OvmfPkg/SmmCpuFeaturesLib: SEV: encrypt+free pages of init. save state map

[mirror_edk2.git] / OvmfPkg / Library / SmmCpuFeaturesLib / SmmCpuFeaturesLib.c

diff --git a/OvmfPkg/Library/SmmCpuFeaturesLib/SmmCpuFeaturesLib.c b/OvmfPkg/Library/SmmCpuFeaturesLib/SmmCpuFeaturesLib.c
index 6b9924e494262a5886778c0ceda3d7a48a472876..59c319e01bfbc6440470fbfff093aec6b27c300c 100644 (file)
--- a/OvmfPkg/Library/SmmCpuFeaturesLib/SmmCpuFeaturesLib.c
+++ b/OvmfPkg/Library/SmmCpuFeaturesLib/SmmCpuFeaturesLib.c
@@ -12,14 +12,14 @@
   WARRANTIES OR REPRESENTATIONS OF ANY KIND, EITHER EXPRESS OR IMPLIED.\r
 **/\r
 \r
-#include <PiSmm.h>\r
-#include <Library/SmmCpuFeaturesLib.h>\r
 #include <Library/BaseLib.h>\r
 #include <Library/BaseMemoryLib.h>\r
-#include <Library/PcdLib.h>\r
-#include <Library/MemoryAllocationLib.h>\r
-#include <Library/SmmServicesTableLib.h>\r
 #include <Library/DebugLib.h>\r
+#include <Library/MemEncryptSevLib.h>\r
+#include <Library/SmmCpuFeaturesLib.h>\r
+#include <Library/SmmServicesTableLib.h>\r
+#include <Library/UefiBootServicesTableLib.h>\r
+#include <PiSmm.h>\r
 #include <Register/QemuSmramSaveStateMap.h>\r
 \r
 //\r
@@ -187,6 +187,42 @@ SmmCpuFeaturesSmmRelocationComplete (
   VOID\r
   )\r
 {\r
+  EFI_STATUS Status;\r
+  UINTN      MapPagesBase;\r
+  UINTN      MapPagesCount;\r
+\r
+  if (!MemEncryptSevIsEnabled ()) {\r
+    return;\r
+  }\r
+\r
+  //\r
+  // Now that SMBASE relocation is complete, re-encrypt the original SMRAM save\r
+  // state map's container pages, and release the pages to DXE. (The pages were\r
+  // allocated in PlatformPei.)\r
+  //\r
+  Status = MemEncryptSevLocateInitialSmramSaveStateMapPages (\r
+             &MapPagesBase,\r
+             &MapPagesCount\r
+             );\r
+  ASSERT_EFI_ERROR (Status);\r
+\r
+  Status = MemEncryptSevSetPageEncMask (\r
+             0,             // Cr3BaseAddress -- use current CR3\r
+             MapPagesBase,  // BaseAddress\r
+             MapPagesCount, // NumPages\r
+             TRUE           // Flush\r
+             );\r
+  if (EFI_ERROR (Status)) {\r
+    DEBUG ((DEBUG_ERROR, "%a: MemEncryptSevSetPageEncMask(): %r\n",\r
+      __FUNCTION__, Status));\r
+    ASSERT (FALSE);\r
+    CpuDeadLoop ();\r
+  }\r
+\r
+  ZeroMem ((VOID *)MapPagesBase, EFI_PAGES_TO_SIZE (MapPagesCount));\r
+\r
+  Status = gBS->FreePages (MapPagesBase, MapPagesCount);\r
+  ASSERT_EFI_ERROR (Status);\r
 }\r
 \r
 /**\r