uefi-ref/edk2
1
0
Fork 0
mirror of https://github.com/tianocore/edk2 synced 2026-08-27 00:23:19 -04:00
Code Issues Projects Releases Packages Wiki Activity Actions

OvmfPkg/PlatformInitLib: add sanity checks to igvm code

Browse source 
With SEV or SEV-ES being active uninitialized memory is random cipher
text instead of being zero-initialized.  So checking against zero to
figure whenever igvm parameters are present or not is not sufficient.
Apply more strict sanity checks.

Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
This commit is contained in:
Gerd Hoffmann 2025-10-06 15:58:47 +02:00 • committed by mergify[bot]
parent ab04d09555
commit 0f0b472ae5
1 changed files with 24 additions and 0 deletions
Download patch file Download diff file Expand all files Collapse all files

24
OvmfPkg/Library/PlatformInitLib/Igvm.c
View file

@ -36,6 +36,8 @@ typedef struct IGVM_MEMORY_MAP_ENTRY {
UINT32 Reserved;
} IGVM_MEMORY_MAP_ENTRY;
STATIC BOOLEAN mIgvmParamsInvalid;
STATIC
IGVM_MEMORY_MAP_ENTRY *
EFIAPI
@ -46,6 +48,10 @@ PlatformIgvmMemoryMapFind (
UINT64 Address;
IGVM_MEMORY_MAP_ENTRY *Map;
if (mIgvmParamsInvalid) {
return NULL;
}
Address = FixedPcdGet64 (PcdOvmfIgvmParamBase);
if (Address == 0) {
// no parameter area
@ -58,6 +64,14 @@ PlatformIgvmMemoryMapFind (
return NULL;
}
if ((Map[0].EntryType & 0xfff0) ||
(Map[0].Reserved != 0))
{
DEBUG ((DEBUG_INFO, "%a: memory map sanity check failed, ignoring\n", __func__));
mIgvmParamsInvalid = TRUE;
return NULL;
}
return Map;
}
@ -193,6 +207,10 @@ PlatformIgvmVpCount (
UINT64 Address;
UINT32 *VpCount;
if (mIgvmParamsInvalid) {
return 0;
}
Address = FixedPcdGet64 (PcdOvmfIgvmParamBase);
if (Address == 0) {
// no parameter area
@ -205,6 +223,12 @@ PlatformIgvmVpCount (
return 0;
}
if (*VpCount & 0xffff0000) {
DEBUG ((DEBUG_INFO, "%a: vp-count sanity check failed, ignoring\n", __func__));
mIgvmParamsInvalid = TRUE;
return 0;
}
DEBUG ((DEBUG_INFO, "%a: vp-count=%d\n", __func__, *VpCount));
return *VpCount;
}