OvmfPkg/IoMmuDxe: Add SEV support for reserved shared memory

Add support to use the reserved shared memory within the IoMmu library.
This improves boot times for all SEV guests, with SEV-SNP benefiting the
most as it avoids the page state change call to the hypervisor.

Cc: Erdem Aktas <erdemaktas@google.com>
Cc: James Bottomley <jejb@linux.ibm.com>
Cc: Jiewen Yao <jiewen.yao@intel.com>
Cc: Min Xu <min.m.xu@intel.com>
Cc: Gerd Hoffmann <kraxel@redhat.com>
Acked-by: Jiewen Yao <Jiewen.yao@intel.com>
Signed-off-by: Tom Lendacky <thomas.lendacky@amd.com>

diff --git a/OvmfPkg/IoMmuDxe/CcIoMmu.c b/OvmfPkg/IoMmuDxe/CcIoMmu.c
index 1479af469881f129fddca4d746a2f7f062940b23..7c2843cd238ac071f8b52a4098c975ea68d63a38 100644 (file)
--- a/OvmfPkg/IoMmuDxe/CcIoMmu.c
+++ b/OvmfPkg/IoMmuDxe/CcIoMmu.c
@@ -223,30 +223,32 @@ IoMmuMap (
       goto FreeMapInfo;\r
   }\r
 \r
-  if (CC_GUEST_IS_SEV (PcdGet64 (PcdConfidentialComputingGuestAttr))) {\r
+  if (MapInfo->ReservedMemBitmap == 0) {\r
     //\r
-    // Clear the memory encryption mask on the plaintext buffer.\r
-    //\r
-    Status = MemEncryptSevClearPageEncMask (\r
-               0,\r
-               MapInfo->PlainTextAddress,\r
-               MapInfo->NumberOfPages\r
-               );\r
-  } else if (CC_GUEST_IS_TDX (PcdGet64 (PcdConfidentialComputingGuestAttr))) {\r
-    //\r
-    // Set the memory shared bit.\r
     // If MapInfo->ReservedMemBitmap is 0, it means the bounce buffer is not allocated\r
     // from the pre-allocated shared memory, so it must be converted to shared memory here.\r
     //\r
-    if (MapInfo->ReservedMemBitmap == 0) {\r
+    if (CC_GUEST_IS_SEV (PcdGet64 (PcdConfidentialComputingGuestAttr))) {\r
+      //\r
+      // Clear the memory encryption mask on the plaintext buffer.\r
+      //\r
+      Status = MemEncryptSevClearPageEncMask (\r
+                 0,\r
+                 MapInfo->PlainTextAddress,\r
+                 MapInfo->NumberOfPages\r
+                 );\r
+    } else if (CC_GUEST_IS_TDX (PcdGet64 (PcdConfidentialComputingGuestAttr))) {\r
+      //\r
+      // Set the memory shared bit.\r
+      //\r
       Status = MemEncryptTdxSetPageSharedBit (\r
                  0,\r
                  MapInfo->PlainTextAddress,\r
                  MapInfo->NumberOfPages\r
                  );\r
+    } else {\r
+      ASSERT (FALSE);\r
     }\r
-  } else {\r
-    ASSERT (FALSE);\r
   }\r
 \r
   ASSERT_EFI_ERROR (Status);\r
@@ -396,30 +398,30 @@ IoMmuUnmapWorker (
       break;\r
   }\r
 \r
-  if (CC_GUEST_IS_SEV (PcdGet64 (PcdConfidentialComputingGuestAttr))) {\r
-    //\r
-    // Restore the memory encryption mask on the area we used to hold the\r
-    // plaintext.\r
-    //\r
-    Status = MemEncryptSevSetPageEncMask (\r
-               0,\r
-               MapInfo->PlainTextAddress,\r
-               MapInfo->NumberOfPages\r
-               );\r
-  } else if (CC_GUEST_IS_TDX (PcdGet64 (PcdConfidentialComputingGuestAttr))) {\r
-    //\r
-    // Restore the memory shared bit mask on the area we used to hold the\r
-    // plaintext.\r
-    //\r
-    if (MapInfo->ReservedMemBitmap == 0) {\r
+  if (MapInfo->ReservedMemBitmap == 0) {\r
+    if (CC_GUEST_IS_SEV (PcdGet64 (PcdConfidentialComputingGuestAttr))) {\r
+      //\r
+      // Restore the memory encryption mask on the area we used to hold the\r
+      // plaintext.\r
+      //\r
+      Status = MemEncryptSevSetPageEncMask (\r
+                 0,\r
+                 MapInfo->PlainTextAddress,\r
+                 MapInfo->NumberOfPages\r
+                 );\r
+    } else if (CC_GUEST_IS_TDX (PcdGet64 (PcdConfidentialComputingGuestAttr))) {\r
+      //\r
+      // Restore the memory shared bit mask on the area we used to hold the\r
+      // plaintext.\r
+      //\r
       Status = MemEncryptTdxClearPageSharedBit (\r
                  0,\r
                  MapInfo->PlainTextAddress,\r
                  MapInfo->NumberOfPages\r
                  );\r
+    } else {\r
+      ASSERT (FALSE);\r
     }\r
-  } else {\r
-    ASSERT (FALSE);\r
   }\r
 \r
   ASSERT_EFI_ERROR (Status);\r
@@ -924,16 +926,14 @@ InstallIoMmuProtocol (
   }\r
 \r
   //\r
-  // Currently only Tdx guest support Reserved shared memory for DMA operation.\r
+  // For CC guests, use reserved shared memory for DMA operation.\r
   //\r
-  if (CC_GUEST_IS_TDX (PcdGet64 (PcdConfidentialComputingGuestAttr))) {\r
-    mReservedSharedMemSupported = TRUE;\r
-    Status                      = IoMmuInitReservedSharedMem ();\r
-    if (EFI_ERROR (Status)) {\r
-      mReservedSharedMemSupported = FALSE;\r
-    } else {\r
-      DEBUG ((DEBUG_INFO, "%a: Feature of reserved memory for DMA is supported.\n", __FUNCTION__));\r
-    }\r
+  mReservedSharedMemSupported = TRUE;\r
+  Status                      = IoMmuInitReservedSharedMem ();\r
+  if (EFI_ERROR (Status)) {\r
+    mReservedSharedMemSupported = FALSE;\r
+  } else {\r
+    DEBUG ((DEBUG_INFO, "%a: Feature of reserved memory for DMA is supported.\n", __FUNCTION__));\r
   }\r
 \r
   return EFI_SUCCESS;\r

diff --git a/OvmfPkg/IoMmuDxe/IoMmuBuffer.c b/OvmfPkg/IoMmuDxe/IoMmuBuffer.c
index 2675223aa0df95e14f6e2937b2dad8997a24144b..83c7c5958340d151b0005d142bed3297ccc7cdb1 100644 (file)
--- a/OvmfPkg/IoMmuDxe/IoMmuBuffer.c
+++ b/OvmfPkg/IoMmuDxe/IoMmuBuffer.c
@@ -9,7 +9,9 @@
 #include <Library/BaseMemoryLib.h>\r
 #include <Library/DebugLib.h>\r
 #include <Library/MemoryAllocationLib.h>\r
+#include <Library/MemEncryptSevLib.h>\r
 #include <Library/MemEncryptTdxLib.h>\r
+#include <Library/PcdLib.h>\r
 #include <Library/UefiBootServicesTableLib.h>\r
 #include "IoMmuInternal.h"\r
 \r
@@ -139,6 +141,7 @@ IoMmuInitReservedSharedMem (
   UINTN                     TotalPages;\r
   IOMMU_RESERVED_MEM_RANGE  *MemRange;\r
   EFI_PHYSICAL_ADDRESS      PhysicalAddress;\r
+  UINT64                    SharedAddress;\r
 \r
   if (!mReservedSharedMemSupported) {\r
     return EFI_UNSUPPORTED;\r
@@ -163,12 +166,25 @@ IoMmuInitReservedSharedMem (
     MemRange->StartAddressOfMemRange = PhysicalAddress;\r
 \r
     for (Index2 = 0; Index2 < MemRange->Slots; Index2++) {\r
-      Status = MemEncryptTdxSetPageSharedBit (\r
-                 0,\r
-                 (UINT64)(UINTN)(MemRange->StartAddressOfMemRange + Index2 * SIZE_OF_MEM_RANGE (MemRange) + MemRange->HeaderSize),\r
-                 EFI_SIZE_TO_PAGES (MemRange->DataSize)\r
-                 );\r
-      ASSERT (!EFI_ERROR (Status));\r
+      SharedAddress = (UINT64)(UINTN)(MemRange->StartAddressOfMemRange + Index2 * SIZE_OF_MEM_RANGE (MemRange) + MemRange->HeaderSize);\r
+\r
+      if (CC_GUEST_IS_SEV (PcdGet64 (PcdConfidentialComputingGuestAttr))) {\r
+        Status = MemEncryptSevClearPageEncMask (\r
+                   0,\r
+                   SharedAddress,\r
+                   EFI_SIZE_TO_PAGES (MemRange->DataSize)\r
+                   );\r
+        ASSERT (!EFI_ERROR (Status));\r
+      } else if (CC_GUEST_IS_TDX (PcdGet64 (PcdConfidentialComputingGuestAttr))) {\r
+        Status = MemEncryptTdxSetPageSharedBit (\r
+                   0,\r
+                   SharedAddress,\r
+                   EFI_SIZE_TO_PAGES (MemRange->DataSize)\r
+                   );\r
+        ASSERT (!EFI_ERROR (Status));\r
+      } else {\r
+        ASSERT (FALSE);\r
+      }\r
     }\r
 \r
     PhysicalAddress += (MemRange->Slots * SIZE_OF_MEM_RANGE (MemRange));\r
@@ -190,6 +206,7 @@ IoMmuReleaseReservedSharedMem (
   EFI_STATUS                Status;\r
   UINT32                    Index1, Index2;\r
   IOMMU_RESERVED_MEM_RANGE  *MemRange;\r
+  UINT64                    SharedAddress;\r
 \r
   if (!mReservedSharedMemSupported) {\r
     return EFI_SUCCESS;\r
@@ -198,12 +215,25 @@ IoMmuReleaseReservedSharedMem (
   for (Index1 = 0; Index1 < ARRAY_SIZE (mReservedMemRanges); Index1++) {\r
     MemRange = &mReservedMemRanges[Index1];\r
     for (Index2 = 0; Index2 < MemRange->Slots; Index2++) {\r
-      Status = MemEncryptTdxClearPageSharedBit (\r
-                 0,\r
-                 (UINT64)(UINTN)(MemRange->StartAddressOfMemRange + Index2 * SIZE_OF_MEM_RANGE (MemRange) + MemRange->HeaderSize),\r
-                 EFI_SIZE_TO_PAGES (MemRange->DataSize)\r
-                 );\r
-      ASSERT (!EFI_ERROR (Status));\r
+      SharedAddress = (UINT64)(UINTN)(MemRange->StartAddressOfMemRange + Index2 * SIZE_OF_MEM_RANGE (MemRange) + MemRange->HeaderSize);\r
+\r
+      if (CC_GUEST_IS_SEV (PcdGet64 (PcdConfidentialComputingGuestAttr))) {\r
+        Status = MemEncryptSevSetPageEncMask (\r
+                   0,\r
+                   SharedAddress,\r
+                   EFI_SIZE_TO_PAGES (MemRange->DataSize)\r
+                   );\r
+        ASSERT (!EFI_ERROR (Status));\r
+      } else if (CC_GUEST_IS_TDX (PcdGet64 (PcdConfidentialComputingGuestAttr))) {\r
+        Status = MemEncryptTdxClearPageSharedBit (\r
+                   0,\r
+                   SharedAddress,\r
+                   EFI_SIZE_TO_PAGES (MemRange->DataSize)\r
+                   );\r
+        ASSERT (!EFI_ERROR (Status));\r
+      } else {\r
+        ASSERT (FALSE);\r
+      }\r
     }\r
   }\r
 \r