UINTN GhcbBackupPageCount;\r
SEV_ES_PER_CPU_DATA *SevEsData;\r
UINTN PageCount;\r
- RETURN_STATUS PcdStatus, DecryptStatus;\r
+ RETURN_STATUS Status;\r
IA32_DESCRIPTOR Gdtr;\r
VOID *Gdt;\r
\r
return;\r
}\r
\r
- PcdStatus = PcdSetBoolS (PcdSevEsIsEnabled, TRUE);\r
- ASSERT_RETURN_ERROR (PcdStatus);\r
+ Status = PcdSetBoolS (PcdSevEsIsEnabled, TRUE);\r
+ ASSERT_RETURN_ERROR (Status);\r
\r
//\r
// Allocate GHCB and per-CPU variable pages.\r
// only clear the encryption mask for the GHCB pages.\r
//\r
for (PageCount = 0; PageCount < GhcbPageCount; PageCount += 2) {\r
- DecryptStatus = MemEncryptSevClearPageEncMask (\r
- 0,\r
- GhcbBasePa + EFI_PAGES_TO_SIZE (PageCount),\r
- 1\r
- );\r
- ASSERT_RETURN_ERROR (DecryptStatus);\r
+ Status = MemEncryptSevClearPageEncMask (\r
+ 0,\r
+ GhcbBasePa + EFI_PAGES_TO_SIZE (PageCount),\r
+ 1\r
+ );\r
+ ASSERT_RETURN_ERROR (Status);\r
}\r
\r
ZeroMem (GhcbBase, EFI_PAGES_TO_SIZE (GhcbPageCount));\r
\r
- PcdStatus = PcdSet64S (PcdGhcbBase, GhcbBasePa);\r
- ASSERT_RETURN_ERROR (PcdStatus);\r
- PcdStatus = PcdSet64S (PcdGhcbSize, EFI_PAGES_TO_SIZE (GhcbPageCount));\r
- ASSERT_RETURN_ERROR (PcdStatus);\r
+ Status = PcdSet64S (PcdGhcbBase, GhcbBasePa);\r
+ ASSERT_RETURN_ERROR (Status);\r
+ Status = PcdSet64S (PcdGhcbSize, EFI_PAGES_TO_SIZE (GhcbPageCount));\r
+ ASSERT_RETURN_ERROR (Status);\r
\r
DEBUG ((\r
DEBUG_INFO,\r
\r
AsmWriteMsr64 (MSR_SEV_ES_GHCB, GhcbBasePa);\r
\r
+ //\r
+ // Now that the PEI GHCB is set up, the SEC GHCB page is no longer necessary\r
+ // to keep shared. Later, it is exposed to the OS as EfiConventionalMemory, so\r
+ // it needs to be marked private. The size of the region is hardcoded in\r
+ // OvmfPkg/ResetVector/ResetVector.nasmb in the definition of\r
+ // SNP_SEC_MEM_BASE_DESC_2.\r
+ //\r
+ Status = MemEncryptSevSetPageEncMask (\r
+ 0, // Cr3 -- use system Cr3\r
+ FixedPcdGet32 (PcdOvmfSecGhcbBase), // BaseAddress\r
+ 1 // NumPages\r
+ );\r
+ ASSERT_RETURN_ERROR (Status);\r
+\r
//\r
// The SEV support will clear the C-bit from non-RAM areas. The early GDT\r
// lives in a non-RAM area, so when an exception occurs (like a #VC) the GDT\r