OvmfPkg/PlatformPei/AmdSev.c

   1 /**@file
   2   Initialize Secure Encrypted Virtualization (SEV) support
   3
   4   Copyright (c) 2017, Advanced Micro Devices. All rights reserved.<BR>
   5
   6   This program and the accompanying materials
   7   are licensed and made available under the terms and conditions of the BSD
   8   License which accompanies this distribution.  The full text of the license
   9   may be found at http://opensource.org/licenses/bsd-license.php
  10
  11   THE PROGRAM IS DISTRIBUTED UNDER THE BSD LICENSE ON AN "AS IS" BASIS,
  12   WITHOUT WARRANTIES OR REPRESENTATIONS OF ANY KIND, EITHER EXPRESS OR IMPLIED.
  13
  14 **/
  15 //
  16 // The package level header files this module uses
  17 //
  18 #include <Library/DebugLib.h>
  19 #include <Library/MemEncryptSevLib.h>
  20 #include <Library/PcdLib.h>
  21 #include <PiPei.h>
  22 #include <Register/Amd/Cpuid.h>
  23 #include <Register/Cpuid.h>
  24
  25 #include "Platform.h"
  26
  27 /**
  28
  29   Function checks if SEV support is available, if present then it sets
  30   the dynamic PcdPteMemoryEncryptionAddressOrMask with memory encryption mask.
  31
  32   **/
  33 VOID
  34 AmdSevInitialize (
  35   VOID
  36   )
  37 {
  38   CPUID_MEMORY_ENCRYPTION_INFO_EBX  Ebx;
  39   UINT64                            EncryptionMask;
  40   RETURN_STATUS                     PcdStatus;
  41
  42   //
  43   // Check if SEV is enabled
  44   //
  45   if (!MemEncryptSevIsEnabled ()) {
  46     return;
  47   }
  48
  49   //
  50   // CPUID Fn8000_001F[EBX] Bit 0:5 (memory encryption bit position)
  51   //
  52   AsmCpuid (CPUID_MEMORY_ENCRYPTION_INFO, NULL, &Ebx.Uint32, NULL, NULL);
  53   EncryptionMask = LShiftU64 (1, Ebx.Bits.PtePosBits);
  54
  55   //
  56   // Set Memory Encryption Mask PCD
  57   //
  58   PcdStatus = PcdSet64S (PcdPteMemoryEncryptionAddressOrMask, EncryptionMask);
  59   ASSERT_RETURN_ERROR (PcdStatus);
  60
  61   DEBUG ((DEBUG_INFO, "SEV is enabled (mask 0x%lx)\n", EncryptionMask));
  62
  63   //
  64   // Set Pcd to Deny the execution of option ROM when security
  65   // violation.
  66   //
  67   PcdStatus = PcdSet32S (PcdOptionRomImageVerificationPolicy, 0x4);
  68   ASSERT_RETURN_ERROR (PcdStatus);
  69 }