]> git.proxmox.com Git - mirror_edk2.git/commit
OvmfPkg/SecMain: validate the memory used for decompressing Fv
authorBrijesh Singh <brijesh.singh@amd.com>
Thu, 9 Dec 2021 03:27:46 +0000 (11:27 +0800)
committermergify[bot] <37929162+mergify[bot]@users.noreply.github.com>
Thu, 9 Dec 2021 06:28:10 +0000 (06:28 +0000)
commit202fb22be6e9100c2ce6329f1b09f885dfdb514a
treed937c25f4180dc8dedcc25d539df317a0051a620
parentd39f8d88ecb31df46e2f95bcc5c20100d1f14681
OvmfPkg/SecMain: validate the memory used for decompressing Fv

BZ: https://bugzilla.tianocore.org/show_bug.cgi?id=3275

The VMM launch sequence should have pre-validated all the data pages used
in the Reset vector. The range does not cover the data pages used during
the SEC phase (mainly PEI and DXE firmware volume decompression memory).

When SEV-SNP is active, the memory must be pre-validated before the access.
Add support to pre-validate the memory range from SnpSecPreValidatedStart
to SnpSecPreValidatedEnd. This should be sufficent to enter into the PEI
phase.

Cc: Michael Roth <michael.roth@amd.com>
Cc: James Bottomley <jejb@linux.ibm.com>
Cc: Min Xu <min.m.xu@intel.com>
Cc: Jiewen Yao <jiewen.yao@intel.com>
Cc: Tom Lendacky <thomas.lendacky@amd.com>
Cc: Jordan Justen <jordan.l.justen@intel.com>
Cc: Ard Biesheuvel <ardb+tianocore@kernel.org>
Cc: Erdem Aktas <erdemaktas@google.com>
Cc: Gerd Hoffmann <kraxel@redhat.com>
Acked-by: Jiewen Yao <Jiewen.yao@intel.com>
Acked-by: Gerd Hoffmann <kraxel@redhat.com>
Signed-off-by: Brijesh Singh <brijesh.singh@amd.com>
OvmfPkg/FvmainCompactScratchEnd.fdf.inc
OvmfPkg/Library/BaseMemEncryptSevLib/PeiMemEncryptSevLib.inf
OvmfPkg/Library/BaseMemEncryptSevLib/X64/PeiSnpSystemRamValidate.c
OvmfPkg/OvmfPkg.dec
OvmfPkg/Sec/AmdSev.c
OvmfPkg/Sec/AmdSev.h
OvmfPkg/Sec/SecMain.c
OvmfPkg/Sec/SecMain.inf