On 3 July 2018 at 23:46, Borislav Petkov <bp@xxxxxxx> wrote: > On Tue, Jul 03, 2018 at 04:16:57PM -0500, Brijesh Singh wrote: >> I agree with Ard, it may be good idea to extend the UEFI spec to >> include encryption information. Having this information may be helpful >> in some cases, e.g if we ever need to map a specific non IO memory as >> unencrypted. So far we have not seen the need for it. But I will ask AMD >> folks working closely with UEFI committee to float this and submit it as >> enhancement in Tianocore BZ. > > Except that if the IO memory handling unencrypted changes in future > incarnations, the changes to the spec become moot. I'm just saying... > Quite the opposite. If we allocate a EFI_MEMORY_xx bit to signify that a region should be mapped as encrypted, we no longer have to reason about these things in the kernel but we can simply apply the attributes that the UEFI memory map provides us. A platform could then describe both encrypted and unencrypted MMIO regions at will.
