summaryrefslogtreecommitdiffstats
path: root/OvmfPkg/Library/SmmCpuFeaturesLib
diff options
context:
space:
mode:
authorLaszlo Ersek <lersek@redhat.com>2018-03-01 20:59:12 +0100
committerLaszlo Ersek <lersek@redhat.com>2018-03-06 13:30:35 +0100
commit5ef3b66fec13f8f2d4f02322a84d6b8a1c31e771 (patch)
treebe4ada8d919a9293c3a2f10ed0a6d838dedc60a5 /OvmfPkg/Library/SmmCpuFeaturesLib
parent86defc2c2575842dc740dad02aafffe212b24c41 (diff)
downloadedk2-5ef3b66fec13f8f2d4f02322a84d6b8a1c31e771.tar.gz
edk2-5ef3b66fec13f8f2d4f02322a84d6b8a1c31e771.tar.bz2
edk2-5ef3b66fec13f8f2d4f02322a84d6b8a1c31e771.zip
OvmfPkg/SmmCpuFeaturesLib: SEV: encrypt+free pages of init. save state map
Based on the following patch from Brijesh Singh <brijesh.singh@amd.com>: [PATCH v2 1/2] OvmfPkg/AmdSevDxe: Clear the C-bit from SMM Saved State http://mid.mail-archive.com/20180228161415.28723-2-brijesh.singh@amd.com https://lists.01.org/pipermail/edk2-devel/2018-February/022016.html Once PiSmmCpuDxeSmm relocates SMBASE for all VCPUs, the pages of the initial SMRAM save state map can be re-encrypted (including zeroing them out after setting the C-bit on them), and they can be released to DXE for general use (undoing the allocation that we did in PlatformPei's AmdSevInitialize() function). The decryption of the same pages (which will occur chronologically earlier) is implemented in the next patch; hence the "re-encryption" part of this patch is currently a no-op. The series is structured like this in order to be bisection-friendly. If the decryption patch preceded this patch, then an info leak would be created while standing between the patches. Cc: Ard Biesheuvel <ard.biesheuvel@linaro.org> Cc: Brijesh Singh <brijesh.singh@amd.com> Cc: Jordan Justen <jordan.l.justen@intel.com> Contributed-under: TianoCore Contribution Agreement 1.1 Signed-off-by: Laszlo Ersek <lersek@redhat.com> Tested-by: Brijesh Singh <brijesh.singh@amd.com> Reviewed-by: Brijesh Singh <brijesh.singh@amd.com>
Diffstat (limited to 'OvmfPkg/Library/SmmCpuFeaturesLib')
-rw-r--r--OvmfPkg/Library/SmmCpuFeaturesLib/SmmCpuFeaturesLib.c38
-rw-r--r--OvmfPkg/Library/SmmCpuFeaturesLib/SmmCpuFeaturesLib.inf2
2 files changed, 40 insertions, 0 deletions
diff --git a/OvmfPkg/Library/SmmCpuFeaturesLib/SmmCpuFeaturesLib.c b/OvmfPkg/Library/SmmCpuFeaturesLib/SmmCpuFeaturesLib.c
index 13d929a983..59c319e01b 100644
--- a/OvmfPkg/Library/SmmCpuFeaturesLib/SmmCpuFeaturesLib.c
+++ b/OvmfPkg/Library/SmmCpuFeaturesLib/SmmCpuFeaturesLib.c
@@ -15,8 +15,10 @@
#include <Library/BaseLib.h>
#include <Library/BaseMemoryLib.h>
#include <Library/DebugLib.h>
+#include <Library/MemEncryptSevLib.h>
#include <Library/SmmCpuFeaturesLib.h>
#include <Library/SmmServicesTableLib.h>
+#include <Library/UefiBootServicesTableLib.h>
#include <PiSmm.h>
#include <Register/QemuSmramSaveStateMap.h>
@@ -185,6 +187,42 @@ SmmCpuFeaturesSmmRelocationComplete (
VOID
)
{
+ EFI_STATUS Status;
+ UINTN MapPagesBase;
+ UINTN MapPagesCount;
+
+ if (!MemEncryptSevIsEnabled ()) {
+ return;
+ }
+
+ //
+ // Now that SMBASE relocation is complete, re-encrypt the original SMRAM save
+ // state map's container pages, and release the pages to DXE. (The pages were
+ // allocated in PlatformPei.)
+ //
+ Status = MemEncryptSevLocateInitialSmramSaveStateMapPages (
+ &MapPagesBase,
+ &MapPagesCount
+ );
+ ASSERT_EFI_ERROR (Status);
+
+ Status = MemEncryptSevSetPageEncMask (
+ 0, // Cr3BaseAddress -- use current CR3
+ MapPagesBase, // BaseAddress
+ MapPagesCount, // NumPages
+ TRUE // Flush
+ );
+ if (EFI_ERROR (Status)) {
+ DEBUG ((DEBUG_ERROR, "%a: MemEncryptSevSetPageEncMask(): %r\n",
+ __FUNCTION__, Status));
+ ASSERT (FALSE);
+ CpuDeadLoop ();
+ }
+
+ ZeroMem ((VOID *)MapPagesBase, EFI_PAGES_TO_SIZE (MapPagesCount));
+
+ Status = gBS->FreePages (MapPagesBase, MapPagesCount);
+ ASSERT_EFI_ERROR (Status);
}
/**
diff --git a/OvmfPkg/Library/SmmCpuFeaturesLib/SmmCpuFeaturesLib.inf b/OvmfPkg/Library/SmmCpuFeaturesLib/SmmCpuFeaturesLib.inf
index 5184abbf21..7c2aaa890b 100644
--- a/OvmfPkg/Library/SmmCpuFeaturesLib/SmmCpuFeaturesLib.inf
+++ b/OvmfPkg/Library/SmmCpuFeaturesLib/SmmCpuFeaturesLib.inf
@@ -36,4 +36,6 @@
BaseLib
BaseMemoryLib
DebugLib
+ MemEncryptSevLib
SmmServicesTableLib
+ UefiBootServicesTableLib