From 16e7adce62f7c28cc1823229b40a27493737cae6 Mon Sep 17 00:00:00 2001 From: Ashish Kalra Date: Tue, 5 Apr 2022 16:30:54 +0000 Subject: [PATCH 5/9] OvmfPkg/PlatformPei: Mark SEC GHCB page as unencrypted via hypercall cherry-picked from https://patchew.org/EDK2/cover.1629380011.git.ashish.kalra@amd.com . Mark the SEC GHCB page (that is mapped as unencrypted in ResetVector code) in the hypervisor's guest page encryption state tracking. Cc: Jordan Justen Cc: Ard Biesheuvel Signed-off-by: Ashish Kalra --- OvmfPkg/PlatformPei/AmdSev.c | 11 +++++++++++ 1 file changed, 11 insertions(+) diff --git a/OvmfPkg/PlatformPei/AmdSev.c b/OvmfPkg/PlatformPei/AmdSev.c index e6b602d7..553e841e 100644 --- a/OvmfPkg/PlatformPei/AmdSev.c +++ b/OvmfPkg/PlatformPei/AmdSev.c @@ -229,6 +229,17 @@ AmdSevEsInitialize ( Status = PcdSetBoolS (PcdSevEsIsEnabled, TRUE); ASSERT_RETURN_ERROR (Status); + // + // The SEC Ghcb setup during reset-vector needs to be marked as + // decrypted in the hypervisor's guest page encryption state + // tracking. + // + SetMemoryEncDecHypercall3 ( + FixedPcdGet32 (PcdOvmfSecGhcbBase), + EFI_SIZE_TO_PAGES (FixedPcdGet32 (PcdOvmfSecGhcbSize)), + FALSE + ); + // // Allocate GHCB and per-CPU variable pages. // Since the pages must survive across the UEFI to OS transition -- 2.25.1