]> git.proxmox.com Git - mirror_edk2.git/commit
OvmfPkg/AmdSev/SecretDxe: Allocate secret location as EfiACPIReclaimMemory
authorDov Murik <dovmurik@linux.ibm.com>
Thu, 15 Dec 2022 13:11:51 +0000 (13:11 +0000)
committermergify[bot] <37929162+mergify[bot]@users.noreply.github.com>
Thu, 15 Dec 2022 13:49:49 +0000 (13:49 +0000)
commit0adc35fccd59c8c5171273319ec899aa48fc2c35
treef4f7ddaff34095e8e6cfa555ca9a968e9d744c0b
parent3e3f5bb21c0a2c1368c43713cf7f4b51097259af
OvmfPkg/AmdSev/SecretDxe: Allocate secret location as EfiACPIReclaimMemory

BZ: https://bugzilla.tianocore.org/show_bug.cgi?id=4186

Commit 079a58276b98 ("OvmfPkg/AmdSev/SecretPei: Mark SEV launch secret
area as reserved") marked the launch secret area itself (1 page) as
reserved so the guest OS can use it during the lifetime of the OS.
However, the address and size of the secret area held in the
CONFIDENTIAL_COMPUTING_SECRET_LOCATION struct are declared as STATIC in
OVMF (in AmdSev/SecretDxe); therefore there's no guarantee that it will
not be written over by OS data.

Fix this by allocating the memory for the
CONFIDENTIAL_COMPUTING_SECRET_LOCATION struct with the
EfiACPIReclaimMemory memory type to ensure the guest OS will not reuse
this memory.

Fixes: 079a58276b98 ("OvmfPkg/AmdSev/SecretPei: Mark SEV launch secret ...")
Signed-off-by: Dov Murik <dovmurik@linux.ibm.com>
Reviewed-by: Tom Lendacky <thomas.lendacky@amd.com>
Reviewed-by: Ard Biesheuvel <ardb@kernel.org>
OvmfPkg/AmdSev/SecretDxe/SecretDxe.c