85b8eac59b
BZ: https://bugzilla.tianocore.org/show_bug.cgi?id=3108 When SEV-ES is active, and MMIO operation will trigger a #VC and the VmgExitLib exception handler will process this MMIO operation. A malicious hypervisor could try to extract information from encrypted memory by setting a reserved bit in the guests nested page tables for a non-MMIO area. This can result in the encrypted data being copied into the GHCB shared buffer area and accessed by the hypervisor. Prevent this by ensuring that the MMIO source/destination is un-encrypted memory. For the APIC register space, access is allowed in general. Cc: Jordan Justen <jordan.l.justen@intel.com> Cc: Laszlo Ersek <lersek@redhat.com> Cc: Ard Biesheuvel <ard.biesheuvel@arm.com> Cc: Brijesh Singh <brijesh.singh@amd.com> Acked-by: Laszlo Ersek <lersek@redhat.com> Signed-off-by: Tom Lendacky <thomas.lendacky@amd.com> Message-Id: <0cf28470ad5e694af45f7f0b35296628f819567d.1610045305.git.thomas.lendacky@amd.com>
58 lines
1.3 KiB
INI
58 lines
1.3 KiB
INI
## @file
|
|
# Library provides the helper functions for SEV guest
|
|
#
|
|
# Copyright (c) 2017 - 2020, Advanced Micro Devices. All rights reserved.<BR>
|
|
#
|
|
# SPDX-License-Identifier: BSD-2-Clause-Patent
|
|
#
|
|
#
|
|
##
|
|
|
|
[Defines]
|
|
INF_VERSION = 1.25
|
|
BASE_NAME = DxeMemEncryptSevLib
|
|
FILE_GUID = c1594631-3888-4be4-949f-9c630dbc842b
|
|
MODULE_TYPE = BASE
|
|
VERSION_STRING = 1.0
|
|
LIBRARY_CLASS = MemEncryptSevLib|DXE_CORE DXE_DRIVER DXE_RUNTIME_DRIVER DXE_SMM_DRIVER UEFI_DRIVER
|
|
|
|
#
|
|
# The following information is for reference only and not required by the build
|
|
# tools.
|
|
#
|
|
# VALID_ARCHITECTURES = IA32 X64
|
|
#
|
|
|
|
[Packages]
|
|
MdeModulePkg/MdeModulePkg.dec
|
|
MdePkg/MdePkg.dec
|
|
OvmfPkg/OvmfPkg.dec
|
|
UefiCpuPkg/UefiCpuPkg.dec
|
|
|
|
[Sources]
|
|
DxeMemEncryptSevLibInternal.c
|
|
PeiDxeMemEncryptSevLibInternal.c
|
|
|
|
[Sources.X64]
|
|
X64/MemEncryptSevLib.c
|
|
X64/PeiDxeVirtualMemory.c
|
|
X64/VirtualMemory.c
|
|
X64/VirtualMemory.h
|
|
|
|
[Sources.IA32]
|
|
Ia32/MemEncryptSevLib.c
|
|
|
|
[LibraryClasses]
|
|
BaseLib
|
|
CacheMaintenanceLib
|
|
CpuLib
|
|
DebugLib
|
|
MemoryAllocationLib
|
|
PcdLib
|
|
|
|
[FeaturePcd]
|
|
gUefiOvmfPkgTokenSpaceGuid.PcdSmmSmramRequire
|
|
|
|
[Pcd]
|
|
gEfiMdeModulePkgTokenSpaceGuid.PcdPteMemoryEncryptionAddressOrMask
|