[mirror_edk2.git] / OvmfPkg / PlatformPei / AmdSev.c

/**@file\r
  Initialize Secure Encrypted Virtualization (SEV) support\r
\r
  Copyright (c) 2017 - 2020, Advanced Micro Devices. All rights reserved.<BR>\r
\r
  SPDX-License-Identifier: BSD-2-Clause-Patent\r
\r
**/\r
//\r
// The package level header files this module uses\r
//\r
#include <IndustryStandard/Q35MchIch9.h>\r
#include <Library/BaseMemoryLib.h>\r
#include <Library/DebugLib.h>\r
#include <Library/HobLib.h>\r
#include <Library/MemEncryptSevLib.h>\r
#include <Library/MemoryAllocationLib.h>\r
#include <Library/PcdLib.h>\r
#include <PiPei.h>\r
#include <Register/Amd/Msr.h>\r
#include <Register/Intel/SmramSaveStateMap.h>\r
#include <Library/VmgExitLib.h>\r
#include <ConfidentialComputingGuestAttr.h>\r
\r
#include "Platform.h"\r
\r
STATIC\r
UINT64\r
GetHypervisorFeature (\r
  VOID\r
  );\r
\r
/**\r
  Initialize SEV-SNP support if running as an SEV-SNP guest.\r
\r
**/\r
STATIC\r
VOID\r
AmdSevSnpInitialize (\r
  VOID\r
  )\r
{\r
  EFI_PEI_HOB_POINTERS         Hob;\r
  EFI_HOB_RESOURCE_DESCRIPTOR  *ResourceHob;\r
  UINT64                       HvFeatures;\r
  EFI_STATUS                   PcdStatus;\r
\r
  if (!MemEncryptSevSnpIsEnabled ()) {\r
    return;\r
  }\r
\r
  //\r
  // Query the hypervisor feature using the VmgExit and set the value in the\r
  // hypervisor features PCD.\r
  //\r
  HvFeatures = GetHypervisorFeature ();\r
  PcdStatus  = PcdSet64S (PcdGhcbHypervisorFeatures, HvFeatures);\r
  ASSERT_RETURN_ERROR (PcdStatus);\r
\r
  //\r
  // Iterate through the system RAM and validate it.\r
  //\r
  for (Hob.Raw = GetHobList (); !END_OF_HOB_LIST (Hob); Hob.Raw = GET_NEXT_HOB (Hob)) {\r
    if ((Hob.Raw != NULL) && (GET_HOB_TYPE (Hob) == EFI_HOB_TYPE_RESOURCE_DESCRIPTOR)) {\r
      ResourceHob = Hob.ResourceDescriptor;\r
\r
      if (ResourceHob->ResourceType == EFI_RESOURCE_SYSTEM_MEMORY) {\r
        MemEncryptSevSnpPreValidateSystemRam (\r
          ResourceHob->PhysicalStart,\r
          EFI_SIZE_TO_PAGES ((UINTN)ResourceHob->ResourceLength)\r
          );\r
      }\r
    }\r
  }\r
}\r
\r
/**\r
  Handle an SEV-SNP/GHCB protocol check failure.\r
\r
  Notify the hypervisor using the VMGEXIT instruction that the SEV-SNP guest\r
  wishes to be terminated.\r
\r
  @param[in] ReasonCode  Reason code to provide to the hypervisor for the\r
                         termination request.\r
\r
**/\r
STATIC\r
VOID\r
SevEsProtocolFailure (\r
  IN UINT8  ReasonCode\r
  )\r
{\r
  MSR_SEV_ES_GHCB_REGISTER  Msr;\r
\r
  //\r
  // Use the GHCB MSR Protocol to request termination by the hypervisor\r
  //\r
  Msr.GhcbPhysicalAddress         = 0;\r
  Msr.GhcbTerminate.Function      = GHCB_INFO_TERMINATE_REQUEST;\r
  Msr.GhcbTerminate.ReasonCodeSet = GHCB_TERMINATE_GHCB;\r
  Msr.GhcbTerminate.ReasonCode    = ReasonCode;\r
  AsmWriteMsr64 (MSR_SEV_ES_GHCB, Msr.GhcbPhysicalAddress);\r
\r
  AsmVmgExit ();\r
\r
  ASSERT (FALSE);\r
  CpuDeadLoop ();\r
}\r
\r
/**\r
 Get the hypervisor features bitmap\r
\r
**/\r
STATIC\r
UINT64\r
GetHypervisorFeature (\r
  VOID\r
  )\r
{\r
  UINT64                    Status;\r
  GHCB                      *Ghcb;\r
  MSR_SEV_ES_GHCB_REGISTER  Msr;\r
  BOOLEAN                   InterruptState;\r
  UINT64                    Features;\r
\r
  Msr.GhcbPhysicalAddress = AsmReadMsr64 (MSR_SEV_ES_GHCB);\r
  Ghcb                    = Msr.Ghcb;\r
\r
  //\r
  // Initialize the GHCB\r
  //\r
  VmgInit (Ghcb, &InterruptState);\r
\r
  //\r
  // Query the Hypervisor Features.\r
  //\r
  Status = VmgExit (Ghcb, SVM_EXIT_HYPERVISOR_FEATURES, 0, 0);\r
  if ((Status != 0)) {\r
    SevEsProtocolFailure (GHCB_TERMINATE_GHCB_GENERAL);\r
  }\r
\r
  Features = Ghcb->SaveArea.SwExitInfo2;\r
\r
  VmgDone (Ghcb, InterruptState);\r
\r
  return Features;\r
}\r
\r
/**\r
\r
  This function can be used to register the GHCB GPA.\r
\r
  @param[in]  Address           The physical address to be registered.\r
\r
**/\r
STATIC\r
VOID\r
GhcbRegister (\r
  IN  EFI_PHYSICAL_ADDRESS  Address\r
  )\r
{\r
  MSR_SEV_ES_GHCB_REGISTER  Msr;\r
  MSR_SEV_ES_GHCB_REGISTER  CurrentMsr;\r
\r
  //\r
  // Save the current MSR Value\r
  //\r
  CurrentMsr.GhcbPhysicalAddress = AsmReadMsr64 (MSR_SEV_ES_GHCB);\r
\r
  //\r
  // Use the GHCB MSR Protocol to request to register the GPA.\r
  //\r
  Msr.GhcbPhysicalAddress      = Address & ~EFI_PAGE_MASK;\r
  Msr.GhcbGpaRegister.Function = GHCB_INFO_GHCB_GPA_REGISTER_REQUEST;\r
  AsmWriteMsr64 (MSR_SEV_ES_GHCB, Msr.GhcbPhysicalAddress);\r
\r
  AsmVmgExit ();\r
\r
  Msr.GhcbPhysicalAddress = AsmReadMsr64 (MSR_SEV_ES_GHCB);\r
\r
  //\r
  // If hypervisor responded with a different GPA than requested then fail.\r
  //\r
  if ((Msr.GhcbGpaRegister.Function != GHCB_INFO_GHCB_GPA_REGISTER_RESPONSE) ||\r
      ((Msr.GhcbPhysicalAddress & ~EFI_PAGE_MASK) != Address))\r
  {\r
    SevEsProtocolFailure (GHCB_TERMINATE_GHCB_GENERAL);\r
  }\r
\r
  //\r
  // Restore the MSR\r
  //\r
  AsmWriteMsr64 (MSR_SEV_ES_GHCB, CurrentMsr.GhcbPhysicalAddress);\r
}\r
\r
/**\r
\r
  Initialize SEV-ES support if running as an SEV-ES guest.\r
\r
  **/\r
STATIC\r
VOID\r
AmdSevEsInitialize (\r
  VOID\r
  )\r
{\r
  UINT8                *GhcbBase;\r
  PHYSICAL_ADDRESS     GhcbBasePa;\r
  UINTN                GhcbPageCount;\r
  UINT8                *GhcbBackupBase;\r
  UINT8                *GhcbBackupPages;\r
  UINTN                GhcbBackupPageCount;\r
  SEV_ES_PER_CPU_DATA  *SevEsData;\r
  UINTN                PageCount;\r
  RETURN_STATUS        PcdStatus, DecryptStatus;\r
  IA32_DESCRIPTOR      Gdtr;\r
  VOID                 *Gdt;\r
\r
  if (!MemEncryptSevEsIsEnabled ()) {\r
    return;\r
  }\r
\r
  PcdStatus = PcdSetBoolS (PcdSevEsIsEnabled, TRUE);\r
  ASSERT_RETURN_ERROR (PcdStatus);\r
\r
  //\r
  // Allocate GHCB and per-CPU variable pages.\r
  //   Since the pages must survive across the UEFI to OS transition\r
  //   make them reserved.\r
  //\r
  GhcbPageCount = mMaxCpuCount * 2;\r
  GhcbBase      = AllocateReservedPages (GhcbPageCount);\r
  ASSERT (GhcbBase != NULL);\r
\r
  GhcbBasePa = (PHYSICAL_ADDRESS)(UINTN)GhcbBase;\r
\r
  //\r
  // Each vCPU gets two consecutive pages, the first is the GHCB and the\r
  // second is the per-CPU variable page. Loop through the allocation and\r
  // only clear the encryption mask for the GHCB pages.\r
  //\r
  for (PageCount = 0; PageCount < GhcbPageCount; PageCount += 2) {\r
    DecryptStatus = MemEncryptSevClearPageEncMask (\r
                      0,\r
                      GhcbBasePa + EFI_PAGES_TO_SIZE (PageCount),\r
                      1\r
                      );\r
    ASSERT_RETURN_ERROR (DecryptStatus);\r
  }\r
\r
  ZeroMem (GhcbBase, EFI_PAGES_TO_SIZE (GhcbPageCount));\r
\r
  PcdStatus = PcdSet64S (PcdGhcbBase, GhcbBasePa);\r
  ASSERT_RETURN_ERROR (PcdStatus);\r
  PcdStatus = PcdSet64S (PcdGhcbSize, EFI_PAGES_TO_SIZE (GhcbPageCount));\r
  ASSERT_RETURN_ERROR (PcdStatus);\r
\r
  DEBUG ((\r
    DEBUG_INFO,\r
    "SEV-ES is enabled, %lu GHCB pages allocated starting at 0x%p\n",\r
    (UINT64)GhcbPageCount,\r
    GhcbBase\r
    ));\r
\r
  //\r
  // Allocate #VC recursion backup pages. The number of backup pages needed is\r
  // one less than the maximum VC count.\r
  //\r
  GhcbBackupPageCount = mMaxCpuCount * (VMGEXIT_MAXIMUM_VC_COUNT - 1);\r
  GhcbBackupBase      = AllocatePages (GhcbBackupPageCount);\r
  ASSERT (GhcbBackupBase != NULL);\r
\r
  GhcbBackupPages = GhcbBackupBase;\r
  for (PageCount = 1; PageCount < GhcbPageCount; PageCount += 2) {\r
    SevEsData =\r
      (SEV_ES_PER_CPU_DATA *)(GhcbBase + EFI_PAGES_TO_SIZE (PageCount));\r
    SevEsData->GhcbBackupPages = GhcbBackupPages;\r
\r
    GhcbBackupPages += EFI_PAGE_SIZE * (VMGEXIT_MAXIMUM_VC_COUNT - 1);\r
  }\r
\r
  DEBUG ((\r
    DEBUG_INFO,\r
    "SEV-ES is enabled, %lu GHCB backup pages allocated starting at 0x%p\n",\r
    (UINT64)GhcbBackupPageCount,\r
    GhcbBackupBase\r
    ));\r
\r
  //\r
  // SEV-SNP guest requires that GHCB GPA must be registered before using it.\r
  //\r
  if (MemEncryptSevSnpIsEnabled ()) {\r
    GhcbRegister (GhcbBasePa);\r
  }\r
\r
  AsmWriteMsr64 (MSR_SEV_ES_GHCB, GhcbBasePa);\r
\r
  //\r
  // The SEV support will clear the C-bit from non-RAM areas.  The early GDT\r
  // lives in a non-RAM area, so when an exception occurs (like a #VC) the GDT\r
  // will be read as un-encrypted even though it was created before the C-bit\r
  // was cleared (encrypted). This will result in a failure to be able to\r
  // handle the exception.\r
  //\r
  AsmReadGdtr (&Gdtr);\r
\r
  Gdt = AllocatePages (EFI_SIZE_TO_PAGES ((UINTN)Gdtr.Limit + 1));\r
  ASSERT (Gdt != NULL);\r
\r
  CopyMem (Gdt, (VOID *)Gdtr.Base, Gdtr.Limit + 1);\r
  Gdtr.Base = (UINTN)Gdt;\r
  AsmWriteGdtr (&Gdtr);\r
}\r
\r
/**\r
\r
  Function checks if SEV support is available, if present then it sets\r
  the dynamic PcdPteMemoryEncryptionAddressOrMask with memory encryption mask.\r
\r
  **/\r
VOID\r
AmdSevInitialize (\r
  VOID\r
  )\r
{\r
  UINT64         EncryptionMask;\r
  RETURN_STATUS  PcdStatus;\r
\r
  //\r
  // Check if SEV is enabled\r
  //\r
  if (!MemEncryptSevIsEnabled ()) {\r
    return;\r
  }\r
\r
  //\r
  // Check and perform SEV-SNP initialization if required. This need to be\r
  // done before the GHCB page is made shared in the AmdSevEsInitialize(). This\r
  // is because the system RAM must be validated before it is made shared.\r
  // The AmdSevSnpInitialize() validates the system RAM.\r
  //\r
  AmdSevSnpInitialize ();\r
\r
  //\r
  // Set Memory Encryption Mask PCD\r
  //\r
  EncryptionMask = MemEncryptSevGetEncryptionMask ();\r
  PcdStatus      = PcdSet64S (PcdPteMemoryEncryptionAddressOrMask, EncryptionMask);\r
  ASSERT_RETURN_ERROR (PcdStatus);\r
\r
  DEBUG ((DEBUG_INFO, "SEV is enabled (mask 0x%lx)\n", EncryptionMask));\r
\r
  //\r
  // Set Pcd to Deny the execution of option ROM when security\r
  // violation.\r
  //\r
  PcdStatus = PcdSet32S (PcdOptionRomImageVerificationPolicy, 0x4);\r
  ASSERT_RETURN_ERROR (PcdStatus);\r
\r
  //\r
  // When SMM is required, cover the pages containing the initial SMRAM Save\r
  // State Map with a memory allocation HOB:\r
  //\r
  // There's going to be a time interval between our decrypting those pages for\r
  // SMBASE relocation and re-encrypting the same pages after SMBASE\r
  // relocation. We shall ensure that the DXE phase stay away from those pages\r
  // until after re-encryption, in order to prevent an information leak to the\r
  // hypervisor.\r
  //\r
  if (FeaturePcdGet (PcdSmmSmramRequire) && (mBootMode != BOOT_ON_S3_RESUME)) {\r
    RETURN_STATUS  LocateMapStatus;\r
    UINTN          MapPagesBase;\r
    UINTN          MapPagesCount;\r
\r
    LocateMapStatus = MemEncryptSevLocateInitialSmramSaveStateMapPages (\r
                        &MapPagesBase,\r
                        &MapPagesCount\r
                        );\r
    ASSERT_RETURN_ERROR (LocateMapStatus);\r
\r
    if (mQ35SmramAtDefaultSmbase) {\r
      //\r
      // The initial SMRAM Save State Map has been covered as part of a larger\r
      // reserved memory allocation in InitializeRamRegions().\r
      //\r
      ASSERT (SMM_DEFAULT_SMBASE <= MapPagesBase);\r
      ASSERT (\r
        (MapPagesBase + EFI_PAGES_TO_SIZE (MapPagesCount) <=\r
         SMM_DEFAULT_SMBASE + MCH_DEFAULT_SMBASE_SIZE)\r
        );\r
    } else {\r
      BuildMemoryAllocationHob (\r
        MapPagesBase,                      // BaseAddress\r
        EFI_PAGES_TO_SIZE (MapPagesCount), // Length\r
        EfiBootServicesData                // MemoryType\r
        );\r
    }\r
  }\r
\r
  //\r
  // Check and perform SEV-ES initialization if required.\r
  //\r
  AmdSevEsInitialize ();\r
\r
  //\r
  // Set the Confidential computing attr PCD to communicate which SEV\r
  // technology is active.\r
  //\r
  if (MemEncryptSevSnpIsEnabled ()) {\r
    PcdStatus = PcdSet64S (PcdConfidentialComputingGuestAttr, CCAttrAmdSevSnp);\r
  } else if (MemEncryptSevEsIsEnabled ()) {\r
    PcdStatus = PcdSet64S (PcdConfidentialComputingGuestAttr, CCAttrAmdSevEs);\r
  } else {\r
    PcdStatus = PcdSet64S (PcdConfidentialComputingGuestAttr, CCAttrAmdSev);\r
  }\r
\r
  ASSERT_RETURN_ERROR (PcdStatus);\r
}\r
\r
/**\r
 The function performs SEV specific region initialization.\r
\r
 **/\r
VOID\r
SevInitializeRam (\r
  VOID\r
  )\r
{\r
  if (MemEncryptSevSnpIsEnabled ()) {\r
    //\r
    // If SEV-SNP is enabled, reserve the Secrets and CPUID memory area.\r
    //\r
    // This memory range is given to the PSP by the hypervisor to populate\r
    // the information used during the SNP VM boots, and it need to persist\r
    // across the kexec boots. Mark it as EfiReservedMemoryType so that\r
    // the guest firmware and OS does not use it as a system memory.\r
    //\r
    BuildMemoryAllocationHob (\r
      (EFI_PHYSICAL_ADDRESS)(UINTN)PcdGet32 (PcdOvmfSnpSecretsBase),\r
      (UINT64)(UINTN)PcdGet32 (PcdOvmfSnpSecretsSize),\r
      EfiReservedMemoryType\r
      );\r
    BuildMemoryAllocationHob (\r
      (EFI_PHYSICAL_ADDRESS)(UINTN)PcdGet32 (PcdOvmfCpuidBase),\r
      (UINT64)(UINTN)PcdGet32 (PcdOvmfCpuidSize),\r
      EfiReservedMemoryType\r
      );\r
  }\r
}\r
Commit	Line	Data
13b5d743 BS	1	/**@file\r
	2	Initialize Secure Encrypted Virtualization (SEV) support\r
	3	\r
45388d04	4	Copyright (c) 2017 - 2020, Advanced Micro Devices. All rights reserved.<BR>\r
13b5d743	5	\r
b26f0cf9	6	SPDX-License-Identifier: BSD-2-Clause-Patent\r
13b5d743 BS	7	\r
	8	**/\r
	9	//\r
	10	// The package level header files this module uses\r
	11	//\r
300aae11	12	#include <IndustryStandard/Q35MchIch9.h>\r
449a6e49	13	#include <Library/BaseMemoryLib.h>\r
13b5d743	14	#include <Library/DebugLib.h>\r
86defc2c	15	#include <Library/HobLib.h>\r
6d576e7a	16	#include <Library/MemEncryptSevLib.h>\r
449a6e49	17	#include <Library/MemoryAllocationLib.h>\r
13b5d743	18	#include <Library/PcdLib.h>\r
6d576e7a	19	#include <PiPei.h>\r
449a6e49	20	#include <Register/Amd/Msr.h>\r
300aae11	21	#include <Register/Intel/SmramSaveStateMap.h>\r
a19b6489	22	#include <Library/VmgExitLib.h>\r
504ae26b	23	#include <ConfidentialComputingGuestAttr.h>\r
13b5d743	24	\r
c0d221a3 LE	25	#include "Platform.h"\r
c0d221a3 LE	26	\r
f5a6e1ba BS	27	STATIC\r
	28	UINT64\r
	29	GetHypervisorFeature (\r
	30	VOID\r
	31	);\r
	32	\r
8eb79b5f BS	33	/**\r
	34	Initialize SEV-SNP support if running as an SEV-SNP guest.\r
	35	\r
	36	**/\r
	37	STATIC\r
	38	VOID\r
	39	AmdSevSnpInitialize (\r
	40	VOID\r
	41	)\r
	42	{\r
	43	EFI_PEI_HOB_POINTERS Hob;\r
	44	EFI_HOB_RESOURCE_DESCRIPTOR *ResourceHob;\r
f5a6e1ba BS	45	UINT64 HvFeatures;\r
f5a6e1ba BS	46	EFI_STATUS PcdStatus;\r
8eb79b5f BS	47	\r
	48	if (!MemEncryptSevSnpIsEnabled ()) {\r
	49	return;\r
	50	}\r
	51	\r
f5a6e1ba BS	52	//\r
	53	// Query the hypervisor feature using the VmgExit and set the value in the\r
	54	// hypervisor features PCD.\r
	55	//\r
	56	HvFeatures = GetHypervisorFeature ();\r
	57	PcdStatus = PcdSet64S (PcdGhcbHypervisorFeatures, HvFeatures);\r
	58	ASSERT_RETURN_ERROR (PcdStatus);\r
	59	\r
8eb79b5f BS	60	//\r
	61	// Iterate through the system RAM and validate it.\r
	62	//\r
	63	for (Hob.Raw = GetHobList (); !END_OF_HOB_LIST (Hob); Hob.Raw = GET_NEXT_HOB (Hob)) {\r
	64	if ((Hob.Raw != NULL) && (GET_HOB_TYPE (Hob) == EFI_HOB_TYPE_RESOURCE_DESCRIPTOR)) {\r
	65	ResourceHob = Hob.ResourceDescriptor;\r
	66	\r
	67	if (ResourceHob->ResourceType == EFI_RESOURCE_SYSTEM_MEMORY) {\r
	68	MemEncryptSevSnpPreValidateSystemRam (\r
	69	ResourceHob->PhysicalStart,\r
	70	EFI_SIZE_TO_PAGES ((UINTN)ResourceHob->ResourceLength)\r
	71	);\r
	72	}\r
	73	}\r
	74	}\r
	75	}\r
	76	\r
a19b6489 BS	77	/**\r
	78	Handle an SEV-SNP/GHCB protocol check failure.\r
	79	\r
	80	Notify the hypervisor using the VMGEXIT instruction that the SEV-SNP guest\r
	81	wishes to be terminated.\r
	82	\r
	83	@param[in] ReasonCode Reason code to provide to the hypervisor for the\r
	84	termination request.\r
	85	\r
	86	**/\r
	87	STATIC\r
	88	VOID\r
	89	SevEsProtocolFailure (\r
	90	IN UINT8 ReasonCode\r
	91	)\r
	92	{\r
	93	MSR_SEV_ES_GHCB_REGISTER Msr;\r
	94	\r
	95	//\r
	96	// Use the GHCB MSR Protocol to request termination by the hypervisor\r
	97	//\r
	98	Msr.GhcbPhysicalAddress = 0;\r
	99	Msr.GhcbTerminate.Function = GHCB_INFO_TERMINATE_REQUEST;\r
	100	Msr.GhcbTerminate.ReasonCodeSet = GHCB_TERMINATE_GHCB;\r
	101	Msr.GhcbTerminate.ReasonCode = ReasonCode;\r
	102	AsmWriteMsr64 (MSR_SEV_ES_GHCB, Msr.GhcbPhysicalAddress);\r
	103	\r
	104	AsmVmgExit ();\r
	105	\r
	106	ASSERT (FALSE);\r
	107	CpuDeadLoop ();\r
	108	}\r
	109	\r
f5a6e1ba BS	110	/**\r
	111	Get the hypervisor features bitmap\r
	112	\r
	113	**/\r
	114	STATIC\r
	115	UINT64\r
	116	GetHypervisorFeature (\r
	117	VOID\r
	118	)\r
	119	{\r
	120	UINT64 Status;\r
	121	GHCB *Ghcb;\r
	122	MSR_SEV_ES_GHCB_REGISTER Msr;\r
	123	BOOLEAN InterruptState;\r
	124	UINT64 Features;\r
	125	\r
	126	Msr.GhcbPhysicalAddress = AsmReadMsr64 (MSR_SEV_ES_GHCB);\r
	127	Ghcb = Msr.Ghcb;\r
	128	\r
	129	//\r
	130	// Initialize the GHCB\r
	131	//\r
	132	VmgInit (Ghcb, &InterruptState);\r
	133	\r
	134	//\r
	135	// Query the Hypervisor Features.\r
	136	//\r
	137	Status = VmgExit (Ghcb, SVM_EXIT_HYPERVISOR_FEATURES, 0, 0);\r
	138	if ((Status != 0)) {\r
	139	SevEsProtocolFailure (GHCB_TERMINATE_GHCB_GENERAL);\r
	140	}\r
	141	\r
	142	Features = Ghcb->SaveArea.SwExitInfo2;\r
	143	\r
	144	VmgDone (Ghcb, InterruptState);\r
	145	\r
	146	return Features;\r
	147	}\r
	148	\r
a19b6489 BS	149	/**\r
	150	\r
	151	This function can be used to register the GHCB GPA.\r
	152	\r
	153	@param[in] Address The physical address to be registered.\r
	154	\r
	155	**/\r
	156	STATIC\r
	157	VOID\r
	158	GhcbRegister (\r
	159	IN EFI_PHYSICAL_ADDRESS Address\r
	160	)\r
	161	{\r
	162	MSR_SEV_ES_GHCB_REGISTER Msr;\r
	163	MSR_SEV_ES_GHCB_REGISTER CurrentMsr;\r
	164	\r
	165	//\r
	166	// Save the current MSR Value\r
	167	//\r
	168	CurrentMsr.GhcbPhysicalAddress = AsmReadMsr64 (MSR_SEV_ES_GHCB);\r
	169	\r
	170	//\r
	171	// Use the GHCB MSR Protocol to request to register the GPA.\r
	172	//\r
	173	Msr.GhcbPhysicalAddress = Address & ~EFI_PAGE_MASK;\r
	174	Msr.GhcbGpaRegister.Function = GHCB_INFO_GHCB_GPA_REGISTER_REQUEST;\r
	175	AsmWriteMsr64 (MSR_SEV_ES_GHCB, Msr.GhcbPhysicalAddress);\r
	176	\r
	177	AsmVmgExit ();\r
	178	\r
	179	Msr.GhcbPhysicalAddress = AsmReadMsr64 (MSR_SEV_ES_GHCB);\r
	180	\r
	181	//\r
	182	// If hypervisor responded with a different GPA than requested then fail.\r
	183	//\r
	184	if ((Msr.GhcbGpaRegister.Function != GHCB_INFO_GHCB_GPA_REGISTER_RESPONSE) \|\|\r
	185	((Msr.GhcbPhysicalAddress & ~EFI_PAGE_MASK) != Address))\r
	186	{\r
	187	SevEsProtocolFailure (GHCB_TERMINATE_GHCB_GENERAL);\r
	188	}\r
	189	\r
	190	//\r
	191	// Restore the MSR\r
	192	//\r
	193	AsmWriteMsr64 (MSR_SEV_ES_GHCB, CurrentMsr.GhcbPhysicalAddress);\r
	194	}\r
	195	\r
cf845a74 TL	196	/**\r
	197	\r
	198	Initialize SEV-ES support if running as an SEV-ES guest.\r
	199	\r
	200	**/\r
	201	STATIC\r
	202	VOID\r
	203	AmdSevEsInitialize (\r
	204	VOID\r
	205	)\r
	206	{\r
5667dc43 TL	207	UINT8 *GhcbBase;\r
	208	PHYSICAL_ADDRESS GhcbBasePa;\r
	209	UINTN GhcbPageCount;\r
	210	UINT8 *GhcbBackupBase;\r
	211	UINT8 *GhcbBackupPages;\r
	212	UINTN GhcbBackupPageCount;\r
	213	SEV_ES_PER_CPU_DATA *SevEsData;\r
	214	UINTN PageCount;\r
	215	RETURN_STATUS PcdStatus, DecryptStatus;\r
	216	IA32_DESCRIPTOR Gdtr;\r
	217	VOID *Gdt;\r
cf845a74 TL	218	\r
	219	if (!MemEncryptSevEsIsEnabled ()) {\r
	220	return;\r
	221	}\r
	222	\r
	223	PcdStatus = PcdSetBoolS (PcdSevEsIsEnabled, TRUE);\r
	224	ASSERT_RETURN_ERROR (PcdStatus);\r
449a6e49 TL	225	\r
	226	//\r
	227	// Allocate GHCB and per-CPU variable pages.\r
3b49d0a5 TL	228	// Since the pages must survive across the UEFI to OS transition\r
3b49d0a5 TL	229	// make them reserved.\r
449a6e49 TL	230	//\r
449a6e49 TL	231	GhcbPageCount = mMaxCpuCount * 2;\r
ac0a286f	232	GhcbBase = AllocateReservedPages (GhcbPageCount);\r
449a6e49 TL	233	ASSERT (GhcbBase != NULL);\r
449a6e49 TL	234	\r
ac0a286f	235	GhcbBasePa = (PHYSICAL_ADDRESS)(UINTN)GhcbBase;\r
449a6e49 TL	236	\r
	237	//\r
	238	// Each vCPU gets two consecutive pages, the first is the GHCB and the\r
	239	// second is the per-CPU variable page. Loop through the allocation and\r
	240	// only clear the encryption mask for the GHCB pages.\r
	241	//\r
	242	for (PageCount = 0; PageCount < GhcbPageCount; PageCount += 2) {\r
	243	DecryptStatus = MemEncryptSevClearPageEncMask (\r
ac0a286f MK	244	0,\r
	245	GhcbBasePa + EFI_PAGES_TO_SIZE (PageCount),\r
	246	1\r
	247	);\r
449a6e49 TL	248	ASSERT_RETURN_ERROR (DecryptStatus);\r
	249	}\r
	250	\r
	251	ZeroMem (GhcbBase, EFI_PAGES_TO_SIZE (GhcbPageCount));\r
	252	\r
	253	PcdStatus = PcdSet64S (PcdGhcbBase, GhcbBasePa);\r
	254	ASSERT_RETURN_ERROR (PcdStatus);\r
	255	PcdStatus = PcdSet64S (PcdGhcbSize, EFI_PAGES_TO_SIZE (GhcbPageCount));\r
	256	ASSERT_RETURN_ERROR (PcdStatus);\r
	257	\r
ac0a286f MK	258	DEBUG ((\r
ac0a286f MK	259	DEBUG_INFO,\r
449a6e49	260	"SEV-ES is enabled, %lu GHCB pages allocated starting at 0x%p\n",\r
ac0a286f MK	261	(UINT64)GhcbPageCount,\r
	262	GhcbBase\r
	263	));\r
449a6e49	264	\r
5667dc43 TL	265	//\r
	266	// Allocate #VC recursion backup pages. The number of backup pages needed is\r
	267	// one less than the maximum VC count.\r
	268	//\r
	269	GhcbBackupPageCount = mMaxCpuCount * (VMGEXIT_MAXIMUM_VC_COUNT - 1);\r
ac0a286f	270	GhcbBackupBase = AllocatePages (GhcbBackupPageCount);\r
5667dc43 TL	271	ASSERT (GhcbBackupBase != NULL);\r
	272	\r
	273	GhcbBackupPages = GhcbBackupBase;\r
	274	for (PageCount = 1; PageCount < GhcbPageCount; PageCount += 2) {\r
	275	SevEsData =\r
	276	(SEV_ES_PER_CPU_DATA *)(GhcbBase + EFI_PAGES_TO_SIZE (PageCount));\r
	277	SevEsData->GhcbBackupPages = GhcbBackupPages;\r
	278	\r
	279	GhcbBackupPages += EFI_PAGE_SIZE * (VMGEXIT_MAXIMUM_VC_COUNT - 1);\r
	280	}\r
	281	\r
ac0a286f MK	282	DEBUG ((\r
ac0a286f MK	283	DEBUG_INFO,\r
5667dc43	284	"SEV-ES is enabled, %lu GHCB backup pages allocated starting at 0x%p\n",\r
ac0a286f MK	285	(UINT64)GhcbBackupPageCount,\r
	286	GhcbBackupBase\r
	287	));\r
5667dc43	288	\r
a19b6489 BS	289	//\r
	290	// SEV-SNP guest requires that GHCB GPA must be registered before using it.\r
	291	//\r
	292	if (MemEncryptSevSnpIsEnabled ()) {\r
	293	GhcbRegister (GhcbBasePa);\r
	294	}\r
	295	\r
449a6e49	296	AsmWriteMsr64 (MSR_SEV_ES_GHCB, GhcbBasePa);\r
13ed9e5f TL	297	\r
	298	//\r
	299	// The SEV support will clear the C-bit from non-RAM areas. The early GDT\r
	300	// lives in a non-RAM area, so when an exception occurs (like a #VC) the GDT\r
	301	// will be read as un-encrypted even though it was created before the C-bit\r
	302	// was cleared (encrypted). This will result in a failure to be able to\r
	303	// handle the exception.\r
	304	//\r
	305	AsmReadGdtr (&Gdtr);\r
	306	\r
ac0a286f	307	Gdt = AllocatePages (EFI_SIZE_TO_PAGES ((UINTN)Gdtr.Limit + 1));\r
13ed9e5f TL	308	ASSERT (Gdt != NULL);\r
13ed9e5f TL	309	\r
ac0a286f MK	310	CopyMem (Gdt, (VOID *)Gdtr.Base, Gdtr.Limit + 1);\r
ac0a286f MK	311	Gdtr.Base = (UINTN)Gdt;\r
13ed9e5f	312	AsmWriteGdtr (&Gdtr);\r
cf845a74 TL	313	}\r
cf845a74 TL	314	\r
13b5d743 BS	315	/**\r
	316	\r
	317	Function checks if SEV support is available, if present then it sets\r
	318	the dynamic PcdPteMemoryEncryptionAddressOrMask with memory encryption mask.\r
	319	\r
	320	**/\r
	321	VOID\r
13b5d743 BS	322	AmdSevInitialize (\r
	323	VOID\r
	324	)\r
	325	{\r
ac0a286f MK	326	UINT64 EncryptionMask;\r
ac0a286f MK	327	RETURN_STATUS PcdStatus;\r
13b5d743 BS	328	\r
	329	//\r
	330	// Check if SEV is enabled\r
	331	//\r
	332	if (!MemEncryptSevIsEnabled ()) {\r
	333	return;\r
	334	}\r
	335	\r
8eb79b5f BS	336	//\r
	337	// Check and perform SEV-SNP initialization if required. This need to be\r
	338	// done before the GHCB page is made shared in the AmdSevEsInitialize(). This\r
	339	// is because the system RAM must be validated before it is made shared.\r
	340	// The AmdSevSnpInitialize() validates the system RAM.\r
	341	//\r
	342	AmdSevSnpInitialize ();\r
	343	\r
13b5d743 BS	344	//\r
	345	// Set Memory Encryption Mask PCD\r
	346	//\r
45388d04	347	EncryptionMask = MemEncryptSevGetEncryptionMask ();\r
ac0a286f	348	PcdStatus = PcdSet64S (PcdPteMemoryEncryptionAddressOrMask, EncryptionMask);\r
13b5d743 BS	349	ASSERT_RETURN_ERROR (PcdStatus);\r
	350	\r
	351	DEBUG ((DEBUG_INFO, "SEV is enabled (mask 0x%lx)\n", EncryptionMask));\r
6041ac65 BS	352	\r
	353	//\r
	354	// Set Pcd to Deny the execution of option ROM when security\r
	355	// violation.\r
	356	//\r
	357	PcdStatus = PcdSet32S (PcdOptionRomImageVerificationPolicy, 0x4);\r
	358	ASSERT_RETURN_ERROR (PcdStatus);\r
86defc2c LE	359	\r
	360	//\r
	361	// When SMM is required, cover the pages containing the initial SMRAM Save\r
	362	// State Map with a memory allocation HOB:\r
	363	//\r
	364	// There's going to be a time interval between our decrypting those pages for\r
	365	// SMBASE relocation and re-encrypting the same pages after SMBASE\r
	366	// relocation. We shall ensure that the DXE phase stay away from those pages\r
	367	// until after re-encryption, in order to prevent an information leak to the\r
	368	// hypervisor.\r
	369	//\r
	370	if (FeaturePcdGet (PcdSmmSmramRequire) && (mBootMode != BOOT_ON_S3_RESUME)) {\r
ac0a286f MK	371	RETURN_STATUS LocateMapStatus;\r
	372	UINTN MapPagesBase;\r
	373	UINTN MapPagesCount;\r
86defc2c LE	374	\r
	375	LocateMapStatus = MemEncryptSevLocateInitialSmramSaveStateMapPages (\r
	376	&MapPagesBase,\r
	377	&MapPagesCount\r
	378	);\r
	379	ASSERT_RETURN_ERROR (LocateMapStatus);\r
	380	\r
300aae11 LE	381	if (mQ35SmramAtDefaultSmbase) {\r
	382	//\r
	383	// The initial SMRAM Save State Map has been covered as part of a larger\r
	384	// reserved memory allocation in InitializeRamRegions().\r
	385	//\r
	386	ASSERT (SMM_DEFAULT_SMBASE <= MapPagesBase);\r
	387	ASSERT (\r
	388	(MapPagesBase + EFI_PAGES_TO_SIZE (MapPagesCount) <=\r
	389	SMM_DEFAULT_SMBASE + MCH_DEFAULT_SMBASE_SIZE)\r
	390	);\r
	391	} else {\r
	392	BuildMemoryAllocationHob (\r
	393	MapPagesBase, // BaseAddress\r
	394	EFI_PAGES_TO_SIZE (MapPagesCount), // Length\r
	395	EfiBootServicesData // MemoryType\r
	396	);\r
	397	}\r
86defc2c	398	}\r
cf845a74 TL	399	\r
	400	//\r
	401	// Check and perform SEV-ES initialization if required.\r
	402	//\r
	403	AmdSevEsInitialize ();\r
504ae26b BS	404	\r
	405	//\r
	406	// Set the Confidential computing attr PCD to communicate which SEV\r
	407	// technology is active.\r
	408	//\r
	409	if (MemEncryptSevSnpIsEnabled ()) {\r
	410	PcdStatus = PcdSet64S (PcdConfidentialComputingGuestAttr, CCAttrAmdSevSnp);\r
	411	} else if (MemEncryptSevEsIsEnabled ()) {\r
	412	PcdStatus = PcdSet64S (PcdConfidentialComputingGuestAttr, CCAttrAmdSevEs);\r
	413	} else {\r
	414	PcdStatus = PcdSet64S (PcdConfidentialComputingGuestAttr, CCAttrAmdSev);\r
	415	}\r
	416	\r
	417	ASSERT_RETURN_ERROR (PcdStatus);\r
13b5d743	418	}\r
ea3a12d9 BS	419	\r
	420	/**\r
	421	The function performs SEV specific region initialization.\r
	422	\r
	423	**/\r
	424	VOID\r
	425	SevInitializeRam (\r
	426	VOID\r
	427	)\r
	428	{\r
	429	if (MemEncryptSevSnpIsEnabled ()) {\r
	430	//\r
	431	// If SEV-SNP is enabled, reserve the Secrets and CPUID memory area.\r
	432	//\r
	433	// This memory range is given to the PSP by the hypervisor to populate\r
	434	// the information used during the SNP VM boots, and it need to persist\r
	435	// across the kexec boots. Mark it as EfiReservedMemoryType so that\r
	436	// the guest firmware and OS does not use it as a system memory.\r
	437	//\r
	438	BuildMemoryAllocationHob (\r
	439	(EFI_PHYSICAL_ADDRESS)(UINTN)PcdGet32 (PcdOvmfSnpSecretsBase),\r
	440	(UINT64)(UINTN)PcdGet32 (PcdOvmfSnpSecretsSize),\r
	441	EfiReservedMemoryType\r
	442	);\r
	443	BuildMemoryAllocationHob (\r
	444	(EFI_PHYSICAL_ADDRESS)(UINTN)PcdGet32 (PcdOvmfCpuidBase),\r
	445	(UINT64)(UINTN)PcdGet32 (PcdOvmfCpuidSize),\r
	446	EfiReservedMemoryType\r
	447	);\r
	448	}\r
	449	}\r