2 Initialize Secure Encrypted Virtualization (SEV) support
4 Copyright (c) 2017 - 2020, Advanced Micro Devices. All rights reserved.<BR>
6 SPDX-License-Identifier: BSD-2-Clause-Patent
10 // The package level header files this module uses
12 #include <IndustryStandard/Q35MchIch9.h>
13 #include <Library/BaseMemoryLib.h>
14 #include <Library/DebugLib.h>
15 #include <Library/HobLib.h>
16 #include <Library/MemEncryptSevLib.h>
17 #include <Library/MemoryAllocationLib.h>
18 #include <Library/PcdLib.h>
20 #include <Register/Amd/Msr.h>
21 #include <Register/Intel/SmramSaveStateMap.h>
22 #include <Library/CcExitLib.h>
23 #include <ConfidentialComputingGuestAttr.h>
29 GetHypervisorFeature (
34 Initialize SEV-SNP support if running as an SEV-SNP guest.
43 EFI_PEI_HOB_POINTERS Hob
;
44 EFI_HOB_RESOURCE_DESCRIPTOR
*ResourceHob
;
48 if (!MemEncryptSevSnpIsEnabled ()) {
53 // Query the hypervisor feature using the VmgExit and set the value in the
54 // hypervisor features PCD.
56 HvFeatures
= GetHypervisorFeature ();
57 PcdStatus
= PcdSet64S (PcdGhcbHypervisorFeatures
, HvFeatures
);
58 ASSERT_RETURN_ERROR (PcdStatus
);
61 // Iterate through the system RAM and validate it.
63 for (Hob
.Raw
= GetHobList (); !END_OF_HOB_LIST (Hob
); Hob
.Raw
= GET_NEXT_HOB (Hob
)) {
64 if ((Hob
.Raw
!= NULL
) && (GET_HOB_TYPE (Hob
) == EFI_HOB_TYPE_RESOURCE_DESCRIPTOR
)) {
65 ResourceHob
= Hob
.ResourceDescriptor
;
67 if (ResourceHob
->ResourceType
== EFI_RESOURCE_SYSTEM_MEMORY
) {
68 MemEncryptSevSnpPreValidateSystemRam (
69 ResourceHob
->PhysicalStart
,
70 EFI_SIZE_TO_PAGES ((UINTN
)ResourceHob
->ResourceLength
)
78 Handle an SEV-SNP/GHCB protocol check failure.
80 Notify the hypervisor using the VMGEXIT instruction that the SEV-SNP guest
81 wishes to be terminated.
83 @param[in] ReasonCode Reason code to provide to the hypervisor for the
89 SevEsProtocolFailure (
93 MSR_SEV_ES_GHCB_REGISTER Msr
;
96 // Use the GHCB MSR Protocol to request termination by the hypervisor
98 Msr
.GhcbPhysicalAddress
= 0;
99 Msr
.GhcbTerminate
.Function
= GHCB_INFO_TERMINATE_REQUEST
;
100 Msr
.GhcbTerminate
.ReasonCodeSet
= GHCB_TERMINATE_GHCB
;
101 Msr
.GhcbTerminate
.ReasonCode
= ReasonCode
;
102 AsmWriteMsr64 (MSR_SEV_ES_GHCB
, Msr
.GhcbPhysicalAddress
);
111 Get the hypervisor features bitmap
116 GetHypervisorFeature (
122 MSR_SEV_ES_GHCB_REGISTER Msr
;
123 BOOLEAN InterruptState
;
126 Msr
.GhcbPhysicalAddress
= AsmReadMsr64 (MSR_SEV_ES_GHCB
);
130 // Initialize the GHCB
132 VmgInit (Ghcb
, &InterruptState
);
135 // Query the Hypervisor Features.
137 Status
= VmgExit (Ghcb
, SVM_EXIT_HYPERVISOR_FEATURES
, 0, 0);
139 SevEsProtocolFailure (GHCB_TERMINATE_GHCB_GENERAL
);
142 Features
= Ghcb
->SaveArea
.SwExitInfo2
;
144 VmgDone (Ghcb
, InterruptState
);
151 This function can be used to register the GHCB GPA.
153 @param[in] Address The physical address to be registered.
159 IN EFI_PHYSICAL_ADDRESS Address
162 MSR_SEV_ES_GHCB_REGISTER Msr
;
163 MSR_SEV_ES_GHCB_REGISTER CurrentMsr
;
166 // Save the current MSR Value
168 CurrentMsr
.GhcbPhysicalAddress
= AsmReadMsr64 (MSR_SEV_ES_GHCB
);
171 // Use the GHCB MSR Protocol to request to register the GPA.
173 Msr
.GhcbPhysicalAddress
= Address
& ~EFI_PAGE_MASK
;
174 Msr
.GhcbGpaRegister
.Function
= GHCB_INFO_GHCB_GPA_REGISTER_REQUEST
;
175 AsmWriteMsr64 (MSR_SEV_ES_GHCB
, Msr
.GhcbPhysicalAddress
);
179 Msr
.GhcbPhysicalAddress
= AsmReadMsr64 (MSR_SEV_ES_GHCB
);
182 // If hypervisor responded with a different GPA than requested then fail.
184 if ((Msr
.GhcbGpaRegister
.Function
!= GHCB_INFO_GHCB_GPA_REGISTER_RESPONSE
) ||
185 ((Msr
.GhcbPhysicalAddress
& ~EFI_PAGE_MASK
) != Address
))
187 SevEsProtocolFailure (GHCB_TERMINATE_GHCB_GENERAL
);
193 AsmWriteMsr64 (MSR_SEV_ES_GHCB
, CurrentMsr
.GhcbPhysicalAddress
);
198 Initialize SEV-ES support if running as an SEV-ES guest.
208 PHYSICAL_ADDRESS GhcbBasePa
;
210 UINT8
*GhcbBackupBase
;
211 UINT8
*GhcbBackupPages
;
212 UINTN GhcbBackupPageCount
;
213 SEV_ES_PER_CPU_DATA
*SevEsData
;
215 RETURN_STATUS PcdStatus
, DecryptStatus
;
216 IA32_DESCRIPTOR Gdtr
;
219 if (!MemEncryptSevEsIsEnabled ()) {
223 PcdStatus
= PcdSetBoolS (PcdSevEsIsEnabled
, TRUE
);
224 ASSERT_RETURN_ERROR (PcdStatus
);
227 // Allocate GHCB and per-CPU variable pages.
228 // Since the pages must survive across the UEFI to OS transition
229 // make them reserved.
231 GhcbPageCount
= mPlatformInfoHob
.PcdCpuMaxLogicalProcessorNumber
* 2;
232 GhcbBase
= AllocateReservedPages (GhcbPageCount
);
233 ASSERT (GhcbBase
!= NULL
);
235 GhcbBasePa
= (PHYSICAL_ADDRESS
)(UINTN
)GhcbBase
;
238 // Each vCPU gets two consecutive pages, the first is the GHCB and the
239 // second is the per-CPU variable page. Loop through the allocation and
240 // only clear the encryption mask for the GHCB pages.
242 for (PageCount
= 0; PageCount
< GhcbPageCount
; PageCount
+= 2) {
243 DecryptStatus
= MemEncryptSevClearPageEncMask (
245 GhcbBasePa
+ EFI_PAGES_TO_SIZE (PageCount
),
248 ASSERT_RETURN_ERROR (DecryptStatus
);
251 ZeroMem (GhcbBase
, EFI_PAGES_TO_SIZE (GhcbPageCount
));
253 PcdStatus
= PcdSet64S (PcdGhcbBase
, GhcbBasePa
);
254 ASSERT_RETURN_ERROR (PcdStatus
);
255 PcdStatus
= PcdSet64S (PcdGhcbSize
, EFI_PAGES_TO_SIZE (GhcbPageCount
));
256 ASSERT_RETURN_ERROR (PcdStatus
);
260 "SEV-ES is enabled, %lu GHCB pages allocated starting at 0x%p\n",
261 (UINT64
)GhcbPageCount
,
266 // Allocate #VC recursion backup pages. The number of backup pages needed is
267 // one less than the maximum VC count.
269 GhcbBackupPageCount
= mPlatformInfoHob
.PcdCpuMaxLogicalProcessorNumber
* (VMGEXIT_MAXIMUM_VC_COUNT
- 1);
270 GhcbBackupBase
= AllocatePages (GhcbBackupPageCount
);
271 ASSERT (GhcbBackupBase
!= NULL
);
273 GhcbBackupPages
= GhcbBackupBase
;
274 for (PageCount
= 1; PageCount
< GhcbPageCount
; PageCount
+= 2) {
276 (SEV_ES_PER_CPU_DATA
*)(GhcbBase
+ EFI_PAGES_TO_SIZE (PageCount
));
277 SevEsData
->GhcbBackupPages
= GhcbBackupPages
;
279 GhcbBackupPages
+= EFI_PAGE_SIZE
* (VMGEXIT_MAXIMUM_VC_COUNT
- 1);
284 "SEV-ES is enabled, %lu GHCB backup pages allocated starting at 0x%p\n",
285 (UINT64
)GhcbBackupPageCount
,
290 // SEV-SNP guest requires that GHCB GPA must be registered before using it.
292 if (MemEncryptSevSnpIsEnabled ()) {
293 GhcbRegister (GhcbBasePa
);
296 AsmWriteMsr64 (MSR_SEV_ES_GHCB
, GhcbBasePa
);
299 // The SEV support will clear the C-bit from non-RAM areas. The early GDT
300 // lives in a non-RAM area, so when an exception occurs (like a #VC) the GDT
301 // will be read as un-encrypted even though it was created before the C-bit
302 // was cleared (encrypted). This will result in a failure to be able to
303 // handle the exception.
307 Gdt
= AllocatePages (EFI_SIZE_TO_PAGES ((UINTN
)Gdtr
.Limit
+ 1));
308 ASSERT (Gdt
!= NULL
);
310 CopyMem (Gdt
, (VOID
*)Gdtr
.Base
, Gdtr
.Limit
+ 1);
311 Gdtr
.Base
= (UINTN
)Gdt
;
312 AsmWriteGdtr (&Gdtr
);
317 Function checks if SEV support is available, if present then it sets
318 the dynamic PcdPteMemoryEncryptionAddressOrMask with memory encryption mask.
326 UINT64 EncryptionMask
;
327 RETURN_STATUS PcdStatus
;
330 // Check if SEV is enabled
332 if (!MemEncryptSevIsEnabled ()) {
337 // Check and perform SEV-SNP initialization if required. This need to be
338 // done before the GHCB page is made shared in the AmdSevEsInitialize(). This
339 // is because the system RAM must be validated before it is made shared.
340 // The AmdSevSnpInitialize() validates the system RAM.
342 AmdSevSnpInitialize ();
345 // Set Memory Encryption Mask PCD
347 EncryptionMask
= MemEncryptSevGetEncryptionMask ();
348 PcdStatus
= PcdSet64S (PcdPteMemoryEncryptionAddressOrMask
, EncryptionMask
);
349 ASSERT_RETURN_ERROR (PcdStatus
);
351 DEBUG ((DEBUG_INFO
, "SEV is enabled (mask 0x%lx)\n", EncryptionMask
));
354 // Set Pcd to Deny the execution of option ROM when security
357 PcdStatus
= PcdSet32S (PcdOptionRomImageVerificationPolicy
, 0x4);
358 ASSERT_RETURN_ERROR (PcdStatus
);
361 // When SMM is required, cover the pages containing the initial SMRAM Save
362 // State Map with a memory allocation HOB:
364 // There's going to be a time interval between our decrypting those pages for
365 // SMBASE relocation and re-encrypting the same pages after SMBASE
366 // relocation. We shall ensure that the DXE phase stay away from those pages
367 // until after re-encryption, in order to prevent an information leak to the
370 if (mPlatformInfoHob
.SmmSmramRequire
&& (mPlatformInfoHob
.BootMode
!= BOOT_ON_S3_RESUME
)) {
371 RETURN_STATUS LocateMapStatus
;
375 LocateMapStatus
= MemEncryptSevLocateInitialSmramSaveStateMapPages (
379 ASSERT_RETURN_ERROR (LocateMapStatus
);
381 if (mPlatformInfoHob
.Q35SmramAtDefaultSmbase
) {
383 // The initial SMRAM Save State Map has been covered as part of a larger
384 // reserved memory allocation in InitializeRamRegions().
386 ASSERT (SMM_DEFAULT_SMBASE
<= MapPagesBase
);
388 (MapPagesBase
+ EFI_PAGES_TO_SIZE (MapPagesCount
) <=
389 SMM_DEFAULT_SMBASE
+ MCH_DEFAULT_SMBASE_SIZE
)
392 BuildMemoryAllocationHob (
393 MapPagesBase
, // BaseAddress
394 EFI_PAGES_TO_SIZE (MapPagesCount
), // Length
395 EfiBootServicesData
// MemoryType
401 // Check and perform SEV-ES initialization if required.
403 AmdSevEsInitialize ();
406 // Set the Confidential computing attr PCD to communicate which SEV
407 // technology is active.
409 if (MemEncryptSevSnpIsEnabled ()) {
410 PcdStatus
= PcdSet64S (PcdConfidentialComputingGuestAttr
, CCAttrAmdSevSnp
);
411 } else if (MemEncryptSevEsIsEnabled ()) {
412 PcdStatus
= PcdSet64S (PcdConfidentialComputingGuestAttr
, CCAttrAmdSevEs
);
414 PcdStatus
= PcdSet64S (PcdConfidentialComputingGuestAttr
, CCAttrAmdSev
);
417 ASSERT_RETURN_ERROR (PcdStatus
);
421 The function performs SEV specific region initialization.
429 if (MemEncryptSevSnpIsEnabled ()) {
431 // If SEV-SNP is enabled, reserve the Secrets and CPUID memory area.
433 // This memory range is given to the PSP by the hypervisor to populate
434 // the information used during the SNP VM boots, and it need to persist
435 // across the kexec boots. Mark it as EfiReservedMemoryType so that
436 // the guest firmware and OS does not use it as a system memory.
438 BuildMemoryAllocationHob (
439 (EFI_PHYSICAL_ADDRESS
)(UINTN
)PcdGet32 (PcdOvmfSnpSecretsBase
),
440 (UINT64
)(UINTN
)PcdGet32 (PcdOvmfSnpSecretsSize
),
441 EfiReservedMemoryType
443 BuildMemoryAllocationHob (
444 (EFI_PHYSICAL_ADDRESS
)(UINTN
)PcdGet32 (PcdOvmfCpuidBase
),
445 (UINT64
)(UINTN
)PcdGet32 (PcdOvmfCpuidSize
),
446 EfiReservedMemoryType