OvmfPkg/SmmCpuFeaturesLib: SEV: encrypt+free pages of init. save state map
authorLaszlo Ersek <lersek@redhat.com>
Thu, 1 Mar 2018 19:59:12 +0000 (20:59 +0100)
committerLaszlo Ersek <lersek@redhat.com>
Tue, 6 Mar 2018 12:30:35 +0000 (13:30 +0100)
commit5ef3b66fec13f8f2d4f02322a84d6b8a1c31e771
treebe4ada8d919a9293c3a2f10ed0a6d838dedc60a5
parent86defc2c2575842dc740dad02aafffe212b24c41
OvmfPkg/SmmCpuFeaturesLib: SEV: encrypt+free pages of init. save state map

Based on the following patch from Brijesh Singh <brijesh.singh@amd.com>:

  [PATCH v2 1/2] OvmfPkg/AmdSevDxe: Clear the C-bit from SMM Saved State
  http://mid.mail-archive.com/20180228161415.28723-2-brijesh.singh@amd.com
  https://lists.01.org/pipermail/edk2-devel/2018-February/022016.html

Once PiSmmCpuDxeSmm relocates SMBASE for all VCPUs, the pages of the
initial SMRAM save state map can be re-encrypted (including zeroing them
out after setting the C-bit on them), and they can be released to DXE for
general use (undoing the allocation that we did in PlatformPei's
AmdSevInitialize() function).

The decryption of the same pages (which will occur chronologically
earlier) is implemented in the next patch; hence the "re-encryption" part
of this patch is currently a no-op. The series is structured like this in
order to be bisection-friendly. If the decryption patch preceded this
patch, then an info leak would be created while standing between the
patches.

Cc: Ard Biesheuvel <ard.biesheuvel@linaro.org>
Cc: Brijesh Singh <brijesh.singh@amd.com>
Cc: Jordan Justen <jordan.l.justen@intel.com>
Contributed-under: TianoCore Contribution Agreement 1.1
Signed-off-by: Laszlo Ersek <lersek@redhat.com>
Tested-by: Brijesh Singh <brijesh.singh@amd.com>
Reviewed-by: Brijesh Singh <brijesh.singh@amd.com>
OvmfPkg/Library/SmmCpuFeaturesLib/SmmCpuFeaturesLib.c
OvmfPkg/Library/SmmCpuFeaturesLib/SmmCpuFeaturesLib.inf