OvmfPkg/MemEncryptSevLib: Add an interface to retrieve the encryption mask

BZ: https://bugzilla.tianocore.org/show_bug.cgi?id=3108

To ensure that we always use a validated encryption mask for an SEV-ES
guest, create a new interface in the MemEncryptSevLib library to return
the encryption mask. This can be used in place of the multiple locations
where CPUID is used to retrieve the value (which would require validation
again) and allows the validated mask to be returned.

The PEI phase will use the value from the SEV-ES work area. Since the
SEV-ES work area isn't valid in the DXE phase, the DXE phase will use the
PcdPteMemoryEncryptionAddressOrMask PCD which is set during PEI.

Cc: Jordan Justen <jordan.l.justen@intel.com>
Cc: Laszlo Ersek <lersek@redhat.com>
Cc: Ard Biesheuvel <ard.biesheuvel@arm.com>
Cc: Rebecca Cran <rebecca@bsdio.com>
Cc: Peter Grehan <grehan@freebsd.org>
Cc: Anthony Perard <anthony.perard@citrix.com>
Cc: Julien Grall <julien@xen.org>
Cc: Brijesh Singh <brijesh.singh@amd.com>
Acked-by: Laszlo Ersek <lersek@redhat.com>
Signed-off-by: Tom Lendacky <thomas.lendacky@amd.com>
Message-Id: <e12044dc01b21e6fc2e9535760ddf3a38a142a71.1610045305.git.thomas.lendacky@amd.com>

diff --git a/OvmfPkg/AmdSev/AmdSevX64.dsc b/OvmfPkg/AmdSev/AmdSevX64.dsc
index bb7697eb324bc63ddbb59c1a0ad83e1e4b83d4ec..d39436e7afc92ab917d182284c43fa5f91c7cc64 100644 (file)
--- a/OvmfPkg/AmdSev/AmdSevX64.dsc
+++ b/OvmfPkg/AmdSev/AmdSevX64.dsc
@@ -164,7 +164,7 @@
   QemuFwCfgSimpleParserLib|OvmfPkg/Library/QemuFwCfgSimpleParserLib/QemuFwCfgSimpleParserLib.inf\r
   VirtioLib|OvmfPkg/Library/VirtioLib/VirtioLib.inf\r
   LoadLinuxLib|OvmfPkg/Library/LoadLinuxLib/LoadLinuxLib.inf\r
-  MemEncryptSevLib|OvmfPkg/Library/BaseMemEncryptSevLib/BaseMemEncryptSevLib.inf\r
+  MemEncryptSevLib|OvmfPkg/Library/BaseMemEncryptSevLib/DxeMemEncryptSevLib.inf\r
   LockBoxLib|OvmfPkg/Library/LockBoxLib/LockBoxBaseLib.inf\r
   CustomizedDisplayLib|MdeModulePkg/Library/CustomizedDisplayLib/CustomizedDisplayLib.inf\r
   FrameBufferBltLib|MdeModulePkg/Library/FrameBufferBltLib/FrameBufferBltLib.inf\r
@@ -285,6 +285,8 @@
   Tpm2DeviceLib|SecurityPkg/Library/Tpm2DeviceLibDTpm/Tpm2DeviceLibDTpm.inf\r
 !endif\r
 \r
+  MemEncryptSevLib|OvmfPkg/Library/BaseMemEncryptSevLib/PeiMemEncryptSevLib.inf\r
+\r
 [LibraryClasses.common.DXE_CORE]\r
   HobLib|MdePkg/Library/DxeCoreHobLib/DxeCoreHobLib.inf\r
   DxeCoreEntryPoint|MdePkg/Library/DxeCoreEntryPoint/DxeCoreEntryPoint.inf\r

diff --git a/OvmfPkg/Bhyve/BhyveX64.dsc b/OvmfPkg/Bhyve/BhyveX64.dsc
index b93fe30ae4e057267fc6620eb9d1e1ad544487c3..33edf3d2d6b548e602f7824345fc5797b024adf9 100644 (file)
--- a/OvmfPkg/Bhyve/BhyveX64.dsc
+++ b/OvmfPkg/Bhyve/BhyveX64.dsc
@@ -163,7 +163,7 @@
   QemuFwCfgS3Lib|OvmfPkg/Library/QemuFwCfgS3Lib/BaseQemuFwCfgS3LibNull.inf\r
   BhyveFwCtlLib|OvmfPkg/Library/BhyveFwCtlLib/BhyveFwCtlLib.inf\r
   VirtioLib|OvmfPkg/Library/VirtioLib/VirtioLib.inf\r
-  MemEncryptSevLib|OvmfPkg/Library/BaseMemEncryptSevLib/BaseMemEncryptSevLib.inf\r
+  MemEncryptSevLib|OvmfPkg/Library/BaseMemEncryptSevLib/DxeMemEncryptSevLib.inf\r
   LockBoxLib|OvmfPkg/Library/LockBoxLib/LockBoxBaseLib.inf\r
 \r
   CustomizedDisplayLib|MdeModulePkg/Library/CustomizedDisplayLib/CustomizedDisplayLib.inf\r
@@ -292,6 +292,8 @@
   Tpm2DeviceLib|SecurityPkg/Library/Tpm2DeviceLibDTpm/Tpm2DeviceLibDTpm.inf\r
 !endif\r
 \r
+  MemEncryptSevLib|OvmfPkg/Library/BaseMemEncryptSevLib/PeiMemEncryptSevLib.inf\r
+\r
 [LibraryClasses.common.DXE_CORE]\r
   HobLib|MdePkg/Library/DxeCoreHobLib/DxeCoreHobLib.inf\r
   DxeCoreEntryPoint|MdePkg/Library/DxeCoreEntryPoint/DxeCoreEntryPoint.inf\r

diff --git a/OvmfPkg/Include/Library/MemEncryptSevLib.h b/OvmfPkg/Include/Library/MemEncryptSevLib.h
index a2c70aa550fe6f626e816d94a559bbae0b59d58c..872abe6725dcb9d3cf1e3308bb4b534aefd6cfbc 100644 (file)
--- a/OvmfPkg/Include/Library/MemEncryptSevLib.h
+++ b/OvmfPkg/Include/Library/MemEncryptSevLib.h
@@ -135,4 +135,16 @@ MemEncryptSevLocateInitialSmramSaveStateMapPages (
   OUT UINTN *BaseAddress,\r
   OUT UINTN *NumberOfPages\r
   );\r
+\r
+/**\r
+  Returns the SEV encryption mask.\r
+\r
+  @return  The SEV pagetable encryption mask\r
+**/\r
+UINT64\r
+EFIAPI\r
+MemEncryptSevGetEncryptionMask (\r
+  VOID\r
+  );\r
+\r
 #endif // _MEM_ENCRYPT_SEV_LIB_H_\r

diff --git a/OvmfPkg/Library/BaseMemEncryptSevLib/BaseMemEncryptSevLib.inf b/OvmfPkg/Library/BaseMemEncryptSevLib/BaseMemEncryptSevLib.inf
deleted file mode 100644 (file)
index 7c44d09..0000000
--- a/OvmfPkg/Library/BaseMemEncryptSevLib/BaseMemEncryptSevLib.inf
+++ /dev/null
@@ -1,51 +0,0 @@
-## @file\r
-#  Library provides the helper functions for SEV guest\r
-#\r
-# Copyright (c) 2017 Advanced Micro Devices. All rights reserved.<BR>\r
-#\r
-#  SPDX-License-Identifier: BSD-2-Clause-Patent\r
-#\r
-#\r
-##\r
-\r
-[Defines]\r
-  INF_VERSION                    = 1.25\r
-  BASE_NAME                      = MemEncryptSevLib\r
-  FILE_GUID                      = c1594631-3888-4be4-949f-9c630dbc842b\r
-  MODULE_TYPE                    = BASE\r
-  VERSION_STRING                 = 1.0\r
-  LIBRARY_CLASS                  = MemEncryptSevLib|PEIM DXE_DRIVER DXE_RUNTIME_DRIVER DXE_SMM_DRIVER UEFI_DRIVER\r
-\r
-#\r
-# The following information is for reference only and not required by the build\r
-# tools.\r
-#\r
-# VALID_ARCHITECTURES           = IA32 X64\r
-#\r
-\r
-[Packages]\r
-  MdeModulePkg/MdeModulePkg.dec\r
-  MdePkg/MdePkg.dec\r
-  OvmfPkg/OvmfPkg.dec\r
-  UefiCpuPkg/UefiCpuPkg.dec\r
-\r
-[Sources.X64]\r
-  MemEncryptSevLibInternal.c\r
-  X64/MemEncryptSevLib.c\r
-  X64/VirtualMemory.c\r
-  X64/VirtualMemory.h\r
-\r
-[Sources.IA32]\r
-  Ia32/MemEncryptSevLib.c\r
-  MemEncryptSevLibInternal.c\r
-\r
-[LibraryClasses]\r
-  BaseLib\r
-  CacheMaintenanceLib\r
-  CpuLib\r
-  DebugLib\r
-  MemoryAllocationLib\r
-  PcdLib\r
-\r
-[FeaturePcd]\r
-  gUefiOvmfPkgTokenSpaceGuid.PcdSmmSmramRequire\r

diff --git a/OvmfPkg/Library/BaseMemEncryptSevLib/DxeMemEncryptSevLib.inf b/OvmfPkg/Library/BaseMemEncryptSevLib/DxeMemEncryptSevLib.inf
new file mode 100644 (file)
index 0000000..837db08
--- /dev/null
+++ b/OvmfPkg/Library/BaseMemEncryptSevLib/DxeMemEncryptSevLib.inf
@@ -0,0 +1,56 @@
+## @file\r
+#  Library provides the helper functions for SEV guest\r
+#\r
+# Copyright (c) 2017 - 2020, Advanced Micro Devices. All rights reserved.<BR>\r
+#\r
+#  SPDX-License-Identifier: BSD-2-Clause-Patent\r
+#\r
+#\r
+##\r
+\r
+[Defines]\r
+  INF_VERSION                    = 1.25\r
+  BASE_NAME                      = DxeMemEncryptSevLib\r
+  FILE_GUID                      = c1594631-3888-4be4-949f-9c630dbc842b\r
+  MODULE_TYPE                    = BASE\r
+  VERSION_STRING                 = 1.0\r
+  LIBRARY_CLASS                  = MemEncryptSevLib|DXE_DRIVER DXE_RUNTIME_DRIVER DXE_SMM_DRIVER UEFI_DRIVER\r
+\r
+#\r
+# The following information is for reference only and not required by the build\r
+# tools.\r
+#\r
+# VALID_ARCHITECTURES           = IA32 X64\r
+#\r
+\r
+[Packages]\r
+  MdeModulePkg/MdeModulePkg.dec\r
+  MdePkg/MdePkg.dec\r
+  OvmfPkg/OvmfPkg.dec\r
+  UefiCpuPkg/UefiCpuPkg.dec\r
+\r
+[Sources]\r
+  DxeMemEncryptSevLibInternal.c\r
+  MemEncryptSevLibInternal.c\r
+\r
+[Sources.X64]\r
+  X64/MemEncryptSevLib.c\r
+  X64/VirtualMemory.c\r
+  X64/VirtualMemory.h\r
+\r
+[Sources.IA32]\r
+  Ia32/MemEncryptSevLib.c\r
+\r
+[LibraryClasses]\r
+  BaseLib\r
+  CacheMaintenanceLib\r
+  CpuLib\r
+  DebugLib\r
+  MemoryAllocationLib\r
+  PcdLib\r
+\r
+[FeaturePcd]\r
+  gUefiOvmfPkgTokenSpaceGuid.PcdSmmSmramRequire\r
+\r
+[Pcd]\r
+  gEfiMdeModulePkgTokenSpaceGuid.PcdPteMemoryEncryptionAddressOrMask\r

diff --git a/OvmfPkg/Library/BaseMemEncryptSevLib/DxeMemEncryptSevLibInternal.c b/OvmfPkg/Library/BaseMemEncryptSevLib/DxeMemEncryptSevLibInternal.c
new file mode 100644 (file)
index 0000000..2816f85
--- /dev/null
+++ b/OvmfPkg/Library/BaseMemEncryptSevLib/DxeMemEncryptSevLibInternal.c
@@ -0,0 +1,145 @@
+/** @file\r
+\r
+  Secure Encrypted Virtualization (SEV) library helper function\r
+\r
+  Copyright (c) 2017 - 2020, AMD Incorporated. All rights reserved.<BR>\r
+\r
+  SPDX-License-Identifier: BSD-2-Clause-Patent\r
+\r
+**/\r
+\r
+#include <Library/BaseLib.h>\r
+#include <Library/DebugLib.h>\r
+#include <Library/MemEncryptSevLib.h>\r
+#include <Library/PcdLib.h>\r
+#include <Register/Amd/Cpuid.h>\r
+#include <Register/Amd/Msr.h>\r
+#include <Register/Cpuid.h>\r
+#include <Uefi/UefiBaseType.h>\r
+\r
+STATIC BOOLEAN mSevStatus = FALSE;\r
+STATIC BOOLEAN mSevEsStatus = FALSE;\r
+STATIC BOOLEAN mSevStatusChecked = FALSE;\r
+\r
+STATIC UINT64  mSevEncryptionMask = 0;\r
+STATIC BOOLEAN mSevEncryptionMaskSaved = FALSE;\r
+\r
+/**\r
+  Reads and sets the status of SEV features.\r
+\r
+  **/\r
+STATIC\r
+VOID\r
+EFIAPI\r
+InternalMemEncryptSevStatus (\r
+  VOID\r
+  )\r
+{\r
+  UINT32                            RegEax;\r
+  MSR_SEV_STATUS_REGISTER           Msr;\r
+  CPUID_MEMORY_ENCRYPTION_INFO_EAX  Eax;\r
+  BOOLEAN                           ReadSevMsr;\r
+  UINT64                            EncryptionMask;\r
+\r
+  ReadSevMsr = FALSE;\r
+\r
+  EncryptionMask = PcdGet64 (PcdPteMemoryEncryptionAddressOrMask);\r
+  if (EncryptionMask != 0) {\r
+    //\r
+    // The MSR has been read before, so it is safe to read it again and avoid\r
+    // having to validate the CPUID information.\r
+    //\r
+    ReadSevMsr = TRUE;\r
+  } else {\r
+    //\r
+    // Check if memory encryption leaf exist\r
+    //\r
+    AsmCpuid (CPUID_EXTENDED_FUNCTION, &RegEax, NULL, NULL, NULL);\r
+    if (RegEax >= CPUID_MEMORY_ENCRYPTION_INFO) {\r
+      //\r
+      // CPUID Fn8000_001F[EAX] Bit 1 (Sev supported)\r
+      //\r
+      AsmCpuid (CPUID_MEMORY_ENCRYPTION_INFO, &Eax.Uint32, NULL, NULL, NULL);\r
+\r
+      if (Eax.Bits.SevBit) {\r
+        ReadSevMsr = TRUE;\r
+      }\r
+    }\r
+  }\r
+\r
+  if (ReadSevMsr) {\r
+    //\r
+    // Check MSR_0xC0010131 Bit 0 (Sev Enabled)\r
+    //\r
+    Msr.Uint32 = AsmReadMsr32 (MSR_SEV_STATUS);\r
+    if (Msr.Bits.SevBit) {\r
+      mSevStatus = TRUE;\r
+    }\r
+\r
+    //\r
+    // Check MSR_0xC0010131 Bit 1 (Sev-Es Enabled)\r
+    //\r
+    if (Msr.Bits.SevEsBit) {\r
+      mSevEsStatus = TRUE;\r
+    }\r
+  }\r
+\r
+  mSevStatusChecked = TRUE;\r
+}\r
+\r
+/**\r
+  Returns a boolean to indicate whether SEV-ES is enabled.\r
+\r
+  @retval TRUE           SEV-ES is enabled\r
+  @retval FALSE          SEV-ES is not enabled\r
+**/\r
+BOOLEAN\r
+EFIAPI\r
+MemEncryptSevEsIsEnabled (\r
+  VOID\r
+  )\r
+{\r
+  if (!mSevStatusChecked) {\r
+    InternalMemEncryptSevStatus ();\r
+  }\r
+\r
+  return mSevEsStatus;\r
+}\r
+\r
+/**\r
+  Returns a boolean to indicate whether SEV is enabled.\r
+\r
+  @retval TRUE           SEV is enabled\r
+  @retval FALSE          SEV is not enabled\r
+**/\r
+BOOLEAN\r
+EFIAPI\r
+MemEncryptSevIsEnabled (\r
+  VOID\r
+  )\r
+{\r
+  if (!mSevStatusChecked) {\r
+    InternalMemEncryptSevStatus ();\r
+  }\r
+\r
+  return mSevStatus;\r
+}\r
+\r
+/**\r
+  Returns the SEV encryption mask.\r
+\r
+  @return  The SEV pagtable encryption mask\r
+**/\r
+UINT64\r
+EFIAPI\r
+MemEncryptSevGetEncryptionMask (\r
+  VOID\r
+  )\r
+{\r
+  if (!mSevEncryptionMaskSaved) {\r
+    mSevEncryptionMask = PcdGet64 (PcdPteMemoryEncryptionAddressOrMask);\r
+    mSevEncryptionMaskSaved = TRUE;\r
+  }\r
+\r
+  return mSevEncryptionMask;\r
+}\r

diff --git a/OvmfPkg/Library/BaseMemEncryptSevLib/MemEncryptSevLibInternal.c b/OvmfPkg/Library/BaseMemEncryptSevLib/MemEncryptSevLibInternal.c
index 02b8eb225d8125fe922fb4a321a81f1ff4996da5..b4a9f464e2688e4f59fc02780076e589ff6ed89f 100644 (file)
--- a/OvmfPkg/Library/BaseMemEncryptSevLib/MemEncryptSevLibInternal.c
+++ b/OvmfPkg/Library/BaseMemEncryptSevLib/MemEncryptSevLibInternal.c
@@ -2,7 +2,7 @@
 \r
   Secure Encrypted Virtualization (SEV) library helper function\r
 \r
-  Copyright (c) 2017, AMD Incorporated. All rights reserved.<BR>\r
+  Copyright (c) 2017 - 2020, AMD Incorporated. All rights reserved.<BR>\r
 \r
   SPDX-License-Identifier: BSD-2-Clause-Patent\r
 \r
@@ -12,102 +12,10 @@
 #include <Library/DebugLib.h>\r
 #include <Library/MemEncryptSevLib.h>\r
 #include <Library/PcdLib.h>\r
-#include <Register/Amd/Cpuid.h>\r
-#include <Register/Amd/Msr.h>\r
-#include <Register/Cpuid.h>\r
 #include <Register/QemuSmramSaveStateMap.h>\r
 #include <Register/SmramSaveStateMap.h>\r
 #include <Uefi/UefiBaseType.h>\r
 \r
-STATIC BOOLEAN mSevStatus = FALSE;\r
-STATIC BOOLEAN mSevEsStatus = FALSE;\r
-STATIC BOOLEAN mSevStatusChecked = FALSE;\r
-\r
-/**\r
-  Reads and sets the status of SEV features.\r
-\r
-  **/\r
-STATIC\r
-VOID\r
-EFIAPI\r
-InternalMemEncryptSevStatus (\r
-  VOID\r
-  )\r
-{\r
-  UINT32                            RegEax;\r
-  MSR_SEV_STATUS_REGISTER           Msr;\r
-  CPUID_MEMORY_ENCRYPTION_INFO_EAX  Eax;\r
-\r
-  //\r
-  // Check if memory encryption leaf exist\r
-  //\r
-  AsmCpuid (CPUID_EXTENDED_FUNCTION, &RegEax, NULL, NULL, NULL);\r
-  if (RegEax >= CPUID_MEMORY_ENCRYPTION_INFO) {\r
-    //\r
-    // CPUID Fn8000_001F[EAX] Bit 1 (Sev supported)\r
-    //\r
-    AsmCpuid (CPUID_MEMORY_ENCRYPTION_INFO, &Eax.Uint32, NULL, NULL, NULL);\r
-\r
-    if (Eax.Bits.SevBit) {\r
-      //\r
-      // Check MSR_0xC0010131 Bit 0 (Sev Enabled)\r
-      //\r
-      Msr.Uint32 = AsmReadMsr32 (MSR_SEV_STATUS);\r
-      if (Msr.Bits.SevBit) {\r
-        mSevStatus = TRUE;\r
-      }\r
-\r
-      //\r
-      // Check MSR_0xC0010131 Bit 1 (Sev-Es Enabled)\r
-      //\r
-      if (Msr.Bits.SevEsBit) {\r
-        mSevEsStatus = TRUE;\r
-      }\r
-    }\r
-  }\r
-\r
-  mSevStatusChecked = TRUE;\r
-}\r
-\r
-/**\r
-  Returns a boolean to indicate whether SEV-ES is enabled.\r
-\r
-  @retval TRUE           SEV-ES is enabled\r
-  @retval FALSE          SEV-ES is not enabled\r
-**/\r
-BOOLEAN\r
-EFIAPI\r
-MemEncryptSevEsIsEnabled (\r
-  VOID\r
-  )\r
-{\r
-  if (!mSevStatusChecked) {\r
-    InternalMemEncryptSevStatus ();\r
-  }\r
-\r
-  return mSevEsStatus;\r
-}\r
-\r
-/**\r
-  Returns a boolean to indicate whether SEV is enabled.\r
-\r
-  @retval TRUE           SEV is enabled\r
-  @retval FALSE          SEV is not enabled\r
-**/\r
-BOOLEAN\r
-EFIAPI\r
-MemEncryptSevIsEnabled (\r
-  VOID\r
-  )\r
-{\r
-  if (!mSevStatusChecked) {\r
-    InternalMemEncryptSevStatus ();\r
-  }\r
-\r
-  return mSevStatus;\r
-}\r
-\r
-\r
 /**\r
   Locate the page range that covers the initial (pre-SMBASE-relocation) SMRAM\r
   Save State Map.\r

diff --git a/OvmfPkg/Library/BaseMemEncryptSevLib/PeiMemEncryptSevLib.inf b/OvmfPkg/Library/BaseMemEncryptSevLib/PeiMemEncryptSevLib.inf
new file mode 100644 (file)
index 0000000..c3cd046
--- /dev/null
+++ b/OvmfPkg/Library/BaseMemEncryptSevLib/PeiMemEncryptSevLib.inf
@@ -0,0 +1,56 @@
+## @file\r
+#  Library provides the helper functions for SEV guest\r
+#\r
+# Copyright (c) 2020 Advanced Micro Devices. All rights reserved.<BR>\r
+#\r
+#  SPDX-License-Identifier: BSD-2-Clause-Patent\r
+#\r
+#\r
+##\r
+\r
+[Defines]\r
+  INF_VERSION                    = 1.25\r
+  BASE_NAME                      = PeiMemEncryptSevLib\r
+  FILE_GUID                      = 15d9a694-3d2a-4184-9672-ba55c3070e07\r
+  MODULE_TYPE                    = BASE\r
+  VERSION_STRING                 = 1.0\r
+  LIBRARY_CLASS                  = MemEncryptSevLib|PEIM\r
+\r
+#\r
+# The following information is for reference only and not required by the build\r
+# tools.\r
+#\r
+# VALID_ARCHITECTURES           = IA32 X64\r
+#\r
+\r
+[Packages]\r
+  MdeModulePkg/MdeModulePkg.dec\r
+  MdePkg/MdePkg.dec\r
+  OvmfPkg/OvmfPkg.dec\r
+  UefiCpuPkg/UefiCpuPkg.dec\r
+\r
+[Sources]\r
+  MemEncryptSevLibInternal.c\r
+  PeiMemEncryptSevLibInternal.c\r
+\r
+[Sources.X64]\r
+  X64/MemEncryptSevLib.c\r
+  X64/VirtualMemory.c\r
+  X64/VirtualMemory.h\r
+\r
+[Sources.IA32]\r
+  Ia32/MemEncryptSevLib.c\r
+\r
+[LibraryClasses]\r
+  BaseLib\r
+  CacheMaintenanceLib\r
+  CpuLib\r
+  DebugLib\r
+  MemoryAllocationLib\r
+  PcdLib\r
+\r
+[FeaturePcd]\r
+  gUefiOvmfPkgTokenSpaceGuid.PcdSmmSmramRequire\r
+\r
+[FixedPcd]\r
+  gUefiCpuPkgTokenSpaceGuid.PcdSevEsWorkAreaBase\r

diff --git a/OvmfPkg/Library/BaseMemEncryptSevLib/PeiMemEncryptSevLibInternal.c b/OvmfPkg/Library/BaseMemEncryptSevLib/PeiMemEncryptSevLibInternal.c
new file mode 100644 (file)
index 0000000..e2fd109
--- /dev/null
+++ b/OvmfPkg/Library/BaseMemEncryptSevLib/PeiMemEncryptSevLibInternal.c
@@ -0,0 +1,159 @@
+/** @file\r
+\r
+  Secure Encrypted Virtualization (SEV) library helper function\r
+\r
+  Copyright (c) 2020, AMD Incorporated. All rights reserved.<BR>\r
+\r
+  SPDX-License-Identifier: BSD-2-Clause-Patent\r
+\r
+**/\r
+\r
+#include <Library/BaseLib.h>\r
+#include <Library/DebugLib.h>\r
+#include <Library/MemEncryptSevLib.h>\r
+#include <Library/PcdLib.h>\r
+#include <Register/Amd/Cpuid.h>\r
+#include <Register/Amd/Msr.h>\r
+#include <Register/Cpuid.h>\r
+#include <Uefi/UefiBaseType.h>\r
+\r
+STATIC BOOLEAN mSevStatus = FALSE;\r
+STATIC BOOLEAN mSevEsStatus = FALSE;\r
+STATIC BOOLEAN mSevStatusChecked = FALSE;\r
+\r
+STATIC UINT64  mSevEncryptionMask = 0;\r
+STATIC BOOLEAN mSevEncryptionMaskSaved = FALSE;\r
+\r
+/**\r
+  Reads and sets the status of SEV features.\r
+\r
+  **/\r
+STATIC\r
+VOID\r
+EFIAPI\r
+InternalMemEncryptSevStatus (\r
+  VOID\r
+  )\r
+{\r
+  UINT32                            RegEax;\r
+  MSR_SEV_STATUS_REGISTER           Msr;\r
+  CPUID_MEMORY_ENCRYPTION_INFO_EAX  Eax;\r
+  BOOLEAN                           ReadSevMsr;\r
+  SEC_SEV_ES_WORK_AREA              *SevEsWorkArea;\r
+\r
+  ReadSevMsr = FALSE;\r
+\r
+  SevEsWorkArea = (SEC_SEV_ES_WORK_AREA *) FixedPcdGet32 (PcdSevEsWorkAreaBase);\r
+  if (SevEsWorkArea != NULL && SevEsWorkArea->EncryptionMask != 0) {\r
+    //\r
+    // The MSR has been read before, so it is safe to read it again and avoid\r
+    // having to validate the CPUID information.\r
+    //\r
+    ReadSevMsr = TRUE;\r
+  } else {\r
+    //\r
+    // Check if memory encryption leaf exist\r
+    //\r
+    AsmCpuid (CPUID_EXTENDED_FUNCTION, &RegEax, NULL, NULL, NULL);\r
+    if (RegEax >= CPUID_MEMORY_ENCRYPTION_INFO) {\r
+      //\r
+      // CPUID Fn8000_001F[EAX] Bit 1 (Sev supported)\r
+      //\r
+      AsmCpuid (CPUID_MEMORY_ENCRYPTION_INFO, &Eax.Uint32, NULL, NULL, NULL);\r
+\r
+      if (Eax.Bits.SevBit) {\r
+        ReadSevMsr = TRUE;\r
+      }\r
+    }\r
+  }\r
+\r
+  if (ReadSevMsr) {\r
+    //\r
+    // Check MSR_0xC0010131 Bit 0 (Sev Enabled)\r
+    //\r
+    Msr.Uint32 = AsmReadMsr32 (MSR_SEV_STATUS);\r
+    if (Msr.Bits.SevBit) {\r
+      mSevStatus = TRUE;\r
+    }\r
+\r
+    //\r
+    // Check MSR_0xC0010131 Bit 1 (Sev-Es Enabled)\r
+    //\r
+    if (Msr.Bits.SevEsBit) {\r
+      mSevEsStatus = TRUE;\r
+    }\r
+  }\r
+\r
+  mSevStatusChecked = TRUE;\r
+}\r
+\r
+/**\r
+  Returns a boolean to indicate whether SEV-ES is enabled.\r
+\r
+  @retval TRUE           SEV-ES is enabled\r
+  @retval FALSE          SEV-ES is not enabled\r
+**/\r
+BOOLEAN\r
+EFIAPI\r
+MemEncryptSevEsIsEnabled (\r
+  VOID\r
+  )\r
+{\r
+  if (!mSevStatusChecked) {\r
+    InternalMemEncryptSevStatus ();\r
+  }\r
+\r
+  return mSevEsStatus;\r
+}\r
+\r
+/**\r
+  Returns a boolean to indicate whether SEV is enabled.\r
+\r
+  @retval TRUE           SEV is enabled\r
+  @retval FALSE          SEV is not enabled\r
+**/\r
+BOOLEAN\r
+EFIAPI\r
+MemEncryptSevIsEnabled (\r
+  VOID\r
+  )\r
+{\r
+  if (!mSevStatusChecked) {\r
+    InternalMemEncryptSevStatus ();\r
+  }\r
+\r
+  return mSevStatus;\r
+}\r
+\r
+/**\r
+  Returns the SEV encryption mask.\r
+\r
+  @return  The SEV pagtable encryption mask\r
+**/\r
+UINT64\r
+EFIAPI\r
+MemEncryptSevGetEncryptionMask (\r
+  VOID\r
+  )\r
+{\r
+  if (!mSevEncryptionMaskSaved) {\r
+    SEC_SEV_ES_WORK_AREA  *SevEsWorkArea;\r
+\r
+    SevEsWorkArea = (SEC_SEV_ES_WORK_AREA *) FixedPcdGet32 (PcdSevEsWorkAreaBase);\r
+    if (SevEsWorkArea != NULL) {\r
+      mSevEncryptionMask = SevEsWorkArea->EncryptionMask;\r
+    } else {\r
+      CPUID_MEMORY_ENCRYPTION_INFO_EBX  Ebx;\r
+\r
+      //\r
+      // CPUID Fn8000_001F[EBX] Bit 0:5 (memory encryption bit position)\r
+      //\r
+      AsmCpuid (CPUID_MEMORY_ENCRYPTION_INFO, NULL, &Ebx.Uint32, NULL, NULL);\r
+      mSevEncryptionMask = LShiftU64 (1, Ebx.Bits.PtePosBits);\r
+    }\r
+\r
+    mSevEncryptionMaskSaved = TRUE;\r
+  }\r
+\r
+  return mSevEncryptionMask;\r
+}\r

diff --git a/OvmfPkg/OvmfPkgIa32.dsc b/OvmfPkg/OvmfPkgIa32.dsc
index 26a013ec353ef4e19f9aa43787d6017d4b245d74..75c5f46a77860441a95d8ba39daf4ae6f20ceea9 100644 (file)
--- a/OvmfPkg/OvmfPkgIa32.dsc
+++ b/OvmfPkg/OvmfPkgIa32.dsc
@@ -170,7 +170,7 @@
   QemuFwCfgSimpleParserLib|OvmfPkg/Library/QemuFwCfgSimpleParserLib/QemuFwCfgSimpleParserLib.inf\r
   VirtioLib|OvmfPkg/Library/VirtioLib/VirtioLib.inf\r
   LoadLinuxLib|OvmfPkg/Library/LoadLinuxLib/LoadLinuxLib.inf\r
-  MemEncryptSevLib|OvmfPkg/Library/BaseMemEncryptSevLib/BaseMemEncryptSevLib.inf\r
+  MemEncryptSevLib|OvmfPkg/Library/BaseMemEncryptSevLib/DxeMemEncryptSevLib.inf\r
 !if $(SMM_REQUIRE) == FALSE\r
   LockBoxLib|OvmfPkg/Library/LockBoxLib/LockBoxBaseLib.inf\r
 !endif\r
@@ -310,6 +310,8 @@
   Tpm2DeviceLib|SecurityPkg/Library/Tpm2DeviceLibDTpm/Tpm2DeviceLibDTpm.inf\r
 !endif\r
 \r
+  MemEncryptSevLib|OvmfPkg/Library/BaseMemEncryptSevLib/PeiMemEncryptSevLib.inf\r
+\r
 [LibraryClasses.common.DXE_CORE]\r
   HobLib|MdePkg/Library/DxeCoreHobLib/DxeCoreHobLib.inf\r
   DxeCoreEntryPoint|MdePkg/Library/DxeCoreEntryPoint/DxeCoreEntryPoint.inf\r

diff --git a/OvmfPkg/OvmfPkgIa32X64.dsc b/OvmfPkg/OvmfPkgIa32X64.dsc
index 10579fe46c5becd326d884a9c6cd0a6ed27964a5..8693248b4ea0d1a2a4cc91dd0d06795c3da743f2 100644 (file)
--- a/OvmfPkg/OvmfPkgIa32X64.dsc
+++ b/OvmfPkg/OvmfPkgIa32X64.dsc
@@ -174,7 +174,7 @@
   QemuFwCfgSimpleParserLib|OvmfPkg/Library/QemuFwCfgSimpleParserLib/QemuFwCfgSimpleParserLib.inf\r
   VirtioLib|OvmfPkg/Library/VirtioLib/VirtioLib.inf\r
   LoadLinuxLib|OvmfPkg/Library/LoadLinuxLib/LoadLinuxLib.inf\r
-  MemEncryptSevLib|OvmfPkg/Library/BaseMemEncryptSevLib/BaseMemEncryptSevLib.inf\r
+  MemEncryptSevLib|OvmfPkg/Library/BaseMemEncryptSevLib/DxeMemEncryptSevLib.inf\r
 !if $(SMM_REQUIRE) == FALSE\r
   LockBoxLib|OvmfPkg/Library/LockBoxLib/LockBoxBaseLib.inf\r
 !endif\r
@@ -314,6 +314,8 @@
   Tpm2DeviceLib|SecurityPkg/Library/Tpm2DeviceLibDTpm/Tpm2DeviceLibDTpm.inf\r
 !endif\r
 \r
+  MemEncryptSevLib|OvmfPkg/Library/BaseMemEncryptSevLib/PeiMemEncryptSevLib.inf\r
+\r
 [LibraryClasses.common.DXE_CORE]\r
   HobLib|MdePkg/Library/DxeCoreHobLib/DxeCoreHobLib.inf\r
   DxeCoreEntryPoint|MdePkg/Library/DxeCoreEntryPoint/DxeCoreEntryPoint.inf\r

diff --git a/OvmfPkg/OvmfPkgX64.dsc b/OvmfPkg/OvmfPkgX64.dsc
index c9235e48ad6260c147bbe9a01162ce93a39c2c4c..799468e08e92b3a4e5cf8f2119114eeb64dc8814 100644 (file)
--- a/OvmfPkg/OvmfPkgX64.dsc
+++ b/OvmfPkg/OvmfPkgX64.dsc
@@ -174,7 +174,7 @@
   QemuFwCfgSimpleParserLib|OvmfPkg/Library/QemuFwCfgSimpleParserLib/QemuFwCfgSimpleParserLib.inf\r
   VirtioLib|OvmfPkg/Library/VirtioLib/VirtioLib.inf\r
   LoadLinuxLib|OvmfPkg/Library/LoadLinuxLib/LoadLinuxLib.inf\r
-  MemEncryptSevLib|OvmfPkg/Library/BaseMemEncryptSevLib/BaseMemEncryptSevLib.inf\r
+  MemEncryptSevLib|OvmfPkg/Library/BaseMemEncryptSevLib/DxeMemEncryptSevLib.inf\r
 !if $(SMM_REQUIRE) == FALSE\r
   LockBoxLib|OvmfPkg/Library/LockBoxLib/LockBoxBaseLib.inf\r
 !endif\r
@@ -314,6 +314,8 @@
   Tpm2DeviceLib|SecurityPkg/Library/Tpm2DeviceLibDTpm/Tpm2DeviceLibDTpm.inf\r
 !endif\r
 \r
+  MemEncryptSevLib|OvmfPkg/Library/BaseMemEncryptSevLib/PeiMemEncryptSevLib.inf\r
+\r
 [LibraryClasses.common.DXE_CORE]\r
   HobLib|MdePkg/Library/DxeCoreHobLib/DxeCoreHobLib.inf\r
   DxeCoreEntryPoint|MdePkg/Library/DxeCoreEntryPoint/DxeCoreEntryPoint.inf\r

diff --git a/OvmfPkg/OvmfXen.dsc b/OvmfPkg/OvmfXen.dsc
index 12b7a87ee877d33e704266b0af4d9a3f73cd61f2..c13388ba5a0545f19e28ef2fd3adada3a16e6f4b 100644 (file)
--- a/OvmfPkg/OvmfXen.dsc
+++ b/OvmfPkg/OvmfXen.dsc
@@ -161,7 +161,7 @@
   SerializeVariablesLib|OvmfPkg/Library/SerializeVariablesLib/SerializeVariablesLib.inf\r
   QemuFwCfgLib|OvmfPkg/Library/QemuFwCfgLib/QemuFwCfgDxeLib.inf\r
   QemuLoadImageLib|OvmfPkg/Library/GenericQemuLoadImageLib/GenericQemuLoadImageLib.inf\r
-  MemEncryptSevLib|OvmfPkg/Library/BaseMemEncryptSevLib/BaseMemEncryptSevLib.inf\r
+  MemEncryptSevLib|OvmfPkg/Library/BaseMemEncryptSevLib/DxeMemEncryptSevLib.inf\r
   LockBoxLib|OvmfPkg/Library/LockBoxLib/LockBoxBaseLib.inf\r
   CustomizedDisplayLib|MdeModulePkg/Library/CustomizedDisplayLib/CustomizedDisplayLib.inf\r
   FrameBufferBltLib|MdeModulePkg/Library/FrameBufferBltLib/FrameBufferBltLib.inf\r
@@ -273,6 +273,7 @@
   QemuFwCfgS3Lib|OvmfPkg/Library/QemuFwCfgS3Lib/PeiQemuFwCfgS3LibFwCfg.inf\r
   PcdLib|MdePkg/Library/PeiPcdLib/PeiPcdLib.inf\r
   QemuFwCfgLib|OvmfPkg/Library/QemuFwCfgLib/QemuFwCfgPeiLib.inf\r
+  MemEncryptSevLib|OvmfPkg/Library/BaseMemEncryptSevLib/PeiMemEncryptSevLib.inf\r
 \r
 [LibraryClasses.common.DXE_CORE]\r
   HobLib|MdePkg/Library/DxeCoreHobLib/DxeCoreHobLib.inf\r