tyler.durden/audk
1
0
Fork 0
mirror of https://github.com/acidanthera/audk.git synced 2025-07-27 07:34:06 +02:00
Code Issues Packages Projects Releases Wiki Activity

OvmfPkg/IoMmuDxe: zero out pages before releasing them

Browse Source 
Whenever we release the plaintext bounce buffer pages that were allocated
implicitly in Map() for BusMasterRead[64] and BusMasterWrite[64], we
restore the encryption mask on them. However, we should also rewrite the
area (fill it with zeros) so that the hypervisor is not left with a
plaintext view of the earlier data.

Similarly, whenever we release the plaintext common buffer pages that were
allocated explicitly in AllocateBuffer() for BusMasterCommonBuffer[64], we
restore the encryption mask on them.  However, we should also rewrite the
area (fill it with zeros) so that the hypervisor is not left with a
plaintext view of the earlier data.

Cc: Ard Biesheuvel <ard.biesheuvel@linaro.org>
Cc: Brijesh Singh <brijesh.singh@amd.com>
Cc: Jordan Justen <jordan.l.justen@intel.com>
Cc: Tom Lendacky <thomas.lendacky@amd.com>
Contributed-under: TianoCore Contribution Agreement 1.0
Signed-off-by: Laszlo Ersek <lersek@redhat.com>
Tested-by: Brijesh Singh <brijesh.singh@amd.com>
Reviewed-by: Brijesh Singh <brijesh.singh@amd.com>
This commit is contained in:
Laszlo Ersek 2017-08-02 11:53:53 +02:00
parent db7ea4d7c4
commit bc1c2e49ac
1 changed files with 5 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

5
OvmfPkg/IoMmuDxe/AmdSevIoMmu.c
View File

@ -280,6 +280,10 @@ IoMmuUnmap (
TRUE TRUE
); );
ASSERT_EFI_ERROR(Status); ASSERT_EFI_ERROR(Status);
ZeroMem (
(VOID*)(UINTN)MapInfo->PlainTextAddress,
EFI_PAGES_TO_SIZE (MapInfo->NumberOfPages)
);
// //
// Free the mapped buffer and the MAP_INFO structure. // Free the mapped buffer and the MAP_INFO structure.
@ -414,6 +418,7 @@ IoMmuFreeBuffer (
TRUE TRUE
); );
ASSERT_EFI_ERROR(Status); ASSERT_EFI_ERROR(Status);
ZeroMem (HostAddress, EFI_PAGES_TO_SIZE (Pages));
DEBUG (( DEBUG ((
DEBUG_VERBOSE, DEBUG_VERBOSE,