd.fdf.inc.
+
+**/
+VOID
+SecValidateSystemRam (
+ VOID
+ );
+
+/**
+ Determine if SEV-SNP is active.
+
+ @retval TRUE SEV-SNP is enabled
+ @retval FALSE SEV-SNP is not enabled
+
+**/
+BOOLEAN
+SevSnpIsEnabled (
+ VOID
+ );
+
#endif
diff --git a/OvmfPkg/Sec/SecMain.c b/OvmfPkg/Sec/SecMain.c index 58e3b923b4..2c5561661e 100644 --- a/OvmfPkg/Sec/SecMain.c +++ b/OvmfPkg/Sec/SecMain.c @@ -861,6 +861,11 @@ SecCoreStartupWithStack ( SecCoreData.BootFirmwareVolumeSize = (UINTN)BootFv->FvLength;
//
+ // Validate the System RAM used in the SEC Phase
+ //
+ SecValidateSystemRam ();
+
+ //
// Make sure the 8259 is masked before initializing the Debug Agent and the debug timer is enabled
//
IoWrite8 (0x21, 0xff);
diff --git a/OvmfPkg/Sec/SecMain.inf b/OvmfPkg/Sec/SecMain.inf index 41dcdba120..95cf0025e1 100644 --- a/OvmfPkg/Sec/SecMain.inf +++ b/OvmfPkg/Sec/SecMain.inf @@ -52,6 +52,7 @@ PeCoffExtraActionLib
ExtractGuidedSectionLib
LocalApicLib
+ MemEncryptSevLib
CpuExceptionHandlerLib
[Ppis]
@@ -74,6 +75,8 @@ gEfiMdeModulePkgTokenSpaceGuid.PcdInitValueInTempStack
gUefiOvmfPkgTokenSpaceGuid.PcdOvmfConfidentialComputingWorkAreaHeader
gUefiOvmfPkgTokenSpaceGuid.PcdOvmfWorkAreaBase
+ gUefiOvmfPkgTokenSpaceGuid.PcdOvmfSecValidatedStart
+ gUefiOvmfPkgTokenSpaceGuid.PcdOvmfSecValidatedEnd
[FeaturePcd]
gUefiOvmfPkgTokenSpaceGuid.PcdSmmSmramRequire
|