From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from NAM10-MW2-obe.outbound.protection.outlook.com (NAM10-MW2-obe.outbound.protection.outlook.com [40.107.94.61]) by mx.groups.io with SMTP id smtpd.web09.11499.1645455580071351595 for ; Mon, 21 Feb 2022 06:59:40 -0800 Authentication-Results: mx.groups.io; dkim=fail reason="body hash did not verify" header.i=@amd.com header.s=selector1 header.b=jsO3VnZm; spf=permerror, err=parse error for token &{10 18 %{i}._ip.%{h}._ehlo.%{d}._spf.vali.email}: invalid domain name (domain: amd.com, ip: 40.107.94.61, mailfrom: brijesh.singh@amd.com) ARC-Seal: i=1; a=rsa-sha256; s=arcselector9901; d=microsoft.com; cv=none; b=T1qJU92q/f361iSf5Or3kQtRZIjRYVCxrYkKyybxaOY0MuWhWbRPE2gSe4Wq/XwEEevn+kZvwHRtJfDP5yIaDoXexPgBJy2MMIxL+thg9vNB5ZEMZa04oBfcWlCj1ZVpKMbnrM9Do6Qy7JWJEWvY6chKXPD7F1V8s3ei15yxwVUxFyIqBulmJY8r8fPstn4tLX21kTrZoFJD+JaAfAO6ofh6gQtvdcnGJGIlu4epk89pQjgP3dGE3mmp9z6L6u4ETMvdVlaDTqICvHUpBLHX1/KR3k8Yo2ddUJN0vA/wpM2xmV0WnC4IGLFP/65neByo72IOCLZFZU+j58fCKSAB6w== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=arcselector9901; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-AntiSpam-MessageData-ChunkCount:X-MS-Exchange-AntiSpam-MessageData-0:X-MS-Exchange-AntiSpam-MessageData-1; bh=HEJ/LWeunTEKbItAK+UvlNBf9idPAB0VkrJfFGXN+Kk=; b=I4sg1pUTHBMkiy6HWcRV5ES/xkesqQxgXqlkPmZxWWB652wy25fqXoOzBBSvL9O1iDPOV45QM0ch9ENGkjuMgBA2FI5Un/2z7ThChYUlOQmfjYyI4ujnpJ+r+UHmyJr4D4gyHU9Uo+jnZThiGfYGnqXVVOh74VWtn9cOMiMtJ683mxQKRCFk8y/GTlela2yqxdYVWL+Nre6bZt+f4xL9jg2MpKgCwKpa0BlwJY90oQw+kYbTY5YjH9CizTX4Vsabl0wuSzo9h617O+LhsU7YFBV/8pYUGgamyyRPlb7Ks0mVQzhgedk4vnxKaVALGR4Zp8Z/Nbl6NjDsXMexPuQQZA== ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=pass (sender ip is 165.204.84.17) smtp.rcpttodomain=edk2.groups.io smtp.mailfrom=amd.com; dmarc=pass (p=quarantine sp=quarantine pct=100) action=none header.from=amd.com; dkim=none (message not signed); arc=none DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=amd.com; s=selector1; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=HEJ/LWeunTEKbItAK+UvlNBf9idPAB0VkrJfFGXN+Kk=; b=jsO3VnZmzkUE5iRwF3PRL1hZx4WLT4uI2GnvFBu0ycmu8zacA9KH3yall39+rgxovT+iBT0oDe3dj38hFQm/swvpHbETU0IielVwzFncUiTOmO+Q432OGFm4JNI8iKLVDfsMmVrAh/k3PYG1qaUQx4Z5LX3zQFUjxbzu9KpN+jg= Received: from DM5PR07CA0104.namprd07.prod.outlook.com (2603:10b6:4:ae::33) by SJ0PR12MB5504.namprd12.prod.outlook.com (2603:10b6:a03:3ad::24) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.4995.16; Mon, 21 Feb 2022 14:59:37 +0000 Received: from DM6NAM11FT063.eop-nam11.prod.protection.outlook.com (2603:10b6:4:ae:cafe::fe) by DM5PR07CA0104.outlook.office365.com (2603:10b6:4:ae::33) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.4995.14 via Frontend Transport; Mon, 21 Feb 2022 14:59:37 +0000 X-MS-Exchange-Authentication-Results: spf=pass (sender IP is 165.204.84.17) smtp.mailfrom=amd.com; dkim=none (message not signed) header.d=none;dmarc=pass action=none header.from=amd.com; Received-SPF: Pass (protection.outlook.com: domain of amd.com designates 165.204.84.17 as permitted sender) receiver=protection.outlook.com; client-ip=165.204.84.17; helo=SATLEXMB04.amd.com; Received: from SATLEXMB04.amd.com (165.204.84.17) by DM6NAM11FT063.mail.protection.outlook.com (10.13.172.219) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256) id 15.20.4995.15 via Frontend Transport; Mon, 21 Feb 2022 14:59:37 +0000 Received: from sbrijesh-desktop.amd.com (10.180.168.240) by SATLEXMB04.amd.com (10.181.40.145) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256) id 15.1.2375.18; Mon, 21 Feb 2022 08:59:35 -0600 From: "Brijesh Singh" To: CC: James Bottomley , Min Xu , "Jiewen Yao" , Tom Lendacky , "Jordan Justen" , Ard Biesheuvel , Erdem Aktas , "Michael Roth" , Gerd Hoffmann , , Brijesh Singh Subject: [PATCH v2 2/2] OvmfPkg/BaseMemEncryptLib: use the SEV_STATUS MSR value from workarea Date: Mon, 21 Feb 2022 08:59:14 -0600 Message-ID: <20220221145914.1972322-3-brijesh.singh@amd.com> X-Mailer: git-send-email 2.25.1 In-Reply-To: <20220221145914.1972322-1-brijesh.singh@amd.com> References: <20220221145914.1972322-1-brijesh.singh@amd.com> MIME-Version: 1.0 Return-Path: brijesh.singh@amd.com X-Originating-IP: [10.180.168.240] X-ClientProxiedBy: SATLEXMB03.amd.com (10.181.40.144) To SATLEXMB04.amd.com (10.181.40.145) X-EOPAttributedMessage: 0 X-MS-PublicTrafficType: Email X-MS-Office365-Filtering-Correlation-Id: e9c951e1-488d-476e-28c3-08d9f54ac7a1 X-MS-TrafficTypeDiagnostic: SJ0PR12MB5504:EE_ X-Microsoft-Antispam-PRVS: X-MS-Exchange-SenderADCheck: 1 X-MS-Exchange-AntiSpam-Relay: 0 X-Microsoft-Antispam: BCL:0; X-Microsoft-Antispam-Message-Info: 9qODMR/BHTeHguyHwiJT0Yv689mXyJpWqbiQ5JQLCuFOsZwRIiVXcngE9BQ9KYqAbagFpuwW3yAtxHRK75lpsL66yjx/BvRA8HwnpdSYR+UQnnd2ErGW1TCyJ3sYy5jJXLhLRZtTntAxwJjELbHo4wHQdKRSoWtI3E8sBIexHtWs5RcAcmsHH/VfZscVb1WXi+uUCZdJdMTYa2Tyi4JlyOF5z24uLskrCxmMGkCDpr/XxfBf5UPyMUD4Zwub7gt7cLQs6Dd5jJeye/zm0E7DQv0luG/7a+1Ha+QgzQ3KBm73qCqGBOUJkZPUxX3mbKPVDXEwucTbryD7CfJfIQ4IzYAakiWX8gMdkRc8rsVLdVL/ckP4GUSZkRs1t6gNW95qXHoxou4umQtfxvfo3E9cNpgYIiDhZl393l+rRdLu5GKIG2BmOd8gfG6VZoDYQnYp/zvL1+xJggo8SqEwCS2YUKqRp5xrtbDtcApfiG31ODtqo6+w/T9ZLdeIJ02Cc78TTc6kBWaQOMiVE0ldJf8MUjav4KbB29+WBIJhsQkTa17GyWHEIwlOFO+TO8Ak1+6dbTzO37fcyfJ8LOyxs41kGcgdPGEGm3pjjwqinvNONGabdNEva2BuSgyolSlPD+RR2Kv6Cg0jOo9CKsYGpotGjUqNZItUWaQtZTdEKpdVk0uL8LTZH8RunR+hyHugnq7EdTmhFdadh8F61X9FSLDizROIHdzOn+azeectancEu6k0xwKOt7m53wx18gcAGSOI7uLR0unv2cJFXOuIhI4B/2Q0irD/K07PN5GcJ5pZ/uM= X-Forefront-Antispam-Report: CIP:165.204.84.17;CTRY:US;LANG:en;SCL:1;SRV:;IPV:CAL;SFV:NSPM;H:SATLEXMB04.amd.com;PTR:InfoDomainNonexistent;CAT:NONE;SFS:(13230001)(4636009)(36840700001)(46966006)(40470700004)(47076005)(16526019)(336012)(186003)(426003)(26005)(30864003)(1076003)(356005)(81166007)(2616005)(2906002)(40460700003)(5660300002)(8936002)(44832011)(36756003)(6666004)(4326008)(82310400004)(508600001)(54906003)(70586007)(8676002)(7696005)(70206006)(83380400001)(36860700001)(316002)(966005)(6916009)(86362001)(36900700001);DIR:OUT;SFP:1101; X-OriginatorOrg: amd.com X-MS-Exchange-CrossTenant-OriginalArrivalTime: 21 Feb 2022 14:59:37.4154 (UTC) X-MS-Exchange-CrossTenant-Network-Message-Id: e9c951e1-488d-476e-28c3-08d9f54ac7a1 X-MS-Exchange-CrossTenant-Id: 3dd8961f-e488-4e60-8e11-a82d994e183d X-MS-Exchange-CrossTenant-OriginalAttributedTenantConnectingIp: TenantId=3dd8961f-e488-4e60-8e11-a82d994e183d;Ip=[165.204.84.17];Helo=[SATLEXMB04.amd.com] X-MS-Exchange-CrossTenant-AuthSource: DM6NAM11FT063.eop-nam11.prod.protection.outlook.com X-MS-Exchange-CrossTenant-AuthAs: Anonymous X-MS-Exchange-CrossTenant-FromEntityHeader: HybridOnPrem X-MS-Exchange-Transport-CrossTenantHeadersStamped: SJ0PR12MB5504 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain BZ: https://bugzilla.tianocore.org/show_bug.cgi?id=3D3582 Improve the MemEncryptSev{Es,Snp}IsEnabled() to use the SEV_STATUS MSR value saved in the workarea. Since workarea is valid until the PEI phase, so, for the Dxe phase use the PcdConfidentialComputingGuestAttr to determine which SEV technology is enabled. Cc: Min Xu Cc: Jiewen Yao Cc: Tom Lendacky Cc: Jordan Justen Cc: Ard Biesheuvel Cc: Erdem Aktas Cc: Gerd Hoffmann Acked-by: Gerd Hoffmann Signed-off-by: Brijesh Singh --- .../DxeMemEncryptSevLib.inf | 1 + .../PeiMemEncryptSevLib.inf | 1 + .../SecMemEncryptSevLib.inf | 1 + .../DxeMemEncryptSevLibInternal.c | 145 ++++++++---------- .../PeiMemEncryptSevLibInternal.c | 139 ++++++----------- .../SecMemEncryptSevLibInternal.c | 80 +++++----- 6 files changed, 155 insertions(+), 212 deletions(-) diff --git a/OvmfPkg/Library/BaseMemEncryptSevLib/DxeMemEncryptSevLib.inf b= /OvmfPkg/Library/BaseMemEncryptSevLib/DxeMemEncryptSevLib.inf index f613bb314f5f..35b7d519d938 100644 --- a/OvmfPkg/Library/BaseMemEncryptSevLib/DxeMemEncryptSevLib.inf +++ b/OvmfPkg/Library/BaseMemEncryptSevLib/DxeMemEncryptSevLib.inf @@ -58,3 +58,4 @@ [FeaturePcd] =20 [Pcd] gEfiMdeModulePkgTokenSpaceGuid.PcdPteMemoryEncryptionAddressOrMask + gEfiMdePkgTokenSpaceGuid.PcdConfidentialComputingGuestAttr diff --git a/OvmfPkg/Library/BaseMemEncryptSevLib/PeiMemEncryptSevLib.inf b= /OvmfPkg/Library/BaseMemEncryptSevLib/PeiMemEncryptSevLib.inf index 50c83859d7e7..714da3323765 100644 --- a/OvmfPkg/Library/BaseMemEncryptSevLib/PeiMemEncryptSevLib.inf +++ b/OvmfPkg/Library/BaseMemEncryptSevLib/PeiMemEncryptSevLib.inf @@ -58,6 +58,7 @@ [FeaturePcd] =20 [FixedPcd] gUefiCpuPkgTokenSpaceGuid.PcdSevEsWorkAreaBase + gUefiOvmfPkgTokenSpaceGuid.PcdOvmfWorkAreaBase gUefiOvmfPkgTokenSpaceGuid.PcdOvmfPeiMemFvBase gUefiOvmfPkgTokenSpaceGuid.PcdOvmfSecPageTablesBase gUefiOvmfPkgTokenSpaceGuid.PcdOvmfSecValidatedEnd diff --git a/OvmfPkg/Library/BaseMemEncryptSevLib/SecMemEncryptSevLib.inf b= /OvmfPkg/Library/BaseMemEncryptSevLib/SecMemEncryptSevLib.inf index 939af0a91ea4..284e5acc1177 100644 --- a/OvmfPkg/Library/BaseMemEncryptSevLib/SecMemEncryptSevLib.inf +++ b/OvmfPkg/Library/BaseMemEncryptSevLib/SecMemEncryptSevLib.inf @@ -52,3 +52,4 @@ [LibraryClasses] =20 [FixedPcd] gUefiCpuPkgTokenSpaceGuid.PcdSevEsWorkAreaBase + gUefiOvmfPkgTokenSpaceGuid.PcdOvmfWorkAreaBase diff --git a/OvmfPkg/Library/BaseMemEncryptSevLib/DxeMemEncryptSevLibIntern= al.c b/OvmfPkg/Library/BaseMemEncryptSevLib/DxeMemEncryptSevLibInternal.c index 15fcd5529587..4aba0075b9e2 100644 --- a/OvmfPkg/Library/BaseMemEncryptSevLib/DxeMemEncryptSevLibInternal.c +++ b/OvmfPkg/Library/BaseMemEncryptSevLib/DxeMemEncryptSevLibInternal.c @@ -16,83 +16,84 @@ #include #include #include +#include =20 -STATIC BOOLEAN mSevStatus =3D FALSE; -STATIC BOOLEAN mSevEsStatus =3D FALSE; -STATIC BOOLEAN mSevSnpStatus =3D FALSE; -STATIC BOOLEAN mSevStatusChecked =3D FALSE; - +STATIC UINT64 mCurrentAttr =3D 0; +STATIC BOOLEAN mCurrentAttrRead =3D FALSE; STATIC UINT64 mSevEncryptionMask =3D 0; STATIC BOOLEAN mSevEncryptionMaskSaved =3D FALSE; =20 /** - Reads and sets the status of SEV features. + The function check if the specified Attr is set. =20 - **/ + @param[in] CurrentAttr The current attribute. + @param[in] Attr The attribute to check. + + @retval TRUE The specified Attr is set. + @retval FALSE The specified Attr is not set. + +**/ +STATIC +BOOLEAN +AmdMemEncryptionAttrCheck ( + IN UINT64 CurrentAttr, + IN CONFIDENTIAL_COMPUTING_GUEST_ATTR Attr + ) +{ + switch (Attr) { + case CCAttrAmdSev: + // + // SEV is automatically enabled if SEV-ES or SEV-SNP is active. + // + return CurrentAttr >=3D CCAttrAmdSev; + case CCAttrAmdSevEs: + // + // SEV-ES is automatically enabled if SEV-SNP is active. + // + return CurrentAttr >=3D CCAttrAmdSevEs; + case CCAttrAmdSevSnp: + return CurrentAttr =3D=3D CCAttrAmdSevSnp; + default: + return FALSE; + } +} + +/** + Check if the specified confidential computing attribute is active. + + @param[in] Attr The attribute to check. + + @retval TRUE The specified Attr is active. + @retval FALSE The specified Attr is not active. + +**/ STATIC -VOID +BOOLEAN EFIAPI -InternalMemEncryptSevStatus ( - VOID +ConfidentialComputingGuestHas ( + IN CONFIDENTIAL_COMPUTING_GUEST_ATTR Attr ) { - UINT32 RegEax; - MSR_SEV_STATUS_REGISTER Msr; - CPUID_MEMORY_ENCRYPTION_INFO_EAX Eax; - BOOLEAN ReadSevMsr; - UINT64 EncryptionMask; - - ReadSevMsr =3D FALSE; - - EncryptionMask =3D PcdGet64 (PcdPteMemoryEncryptionAddressOrMask); - if (EncryptionMask !=3D 0) { - // - // The MSR has been read before, so it is safe to read it again and av= oid - // having to validate the CPUID information. - // - ReadSevMsr =3D TRUE; - } else { - // - // Check if memory encryption leaf exist - // - AsmCpuid (CPUID_EXTENDED_FUNCTION, &RegEax, NULL, NULL, NULL); - if (RegEax >=3D CPUID_MEMORY_ENCRYPTION_INFO) { - // - // CPUID Fn8000_001F[EAX] Bit 1 (Sev supported) - // - AsmCpuid (CPUID_MEMORY_ENCRYPTION_INFO, &Eax.Uint32, NULL, NULL, NUL= L); - - if (Eax.Bits.SevBit) { - ReadSevMsr =3D TRUE; - } - } + // + // Get the current CC attribute. + // + // We avoid reading the PCD on every check because this routine could be= indirectly + // called during the virtual pointer conversion. And its not safe to acc= ess the + // PCDs during the virtual pointer conversion. + // + if (!mCurrentAttrRead) { + mCurrentAttr =3D PcdGet64 (PcdConfidentialComputingGuestAttr); + mCurrentAttrRead =3D TRUE; } =20 - if (ReadSevMsr) { - // - // Check MSR_0xC0010131 Bit 0 (Sev Enabled) - // - Msr.Uint32 =3D AsmReadMsr32 (MSR_SEV_STATUS); - if (Msr.Bits.SevBit) { - mSevStatus =3D TRUE; - } - - // - // Check MSR_0xC0010131 Bit 1 (Sev-Es Enabled) - // - if (Msr.Bits.SevEsBit) { - mSevEsStatus =3D TRUE; - } - - // - // Check MSR_0xC0010131 Bit 2 (Sev-Snp Enabled) - // - if (Msr.Bits.SevSnpBit) { - mSevSnpStatus =3D TRUE; - } + // + // If attr is for the AMD group then call AMD specific checks. + // + if (((RShiftU64 (mCurrentAttr, 8)) & 0xff) =3D=3D 1) { + return AmdMemEncryptionAttrCheck (mCurrentAttr, Attr); } =20 - mSevStatusChecked =3D TRUE; + return (mCurrentAttr =3D=3D Attr); } =20 /** @@ -107,11 +108,7 @@ MemEncryptSevSnpIsEnabled ( VOID ) { - if (!mSevStatusChecked) { - InternalMemEncryptSevStatus (); - } - - return mSevSnpStatus; + return ConfidentialComputingGuestHas (CCAttrAmdSevSnp); } =20 /** @@ -126,11 +123,7 @@ MemEncryptSevEsIsEnabled ( VOID ) { - if (!mSevStatusChecked) { - InternalMemEncryptSevStatus (); - } - - return mSevEsStatus; + return ConfidentialComputingGuestHas (CCAttrAmdSevEs); } =20 /** @@ -145,11 +138,7 @@ MemEncryptSevIsEnabled ( VOID ) { - if (!mSevStatusChecked) { - InternalMemEncryptSevStatus (); - } - - return mSevStatus; + return ConfidentialComputingGuestHas (CCAttrAmdSev); } =20 /** diff --git a/OvmfPkg/Library/BaseMemEncryptSevLib/PeiMemEncryptSevLibIntern= al.c b/OvmfPkg/Library/BaseMemEncryptSevLib/PeiMemEncryptSevLibInternal.c index d68ff08c3ea6..3f8f91a5da12 100644 --- a/OvmfPkg/Library/BaseMemEncryptSevLib/PeiMemEncryptSevLibInternal.c +++ b/OvmfPkg/Library/BaseMemEncryptSevLib/PeiMemEncryptSevLibInternal.c @@ -17,82 +17,51 @@ #include #include =20 -STATIC BOOLEAN mSevStatus =3D FALSE; -STATIC BOOLEAN mSevEsStatus =3D FALSE; -STATIC BOOLEAN mSevSnpStatus =3D FALSE; -STATIC BOOLEAN mSevStatusChecked =3D FALSE; +/** + Read the workarea to determine whether SEV is enabled. If enabled, + then return the SevEsWorkArea pointer. + + **/ +STATIC +SEC_SEV_ES_WORK_AREA * +EFIAPI +GetSevEsWorkArea ( + VOID + ) +{ + OVMF_WORK_AREA *WorkArea; + + WorkArea =3D (OVMF_WORK_AREA *)FixedPcdGet32 (PcdOvmfWorkAreaBase); + + // + // If its not SEV guest then SevEsWorkArea is not valid. + // + if ((WorkArea =3D=3D NULL) || (WorkArea->Header.GuestType !=3D GUEST_TYP= E_AMD_SEV)) { + return NULL; + } =20 -STATIC UINT64 mSevEncryptionMask =3D 0; -STATIC BOOLEAN mSevEncryptionMaskSaved =3D FALSE; + return (SEC_SEV_ES_WORK_AREA *)FixedPcdGet32 (PcdSevEsWorkAreaBase); +} =20 /** - Reads and sets the status of SEV features. + Read the SEV Status MSR value from the workarea =20 **/ STATIC -VOID +UINT32 EFIAPI InternalMemEncryptSevStatus ( VOID ) { - UINT32 RegEax; - MSR_SEV_STATUS_REGISTER Msr; - CPUID_MEMORY_ENCRYPTION_INFO_EAX Eax; - BOOLEAN ReadSevMsr; - SEC_SEV_ES_WORK_AREA *SevEsWorkArea; + SEC_SEV_ES_WORK_AREA *SevEsWorkArea; =20 - ReadSevMsr =3D FALSE; - - SevEsWorkArea =3D (SEC_SEV_ES_WORK_AREA *)FixedPcdGet32 (PcdSevEsWorkAre= aBase); - if ((SevEsWorkArea !=3D NULL) && (SevEsWorkArea->EncryptionMask !=3D 0))= { - // - // The MSR has been read before, so it is safe to read it again and av= oid - // having to validate the CPUID information. - // - ReadSevMsr =3D TRUE; - } else { - // - // Check if memory encryption leaf exist - // - AsmCpuid (CPUID_EXTENDED_FUNCTION, &RegEax, NULL, NULL, NULL); - if (RegEax >=3D CPUID_MEMORY_ENCRYPTION_INFO) { - // - // CPUID Fn8000_001F[EAX] Bit 1 (Sev supported) - // - AsmCpuid (CPUID_MEMORY_ENCRYPTION_INFO, &Eax.Uint32, NULL, NULL, NUL= L); - - if (Eax.Bits.SevBit) { - ReadSevMsr =3D TRUE; - } - } - } - - if (ReadSevMsr) { - // - // Check MSR_0xC0010131 Bit 0 (Sev Enabled) - // - Msr.Uint32 =3D AsmReadMsr32 (MSR_SEV_STATUS); - if (Msr.Bits.SevBit) { - mSevStatus =3D TRUE; - } - - // - // Check MSR_0xC0010131 Bit 1 (Sev-Es Enabled) - // - if (Msr.Bits.SevEsBit) { - mSevEsStatus =3D TRUE; - } - - // - // Check MSR_0xC0010131 Bit 2 (Sev-Snp Enabled) - // - if (Msr.Bits.SevSnpBit) { - mSevSnpStatus =3D TRUE; - } + SevEsWorkArea =3D GetSevEsWorkArea (); + if (SevEsWorkArea =3D=3D NULL) { + return 0; } =20 - mSevStatusChecked =3D TRUE; + return (UINT32)(UINTN)SevEsWorkArea->SevStatusMsrValue; } =20 /** @@ -107,11 +76,11 @@ MemEncryptSevSnpIsEnabled ( VOID ) { - if (!mSevStatusChecked) { - InternalMemEncryptSevStatus (); - } + MSR_SEV_STATUS_REGISTER Msr; =20 - return mSevSnpStatus; + Msr.Uint32 =3D InternalMemEncryptSevStatus (); + + return Msr.Bits.SevSnpBit ? TRUE : FALSE; } =20 /** @@ -126,11 +95,11 @@ MemEncryptSevEsIsEnabled ( VOID ) { - if (!mSevStatusChecked) { - InternalMemEncryptSevStatus (); - } + MSR_SEV_STATUS_REGISTER Msr; =20 - return mSevEsStatus; + Msr.Uint32 =3D InternalMemEncryptSevStatus (); + + return Msr.Bits.SevEsBit ? TRUE : FALSE; } =20 /** @@ -145,11 +114,11 @@ MemEncryptSevIsEnabled ( VOID ) { - if (!mSevStatusChecked) { - InternalMemEncryptSevStatus (); - } + MSR_SEV_STATUS_REGISTER Msr; =20 - return mSevStatus; + Msr.Uint32 =3D InternalMemEncryptSevStatus (); + + return Msr.Bits.SevBit ? TRUE : FALSE; } =20 /** @@ -163,24 +132,12 @@ MemEncryptSevGetEncryptionMask ( VOID ) { - if (!mSevEncryptionMaskSaved) { - SEC_SEV_ES_WORK_AREA *SevEsWorkArea; + SEC_SEV_ES_WORK_AREA *SevEsWorkArea; =20 - SevEsWorkArea =3D (SEC_SEV_ES_WORK_AREA *)FixedPcdGet32 (PcdSevEsWorkA= reaBase); - if (SevEsWorkArea !=3D NULL) { - mSevEncryptionMask =3D SevEsWorkArea->EncryptionMask; - } else { - CPUID_MEMORY_ENCRYPTION_INFO_EBX Ebx; - - // - // CPUID Fn8000_001F[EBX] Bit 0:5 (memory encryption bit position) - // - AsmCpuid (CPUID_MEMORY_ENCRYPTION_INFO, NULL, &Ebx.Uint32, NULL, NUL= L); - mSevEncryptionMask =3D LShiftU64 (1, Ebx.Bits.PtePosBits); - } - - mSevEncryptionMaskSaved =3D TRUE; + SevEsWorkArea =3D GetSevEsWorkArea (); + if (SevEsWorkArea =3D=3D NULL) { + return 0; } =20 - return mSevEncryptionMask; + return SevEsWorkArea->EncryptionMask; } diff --git a/OvmfPkg/Library/BaseMemEncryptSevLib/SecMemEncryptSevLibIntern= al.c b/OvmfPkg/Library/BaseMemEncryptSevLib/SecMemEncryptSevLibInternal.c index 5d912b2a4a5e..80aceba01bcf 100644 --- a/OvmfPkg/Library/BaseMemEncryptSevLib/SecMemEncryptSevLibInternal.c +++ b/OvmfPkg/Library/BaseMemEncryptSevLib/SecMemEncryptSevLibInternal.c @@ -18,7 +18,33 @@ #include =20 /** - Reads and sets the status of SEV features. + Read the workarea to determine whether SEV is enabled. If enabled, + then return the SevEsWorkArea pointer. + + **/ +STATIC +SEC_SEV_ES_WORK_AREA * +EFIAPI +GetSevEsWorkArea ( + VOID + ) +{ + OVMF_WORK_AREA *WorkArea; + + WorkArea =3D (OVMF_WORK_AREA *)FixedPcdGet32 (PcdOvmfWorkAreaBase); + + // + // If its not SEV guest then SevEsWorkArea is not valid. + // + if ((WorkArea =3D=3D NULL) || (WorkArea->Header.GuestType !=3D GUEST_TYP= E_AMD_SEV)) { + return NULL; + } + + return (SEC_SEV_ES_WORK_AREA *)FixedPcdGet32 (PcdSevEsWorkAreaBase); +} + +/** + Read the SEV Status MSR value from the workarea =20 **/ STATIC @@ -28,38 +54,14 @@ InternalMemEncryptSevStatus ( VOID ) { - UINT32 RegEax; - CPUID_MEMORY_ENCRYPTION_INFO_EAX Eax; - BOOLEAN ReadSevMsr; - SEC_SEV_ES_WORK_AREA *SevEsWorkArea; + SEC_SEV_ES_WORK_AREA *SevEsWorkArea; =20 - ReadSevMsr =3D FALSE; - - SevEsWorkArea =3D (SEC_SEV_ES_WORK_AREA *)FixedPcdGet32 (PcdSevEsWorkAre= aBase); - if ((SevEsWorkArea !=3D NULL) && (SevEsWorkArea->EncryptionMask !=3D 0))= { - // - // The MSR has been read before, so it is safe to read it again and av= oid - // having to validate the CPUID information. - // - ReadSevMsr =3D TRUE; - } else { - // - // Check if memory encryption leaf exist - // - AsmCpuid (CPUID_EXTENDED_FUNCTION, &RegEax, NULL, NULL, NULL); - if (RegEax >=3D CPUID_MEMORY_ENCRYPTION_INFO) { - // - // CPUID Fn8000_001F[EAX] Bit 1 (Sev supported) - // - AsmCpuid (CPUID_MEMORY_ENCRYPTION_INFO, &Eax.Uint32, NULL, NULL, NUL= L); - - if (Eax.Bits.SevBit) { - ReadSevMsr =3D TRUE; - } - } + SevEsWorkArea =3D GetSevEsWorkArea (); + if (SevEsWorkArea =3D=3D NULL) { + return 0; } =20 - return ReadSevMsr ? AsmReadMsr32 (MSR_SEV_STATUS) : 0; + return (UINT32)(UINTN)SevEsWorkArea->SevStatusMsrValue; } =20 /** @@ -130,22 +132,14 @@ MemEncryptSevGetEncryptionMask ( VOID ) { - CPUID_MEMORY_ENCRYPTION_INFO_EBX Ebx; - SEC_SEV_ES_WORK_AREA *SevEsWorkArea; - UINT64 EncryptionMask; + SEC_SEV_ES_WORK_AREA *SevEsWorkArea; =20 - SevEsWorkArea =3D (SEC_SEV_ES_WORK_AREA *)FixedPcdGet32 (PcdSevEsWorkAre= aBase); - if (SevEsWorkArea !=3D NULL) { - EncryptionMask =3D SevEsWorkArea->EncryptionMask; - } else { - // - // CPUID Fn8000_001F[EBX] Bit 0:5 (memory encryption bit position) - // - AsmCpuid (CPUID_MEMORY_ENCRYPTION_INFO, NULL, &Ebx.Uint32, NULL, NULL)= ; - EncryptionMask =3D LShiftU64 (1, Ebx.Bits.PtePosBits); + SevEsWorkArea =3D GetSevEsWorkArea (); + if (SevEsWorkArea =3D=3D NULL) { + return 0; } =20 - return EncryptionMask; + return SevEsWorkArea->EncryptionMask; } =20 /** --=20 2.25.1