OvmfPkg: Obtain SEV encryption mask with the new MemEncryptSevLib API

BZ: https://bugzilla.tianocore.org/show_bug.cgi?id=3108

The early assembler code performs validation for some of the SEV-related
information, specifically the encryption bit position. The new
MemEncryptSevGetEncryptionMask() interface provides access to this
validated value.

To ensure that we always use a validated encryption mask for an SEV-ES
guest, update all locations that use CPUID to calculate the encryption
mask to use the new interface.

Also, clean up some call areas where extra masking was being performed
and where a function call was being used instead of the local variable
that was just set using the function.

Cc: Jordan Justen <jordan.l.justen@intel.com>
Cc: Laszlo Ersek <lersek@redhat.com>
Cc: Ard Biesheuvel <ard.biesheuvel@arm.com>
Cc: Rebecca Cran <rebecca@bsdio.com>
Cc: Peter Grehan <grehan@freebsd.org>
Cc: Brijesh Singh <brijesh.singh@amd.com>
Cc: Anthony Perard <anthony.perard@citrix.com>
Cc: Julien Grall <julien@xen.org>
Reviewed-by: Laszlo Ersek <lersek@redhat.com>
Signed-off-by: Tom Lendacky <thomas.lendacky@amd.com>
Message-Id: <9de678c0d66443c6cc33e004a4cac0a0223c2ebc.1610045305.git.thomas.lendacky@amd.com>

diff --git a/OvmfPkg/Bhyve/PlatformPei/AmdSev.c b/OvmfPkg/Bhyve/PlatformPei/AmdSev.c
index e484f4b311feaf7cc473f2aea44d0e9b30f67b46..e3ed78581c1b9d925e0f22593d533af2da3a78a7 100644 (file)
--- a/OvmfPkg/Bhyve/PlatformPei/AmdSev.c
+++ b/OvmfPkg/Bhyve/PlatformPei/AmdSev.c
@@ -1,7 +1,7 @@
 /**@file\r
   Initialize Secure Encrypted Virtualization (SEV) support\r
 \r
-  Copyright (c) 2017, Advanced Micro Devices. All rights reserved.<BR>\r
+  Copyright (c) 2017 - 2020, Advanced Micro Devices. All rights reserved.<BR>\r
 \r
   SPDX-License-Identifier: BSD-2-Clause-Patent\r
 \r
@@ -15,8 +15,6 @@
 #include <Library/MemEncryptSevLib.h>\r
 #include <Library/PcdLib.h>\r
 #include <PiPei.h>\r
-#include <Register/Amd/Cpuid.h>\r
-#include <Register/Cpuid.h>\r
 #include <Register/Intel/SmramSaveStateMap.h>\r
 \r
 #include "Platform.h"\r
@@ -32,7 +30,6 @@ AmdSevInitialize (
   VOID\r
   )\r
 {\r
-  CPUID_MEMORY_ENCRYPTION_INFO_EBX  Ebx;\r
   UINT64                            EncryptionMask;\r
   RETURN_STATUS                     PcdStatus;\r
 \r
@@ -43,15 +40,10 @@ AmdSevInitialize (
     return;\r
   }\r
 \r
-  //\r
-  // CPUID Fn8000_001F[EBX] Bit 0:5 (memory encryption bit position)\r
-  //\r
-  AsmCpuid (CPUID_MEMORY_ENCRYPTION_INFO, NULL, &Ebx.Uint32, NULL, NULL);\r
-  EncryptionMask = LShiftU64 (1, Ebx.Bits.PtePosBits);\r
-\r
   //\r
   // Set Memory Encryption Mask PCD\r
   //\r
+  EncryptionMask = MemEncryptSevGetEncryptionMask ();\r
   PcdStatus = PcdSet64S (PcdPteMemoryEncryptionAddressOrMask, EncryptionMask);\r
   ASSERT_RETURN_ERROR (PcdStatus);\r
 \r

diff --git a/OvmfPkg/Library/BaseMemEncryptSevLib/X64/VirtualMemory.c b/OvmfPkg/Library/BaseMemEncryptSevLib/X64/VirtualMemory.c
index 5e110c84ff81d60f61d41c478c3eec5a866f1142..6422bc53bd5df8fd5e8bdef35952520160d36cfc 100644 (file)
--- a/OvmfPkg/Library/BaseMemEncryptSevLib/X64/VirtualMemory.c
+++ b/OvmfPkg/Library/BaseMemEncryptSevLib/X64/VirtualMemory.c
@@ -3,7 +3,7 @@
   Virtual Memory Management Services to set or clear the memory encryption bit\r
 \r
   Copyright (c) 2006 - 2018, Intel Corporation. All rights reserved.<BR>\r
-  Copyright (c) 2017, AMD Incorporated. All rights reserved.<BR>\r
+  Copyright (c) 2017 - 2020, AMD Incorporated. All rights reserved.<BR>\r
 \r
   SPDX-License-Identifier: BSD-2-Clause-Patent\r
 \r
@@ -12,6 +12,7 @@
 **/\r
 \r
 #include <Library/CpuLib.h>\r
+#include <Library/MemEncryptSevLib.h>\r
 #include <Register/Amd/Cpuid.h>\r
 #include <Register/Cpuid.h>\r
 \r
@@ -39,17 +40,12 @@ GetMemEncryptionAddressMask (
   )\r
 {\r
   UINT64                            EncryptionMask;\r
-  CPUID_MEMORY_ENCRYPTION_INFO_EBX  Ebx;\r
 \r
   if (mAddressEncMaskChecked) {\r
     return mAddressEncMask;\r
   }\r
 \r
-  //\r
-  // CPUID Fn8000_001F[EBX] Bit 0:5 (memory encryption bit position)\r
-  //\r
-  AsmCpuid (CPUID_MEMORY_ENCRYPTION_INFO, NULL, &Ebx.Uint32, NULL, NULL);\r
-  EncryptionMask = LShiftU64 (1, Ebx.Bits.PtePosBits);\r
+  EncryptionMask = MemEncryptSevGetEncryptionMask ();\r
 \r
   mAddressEncMask = EncryptionMask & PAGING_1G_ADDRESS_MASK_64;\r
   mAddressEncMaskChecked = TRUE;\r
@@ -289,8 +285,7 @@ SetPageTablePoolReadOnly (
   LevelSize[3] = SIZE_1GB;\r
   LevelSize[4] = SIZE_512GB;\r
 \r
-  AddressEncMask  = GetMemEncryptionAddressMask() &\r
-                    PAGING_1G_ADDRESS_MASK_64;\r
+  AddressEncMask  = GetMemEncryptionAddressMask();\r
   PageTable       = (UINT64 *)(UINTN)PageTableBase;\r
   PoolUnitSize    = PAGE_TABLE_POOL_UNIT_SIZE;\r
 \r
@@ -437,7 +432,7 @@ Split1GPageTo2M (
 \r
   AddressEncMask = GetMemEncryptionAddressMask ();\r
   ASSERT (PageDirectoryEntry != NULL);\r
-  ASSERT (*PageEntry1G & GetMemEncryptionAddressMask ());\r
+  ASSERT (*PageEntry1G & AddressEncMask);\r
   //\r
   // Fill in 1G page entry.\r
   //\r

diff --git a/OvmfPkg/PlatformPei/AmdSev.c b/OvmfPkg/PlatformPei/AmdSev.c
index 4a515a484720eca27aeed9e2e8102168b3a0dad8..954d53eba4e82eb63cda5537500743dacf16c49c 100644 (file)
--- a/OvmfPkg/PlatformPei/AmdSev.c
+++ b/OvmfPkg/PlatformPei/AmdSev.c
@@ -1,7 +1,7 @@
 /**@file\r
   Initialize Secure Encrypted Virtualization (SEV) support\r
 \r
-  Copyright (c) 2017, Advanced Micro Devices. All rights reserved.<BR>\r
+  Copyright (c) 2017 - 2020, Advanced Micro Devices. All rights reserved.<BR>\r
 \r
   SPDX-License-Identifier: BSD-2-Clause-Patent\r
 \r
@@ -17,9 +17,7 @@
 #include <Library/MemoryAllocationLib.h>\r
 #include <Library/PcdLib.h>\r
 #include <PiPei.h>\r
-#include <Register/Amd/Cpuid.h>\r
 #include <Register/Amd/Msr.h>\r
-#include <Register/Cpuid.h>\r
 #include <Register/Intel/SmramSaveStateMap.h>\r
 \r
 #include "Platform.h"\r
@@ -116,7 +114,6 @@ AmdSevInitialize (
   VOID\r
   )\r
 {\r
-  CPUID_MEMORY_ENCRYPTION_INFO_EBX  Ebx;\r
   UINT64                            EncryptionMask;\r
   RETURN_STATUS                     PcdStatus;\r
 \r
@@ -127,15 +124,10 @@ AmdSevInitialize (
     return;\r
   }\r
 \r
-  //\r
-  // CPUID Fn8000_001F[EBX] Bit 0:5 (memory encryption bit position)\r
-  //\r
-  AsmCpuid (CPUID_MEMORY_ENCRYPTION_INFO, NULL, &Ebx.Uint32, NULL, NULL);\r
-  EncryptionMask = LShiftU64 (1, Ebx.Bits.PtePosBits);\r
-\r
   //\r
   // Set Memory Encryption Mask PCD\r
   //\r
+  EncryptionMask = MemEncryptSevGetEncryptionMask ();\r
   PcdStatus = PcdSet64S (PcdPteMemoryEncryptionAddressOrMask, EncryptionMask);\r
   ASSERT_RETURN_ERROR (PcdStatus);\r
 \r

diff --git a/OvmfPkg/XenPlatformPei/AmdSev.c b/OvmfPkg/XenPlatformPei/AmdSev.c
index 7ebbb5cc1fd22458d6b6f76779fd119aaa7059c3..4ed448632ae2b831a2a0fc72f61f7ae6dc4db4e9 100644 (file)
--- a/OvmfPkg/XenPlatformPei/AmdSev.c
+++ b/OvmfPkg/XenPlatformPei/AmdSev.c
@@ -1,7 +1,7 @@
 /**@file\r
   Initialize Secure Encrypted Virtualization (SEV) support\r
 \r
-  Copyright (c) 2017, Advanced Micro Devices. All rights reserved.<BR>\r
+  Copyright (c) 2017 - 2020, Advanced Micro Devices. All rights reserved.<BR>\r
   Copyright (c) 2019, Citrix Systems, Inc.\r
 \r
   SPDX-License-Identifier: BSD-2-Clause-Patent\r
@@ -14,8 +14,6 @@
 #include <Library/MemEncryptSevLib.h>\r
 #include <Library/PcdLib.h>\r
 #include <PiPei.h>\r
-#include <Register/Amd/Cpuid.h>\r
-#include <Register/Cpuid.h>\r
 \r
 #include "Platform.h"\r
 \r
@@ -30,7 +28,6 @@ AmdSevInitialize (
   VOID\r
   )\r
 {\r
-  CPUID_MEMORY_ENCRYPTION_INFO_EBX  Ebx;\r
   UINT64                            EncryptionMask;\r
   RETURN_STATUS                     PcdStatus;\r
 \r
@@ -41,15 +38,10 @@ AmdSevInitialize (
     return;\r
   }\r
 \r
-  //\r
-  // CPUID Fn8000_001F[EBX] Bit 0:5 (memory encryption bit position)\r
-  //\r
-  AsmCpuid (CPUID_MEMORY_ENCRYPTION_INFO, NULL, &Ebx.Uint32, NULL, NULL);\r
-  EncryptionMask = LShiftU64 (1, Ebx.Bits.PtePosBits);\r
-\r
   //\r
   // Set Memory Encryption Mask PCD\r
   //\r
+  EncryptionMask = MemEncryptSevGetEncryptionMask ();\r
   PcdStatus = PcdSet64S (PcdPteMemoryEncryptionAddressOrMask, EncryptionMask);\r
   ASSERT_RETURN_ERROR (PcdStatus);\r
 \r