X-Git-Url: https://git.proxmox.com/?a=blobdiff_plain;f=OvmfPkg%2FPlatformPei%2FFv.c;h=248c58508558a2741848073776a8db3d4a17193e;hb=23bfb5c0aab6bda348ac03e160d4a8432031fac1;hp=3ed775c850832f472df524cf8f0522662ec5dae5;hpb=74e5c15842b75be9e7d2057ac0345cbf524b2234;p=mirror_edk2.git

diff --git a/OvmfPkg/PlatformPei/Fv.c b/OvmfPkg/PlatformPei/Fv.c
index 3ed775c850..248c585085 100644
--- a/OvmfPkg/PlatformPei/Fv.c
+++ b/OvmfPkg/PlatformPei/Fv.c
@@ -32,6 +32,8 @@ PeiFvInitialization (
   VOID
   )
 {
+  BOOLEAN SecureS3Needed;
+
   DEBUG ((EFI_D_INFO, "Platform PEI Firmware Volume Initialization\n"));
 
   //
@@ -50,15 +52,38 @@ PeiFvInitialization (
   //
   BuildFvHob (PcdGet32 (PcdOvmfDxeMemFvBase), PcdGet32 (PcdOvmfDxeMemFvSize));
 
+  SecureS3Needed = mS3Supported && FeaturePcdGet (PcdSmmSmramRequire);
+
   //
   // Create a memory allocation HOB for the DXE FV.
   //
+  // If "secure" S3 is needed, then SEC will decompress both PEI and DXE
+  // firmware volumes at S3 resume too, hence we need to keep away the OS from
+  // DXEFV as well. Otherwise we only need to keep away DXE itself from the
+  // DXEFV area.
+  //
   BuildMemoryAllocationHob (
     PcdGet32 (PcdOvmfDxeMemFvBase),
     PcdGet32 (PcdOvmfDxeMemFvSize),
-    EfiBootServicesData
+    SecureS3Needed ? EfiACPIMemoryNVS : EfiBootServicesData
     );
 
+  //
+  // Additionally, said decompression will use temporary memory above the end
+  // of DXEFV, so let's keep away the OS from there too.
+  //
+  if (SecureS3Needed) {
+    UINT32 DxeMemFvEnd;
+
+    DxeMemFvEnd = PcdGet32 (PcdOvmfDxeMemFvBase) +
+                  PcdGet32 (PcdOvmfDxeMemFvSize);
+    BuildMemoryAllocationHob (
+      DxeMemFvEnd,
+      PcdGet32 (PcdOvmfDecompressionScratchEnd) - DxeMemFvEnd,
+      EfiACPIMemoryNVS
+      );
+  }
+
   //
   // Let PEI know about the DXE FV so it can find the DXE Core
   //