rpms/edk2
7
0
Fork 0
Code Issues Pull Requests Releases Activity

* Mon Oct 27 2025 Jon Maloy <jmaloy@redhat.com> - 20241117-6

Browse Source 
- edk2-OvmfPkg-MemEncryptSevLib-Evict-cache-lines-during-SN.patch [RHEL-121983]
- edk2-MdePkg-Add-the-COHERENCY_SFW_NO-CPUID-bit-field.patch [RHEL-121983]
- edk2-OvmfPkg-ResetVector-Make-ReceivedVc-a-flag-in-SEV-ES.patch [RHEL-121983]
- edk2-OvmfPkg-MemEncryptSevLib-Check-if-SEV-SNP-coherency-.patch [RHEL-121983]
- Resolves: RHEL-121983
  ([edk2] VM panic on booting SNP guest with large memory on Genoa)
This commit is contained in:
Jon Maloy 2025-10-27 14:46:48 -04:00
parent 47bbb1076c
commit 1f24ad89a1
5 changed files with 537 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

44
edk2-MdePkg-Add-the-COHERENCY_SFW_NO-CPUID-bit-field.patch Normal file
View File

@ -0,0 +1,44 @@
From 0e83abc612409e4c12e3fb59611b7b6517746e3d Mon Sep 17 00:00:00 2001
From: Tom Lendacky <thomas.lendacky@amd.com>
Date: Tue, 22 Jul 2025 16:59:44 -0500
Subject: [PATCH 2/4] MdePkg: Add the COHERENCY_SFW_NO CPUID bit field
RH-Author: Luigi Leonardi <None>
RH-MergeRequest: 98: OvmfPkg/MemEncryptSevLib: Evict cache lines during SNP memory validation
RH-Jira: RHEL-121983
RH-Acked-by: Gerd Hoffmann <kraxel@redhat.com>
RH-Commit: [2/4] c4fe91e0c104cafef0dc5363c746075b44b744ba (luigileonardi/edk2)
Update the CPUID 0x8000001F EBX definition to add the COHERENCY_SFW_NO
bit field. The COHERENCY_SFW_NO bit is used to indicate that the SEV-SNP
cache coherency mitigation is not needed.
Signed-off-by: Tom Lendacky <thomas.lendacky@amd.com>
---
MdePkg/Include/Register/Amd/Cpuid.h | 9 +++++++--
1 file changed, 7 insertions(+), 2 deletions(-)
diff --git a/MdePkg/Include/Register/Amd/Cpuid.h b/MdePkg/Include/Register/Amd/Cpuid.h
index fdcbc475d5..0313ee2789 100644
--- a/MdePkg/Include/Register/Amd/Cpuid.h
+++ b/MdePkg/Include/Register/Amd/Cpuid.h
@@ -701,9 +701,14 @@ typedef union {
UINT32 ReducedPhysBits : 5;
///
- /// [Bit 31:12] Reserved
+ /// [Bit 30:12] Reserved
///
- UINT32 ReservedBits : 21;
+ UINT32 ReservedBits : 20;
+
+ ///
+ /// [Bit 31] SEV-SNP Cache Coherency Mitigation is not needed
+ ///
+ UINT32 CoherencySfwNo : 1;
} Bits;
///
/// All bit fields as a 32-bit value
--
2.50.1

276
edk2-OvmfPkg-MemEncryptSevLib-Check-if-SEV-SNP-coherency-.patch Normal file
View File

@ -0,0 +1,276 @@
From f6ce42e2cdc81b84a2ad5f9cf7a64ce7fd1adcd5 Mon Sep 17 00:00:00 2001
From: Tom Lendacky <thomas.lendacky@amd.com>
Date: Tue, 22 Jul 2025 15:06:18 -0500
Subject: [PATCH 4/4] OvmfPkg/MemEncryptSevLib: Check if SEV-SNP coherency
mitigitation is needed
RH-Author: Luigi Leonardi <None>
RH-MergeRequest: 98: OvmfPkg/MemEncryptSevLib: Evict cache lines during SNP memory validation
RH-Jira: RHEL-121983
RH-Acked-by: Gerd Hoffmann <kraxel@redhat.com>
RH-Commit: [4/4] c35864a80d723cd0ed9c696707d2b760d1a54ac7 (luigileonardi/edk2)
CPUID bit Fn8000001F_EBX[31] defines the COHERNECY_SFW_NO CPUID bit that,
when set, indicates that the software mitigation for this vulnerability is
not needed.
Add support to check for this CPUID bit and avoid the mitigation if set.
Signed-off-by: Tom Lendacky <thomas.lendacky@amd.com>
---
OvmfPkg/Include/Library/MemEncryptSevLib.h | 14 +++++
OvmfPkg/Include/WorkArea.h | 5 +-
.../DxeMemEncryptSevLibInternal.c | 54 +++++++++++++++++--
.../PeiMemEncryptSevLibInternal.c | 25 +++++++++
.../SecMemEncryptSevLibInternal.c | 25 +++++++++
.../X64/SnpPageStateChangeInternal.c | 10 ++--
OvmfPkg/ResetVector/Ia32/AmdSev.asm | 10 ++++
OvmfPkg/ResetVector/ResetVector.nasmb | 1 +
8 files changed, 135 insertions(+), 9 deletions(-)
diff --git a/OvmfPkg/Include/Library/MemEncryptSevLib.h b/OvmfPkg/Include/Library/MemEncryptSevLib.h
index c5653539d8..d3d4f6fa9a 100644
--- a/OvmfPkg/Include/Library/MemEncryptSevLib.h
+++ b/OvmfPkg/Include/Library/MemEncryptSevLib.h
@@ -178,6 +178,20 @@ MemEncryptSevEsDebugVirtualizationIsEnabled (
VOID
);
+/**
+ Returns a boolean to indicate whether the SEV-SNP cache line eviction
+ mitigation is needed.
+
+ @retval TRUE Cache line eviction mitigation required
+ @retval FALSE Cache line eviction migigation not required
+
+**/
+BOOLEAN
+EFIAPI
+MemEncryptSevSnpDoCoherencyMitigation (
+ VOID
+ );
+
/**
Returns the encryption state of the specified virtual address range.
diff --git a/OvmfPkg/Include/WorkArea.h b/OvmfPkg/Include/WorkArea.h
index 9f3a4517bd..297e54f36e 100644
--- a/OvmfPkg/Include/WorkArea.h
+++ b/OvmfPkg/Include/WorkArea.h
@@ -53,6 +53,8 @@ typedef struct _SEC_SEV_ES_WORK_AREA {
// Flags:
// - BIT0 - VC: Indicator that the VC handler was called. It is used
// during the SevFeature detection in OvmfPkg/ResetVector/Ia32/AmdSev.asm
+ // - BIT1 - CSFW_NO: Indicator that the SEV-SNP cache line evication
+ // mitigation is not needed.
//
UINT8 Flags;
UINT8 Reserved[7];
@@ -64,7 +66,8 @@ typedef struct _SEC_SEV_ES_WORK_AREA {
UINT8 WorkBuffer[1024];
} SEC_SEV_ES_WORK_AREA;
-#define SEV_ES_WORK_AREA_VC BIT0
+#define SEV_ES_WORK_AREA_FLAG_VC BIT0
+#define SEV_ES_WORK_AREA_FLAG_CSFW_NO BIT1
//
// The SEV work area definition.
diff --git a/OvmfPkg/Library/BaseMemEncryptSevLib/DxeMemEncryptSevLibInternal.c b/OvmfPkg/Library/BaseMemEncryptSevLib/DxeMemEncryptSevLibInternal.c
index 9947d663de..aace322e5a 100644
--- a/OvmfPkg/Library/BaseMemEncryptSevLib/DxeMemEncryptSevLibInternal.c
+++ b/OvmfPkg/Library/BaseMemEncryptSevLib/DxeMemEncryptSevLibInternal.c
@@ -18,10 +18,12 @@
#include <Uefi/UefiBaseType.h>
#include <ConfidentialComputingGuestAttr.h>
-STATIC UINT64 mCurrentAttr = 0;
-STATIC BOOLEAN mCurrentAttrRead = FALSE;
-STATIC UINT64 mSevEncryptionMask = 0;
-STATIC BOOLEAN mSevEncryptionMaskSaved = FALSE;
+STATIC UINT64 mCurrentAttr = 0;
+STATIC BOOLEAN mCurrentAttrRead = FALSE;
+STATIC UINT64 mSevEncryptionMask = 0;
+STATIC BOOLEAN mSevEncryptionMaskSaved = FALSE;
+STATIC BOOLEAN mSevSnpCoherencySfwNo = FALSE;
+STATIC BOOLEAN mSevSnpCoherencySfwNoRead = FALSE;
/**
The function check if the specified Attr is set.
@@ -180,3 +182,47 @@ MemEncryptSevEsDebugVirtualizationIsEnabled (
{
return ConfidentialComputingGuestHas (CCAttrFeatureAmdSevEsDebugVirtualization);
}
+
+/**
+ Returns a boolean to indicate if the CPUID COHERENCY_SFW_NO bit is set.
+
+ @retval TRUE The COHERENCY_SFW_NO bit is set.
+ @retval FALSE The COHERENCY_SFW_NO bit is not set.
+
+**/
+STATIC
+BOOLEAN
+MemEncryptCoherencSfwNo (
+ VOID
+ )
+{
+ CPUID_MEMORY_ENCRYPTION_INFO_EBX RegEbx;
+
+ if (!mSevSnpCoherencySfwNoRead) {
+ AsmCpuid (0x8000001F, NULL, &RegEbx.Uint32, NULL, NULL);
+ if (RegEbx.Bits.CoherencySfwNo == 1) {
+ mSevSnpCoherencySfwNo = TRUE;
+ }
+
+ mSevSnpCoherencySfwNoRead = TRUE;
+ }
+
+ return mSevSnpCoherencySfwNo;
+}
+
+/**
+ Returns a boolean to indicate whether the SEV-SNP cache line eviction
+ mitigation is needed.
+
+ @retval TRUE Cache line eviction mitigation required
+ @retval FALSE Cache line eviction migigation not required
+
+**/
+BOOLEAN
+EFIAPI
+MemEncryptSevSnpDoCoherencyMitigation (
+ VOID
+ )
+{
+ return MemEncryptSevSnpIsEnabled () && !MemEncryptCoherencSfwNo ();
+}
diff --git a/OvmfPkg/Library/BaseMemEncryptSevLib/PeiMemEncryptSevLibInternal.c b/OvmfPkg/Library/BaseMemEncryptSevLib/PeiMemEncryptSevLibInternal.c
index f381b9255b..3eeb4831ab 100644
--- a/OvmfPkg/Library/BaseMemEncryptSevLib/PeiMemEncryptSevLibInternal.c
+++ b/OvmfPkg/Library/BaseMemEncryptSevLib/PeiMemEncryptSevLibInternal.c
@@ -160,3 +160,28 @@ MemEncryptSevEsDebugVirtualizationIsEnabled (
return Msr.Bits.DebugVirtualization ? TRUE : FALSE;
}
+
+/**
+ Returns a boolean to indicate whether the SEV-SNP cache line eviction
+ mitigation is needed.
+
+ @retval TRUE Cache line eviction mitigation required
+ @retval FALSE Cache line eviction migigation not required
+
+**/
+BOOLEAN
+EFIAPI
+MemEncryptSevSnpDoCoherencyMitigation (
+ VOID
+ )
+{
+ SEC_SEV_ES_WORK_AREA *SevEsWorkArea;
+
+ SevEsWorkArea = GetSevEsWorkArea ();
+ if (SevEsWorkArea == NULL) {
+ return FALSE;
+ }
+
+ return MemEncryptSevSnpIsEnabled () &&
+ ((SevEsWorkArea->Flags & SEV_ES_WORK_AREA_FLAG_CSFW_NO) == 0);
+}
diff --git a/OvmfPkg/Library/BaseMemEncryptSevLib/SecMemEncryptSevLibInternal.c b/OvmfPkg/Library/BaseMemEncryptSevLib/SecMemEncryptSevLibInternal.c
index 946bed2ada..05c93de3e5 100644
--- a/OvmfPkg/Library/BaseMemEncryptSevLib/SecMemEncryptSevLibInternal.c
+++ b/OvmfPkg/Library/BaseMemEncryptSevLib/SecMemEncryptSevLibInternal.c
@@ -161,6 +161,31 @@ MemEncryptSevEsDebugVirtualizationIsEnabled (
return Msr.Bits.DebugVirtualization ? TRUE : FALSE;
}
+/**
+ Returns a boolean to indicate whether the SEV-SNP cache line eviction
+ mitigation is needed.
+
+ @retval TRUE Cache line eviction mitigation required
+ @retval FALSE Cache line eviction migigation not required
+
+**/
+BOOLEAN
+EFIAPI
+MemEncryptSevSnpDoCoherencyMitigation (
+ VOID
+ )
+{
+ SEC_SEV_ES_WORK_AREA *SevEsWorkArea;
+
+ SevEsWorkArea = GetSevEsWorkArea ();
+ if (SevEsWorkArea == NULL) {
+ return FALSE;
+ }
+
+ return MemEncryptSevSnpIsEnabled () &&
+ ((SevEsWorkArea->Flags & SEV_ES_WORK_AREA_FLAG_CSFW_NO) == 0);
+}
+
/**
Locate the page range that covers the initial (pre-SMBASE-relocation) SMRAM
Save State Map.
diff --git a/OvmfPkg/Library/BaseMemEncryptSevLib/X64/SnpPageStateChangeInternal.c b/OvmfPkg/Library/BaseMemEncryptSevLib/X64/SnpPageStateChangeInternal.c
index 7b6ba063df..ef3aec4b30 100644
--- a/OvmfPkg/Library/BaseMemEncryptSevLib/X64/SnpPageStateChangeInternal.c
+++ b/OvmfPkg/Library/BaseMemEncryptSevLib/X64/SnpPageStateChangeInternal.c
@@ -315,10 +315,12 @@ InternalSetPageState (
if (State == SevSnpPagePrivate) {
AmdSvsmSnpPvalidate (Info);
- for (Index = 0; Index <= Info->Header.EndEntry; Index++) {
- Address = LShiftU64 ((UINT64)Info->Entry[Index].GuestFrameNumber, EFI_PAGE_SHIFT);
- RmpPageSize = Info->Entry[Index].PageSize;
- SevEvictCache (Address, RmpPageSize == PvalidatePageSize2MB ? PAGES_PER_2MB_ENTRY : 1);
+ if (MemEncryptSevSnpDoCoherencyMitigation ()) {
+ for (Index = 0; Index <= Info->Header.EndEntry; Index++) {
+ Address = LShiftU64 ((UINT64)Info->Entry[Index].GuestFrameNumber, EFI_PAGE_SHIFT);
+ RmpPageSize = Info->Entry[Index].PageSize;
+ SevEvictCache (Address, RmpPageSize == PvalidatePageSize2MB ? PAGES_PER_2MB_ENTRY : 1);
+ }
}
}
}
diff --git a/OvmfPkg/ResetVector/Ia32/AmdSev.asm b/OvmfPkg/ResetVector/Ia32/AmdSev.asm
index de09a59ef7..22b696419a 100644
--- a/OvmfPkg/ResetVector/Ia32/AmdSev.asm
+++ b/OvmfPkg/ResetVector/Ia32/AmdSev.asm
@@ -249,9 +249,19 @@ ClearSevEsWorkArea:
; Check for SEV memory encryption feature:
; CPUID Fn8000_001F[EAX] - Bit 1
+ ; Check for the COHERENCY_SFW_NO feature:
+ ; CPUID Fn8000_001F[EBX] - Bit 31
; CPUID raises a #VC exception if running as an SEV-ES guest
mov eax, 0x8000001f
cpuid
+
+ ; If COHERENCY_SFW_NO is set, set the CSFW_NO bit in the FLAGS field
+ ; of the workarea (this can be set regardless of whether SEV is enabled).
+ bt ebx, 31
+ jnc CheckSev
+ or byte[SEV_ES_WORK_AREA_FLAGS], SEV_ES_WORK_AREA_FLAG_CSFW_NO
+
+CheckSev:
bt eax, 1
jnc NoSev
diff --git a/OvmfPkg/ResetVector/ResetVector.nasmb b/OvmfPkg/ResetVector/ResetVector.nasmb
index a63b859f39..956116fbda 100644
--- a/OvmfPkg/ResetVector/ResetVector.nasmb
+++ b/OvmfPkg/ResetVector/ResetVector.nasmb
@@ -65,6 +65,7 @@
%define SEV_ES_WORK_AREA_ENC_MASK (FixedPcdGet32 (PcdSevEsWorkAreaBase) + 16)
%define SEV_ES_WORK_AREA_FLAGS (FixedPcdGet32 (PcdSevEsWorkAreaBase) + 24)
%define SEV_ES_WORK_AREA_FLAG_VC 0x01
+%define SEV_ES_WORK_AREA_FLAG_CSFW_NO 0x02
%define SEV_ES_VC_TOP_OF_STACK (FixedPcdGet32 (PcdOvmfSecPeiTempRamBase) + FixedPcdGet32 (PcdOvmfSecPeiTempRamSize))
%define SEV_SNP_SECRETS_BASE (FixedPcdGet32 (PcdOvmfSnpSecretsBase))
%define SEV_SNP_SECRETS_SIZE (FixedPcdGet32 (PcdOvmfSnpSecretsSize))
--
2.50.1

102
edk2-OvmfPkg-MemEncryptSevLib-Evict-cache-lines-during-SN.patch Normal file
View File

@ -0,0 +1,102 @@
From b6fd77f13cf1d2e7148609a5263eb0ce39379ba4 Mon Sep 17 00:00:00 2001
From: Tom Lendacky <thomas.lendacky@amd.com>
Date: Tue, 12 Aug 2025 14:43:32 -0500
Subject: [PATCH 1/4] OvmfPkg/MemEncryptSevLib: Evict cache lines during SNP
memory validation
RH-Author: Luigi Leonardi <None>
RH-MergeRequest: 98: OvmfPkg/MemEncryptSevLib: Evict cache lines during SNP memory validation
RH-Jira: RHEL-121983
RH-Acked-by: Gerd Hoffmann <kraxel@redhat.com>
RH-Commit: [1/4] 40511ff2dde07f38d398083d3b29c301bff45807 (luigileonardi/edk2)
An SNP cache coherency vulnerability may require a mitigation to evict
cache lines after memory has been validated. Perform this mitigation
after having validated memory.
CVE-2024-36331
Signed-off-by: Michael Roth <michael.roth@amd.com>
Co-developed-by: Tom Lendacky <thomas.lendacky@amd.com>
Signed-off-by: Tom Lendacky <thomas.lendacky@amd.com>
---
.../X64/SnpPageStateChangeInternal.c | 41 ++++++++++++++++++-
1 file changed, 40 insertions(+), 1 deletion(-)
diff --git a/OvmfPkg/Library/BaseMemEncryptSevLib/X64/SnpPageStateChangeInternal.c b/OvmfPkg/Library/BaseMemEncryptSevLib/X64/SnpPageStateChangeInternal.c
index e073f3937c..7b6ba063df 100644
--- a/OvmfPkg/Library/BaseMemEncryptSevLib/X64/SnpPageStateChangeInternal.c
+++ b/OvmfPkg/Library/BaseMemEncryptSevLib/X64/SnpPageStateChangeInternal.c
@@ -22,6 +22,8 @@
#include "SnpPageStateChange.h"
+#define PAGES_PER_2MB_ENTRY 512
+
STATIC
UINTN
MemoryStateToGhcbOp (
@@ -213,6 +215,33 @@ PageStateChange (
}
}
+STATIC
+VOID
+SevEvictCache (
+ IN EFI_PHYSICAL_ADDRESS Address,
+ IN UINTN NumPages
+ )
+{
+ #if defined (__GNUC__) || defined (__clang__)
+ volatile UINT8 Val __attribute__ ((__unused__));
+ #else
+ volatile UINT8 Val;
+ #endif
+ UINT8 *Bytes = (UINT8 *)Address;
+ UINTN PageIdx;
+
+ /*
+ * For SEV guests, a read from the first/last cache-lines of a 4K page
+ * using the guest key is sufficient to cause a flush of all cache-lines
+ * associated with that 4K page without incurring all the overhead of a
+ * full CLFLUSH sequence.
+ */
+ for (PageIdx = 0; PageIdx < NumPages; PageIdx++) {
+ Val = Bytes[PageIdx * SIZE_4KB];
+ Val = Bytes[PageIdx * SIZE_4KB + SIZE_4KB - 1];
+ }
+}
+
/**
The function is used to set the page state when SEV-SNP is active. The page state
transition consist of changing the page ownership in the RMP table, and using the
@@ -231,8 +260,12 @@ InternalSetPageState (
IN UINTN PscBufferSize
)
{
- EFI_PHYSICAL_ADDRESS NextAddress, EndAddress;
+ EFI_PHYSICAL_ADDRESS NextAddress;
+ EFI_PHYSICAL_ADDRESS EndAddress;
+ EFI_PHYSICAL_ADDRESS Address;
SNP_PAGE_STATE_CHANGE_INFO *Info;
+ UINTN RmpPageSize;
+ UINTN Index;
EndAddress = BaseAddress + EFI_PAGES_TO_SIZE (NumPages);
@@ -281,6 +314,12 @@ InternalSetPageState (
//
if (State == SevSnpPagePrivate) {
AmdSvsmSnpPvalidate (Info);
+
+ for (Index = 0; Index <= Info->Header.EndEntry; Index++) {
+ Address = LShiftU64 ((UINT64)Info->Entry[Index].GuestFrameNumber, EFI_PAGE_SHIFT);
+ RmpPageSize = Info->Entry[Index].PageSize;
+ SevEvictCache (Address, RmpPageSize == PvalidatePageSize2MB ? PAGES_PER_2MB_ENTRY : 1);
+ }
}
}
}
--
2.50.1

98
edk2-OvmfPkg-ResetVector-Make-ReceivedVc-a-flag-in-SEV-ES.patch Normal file
View File

@ -0,0 +1,98 @@
From 234e41cf24326370466cc3c4505e9a262b1b75dd Mon Sep 17 00:00:00 2001
From: Tom Lendacky <thomas.lendacky@amd.com>
Date: Tue, 22 Jul 2025 13:38:22 -0500
Subject: [PATCH 3/4] OvmfPkg/ResetVector: Make ReceivedVc a flag in SEV-ES
workarea
RH-Author: Luigi Leonardi <None>
RH-MergeRequest: 98: OvmfPkg/MemEncryptSevLib: Evict cache lines during SNP memory validation
RH-Jira: RHEL-121983
RH-Acked-by: Gerd Hoffmann <kraxel@redhat.com>
RH-Commit: [3/4] c0ff50547a4ae16b13557d750577be3ca4114c44 (luigileonardi/edk2)
In preparation for adding another indicator flag, change the ReceivedVc
field into a flags field. Since the code is used by both assembler and
C files, use bitmasks for field definitions. The VC flag is bit 0.
Signed-off-by: Tom Lendacky <thomas.lendacky@amd.com>
---
OvmfPkg/Include/WorkArea.h | 10 ++++++----
OvmfPkg/ResetVector/Ia32/AmdSev.asm | 10 +++++-----
OvmfPkg/ResetVector/ResetVector.nasmb | 3 ++-
3 files changed, 13 insertions(+), 10 deletions(-)
diff --git a/OvmfPkg/Include/WorkArea.h b/OvmfPkg/Include/WorkArea.h
index 3b9ea04630..9f3a4517bd 100644
--- a/OvmfPkg/Include/WorkArea.h
+++ b/OvmfPkg/Include/WorkArea.h
@@ -50,11 +50,11 @@ typedef struct _SEC_SEV_ES_WORK_AREA {
UINT64 EncryptionMask;
+ // Flags:
+ // - BIT0 - VC: Indicator that the VC handler was called. It is used
+ // during the SevFeature detection in OvmfPkg/ResetVector/Ia32/AmdSev.asm
//
- // Indicator that the VC handler is called. It is used during the SevFeature
- // detection in OvmfPkg/ResetVector/Ia32/AmdSev.c
- //
- UINT8 ReceivedVc;
+ UINT8 Flags;
UINT8 Reserved[7];
// Used by SEC to generate Page State Change requests. This should be
@@ -64,6 +64,8 @@ typedef struct _SEC_SEV_ES_WORK_AREA {
UINT8 WorkBuffer[1024];
} SEC_SEV_ES_WORK_AREA;
+#define SEV_ES_WORK_AREA_VC BIT0
+
//
// The SEV work area definition.
//
diff --git a/OvmfPkg/ResetVector/Ia32/AmdSev.asm b/OvmfPkg/ResetVector/Ia32/AmdSev.asm
index 827c874312..de09a59ef7 100644
--- a/OvmfPkg/ResetVector/Ia32/AmdSev.asm
+++ b/OvmfPkg/ResetVector/Ia32/AmdSev.asm
@@ -306,9 +306,9 @@ NoSev:
; Perform an SEV-ES sanity check by seeing if a #VC exception occurred.
;
; If SEV-ES is enabled, the CPUID instruction will trigger a #VC exception
- ; where the RECEIVED_VC offset in the workarea will be set to one.
+ ; where the VC bit in the FLAGS field in the workarea will be set to one.
;
- cmp byte[SEV_ES_WORK_AREA_RECEIVED_VC], 0
+ test byte[SEV_ES_WORK_AREA_FLAGS], SEV_ES_WORK_AREA_FLAG_VC
jz NoSevPass
;
@@ -402,9 +402,9 @@ SevEsIdtVmmComm:
; If we're here, then we are an SEV-ES guest and this
; was triggered by a CPUID instruction
;
- ; Set the recievedVc field in the workarea to communicate that
- ; a #VC was taken.
- mov byte[SEV_ES_WORK_AREA_RECEIVED_VC], 1
+ ; Set the VC bit in the FLAGS field in the workarea to communicate
+ ; that a #VC was taken.
+ or byte[SEV_ES_WORK_AREA_FLAGS], SEV_ES_WORK_AREA_FLAG_VC
pop ecx ; Error code
cmp ecx, 0x72 ; Be sure it was CPUID
diff --git a/OvmfPkg/ResetVector/ResetVector.nasmb b/OvmfPkg/ResetVector/ResetVector.nasmb
index 7279ac64b1..a63b859f39 100644
--- a/OvmfPkg/ResetVector/ResetVector.nasmb
+++ b/OvmfPkg/ResetVector/ResetVector.nasmb
@@ -63,7 +63,8 @@
%define SEV_ES_WORK_AREA_STATUS_MSR (FixedPcdGet32 (PcdSevEsWorkAreaBase))
%define SEV_ES_WORK_AREA_RDRAND (FixedPcdGet32 (PcdSevEsWorkAreaBase) + 8)
%define SEV_ES_WORK_AREA_ENC_MASK (FixedPcdGet32 (PcdSevEsWorkAreaBase) + 16)
-%define SEV_ES_WORK_AREA_RECEIVED_VC (FixedPcdGet32 (PcdSevEsWorkAreaBase) + 24)
+%define SEV_ES_WORK_AREA_FLAGS (FixedPcdGet32 (PcdSevEsWorkAreaBase) + 24)
+%define SEV_ES_WORK_AREA_FLAG_VC 0x01
%define SEV_ES_VC_TOP_OF_STACK (FixedPcdGet32 (PcdOvmfSecPeiTempRamBase) + FixedPcdGet32 (PcdOvmfSecPeiTempRamSize))
%define SEV_SNP_SECRETS_BASE (FixedPcdGet32 (PcdOvmfSnpSecretsBase))
%define SEV_SNP_SECRETS_SIZE (FixedPcdGet32 (PcdOvmfSnpSecretsSize))
--
2.50.1

18
edk2.spec
View File

@ -21,7 +21,7 @@ ExclusiveArch: x86_64 aarch64
Name: edk2
Version: %{GITDATE}
Release: 5%{?dist}
Release: 6%{?dist}
Summary: UEFI firmware for 64-bit virtual machines
License: BSD-2-Clause-Patent and Apache-2.0 and MIT
URL: http://www.tianocore.org
@ -101,6 +101,14 @@ Patch40: edk2-OvmfPkg-Add-the-ResetVector-in-TDX-MailBox.patch
Patch41: edk2-OvmfPkg-TdxDxe-Support-5-level-paging-for-ResetVecto.patch
# For RHEL-69780 - Fail to create AMD SEV SLES 15 SP4 guest via virt-install --cdrom [rhel-9.8]
Patch42: edk2-OvmfPkg-IoMmuDxe-Fix-1M-and-2M-buffer-handling.patch
# For RHEL-121983 - [edk2] VM panic on booting SNP guest with large memory on Genoa
Patch43: edk2-OvmfPkg-MemEncryptSevLib-Evict-cache-lines-during-SN.patch
# For RHEL-121983 - [edk2] VM panic on booting SNP guest with large memory on Genoa
Patch44: edk2-MdePkg-Add-the-COHERENCY_SFW_NO-CPUID-bit-field.patch
# For RHEL-121983 - [edk2] VM panic on booting SNP guest with large memory on Genoa
Patch45: edk2-OvmfPkg-ResetVector-Make-ReceivedVc-a-flag-in-SEV-ES.patch
# For RHEL-121983 - [edk2] VM panic on booting SNP guest with large memory on Genoa
Patch46: edk2-OvmfPkg-MemEncryptSevLib-Check-if-SEV-SNP-coherency-.patch
# python3-devel and libuuid-devel are required for building tools.
# python3-devel is also needed for varstore template generation and
@ -436,6 +444,14 @@ install -m 0644 \
%changelog
* Mon Oct 27 2025 Jon Maloy <jmaloy@redhat.com> - 20241117-6
- edk2-OvmfPkg-MemEncryptSevLib-Evict-cache-lines-during-SN.patch [RHEL-121983]
- edk2-MdePkg-Add-the-COHERENCY_SFW_NO-CPUID-bit-field.patch [RHEL-121983]
- edk2-OvmfPkg-ResetVector-Make-ReceivedVc-a-flag-in-SEV-ES.patch [RHEL-121983]
- edk2-OvmfPkg-MemEncryptSevLib-Check-if-SEV-SNP-coherency-.patch [RHEL-121983]
- Resolves: RHEL-121983
([edk2] VM panic on booting SNP guest with large memory on Genoa)
* Mon Oct 20 2025 Jon Maloy <jmaloy@redhat.com> - 20241117-5
- edk2-MdePkg-Acpi66.h-Add-ACPI-6.6-header.patch [RHEL-109010]
- edk2-OvmfPkg-WorkArea.h-Add-MAILBOX_GDT.patch [RHEL-109010]