From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from mail02.groups.io (mail02.groups.io [66.175.222.108]) by spool.mail.gandi.net (Postfix) with ESMTPS id 2537ED81112 for ; Thu, 22 Feb 2024 17:31:56 +0000 (UTC) DKIM-Signature: a=rsa-sha256; bh=EcsOTvFdd1R92aKA1WKl73IRhSe77lMRoyiyubOWQJQ=; c=relaxed/simple; d=groups.io; h=ARC-Seal:ARC-Message-Signature:ARC-Authentication-Results:Received-SPF:From:To:CC:Subject:Date:Message-ID:In-Reply-To:References:MIME-Version:Precedence:List-Subscribe:List-Help:Sender:List-Id:Mailing-List:Delivered-To:Reply-To:List-Unsubscribe-Post:List-Unsubscribe:Content-Transfer-Encoding:Content-Type; s=20140610; t=1708623115; v=1; b=EwILubnfnPw8FQimr8GARHZ7u9uW1bIXrq7391tPTEdOlDhw+5VQh6RGlsLNIQLuFxv/gK+J zd3As8/r043AZumcKls2m4X/S8C3aTAIzrbrTe5yw/X5uo8NhqlnHGGXmKrrie5b79eafaG+iQ2 KsDSIdWgm1JbIcYyOCtrhqiQ= X-Received: by 127.0.0.2 with SMTP id q3KcYY7687511xSSuHx2xsMD; Thu, 22 Feb 2024 09:31:55 -0800 X-Received: from NAM11-BN8-obe.outbound.protection.outlook.com (NAM11-BN8-obe.outbound.protection.outlook.com [40.107.236.41]) by mx.groups.io with SMTP id smtpd.web10.19126.1708623115026251886 for ; Thu, 22 Feb 2024 09:31:55 -0800 ARC-Seal: i=1; a=rsa-sha256; s=arcselector9901; d=microsoft.com; cv=none; b=cRPw95t81oUSskEOoym7fPd27T/dr/JgMpy6hAa7sGO5UPrlTE3rxtrwfpMYtIxXjdUgKh6+cYeRDQBUsQP27D2RUniFD8Q+7EWk3yY+oVnwAaUFjNFE8XyLTUra1spWTBLenCosQPpEWjQgfzgbywkB/609YHcTG76uPmEvkh0PN5j/uRE0sNy/xEfLTr/smaNwofloNMddRVnpG9OeeUUPE7XhNn/+bCZLI3UG8uXrmKfHDVjaYyQHIFAWfondUnLIkzkdl7AzL5pn3Jb5/t5nPSifJgUBihAaF0Dc7Lqo1+Jt5orhBx0Xl94B9qWDi4gydK3A0IuKr8/KE3xLVA== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=arcselector9901; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-AntiSpam-MessageData-ChunkCount:X-MS-Exchange-AntiSpam-MessageData-0:X-MS-Exchange-AntiSpam-MessageData-1; bh=lBMozBa9AFQhGFfH4EeECo9FAgpAcAe1WNNMvnKSgSU=; b=KNkgqJLZOdfnv3Ni3mhCN3ToL4195GfJvKwwZYCRkp9jtv4c9tj0ORZsJHsmDCV8OUTxD3Wzf9Daz0vJGWFokpH8Tzog2d23tbwzM2i+qscyGRY8HGgKI9kGTpqYkJW1VwLbJ66IHlUuR760kAJCwx33rG+yxeuv5hTpJ9iLx/7XnqcbQ86j+6AsfqKtIL+nYzBEUWfLGxltrH9RNaBUONj584T0K/FEXJyj6eYtjDWVKq51ey9Knhf5T1xBmNNcarIt5c4+UnlPxARXuZDTv/LAobQ0cr1Q9jTNcQE2dXDbe+Y/0ySte5J8KtXwkHFyoMqFgT/uvfZuqFc95SKbxQ== ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=pass (sender ip is 165.204.84.17) smtp.rcpttodomain=edk2.groups.io smtp.mailfrom=amd.com; dmarc=pass (p=quarantine sp=quarantine pct=100) action=none header.from=amd.com; dkim=none (message not signed); arc=none (0) X-Received: from BN0PR08CA0004.namprd08.prod.outlook.com (2603:10b6:408:142::22) by MW6PR12MB8867.namprd12.prod.outlook.com (2603:10b6:303:249::6) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.7316.24; Thu, 22 Feb 2024 17:31:52 +0000 X-Received: from BN2PEPF000044A5.namprd04.prod.outlook.com (2603:10b6:408:142:cafe::6e) by BN0PR08CA0004.outlook.office365.com (2603:10b6:408:142::22) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.7292.45 via Frontend Transport; Thu, 22 Feb 2024 17:31:52 +0000 X-MS-Exchange-Authentication-Results: spf=pass (sender IP is 165.204.84.17) smtp.mailfrom=amd.com; dkim=none (message not signed) header.d=none;dmarc=pass action=none header.from=amd.com; Received-SPF: Pass (protection.outlook.com: domain of amd.com designates 165.204.84.17 as permitted sender) receiver=protection.outlook.com; client-ip=165.204.84.17; helo=SATLEXMB04.amd.com; pr=C X-Received: from SATLEXMB04.amd.com (165.204.84.17) by BN2PEPF000044A5.mail.protection.outlook.com (10.167.243.104) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256) id 15.20.7292.25 via Frontend Transport; Thu, 22 Feb 2024 17:31:52 +0000 X-Received: from tlendack-t1.amdoffice.net (10.180.168.240) by SATLEXMB04.amd.com (10.181.40.145) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256) id 15.1.2507.35; Thu, 22 Feb 2024 11:31:51 -0600 From: "Lendacky, Thomas via groups.io" To: CC: Ard Biesheuvel , Erdem Aktas , Gerd Hoffmann , Jiewen Yao , Laszlo Ersek , Liming Gao , Michael D Kinney , Min Xu , Zhiguang Liu , "Rahul Kumar" , Ray Ni , Michael Roth Subject: [edk2-devel] [PATCH v2 14/23] Ovmfpkg/CcSvsmLib: Create CcSvsmLib to handle SVSM related services Date: Thu, 22 Feb 2024 11:29:53 -0600 Message-ID: <56d5ceff99e0be9e4e261476deba6a9b01da5c81.1708623001.git.thomas.lendacky@amd.com> In-Reply-To: References: MIME-Version: 1.0 X-Originating-IP: [10.180.168.240] X-ClientProxiedBy: SATLEXMB03.amd.com (10.181.40.144) To SATLEXMB04.amd.com (10.181.40.145) X-EOPAttributedMessage: 0 X-MS-PublicTrafficType: Email X-MS-TrafficTypeDiagnostic: BN2PEPF000044A5:EE_|MW6PR12MB8867:EE_ X-MS-Office365-Filtering-Correlation-Id: abdb9de1-37d8-45d1-8403-08dc33cc285d X-MS-Exchange-SenderADCheck: 1 X-MS-Exchange-AntiSpam-Relay: 0 X-Microsoft-Antispam-Message-Info: 6qQ6EfvwJzGsMgEnBgYORr4Zm91LxlFbLR2JntOxsMtYFR+Hlpk9Z/Gsi4BeEHSHcR5EilK7syk/P1yhHMNMaXncHzHxvEiNqkLB/U3xDIM+/WdzqoazVRY0UAzNkRfVI31tUUgAjAMCzWgT6MFfG63slVOERTfe6ueVcr2LaWJHh1U6uwyoxavoe5SeooXkvmyZbuwH7m19Q9AX7XDW0sL1JNReu1tfQqQUNhCisBszaq7h18TJqxVhmp7LZxQlFqBRQeVjJx3rWD92o7l1Gq4xqR0/QRodmt8rJ3nNQckBfpEU+8zYlk6n0CUc7DCG2Gxf/UhxN50Kxev5q53kkddEI2GP1plBGlxOMJzkabYs++YEGLD6BAmPiG3m/MJ8DiF2LIg4SDZgDXBP49eQKJuSEDviuqibl2Ta5FJJGDkvzKW4fH3WWeXR9++5wu3gKWeyIpeyMeHAt+zdBK5rIv78ew0aAMmv6H3Ca0+G4kbL5ePdRddVoq2zVdm6NUS81cBue9PQLu0RtsFBhfvACuXFRcuTU4mKIsPmNjtvcqxW1Hxn5Vz5syXESOjRkI3FUJSgaak+XBs/tZuGjp8LaFX3ltMFMJSfo5sQ7br9i0N5IquBA//E1AqMs52ygxdI/PNgH8mlXW9Im1MYDNJwCg== X-OriginatorOrg: amd.com X-MS-Exchange-CrossTenant-OriginalArrivalTime: 22 Feb 2024 17:31:52.2861 (UTC) X-MS-Exchange-CrossTenant-Network-Message-Id: abdb9de1-37d8-45d1-8403-08dc33cc285d X-MS-Exchange-CrossTenant-Id: 3dd8961f-e488-4e60-8e11-a82d994e183d X-MS-Exchange-CrossTenant-OriginalAttributedTenantConnectingIp: TenantId=3dd8961f-e488-4e60-8e11-a82d994e183d;Ip=[165.204.84.17];Helo=[SATLEXMB04.amd.com] X-MS-Exchange-CrossTenant-AuthSource: BN2PEPF000044A5.namprd04.prod.outlook.com X-MS-Exchange-CrossTenant-AuthAs: Anonymous X-MS-Exchange-CrossTenant-FromEntityHeader: HybridOnPrem X-MS-Exchange-Transport-CrossTenantHeadersStamped: MW6PR12MB8867 Precedence: Bulk List-Subscribe: List-Help: Sender: devel@edk2.groups.io List-Id: Mailing-List: list devel@edk2.groups.io; contact devel+owner@edk2.groups.io Reply-To: devel@edk2.groups.io,thomas.lendacky@amd.com List-Unsubscribe-Post: List-Unsubscribe=One-Click List-Unsubscribe: X-Gm-Message-State: bcBpgTMFkatNGLznUy0ohcbpx7686176AA= Content-Transfer-Encoding: quoted-printable Content-Type: text/plain X-GND-Status: LEGIT Authentication-Results: spool.mail.gandi.net; dkim=pass header.d=groups.io header.s=20140610 header.b=EwILubnf; spf=pass (spool.mail.gandi.net: domain of bounce@groups.io designates 66.175.222.108 as permitted sender) smtp.mailfrom=bounce@groups.io; dmarc=pass (policy=none) header.from=groups.io; arc=reject ("signature check failed: fail, {[1] = sig:microsoft.com:reject}") BZ: https://bugzilla.tianocore.org/show_bug.cgi?id=3D4654 Add initial support for the new CcSvsmLib library to OvmfPkg. The initial implementation will fully implement the SVSM presence check API and the SVSM VMPL API, with later patches fully implementing the other interfaces. The SVSM presence check, CcSvsmIsSvsmPresent(), determines the presence of an SVSM by checking if an SVSM has been advertised in the SEV-SNP Secrets Page. The SVSM VMPL API, CcSvsmSnpGetVmpl(), returns the VMPL level at which OVMF is currently running. Signed-off-by: Tom Lendacky --- OvmfPkg/AmdSev/AmdSevX64.dsc | 1 + OvmfPkg/Bhyve/BhyveX64.dsc | 1 + OvmfPkg/CloudHv/CloudHvX64.dsc | 1 + OvmfPkg/IntelTdx/IntelTdxX64.dsc | 1 + OvmfPkg/Microvm/MicrovmX64.dsc | 1 + OvmfPkg/OvmfPkgIa32.dsc | 1 + OvmfPkg/OvmfPkgIa32X64.dsc | 3 +- OvmfPkg/OvmfPkgX64.dsc | 1 + OvmfPkg/OvmfXen.dsc | 1 + OvmfPkg/Library/CcSvsmLib/CcSvsmLib.inf | 38 +++ OvmfPkg/Library/CcSvsmLib/CcSvsmLib.c | 267 ++++++++++++++++++++ 11 files changed, 315 insertions(+), 1 deletion(-) diff --git a/OvmfPkg/AmdSev/AmdSevX64.dsc b/OvmfPkg/AmdSev/AmdSevX64.dsc index a31a89344a60..be0bfe3b017d 100644 --- a/OvmfPkg/AmdSev/AmdSevX64.dsc +++ b/OvmfPkg/AmdSev/AmdSevX64.dsc @@ -208,6 +208,7 @@ [LibraryClasses] [LibraryClasses.common] BaseCryptLib|CryptoPkg/Library/BaseCryptLib/BaseCryptLib.inf CcExitLib|OvmfPkg/Library/CcExitLib/CcExitLib.inf + CcSvsmLib|OvmfPkg/Library/CcSvsmLib/CcSvsmLib.inf TdxLib|MdePkg/Library/TdxLib/TdxLib.inf TdxMailboxLib|OvmfPkg/Library/TdxMailboxLib/TdxMailboxLibNull.inf =20 diff --git a/OvmfPkg/Bhyve/BhyveX64.dsc b/OvmfPkg/Bhyve/BhyveX64.dsc index 9689a2f14efa..69e5c33126a3 100644 --- a/OvmfPkg/Bhyve/BhyveX64.dsc +++ b/OvmfPkg/Bhyve/BhyveX64.dsc @@ -234,6 +234,7 @@ [LibraryClasses] [LibraryClasses.common] BaseCryptLib|CryptoPkg/Library/BaseCryptLib/BaseCryptLib.inf CcExitLib|UefiCpuPkg/Library/CcExitLibNull/CcExitLibNull.inf + CcSvsmLib|UefiCpuPkg/Library/CcSvsmLibNull/CcSvsmLibNull.inf TdxLib|MdePkg/Library/TdxLib/TdxLib.inf =20 [LibraryClasses.common.SEC] diff --git a/OvmfPkg/CloudHv/CloudHvX64.dsc b/OvmfPkg/CloudHv/CloudHvX64.ds= c index b522fa10594d..31d8da0a1a61 100644 --- a/OvmfPkg/CloudHv/CloudHvX64.dsc +++ b/OvmfPkg/CloudHv/CloudHvX64.dsc @@ -244,6 +244,7 @@ [LibraryClasses] [LibraryClasses.common] BaseCryptLib|CryptoPkg/Library/BaseCryptLib/BaseCryptLib.inf CcExitLib|OvmfPkg/Library/CcExitLib/CcExitLib.inf + CcSvsmLib|OvmfPkg/Library/CcSvsmLib/CcSvsmLib.inf TdxLib|MdePkg/Library/TdxLib/TdxLib.inf TdxMailboxLib|OvmfPkg/Library/TdxMailboxLib/TdxMailboxLibNull.inf =20 diff --git a/OvmfPkg/IntelTdx/IntelTdxX64.dsc b/OvmfPkg/IntelTdx/IntelTdxX6= 4.dsc index 82e3e41cfc57..6fbe4bb17573 100644 --- a/OvmfPkg/IntelTdx/IntelTdxX64.dsc +++ b/OvmfPkg/IntelTdx/IntelTdxX64.dsc @@ -215,6 +215,7 @@ [LibraryClasses] [LibraryClasses.common] BaseCryptLib|CryptoPkg/Library/BaseCryptLib/BaseCryptLib.inf CcExitLib|OvmfPkg/Library/CcExitLib/CcExitLib.inf + CcSvsmLib|UefiCpuPkg/Library/CcSvsmLibNull/CcSvsmLibNull.inf TdxLib|MdePkg/Library/TdxLib/TdxLib.inf TdxMailboxLib|OvmfPkg/Library/TdxMailboxLib/TdxMailboxLib.inf PlatformInitLib|OvmfPkg/Library/PlatformInitLib/PlatformInitLib.inf diff --git a/OvmfPkg/Microvm/MicrovmX64.dsc b/OvmfPkg/Microvm/MicrovmX64.ds= c index 063324cd0572..7110c4805acf 100644 --- a/OvmfPkg/Microvm/MicrovmX64.dsc +++ b/OvmfPkg/Microvm/MicrovmX64.dsc @@ -242,6 +242,7 @@ [LibraryClasses] [LibraryClasses.common] BaseCryptLib|CryptoPkg/Library/BaseCryptLib/BaseCryptLib.inf CcExitLib|OvmfPkg/Library/CcExitLib/CcExitLib.inf + CcSvsmLib|OvmfPkg/Library/CcSvsmLib/CcSvsmLib.inf SerialPortLib|MdeModulePkg/Library/BaseSerialPortLib16550/BaseSerialPort= Lib16550.inf PlatformHookLib|MdeModulePkg/Library/BasePlatformHookLibNull/BasePlatfor= mHookLibNull.inf FdtLib|EmbeddedPkg/Library/FdtLib/FdtLib.inf diff --git a/OvmfPkg/OvmfPkgIa32.dsc b/OvmfPkg/OvmfPkgIa32.dsc index 28379961a78e..dc9d7233da15 100644 --- a/OvmfPkg/OvmfPkgIa32.dsc +++ b/OvmfPkg/OvmfPkgIa32.dsc @@ -251,6 +251,7 @@ [LibraryClasses] [LibraryClasses.common] BaseCryptLib|CryptoPkg/Library/BaseCryptLib/BaseCryptLib.inf CcExitLib|UefiCpuPkg/Library/CcExitLibNull/CcExitLibNull.inf + CcSvsmLib|UefiCpuPkg/Library/CcSvsmLibNull/CcSvsmLibNull.inf TdxMailboxLib|OvmfPkg/Library/TdxMailboxLib/TdxMailboxLibNull.inf =20 [LibraryClasses.common.SEC] diff --git a/OvmfPkg/OvmfPkgIa32X64.dsc b/OvmfPkg/OvmfPkgIa32X64.dsc index 5e9eee628aea..afdb33023e85 100644 --- a/OvmfPkg/OvmfPkgIa32X64.dsc +++ b/OvmfPkg/OvmfPkgIa32X64.dsc @@ -4,7 +4,7 @@ # Copyright (c) 2006 - 2023, Intel Corporation. All rights reserved.
# (C) Copyright 2016 Hewlett Packard Enterprise Development LP
# Copyright (c) Microsoft Corporation. -# Copyright (C) 2023 Advanced Micro Devices, Inc. All rights reserved. +# Copyright (C) 2023 - 2024, Advanced Micro Devices, Inc. All rights rese= rved.
# # SPDX-License-Identifier: BSD-2-Clause-Patent # @@ -256,6 +256,7 @@ [LibraryClasses] [LibraryClasses.common] BaseCryptLib|CryptoPkg/Library/BaseCryptLib/BaseCryptLib.inf CcExitLib|UefiCpuPkg/Library/CcExitLibNull/CcExitLibNull.inf + CcSvsmLib|UefiCpuPkg/Library/CcSvsmLibNull/CcSvsmLibNull.inf TdxLib|MdePkg/Library/TdxLib/TdxLib.inf TdxMailboxLib|OvmfPkg/Library/TdxMailboxLib/TdxMailboxLibNull.inf =20 diff --git a/OvmfPkg/OvmfPkgX64.dsc b/OvmfPkg/OvmfPkgX64.dsc index bf4c7906c460..a70aae7c3e77 100644 --- a/OvmfPkg/OvmfPkgX64.dsc +++ b/OvmfPkg/OvmfPkgX64.dsc @@ -272,6 +272,7 @@ [LibraryClasses] [LibraryClasses.common] BaseCryptLib|CryptoPkg/Library/BaseCryptLib/BaseCryptLib.inf CcExitLib|OvmfPkg/Library/CcExitLib/CcExitLib.inf + CcSvsmLib|OvmfPkg/Library/CcSvsmLib/CcSvsmLib.inf TdxLib|MdePkg/Library/TdxLib/TdxLib.inf TdxMailboxLib|OvmfPkg/Library/TdxMailboxLib/TdxMailboxLib.inf =20 diff --git a/OvmfPkg/OvmfXen.dsc b/OvmfPkg/OvmfXen.dsc index 976b795d41c9..d533c5f37be3 100644 --- a/OvmfPkg/OvmfXen.dsc +++ b/OvmfPkg/OvmfXen.dsc @@ -235,6 +235,7 @@ [LibraryClasses] [LibraryClasses.common] BaseCryptLib|CryptoPkg/Library/BaseCryptLib/BaseCryptLib.inf CcExitLib|UefiCpuPkg/Library/CcExitLibNull/CcExitLibNull.inf + CcSvsmLib|UefiCpuPkg/Library/CcSvsmLibNull/CcSvsmLibNull.inf TdxLib|MdePkg/Library/TdxLib/TdxLib.inf =20 [LibraryClasses.common.SEC] diff --git a/OvmfPkg/Library/CcSvsmLib/CcSvsmLib.inf b/OvmfPkg/Library/CcSv= smLib/CcSvsmLib.inf new file mode 100644 index 000000000000..6a57d397d2f6 --- /dev/null +++ b/OvmfPkg/Library/CcSvsmLib/CcSvsmLib.inf @@ -0,0 +1,38 @@ +## @file +# CcExitLib Library. +# +# Copyright (C) 2024, Advanced Micro Devices, Inc. All rights reserved. +# SPDX-License-Identifier: BSD-2-Clause-Patent +# +## + +[Defines] + INF_VERSION =3D 1.29 + BASE_NAME =3D CcSvsmLib + FILE_GUID =3D 288e3588-87d8-4c2c-b568-bf900de0fb36 + MODULE_TYPE =3D BASE + VERSION_STRING =3D 1.0 + LIBRARY_CLASS =3D CcSvsmLib + +# +# The following information is for reference only and not required by the = build tools. +# +# VALID_ARCHITECTURES =3D X64 +# + +[Sources.common] + CcSvsmLib.c + +[Packages] + MdePkg/MdePkg.dec + OvmfPkg/OvmfPkg.dec + UefiCpuPkg/UefiCpuPkg.dec + +[LibraryClasses] + BaseLib + BaseMemoryLib + DebugLib + +[Pcd] + gUefiOvmfPkgTokenSpaceGuid.PcdOvmfSnpSecretsBase + gUefiOvmfPkgTokenSpaceGuid.PcdOvmfSnpSecretsSize diff --git a/OvmfPkg/Library/CcSvsmLib/CcSvsmLib.c b/OvmfPkg/Library/CcSvsm= Lib/CcSvsmLib.c new file mode 100644 index 000000000000..f45ae472783c --- /dev/null +++ b/OvmfPkg/Library/CcSvsmLib/CcSvsmLib.c @@ -0,0 +1,267 @@ +/** @file + SVSM Support Library. + + Copyright (C) 2024, Advanced Micro Devices, Inc. All rights reserved. + SPDX-License-Identifier: BSD-2-Clause-Patent + +**/ + +#include +#include +#include +#include +#include + +#define PAGES_PER_2MB_ENTRY 512 + +/** + Issue a GHCB termination request for termination. + + Request termination using the GHCB MSR protocol. + +**/ +STATIC +VOID +SnpTerminate ( + VOID + ) +{ + MSR_SEV_ES_GHCB_REGISTER Msr; + + // + // Use the GHCB MSR Protocol to request termination by the hypervisor + // + Msr.Uint64 =3D 0; + Msr.GhcbTerminate.Function =3D GHCB_INFO_TERMINATE_REQUEST; + Msr.GhcbTerminate.ReasonCodeSet =3D GHCB_TERMINATE_GHCB; + Msr.GhcbTerminate.ReasonCode =3D GHCB_TERMINATE_GHCB_GENERAL; + AsmWriteMsr64 (MSR_SEV_ES_GHCB, Msr.Uint64); + + AsmVmgExit (); + + ASSERT (FALSE); + CpuDeadLoop (); +} + +/** + Report the presence of an Secure Virtual Services Module (SVSM). + + Determines the presence of an SVSM. + + @retval TRUE An SVSM is present + @retval FALSE An SVSM is not present + +**/ +BOOLEAN +EFIAPI +CcSvsmIsSvsmPresent ( + VOID + ) +{ + SVSM_INFORMATION *SvsmInfo; + + SvsmInfo =3D (SVSM_INFORMATION *)(UINTN)PcdGet32 (PcdOvmfSnpSecretsBase)= ; + + return (SvsmInfo !=3D NULL && SvsmInfo->SvsmSize !=3D 0); +} + +/** + Report the VMPL level at which the SEV-SNP guest is running. + + Determines the VMPL level at which the guest is running. If an SVSM is + not present, then it must be VMPL0, otherwise return what is reported + by the SVSM. + + @return The VMPL level + +**/ +UINT8 +EFIAPI +CcSvsmSnpGetVmpl ( + VOID + ) +{ + SVSM_INFORMATION *SvsmInfo; + + SvsmInfo =3D (SVSM_INFORMATION *)(UINTN)PcdGet32 (PcdOvmfSnpSecretsBase)= ; + + return CcSvsmIsSvsmPresent () ? SvsmInfo->SvsmGuestVmpl : 0; +} + +/** + Report the Calling Area address (CAA) for the BSP of the SEV-SNP guest. + + If an SVSM is present, the CAA for the BSP is returned. + + @return The CAA + +**/ +UINT64 +EFIAPI +CcSvsmSnpGetCaa ( + VOID + ) +{ + SVSM_INFORMATION *SvsmInfo; + + SvsmInfo =3D (SVSM_INFORMATION *)(UINTN)PcdGet32 (PcdOvmfSnpSecretsBase)= ; + + return CcSvsmIsSvsmPresent () ? SvsmInfo->SvsmCaa : 0; +} + +/** + Perform a native PVALIDATE operation for the page ranges specified. + + Validate or rescind the validation of the specified pages. + + @param[in] Info Pointer to a page state change structure + +**/ +STATIC +VOID +BasePvalidate ( + IN SNP_PAGE_STATE_CHANGE_INFO *Info + ) +{ + UINTN RmpPageSize; + UINTN StartIndex; + UINTN EndIndex; + UINTN Index; + UINTN Ret; + EFI_PHYSICAL_ADDRESS Address; + BOOLEAN Validate; + + StartIndex =3D Info->Header.CurrentEntry; + EndIndex =3D Info->Header.EndEntry; + + for ( ; StartIndex <=3D EndIndex; StartIndex++) { + // + // Get the address and the page size from the Info. + // + Address =3D ((EFI_PHYSICAL_ADDRESS)Info->Entry[StartIndex].GuestFr= ameNumber) << EFI_PAGE_SHIFT; + RmpPageSize =3D Info->Entry[StartIndex].PageSize; + Validate =3D Info->Entry[StartIndex].Operation =3D=3D SNP_PAGE_STAT= E_PRIVATE; + + Ret =3D AsmPvalidate (RmpPageSize, Validate, Address); + + // + // If we fail to validate due to size mismatch then try with the + // smaller page size. This senario will occur if the backing page in + // the RMP entry is 4K and we are validating it as a 2MB. + // + if ((Ret =3D=3D PVALIDATE_RET_SIZE_MISMATCH) && (RmpPageSize =3D=3D Pv= alidatePageSize2MB)) { + for (Index =3D 0; Index < PAGES_PER_2MB_ENTRY; Index++) { + Ret =3D AsmPvalidate (PvalidatePageSize4K, Validate, Address); + if (Ret) { + break; + } + + Address =3D Address + EFI_PAGE_SIZE; + } + } + + // + // If validation failed then do not continue. + // + if (Ret) { + DEBUG (( + DEBUG_ERROR, + "%a:%a: Failed to %a address 0x%Lx Error code %d\n", + gEfiCallerBaseName, + __func__, + Validate ? "Validate" : "Invalidate", + Address, + Ret + )); + + SnpTerminate (); + } + } +} + +/** + Perform a PVALIDATE operation for the page ranges specified. + + Validate or rescind the validation of the specified pages. + + @param[in] Info Pointer to a page state change structure + +**/ +VOID +EFIAPI +CcSvsmSnpPvalidate ( + IN SNP_PAGE_STATE_CHANGE_INFO *Info + ) +{ + BasePvalidate (Info); +} + +/** + Perform a native RMPADJUST operation to alter the VMSA setting of a page= . + + Add or remove the VMSA attribute for a page. + + @param[in] Vmsa Pointer to an SEV-ES save area page + @param[in] SetVmsa Boolean indicator as to whether to set o= r + or clear the VMSA setting for the page + + @retval EFI_SUCCESS RMPADJUST operation successful + @retval EFI_INVALID_PARAMETER RMPADJUST operation failed, an invalid + parameter was supplied + +**/ +STATIC +EFI_STATUS +BaseVmsaRmpAdjust ( + IN SEV_ES_SAVE_AREA *Vmsa, + IN BOOLEAN SetVmsa + ) +{ + UINT64 Rdx; + UINT32 Ret; + + // + // The RMPADJUST instruction is used to set or clear the VMSA bit for a + // page. The VMSA change is only made when running at VMPL0 and is ignor= ed + // otherwise. If too low a target VMPL is specified, the instruction can + // succeed without changing the VMSA bit when not running at VMPL0. Usin= g a + // target VMPL level of 1, RMPADJUST will return a FAIL_PERMISSION error= if + // not running at VMPL0, thus ensuring that the VMSA bit is set appropri= ately + // when no error is returned. + // + Rdx =3D 1; + if (SetVmsa) { + Rdx |=3D RMPADJUST_VMSA_PAGE_BIT; + } + + Ret =3D AsmRmpAdjust ((UINT64)(UINTN)Vmsa, 0, Rdx); + + return (Ret =3D=3D 0) ? EFI_SUCCESS : EFI_INVALID_PARAMETER; +} + +/** + Perform an RMPADJUST operation to alter the VMSA setting of a page. + + Add or remove the VMSA attribute for a page. + + @param[in] Vmsa Pointer to an SEV-ES save area page + @param[in] ApicId APIC ID associated with the VMSA + @param[in] SetVmsa Boolean indicator as to whether to set o= r + or clear the VMSA setting for the page + + @retval EFI_SUCCESS RMPADJUST operation successful + @retval EFI_UNSUPPORTED Operation is not supported + @retval EFI_INVALID_PARAMETER RMPADJUST operation failed, an invalid + parameter was supplied + +**/ +EFI_STATUS +EFIAPI +CcSvsmSnpVmsaRmpAdjust ( + IN SEV_ES_SAVE_AREA *Vmsa, + IN UINT32 ApicId, + IN BOOLEAN SetVmsa + ) +{ + return BaseVmsaRmpAdjust (Vmsa, SetVmsa); +} --=20 2.42.0 -=3D-=3D-=3D-=3D-=3D-=3D-=3D-=3D-=3D-=3D-=3D- Groups.io Links: You receive all messages sent to this group. View/Reply Online (#115849): https://edk2.groups.io/g/devel/message/115849 Mute This Topic: https://groups.io/mt/104512963/7686176 Group Owner: devel+owner@edk2.groups.io Unsubscribe: https://edk2.groups.io/g/devel/unsub [rebecca@openfw.io] -=3D-=3D-=3D-=3D-=3D-=3D-=3D-=3D-=3D-=3D-=3D-