OvmfPkg/ResetVector: Validate the encryption bit position for SEV/SEV-ES

[mirror_edk2.git] / OvmfPkg / ResetVector / Ia32 / PageTables64.asm

diff --git a/OvmfPkg/ResetVector/Ia32/PageTables64.asm b/OvmfPkg/ResetVector/Ia32/PageTables64.asm
index 4032719c30755a2af644fd757494b949ef3af7bc..ccc95ad4715d3770e53fa6f9680c9ce28279a7c2 100644 (file)
--- a/OvmfPkg/ResetVector/Ia32/PageTables64.asm
+++ b/OvmfPkg/ResetVector/Ia32/PageTables64.asm
@@ -140,9 +140,18 @@ GetSevEncBit:
     ; Get pte bit position to enable memory encryption\r
     ; CPUID Fn8000_001F[EBX] - Bits 5:0\r
     ;\r
+    and       ebx, 0x3f\r
     mov       eax, ebx\r
-    and       eax, 0x3f\r
-    jmp       SevExit\r
+\r
+    ; The encryption bit position is always above 31\r
+    sub       ebx, 32\r
+    jns       SevExit\r
+\r
+    ; Encryption bit was reported as 31 or below, enter a HLT loop\r
+SevEncBitLowHlt:\r
+    cli\r
+    hlt\r
+    jmp       SevEncBitLowHlt\r
 \r
 NoSev:\r
     xor       eax, eax\r