Re: [edk2-devel] [PATCH v2] OvmfPkg/PlatformPei: Validate SEC's GHCB page

2022-12-11 Thread Gerd Hoffmann
Hi, > > + Status = MemEncryptSevSetPageEncMask ( > > +0, // Cr3 -- use system Cr3 > > +FixedPcdGet32 (PcdOvmfSecGhcbBase), > > +1 // Number of pages > > +); > > These arguments need to be aligned under the lower

Re: [edk2-devel] [PATCH v2] OvmfPkg/PlatformPei: Validate SEC's GHCB page

2022-12-09 Thread Lendacky, Thomas via groups.io
On 12/9/22 12:58, Adam Dunlap wrote: When running under SEV-ES, a page of shared memory is allocated for the GHCB during the SEC phase at address 0x809000. This page of memory is eventually passed to the OS as EfiConventionalMemory. When running SEV-SNP, this page is not PVALIDATE'd in the RMP ta

[edk2-devel] [PATCH v2] OvmfPkg/PlatformPei: Validate SEC's GHCB page

2022-12-09 Thread Adam Dunlap via groups.io
When running under SEV-ES, a page of shared memory is allocated for the GHCB during the SEC phase at address 0x809000. This page of memory is eventually passed to the OS as EfiConventionalMemory. When running SEV-SNP, this page is not PVALIDATE'd in the RMP table, meaning that if the guest OS tries