From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from NAM04-BN8-obe.outbound.protection.outlook.com (NAM04-BN8-obe.outbound.protection.outlook.com [40.107.100.79]) by mx.groups.io with SMTP id smtpd.web08.1126.1610045413410361394 for ; Thu, 07 Jan 2021 10:50:13 -0800 Authentication-Results: mx.groups.io; dkim=fail reason="body hash did not verify" header.i=@amdcloud.onmicrosoft.com header.s=selector2-amdcloud-onmicrosoft-com header.b=flL31zQ7; spf=permerror, err=parse error for token &{10 18 %{i}._ip.%{h}._ehlo.%{d}._spf.vali.email}: invalid domain name (domain: amd.com, ip: 40.107.100.79, mailfrom: thomas.lendacky@amd.com) ARC-Seal: i=1; a=rsa-sha256; s=arcselector9901; d=microsoft.com; cv=none; b=dFXN43LDGMde/4fKPbgiemI2F+0tEF3KrZ9SosxQmUn5q2Rt2pOWSZkliWrDELC3ttEa9KW7cQVnUg2gnHRXPJr/hWhHqklgUBp0njlDKVfTRbeO5VmFMk88uooKk3KFta/PLr/ONYHdRl1OoTnEUCguW5F4N+jcApvLIucFnCsR6e+2TsMovChbgQjmpzevd8STjb5RvGeTtA51LLpW75S9r9CtHVbusmDl9ttr3DQcmzs9hdAcCmmhl9lUsDwkR9Wvf3G3ZZdkvWX/ELQsl3NYzCOu0n/VBS8kAtWi+2J3s6mUfbiSCTrXXJ6dPCWVUmiog3mlJtghOR1azLqKEw== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=arcselector9901; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=2+fMoLkWftGuwu7BRNWUwC5aeS2V9r+7q8tWlp0S4k8=; b=SksOxTiXOCIlWi/Vkf8166b3GZWMtGlt9ckloueUgnhZcJ/JEqG/qeuStGVtS+IIxw9xzUeTkBEdKUF3y9rczVCQw8k1R5QbtKVkmJMTFl72tBFoXjzt0FWaMCHCLzi4ANtt/dkSOiY2QN6s1YVx44RM3T58c1V+hj3LSMe8IGpWp3HN/wOKIJOUbarloKDMvsBE4wGGCvMq5JBbaXygXEY1qeOUY2juyfAaoRfB18RbHd+leqnOqALDLJKiIN1jbJ8VznWMmtKAgpsHlEei6KWm44z4JHIcNklw2iOxMGNQ7arWn2/Dt5gzKFZR8ngRSJKgekd9nW/e7X9wM3G0Ng== ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=pass smtp.mailfrom=amd.com; dmarc=pass action=none header.from=amd.com; dkim=pass header.d=amd.com; arc=none DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=amdcloud.onmicrosoft.com; s=selector2-amdcloud-onmicrosoft-com; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=2+fMoLkWftGuwu7BRNWUwC5aeS2V9r+7q8tWlp0S4k8=; b=flL31zQ7u2RlAGLgfdHY5KE6znyeyon3ZtuFkMzhhT7jARJ48VtlH2y/wHmTiwM1h83QLFhonDKDeMfQ0lNGwlQduFUjcybsa5xNTVBTMRDNXSslnwBMy5VF/+AnvJrUSvyusl5jD/8h7dOtkFdOtIHH4ZQsiuOsw12knoG1jKA= Authentication-Results: edk2.groups.io; dkim=none (message not signed) header.d=none;edk2.groups.io; dmarc=none action=none header.from=amd.com; Received: from DM5PR12MB1355.namprd12.prod.outlook.com (2603:10b6:3:6e::7) by DM5PR1201MB0121.namprd12.prod.outlook.com (2603:10b6:4:56::9) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.3721.23; Thu, 7 Jan 2021 18:50:10 +0000 Received: from DM5PR12MB1355.namprd12.prod.outlook.com ([fe80::d95e:b9d:1d6a:e845]) by DM5PR12MB1355.namprd12.prod.outlook.com ([fe80::d95e:b9d:1d6a:e845%12]) with mapi id 15.20.3721.024; Thu, 7 Jan 2021 18:50:10 +0000 From: "Lendacky, Thomas" To: devel@edk2.groups.io CC: Brijesh Singh , James Bottomley , Jordan Justen , Laszlo Ersek , Ard Biesheuvel , Rebecca Cran , Peter Grehan , Anthony Perard , Julien Grall Subject: [PATCH v3 06/15] OvmfPkg/MemEncryptSevLib: Add an interface to retrieve the encryption mask Date: Thu, 7 Jan 2021 12:48:16 -0600 Message-ID: X-Mailer: git-send-email 2.30.0 In-Reply-To: References: X-Originating-IP: [165.204.77.1] X-ClientProxiedBy: DM5PR22CA0003.namprd22.prod.outlook.com (2603:10b6:3:101::13) To DM5PR12MB1355.namprd12.prod.outlook.com (2603:10b6:3:6e::7) Return-Path: thomas.lendacky@amd.com MIME-Version: 1.0 X-MS-Exchange-MessageSentRepresentingType: 1 Received: from tlendack-t1.amd.com (165.204.77.1) by DM5PR22CA0003.namprd22.prod.outlook.com (2603:10b6:3:101::13) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.3742.6 via Frontend Transport; Thu, 7 Jan 2021 18:50:09 +0000 X-MS-PublicTrafficType: Email X-MS-Office365-Filtering-HT: Tenant X-MS-Office365-Filtering-Correlation-Id: df962f26-8845-4a65-cc01-08d8b33d0f1e X-MS-TrafficTypeDiagnostic: DM5PR1201MB0121: X-MS-Exchange-Transport-Forked: True X-Microsoft-Antispam-PRVS: X-MS-Oob-TLC-OOBClassifiers: OLM:10000; X-MS-Exchange-SenderADCheck: 1 X-Microsoft-Antispam: BCL:0; X-Microsoft-Antispam-Message-Info: 4tJZkO7adLREXNVSws+YaYgBcGdqTMZpzOQYsaEfJzUEQEQaP50dbZ5AVE46meDHt5y9CA+92H8Wp6kd91Dw/7f7gdFiJnzFXiGZKxilRvXUQksPFbHXtoS1huU9HanwBhifPuFV3WCQdpYuzCwnLmXWZZs8NNUq7g1HUau2I6270reQ2kH5eQelV2m8gsNNNNO87OwtGM4MjaVAI1iviv1vHB4iADRqNV4W7dKvHOB+ZQuBTjSnUPvRVnQLb9xSMoGl8gw4fDazyFjO+/kNSNSEGMqPSpJ+lCeUqhLL45DOqddR+pTZqJ5khZ5R3IvfSlBWrK0wrLX5nkkkcMgHXaJKIKmWojRq63C68OMRNdFWQu5lq95+Ugy8+ag1Y1Q7fJw9s+mCO2+RM72W10bkPkv+BFBsLNq5+EFdOatFP96d3kSbbsu6iwZV8wpOiE6gHdB2gXtc8SVmlbwbM3cxDQ== X-Forefront-Antispam-Report: CIP:255.255.255.255;CTRY:;LANG:en;SCL:1;SRV:;IPV:NLI;SFV:NSPM;H:DM5PR12MB1355.namprd12.prod.outlook.com;PTR:;CAT:NONE;SFS:(4636009)(39860400002)(136003)(366004)(346002)(376002)(396003)(54906003)(36756003)(316002)(30864003)(52116002)(16526019)(186003)(6666004)(7696005)(4326008)(83380400001)(66556008)(66946007)(6916009)(956004)(2906002)(8936002)(5660300002)(6486002)(66476007)(8676002)(86362001)(478600001)(966005)(2616005)(26005)(19627235002);DIR:OUT;SFP:1101; X-MS-Exchange-AntiSpam-MessageData: =?us-ascii?Q?Z1dzCpcZ/v9PjjE9B4yhprRTpin6HRxNiWhCdI2uyZ3k3FqxZs+DlZDi0uD9?= =?us-ascii?Q?hQP7Lad2462SERdZH6m/o7eb0YTjhHnsCPM2pRI5hsNdiC9Z6f80j+YGStEq?= =?us-ascii?Q?Rl1WP04nh5bzqFl4rP6YmNm4QunL3Yx4W5XNbKOgEEs71aH0yK1xRx92Pb/k?= =?us-ascii?Q?krsJD38f2ABs3I60f2gfBzFGoYjMudxPAFAIGsPWbmboBy/8Kw2Sf1ThUn6c?= =?us-ascii?Q?t5UGnd+W7o0l2awh+zOtWb7HtR6zse2g/6M5Tgi3RhHIX+lqfZphMfwoLvCB?= =?us-ascii?Q?aiqiAV9jK2ztei54nNYjmAxCXkR40nXtEf15Hgm0ro9yAl2zuMWxTErXLOjz?= =?us-ascii?Q?/bmjgGLBw5PHwSNlIxcpOWlBp7z3BZe5FxqCtsCRZWDd/3vy9JG42zYJRdHT?= =?us-ascii?Q?AnXEtQMqswu8r/0A88bldiBRly0nwkRLikYkHkbxhpa7Jj2mpmNV9Kp3032V?= =?us-ascii?Q?e4Lp0vly/tHJIw5Ultp6zXVjSxVlJb0XTXiKmyEGMJVrLKfgq6Owu1yZyAX5?= =?us-ascii?Q?R/WGOAJw2cuSw0nCAZ1aB5xW2PbfwhbNLd9PvO6vRSk/ua9XbJ31RGadL9Ys?= =?us-ascii?Q?jbt8PdEHisOy3iCWkfyeyaNN0MZh1KpNeEvRXCJi332lE5KH4w9mTNMS/a1C?= =?us-ascii?Q?tAhAkyaKuYYwPVLAfvg4owd0AhYV+X4b4lMpnASXVh195IsQFr8yzW9BGPka?= =?us-ascii?Q?lIAK4PX8+sj+8JLrAhL9GYrqBdTWFormmNcPg3SfAtEzKVokACq62gdtUK0x?= =?us-ascii?Q?EVvkQKog4Z2g8lfA2WzdQ0kbw+7M02/j8NHQVu9NqAO0+CSH7+iIQDort5H0?= =?us-ascii?Q?w8EGMxx7Eh84pHw/8W4dKun/8IH+50wTNa4vvCCo7MTmffE5mteQP3su4+Fh?= =?us-ascii?Q?jM9sx8Hk4vaF4GxFzUUnFpLDyib4KD5Rq0sq0iJ+sz0jqW1ae05l3rw5Xe3X?= =?us-ascii?Q?RzGD/4RptIENFgA6dELSuRurAba47NnLgWB2C0lB1bc36Lits9B43YJZ73Uu?= =?us-ascii?Q?N/wT?= X-OriginatorOrg: amd.com X-MS-Exchange-CrossTenant-AuthSource: DM5PR12MB1355.namprd12.prod.outlook.com X-MS-Exchange-CrossTenant-AuthAs: Internal X-MS-Exchange-CrossTenant-OriginalArrivalTime: 07 Jan 2021 18:50:09.9869 (UTC) X-MS-Exchange-CrossTenant-FromEntityHeader: Hosted X-MS-Exchange-CrossTenant-Id: 3dd8961f-e488-4e60-8e11-a82d994e183d X-MS-Exchange-CrossTenant-Network-Message-Id: df962f26-8845-4a65-cc01-08d8b33d0f1e X-MS-Exchange-CrossTenant-MailboxType: HOSTED X-MS-Exchange-CrossTenant-UserPrincipalName: Pa9OL+FrkujBQrbtvBy78iOuaYCXieZYb80UPqMDU72Gl8JdepsTEahSgROyM2qy4WfDP3ib/jOCFaVusskSNg== X-MS-Exchange-Transport-CrossTenantHeadersStamped: DM5PR1201MB0121 Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: quoted-printable From: Tom Lendacky BZ: https://bugzilla.tianocore.org/show_bug.cgi?id=3D3108 To ensure that we always use a validated encryption mask for an SEV-ES guest, create a new interface in the MemEncryptSevLib library to return the encryption mask. This can be used in place of the multiple locations where CPUID is used to retrieve the value (which would require validation again) and allows the validated mask to be returned. The PEI phase will use the value from the SEV-ES work area. Since the SEV-ES work area isn't valid in the DXE phase, the DXE phase will use the PcdPteMemoryEncryptionAddressOrMask PCD which is set during PEI. Cc: Jordan Justen Cc: Laszlo Ersek Cc: Ard Biesheuvel Cc: Rebecca Cran Cc: Peter Grehan Cc: Anthony Perard Cc: Julien Grall Cc: Brijesh Singh Acked-by: Laszlo Ersek Signed-off-by: Tom Lendacky --- OvmfPkg/AmdSev/AmdSevX64.dsc = | 4 +- OvmfPkg/Bhyve/BhyveX64.dsc = | 4 +- OvmfPkg/OvmfPkgIa32.dsc = | 4 +- OvmfPkg/OvmfPkgIa32X64.dsc = | 4 +- OvmfPkg/OvmfPkgX64.dsc = | 4 +- OvmfPkg/OvmfXen.dsc = | 3 +- OvmfPkg/Library/BaseMemEncryptSevLib/{BaseMemEncryptSevLib.inf =3D> DxeMem= EncryptSevLib.inf} | 15 +- OvmfPkg/Library/BaseMemEncryptSevLib/PeiMemEncryptSevLib.inf = | 56 +++++++ OvmfPkg/Include/Library/MemEncryptSevLib.h = | 12 ++ OvmfPkg/Library/BaseMemEncryptSevLib/DxeMemEncryptSevLibInternal.c = | 145 ++++++++++++++++++ OvmfPkg/Library/BaseMemEncryptSevLib/MemEncryptSevLibInternal.c = | 94 +----------- OvmfPkg/Library/BaseMemEncryptSevLib/PeiMemEncryptSevLibInternal.c = | 159 ++++++++++++++++++++ 12 files changed, 400 insertions(+), 104 deletions(-) diff --git a/OvmfPkg/AmdSev/AmdSevX64.dsc b/OvmfPkg/AmdSev/AmdSevX64.dsc index bb7697eb324b..d39436e7afc9 100644 --- a/OvmfPkg/AmdSev/AmdSevX64.dsc +++ b/OvmfPkg/AmdSev/AmdSevX64.dsc @@ -164,7 +164,7 @@ [LibraryClasses] QemuFwCfgSimpleParserLib|OvmfPkg/Library/QemuFwCfgSimpleParserLib/QemuFw= CfgSimpleParserLib.inf VirtioLib|OvmfPkg/Library/VirtioLib/VirtioLib.inf LoadLinuxLib|OvmfPkg/Library/LoadLinuxLib/LoadLinuxLib.inf - MemEncryptSevLib|OvmfPkg/Library/BaseMemEncryptSevLib/BaseMemEncryptSevL= ib.inf + MemEncryptSevLib|OvmfPkg/Library/BaseMemEncryptSevLib/DxeMemEncryptSevLi= b.inf LockBoxLib|OvmfPkg/Library/LockBoxLib/LockBoxBaseLib.inf CustomizedDisplayLib|MdeModulePkg/Library/CustomizedDisplayLib/Customize= dDisplayLib.inf FrameBufferBltLib|MdeModulePkg/Library/FrameBufferBltLib/FrameBufferBltL= ib.inf @@ -285,6 +285,8 @@ [LibraryClasses.common.PEIM] Tpm2DeviceLib|SecurityPkg/Library/Tpm2DeviceLibDTpm/Tpm2DeviceLibDTpm.in= f !endif =20 + MemEncryptSevLib|OvmfPkg/Library/BaseMemEncryptSevLib/PeiMemEncryptSevLi= b.inf + [LibraryClasses.common.DXE_CORE] HobLib|MdePkg/Library/DxeCoreHobLib/DxeCoreHobLib.inf DxeCoreEntryPoint|MdePkg/Library/DxeCoreEntryPoint/DxeCoreEntryPoint.inf diff --git a/OvmfPkg/Bhyve/BhyveX64.dsc b/OvmfPkg/Bhyve/BhyveX64.dsc index b93fe30ae4e0..33edf3d2d6b5 100644 --- a/OvmfPkg/Bhyve/BhyveX64.dsc +++ b/OvmfPkg/Bhyve/BhyveX64.dsc @@ -163,7 +163,7 @@ [LibraryClasses] QemuFwCfgS3Lib|OvmfPkg/Library/QemuFwCfgS3Lib/BaseQemuFwCfgS3LibNull.inf BhyveFwCtlLib|OvmfPkg/Library/BhyveFwCtlLib/BhyveFwCtlLib.inf VirtioLib|OvmfPkg/Library/VirtioLib/VirtioLib.inf - MemEncryptSevLib|OvmfPkg/Library/BaseMemEncryptSevLib/BaseMemEncryptSevL= ib.inf + MemEncryptSevLib|OvmfPkg/Library/BaseMemEncryptSevLib/DxeMemEncryptSevLi= b.inf LockBoxLib|OvmfPkg/Library/LockBoxLib/LockBoxBaseLib.inf =20 CustomizedDisplayLib|MdeModulePkg/Library/CustomizedDisplayLib/Customize= dDisplayLib.inf @@ -292,6 +292,8 @@ [LibraryClasses.common.PEIM] Tpm2DeviceLib|SecurityPkg/Library/Tpm2DeviceLibDTpm/Tpm2DeviceLibDTpm.in= f !endif =20 + MemEncryptSevLib|OvmfPkg/Library/BaseMemEncryptSevLib/PeiMemEncryptSevLi= b.inf + [LibraryClasses.common.DXE_CORE] HobLib|MdePkg/Library/DxeCoreHobLib/DxeCoreHobLib.inf DxeCoreEntryPoint|MdePkg/Library/DxeCoreEntryPoint/DxeCoreEntryPoint.inf diff --git a/OvmfPkg/OvmfPkgIa32.dsc b/OvmfPkg/OvmfPkgIa32.dsc index 26a013ec353e..75c5f46a7786 100644 --- a/OvmfPkg/OvmfPkgIa32.dsc +++ b/OvmfPkg/OvmfPkgIa32.dsc @@ -170,7 +170,7 @@ [LibraryClasses] QemuFwCfgSimpleParserLib|OvmfPkg/Library/QemuFwCfgSimpleParserLib/QemuFw= CfgSimpleParserLib.inf VirtioLib|OvmfPkg/Library/VirtioLib/VirtioLib.inf LoadLinuxLib|OvmfPkg/Library/LoadLinuxLib/LoadLinuxLib.inf - MemEncryptSevLib|OvmfPkg/Library/BaseMemEncryptSevLib/BaseMemEncryptSevL= ib.inf + MemEncryptSevLib|OvmfPkg/Library/BaseMemEncryptSevLib/DxeMemEncryptSevLi= b.inf !if $(SMM_REQUIRE) =3D=3D FALSE LockBoxLib|OvmfPkg/Library/LockBoxLib/LockBoxBaseLib.inf !endif @@ -310,6 +310,8 @@ [LibraryClasses.common.PEIM] Tpm2DeviceLib|SecurityPkg/Library/Tpm2DeviceLibDTpm/Tpm2DeviceLibDTpm.in= f !endif =20 + MemEncryptSevLib|OvmfPkg/Library/BaseMemEncryptSevLib/PeiMemEncryptSevLi= b.inf + [LibraryClasses.common.DXE_CORE] HobLib|MdePkg/Library/DxeCoreHobLib/DxeCoreHobLib.inf DxeCoreEntryPoint|MdePkg/Library/DxeCoreEntryPoint/DxeCoreEntryPoint.inf diff --git a/OvmfPkg/OvmfPkgIa32X64.dsc b/OvmfPkg/OvmfPkgIa32X64.dsc index 10579fe46c5b..8693248b4ea0 100644 --- a/OvmfPkg/OvmfPkgIa32X64.dsc +++ b/OvmfPkg/OvmfPkgIa32X64.dsc @@ -174,7 +174,7 @@ [LibraryClasses] QemuFwCfgSimpleParserLib|OvmfPkg/Library/QemuFwCfgSimpleParserLib/QemuFw= CfgSimpleParserLib.inf VirtioLib|OvmfPkg/Library/VirtioLib/VirtioLib.inf LoadLinuxLib|OvmfPkg/Library/LoadLinuxLib/LoadLinuxLib.inf - MemEncryptSevLib|OvmfPkg/Library/BaseMemEncryptSevLib/BaseMemEncryptSevL= ib.inf + MemEncryptSevLib|OvmfPkg/Library/BaseMemEncryptSevLib/DxeMemEncryptSevLi= b.inf !if $(SMM_REQUIRE) =3D=3D FALSE LockBoxLib|OvmfPkg/Library/LockBoxLib/LockBoxBaseLib.inf !endif @@ -314,6 +314,8 @@ [LibraryClasses.common.PEIM] Tpm2DeviceLib|SecurityPkg/Library/Tpm2DeviceLibDTpm/Tpm2DeviceLibDTpm.in= f !endif =20 + MemEncryptSevLib|OvmfPkg/Library/BaseMemEncryptSevLib/PeiMemEncryptSevLi= b.inf + [LibraryClasses.common.DXE_CORE] HobLib|MdePkg/Library/DxeCoreHobLib/DxeCoreHobLib.inf DxeCoreEntryPoint|MdePkg/Library/DxeCoreEntryPoint/DxeCoreEntryPoint.inf diff --git a/OvmfPkg/OvmfPkgX64.dsc b/OvmfPkg/OvmfPkgX64.dsc index c9235e48ad62..799468e08e92 100644 --- a/OvmfPkg/OvmfPkgX64.dsc +++ b/OvmfPkg/OvmfPkgX64.dsc @@ -174,7 +174,7 @@ [LibraryClasses] QemuFwCfgSimpleParserLib|OvmfPkg/Library/QemuFwCfgSimpleParserLib/QemuFw= CfgSimpleParserLib.inf VirtioLib|OvmfPkg/Library/VirtioLib/VirtioLib.inf LoadLinuxLib|OvmfPkg/Library/LoadLinuxLib/LoadLinuxLib.inf - MemEncryptSevLib|OvmfPkg/Library/BaseMemEncryptSevLib/BaseMemEncryptSevL= ib.inf + MemEncryptSevLib|OvmfPkg/Library/BaseMemEncryptSevLib/DxeMemEncryptSevLi= b.inf !if $(SMM_REQUIRE) =3D=3D FALSE LockBoxLib|OvmfPkg/Library/LockBoxLib/LockBoxBaseLib.inf !endif @@ -314,6 +314,8 @@ [LibraryClasses.common.PEIM] Tpm2DeviceLib|SecurityPkg/Library/Tpm2DeviceLibDTpm/Tpm2DeviceLibDTpm.in= f !endif =20 + MemEncryptSevLib|OvmfPkg/Library/BaseMemEncryptSevLib/PeiMemEncryptSevLi= b.inf + [LibraryClasses.common.DXE_CORE] HobLib|MdePkg/Library/DxeCoreHobLib/DxeCoreHobLib.inf DxeCoreEntryPoint|MdePkg/Library/DxeCoreEntryPoint/DxeCoreEntryPoint.inf diff --git a/OvmfPkg/OvmfXen.dsc b/OvmfPkg/OvmfXen.dsc index 12b7a87ee877..c13388ba5a05 100644 --- a/OvmfPkg/OvmfXen.dsc +++ b/OvmfPkg/OvmfXen.dsc @@ -161,7 +161,7 @@ [LibraryClasses] SerializeVariablesLib|OvmfPkg/Library/SerializeVariablesLib/SerializeVar= iablesLib.inf QemuFwCfgLib|OvmfPkg/Library/QemuFwCfgLib/QemuFwCfgDxeLib.inf QemuLoadImageLib|OvmfPkg/Library/GenericQemuLoadImageLib/GenericQemuLoad= ImageLib.inf - MemEncryptSevLib|OvmfPkg/Library/BaseMemEncryptSevLib/BaseMemEncryptSevL= ib.inf + MemEncryptSevLib|OvmfPkg/Library/BaseMemEncryptSevLib/DxeMemEncryptSevLi= b.inf LockBoxLib|OvmfPkg/Library/LockBoxLib/LockBoxBaseLib.inf CustomizedDisplayLib|MdeModulePkg/Library/CustomizedDisplayLib/Customize= dDisplayLib.inf FrameBufferBltLib|MdeModulePkg/Library/FrameBufferBltLib/FrameBufferBltL= ib.inf @@ -273,6 +273,7 @@ [LibraryClasses.common.PEIM] QemuFwCfgS3Lib|OvmfPkg/Library/QemuFwCfgS3Lib/PeiQemuFwCfgS3LibFwCfg.inf PcdLib|MdePkg/Library/PeiPcdLib/PeiPcdLib.inf QemuFwCfgLib|OvmfPkg/Library/QemuFwCfgLib/QemuFwCfgPeiLib.inf + MemEncryptSevLib|OvmfPkg/Library/BaseMemEncryptSevLib/PeiMemEncryptSevLi= b.inf =20 [LibraryClasses.common.DXE_CORE] HobLib|MdePkg/Library/DxeCoreHobLib/DxeCoreHobLib.inf diff --git a/OvmfPkg/Library/BaseMemEncryptSevLib/BaseMemEncryptSevLib.inf = b/OvmfPkg/Library/BaseMemEncryptSevLib/DxeMemEncryptSevLib.inf similarity index 68% rename from OvmfPkg/Library/BaseMemEncryptSevLib/BaseMemEncryptSevLib.inf rename to OvmfPkg/Library/BaseMemEncryptSevLib/DxeMemEncryptSevLib.inf index 7c44d0952815..837db0876184 100644 --- a/OvmfPkg/Library/BaseMemEncryptSevLib/BaseMemEncryptSevLib.inf +++ b/OvmfPkg/Library/BaseMemEncryptSevLib/DxeMemEncryptSevLib.inf @@ -1,7 +1,7 @@ ## @file # Library provides the helper functions for SEV guest # -# Copyright (c) 2017 Advanced Micro Devices. All rights reserved.
+# Copyright (c) 2017 - 2020, Advanced Micro Devices. All rights reserved.<= BR> # # SPDX-License-Identifier: BSD-2-Clause-Patent # @@ -10,11 +10,11 @@ =20 [Defines] INF_VERSION =3D 1.25 - BASE_NAME =3D MemEncryptSevLib + BASE_NAME =3D DxeMemEncryptSevLib FILE_GUID =3D c1594631-3888-4be4-949f-9c630dbc842b MODULE_TYPE =3D BASE VERSION_STRING =3D 1.0 - LIBRARY_CLASS =3D MemEncryptSevLib|PEIM DXE_DRIVER DXE_= RUNTIME_DRIVER DXE_SMM_DRIVER UEFI_DRIVER + LIBRARY_CLASS =3D MemEncryptSevLib|DXE_DRIVER DXE_RUNTI= ME_DRIVER DXE_SMM_DRIVER UEFI_DRIVER =20 # # The following information is for reference only and not required by the = build @@ -29,15 +29,17 @@ [Packages] OvmfPkg/OvmfPkg.dec UefiCpuPkg/UefiCpuPkg.dec =20 +[Sources] + DxeMemEncryptSevLibInternal.c + MemEncryptSevLibInternal.c + [Sources.X64] - MemEncryptSevLibInternal.c X64/MemEncryptSevLib.c X64/VirtualMemory.c X64/VirtualMemory.h =20 [Sources.IA32] Ia32/MemEncryptSevLib.c - MemEncryptSevLibInternal.c =20 [LibraryClasses] BaseLib @@ -49,3 +51,6 @@ [LibraryClasses] =20 [FeaturePcd] gUefiOvmfPkgTokenSpaceGuid.PcdSmmSmramRequire + +[Pcd] + gEfiMdeModulePkgTokenSpaceGuid.PcdPteMemoryEncryptionAddressOrMask diff --git a/OvmfPkg/Library/BaseMemEncryptSevLib/PeiMemEncryptSevLib.inf b= /OvmfPkg/Library/BaseMemEncryptSevLib/PeiMemEncryptSevLib.inf new file mode 100644 index 000000000000..c3cd046cb630 --- /dev/null +++ b/OvmfPkg/Library/BaseMemEncryptSevLib/PeiMemEncryptSevLib.inf @@ -0,0 +1,56 @@ +## @file +# Library provides the helper functions for SEV guest +# +# Copyright (c) 2020 Advanced Micro Devices. All rights reserved.
+# +# SPDX-License-Identifier: BSD-2-Clause-Patent +# +# +## + +[Defines] + INF_VERSION =3D 1.25 + BASE_NAME =3D PeiMemEncryptSevLib + FILE_GUID =3D 15d9a694-3d2a-4184-9672-ba55c3070e07 + MODULE_TYPE =3D BASE + VERSION_STRING =3D 1.0 + LIBRARY_CLASS =3D MemEncryptSevLib|PEIM + +# +# The following information is for reference only and not required by the = build +# tools. +# +# VALID_ARCHITECTURES =3D IA32 X64 +# + +[Packages] + MdeModulePkg/MdeModulePkg.dec + MdePkg/MdePkg.dec + OvmfPkg/OvmfPkg.dec + UefiCpuPkg/UefiCpuPkg.dec + +[Sources] + MemEncryptSevLibInternal.c + PeiMemEncryptSevLibInternal.c + +[Sources.X64] + X64/MemEncryptSevLib.c + X64/VirtualMemory.c + X64/VirtualMemory.h + +[Sources.IA32] + Ia32/MemEncryptSevLib.c + +[LibraryClasses] + BaseLib + CacheMaintenanceLib + CpuLib + DebugLib + MemoryAllocationLib + PcdLib + +[FeaturePcd] + gUefiOvmfPkgTokenSpaceGuid.PcdSmmSmramRequire + +[FixedPcd] + gUefiCpuPkgTokenSpaceGuid.PcdSevEsWorkAreaBase diff --git a/OvmfPkg/Include/Library/MemEncryptSevLib.h b/OvmfPkg/Include/L= ibrary/MemEncryptSevLib.h index a2c70aa550fe..872abe6725dc 100644 --- a/OvmfPkg/Include/Library/MemEncryptSevLib.h +++ b/OvmfPkg/Include/Library/MemEncryptSevLib.h @@ -135,4 +135,16 @@ MemEncryptSevLocateInitialSmramSaveStateMapPages ( OUT UINTN *BaseAddress, OUT UINTN *NumberOfPages ); + +/** + Returns the SEV encryption mask. + + @return The SEV pagetable encryption mask +**/ +UINT64 +EFIAPI +MemEncryptSevGetEncryptionMask ( + VOID + ); + #endif // _MEM_ENCRYPT_SEV_LIB_H_ diff --git a/OvmfPkg/Library/BaseMemEncryptSevLib/DxeMemEncryptSevLibIntern= al.c b/OvmfPkg/Library/BaseMemEncryptSevLib/DxeMemEncryptSevLibInternal.c new file mode 100644 index 000000000000..2816f859a0c4 --- /dev/null +++ b/OvmfPkg/Library/BaseMemEncryptSevLib/DxeMemEncryptSevLibInternal.c @@ -0,0 +1,145 @@ +/** @file + + Secure Encrypted Virtualization (SEV) library helper function + + Copyright (c) 2017 - 2020, AMD Incorporated. All rights reserved.
+ + SPDX-License-Identifier: BSD-2-Clause-Patent + +**/ + +#include +#include +#include +#include +#include +#include +#include +#include + +STATIC BOOLEAN mSevStatus =3D FALSE; +STATIC BOOLEAN mSevEsStatus =3D FALSE; +STATIC BOOLEAN mSevStatusChecked =3D FALSE; + +STATIC UINT64 mSevEncryptionMask =3D 0; +STATIC BOOLEAN mSevEncryptionMaskSaved =3D FALSE; + +/** + Reads and sets the status of SEV features. + + **/ +STATIC +VOID +EFIAPI +InternalMemEncryptSevStatus ( + VOID + ) +{ + UINT32 RegEax; + MSR_SEV_STATUS_REGISTER Msr; + CPUID_MEMORY_ENCRYPTION_INFO_EAX Eax; + BOOLEAN ReadSevMsr; + UINT64 EncryptionMask; + + ReadSevMsr =3D FALSE; + + EncryptionMask =3D PcdGet64 (PcdPteMemoryEncryptionAddressOrMask); + if (EncryptionMask !=3D 0) { + // + // The MSR has been read before, so it is safe to read it again and av= oid + // having to validate the CPUID information. + // + ReadSevMsr =3D TRUE; + } else { + // + // Check if memory encryption leaf exist + // + AsmCpuid (CPUID_EXTENDED_FUNCTION, &RegEax, NULL, NULL, NULL); + if (RegEax >=3D CPUID_MEMORY_ENCRYPTION_INFO) { + // + // CPUID Fn8000_001F[EAX] Bit 1 (Sev supported) + // + AsmCpuid (CPUID_MEMORY_ENCRYPTION_INFO, &Eax.Uint32, NULL, NULL, NUL= L); + + if (Eax.Bits.SevBit) { + ReadSevMsr =3D TRUE; + } + } + } + + if (ReadSevMsr) { + // + // Check MSR_0xC0010131 Bit 0 (Sev Enabled) + // + Msr.Uint32 =3D AsmReadMsr32 (MSR_SEV_STATUS); + if (Msr.Bits.SevBit) { + mSevStatus =3D TRUE; + } + + // + // Check MSR_0xC0010131 Bit 1 (Sev-Es Enabled) + // + if (Msr.Bits.SevEsBit) { + mSevEsStatus =3D TRUE; + } + } + + mSevStatusChecked =3D TRUE; +} + +/** + Returns a boolean to indicate whether SEV-ES is enabled. + + @retval TRUE SEV-ES is enabled + @retval FALSE SEV-ES is not enabled +**/ +BOOLEAN +EFIAPI +MemEncryptSevEsIsEnabled ( + VOID + ) +{ + if (!mSevStatusChecked) { + InternalMemEncryptSevStatus (); + } + + return mSevEsStatus; +} + +/** + Returns a boolean to indicate whether SEV is enabled. + + @retval TRUE SEV is enabled + @retval FALSE SEV is not enabled +**/ +BOOLEAN +EFIAPI +MemEncryptSevIsEnabled ( + VOID + ) +{ + if (!mSevStatusChecked) { + InternalMemEncryptSevStatus (); + } + + return mSevStatus; +} + +/** + Returns the SEV encryption mask. + + @return The SEV pagtable encryption mask +**/ +UINT64 +EFIAPI +MemEncryptSevGetEncryptionMask ( + VOID + ) +{ + if (!mSevEncryptionMaskSaved) { + mSevEncryptionMask =3D PcdGet64 (PcdPteMemoryEncryptionAddressOrMask); + mSevEncryptionMaskSaved =3D TRUE; + } + + return mSevEncryptionMask; +} diff --git a/OvmfPkg/Library/BaseMemEncryptSevLib/MemEncryptSevLibInternal.= c b/OvmfPkg/Library/BaseMemEncryptSevLib/MemEncryptSevLibInternal.c index 02b8eb225d81..b4a9f464e268 100644 --- a/OvmfPkg/Library/BaseMemEncryptSevLib/MemEncryptSevLibInternal.c +++ b/OvmfPkg/Library/BaseMemEncryptSevLib/MemEncryptSevLibInternal.c @@ -2,7 +2,7 @@ =20 Secure Encrypted Virtualization (SEV) library helper function =20 - Copyright (c) 2017, AMD Incorporated. All rights reserved.
+ Copyright (c) 2017 - 2020, AMD Incorporated. All rights reserved.
=20 SPDX-License-Identifier: BSD-2-Clause-Patent =20 @@ -12,102 +12,10 @@ #include #include #include -#include -#include -#include #include #include #include =20 -STATIC BOOLEAN mSevStatus =3D FALSE; -STATIC BOOLEAN mSevEsStatus =3D FALSE; -STATIC BOOLEAN mSevStatusChecked =3D FALSE; - -/** - Reads and sets the status of SEV features. - - **/ -STATIC -VOID -EFIAPI -InternalMemEncryptSevStatus ( - VOID - ) -{ - UINT32 RegEax; - MSR_SEV_STATUS_REGISTER Msr; - CPUID_MEMORY_ENCRYPTION_INFO_EAX Eax; - - // - // Check if memory encryption leaf exist - // - AsmCpuid (CPUID_EXTENDED_FUNCTION, &RegEax, NULL, NULL, NULL); - if (RegEax >=3D CPUID_MEMORY_ENCRYPTION_INFO) { - // - // CPUID Fn8000_001F[EAX] Bit 1 (Sev supported) - // - AsmCpuid (CPUID_MEMORY_ENCRYPTION_INFO, &Eax.Uint32, NULL, NULL, NULL)= ; - - if (Eax.Bits.SevBit) { - // - // Check MSR_0xC0010131 Bit 0 (Sev Enabled) - // - Msr.Uint32 =3D AsmReadMsr32 (MSR_SEV_STATUS); - if (Msr.Bits.SevBit) { - mSevStatus =3D TRUE; - } - - // - // Check MSR_0xC0010131 Bit 1 (Sev-Es Enabled) - // - if (Msr.Bits.SevEsBit) { - mSevEsStatus =3D TRUE; - } - } - } - - mSevStatusChecked =3D TRUE; -} - -/** - Returns a boolean to indicate whether SEV-ES is enabled. - - @retval TRUE SEV-ES is enabled - @retval FALSE SEV-ES is not enabled -**/ -BOOLEAN -EFIAPI -MemEncryptSevEsIsEnabled ( - VOID - ) -{ - if (!mSevStatusChecked) { - InternalMemEncryptSevStatus (); - } - - return mSevEsStatus; -} - -/** - Returns a boolean to indicate whether SEV is enabled. - - @retval TRUE SEV is enabled - @retval FALSE SEV is not enabled -**/ -BOOLEAN -EFIAPI -MemEncryptSevIsEnabled ( - VOID - ) -{ - if (!mSevStatusChecked) { - InternalMemEncryptSevStatus (); - } - - return mSevStatus; -} - - /** Locate the page range that covers the initial (pre-SMBASE-relocation) SM= RAM Save State Map. diff --git a/OvmfPkg/Library/BaseMemEncryptSevLib/PeiMemEncryptSevLibIntern= al.c b/OvmfPkg/Library/BaseMemEncryptSevLib/PeiMemEncryptSevLibInternal.c new file mode 100644 index 000000000000..e2fd109d120f --- /dev/null +++ b/OvmfPkg/Library/BaseMemEncryptSevLib/PeiMemEncryptSevLibInternal.c @@ -0,0 +1,159 @@ +/** @file + + Secure Encrypted Virtualization (SEV) library helper function + + Copyright (c) 2020, AMD Incorporated. All rights reserved.
+ + SPDX-License-Identifier: BSD-2-Clause-Patent + +**/ + +#include +#include +#include +#include +#include +#include +#include +#include + +STATIC BOOLEAN mSevStatus =3D FALSE; +STATIC BOOLEAN mSevEsStatus =3D FALSE; +STATIC BOOLEAN mSevStatusChecked =3D FALSE; + +STATIC UINT64 mSevEncryptionMask =3D 0; +STATIC BOOLEAN mSevEncryptionMaskSaved =3D FALSE; + +/** + Reads and sets the status of SEV features. + + **/ +STATIC +VOID +EFIAPI +InternalMemEncryptSevStatus ( + VOID + ) +{ + UINT32 RegEax; + MSR_SEV_STATUS_REGISTER Msr; + CPUID_MEMORY_ENCRYPTION_INFO_EAX Eax; + BOOLEAN ReadSevMsr; + SEC_SEV_ES_WORK_AREA *SevEsWorkArea; + + ReadSevMsr =3D FALSE; + + SevEsWorkArea =3D (SEC_SEV_ES_WORK_AREA *) FixedPcdGet32 (PcdSevEsWorkAr= eaBase); + if (SevEsWorkArea !=3D NULL && SevEsWorkArea->EncryptionMask !=3D 0) { + // + // The MSR has been read before, so it is safe to read it again and av= oid + // having to validate the CPUID information. + // + ReadSevMsr =3D TRUE; + } else { + // + // Check if memory encryption leaf exist + // + AsmCpuid (CPUID_EXTENDED_FUNCTION, &RegEax, NULL, NULL, NULL); + if (RegEax >=3D CPUID_MEMORY_ENCRYPTION_INFO) { + // + // CPUID Fn8000_001F[EAX] Bit 1 (Sev supported) + // + AsmCpuid (CPUID_MEMORY_ENCRYPTION_INFO, &Eax.Uint32, NULL, NULL, NUL= L); + + if (Eax.Bits.SevBit) { + ReadSevMsr =3D TRUE; + } + } + } + + if (ReadSevMsr) { + // + // Check MSR_0xC0010131 Bit 0 (Sev Enabled) + // + Msr.Uint32 =3D AsmReadMsr32 (MSR_SEV_STATUS); + if (Msr.Bits.SevBit) { + mSevStatus =3D TRUE; + } + + // + // Check MSR_0xC0010131 Bit 1 (Sev-Es Enabled) + // + if (Msr.Bits.SevEsBit) { + mSevEsStatus =3D TRUE; + } + } + + mSevStatusChecked =3D TRUE; +} + +/** + Returns a boolean to indicate whether SEV-ES is enabled. + + @retval TRUE SEV-ES is enabled + @retval FALSE SEV-ES is not enabled +**/ +BOOLEAN +EFIAPI +MemEncryptSevEsIsEnabled ( + VOID + ) +{ + if (!mSevStatusChecked) { + InternalMemEncryptSevStatus (); + } + + return mSevEsStatus; +} + +/** + Returns a boolean to indicate whether SEV is enabled. + + @retval TRUE SEV is enabled + @retval FALSE SEV is not enabled +**/ +BOOLEAN +EFIAPI +MemEncryptSevIsEnabled ( + VOID + ) +{ + if (!mSevStatusChecked) { + InternalMemEncryptSevStatus (); + } + + return mSevStatus; +} + +/** + Returns the SEV encryption mask. + + @return The SEV pagtable encryption mask +**/ +UINT64 +EFIAPI +MemEncryptSevGetEncryptionMask ( + VOID + ) +{ + if (!mSevEncryptionMaskSaved) { + SEC_SEV_ES_WORK_AREA *SevEsWorkArea; + + SevEsWorkArea =3D (SEC_SEV_ES_WORK_AREA *) FixedPcdGet32 (PcdSevEsWork= AreaBase); + if (SevEsWorkArea !=3D NULL) { + mSevEncryptionMask =3D SevEsWorkArea->EncryptionMask; + } else { + CPUID_MEMORY_ENCRYPTION_INFO_EBX Ebx; + + // + // CPUID Fn8000_001F[EBX] Bit 0:5 (memory encryption bit position) + // + AsmCpuid (CPUID_MEMORY_ENCRYPTION_INFO, NULL, &Ebx.Uint32, NULL, NUL= L); + mSevEncryptionMask =3D LShiftU64 (1, Ebx.Bits.PtePosBits); + } + + mSevEncryptionMaskSaved =3D TRUE; + } + + return mSevEncryptionMask; +} --=20 2.30.0