From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from NAM12-MW2-obe.outbound.protection.outlook.com (NAM12-MW2-obe.outbound.protection.outlook.com [40.107.244.55]) by mx.groups.io with SMTP id smtpd.web12.2803.1608065530452844492 for ; Tue, 15 Dec 2020 12:52:10 -0800 Authentication-Results: mx.groups.io; dkim=fail reason="body hash did not verify" header.i=@amdcloud.onmicrosoft.com header.s=selector2-amdcloud-onmicrosoft-com header.b=hNjOR73E; spf=permerror, err=parse error for token &{10 18 %{i}._ip.%{h}._ehlo.%{d}._spf.vali.email}: invalid domain name (domain: amd.com, ip: 40.107.244.55, mailfrom: thomas.lendacky@amd.com) ARC-Seal: i=1; a=rsa-sha256; s=arcselector9901; d=microsoft.com; cv=none; b=Zi7ZYI5HS4TxIKo05oAkjA4lkUR5JjGqDJMS5HNMFHbu0Tkz0EZZMisLyM9ptBKzSAD/AFA/iXmLxT57Z0eBk6xXDLBlukp+GtCIxxH4gc0zsqsqzSXODLzzDaURV6Im7rPmkchZrvW6RqVeOIWq6M2UcQEanRFZRRNK9AWaDg9JXWHdWT4IoRTHZ5Nke0hcC0PJbSTe+lEJdXUPwERUus0Kh7P2CjGZBdrvhTxlfLCByaeXDAkUZZ+dwnPSA9T/K3RfRfF156xHb/S67IVEyAcTAabPP4URNVPHFg5lBDX/bzrwWjQJjoeWOh2YJVQThT97eHhZZiL4jyGrV1hYcw== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=arcselector9901; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=7Pqvf+InDRjjJXAKthrhzJRl4H2D/8lUxDfxhodEX60=; b=JF0TOVUK2TnuhlJ0s1i3ZqB+YnHwUMY8itkjHh/1zpyY3lRUyoe2UejENw4bK/8AbS1Tmq3AjBjBPcf3Qtv1nYKGpaOJ6XCS3XCFwdDAd8iVxqJH/BHGHTS1923STADwAhiUZ4ABJivT5tu61MvWc3bvkM9c3Do2qKdUjlVtZpA0zYRFTte5S9O3mUOmwCXVGtuMMA3qn/PcBG9nha3p7cmpQrD940+gnt5OIF6+7YDjdll3gZdXQ8orycd8xrQLddQfBZ8t/D9mF3TU/YsOx/n1PH7gwkbFqRqOZ+oOO3LRvRINdigzA8kh5PRpFkaSiEVe5Nrozk1+7x5zU9v+TQ== ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=pass smtp.mailfrom=amd.com; dmarc=pass action=none header.from=amd.com; dkim=pass header.d=amd.com; arc=none DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=amdcloud.onmicrosoft.com; s=selector2-amdcloud-onmicrosoft-com; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=7Pqvf+InDRjjJXAKthrhzJRl4H2D/8lUxDfxhodEX60=; b=hNjOR73EprGFcRPePT5hiUV0gmY3J4oEd818hLvfb2VDreqrMs3LROcfTt0dAQyzjwMh2tZWOgr/f3CKy2mXXaC0r15P8YEvVpIgSz4h04mi/wr2Pc27dImNSsruaHJj6S/Nz80IqQ3bEoxpHrKW/PS+2K/l72CGUm8t+rZMQJM= Authentication-Results: edk2.groups.io; dkim=none (message not signed) header.d=none;edk2.groups.io; dmarc=none action=none header.from=amd.com; Received: from DM5PR12MB1355.namprd12.prod.outlook.com (10.168.234.7) by DM6PR12MB4155.namprd12.prod.outlook.com (10.141.8.79) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.3654.15; Tue, 15 Dec 2020 20:52:06 +0000 Received: from DM5PR12MB1355.namprd12.prod.outlook.com ([fe80::d95e:b9d:1d6a:e845]) by DM5PR12MB1355.namprd12.prod.outlook.com ([fe80::d95e:b9d:1d6a:e845%12]) with mapi id 15.20.3654.025; Tue, 15 Dec 2020 20:52:06 +0000 From: "Lendacky, Thomas" To: devel@edk2.groups.io CC: Brijesh Singh , James Bottomley , Jordan Justen , Laszlo Ersek , Ard Biesheuvel , Rebecca Cran , Peter Grehan , Anthony Perard , Julien Grall Subject: [PATCH 05/12] OvmfPkg/MemEncryptSevLib: Add an interface to retrieve the encryption mask Date: Tue, 15 Dec 2020 14:51:04 -0600 Message-ID: X-Mailer: git-send-email 2.28.0 In-Reply-To: References: X-Originating-IP: [165.204.77.1] X-ClientProxiedBy: CH2PR10CA0014.namprd10.prod.outlook.com (2603:10b6:610:4c::24) To DM5PR12MB1355.namprd12.prod.outlook.com (2603:10b6:3:6e::7) Return-Path: thomas.lendacky@amd.com MIME-Version: 1.0 X-MS-Exchange-MessageSentRepresentingType: 1 Received: from tlendack-t1.amd.com (165.204.77.1) by CH2PR10CA0014.namprd10.prod.outlook.com (2603:10b6:610:4c::24) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.3654.12 via Frontend Transport; Tue, 15 Dec 2020 20:52:05 +0000 X-MS-PublicTrafficType: Email X-MS-Office365-Filtering-HT: Tenant X-MS-Office365-Filtering-Correlation-Id: 308a5d3d-979a-431c-4ea8-08d8a13b48b5 X-MS-TrafficTypeDiagnostic: DM6PR12MB4155: X-MS-Exchange-Transport-Forked: True X-Microsoft-Antispam-PRVS: X-MS-Oob-TLC-OOBClassifiers: OLM:9508; X-MS-Exchange-SenderADCheck: 1 X-Microsoft-Antispam: BCL:0; X-Microsoft-Antispam-Message-Info: UxFOvBmjzLeLkPPyRurUfewdLfL4gAYS6iLpv3uOV8TaPHfVfFQEj+g9XAHiD23Olviqcn7qpQUgMp7Zb/rm6pJz1bHcl0ZVCeAPDRyvhZJeZtRrRnDQzYo6e1olQECGzBV/9f8Y8KnNfo9KtRQLVZQREONjJ2UwyErl5MRiusYluw5VovPcCkvkPAyj1U3EybylnQqh6IQJMmpHdHzw11oGu1/IRdEYiwldVyI4rvvPjJZZyzWjqfESEmYIOpkpxX7rSpM8ofjUQqN4MHo2srjZ3G4zJyq0Pv/vqOlizkJfwj33Qwc3swjF+6xIgATIKFUkWlrEQVwzeM4vukX7n3BUYxDJ8QH6aErzpE6C0J61i23703WLJJpT7QfdS3o0eBw5UKXwRIcTr8u+PbaTjwZZL6NnSh05dd7WYMIx/9UYqFxsvyFM/AyLkc4inSgJ7Gc4IYBubwVfLAnYHKLT1g== X-Forefront-Antispam-Report: CIP:255.255.255.255;CTRY:;LANG:en;SCL:1;SRV:;IPV:NLI;SFV:NSPM;H:DM5PR12MB1355.namprd12.prod.outlook.com;PTR:;CAT:NONE;SFS:(4636009)(376002)(366004)(136003)(346002)(66946007)(26005)(4326008)(19627235002)(16526019)(6916009)(8676002)(36756003)(508600001)(52116002)(30864003)(83380400001)(5660300002)(8936002)(966005)(186003)(54906003)(956004)(2616005)(66476007)(2906002)(86362001)(34490700003)(6486002)(66556008)(7696005);DIR:OUT;SFP:1101; X-MS-Exchange-AntiSpam-MessageData: =?us-ascii?Q?FvjAFkk6o90MrK1NTE38btIWTLYAsd+sKF0n5jjVSNOYw+QnV6GxuvKt5cMO?= =?us-ascii?Q?E+lZLT+7zL8xXzLp6yWdRWG6qbBs1ecHZ7pQZWfiWyPiyU5AiUaDvCUkHuHG?= =?us-ascii?Q?UAKEzHauN9vkUOSax2kxHfbbq+py5guPJvd7cEz8vTSbzoKa00llEBAJAZgC?= =?us-ascii?Q?MUQfPsF5WdugjICIfHk52MRLNPGooB+415uF2vQdNH6UkGPRr+QOTTWMaBUU?= =?us-ascii?Q?ZNYMZPn3DiIug4kXADKhV782ECBqRYVUsnXGfDqMgCgPNb7SSvqhJHmQ1BZ5?= =?us-ascii?Q?0ezCm1qqbHYhNffTK48H8byE5Dy9FxMgwi/jInBWD40/Kl3T+FU7gf4jP+PM?= =?us-ascii?Q?cM/c46U8b9C1nIn5luyCPlu8+et+tEBj1XHUJUr/jSTXYOeA1O09nNlgUqag?= =?us-ascii?Q?7qdvKUr8lcdf+9EcbxWWsga4pWP64WvABM5QeXznO+ldv1GCbFKVvR1aOCsE?= =?us-ascii?Q?xG3ddwG1UqJSf1bSJY7fZYxKCshMi4dkWHnurspUG3AwnY/avIObX87oeSEk?= =?us-ascii?Q?9JMr6ym/j9DjSCG3wz4ZEXY+XP9guAB1E+8uTtclPZETX+MekGZIS/lbfHqW?= =?us-ascii?Q?294N6KtRWM4tCP/cLMc7KO0vUc0yfLld/1C9ULcA0Edei8FQCDE5jGvclo0C?= =?us-ascii?Q?GyDdgzw3DLzKJCYwLt23AaEl44R5I06bxdPdBn5hnnwP2Me19LzQA13IpnGy?= =?us-ascii?Q?1mQnEDCabLQUluhRnCs7gBVltZYSTkxdfKHoBSXTUoz4ucFXfcBkWuYYKxtM?= =?us-ascii?Q?45nHZrew12owNFd6t3OV0Btyzzqz/FnVJmEdtmvdKcbooegxDOcmV9qneR0d?= =?us-ascii?Q?Um2H7Dt4sZaqgbaNf2uP9kUAEAi4UnY69XbH0llIoK9CitiR9bonnEheQywq?= =?us-ascii?Q?lo5q7nDMR24dsioP3t1iCWbDicf9Hp87GTaBWeWQ6zSOFnoAFeHSErNqEWZO?= =?us-ascii?Q?Key07Rew8Zf9Q21VGEQDDXjT5QMLZNu/cL/00Y00ZJASsQ7mkYPZN+Kv+dTX?= =?us-ascii?Q?YavR?= X-OriginatorOrg: amd.com X-MS-Exchange-CrossTenant-AuthSource: DM5PR12MB1355.namprd12.prod.outlook.com X-MS-Exchange-CrossTenant-AuthAs: Internal X-MS-Exchange-CrossTenant-OriginalArrivalTime: 15 Dec 2020 20:52:06.5510 (UTC) X-MS-Exchange-CrossTenant-FromEntityHeader: Hosted X-MS-Exchange-CrossTenant-Id: 3dd8961f-e488-4e60-8e11-a82d994e183d X-MS-Exchange-CrossTenant-Network-Message-Id: 308a5d3d-979a-431c-4ea8-08d8a13b48b5 X-MS-Exchange-CrossTenant-MailboxType: HOSTED X-MS-Exchange-CrossTenant-UserPrincipalName: f1zP629/TiZvHK4gWgMOyICcYMYaXQ1cF5Z7A9fBjCbANJY/AaaLQm3GeomLW/qVvyzUbI1WxC5Mrdcy/tgJ6Q== X-MS-Exchange-Transport-CrossTenantHeadersStamped: DM6PR12MB4155 Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: quoted-printable From: Tom Lendacky BZ: https://bugzilla.tianocore.org/show_bug.cgi?id=3D3108 The early assembler code performs validation for some of the SEV-related information, specifically the encryption bit position. To avoid having to re-validate the encryption bit position as the system proceeds through its boot phases, use the saved information from the SEV-ES work area during PEI and PcdPteMemoryEncryptionAddressOrMask (set during PEI) during DXE. To ensure that we always use a validated encryption mask for an SEV-ES guest, create a new interface in the MemEncryptSevLib library to return the encryption mask. This avoids the multiple locations where CPUID is used to retrieve the value and allows the validated mask to be returned. Update all locations that use CPUID to calculate the encryption mask to use the new interface. Also, clean up some call areas where extra masking was being performed and where a function call was being used instead of the local variable that was just set using the function. Cc: Jordan Justen Cc: Laszlo Ersek Cc: Ard Biesheuvel Cc: Rebecca Cran Cc: Peter Grehan Cc: Anthony Perard Cc: Julien Grall Cc: Brijesh Singh Signed-off-by: Tom Lendacky --- OvmfPkg/AmdSev/AmdSevX64.dsc | 4 +- OvmfPkg/Bhyve/BhyveX64.dsc | 4 +- OvmfPkg/OvmfPkgIa32.dsc | 4 +- OvmfPkg/OvmfPkgIa32X64.dsc | 4 +- OvmfPkg/OvmfPkgX64.dsc | 4 +- OvmfPkg/OvmfXen.dsc | 3 +- ...SevLib.inf =3D> DxeBaseMemEncryptSevLib.inf} | 13 +- .../PeiBaseMemEncryptSevLib.inf | 56 ++++++ OvmfPkg/Include/Library/MemEncryptSevLib.h | 14 ++ OvmfPkg/Bhyve/PlatformPei/AmdSev.c | 12 +- .../DxeMemEncryptSevLibInternal.c | 145 ++++++++++++++++ .../MemEncryptSevLibInternal.c | 91 +--------- .../PeiMemEncryptSevLibInternal.c | 159 ++++++++++++++++++ .../BaseMemEncryptSevLib/X64/VirtualMemory.c | 15 +- OvmfPkg/PlatformPei/AmdSev.c | 12 +- OvmfPkg/XenPlatformPei/AmdSev.c | 12 +- OvmfPkg/ResetVector/Ia32/PageTables64.asm | 10 +- OvmfPkg/ResetVector/ResetVector.nasmb | 1 + 18 files changed, 422 insertions(+), 141 deletions(-) rename OvmfPkg/Library/BaseMemEncryptSevLib/{BaseMemEncryptSevLib.inf =3D>= DxeBaseMemEncryptSevLib.inf} (67%) create mode 100644 OvmfPkg/Library/BaseMemEncryptSevLib/PeiBaseMemEncryptS= evLib.inf create mode 100644 OvmfPkg/Library/BaseMemEncryptSevLib/DxeMemEncryptSevLi= bInternal.c create mode 100644 OvmfPkg/Library/BaseMemEncryptSevLib/PeiMemEncryptSevLi= bInternal.c diff --git a/OvmfPkg/AmdSev/AmdSevX64.dsc b/OvmfPkg/AmdSev/AmdSevX64.dsc index bb7697eb324b..c742ec54cb57 100644 --- a/OvmfPkg/AmdSev/AmdSevX64.dsc +++ b/OvmfPkg/AmdSev/AmdSevX64.dsc @@ -164,7 +164,7 @@ [LibraryClasses] QemuFwCfgSimpleParserLib|OvmfPkg/Library/QemuFwCfgSimpleParserLib/QemuFw= CfgSimpleParserLib.inf VirtioLib|OvmfPkg/Library/VirtioLib/VirtioLib.inf LoadLinuxLib|OvmfPkg/Library/LoadLinuxLib/LoadLinuxLib.inf - MemEncryptSevLib|OvmfPkg/Library/BaseMemEncryptSevLib/BaseMemEncryptSevL= ib.inf + MemEncryptSevLib|OvmfPkg/Library/BaseMemEncryptSevLib/DxeBaseMemEncryptS= evLib.inf LockBoxLib|OvmfPkg/Library/LockBoxLib/LockBoxBaseLib.inf CustomizedDisplayLib|MdeModulePkg/Library/CustomizedDisplayLib/Customize= dDisplayLib.inf FrameBufferBltLib|MdeModulePkg/Library/FrameBufferBltLib/FrameBufferBltL= ib.inf @@ -285,6 +285,8 @@ [LibraryClasses.common.PEIM] Tpm2DeviceLib|SecurityPkg/Library/Tpm2DeviceLibDTpm/Tpm2DeviceLibDTpm.in= f !endif =20 + MemEncryptSevLib|OvmfPkg/Library/BaseMemEncryptSevLib/PeiBaseMemEncryptS= evLib.inf + [LibraryClasses.common.DXE_CORE] HobLib|MdePkg/Library/DxeCoreHobLib/DxeCoreHobLib.inf DxeCoreEntryPoint|MdePkg/Library/DxeCoreEntryPoint/DxeCoreEntryPoint.inf diff --git a/OvmfPkg/Bhyve/BhyveX64.dsc b/OvmfPkg/Bhyve/BhyveX64.dsc index b93fe30ae4e0..27973bc940d5 100644 --- a/OvmfPkg/Bhyve/BhyveX64.dsc +++ b/OvmfPkg/Bhyve/BhyveX64.dsc @@ -163,7 +163,7 @@ [LibraryClasses] QemuFwCfgS3Lib|OvmfPkg/Library/QemuFwCfgS3Lib/BaseQemuFwCfgS3LibNull.inf BhyveFwCtlLib|OvmfPkg/Library/BhyveFwCtlLib/BhyveFwCtlLib.inf VirtioLib|OvmfPkg/Library/VirtioLib/VirtioLib.inf - MemEncryptSevLib|OvmfPkg/Library/BaseMemEncryptSevLib/BaseMemEncryptSevL= ib.inf + MemEncryptSevLib|OvmfPkg/Library/BaseMemEncryptSevLib/DxeBaseMemEncryptS= evLib.inf LockBoxLib|OvmfPkg/Library/LockBoxLib/LockBoxBaseLib.inf =20 CustomizedDisplayLib|MdeModulePkg/Library/CustomizedDisplayLib/Customize= dDisplayLib.inf @@ -292,6 +292,8 @@ [LibraryClasses.common.PEIM] Tpm2DeviceLib|SecurityPkg/Library/Tpm2DeviceLibDTpm/Tpm2DeviceLibDTpm.in= f !endif =20 + MemEncryptSevLib|OvmfPkg/Library/BaseMemEncryptSevLib/PeiBaseMemEncryptS= evLib.inf + [LibraryClasses.common.DXE_CORE] HobLib|MdePkg/Library/DxeCoreHobLib/DxeCoreHobLib.inf DxeCoreEntryPoint|MdePkg/Library/DxeCoreEntryPoint/DxeCoreEntryPoint.inf diff --git a/OvmfPkg/OvmfPkgIa32.dsc b/OvmfPkg/OvmfPkgIa32.dsc index 8eede796a8bd..e433e17dc807 100644 --- a/OvmfPkg/OvmfPkgIa32.dsc +++ b/OvmfPkg/OvmfPkgIa32.dsc @@ -169,7 +169,7 @@ [LibraryClasses] QemuFwCfgSimpleParserLib|OvmfPkg/Library/QemuFwCfgSimpleParserLib/QemuFw= CfgSimpleParserLib.inf VirtioLib|OvmfPkg/Library/VirtioLib/VirtioLib.inf LoadLinuxLib|OvmfPkg/Library/LoadLinuxLib/LoadLinuxLib.inf - MemEncryptSevLib|OvmfPkg/Library/BaseMemEncryptSevLib/BaseMemEncryptSevL= ib.inf + MemEncryptSevLib|OvmfPkg/Library/BaseMemEncryptSevLib/DxeBaseMemEncryptS= evLib.inf !if $(SMM_REQUIRE) =3D=3D FALSE LockBoxLib|OvmfPkg/Library/LockBoxLib/LockBoxBaseLib.inf !endif @@ -309,6 +309,8 @@ [LibraryClasses.common.PEIM] Tpm2DeviceLib|SecurityPkg/Library/Tpm2DeviceLibDTpm/Tpm2DeviceLibDTpm.in= f !endif =20 + MemEncryptSevLib|OvmfPkg/Library/BaseMemEncryptSevLib/PeiBaseMemEncryptS= evLib.inf + [LibraryClasses.common.DXE_CORE] HobLib|MdePkg/Library/DxeCoreHobLib/DxeCoreHobLib.inf DxeCoreEntryPoint|MdePkg/Library/DxeCoreEntryPoint/DxeCoreEntryPoint.inf diff --git a/OvmfPkg/OvmfPkgIa32X64.dsc b/OvmfPkg/OvmfPkgIa32X64.dsc index f9f82a48f4b9..2e2eefbe33f0 100644 --- a/OvmfPkg/OvmfPkgIa32X64.dsc +++ b/OvmfPkg/OvmfPkgIa32X64.dsc @@ -173,7 +173,7 @@ [LibraryClasses] QemuFwCfgSimpleParserLib|OvmfPkg/Library/QemuFwCfgSimpleParserLib/QemuFw= CfgSimpleParserLib.inf VirtioLib|OvmfPkg/Library/VirtioLib/VirtioLib.inf LoadLinuxLib|OvmfPkg/Library/LoadLinuxLib/LoadLinuxLib.inf - MemEncryptSevLib|OvmfPkg/Library/BaseMemEncryptSevLib/BaseMemEncryptSevL= ib.inf + MemEncryptSevLib|OvmfPkg/Library/BaseMemEncryptSevLib/DxeBaseMemEncryptS= evLib.inf !if $(SMM_REQUIRE) =3D=3D FALSE LockBoxLib|OvmfPkg/Library/LockBoxLib/LockBoxBaseLib.inf !endif @@ -313,6 +313,8 @@ [LibraryClasses.common.PEIM] Tpm2DeviceLib|SecurityPkg/Library/Tpm2DeviceLibDTpm/Tpm2DeviceLibDTpm.in= f !endif =20 + MemEncryptSevLib|OvmfPkg/Library/BaseMemEncryptSevLib/PeiBaseMemEncryptS= evLib.inf + [LibraryClasses.common.DXE_CORE] HobLib|MdePkg/Library/DxeCoreHobLib/DxeCoreHobLib.inf DxeCoreEntryPoint|MdePkg/Library/DxeCoreEntryPoint/DxeCoreEntryPoint.inf diff --git a/OvmfPkg/OvmfPkgX64.dsc b/OvmfPkg/OvmfPkgX64.dsc index e59ae05b73aa..3e008855fbc1 100644 --- a/OvmfPkg/OvmfPkgX64.dsc +++ b/OvmfPkg/OvmfPkgX64.dsc @@ -173,7 +173,7 @@ [LibraryClasses] QemuFwCfgSimpleParserLib|OvmfPkg/Library/QemuFwCfgSimpleParserLib/QemuFw= CfgSimpleParserLib.inf VirtioLib|OvmfPkg/Library/VirtioLib/VirtioLib.inf LoadLinuxLib|OvmfPkg/Library/LoadLinuxLib/LoadLinuxLib.inf - MemEncryptSevLib|OvmfPkg/Library/BaseMemEncryptSevLib/BaseMemEncryptSevL= ib.inf + MemEncryptSevLib|OvmfPkg/Library/BaseMemEncryptSevLib/DxeBaseMemEncryptS= evLib.inf !if $(SMM_REQUIRE) =3D=3D FALSE LockBoxLib|OvmfPkg/Library/LockBoxLib/LockBoxBaseLib.inf !endif @@ -313,6 +313,8 @@ [LibraryClasses.common.PEIM] Tpm2DeviceLib|SecurityPkg/Library/Tpm2DeviceLibDTpm/Tpm2DeviceLibDTpm.in= f !endif =20 + MemEncryptSevLib|OvmfPkg/Library/BaseMemEncryptSevLib/PeiBaseMemEncryptS= evLib.inf + [LibraryClasses.common.DXE_CORE] HobLib|MdePkg/Library/DxeCoreHobLib/DxeCoreHobLib.inf DxeCoreEntryPoint|MdePkg/Library/DxeCoreEntryPoint/DxeCoreEntryPoint.inf diff --git a/OvmfPkg/OvmfXen.dsc b/OvmfPkg/OvmfXen.dsc index 12b7a87ee877..44fae364b423 100644 --- a/OvmfPkg/OvmfXen.dsc +++ b/OvmfPkg/OvmfXen.dsc @@ -161,7 +161,7 @@ [LibraryClasses] SerializeVariablesLib|OvmfPkg/Library/SerializeVariablesLib/SerializeVar= iablesLib.inf QemuFwCfgLib|OvmfPkg/Library/QemuFwCfgLib/QemuFwCfgDxeLib.inf QemuLoadImageLib|OvmfPkg/Library/GenericQemuLoadImageLib/GenericQemuLoad= ImageLib.inf - MemEncryptSevLib|OvmfPkg/Library/BaseMemEncryptSevLib/BaseMemEncryptSevL= ib.inf + MemEncryptSevLib|OvmfPkg/Library/BaseMemEncryptSevLib/DxeBaseMemEncryptS= evLib.inf LockBoxLib|OvmfPkg/Library/LockBoxLib/LockBoxBaseLib.inf CustomizedDisplayLib|MdeModulePkg/Library/CustomizedDisplayLib/Customize= dDisplayLib.inf FrameBufferBltLib|MdeModulePkg/Library/FrameBufferBltLib/FrameBufferBltL= ib.inf @@ -273,6 +273,7 @@ [LibraryClasses.common.PEIM] QemuFwCfgS3Lib|OvmfPkg/Library/QemuFwCfgS3Lib/PeiQemuFwCfgS3LibFwCfg.inf PcdLib|MdePkg/Library/PeiPcdLib/PeiPcdLib.inf QemuFwCfgLib|OvmfPkg/Library/QemuFwCfgLib/QemuFwCfgPeiLib.inf + MemEncryptSevLib|OvmfPkg/Library/BaseMemEncryptSevLib/PeiBaseMemEncryptS= evLib.inf =20 [LibraryClasses.common.DXE_CORE] HobLib|MdePkg/Library/DxeCoreHobLib/DxeCoreHobLib.inf diff --git a/OvmfPkg/Library/BaseMemEncryptSevLib/BaseMemEncryptSevLib.inf = b/OvmfPkg/Library/BaseMemEncryptSevLib/DxeBaseMemEncryptSevLib.inf similarity index 67% rename from OvmfPkg/Library/BaseMemEncryptSevLib/BaseMemEncryptSevLib.inf rename to OvmfPkg/Library/BaseMemEncryptSevLib/DxeBaseMemEncryptSevLib.inf index 7c44d0952815..2be6ca1fa737 100644 --- a/OvmfPkg/Library/BaseMemEncryptSevLib/BaseMemEncryptSevLib.inf +++ b/OvmfPkg/Library/BaseMemEncryptSevLib/DxeBaseMemEncryptSevLib.inf @@ -1,7 +1,7 @@ ## @file # Library provides the helper functions for SEV guest # -# Copyright (c) 2017 Advanced Micro Devices. All rights reserved.
+# Copyright (c) 2017 - 2020, Advanced Micro Devices. All rights reserved.<= BR> # # SPDX-License-Identifier: BSD-2-Clause-Patent # @@ -10,11 +10,11 @@ =20 [Defines] INF_VERSION =3D 1.25 - BASE_NAME =3D MemEncryptSevLib + BASE_NAME =3D DxeMemEncryptSevLib FILE_GUID =3D c1594631-3888-4be4-949f-9c630dbc842b MODULE_TYPE =3D BASE VERSION_STRING =3D 1.0 - LIBRARY_CLASS =3D MemEncryptSevLib|PEIM DXE_DRIVER DXE_= RUNTIME_DRIVER DXE_SMM_DRIVER UEFI_DRIVER + LIBRARY_CLASS =3D MemEncryptSevLib|DXE_DRIVER DXE_RUNTI= ME_DRIVER DXE_SMM_DRIVER UEFI_DRIVER =20 # # The following information is for reference only and not required by the = build @@ -30,14 +30,16 @@ [Packages] UefiCpuPkg/UefiCpuPkg.dec =20 [Sources.X64] + DxeMemEncryptSevLibInternal.c MemEncryptSevLibInternal.c X64/MemEncryptSevLib.c X64/VirtualMemory.c X64/VirtualMemory.h =20 [Sources.IA32] + DxeMemEncryptSevLibInternal.c + MemEncryptSevLibInternal.c Ia32/MemEncryptSevLib.c - MemEncryptSevLibInternal.c =20 [LibraryClasses] BaseLib @@ -49,3 +51,6 @@ [LibraryClasses] =20 [FeaturePcd] gUefiOvmfPkgTokenSpaceGuid.PcdSmmSmramRequire + +[Pcd] + gEfiMdeModulePkgTokenSpaceGuid.PcdPteMemoryEncryptionAddressOrMask diff --git a/OvmfPkg/Library/BaseMemEncryptSevLib/PeiBaseMemEncryptSevLib.i= nf b/OvmfPkg/Library/BaseMemEncryptSevLib/PeiBaseMemEncryptSevLib.inf new file mode 100644 index 000000000000..7bdf8cb5210d --- /dev/null +++ b/OvmfPkg/Library/BaseMemEncryptSevLib/PeiBaseMemEncryptSevLib.inf @@ -0,0 +1,56 @@ +## @file +# Library provides the helper functions for SEV guest +# +# Copyright (c) 2020 Advanced Micro Devices. All rights reserved.
+# +# SPDX-License-Identifier: BSD-2-Clause-Patent +# +# +## + +[Defines] + INF_VERSION =3D 1.25 + BASE_NAME =3D PeiMemEncryptSevLib + FILE_GUID =3D 15d9a694-3d2a-4184-9672-ba55c3070e07 + MODULE_TYPE =3D BASE + VERSION_STRING =3D 1.0 + LIBRARY_CLASS =3D MemEncryptSevLib|PEIM + +# +# The following information is for reference only and not required by the = build +# tools. +# +# VALID_ARCHITECTURES =3D IA32 X64 +# + +[Packages] + MdeModulePkg/MdeModulePkg.dec + MdePkg/MdePkg.dec + OvmfPkg/OvmfPkg.dec + UefiCpuPkg/UefiCpuPkg.dec + +[Sources.X64] + PeiMemEncryptSevLibInternal.c + MemEncryptSevLibInternal.c + X64/MemEncryptSevLib.c + X64/VirtualMemory.c + X64/VirtualMemory.h + +[Sources.IA32] + PeiMemEncryptSevLibInternal.c + MemEncryptSevLibInternal.c + Ia32/MemEncryptSevLib.c + +[LibraryClasses] + BaseLib + CacheMaintenanceLib + CpuLib + DebugLib + MemoryAllocationLib + PcdLib + +[FeaturePcd] + gUefiOvmfPkgTokenSpaceGuid.PcdSmmSmramRequire + +[FixedPcd] + gUefiCpuPkgTokenSpaceGuid.PcdSevEsWorkAreaBase diff --git a/OvmfPkg/Include/Library/MemEncryptSevLib.h b/OvmfPkg/Include/L= ibrary/MemEncryptSevLib.h index dc09c61e58bb..394065f15bc1 100644 --- a/OvmfPkg/Include/Library/MemEncryptSevLib.h +++ b/OvmfPkg/Include/Library/MemEncryptSevLib.h @@ -29,6 +29,8 @@ typedef struct _SEC_SEV_ES_WORK_AREA { UINT8 Reserved1[7]; =20 UINT64 RandomData; + + UINT64 EncryptionMask; } SEC_SEV_ES_WORK_AREA; =20 /** @@ -133,4 +135,16 @@ MemEncryptSevLocateInitialSmramSaveStateMapPages ( OUT UINTN *BaseAddress, OUT UINTN *NumberOfPages ); + +/** + Returns the SEV encryption mask. + + @return The SEV pagtable encryption mask +**/ +UINT64 +EFIAPI +MemEncryptSevGetEncryptionMask ( + VOID + ); + #endif // _MEM_ENCRYPT_SEV_LIB_H_ diff --git a/OvmfPkg/Bhyve/PlatformPei/AmdSev.c b/OvmfPkg/Bhyve/PlatformPei= /AmdSev.c index e484f4b311fe..e3ed78581c1b 100644 --- a/OvmfPkg/Bhyve/PlatformPei/AmdSev.c +++ b/OvmfPkg/Bhyve/PlatformPei/AmdSev.c @@ -1,7 +1,7 @@ /**@file Initialize Secure Encrypted Virtualization (SEV) support =20 - Copyright (c) 2017, Advanced Micro Devices. All rights reserved.
+ Copyright (c) 2017 - 2020, Advanced Micro Devices. All rights reserved.<= BR> =20 SPDX-License-Identifier: BSD-2-Clause-Patent =20 @@ -15,8 +15,6 @@ #include #include #include -#include -#include #include =20 #include "Platform.h" @@ -32,7 +30,6 @@ AmdSevInitialize ( VOID ) { - CPUID_MEMORY_ENCRYPTION_INFO_EBX Ebx; UINT64 EncryptionMask; RETURN_STATUS PcdStatus; =20 @@ -43,15 +40,10 @@ AmdSevInitialize ( return; } =20 - // - // CPUID Fn8000_001F[EBX] Bit 0:5 (memory encryption bit position) - // - AsmCpuid (CPUID_MEMORY_ENCRYPTION_INFO, NULL, &Ebx.Uint32, NULL, NULL); - EncryptionMask =3D LShiftU64 (1, Ebx.Bits.PtePosBits); - // // Set Memory Encryption Mask PCD // + EncryptionMask =3D MemEncryptSevGetEncryptionMask (); PcdStatus =3D PcdSet64S (PcdPteMemoryEncryptionAddressOrMask, Encryption= Mask); ASSERT_RETURN_ERROR (PcdStatus); =20 diff --git a/OvmfPkg/Library/BaseMemEncryptSevLib/DxeMemEncryptSevLibIntern= al.c b/OvmfPkg/Library/BaseMemEncryptSevLib/DxeMemEncryptSevLibInternal.c new file mode 100644 index 000000000000..2816f859a0c4 --- /dev/null +++ b/OvmfPkg/Library/BaseMemEncryptSevLib/DxeMemEncryptSevLibInternal.c @@ -0,0 +1,145 @@ +/** @file + + Secure Encrypted Virtualization (SEV) library helper function + + Copyright (c) 2017 - 2020, AMD Incorporated. All rights reserved.
+ + SPDX-License-Identifier: BSD-2-Clause-Patent + +**/ + +#include +#include +#include +#include +#include +#include +#include +#include + +STATIC BOOLEAN mSevStatus =3D FALSE; +STATIC BOOLEAN mSevEsStatus =3D FALSE; +STATIC BOOLEAN mSevStatusChecked =3D FALSE; + +STATIC UINT64 mSevEncryptionMask =3D 0; +STATIC BOOLEAN mSevEncryptionMaskSaved =3D FALSE; + +/** + Reads and sets the status of SEV features. + + **/ +STATIC +VOID +EFIAPI +InternalMemEncryptSevStatus ( + VOID + ) +{ + UINT32 RegEax; + MSR_SEV_STATUS_REGISTER Msr; + CPUID_MEMORY_ENCRYPTION_INFO_EAX Eax; + BOOLEAN ReadSevMsr; + UINT64 EncryptionMask; + + ReadSevMsr =3D FALSE; + + EncryptionMask =3D PcdGet64 (PcdPteMemoryEncryptionAddressOrMask); + if (EncryptionMask !=3D 0) { + // + // The MSR has been read before, so it is safe to read it again and av= oid + // having to validate the CPUID information. + // + ReadSevMsr =3D TRUE; + } else { + // + // Check if memory encryption leaf exist + // + AsmCpuid (CPUID_EXTENDED_FUNCTION, &RegEax, NULL, NULL, NULL); + if (RegEax >=3D CPUID_MEMORY_ENCRYPTION_INFO) { + // + // CPUID Fn8000_001F[EAX] Bit 1 (Sev supported) + // + AsmCpuid (CPUID_MEMORY_ENCRYPTION_INFO, &Eax.Uint32, NULL, NULL, NUL= L); + + if (Eax.Bits.SevBit) { + ReadSevMsr =3D TRUE; + } + } + } + + if (ReadSevMsr) { + // + // Check MSR_0xC0010131 Bit 0 (Sev Enabled) + // + Msr.Uint32 =3D AsmReadMsr32 (MSR_SEV_STATUS); + if (Msr.Bits.SevBit) { + mSevStatus =3D TRUE; + } + + // + // Check MSR_0xC0010131 Bit 1 (Sev-Es Enabled) + // + if (Msr.Bits.SevEsBit) { + mSevEsStatus =3D TRUE; + } + } + + mSevStatusChecked =3D TRUE; +} + +/** + Returns a boolean to indicate whether SEV-ES is enabled. + + @retval TRUE SEV-ES is enabled + @retval FALSE SEV-ES is not enabled +**/ +BOOLEAN +EFIAPI +MemEncryptSevEsIsEnabled ( + VOID + ) +{ + if (!mSevStatusChecked) { + InternalMemEncryptSevStatus (); + } + + return mSevEsStatus; +} + +/** + Returns a boolean to indicate whether SEV is enabled. + + @retval TRUE SEV is enabled + @retval FALSE SEV is not enabled +**/ +BOOLEAN +EFIAPI +MemEncryptSevIsEnabled ( + VOID + ) +{ + if (!mSevStatusChecked) { + InternalMemEncryptSevStatus (); + } + + return mSevStatus; +} + +/** + Returns the SEV encryption mask. + + @return The SEV pagtable encryption mask +**/ +UINT64 +EFIAPI +MemEncryptSevGetEncryptionMask ( + VOID + ) +{ + if (!mSevEncryptionMaskSaved) { + mSevEncryptionMask =3D PcdGet64 (PcdPteMemoryEncryptionAddressOrMask); + mSevEncryptionMaskSaved =3D TRUE; + } + + return mSevEncryptionMask; +} diff --git a/OvmfPkg/Library/BaseMemEncryptSevLib/MemEncryptSevLibInternal.= c b/OvmfPkg/Library/BaseMemEncryptSevLib/MemEncryptSevLibInternal.c index 02b8eb225d81..ec6d02eaefd0 100644 --- a/OvmfPkg/Library/BaseMemEncryptSevLib/MemEncryptSevLibInternal.c +++ b/OvmfPkg/Library/BaseMemEncryptSevLib/MemEncryptSevLibInternal.c @@ -2,7 +2,7 @@ =20 Secure Encrypted Virtualization (SEV) library helper function =20 - Copyright (c) 2017, AMD Incorporated. All rights reserved.
+ Copyright (c) 2017 - 2020, AMD Incorporated. All rights reserved.
=20 SPDX-License-Identifier: BSD-2-Clause-Patent =20 @@ -19,95 +19,6 @@ #include #include =20 -STATIC BOOLEAN mSevStatus =3D FALSE; -STATIC BOOLEAN mSevEsStatus =3D FALSE; -STATIC BOOLEAN mSevStatusChecked =3D FALSE; - -/** - Reads and sets the status of SEV features. - - **/ -STATIC -VOID -EFIAPI -InternalMemEncryptSevStatus ( - VOID - ) -{ - UINT32 RegEax; - MSR_SEV_STATUS_REGISTER Msr; - CPUID_MEMORY_ENCRYPTION_INFO_EAX Eax; - - // - // Check if memory encryption leaf exist - // - AsmCpuid (CPUID_EXTENDED_FUNCTION, &RegEax, NULL, NULL, NULL); - if (RegEax >=3D CPUID_MEMORY_ENCRYPTION_INFO) { - // - // CPUID Fn8000_001F[EAX] Bit 1 (Sev supported) - // - AsmCpuid (CPUID_MEMORY_ENCRYPTION_INFO, &Eax.Uint32, NULL, NULL, NULL)= ; - - if (Eax.Bits.SevBit) { - // - // Check MSR_0xC0010131 Bit 0 (Sev Enabled) - // - Msr.Uint32 =3D AsmReadMsr32 (MSR_SEV_STATUS); - if (Msr.Bits.SevBit) { - mSevStatus =3D TRUE; - } - - // - // Check MSR_0xC0010131 Bit 1 (Sev-Es Enabled) - // - if (Msr.Bits.SevEsBit) { - mSevEsStatus =3D TRUE; - } - } - } - - mSevStatusChecked =3D TRUE; -} - -/** - Returns a boolean to indicate whether SEV-ES is enabled. - - @retval TRUE SEV-ES is enabled - @retval FALSE SEV-ES is not enabled -**/ -BOOLEAN -EFIAPI -MemEncryptSevEsIsEnabled ( - VOID - ) -{ - if (!mSevStatusChecked) { - InternalMemEncryptSevStatus (); - } - - return mSevEsStatus; -} - -/** - Returns a boolean to indicate whether SEV is enabled. - - @retval TRUE SEV is enabled - @retval FALSE SEV is not enabled -**/ -BOOLEAN -EFIAPI -MemEncryptSevIsEnabled ( - VOID - ) -{ - if (!mSevStatusChecked) { - InternalMemEncryptSevStatus (); - } - - return mSevStatus; -} - - /** Locate the page range that covers the initial (pre-SMBASE-relocation) SM= RAM Save State Map. diff --git a/OvmfPkg/Library/BaseMemEncryptSevLib/PeiMemEncryptSevLibIntern= al.c b/OvmfPkg/Library/BaseMemEncryptSevLib/PeiMemEncryptSevLibInternal.c new file mode 100644 index 000000000000..e2fd109d120f --- /dev/null +++ b/OvmfPkg/Library/BaseMemEncryptSevLib/PeiMemEncryptSevLibInternal.c @@ -0,0 +1,159 @@ +/** @file + + Secure Encrypted Virtualization (SEV) library helper function + + Copyright (c) 2020, AMD Incorporated. All rights reserved.
+ + SPDX-License-Identifier: BSD-2-Clause-Patent + +**/ + +#include +#include +#include +#include +#include +#include +#include +#include + +STATIC BOOLEAN mSevStatus =3D FALSE; +STATIC BOOLEAN mSevEsStatus =3D FALSE; +STATIC BOOLEAN mSevStatusChecked =3D FALSE; + +STATIC UINT64 mSevEncryptionMask =3D 0; +STATIC BOOLEAN mSevEncryptionMaskSaved =3D FALSE; + +/** + Reads and sets the status of SEV features. + + **/ +STATIC +VOID +EFIAPI +InternalMemEncryptSevStatus ( + VOID + ) +{ + UINT32 RegEax; + MSR_SEV_STATUS_REGISTER Msr; + CPUID_MEMORY_ENCRYPTION_INFO_EAX Eax; + BOOLEAN ReadSevMsr; + SEC_SEV_ES_WORK_AREA *SevEsWorkArea; + + ReadSevMsr =3D FALSE; + + SevEsWorkArea =3D (SEC_SEV_ES_WORK_AREA *) FixedPcdGet32 (PcdSevEsWorkAr= eaBase); + if (SevEsWorkArea !=3D NULL && SevEsWorkArea->EncryptionMask !=3D 0) { + // + // The MSR has been read before, so it is safe to read it again and av= oid + // having to validate the CPUID information. + // + ReadSevMsr =3D TRUE; + } else { + // + // Check if memory encryption leaf exist + // + AsmCpuid (CPUID_EXTENDED_FUNCTION, &RegEax, NULL, NULL, NULL); + if (RegEax >=3D CPUID_MEMORY_ENCRYPTION_INFO) { + // + // CPUID Fn8000_001F[EAX] Bit 1 (Sev supported) + // + AsmCpuid (CPUID_MEMORY_ENCRYPTION_INFO, &Eax.Uint32, NULL, NULL, NUL= L); + + if (Eax.Bits.SevBit) { + ReadSevMsr =3D TRUE; + } + } + } + + if (ReadSevMsr) { + // + // Check MSR_0xC0010131 Bit 0 (Sev Enabled) + // + Msr.Uint32 =3D AsmReadMsr32 (MSR_SEV_STATUS); + if (Msr.Bits.SevBit) { + mSevStatus =3D TRUE; + } + + // + // Check MSR_0xC0010131 Bit 1 (Sev-Es Enabled) + // + if (Msr.Bits.SevEsBit) { + mSevEsStatus =3D TRUE; + } + } + + mSevStatusChecked =3D TRUE; +} + +/** + Returns a boolean to indicate whether SEV-ES is enabled. + + @retval TRUE SEV-ES is enabled + @retval FALSE SEV-ES is not enabled +**/ +BOOLEAN +EFIAPI +MemEncryptSevEsIsEnabled ( + VOID + ) +{ + if (!mSevStatusChecked) { + InternalMemEncryptSevStatus (); + } + + return mSevEsStatus; +} + +/** + Returns a boolean to indicate whether SEV is enabled. + + @retval TRUE SEV is enabled + @retval FALSE SEV is not enabled +**/ +BOOLEAN +EFIAPI +MemEncryptSevIsEnabled ( + VOID + ) +{ + if (!mSevStatusChecked) { + InternalMemEncryptSevStatus (); + } + + return mSevStatus; +} + +/** + Returns the SEV encryption mask. + + @return The SEV pagtable encryption mask +**/ +UINT64 +EFIAPI +MemEncryptSevGetEncryptionMask ( + VOID + ) +{ + if (!mSevEncryptionMaskSaved) { + SEC_SEV_ES_WORK_AREA *SevEsWorkArea; + + SevEsWorkArea =3D (SEC_SEV_ES_WORK_AREA *) FixedPcdGet32 (PcdSevEsWork= AreaBase); + if (SevEsWorkArea !=3D NULL) { + mSevEncryptionMask =3D SevEsWorkArea->EncryptionMask; + } else { + CPUID_MEMORY_ENCRYPTION_INFO_EBX Ebx; + + // + // CPUID Fn8000_001F[EBX] Bit 0:5 (memory encryption bit position) + // + AsmCpuid (CPUID_MEMORY_ENCRYPTION_INFO, NULL, &Ebx.Uint32, NULL, NUL= L); + mSevEncryptionMask =3D LShiftU64 (1, Ebx.Bits.PtePosBits); + } + + mSevEncryptionMaskSaved =3D TRUE; + } + + return mSevEncryptionMask; +} diff --git a/OvmfPkg/Library/BaseMemEncryptSevLib/X64/VirtualMemory.c b/Ovm= fPkg/Library/BaseMemEncryptSevLib/X64/VirtualMemory.c index 5e110c84ff81..6422bc53bd5d 100644 --- a/OvmfPkg/Library/BaseMemEncryptSevLib/X64/VirtualMemory.c +++ b/OvmfPkg/Library/BaseMemEncryptSevLib/X64/VirtualMemory.c @@ -3,7 +3,7 @@ Virtual Memory Management Services to set or clear the memory encryption= bit =20 Copyright (c) 2006 - 2018, Intel Corporation. All rights reserved.
- Copyright (c) 2017, AMD Incorporated. All rights reserved.
+ Copyright (c) 2017 - 2020, AMD Incorporated. All rights reserved.
=20 SPDX-License-Identifier: BSD-2-Clause-Patent =20 @@ -12,6 +12,7 @@ **/ =20 #include +#include #include #include =20 @@ -39,17 +40,12 @@ GetMemEncryptionAddressMask ( ) { UINT64 EncryptionMask; - CPUID_MEMORY_ENCRYPTION_INFO_EBX Ebx; =20 if (mAddressEncMaskChecked) { return mAddressEncMask; } =20 - // - // CPUID Fn8000_001F[EBX] Bit 0:5 (memory encryption bit position) - // - AsmCpuid (CPUID_MEMORY_ENCRYPTION_INFO, NULL, &Ebx.Uint32, NULL, NULL); - EncryptionMask =3D LShiftU64 (1, Ebx.Bits.PtePosBits); + EncryptionMask =3D MemEncryptSevGetEncryptionMask (); =20 mAddressEncMask =3D EncryptionMask & PAGING_1G_ADDRESS_MASK_64; mAddressEncMaskChecked =3D TRUE; @@ -289,8 +285,7 @@ SetPageTablePoolReadOnly ( LevelSize[3] =3D SIZE_1GB; LevelSize[4] =3D SIZE_512GB; =20 - AddressEncMask =3D GetMemEncryptionAddressMask() & - PAGING_1G_ADDRESS_MASK_64; + AddressEncMask =3D GetMemEncryptionAddressMask(); PageTable =3D (UINT64 *)(UINTN)PageTableBase; PoolUnitSize =3D PAGE_TABLE_POOL_UNIT_SIZE; =20 @@ -437,7 +432,7 @@ Split1GPageTo2M ( =20 AddressEncMask =3D GetMemEncryptionAddressMask (); ASSERT (PageDirectoryEntry !=3D NULL); - ASSERT (*PageEntry1G & GetMemEncryptionAddressMask ()); + ASSERT (*PageEntry1G & AddressEncMask); // // Fill in 1G page entry. // diff --git a/OvmfPkg/PlatformPei/AmdSev.c b/OvmfPkg/PlatformPei/AmdSev.c index 4a515a484720..954d53eba4e8 100644 --- a/OvmfPkg/PlatformPei/AmdSev.c +++ b/OvmfPkg/PlatformPei/AmdSev.c @@ -1,7 +1,7 @@ /**@file Initialize Secure Encrypted Virtualization (SEV) support =20 - Copyright (c) 2017, Advanced Micro Devices. All rights reserved.
+ Copyright (c) 2017 - 2020, Advanced Micro Devices. All rights reserved.<= BR> =20 SPDX-License-Identifier: BSD-2-Clause-Patent =20 @@ -17,9 +17,7 @@ #include #include #include -#include #include -#include #include =20 #include "Platform.h" @@ -116,7 +114,6 @@ AmdSevInitialize ( VOID ) { - CPUID_MEMORY_ENCRYPTION_INFO_EBX Ebx; UINT64 EncryptionMask; RETURN_STATUS PcdStatus; =20 @@ -127,15 +124,10 @@ AmdSevInitialize ( return; } =20 - // - // CPUID Fn8000_001F[EBX] Bit 0:5 (memory encryption bit position) - // - AsmCpuid (CPUID_MEMORY_ENCRYPTION_INFO, NULL, &Ebx.Uint32, NULL, NULL); - EncryptionMask =3D LShiftU64 (1, Ebx.Bits.PtePosBits); - // // Set Memory Encryption Mask PCD // + EncryptionMask =3D MemEncryptSevGetEncryptionMask (); PcdStatus =3D PcdSet64S (PcdPteMemoryEncryptionAddressOrMask, Encryption= Mask); ASSERT_RETURN_ERROR (PcdStatus); =20 diff --git a/OvmfPkg/XenPlatformPei/AmdSev.c b/OvmfPkg/XenPlatformPei/AmdSe= v.c index 7ebbb5cc1fd2..4ed448632ae2 100644 --- a/OvmfPkg/XenPlatformPei/AmdSev.c +++ b/OvmfPkg/XenPlatformPei/AmdSev.c @@ -1,7 +1,7 @@ /**@file Initialize Secure Encrypted Virtualization (SEV) support =20 - Copyright (c) 2017, Advanced Micro Devices. All rights reserved.
+ Copyright (c) 2017 - 2020, Advanced Micro Devices. All rights reserved.<= BR> Copyright (c) 2019, Citrix Systems, Inc. =20 SPDX-License-Identifier: BSD-2-Clause-Patent @@ -14,8 +14,6 @@ #include #include #include -#include -#include =20 #include "Platform.h" =20 @@ -30,7 +28,6 @@ AmdSevInitialize ( VOID ) { - CPUID_MEMORY_ENCRYPTION_INFO_EBX Ebx; UINT64 EncryptionMask; RETURN_STATUS PcdStatus; =20 @@ -41,15 +38,10 @@ AmdSevInitialize ( return; } =20 - // - // CPUID Fn8000_001F[EBX] Bit 0:5 (memory encryption bit position) - // - AsmCpuid (CPUID_MEMORY_ENCRYPTION_INFO, NULL, &Ebx.Uint32, NULL, NULL); - EncryptionMask =3D LShiftU64 (1, Ebx.Bits.PtePosBits); - // // Set Memory Encryption Mask PCD // + EncryptionMask =3D MemEncryptSevGetEncryptionMask (); PcdStatus =3D PcdSet64S (PcdPteMemoryEncryptionAddressOrMask, Encryption= Mask); ASSERT_RETURN_ERROR (PcdStatus); =20 diff --git a/OvmfPkg/ResetVector/Ia32/PageTables64.asm b/OvmfPkg/ResetVecto= r/Ia32/PageTables64.asm index b08f31157cbf..8c0d432050df 100644 --- a/OvmfPkg/ResetVector/Ia32/PageTables64.asm +++ b/OvmfPkg/ResetVector/Ia32/PageTables64.asm @@ -145,13 +145,21 @@ GetSevEncBit: =20 ; The encryption bit position is always above 31 sub ebx, 32 - jns SevExit + jns SevSaveMask =20 ; Encryption bit was reported as 31 or below, enter a HLT loop SevEncBitLowHlt: hlt jmp SevEncBitLowHlt =20 +SevSaveMask: + xor edx, edx + bts edx, ebx + + mov dword[SEV_ES_WORK_AREA_ENC_MASK], 0 + mov dword[SEV_ES_WORK_AREA_ENC_MASK + 4], edx + jmp SevExit + NoSev: ; ; Perform an SEV-ES sanity check by seeing if a #VC exception occurred= . diff --git a/OvmfPkg/ResetVector/ResetVector.nasmb b/OvmfPkg/ResetVector/Re= setVector.nasmb index d3aa87982959..5fbacaed5f9d 100644 --- a/OvmfPkg/ResetVector/ResetVector.nasmb +++ b/OvmfPkg/ResetVector/ResetVector.nasmb @@ -74,6 +74,7 @@ %define GHCB_SIZE (FixedPcdGet32 (PcdOvmfSecGhcbSize)) %define SEV_ES_WORK_AREA (FixedPcdGet32 (PcdSevEsWorkAreaBase)) %define SEV_ES_WORK_AREA_RDRAND (FixedPcdGet32 (PcdSevEsWorkAreaBase) + = 8) + %define SEV_ES_WORK_AREA_ENC_MASK (FixedPcdGet32 (PcdSevEsWorkAreaBase) = + 16) %define SEV_ES_VC_TOP_OF_STACK (FixedPcdGet32 (PcdOvmfSecPeiTempRamBase)= + FixedPcdGet32 (PcdOvmfSecPeiTempRamSize)) %include "Ia32/Flat32ToFlat64.asm" %include "Ia32/PageTables64.asm" --=20 2.28.0