OvmfPkg/Include/Library/MemEncryptSevLib.h

   1 /** @file
   2
   3   Define Secure Encrypted Virtualization (SEV) base library helper function
   4
   5   Copyright (c) 2017 - 2020, AMD Incorporated. All rights reserved.<BR>
   6
   7   SPDX-License-Identifier: BSD-2-Clause-Patent
   8
   9 **/
  10
  11 #ifndef _MEM_ENCRYPT_SEV_LIB_H_
  12 #define _MEM_ENCRYPT_SEV_LIB_H_
  13
  14 #include <Base.h>
  15 #include <WorkArea.h>
  16
  17 //
  18 // Define the maximum number of #VCs allowed (e.g. the level of nesting
  19 // that is allowed => 2 allows for 1 nested #VCs). I this value is changed,
  20 // be sure to increase the size of
  21 //   gUefiOvmfPkgTokenSpaceGuid.PcdOvmfSecGhcbBackupSize
  22 // in any FDF file using this PCD.
  23 //
  24 #define VMGEXIT_MAXIMUM_VC_COUNT  2
  25
  26 //
  27 // Per-CPU data mapping structure
  28 //   Use UINT32 for cached indicators and compare to a specific value
  29 //   so that the hypervisor can't indicate a value is cached by just
  30 //   writing random data to that area.
  31 //
  32 typedef struct {
  33   UINT32    Dr7Cached;
  34   UINT64    Dr7;
  35
  36   UINTN     VcCount;
  37   VOID      *GhcbBackupPages;
  38 } SEV_ES_PER_CPU_DATA;
  39
  40 //
  41 // Memory encryption address range states.
  42 //
  43 typedef enum {
  44   MemEncryptSevAddressRangeUnencrypted,
  45   MemEncryptSevAddressRangeEncrypted,
  46   MemEncryptSevAddressRangeMixed,
  47   MemEncryptSevAddressRangeError,
  48 } MEM_ENCRYPT_SEV_ADDRESS_RANGE_STATE;
  49
  50 /**
  51   Returns a boolean to indicate whether SEV-SNP is enabled
  52
  53   @retval TRUE           SEV-SNP is enabled
  54   @retval FALSE          SEV-SNP is not enabled
  55 **/
  56 BOOLEAN
  57 EFIAPI
  58 MemEncryptSevSnpIsEnabled (
  59   VOID
  60   );
  61
  62 /**
  63   Returns a boolean to indicate whether SEV-ES is enabled.
  64
  65   @retval TRUE           SEV-ES is enabled
  66   @retval FALSE          SEV-ES is not enabled
  67 **/
  68 BOOLEAN
  69 EFIAPI
  70 MemEncryptSevEsIsEnabled (
  71   VOID
  72   );
  73
  74 /**
  75   Returns a boolean to indicate whether SEV is enabled
  76
  77   @retval TRUE           SEV is enabled
  78   @retval FALSE          SEV is not enabled
  79 **/
  80 BOOLEAN
  81 EFIAPI
  82 MemEncryptSevIsEnabled (
  83   VOID
  84   );
  85
  86 /**
  87   This function clears memory encryption bit for the memory region specified by
  88   BaseAddress and NumPages from the current page table context.
  89
  90   @param[in]  Cr3BaseAddress          Cr3 Base Address (if zero then use
  91                                       current CR3)
  92   @param[in]  BaseAddress             The physical address that is the start
  93                                       address of a memory region.
  94   @param[in]  NumPages                The number of pages from start memory
  95                                       region.
  96
  97   @retval RETURN_SUCCESS              The attributes were cleared for the
  98                                       memory region.
  99   @retval RETURN_INVALID_PARAMETER    Number of pages is zero.
 100   @retval RETURN_UNSUPPORTED          Clearing the memory encryption attribute
 101                                       is not supported
 102 **/
 103 RETURN_STATUS
 104 EFIAPI
 105 MemEncryptSevClearPageEncMask (
 106   IN PHYSICAL_ADDRESS  Cr3BaseAddress,
 107   IN PHYSICAL_ADDRESS  BaseAddress,
 108   IN UINTN             NumPages
 109   );
 110
 111 /**
 112   This function sets memory encryption bit for the memory region specified by
 113   BaseAddress and NumPages from the current page table context.
 114
 115   @param[in]  Cr3BaseAddress          Cr3 Base Address (if zero then use
 116                                       current CR3)
 117   @param[in]  BaseAddress             The physical address that is the start
 118                                       address of a memory region.
 119   @param[in]  NumPages                The number of pages from start memory
 120                                       region.
 121
 122   @retval RETURN_SUCCESS              The attributes were set for the memory
 123                                       region.
 124   @retval RETURN_INVALID_PARAMETER    Number of pages is zero.
 125   @retval RETURN_UNSUPPORTED          Setting the memory encryption attribute
 126                                       is not supported
 127 **/
 128 RETURN_STATUS
 129 EFIAPI
 130 MemEncryptSevSetPageEncMask (
 131   IN PHYSICAL_ADDRESS  Cr3BaseAddress,
 132   IN PHYSICAL_ADDRESS  BaseAddress,
 133   IN UINTN             NumPages
 134   );
 135
 136 /**
 137   Locate the page range that covers the initial (pre-SMBASE-relocation) SMRAM
 138   Save State Map.
 139
 140   @param[out] BaseAddress     The base address of the lowest-address page that
 141                               covers the initial SMRAM Save State Map.
 142
 143   @param[out] NumberOfPages   The number of pages in the page range that covers
 144                               the initial SMRAM Save State Map.
 145
 146   @retval RETURN_SUCCESS      BaseAddress and NumberOfPages have been set on
 147                               output.
 148
 149   @retval RETURN_UNSUPPORTED  SMM is unavailable.
 150 **/
 151 RETURN_STATUS
 152 EFIAPI
 153 MemEncryptSevLocateInitialSmramSaveStateMapPages (
 154   OUT UINTN  *BaseAddress,
 155   OUT UINTN  *NumberOfPages
 156   );
 157
 158 /**
 159   Returns the SEV encryption mask.
 160
 161   @return  The SEV pagetable encryption mask
 162 **/
 163 UINT64
 164 EFIAPI
 165 MemEncryptSevGetEncryptionMask (
 166   VOID
 167   );
 168
 169 /**
 170   Returns the encryption state of the specified virtual address range.
 171
 172   @param[in]  Cr3BaseAddress          Cr3 Base Address (if zero then use
 173                                       current CR3)
 174   @param[in]  BaseAddress             Base address to check
 175   @param[in]  Length                  Length of virtual address range
 176
 177   @retval MemEncryptSevAddressRangeUnencrypted  Address range is mapped
 178                                                 unencrypted
 179   @retval MemEncryptSevAddressRangeEncrypted    Address range is mapped
 180                                                 encrypted
 181   @retval MemEncryptSevAddressRangeMixed        Address range is mapped mixed
 182   @retval MemEncryptSevAddressRangeError        Address range is not mapped
 183 **/
 184 MEM_ENCRYPT_SEV_ADDRESS_RANGE_STATE
 185 EFIAPI
 186 MemEncryptSevGetAddressRangeState (
 187   IN PHYSICAL_ADDRESS  Cr3BaseAddress,
 188   IN PHYSICAL_ADDRESS  BaseAddress,
 189   IN UINTN             Length
 190   );
 191
 192 /**
 193   This function clears memory encryption bit for the MMIO region specified by
 194   BaseAddress and NumPages.
 195
 196   @param[in]  Cr3BaseAddress          Cr3 Base Address (if zero then use
 197                                       current CR3)
 198   @param[in]  BaseAddress             The physical address that is the start
 199                                       address of a MMIO region.
 200   @param[in]  NumPages                The number of pages from start memory
 201                                       region.
 202
 203   @retval RETURN_SUCCESS              The attributes were cleared for the
 204                                       memory region.
 205   @retval RETURN_INVALID_PARAMETER    Number of pages is zero.
 206   @retval RETURN_UNSUPPORTED          Clearing the memory encryption attribute
 207                                       is not supported
 208 **/
 209 RETURN_STATUS
 210 EFIAPI
 211 MemEncryptSevClearMmioPageEncMask (
 212   IN PHYSICAL_ADDRESS  Cr3BaseAddress,
 213   IN PHYSICAL_ADDRESS  BaseAddress,
 214   IN UINTN             NumPages
 215   );
 216
 217 /**
 218   Pre-validate the system RAM when SEV-SNP is enabled in the guest VM.
 219
 220   @param[in]  BaseAddress             Base address
 221   @param[in]  NumPages                Number of pages starting from the base address
 222
 223 **/
 224 VOID
 225 EFIAPI
 226 MemEncryptSevSnpPreValidateSystemRam (
 227   IN PHYSICAL_ADDRESS  BaseAddress,
 228   IN UINTN             NumPages
 229   );
 230
 231 #endif // _MEM_ENCRYPT_SEV_LIB_H_