2 Main SEC phase code. Transitions to PEI.
4 Copyright (c) 2008 - 2015, Intel Corporation. All rights reserved.<BR>
5 (C) Copyright 2016 Hewlett Packard Enterprise Development LP<BR>
6 Copyright (c) 2020, Advanced Micro Devices, Inc. All rights reserved.<BR>
8 SPDX-License-Identifier: BSD-2-Clause-Patent
14 #include <Library/PeimEntryPoint.h>
15 #include <Library/BaseLib.h>
16 #include <Library/DebugLib.h>
17 #include <Library/BaseMemoryLib.h>
18 #include <Library/PeiServicesLib.h>
19 #include <Library/PcdLib.h>
20 #include <Library/CpuLib.h>
21 #include <Library/UefiCpuLib.h>
22 #include <Library/DebugAgentLib.h>
23 #include <Library/IoLib.h>
24 #include <Library/PeCoffLib.h>
25 #include <Library/PeCoffGetEntryPointLib.h>
26 #include <Library/PeCoffExtraActionLib.h>
27 #include <Library/ExtractGuidedSectionLib.h>
28 #include <Library/LocalApicLib.h>
29 #include <Library/CpuExceptionHandlerLib.h>
30 #include <Ppi/TemporaryRamSupport.h>
31 #include <Ppi/MpInitLibDep.h>
32 #include <Library/PlatformInitLib.h>
33 #include <Library/CcProbeLib.h>
36 #define SEC_IDT_ENTRY_COUNT 34
38 typedef struct _SEC_IDT_TABLE
{
39 EFI_PEI_SERVICES
*PeiService
;
40 IA32_IDT_GATE_DESCRIPTOR IdtTable
[SEC_IDT_ENTRY_COUNT
];
51 TemporaryRamMigration (
52 IN CONST EFI_PEI_SERVICES
**PeiServices
,
53 IN EFI_PHYSICAL_ADDRESS TemporaryMemoryBase
,
54 IN EFI_PHYSICAL_ADDRESS PermanentMemoryBase
,
61 EFI_PEI_TEMPORARY_RAM_SUPPORT_PPI mTemporaryRamSupportPpi
= {
65 EFI_PEI_PPI_DESCRIPTOR mPrivateDispatchTableMp
[] = {
67 (EFI_PEI_PPI_DESCRIPTOR_PPI
),
68 &gEfiTemporaryRamSupportPpiGuid
,
69 &mTemporaryRamSupportPpi
72 (EFI_PEI_PPI_DESCRIPTOR_PPI
| EFI_PEI_PPI_DESCRIPTOR_TERMINATE_LIST
),
73 &gEfiPeiMpInitLibMpDepPpiGuid
,
78 EFI_PEI_PPI_DESCRIPTOR mPrivateDispatchTableUp
[] = {
80 (EFI_PEI_PPI_DESCRIPTOR_PPI
),
81 &gEfiTemporaryRamSupportPpiGuid
,
82 &mTemporaryRamSupportPpi
85 (EFI_PEI_PPI_DESCRIPTOR_PPI
| EFI_PEI_PPI_DESCRIPTOR_TERMINATE_LIST
),
86 &gEfiPeiMpInitLibUpDepPpiGuid
,
92 // Template of an IDT entry pointing to 10:FFFFFFE4h.
94 IA32_IDT_GATE_DESCRIPTOR mIdtEntryTemplate
= {
99 IA32_IDT_GATE_TYPE_INTERRUPT_32
, // GateType
105 Locates the main boot firmware volume.
107 @param[in,out] BootFv On input, the base of the BootFv
108 On output, the decompressed main firmware volume
110 @retval EFI_SUCCESS The main firmware volume was located and decompressed
111 @retval EFI_NOT_FOUND The main firmware volume was not found
116 IN OUT EFI_FIRMWARE_VOLUME_HEADER
**BootFv
119 EFI_FIRMWARE_VOLUME_HEADER
*Fv
;
122 ASSERT (((UINTN
)*BootFv
& EFI_PAGE_MASK
) == 0);
125 Distance
= (UINTN
)(*BootFv
)->FvLength
;
127 Fv
= (EFI_FIRMWARE_VOLUME_HEADER
*)((UINT8
*)Fv
- EFI_PAGE_SIZE
);
128 Distance
+= EFI_PAGE_SIZE
;
129 if (Distance
> SIZE_32MB
) {
130 return EFI_NOT_FOUND
;
133 if (Fv
->Signature
!= EFI_FVH_SIGNATURE
) {
137 if ((UINTN
)Fv
->FvLength
> Distance
) {
147 Locates a section within a series of sections
148 with the specified section type.
150 The Instance parameter indicates which instance of the section
151 type to return. (0 is first instance, 1 is second...)
153 @param[in] Sections The sections to search
154 @param[in] SizeOfSections Total size of all sections
155 @param[in] SectionType The section type to locate
156 @param[in] Instance The section instance number
157 @param[out] FoundSection The FFS section if found
159 @retval EFI_SUCCESS The file and section was found
160 @retval EFI_NOT_FOUND The file and section was not found
161 @retval EFI_VOLUME_CORRUPTED The firmware volume was corrupted
165 FindFfsSectionInstance (
167 IN UINTN SizeOfSections
,
168 IN EFI_SECTION_TYPE SectionType
,
170 OUT EFI_COMMON_SECTION_HEADER
**FoundSection
173 EFI_PHYSICAL_ADDRESS CurrentAddress
;
175 EFI_PHYSICAL_ADDRESS EndOfSections
;
176 EFI_COMMON_SECTION_HEADER
*Section
;
177 EFI_PHYSICAL_ADDRESS EndOfSection
;
180 // Loop through the FFS file sections within the PEI Core FFS file
182 EndOfSection
= (EFI_PHYSICAL_ADDRESS
)(UINTN
)Sections
;
183 EndOfSections
= EndOfSection
+ SizeOfSections
;
185 if (EndOfSection
== EndOfSections
) {
189 CurrentAddress
= (EndOfSection
+ 3) & ~(3ULL);
190 if (CurrentAddress
>= EndOfSections
) {
191 return EFI_VOLUME_CORRUPTED
;
194 Section
= (EFI_COMMON_SECTION_HEADER
*)(UINTN
)CurrentAddress
;
196 Size
= SECTION_SIZE (Section
);
197 if (Size
< sizeof (*Section
)) {
198 return EFI_VOLUME_CORRUPTED
;
201 EndOfSection
= CurrentAddress
+ Size
;
202 if (EndOfSection
> EndOfSections
) {
203 return EFI_VOLUME_CORRUPTED
;
207 // Look for the requested section type
209 if (Section
->Type
== SectionType
) {
211 *FoundSection
= Section
;
219 return EFI_NOT_FOUND
;
223 Locates a section within a series of sections
224 with the specified section type.
226 @param[in] Sections The sections to search
227 @param[in] SizeOfSections Total size of all sections
228 @param[in] SectionType The section type to locate
229 @param[out] FoundSection The FFS section if found
231 @retval EFI_SUCCESS The file and section was found
232 @retval EFI_NOT_FOUND The file and section was not found
233 @retval EFI_VOLUME_CORRUPTED The firmware volume was corrupted
237 FindFfsSectionInSections (
239 IN UINTN SizeOfSections
,
240 IN EFI_SECTION_TYPE SectionType
,
241 OUT EFI_COMMON_SECTION_HEADER
**FoundSection
244 return FindFfsSectionInstance (
254 Locates a FFS file with the specified file type and a section
255 within that file with the specified section type.
257 @param[in] Fv The firmware volume to search
258 @param[in] FileType The file type to locate
259 @param[in] SectionType The section type to locate
260 @param[out] FoundSection The FFS section if found
262 @retval EFI_SUCCESS The file and section was found
263 @retval EFI_NOT_FOUND The file and section was not found
264 @retval EFI_VOLUME_CORRUPTED The firmware volume was corrupted
268 FindFfsFileAndSection (
269 IN EFI_FIRMWARE_VOLUME_HEADER
*Fv
,
270 IN EFI_FV_FILETYPE FileType
,
271 IN EFI_SECTION_TYPE SectionType
,
272 OUT EFI_COMMON_SECTION_HEADER
**FoundSection
276 EFI_PHYSICAL_ADDRESS CurrentAddress
;
277 EFI_PHYSICAL_ADDRESS EndOfFirmwareVolume
;
278 EFI_FFS_FILE_HEADER
*File
;
280 EFI_PHYSICAL_ADDRESS EndOfFile
;
282 if (Fv
->Signature
!= EFI_FVH_SIGNATURE
) {
283 DEBUG ((DEBUG_ERROR
, "FV at %p does not have FV header signature\n", Fv
));
284 return EFI_VOLUME_CORRUPTED
;
287 CurrentAddress
= (EFI_PHYSICAL_ADDRESS
)(UINTN
)Fv
;
288 EndOfFirmwareVolume
= CurrentAddress
+ Fv
->FvLength
;
291 // Loop through the FFS files in the Boot Firmware Volume
293 for (EndOfFile
= CurrentAddress
+ Fv
->HeaderLength
; ; ) {
294 CurrentAddress
= (EndOfFile
+ 7) & ~(7ULL);
295 if (CurrentAddress
> EndOfFirmwareVolume
) {
296 return EFI_VOLUME_CORRUPTED
;
299 File
= (EFI_FFS_FILE_HEADER
*)(UINTN
)CurrentAddress
;
300 Size
= FFS_FILE_SIZE (File
);
301 if (Size
< (sizeof (*File
) + sizeof (EFI_COMMON_SECTION_HEADER
))) {
302 return EFI_VOLUME_CORRUPTED
;
305 EndOfFile
= CurrentAddress
+ Size
;
306 if (EndOfFile
> EndOfFirmwareVolume
) {
307 return EFI_VOLUME_CORRUPTED
;
311 // Look for the request file type
313 if (File
->Type
!= FileType
) {
317 Status
= FindFfsSectionInSections (
319 (UINTN
)EndOfFile
- (UINTN
)(File
+ 1),
323 if (!EFI_ERROR (Status
) || (Status
== EFI_VOLUME_CORRUPTED
)) {
330 Locates the compressed main firmware volume and decompresses it.
332 @param[in,out] Fv On input, the firmware volume to search
333 On output, the decompressed BOOT/PEI FV
335 @retval EFI_SUCCESS The file and section was found
336 @retval EFI_NOT_FOUND The file and section was not found
337 @retval EFI_VOLUME_CORRUPTED The firmware volume was corrupted
342 IN OUT EFI_FIRMWARE_VOLUME_HEADER
**Fv
346 EFI_GUID_DEFINED_SECTION
*Section
;
347 UINT32 OutputBufferSize
;
348 UINT32 ScratchBufferSize
;
349 UINT16 SectionAttribute
;
350 UINT32 AuthenticationStatus
;
353 EFI_COMMON_SECTION_HEADER
*FvSection
;
354 EFI_FIRMWARE_VOLUME_HEADER
*PeiMemFv
;
355 EFI_FIRMWARE_VOLUME_HEADER
*DxeMemFv
;
357 UINT32 FvSectionSize
;
359 FvSection
= (EFI_COMMON_SECTION_HEADER
*)NULL
;
361 Status
= FindFfsFileAndSection (
363 EFI_FV_FILETYPE_FIRMWARE_VOLUME_IMAGE
,
364 EFI_SECTION_GUID_DEFINED
,
365 (EFI_COMMON_SECTION_HEADER
**)&Section
367 if (EFI_ERROR (Status
)) {
368 DEBUG ((DEBUG_ERROR
, "Unable to find GUID defined section\n"));
372 Status
= ExtractGuidedSectionGetInfo (
378 if (EFI_ERROR (Status
)) {
379 DEBUG ((DEBUG_ERROR
, "Unable to GetInfo for GUIDed section\n"));
383 OutputBuffer
= (VOID
*)((UINT8
*)(UINTN
)PcdGet32 (PcdOvmfDxeMemFvBase
) + SIZE_1MB
);
384 ScratchBuffer
= ALIGN_POINTER ((UINT8
*)OutputBuffer
+ OutputBufferSize
, SIZE_1MB
);
388 "%a: OutputBuffer@%p+0x%x ScratchBuffer@%p+0x%x "
389 "PcdOvmfDecompressionScratchEnd=0x%x\n",
395 PcdGet32 (PcdOvmfDecompressionScratchEnd
)
398 (UINTN
)ScratchBuffer
+ ScratchBufferSize
==
399 PcdGet32 (PcdOvmfDecompressionScratchEnd
)
402 Status
= ExtractGuidedSectionDecode (
406 &AuthenticationStatus
408 if (EFI_ERROR (Status
)) {
409 DEBUG ((DEBUG_ERROR
, "Error during GUID section decode\n"));
413 Status
= FindFfsSectionInstance (
416 EFI_SECTION_FIRMWARE_VOLUME_IMAGE
,
420 if (EFI_ERROR (Status
)) {
421 DEBUG ((DEBUG_ERROR
, "Unable to find PEI FV section\n"));
426 SECTION_SIZE (FvSection
) ==
427 (PcdGet32 (PcdOvmfPeiMemFvSize
) + sizeof (*FvSection
))
429 ASSERT (FvSection
->Type
== EFI_SECTION_FIRMWARE_VOLUME_IMAGE
);
431 PeiMemFv
= (EFI_FIRMWARE_VOLUME_HEADER
*)(UINTN
)PcdGet32 (PcdOvmfPeiMemFvBase
);
432 CopyMem (PeiMemFv
, (VOID
*)(FvSection
+ 1), PcdGet32 (PcdOvmfPeiMemFvSize
));
434 if (PeiMemFv
->Signature
!= EFI_FVH_SIGNATURE
) {
435 DEBUG ((DEBUG_ERROR
, "Extracted FV at %p does not have FV header signature\n", PeiMemFv
));
437 return EFI_VOLUME_CORRUPTED
;
440 Status
= FindFfsSectionInstance (
443 EFI_SECTION_FIRMWARE_VOLUME_IMAGE
,
447 if (EFI_ERROR (Status
)) {
448 DEBUG ((DEBUG_ERROR
, "Unable to find DXE FV section\n"));
452 ASSERT (FvSection
->Type
== EFI_SECTION_FIRMWARE_VOLUME_IMAGE
);
454 if (IS_SECTION2 (FvSection
)) {
455 FvSectionSize
= SECTION2_SIZE (FvSection
);
456 FvHeaderSize
= sizeof (EFI_COMMON_SECTION_HEADER2
);
458 FvSectionSize
= SECTION_SIZE (FvSection
);
459 FvHeaderSize
= sizeof (EFI_COMMON_SECTION_HEADER
);
462 ASSERT (FvSectionSize
== (PcdGet32 (PcdOvmfDxeMemFvSize
) + FvHeaderSize
));
464 DxeMemFv
= (EFI_FIRMWARE_VOLUME_HEADER
*)(UINTN
)PcdGet32 (PcdOvmfDxeMemFvBase
);
465 CopyMem (DxeMemFv
, (VOID
*)((UINTN
)FvSection
+ FvHeaderSize
), PcdGet32 (PcdOvmfDxeMemFvSize
));
467 if (DxeMemFv
->Signature
!= EFI_FVH_SIGNATURE
) {
468 DEBUG ((DEBUG_ERROR
, "Extracted FV at %p does not have FV header signature\n", DxeMemFv
));
470 return EFI_VOLUME_CORRUPTED
;
478 Locates the PEI Core entry point address
480 @param[in] Fv The firmware volume to search
481 @param[out] PeiCoreEntryPoint The entry point of the PEI Core image
483 @retval EFI_SUCCESS The file and section was found
484 @retval EFI_NOT_FOUND The file and section was not found
485 @retval EFI_VOLUME_CORRUPTED The firmware volume was corrupted
489 FindPeiCoreImageBaseInFv (
490 IN EFI_FIRMWARE_VOLUME_HEADER
*Fv
,
491 OUT EFI_PHYSICAL_ADDRESS
*PeiCoreImageBase
495 EFI_COMMON_SECTION_HEADER
*Section
;
497 Status
= FindFfsFileAndSection (
499 EFI_FV_FILETYPE_PEI_CORE
,
503 if (EFI_ERROR (Status
)) {
504 Status
= FindFfsFileAndSection (
506 EFI_FV_FILETYPE_PEI_CORE
,
510 if (EFI_ERROR (Status
)) {
511 DEBUG ((DEBUG_ERROR
, "Unable to find PEI Core image\n"));
516 *PeiCoreImageBase
= (EFI_PHYSICAL_ADDRESS
)(UINTN
)(Section
+ 1);
521 Reads 8-bits of CMOS data.
523 Reads the 8-bits of CMOS data at the location specified by Index.
524 The 8-bit read value is returned.
526 @param Index The CMOS location to read.
528 @return The value read.
537 IoWrite8 (0x70, (UINT8
)Index
);
538 return IoRead8 (0x71);
547 return (CmosRead8 (0xF) == 0xFE);
553 IN OUT EFI_FIRMWARE_VOLUME_HEADER
**PeiFv
556 *PeiFv
= (EFI_FIRMWARE_VOLUME_HEADER
*)(UINTN
)PcdGet32 (PcdOvmfPeiMemFvBase
);
561 Locates the PEI Core entry point address
563 @param[in,out] Fv The firmware volume to search
564 @param[out] PeiCoreEntryPoint The entry point of the PEI Core image
566 @retval EFI_SUCCESS The file and section was found
567 @retval EFI_NOT_FOUND The file and section was not found
568 @retval EFI_VOLUME_CORRUPTED The firmware volume was corrupted
572 FindPeiCoreImageBase (
573 IN OUT EFI_FIRMWARE_VOLUME_HEADER
**BootFv
,
574 OUT EFI_PHYSICAL_ADDRESS
*PeiCoreImageBase
579 *PeiCoreImageBase
= 0;
581 S3Resume
= IsS3Resume ();
582 if (S3Resume
&& !FeaturePcdGet (PcdSmmSmramRequire
)) {
584 // A malicious runtime OS may have injected something into our previously
585 // decoded PEI FV, but we don't care about that unless SMM/SMRAM is required.
587 DEBUG ((DEBUG_VERBOSE
, "SEC: S3 resume\n"));
588 GetS3ResumePeiFv (BootFv
);
591 // We're either not resuming, or resuming "securely" -- we'll decompress
592 // both PEI FV and DXE FV from pristine flash.
597 S3Resume
? "S3 resume (with PEI decompression)" : "Normal boot"
601 DecompressMemFvs (BootFv
);
604 FindPeiCoreImageBaseInFv (*BootFv
, PeiCoreImageBase
);
608 Find core image base.
613 IN EFI_FIRMWARE_VOLUME_HEADER
*BootFirmwareVolumePtr
,
614 OUT EFI_PHYSICAL_ADDRESS
*SecCoreImageBase
617 EFI_PHYSICAL_ADDRESS CurrentAddress
;
618 EFI_PHYSICAL_ADDRESS EndOfFirmwareVolume
;
619 EFI_FFS_FILE_HEADER
*File
;
621 EFI_PHYSICAL_ADDRESS EndOfFile
;
622 EFI_COMMON_SECTION_HEADER
*Section
;
623 EFI_PHYSICAL_ADDRESS EndOfSection
;
625 *SecCoreImageBase
= 0;
627 CurrentAddress
= (EFI_PHYSICAL_ADDRESS
)(UINTN
)BootFirmwareVolumePtr
;
628 EndOfFirmwareVolume
= CurrentAddress
+ BootFirmwareVolumePtr
->FvLength
;
631 // Loop through the FFS files in the Boot Firmware Volume
633 for (EndOfFile
= CurrentAddress
+ BootFirmwareVolumePtr
->HeaderLength
; ; ) {
634 CurrentAddress
= (EndOfFile
+ 7) & 0xfffffffffffffff8ULL
;
635 if (CurrentAddress
> EndOfFirmwareVolume
) {
636 return EFI_NOT_FOUND
;
639 File
= (EFI_FFS_FILE_HEADER
*)(UINTN
)CurrentAddress
;
640 Size
= FFS_FILE_SIZE (File
);
641 if (Size
< sizeof (*File
)) {
642 return EFI_NOT_FOUND
;
645 EndOfFile
= CurrentAddress
+ Size
;
646 if (EndOfFile
> EndOfFirmwareVolume
) {
647 return EFI_NOT_FOUND
;
653 if (File
->Type
!= EFI_FV_FILETYPE_SECURITY_CORE
) {
658 // Loop through the FFS file sections within the FFS file
660 EndOfSection
= (EFI_PHYSICAL_ADDRESS
)(UINTN
)(File
+ 1);
662 CurrentAddress
= (EndOfSection
+ 3) & 0xfffffffffffffffcULL
;
663 Section
= (EFI_COMMON_SECTION_HEADER
*)(UINTN
)CurrentAddress
;
665 Size
= SECTION_SIZE (Section
);
666 if (Size
< sizeof (*Section
)) {
667 return EFI_NOT_FOUND
;
670 EndOfSection
= CurrentAddress
+ Size
;
671 if (EndOfSection
> EndOfFile
) {
672 return EFI_NOT_FOUND
;
676 // Look for executable sections
678 if ((Section
->Type
== EFI_SECTION_PE32
) || (Section
->Type
== EFI_SECTION_TE
)) {
679 if (File
->Type
== EFI_FV_FILETYPE_SECURITY_CORE
) {
680 *SecCoreImageBase
= (PHYSICAL_ADDRESS
)(UINTN
)(Section
+ 1);
688 // SEC Core image found
690 if (*SecCoreImageBase
!= 0) {
697 Find and return Pei Core entry point.
699 It also find SEC and PEI Core file debug information. It will report them if
700 remote debug is enabled.
704 FindAndReportEntryPoints (
705 IN EFI_FIRMWARE_VOLUME_HEADER
**BootFirmwareVolumePtr
,
706 OUT EFI_PEI_CORE_ENTRY_POINT
*PeiCoreEntryPoint
710 EFI_PHYSICAL_ADDRESS SecCoreImageBase
;
711 EFI_PHYSICAL_ADDRESS PeiCoreImageBase
;
712 PE_COFF_LOADER_IMAGE_CONTEXT ImageContext
;
715 // Find SEC Core and PEI Core image base
717 Status
= FindImageBase (*BootFirmwareVolumePtr
, &SecCoreImageBase
);
718 ASSERT_EFI_ERROR (Status
);
720 FindPeiCoreImageBase (BootFirmwareVolumePtr
, &PeiCoreImageBase
);
722 ZeroMem ((VOID
*)&ImageContext
, sizeof (PE_COFF_LOADER_IMAGE_CONTEXT
));
724 // Report SEC Core debug information when remote debug is enabled
726 ImageContext
.ImageAddress
= SecCoreImageBase
;
727 ImageContext
.PdbPointer
= PeCoffLoaderGetPdbPointer ((VOID
*)(UINTN
)ImageContext
.ImageAddress
);
728 PeCoffLoaderRelocateImageExtraAction (&ImageContext
);
731 // Report PEI Core debug information when remote debug is enabled
733 ImageContext
.ImageAddress
= (EFI_PHYSICAL_ADDRESS
)(UINTN
)PeiCoreImageBase
;
734 ImageContext
.PdbPointer
= PeCoffLoaderGetPdbPointer ((VOID
*)(UINTN
)ImageContext
.ImageAddress
);
735 PeCoffLoaderRelocateImageExtraAction (&ImageContext
);
738 // Find PEI Core entry point
740 Status
= PeCoffLoaderGetEntryPoint ((VOID
*)(UINTN
)PeiCoreImageBase
, (VOID
**)PeiCoreEntryPoint
);
741 if (EFI_ERROR (Status
)) {
742 *PeiCoreEntryPoint
= 0;
750 SecCoreStartupWithStack (
751 IN EFI_FIRMWARE_VOLUME_HEADER
*BootFv
,
752 IN VOID
*TopOfCurrentStack
755 EFI_SEC_PEI_HAND_OFF SecCoreData
;
756 SEC_IDT_TABLE IdtTableInStack
;
757 IA32_DESCRIPTOR IdtDescriptor
;
759 volatile UINT8
*Table
;
761 #if defined (TDX_GUEST_SUPPORTED)
762 if (CcProbe () == CcGuestTypeIntelTdx
) {
764 // For Td guests, the memory map info is in TdHobLib. It should be processed
765 // first so that the memory is accepted. Otherwise access to the unaccepted
766 // memory will trigger tripple fault.
768 if (ProcessTdxHobList () != EFI_SUCCESS
) {
776 // To ensure SMM can't be compromised on S3 resume, we must force re-init of
777 // the BaseExtractGuidedSectionLib. Since this is before library contructors
778 // are called, we must use a loop rather than SetMem.
780 Table
= (UINT8
*)(UINTN
)FixedPcdGet64 (PcdGuidedExtractHandlerTableAddress
);
782 Index
< FixedPcdGet32 (PcdGuidedExtractHandlerTableSize
);
789 // Initialize IDT - Since this is before library constructors are called,
790 // we use a loop rather than CopyMem.
792 IdtTableInStack
.PeiService
= NULL
;
794 for (Index
= 0; Index
< SEC_IDT_ENTRY_COUNT
; Index
++) {
796 // Declare the local variables that actually move the data elements as
797 // volatile to prevent the optimizer from replacing this function with
798 // the intrinsic memcpy()
804 Src
= (CONST UINT8
*)&mIdtEntryTemplate
;
805 Dst
= (volatile UINT8
*)&IdtTableInStack
.IdtTable
[Index
];
806 for (Byte
= 0; Byte
< sizeof (mIdtEntryTemplate
); Byte
++) {
807 Dst
[Byte
] = Src
[Byte
];
811 IdtDescriptor
.Base
= (UINTN
)&IdtTableInStack
.IdtTable
;
812 IdtDescriptor
.Limit
= (UINT16
)(sizeof (IdtTableInStack
.IdtTable
) - 1);
814 if (SevEsIsEnabled ()) {
815 SevEsProtocolCheck ();
818 // For SEV-ES guests, the exception handler is needed before calling
819 // ProcessLibraryConstructorList() because some of the library constructors
820 // perform some functions that result in #VC exceptions being generated.
822 // Due to this code executing before library constructors, *all* library
823 // API calls are theoretically interface contract violations. However,
824 // because this is SEC (executing in flash), those constructors cannot
825 // write variables with static storage duration anyway. Furthermore, only
826 // a small, restricted set of APIs, such as AsmWriteIdtr() and
827 // InitializeCpuExceptionHandlers(), are called, where we require that the
828 // underlying library not require constructors to have been invoked and
829 // that the library instance not trigger any #VC exceptions.
831 AsmWriteIdtr (&IdtDescriptor
);
832 InitializeCpuExceptionHandlers (NULL
);
835 ProcessLibraryConstructorList (NULL
, NULL
);
837 if (!SevEsIsEnabled ()) {
839 // For non SEV-ES guests, just load the IDTR.
841 AsmWriteIdtr (&IdtDescriptor
);
844 // Under SEV-ES, the hypervisor can't modify CR0 and so can't enable
845 // caching in order to speed up the boot. Enable caching early for
851 #if defined (TDX_GUEST_SUPPORTED)
852 if (CcProbe () == CcGuestTypeIntelTdx
) {
854 // InitializeCpuExceptionHandlers () should be called in Td guests so that
855 // #VE exceptions can be handled correctly.
857 InitializeCpuExceptionHandlers (NULL
);
864 "SecCoreStartupWithStack(0x%x, 0x%x)\n",
865 (UINT32
)(UINTN
)BootFv
,
866 (UINT32
)(UINTN
)TopOfCurrentStack
870 // Initialize floating point operating environment
871 // to be compliant with UEFI spec.
873 InitializeFloatingPointUnits ();
875 #if defined (MDE_CPU_X64)
877 // ASSERT that the Page Tables were set by the reset vector code to
878 // the address we expect.
880 ASSERT (AsmReadCr3 () == (UINTN
)PcdGet32 (PcdOvmfSecPageTablesBase
));
884 // |-------------| <-- TopOfCurrentStack
888 // |-------------| <-- SecCoreData.TemporaryRamBase
892 (UINTN
)(PcdGet32 (PcdOvmfSecPeiTempRamBase
) +
893 PcdGet32 (PcdOvmfSecPeiTempRamSize
)) ==
894 (UINTN
)TopOfCurrentStack
898 // Initialize SEC hand-off state
900 SecCoreData
.DataSize
= sizeof (EFI_SEC_PEI_HAND_OFF
);
902 SecCoreData
.TemporaryRamSize
= (UINTN
)PcdGet32 (PcdOvmfSecPeiTempRamSize
);
903 SecCoreData
.TemporaryRamBase
= (VOID
*)((UINT8
*)TopOfCurrentStack
- SecCoreData
.TemporaryRamSize
);
905 SecCoreData
.PeiTemporaryRamBase
= SecCoreData
.TemporaryRamBase
;
906 SecCoreData
.PeiTemporaryRamSize
= SecCoreData
.TemporaryRamSize
>> 1;
908 SecCoreData
.StackBase
= (UINT8
*)SecCoreData
.TemporaryRamBase
+ SecCoreData
.PeiTemporaryRamSize
;
909 SecCoreData
.StackSize
= SecCoreData
.TemporaryRamSize
>> 1;
911 SecCoreData
.BootFirmwareVolumeBase
= BootFv
;
912 SecCoreData
.BootFirmwareVolumeSize
= (UINTN
)BootFv
->FvLength
;
915 // Validate the System RAM used in the SEC Phase
917 SecValidateSystemRam ();
920 // Make sure the 8259 is masked before initializing the Debug Agent and the debug timer is enabled
922 IoWrite8 (0x21, 0xff);
923 IoWrite8 (0xA1, 0xff);
926 // Initialize Local APIC Timer hardware and disable Local APIC Timer
927 // interrupts before initializing the Debug Agent and the debug timer is
930 InitializeApicTimer (0, MAX_UINT32
, TRUE
, 5);
931 DisableApicTimerInterrupt ();
934 // Initialize Debug Agent to support source level debug in SEC/PEI phases before memory ready.
936 InitializeDebugAgent (DEBUG_AGENT_INIT_PREMEM_SEC
, &SecCoreData
, SecStartupPhase2
);
940 Caller provided function to be invoked at the end of InitializeDebugAgent().
942 Entry point to the C language phase of SEC. After the SEC assembly
943 code has initialized some temporary memory and set up the stack,
944 the control is transferred to this function.
946 @param[in] Context The first input parameter of InitializeDebugAgent().
955 EFI_SEC_PEI_HAND_OFF
*SecCoreData
;
956 EFI_FIRMWARE_VOLUME_HEADER
*BootFv
;
957 EFI_PEI_CORE_ENTRY_POINT PeiCoreEntryPoint
;
958 EFI_PEI_PPI_DESCRIPTOR
*EfiPeiPpiDescriptor
;
960 SecCoreData
= (EFI_SEC_PEI_HAND_OFF
*)Context
;
963 // Find PEI Core entry point. It will report SEC and Pei Core debug information if remote debug
966 BootFv
= (EFI_FIRMWARE_VOLUME_HEADER
*)SecCoreData
->BootFirmwareVolumeBase
;
967 FindAndReportEntryPoints (&BootFv
, &PeiCoreEntryPoint
);
968 SecCoreData
->BootFirmwareVolumeBase
= BootFv
;
969 SecCoreData
->BootFirmwareVolumeSize
= (UINTN
)BootFv
->FvLength
;
972 // Td guest is required to use the MpInitLibUp (unique-processor version).
973 // Other guests use the MpInitLib (multi-processor version).
975 if (CcProbe () == CcGuestTypeIntelTdx
) {
976 EfiPeiPpiDescriptor
= (EFI_PEI_PPI_DESCRIPTOR
*)&mPrivateDispatchTableUp
;
978 EfiPeiPpiDescriptor
= (EFI_PEI_PPI_DESCRIPTOR
*)&mPrivateDispatchTableMp
;
982 // Transfer the control to the PEI core
984 (*PeiCoreEntryPoint
)(SecCoreData
, EfiPeiPpiDescriptor
);
987 // If we get here then the PEI Core returned, which is not recoverable.
995 TemporaryRamMigration (
996 IN CONST EFI_PEI_SERVICES
**PeiServices
,
997 IN EFI_PHYSICAL_ADDRESS TemporaryMemoryBase
,
998 IN EFI_PHYSICAL_ADDRESS PermanentMemoryBase
,
1002 IA32_DESCRIPTOR IdtDescriptor
;
1007 DEBUG_AGENT_CONTEXT_POSTMEM_SEC DebugAgentContext
;
1009 BASE_LIBRARY_JUMP_BUFFER JumpBuffer
;
1013 "TemporaryRamMigration(0x%Lx, 0x%Lx, 0x%Lx)\n",
1014 TemporaryMemoryBase
,
1015 PermanentMemoryBase
,
1019 OldHeap
= (VOID
*)(UINTN
)TemporaryMemoryBase
;
1020 NewHeap
= (VOID
*)((UINTN
)PermanentMemoryBase
+ (CopySize
>> 1));
1022 OldStack
= (VOID
*)((UINTN
)TemporaryMemoryBase
+ (CopySize
>> 1));
1023 NewStack
= (VOID
*)(UINTN
)PermanentMemoryBase
;
1025 DebugAgentContext
.HeapMigrateOffset
= (UINTN
)NewHeap
- (UINTN
)OldHeap
;
1026 DebugAgentContext
.StackMigrateOffset
= (UINTN
)NewStack
- (UINTN
)OldStack
;
1028 OldStatus
= SaveAndSetDebugTimerInterrupt (FALSE
);
1029 InitializeDebugAgent (DEBUG_AGENT_INIT_POSTMEM_SEC
, (VOID
*)&DebugAgentContext
, NULL
);
1034 CopyMem (NewHeap
, OldHeap
, CopySize
>> 1);
1039 CopyMem (NewStack
, OldStack
, CopySize
>> 1);
1042 // Rebase IDT table in permanent memory
1044 AsmReadIdtr (&IdtDescriptor
);
1045 IdtDescriptor
.Base
= IdtDescriptor
.Base
- (UINTN
)OldStack
+ (UINTN
)NewStack
;
1047 AsmWriteIdtr (&IdtDescriptor
);
1050 // Use SetJump()/LongJump() to switch to a new stack.
1052 if (SetJump (&JumpBuffer
) == 0) {
1053 #if defined (MDE_CPU_IA32)
1054 JumpBuffer
.Esp
= JumpBuffer
.Esp
+ DebugAgentContext
.StackMigrateOffset
;
1055 JumpBuffer
.Ebp
= JumpBuffer
.Ebp
+ DebugAgentContext
.StackMigrateOffset
;
1057 #if defined (MDE_CPU_X64)
1058 JumpBuffer
.Rsp
= JumpBuffer
.Rsp
+ DebugAgentContext
.StackMigrateOffset
;
1059 JumpBuffer
.Rbp
= JumpBuffer
.Rbp
+ DebugAgentContext
.StackMigrateOffset
;
1061 LongJump (&JumpBuffer
, (UINTN
)-1);
1064 SaveAndSetDebugTimerInterrupt (OldStatus
);