From 13ed9e5fc052e4c6db257fdec6f427192f88870c Mon Sep 17 00:00:00 2001 From: Tom Lendacky Date: Wed, 12 Aug 2020 15:21:40 -0500 Subject: [PATCH] OvmfPkg/PlatformPei: Move early GDT into ram when SEV-ES is enabled BZ: https://bugzilla.tianocore.org/show_bug.cgi?id=2198 The SEV support will clear the C-bit from non-RAM areas. The early GDT lives in a non-RAM area, so when an exception occurs (like a #VC) the GDT will be read as un-encrypted even though it is encrypted. This will result in a failure to be able to handle the exception. Move the GDT into RAM so it can be accessed without error when running as an SEV-ES guest. Cc: Jordan Justen Cc: Laszlo Ersek Cc: Ard Biesheuvel Reviewed-by: Laszlo Ersek Signed-off-by: Tom Lendacky Regression-tested-by: Laszlo Ersek --- OvmfPkg/PlatformPei/AmdSev.c | 18 ++++++++++++++++++ 1 file changed, 18 insertions(+) diff --git a/OvmfPkg/PlatformPei/AmdSev.c b/OvmfPkg/PlatformPei/AmdSev.c index 4fd4534cab..a2b38c5912 100644 --- a/OvmfPkg/PlatformPei/AmdSev.c +++ b/OvmfPkg/PlatformPei/AmdSev.c @@ -39,6 +39,8 @@ AmdSevEsInitialize ( PHYSICAL_ADDRESS GhcbBasePa; UINTN GhcbPageCount, PageCount; RETURN_STATUS PcdStatus, DecryptStatus; + IA32_DESCRIPTOR Gdtr; + VOID *Gdt; if (!MemEncryptSevEsIsEnabled ()) { return; @@ -83,6 +85,22 @@ AmdSevEsInitialize ( (UINT64)GhcbPageCount, GhcbBase)); AsmWriteMsr64 (MSR_SEV_ES_GHCB, GhcbBasePa); + + // + // The SEV support will clear the C-bit from non-RAM areas. The early GDT + // lives in a non-RAM area, so when an exception occurs (like a #VC) the GDT + // will be read as un-encrypted even though it was created before the C-bit + // was cleared (encrypted). This will result in a failure to be able to + // handle the exception. + // + AsmReadGdtr (&Gdtr); + + Gdt = AllocatePages (EFI_SIZE_TO_PAGES ((UINTN) Gdtr.Limit + 1)); + ASSERT (Gdt != NULL); + + CopyMem (Gdt, (VOID *) Gdtr.Base, Gdtr.Limit + 1); + Gdtr.Base = (UINTN) Gdt; + AsmWriteGdtr (&Gdtr); } /**