From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from NAM11-BN8-obe.outbound.protection.outlook.com (NAM11-BN8-obe.outbound.protection.outlook.com []) by mx.groups.io with SMTP id smtpd.web12.504.1587577397852627360 for ; Wed, 22 Apr 2020 10:43:20 -0700 Authentication-Results: mx.groups.io; dkim=pass header.i=@amdcloud.onmicrosoft.com header.s=selector2-amdcloud-onmicrosoft-com header.b=r/X+/7Nh; spf=none, err=SPF record not found (domain: amd.com, ip: , mailfrom: thomas.lendacky@amd.com) ARC-Seal: i=1; a=rsa-sha256; s=arcselector9901; d=microsoft.com; cv=none; b=n6zdyHkTwdebCOdlAJgWyCOWZo8aCeh/8nSAeemvIJLj6DDTfv4xrZepKFfhbXtT7WP5kG4PBGjD4/KK8cH8ufMetwuJrBwV3/qofT3s6YFghn//ADb5KyIyin4oJmnuphv9pPCWR9JsoTQ21yw+uV+lP/V+TGi10G8VUVNiwEqniqyZUYU4DG8mzZQmmslHDGecA/jaauJ/46tqf9rcEZ40ZDSlz2TGMR+UOyH1FejWbU10+fHRlKs8t30CyVAUZ81FDoLVCp8PsU6/isP9tzn07klBU0ezFrwcP7kAdYcrOluSMLDBb0em3YFkIe/UillECtjRJviHMoLhEnllOw== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=arcselector9901; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=SN2rOIs8cakZnaU5Fv9W8IsGkEVCXf+RA8lAY1E7kzM=; b=LoS1al7YUvyOmeW8dKjwinpZb7DKMNzfsHh2r5ZSAIW6+dGg5cQUCyMxl0gmnMP1edG9qmsjHJO9uoTG93mp+n0hjpSf05ie5k2uTe4XxJ/g+KjGB/QOlelqnK2ZjxZJPcapk/faDCR5Od8d8bytZ+Nng0+He14CbjHsyqjvaxLYPQBJtZUtTERbL/NEe9FQRBjpuag73xp7aIbizhZ+1vB6+0wEWuXZd+6XoDlZ5LcdXQb+icFPk6KLqsy4RCC6WuK5HC6fRvQJlqqBXV+Lfq0PTUiU/IMLzWsQQEi2m3/YXiVL+x/wxiwOOQDlEGgZO/qbFiH8fjArg+EHTNVSwg== ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=pass smtp.mailfrom=amd.com; dmarc=pass action=none header.from=amd.com; dkim=pass header.d=amd.com; arc=none DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=amdcloud.onmicrosoft.com; s=selector2-amdcloud-onmicrosoft-com; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=SN2rOIs8cakZnaU5Fv9W8IsGkEVCXf+RA8lAY1E7kzM=; b=r/X+/7NhqGsrbwF+p7x7JBq3t0VR6dbUUetAdPFL8dRAm5lMvp/ErJdQDUH4DIKMvl9zFkxP+NXlqKXz8R3b4OKEgH6ZPIh25t3s4qgObe33IN9Xq87BR9D1gmD9Bc7tBUZO5uh+WaPeUTDtIYgeqr51u9PuL+hBG0g/Ogr9FDs= Authentication-Results: spf=none (sender IP is ) smtp.mailfrom=Thomas.Lendacky@amd.com; Received: from DM6PR12MB3163.namprd12.prod.outlook.com (2603:10b6:5:15e::26) by DM6PR12MB3673.namprd12.prod.outlook.com (2603:10b6:5:1c5::11) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.2921.29; Wed, 22 Apr 2020 17:43:17 +0000 Received: from DM6PR12MB3163.namprd12.prod.outlook.com ([fe80::9ae:cb95:c925:d5bf]) by DM6PR12MB3163.namprd12.prod.outlook.com ([fe80::9ae:cb95:c925:d5bf%4]) with mapi id 15.20.2921.030; Wed, 22 Apr 2020 17:43:17 +0000 From: "Lendacky, Thomas" To: devel@edk2.groups.io Cc: Jordan Justen , Laszlo Ersek , Ard Biesheuvel , Michael D Kinney , Liming Gao , Eric Dong , Ray Ni , Brijesh Singh Subject: [PATCH v7 34/43] OvmfPkg/ResetVector: Add support for a 32-bit SEV check Date: Wed, 22 Apr 2020 12:41:49 -0500 Message-Id: <8bc5c25bea8e013e0b60892d2c1bcb7ff28f7a65.1587577317.git.thomas.lendacky@amd.com> X-Mailer: git-send-email 2.17.1 In-Reply-To: References: X-ClientProxiedBy: DM5PR04CA0060.namprd04.prod.outlook.com (2603:10b6:3:ef::22) To DM6PR12MB3163.namprd12.prod.outlook.com (2603:10b6:5:15e::26) Return-Path: thomas.lendacky@amd.com MIME-Version: 1.0 X-MS-Exchange-MessageSentRepresentingType: 1 Received: from tlendack-t1.amd.com (165.204.77.1) by DM5PR04CA0060.namprd04.prod.outlook.com (2603:10b6:3:ef::22) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.2937.13 via Frontend Transport; Wed, 22 Apr 2020 17:42:49 +0000 X-Mailer: git-send-email 2.17.1 X-Originating-IP: [165.204.77.1] X-MS-PublicTrafficType: Email X-MS-Office365-Filtering-HT: Tenant X-MS-Office365-Filtering-Correlation-Id: 8ab0152f-7190-4377-7003-08d7e6e4938e X-MS-TrafficTypeDiagnostic: DM6PR12MB3673:|DM6PR12MB3673: X-MS-Exchange-Transport-Forked: True X-Microsoft-Antispam-PRVS: X-MS-Oob-TLC-OOBClassifiers: OLM:6430; X-Forefront-PRVS: 03818C953D X-Forefront-Antispam-Report: CIP:255.255.255.255;CTRY:;LANG:en;SCL:1;SRV:;IPV:NLI;SFV:NSPM;H:DM6PR12MB3163.namprd12.prod.outlook.com;PTR:;CAT:NONE;SFTY:;SFS:(10009020)(4636009)(346002)(136003)(396003)(366004)(39860400002)(376002)(16526019)(186003)(8936002)(8676002)(956004)(30864003)(4326008)(316002)(6916009)(86362001)(2616005)(36756003)(26005)(52116002)(7696005)(5660300002)(19627235002)(2906002)(478600001)(81156014)(966005)(66556008)(66946007)(66476007)(6486002)(54906003)(136400200001);DIR:OUT;SFP:1101; Received-SPF: None (protection.outlook.com: amd.com does not designate permitted sender hosts) X-MS-Exchange-SenderADCheck: 1 X-Microsoft-Antispam: BCL:0; X-Microsoft-Antispam-Message-Info: TKydlRYiLGqCD/CyykLXgFQBLcyprd4y526toOyvZ5l9Pa/LnAXeCNQabLYTa1ScNZgwu2XldqIWBi+WWUTjM4qfgN6PnVjLSuZcpbSiTxXRQ4tIGn3/BFVDPTnVqrgU6WVGCUiUblS3AFWZUkxqyad7APFkRM70S9rzuqsa7zxfF191uYei3QdlfcigwViMv7bSBMNL9jjK/nAeXtSudeQR9TEBkHFuyW7Wqm00rFejzgtcd4yN/sQ3LXBhkHwkWo3R7UTbWauaZbQRBMya1bR73dltYkcL+Iky0TcQTEpbivgxXU5nJ03RJwC5Kybyz1kHWgqu9nafdFjf3mn5cF7U/eSYLTgesitgylOiJ6BxrFtdytMrIuAo7cqUJzOSP5PQ4YnukSXh+eqSI4SLxDj+vWouzEMZ8/8QEgLs0v+H7zo5QN9b0L7xH70ZJj0x/xFye1jiLgqI6PKP7AKjZPRbb6GehE3yOImxjAS3o0k1tQBL/SqTm6cB2MoBsefAkW2yLR/GcfQ3GSSLgQJopR5D5LnOcjBbjKx2Ba0DicR5hSWSlUnWVwxbTtGkq1ftpYkc0UYwKup/9wBnyTF3Fg== X-MS-Exchange-AntiSpam-MessageData: HcYODWzGGyfh+ZUyL5Z6Gp02mukUq0NwJriZ5EfL2Tb66K363O0w9lzho29YTRQ5uNAmK2jg/kqb7IvmrV3fzclmyQ4nT8CyhUodgqT0Q4UxQL+wiU6e974hpTJSmSz14bRDCIxTqlT3ea73VqAyfg== X-OriginatorOrg: amd.com X-MS-Exchange-CrossTenant-Network-Message-Id: 8ab0152f-7190-4377-7003-08d7e6e4938e X-MS-Exchange-CrossTenant-OriginalArrivalTime: 22 Apr 2020 17:42:50.0181 (UTC) X-MS-Exchange-CrossTenant-FromEntityHeader: Hosted X-MS-Exchange-CrossTenant-Id: 3dd8961f-e488-4e60-8e11-a82d994e183d X-MS-Exchange-CrossTenant-MailboxType: HOSTED X-MS-Exchange-CrossTenant-UserPrincipalName: ZbuZghMayCCqQLLlacCluiwsn72tESKH227/7CYjTHRw1YB2PeuiDlMfRRNcfqOo+bFVdyyg8ud8OA8plzJW3g== X-MS-Exchange-Transport-CrossTenantHeadersStamped: DM6PR12MB3673 Content-Type: text/plain BZ: https://bugzilla.tianocore.org/show_bug.cgi?id=2198 During BSP startup, the reset vector code will issue a CPUID instruction while in 32-bit mode. When running as an SEV-ES guest, this will trigger a #VC exception. Add exception handling support to the early reset vector code to catch these exceptions. Also, since the guest is in 32-bit mode at this point, writes to the GHCB will be encrypted and thus not able to be read by the hypervisor, so use the GHCB CPUID request/response protocol to obtain the requested CPUID function values and provide these to the guest. The exception handling support is active during the SEV check and uses the OVMF temporary RAM space for a stack. After the SEV check is complete, the exception handling support is removed and the stack pointer cleared. Cc: Jordan Justen Cc: Laszlo Ersek Cc: Ard Biesheuvel Reviewed-by: Laszlo Ersek Signed-off-by: Tom Lendacky --- OvmfPkg/ResetVector/ResetVector.inf | 3 + OvmfPkg/ResetVector/Ia32/PageTables64.asm | 320 ++++++++++++++++++++-- OvmfPkg/ResetVector/ResetVector.nasmb | 2 + 3 files changed, 298 insertions(+), 27 deletions(-) diff --git a/OvmfPkg/ResetVector/ResetVector.inf b/OvmfPkg/ResetVector/ResetVector.inf index 483fd90fe785..a53ae6c194ae 100644 --- a/OvmfPkg/ResetVector/ResetVector.inf +++ b/OvmfPkg/ResetVector/ResetVector.inf @@ -34,9 +34,12 @@ [BuildOptions] *_*_X64_NASMB_FLAGS = -I$(WORKSPACE)/UefiCpuPkg/ResetVector/Vtf0/ [Pcd] + gUefiCpuPkgTokenSpaceGuid.PcdSevEsWorkAreaBase gUefiOvmfPkgTokenSpaceGuid.PcdOvmfSecGhcbBase gUefiOvmfPkgTokenSpaceGuid.PcdOvmfSecGhcbSize gUefiOvmfPkgTokenSpaceGuid.PcdOvmfSecGhcbPageTableBase gUefiOvmfPkgTokenSpaceGuid.PcdOvmfSecGhcbPageTableSize gUefiOvmfPkgTokenSpaceGuid.PcdOvmfSecPageTablesBase gUefiOvmfPkgTokenSpaceGuid.PcdOvmfSecPageTablesSize + gUefiOvmfPkgTokenSpaceGuid.PcdOvmfSecPeiTempRamBase + gUefiOvmfPkgTokenSpaceGuid.PcdOvmfSecPeiTempRamSize diff --git a/OvmfPkg/ResetVector/Ia32/PageTables64.asm b/OvmfPkg/ResetVector/Ia32/PageTables64.asm index c3587a1b7814..a83569d4a4be 100644 --- a/OvmfPkg/ResetVector/Ia32/PageTables64.asm +++ b/OvmfPkg/ResetVector/Ia32/PageTables64.asm @@ -36,13 +36,58 @@ BITS 32 PAGE_READ_WRITE + \ PAGE_PRESENT) -; Check if Secure Encrypted Virtualization (SEV) feature is enabled ; -; If SEV is enabled then EAX will be at least 32 +; SEV-ES #VC exception handler support +; +; #VC handler local variable locations +; +%define VC_CPUID_RESULT_EAX 0 +%define VC_CPUID_RESULT_EBX 4 +%define VC_CPUID_RESULT_ECX 8 +%define VC_CPUID_RESULT_EDX 12 +%define VC_GHCB_MSR_EDX 16 +%define VC_GHCB_MSR_EAX 20 +%define VC_CPUID_REQUEST_REGISTER 24 +%define VC_CPUID_FUNCTION 28 + +; #VC handler total local variable size +; +%define VC_VARIABLE_SIZE 32 + +; #VC handler GHCB CPUID request/response protocol values +; +%define GHCB_CPUID_REQUEST 4 +%define GHCB_CPUID_RESPONSE 5 +%define GHCB_CPUID_REGISTER_SHIFT 30 +%define CPUID_INSN_LEN 2 + + +; Check if Secure Encrypted Virtualization (SEV) features are enabled +; +; Modified: EAX, EBX, ECX, EDX, ESP +; +; If SEV is enabled then EAX will be at least 32. ; If SEV is disabled then EAX will be zero. ; -CheckSevFeature: +CheckSevFeatures: + ; Set the first byte of the workarea to zero to communicate to the SEC + ; phase that SEV-ES is not enabled. If SEV-ES is enabled, the CPUID + ; instruction will trigger a #VC exception where the first byte of the + ; workarea will be set to one. + mov byte[SEV_ES_WORK_AREA], 0 + + ; + ; Set up exception handlers to check for SEV-ES + ; Load temporary RAM stack based on PCDs (see SevEsIdtVmmComm for + ; stack usage) + ; Establish exception handlers + ; + mov esp, SEV_ES_VC_TOP_OF_STACK + mov eax, ADDR_OF(Idtr) + lidt [cs:eax] + ; Check if we have a valid (0x8000_001F) CPUID leaf + ; CPUID raises a #VC exception if running as an SEV-ES guest mov eax, 0x80000000 cpuid @@ -53,8 +98,8 @@ CheckSevFeature: jl NoSev ; Check for memory encryption feature: - ; CPUID Fn8000_001F[EAX] - Bit 1 - ; + ; CPUID Fn8000_001F[EAX] - Bit 1 + ; CPUID raises a #VC exception if running as an SEV-ES guest mov eax, 0x8000001f cpuid bt eax, 1 @@ -67,6 +112,16 @@ CheckSevFeature: bt eax, 0 jnc NoSev + ; Check if SEV-ES is enabled + ; MSR_0xC0010131 - Bit 1 (SEV-ES enabled) + bt eax, 1 + jnc NoSevEs + + ; Set the first byte of the workarea to one to communicate to the SEC + ; phase that SEV-ES is enabled. + mov byte[SEV_ES_WORK_AREA], 1 + +NoSevEs: ; Get pte bit position to enable memory encryption ; CPUID Fn8000_001F[EBX] - Bits 5:0 ; @@ -78,45 +133,44 @@ NoSev: xor eax, eax SevExit: - OneTimeCallRet CheckSevFeature + ; + ; Clear exception handlers and stack + ; + push eax + mov eax, ADDR_OF(IdtrClear) + lidt [cs:eax] + pop eax + mov esp, 0 + + OneTimeCallRet CheckSevFeatures ; Check if Secure Encrypted Virtualization - Encrypted State (SEV-ES) feature ; is enabled. ; -; Modified: EAX, EBX, ECX +; Modified: EAX ; ; If SEV-ES is enabled then EAX will be non-zero. ; If SEV-ES is disabled then EAX will be zero. ; -CheckSevEsFeature: +IsSevEsEnabled: xor eax, eax - ; SEV-ES can't be enabled if SEV isn't, so first check the encryption - ; mask. - test edx, edx - jz NoSevEs + ; During CheckSevFeatures, the SEV_ES_WORK_AREA was set to 1 if + ; SEV-ES is enabled. + cmp byte[SEV_ES_WORK_AREA], 0 + jz SevEsDisabled - ; Save current value of encryption mask - mov ebx, edx + mov eax, 1 - ; Check if SEV-ES is enabled - ; MSR_0xC0010131 - Bit 1 (SEV-ES enabled) - mov ecx, 0xc0010131 - rdmsr - and eax, 2 - - ; Restore encryption mask - mov edx, ebx - -NoSevEs: - OneTimeCallRet CheckSevEsFeature +SevEsDisabled: + OneTimeCallRet IsSevEsEnabled ; ; Modified: EAX, EBX, ECX, EDX ; SetCr3ForPageTables64: - OneTimeCall CheckSevFeature + OneTimeCall CheckSevFeatures xor edx, edx test eax, eax jz SevNotActive @@ -175,7 +229,7 @@ pageTableEntriesLoop: mov [(ecx * 8 + PT_ADDR (0x2000 - 8)) + 4], edx loop pageTableEntriesLoop - OneTimeCall CheckSevEsFeature + OneTimeCall IsSevEsEnabled test eax, eax jz SetCr3 @@ -216,3 +270,215 @@ SetCr3: mov cr3, eax OneTimeCallRet SetCr3ForPageTables64 + +; +; Start of #VC exception handling routines +; + +SevEsIdtNotCpuid: + ; + ; Use VMGEXIT to request termination. + ; 1 - #VC was not for CPUID + ; + mov eax, 1 + jmp SevEsIdtTerminate + +SevEsIdtNoCpuidResponse: + ; + ; Use VMGEXIT to request termination. + ; 2 - GHCB_CPUID_RESPONSE not received + ; + mov eax, 2 + +SevEsIdtTerminate: + ; + ; Use VMGEXIT to request termination. At this point the reason code is + ; located in EAX, so shift it left 16 bits to the proper location. + ; + ; EAX[11:0] => 0x100 - request termination + ; EAX[15:12] => 0x1 - OVMF + ; EAX[23:16] => 0xXX - REASON CODE + ; + shl eax, 16 + or eax, 0x1100 + xor edx, edx + mov ecx, 0xc0010130 + wrmsr + ; + ; Issue VMGEXIT - NASM doesn't support the vmmcall instruction in 32-bit + ; mode, so work around this by temporarily switching to 64-bit mode. + ; +BITS 64 + rep vmmcall +BITS 32 + + ; + ; We shouldn't come back from the VMGEXIT, but if we do, just loop. + ; +SevEsIdtHlt: + hlt + jmp SevEsIdtHlt + iret + + ; + ; Total stack usage for the #VC handler is 44 bytes: + ; - 12 bytes for the exception IRET (after popping error code) + ; - 32 bytes for the local variables. + ; +SevEsIdtVmmComm: + ; + ; If we're here, then we are an SEV-ES guest and this + ; was triggered by a CPUID instruction + ; + + pop ecx ; Error code + cmp ecx, 0x72 ; Be sure it was CPUID + jne SevEsIdtNotCpuid + + ; Set up local variable room on the stack + ; CPUID function : + 28 + ; CPUID request register : + 24 + ; GHCB MSR (EAX) : + 20 + ; GHCB MSR (EDX) : + 16 + ; CPUID result (EDX) : + 12 + ; CPUID result (ECX) : + 8 + ; CPUID result (EBX) : + 4 + ; CPUID result (EAX) : + 0 + sub esp, VC_VARIABLE_SIZE + + ; Save the CPUID function being requested + mov [esp + VC_CPUID_FUNCTION], eax + + ; The GHCB CPUID protocol uses the following mapping to request + ; a specific register: + ; 0 => EAX, 1 => EBX, 2 => ECX, 3 => EDX + ; + ; Set EAX as the first register to request. This will also be used as a + ; loop variable to request all register values (EAX to EDX). + xor eax, eax + mov [esp + VC_CPUID_REQUEST_REGISTER], eax + + ; Save current GHCB MSR value + mov ecx, 0xc0010130 + rdmsr + mov [esp + VC_GHCB_MSR_EAX], eax + mov [esp + VC_GHCB_MSR_EDX], edx + +NextReg: + ; + ; Setup GHCB MSR + ; GHCB_MSR[63:32] = CPUID function + ; GHCB_MSR[31:30] = CPUID register + ; GHCB_MSR[11:0] = CPUID request protocol + ; + mov eax, [esp + VC_CPUID_REQUEST_REGISTER] + cmp eax, 4 + jge VmmDone + + shl eax, GHCB_CPUID_REGISTER_SHIFT + or eax, GHCB_CPUID_REQUEST + mov edx, [esp + VC_CPUID_FUNCTION] + mov ecx, 0xc0010130 + wrmsr + + ; + ; Issue VMGEXIT - NASM doesn't support the vmmcall instruction in 32-bit + ; mode, so work around this by temporarily switching to 64-bit mode. + ; +BITS 64 + rep vmmcall +BITS 32 + + ; + ; Read GHCB MSR + ; GHCB_MSR[63:32] = CPUID register value + ; GHCB_MSR[31:30] = CPUID register + ; GHCB_MSR[11:0] = CPUID response protocol + ; + mov ecx, 0xc0010130 + rdmsr + mov ecx, eax + and ecx, 0xfff + cmp ecx, GHCB_CPUID_RESPONSE + jne SevEsIdtNoCpuidResponse + + ; Save returned value + shr eax, GHCB_CPUID_REGISTER_SHIFT + mov [esp + eax * 4], edx + + ; Next register + inc word [esp + VC_CPUID_REQUEST_REGISTER] + + jmp NextReg + +VmmDone: + ; + ; At this point we have all CPUID register values. Restore the GHCB MSR, + ; set the return register values and return. + ; + mov eax, [esp + VC_GHCB_MSR_EAX] + mov edx, [esp + VC_GHCB_MSR_EDX] + mov ecx, 0xc0010130 + wrmsr + + mov eax, [esp + VC_CPUID_RESULT_EAX] + mov ebx, [esp + VC_CPUID_RESULT_EBX] + mov ecx, [esp + VC_CPUID_RESULT_ECX] + mov edx, [esp + VC_CPUID_RESULT_EDX] + + add esp, VC_VARIABLE_SIZE + + ; Update the EIP value to skip over the now handled CPUID instruction + ; (the CPUID instruction has a length of 2) + add word [esp], CPUID_INSN_LEN + iret + +ALIGN 2 + +Idtr: + dw IDT_END - IDT_BASE - 1 ; Limit + dd ADDR_OF(IDT_BASE) ; Base + +IdtrClear: + dw 0 ; Limit + dd 0 ; Base + +ALIGN 16 + +; +; The Interrupt Descriptor Table (IDT) +; This will be used to determine if SEV-ES is enabled. Upon execution +; of the CPUID instruction, a VMM Communication Exception will occur. +; This will tell us if SEV-ES is enabled. We can use the current value +; of the GHCB MSR to determine the SEV attributes. +; +IDT_BASE: +; +; Vectors 0 - 28 (No handlers) +; +%rep 29 + dw 0 ; Offset low bits 15..0 + dw 0x10 ; Selector + db 0 ; Reserved + db 0x8E ; Gate Type (IA32_IDT_GATE_TYPE_INTERRUPT_32) + dw 0 ; Offset high bits 31..16 +%endrep +; +; Vector 29 (VMM Communication Exception) +; + dw (ADDR_OF(SevEsIdtVmmComm) & 0xffff) ; Offset low bits 15..0 + dw 0x10 ; Selector + db 0 ; Reserved + db 0x8E ; Gate Type (IA32_IDT_GATE_TYPE_INTERRUPT_32) + dw (ADDR_OF(SevEsIdtVmmComm) >> 16) ; Offset high bits 31..16 +; +; Vectors 30 - 31 (No handlers) +; +%rep 2 + dw 0 ; Offset low bits 15..0 + dw 0x10 ; Selector + db 0 ; Reserved + db 0x8E ; Gate Type (IA32_IDT_GATE_TYPE_INTERRUPT_32) + dw 0 ; Offset high bits 31..16 +%endrep +IDT_END: diff --git a/OvmfPkg/ResetVector/ResetVector.nasmb b/OvmfPkg/ResetVector/ResetVector.nasmb index bfb77e439105..762661115d50 100644 --- a/OvmfPkg/ResetVector/ResetVector.nasmb +++ b/OvmfPkg/ResetVector/ResetVector.nasmb @@ -72,6 +72,8 @@ %define GHCB_PT_ADDR (FixedPcdGet32 (PcdOvmfSecGhcbPageTableBase)) %define GHCB_BASE (FixedPcdGet32 (PcdOvmfSecGhcbBase)) %define GHCB_SIZE (FixedPcdGet32 (PcdOvmfSecGhcbSize)) + %define SEV_ES_WORK_AREA (FixedPcdGet32 (PcdSevEsWorkAreaBase)) + %define SEV_ES_VC_TOP_OF_STACK (FixedPcdGet32 (PcdOvmfSecPeiTempRamBase) + FixedPcdGet32 (PcdOvmfSecPeiTempRamSize)) %include "Ia32/PageTables64.asm" %endif -- 2.17.1