OvmfPkg/ResetVector: update SEV support to use new work area format

BZ: https://bugzilla.tianocore.org/show_bug.cgi?id=3429

Update the SEV support to switch to using the newer work area format.

Cc: James Bottomley <jejb@linux.ibm.com>
Cc: Min Xu <min.m.xu@intel.com>
Cc: Jiewen Yao <jiewen.yao@intel.com>
Cc: Tom Lendacky <thomas.lendacky@amd.com>
Cc: Jordan Justen <jordan.l.justen@intel.com>
Cc: Ard Biesheuvel <ardb+tianocore@kernel.org>
Cc: Erdem Aktas <erdemaktas@google.com>
Signed-off-by: Brijesh Singh <brijesh.singh@amd.com>
Reviewed-by: Min Xu <min.m.xu@intel.com>
Reviewed-by: Jiewen Yao <Jiewen.yao@intel.com>

diff --git a/OvmfPkg/ResetVector/Ia32/AmdSev.asm b/OvmfPkg/ResetVector/Ia32/AmdSev.asm
index aa95d06eaddb909207e50ebc755d22b62b0a166c..87d81b01e263806ea9bf5e679a3e9dc6b9e9442f 100644 (file)
--- a/OvmfPkg/ResetVector/Ia32/AmdSev.asm
+++ b/OvmfPkg/ResetVector/Ia32/AmdSev.asm
@@ -171,6 +171,9 @@ CheckSevFeatures:
     bt        eax, 0\r
     jnc       NoSev\r
 \r
+    ; Set the work area header to indicate that the SEV is enabled\r
+    mov     byte[WORK_AREA_GUEST_TYPE], 1\r
+\r
     ; Check for SEV-ES memory encryption feature:\r
     ; CPUID  Fn8000_001F[EAX] - Bit 3\r
     ;   CPUID raises a #VC exception if running as an SEV-ES guest\r
@@ -257,6 +260,11 @@ SevExit:
 IsSevEsEnabled:\r
     xor       eax, eax\r
 \r
+    ; During CheckSevFeatures, the WORK_AREA_GUEST_TYPE is set\r
+    ; to 1 if SEV is enabled.\r
+    cmp       byte[WORK_AREA_GUEST_TYPE], 1\r
+    jne       SevEsDisabled\r
+\r
     ; During CheckSevFeatures, the SEV_ES_WORK_AREA was set to 1 if\r
     ; SEV-ES is enabled.\r
     cmp       byte[SEV_ES_WORK_AREA], 1\r

diff --git a/OvmfPkg/ResetVector/Ia32/PageTables64.asm b/OvmfPkg/ResetVector/Ia32/PageTables64.asm
index eacdb69ddb9fe7f624376abda00e7ea17161465c..f688909f1c7d00b6dc2edee5ca1566f4a35642d7 100644 (file)
--- a/OvmfPkg/ResetVector/Ia32/PageTables64.asm
+++ b/OvmfPkg/ResetVector/Ia32/PageTables64.asm
@@ -42,6 +42,10 @@ BITS    32
 ;\r
 SetCr3ForPageTables64:\r
 \r
+    ; Clear the WorkArea header. The SEV probe routines will populate the\r
+    ; work area when detected.\r
+    mov     byte[WORK_AREA_GUEST_TYPE], 0\r
+\r
     OneTimeCall   CheckSevFeatures\r
     xor     edx, edx\r
     test    eax, eax\r

diff --git a/OvmfPkg/ResetVector/ResetVector.inf b/OvmfPkg/ResetVector/ResetVector.inf
index d028c92d8cfacd1602bd94feaa73d307837f5c6d..a2520dde5508ef938be3a739338c378ec11bae37 100644 (file)
--- a/OvmfPkg/ResetVector/ResetVector.inf
+++ b/OvmfPkg/ResetVector/ResetVector.inf
@@ -43,6 +43,7 @@
   gUefiOvmfPkgTokenSpaceGuid.PcdOvmfSecPageTablesSize\r
   gUefiOvmfPkgTokenSpaceGuid.PcdOvmfSecPeiTempRamBase\r
   gUefiOvmfPkgTokenSpaceGuid.PcdOvmfSecPeiTempRamSize\r
+  gUefiOvmfPkgTokenSpaceGuid.PcdOvmfWorkAreaBase\r
 \r
 [FixedPcd]\r
   gUefiOvmfPkgTokenSpaceGuid.PcdSevLaunchSecretBase\r

diff --git a/OvmfPkg/ResetVector/ResetVector.nasmb b/OvmfPkg/ResetVector/ResetVector.nasmb
index acec46a3245054518bbffd9389ed3544c1dd12ae..d1d800c567453cdfdf2a7e3ee3a6a54ba801cd7d 100644 (file)
--- a/OvmfPkg/ResetVector/ResetVector.nasmb
+++ b/OvmfPkg/ResetVector/ResetVector.nasmb
@@ -72,6 +72,7 @@
   %define GHCB_PT_ADDR (FixedPcdGet32 (PcdOvmfSecGhcbPageTableBase))\r
   %define GHCB_BASE (FixedPcdGet32 (PcdOvmfSecGhcbBase))\r
   %define GHCB_SIZE (FixedPcdGet32 (PcdOvmfSecGhcbSize))\r
+  %define WORK_AREA_GUEST_TYPE (FixedPcdGet32 (PcdOvmfWorkAreaBase))\r
   %define SEV_ES_WORK_AREA (FixedPcdGet32 (PcdSevEsWorkAreaBase))\r
   %define SEV_ES_WORK_AREA_RDRAND (FixedPcdGet32 (PcdSevEsWorkAreaBase) + 8)\r
   %define SEV_ES_WORK_AREA_ENC_MASK (FixedPcdGet32 (PcdSevEsWorkAreaBase) + 16)\r

diff --git a/OvmfPkg/Sec/SecMain.c b/OvmfPkg/Sec/SecMain.c
index 9db67e17b2aa309e079b5d63cb831049ece15894..707b0d4bbff4e86b292aaef4f3e66563d6a08b5c 100644 (file)
--- a/OvmfPkg/Sec/SecMain.c
+++ b/OvmfPkg/Sec/SecMain.c
@@ -807,6 +807,36 @@ SevEsProtocolCheck (
   Ghcb->GhcbUsage = GHCB_STANDARD_USAGE;\r
 }\r
 \r
+/**\r
+ Determine if the SEV is active.\r
+\r
+ During the early booting, GuestType is set in the work area. Verify that it\r
+ is an SEV guest.\r
+\r
+ @retval TRUE   SEV is enabled\r
+ @retval FALSE  SEV is not enabled\r
+\r
+**/\r
+STATIC\r
+BOOLEAN\r
+IsSevGuest (\r
+  VOID\r
+  )\r
+{\r
+  OVMF_WORK_AREA             *WorkArea;\r
+\r
+  //\r
+  // Ensure that the size of the Confidential Computing work area header\r
+  // is same as what is provided through a fixed PCD.\r
+  //\r
+  ASSERT ((UINTN) FixedPcdGet32 (PcdOvmfConfidentialComputingWorkAreaHeader) ==\r
+          sizeof(CONFIDENTIAL_COMPUTING_WORK_AREA_HEADER));\r
+\r
+  WorkArea = (OVMF_WORK_AREA *) FixedPcdGet32 (PcdOvmfWorkAreaBase);\r
+\r
+  return ((WorkArea != NULL) && (WorkArea->Header.GuestType == GUEST_TYPE_AMD_SEV));\r
+}\r
+\r
 /**\r
   Determine if SEV-ES is active.\r
 \r
@@ -826,9 +856,13 @@ SevEsIsEnabled (
 {\r
   SEC_SEV_ES_WORK_AREA  *SevEsWorkArea;\r
 \r
+  if (!IsSevGuest()) {\r
+    return FALSE;\r
+  }\r
+\r
   SevEsWorkArea = (SEC_SEV_ES_WORK_AREA *) FixedPcdGet32 (PcdSevEsWorkAreaBase);\r
 \r
-  return ((SevEsWorkArea != NULL) && (SevEsWorkArea->SevEsEnabled != 0));\r
+  return (SevEsWorkArea->SevEsEnabled != 0);\r
 }\r
 \r
 VOID\r

diff --git a/OvmfPkg/Sec/SecMain.inf b/OvmfPkg/Sec/SecMain.inf
index 7f78dcee27728e10ef153cb67c1f3a58c227f150..ea4b9611f52dd45e9f28f5e9745f3f6259aacb29 100644 (file)
--- a/OvmfPkg/Sec/SecMain.inf
+++ b/OvmfPkg/Sec/SecMain.inf
@@ -70,6 +70,8 @@
   gUefiOvmfPkgTokenSpaceGuid.PcdGuidedExtractHandlerTableSize\r
   gUefiOvmfPkgTokenSpaceGuid.PcdOvmfDecompressionScratchEnd\r
   gEfiMdeModulePkgTokenSpaceGuid.PcdInitValueInTempStack\r
+  gUefiOvmfPkgTokenSpaceGuid.PcdOvmfConfidentialComputingWorkAreaHeader\r
+  gUefiOvmfPkgTokenSpaceGuid.PcdOvmfWorkAreaBase\r
 \r
 [FeaturePcd]\r
   gUefiOvmfPkgTokenSpaceGuid.PcdSmmSmramRequire\r