From 0afb8743493853e30171f6000de51242e22a1eb8 Mon Sep 17 00:00:00 2001 From: Tom Lendacky Date: Fri, 8 Mar 2024 07:33:01 -0800 Subject: OvmfPkg/BaseMemEncryptLib: Check for presence of an SVSM when not at VMPL0 BZ: https://bugzilla.tianocore.org/show_bug.cgi?id=4654 Currently, an SEV-SNP guest will terminate if it is not running at VMPL0. The requirement for running at VMPL0 is removed if an SVSM is present. Update the current VMPL0 check to additionally check for the presence of an SVSM is the guest is not running at VMPL0. Cc: Ard Biesheuvel Cc: Erdem Aktas Cc: Gerd Hoffmann Cc: Jiewen Yao Cc: Laszlo Ersek Cc: Michael Roth Cc: Min Xu Acked-by: Gerd Hoffmann Signed-off-by: Tom Lendacky --- .../Library/BaseMemEncryptSevLib/X64/SecSnpSystemRamValidate.c | 9 ++++++--- 1 file changed, 6 insertions(+), 3 deletions(-) diff --git a/OvmfPkg/Library/BaseMemEncryptSevLib/X64/SecSnpSystemRamValidate.c b/OvmfPkg/Library/BaseMemEncryptSevLib/X64/SecSnpSystemRamValidate.c index ca279d7727..227e333399 100644 --- a/OvmfPkg/Library/BaseMemEncryptSevLib/X64/SecSnpSystemRamValidate.c +++ b/OvmfPkg/Library/BaseMemEncryptSevLib/X64/SecSnpSystemRamValidate.c @@ -12,6 +12,7 @@ #include #include #include +#include #include "SnpPageStateChange.h" @@ -74,10 +75,12 @@ MemEncryptSevSnpPreValidateSystemRam ( // // The page state change uses the PVALIDATE instruction. The instruction - // can be run on VMPL-0 only. If its not VMPL-0 guest then terminate - // the boot. + // can be run at VMPL-0 only. If its not a VMPL-0 guest, then an SVSM must + // be present to perform the operation on behalf of the guest. If the guest + // is not running at VMPL-0 and an SVSM is not present, then terminate the + // boot. // - if (!SevSnpIsVmpl0 ()) { + if (!SevSnpIsVmpl0 () && !AmdSvsmIsSvsmPresent ()) { SnpPageStateFailureTerminate (); } -- cgit