OvmfPkg/BaseMemEncryptLib: use the SEV_STATUS MSR value from workarea

BZ: https://bugzilla.tianocore.org/show_bug.cgi?id=3582

Improve the MemEncryptSev{Es,Snp}IsEnabled() to use the SEV_STATUS MSR
value saved in the workarea. Since workarea is valid until the PEI phase,
so, for the Dxe phase use the PcdConfidentialComputingGuestAttr to
determine which SEV technology is enabled.

Cc: Min Xu <min.m.xu@intel.com>
Cc: Jiewen Yao <jiewen.yao@intel.com>
Cc: Tom Lendacky <thomas.lendacky@amd.com>
Cc: Jordan Justen <jordan.l.justen@intel.com>
Cc: Ard Biesheuvel <ardb+tianocore@kernel.org>
Cc: Erdem Aktas <erdemaktas@google.com>
Cc: Gerd Hoffmann <kraxel@redhat.com>
Acked-by: Gerd Hoffmann <kraxel@redhat.com>
Signed-off-by: Brijesh Singh <brijesh.singh@amd.com>
Acked-by: Jiewen Yao <jiewen.yao@intel.com>

diff --git a/OvmfPkg/Library/BaseMemEncryptSevLib/DxeMemEncryptSevLib.inf b/OvmfPkg/Library/BaseMemEncryptSevLib/DxeMemEncryptSevLib.inf
index f613bb314f5ff350cb989d3e85e646d52d661568..35b7d519d9389243655d93343a8dc5a7462d5ff6 100644 (file)
--- a/OvmfPkg/Library/BaseMemEncryptSevLib/DxeMemEncryptSevLib.inf
+++ b/OvmfPkg/Library/BaseMemEncryptSevLib/DxeMemEncryptSevLib.inf
@@ -58,3 +58,4 @@
 \r
 [Pcd]\r
   gEfiMdeModulePkgTokenSpaceGuid.PcdPteMemoryEncryptionAddressOrMask\r
+  gEfiMdePkgTokenSpaceGuid.PcdConfidentialComputingGuestAttr\r

diff --git a/OvmfPkg/Library/BaseMemEncryptSevLib/DxeMemEncryptSevLibInternal.c b/OvmfPkg/Library/BaseMemEncryptSevLib/DxeMemEncryptSevLibInternal.c
index 15fcd5529587ca9f6a31afac2bde3c1d04541fef..4aba0075b9e2bb40c09c123dd3d6abaa434bc93f 100644 (file)
--- a/OvmfPkg/Library/BaseMemEncryptSevLib/DxeMemEncryptSevLibInternal.c
+++ b/OvmfPkg/Library/BaseMemEncryptSevLib/DxeMemEncryptSevLibInternal.c
@@ -16,83 +16,84 @@
 #include <Register/Amd/Msr.h>\r
 #include <Register/Cpuid.h>\r
 #include <Uefi/UefiBaseType.h>\r
+#include <ConfidentialComputingGuestAttr.h>\r
 \r
-STATIC BOOLEAN  mSevStatus        = FALSE;\r
-STATIC BOOLEAN  mSevEsStatus      = FALSE;\r
-STATIC BOOLEAN  mSevSnpStatus     = FALSE;\r
-STATIC BOOLEAN  mSevStatusChecked = FALSE;\r
-\r
+STATIC UINT64   mCurrentAttr            = 0;\r
+STATIC BOOLEAN  mCurrentAttrRead        = FALSE;\r
 STATIC UINT64   mSevEncryptionMask      = 0;\r
 STATIC BOOLEAN  mSevEncryptionMaskSaved = FALSE;\r
 \r
 /**\r
-  Reads and sets the status of SEV features.\r
+  The function check if the specified Attr is set.\r
+\r
+  @param[in]  CurrentAttr   The current attribute.\r
+  @param[in]  Attr          The attribute to check.\r
 \r
-  **/\r
+  @retval  TRUE      The specified Attr is set.\r
+  @retval  FALSE     The specified Attr is not set.\r
+\r
+**/\r
 STATIC\r
-VOID\r
-EFIAPI\r
-InternalMemEncryptSevStatus (\r
-  VOID\r
+BOOLEAN\r
+AmdMemEncryptionAttrCheck (\r
+  IN  UINT64                             CurrentAttr,\r
+  IN  CONFIDENTIAL_COMPUTING_GUEST_ATTR  Attr\r
   )\r
 {\r
-  UINT32                            RegEax;\r
-  MSR_SEV_STATUS_REGISTER           Msr;\r
-  CPUID_MEMORY_ENCRYPTION_INFO_EAX  Eax;\r
-  BOOLEAN                           ReadSevMsr;\r
-  UINT64                            EncryptionMask;\r
-\r
-  ReadSevMsr = FALSE;\r
-\r
-  EncryptionMask = PcdGet64 (PcdPteMemoryEncryptionAddressOrMask);\r
-  if (EncryptionMask != 0) {\r
-    //\r
-    // The MSR has been read before, so it is safe to read it again and avoid\r
-    // having to validate the CPUID information.\r
-    //\r
-    ReadSevMsr = TRUE;\r
-  } else {\r
-    //\r
-    // Check if memory encryption leaf exist\r
-    //\r
-    AsmCpuid (CPUID_EXTENDED_FUNCTION, &RegEax, NULL, NULL, NULL);\r
-    if (RegEax >= CPUID_MEMORY_ENCRYPTION_INFO) {\r
+  switch (Attr) {\r
+    case CCAttrAmdSev:\r
       //\r
-      // CPUID Fn8000_001F[EAX] Bit 1 (Sev supported)\r
+      // SEV is automatically enabled if SEV-ES or SEV-SNP is active.\r
       //\r
-      AsmCpuid (CPUID_MEMORY_ENCRYPTION_INFO, &Eax.Uint32, NULL, NULL, NULL);\r
+      return CurrentAttr >= CCAttrAmdSev;\r
+    case CCAttrAmdSevEs:\r
+      //\r
+      // SEV-ES is automatically enabled if SEV-SNP is active.\r
+      //\r
+      return CurrentAttr >= CCAttrAmdSevEs;\r
+    case CCAttrAmdSevSnp:\r
+      return CurrentAttr == CCAttrAmdSevSnp;\r
+    default:\r
+      return FALSE;\r
+  }\r
+}\r
+\r
+/**\r
+  Check if the specified confidential computing attribute is active.\r
+\r
+  @param[in]  Attr          The attribute to check.\r
 \r
-      if (Eax.Bits.SevBit) {\r
-        ReadSevMsr = TRUE;\r
-      }\r
-    }\r
+  @retval TRUE   The specified Attr is active.\r
+  @retval FALSE  The specified Attr is not active.\r
+\r
+**/\r
+STATIC\r
+BOOLEAN\r
+EFIAPI\r
+ConfidentialComputingGuestHas (\r
+  IN  CONFIDENTIAL_COMPUTING_GUEST_ATTR  Attr\r
+  )\r
+{\r
+  //\r
+  // Get the current CC attribute.\r
+  //\r
+  // We avoid reading the PCD on every check because this routine could be indirectly\r
+  // called during the virtual pointer conversion. And its not safe to access the\r
+  // PCDs during the virtual pointer conversion.\r
+  //\r
+  if (!mCurrentAttrRead) {\r
+    mCurrentAttr     = PcdGet64 (PcdConfidentialComputingGuestAttr);\r
+    mCurrentAttrRead = TRUE;\r
   }\r
 \r
-  if (ReadSevMsr) {\r
-    //\r
-    // Check MSR_0xC0010131 Bit 0 (Sev Enabled)\r
-    //\r
-    Msr.Uint32 = AsmReadMsr32 (MSR_SEV_STATUS);\r
-    if (Msr.Bits.SevBit) {\r
-      mSevStatus = TRUE;\r
-    }\r
-\r
-    //\r
-    // Check MSR_0xC0010131 Bit 1 (Sev-Es Enabled)\r
-    //\r
-    if (Msr.Bits.SevEsBit) {\r
-      mSevEsStatus = TRUE;\r
-    }\r
-\r
-    //\r
-    // Check MSR_0xC0010131 Bit 2 (Sev-Snp Enabled)\r
-    //\r
-    if (Msr.Bits.SevSnpBit) {\r
-      mSevSnpStatus = TRUE;\r
-    }\r
+  //\r
+  // If attr is for the AMD group then call AMD specific checks.\r
+  //\r
+  if (((RShiftU64 (mCurrentAttr, 8)) & 0xff) == 1) {\r
+    return AmdMemEncryptionAttrCheck (mCurrentAttr, Attr);\r
   }\r
 \r
-  mSevStatusChecked = TRUE;\r
+  return (mCurrentAttr == Attr);\r
 }\r
 \r
 /**\r
@@ -107,11 +108,7 @@ MemEncryptSevSnpIsEnabled (
   VOID\r
   )\r
 {\r
-  if (!mSevStatusChecked) {\r
-    InternalMemEncryptSevStatus ();\r
-  }\r
-\r
-  return mSevSnpStatus;\r
+  return ConfidentialComputingGuestHas (CCAttrAmdSevSnp);\r
 }\r
 \r
 /**\r
@@ -126,11 +123,7 @@ MemEncryptSevEsIsEnabled (
   VOID\r
   )\r
 {\r
-  if (!mSevStatusChecked) {\r
-    InternalMemEncryptSevStatus ();\r
-  }\r
-\r
-  return mSevEsStatus;\r
+  return ConfidentialComputingGuestHas (CCAttrAmdSevEs);\r
 }\r
 \r
 /**\r
@@ -145,11 +138,7 @@ MemEncryptSevIsEnabled (
   VOID\r
   )\r
 {\r
-  if (!mSevStatusChecked) {\r
-    InternalMemEncryptSevStatus ();\r
-  }\r
-\r
-  return mSevStatus;\r
+  return ConfidentialComputingGuestHas (CCAttrAmdSev);\r
 }\r
 \r
 /**\r

diff --git a/OvmfPkg/Library/BaseMemEncryptSevLib/PeiMemEncryptSevLib.inf b/OvmfPkg/Library/BaseMemEncryptSevLib/PeiMemEncryptSevLib.inf
index 50c83859d7e71ceebcba9666f32f6804f8b42eed..714da33237655fee06816688625c4534b5d612bc 100644 (file)
--- a/OvmfPkg/Library/BaseMemEncryptSevLib/PeiMemEncryptSevLib.inf
+++ b/OvmfPkg/Library/BaseMemEncryptSevLib/PeiMemEncryptSevLib.inf
@@ -58,6 +58,7 @@
 \r
 [FixedPcd]\r
   gUefiCpuPkgTokenSpaceGuid.PcdSevEsWorkAreaBase\r
+  gUefiOvmfPkgTokenSpaceGuid.PcdOvmfWorkAreaBase\r
   gUefiOvmfPkgTokenSpaceGuid.PcdOvmfPeiMemFvBase\r
   gUefiOvmfPkgTokenSpaceGuid.PcdOvmfSecPageTablesBase\r
   gUefiOvmfPkgTokenSpaceGuid.PcdOvmfSecValidatedEnd\r

diff --git a/OvmfPkg/Library/BaseMemEncryptSevLib/PeiMemEncryptSevLibInternal.c b/OvmfPkg/Library/BaseMemEncryptSevLib/PeiMemEncryptSevLibInternal.c
index d68ff08c3ea673a42bb425673d122c9993499f33..3f8f91a5da121a2de2e95b8546b568a9e2a352a1 100644 (file)
--- a/OvmfPkg/Library/BaseMemEncryptSevLib/PeiMemEncryptSevLibInternal.c
+++ b/OvmfPkg/Library/BaseMemEncryptSevLib/PeiMemEncryptSevLibInternal.c
@@ -17,82 +17,51 @@
 #include <Register/Cpuid.h>\r
 #include <Uefi/UefiBaseType.h>\r
 \r
-STATIC BOOLEAN  mSevStatus        = FALSE;\r
-STATIC BOOLEAN  mSevEsStatus      = FALSE;\r
-STATIC BOOLEAN  mSevSnpStatus     = FALSE;\r
-STATIC BOOLEAN  mSevStatusChecked = FALSE;\r
+/**\r
+   Read the workarea to determine whether SEV is enabled. If enabled,\r
+   then return the SevEsWorkArea pointer.\r
+\r
+  **/\r
+STATIC\r
+SEC_SEV_ES_WORK_AREA *\r
+EFIAPI\r
+GetSevEsWorkArea (\r
+  VOID\r
+  )\r
+{\r
+  OVMF_WORK_AREA  *WorkArea;\r
+\r
+  WorkArea = (OVMF_WORK_AREA *)FixedPcdGet32 (PcdOvmfWorkAreaBase);\r
+\r
+  //\r
+  // If its not SEV guest then SevEsWorkArea is not valid.\r
+  //\r
+  if ((WorkArea == NULL) || (WorkArea->Header.GuestType != GUEST_TYPE_AMD_SEV)) {\r
+    return NULL;\r
+  }\r
 \r
-STATIC UINT64   mSevEncryptionMask      = 0;\r
-STATIC BOOLEAN  mSevEncryptionMaskSaved = FALSE;\r
+  return (SEC_SEV_ES_WORK_AREA *)FixedPcdGet32 (PcdSevEsWorkAreaBase);\r
+}\r
 \r
 /**\r
-  Reads and sets the status of SEV features.\r
+  Read the SEV Status MSR value from the workarea\r
 \r
   **/\r
 STATIC\r
-VOID\r
+UINT32\r
 EFIAPI\r
 InternalMemEncryptSevStatus (\r
   VOID\r
   )\r
 {\r
-  UINT32                            RegEax;\r
-  MSR_SEV_STATUS_REGISTER           Msr;\r
-  CPUID_MEMORY_ENCRYPTION_INFO_EAX  Eax;\r
-  BOOLEAN                           ReadSevMsr;\r
-  SEC_SEV_ES_WORK_AREA              *SevEsWorkArea;\r
-\r
-  ReadSevMsr = FALSE;\r
-\r
-  SevEsWorkArea = (SEC_SEV_ES_WORK_AREA *)FixedPcdGet32 (PcdSevEsWorkAreaBase);\r
-  if ((SevEsWorkArea != NULL) && (SevEsWorkArea->EncryptionMask != 0)) {\r
-    //\r
-    // The MSR has been read before, so it is safe to read it again and avoid\r
-    // having to validate the CPUID information.\r
-    //\r
-    ReadSevMsr = TRUE;\r
-  } else {\r
-    //\r
-    // Check if memory encryption leaf exist\r
-    //\r
-    AsmCpuid (CPUID_EXTENDED_FUNCTION, &RegEax, NULL, NULL, NULL);\r
-    if (RegEax >= CPUID_MEMORY_ENCRYPTION_INFO) {\r
-      //\r
-      // CPUID Fn8000_001F[EAX] Bit 1 (Sev supported)\r
-      //\r
-      AsmCpuid (CPUID_MEMORY_ENCRYPTION_INFO, &Eax.Uint32, NULL, NULL, NULL);\r
-\r
-      if (Eax.Bits.SevBit) {\r
-        ReadSevMsr = TRUE;\r
-      }\r
-    }\r
-  }\r
+  SEC_SEV_ES_WORK_AREA  *SevEsWorkArea;\r
 \r
-  if (ReadSevMsr) {\r
-    //\r
-    // Check MSR_0xC0010131 Bit 0 (Sev Enabled)\r
-    //\r
-    Msr.Uint32 = AsmReadMsr32 (MSR_SEV_STATUS);\r
-    if (Msr.Bits.SevBit) {\r
-      mSevStatus = TRUE;\r
-    }\r
-\r
-    //\r
-    // Check MSR_0xC0010131 Bit 1 (Sev-Es Enabled)\r
-    //\r
-    if (Msr.Bits.SevEsBit) {\r
-      mSevEsStatus = TRUE;\r
-    }\r
-\r
-    //\r
-    // Check MSR_0xC0010131 Bit 2 (Sev-Snp Enabled)\r
-    //\r
-    if (Msr.Bits.SevSnpBit) {\r
-      mSevSnpStatus = TRUE;\r
-    }\r
+  SevEsWorkArea = GetSevEsWorkArea ();\r
+  if (SevEsWorkArea == NULL) {\r
+    return 0;\r
   }\r
 \r
-  mSevStatusChecked = TRUE;\r
+  return (UINT32)(UINTN)SevEsWorkArea->SevStatusMsrValue;\r
 }\r
 \r
 /**\r
@@ -107,11 +76,11 @@ MemEncryptSevSnpIsEnabled (
   VOID\r
   )\r
 {\r
-  if (!mSevStatusChecked) {\r
-    InternalMemEncryptSevStatus ();\r
-  }\r
+  MSR_SEV_STATUS_REGISTER  Msr;\r
+\r
+  Msr.Uint32 = InternalMemEncryptSevStatus ();\r
 \r
-  return mSevSnpStatus;\r
+  return Msr.Bits.SevSnpBit ? TRUE : FALSE;\r
 }\r
 \r
 /**\r
@@ -126,11 +95,11 @@ MemEncryptSevEsIsEnabled (
   VOID\r
   )\r
 {\r
-  if (!mSevStatusChecked) {\r
-    InternalMemEncryptSevStatus ();\r
-  }\r
+  MSR_SEV_STATUS_REGISTER  Msr;\r
+\r
+  Msr.Uint32 = InternalMemEncryptSevStatus ();\r
 \r
-  return mSevEsStatus;\r
+  return Msr.Bits.SevEsBit ? TRUE : FALSE;\r
 }\r
 \r
 /**\r
@@ -145,11 +114,11 @@ MemEncryptSevIsEnabled (
   VOID\r
   )\r
 {\r
-  if (!mSevStatusChecked) {\r
-    InternalMemEncryptSevStatus ();\r
-  }\r
+  MSR_SEV_STATUS_REGISTER  Msr;\r
 \r
-  return mSevStatus;\r
+  Msr.Uint32 = InternalMemEncryptSevStatus ();\r
+\r
+  return Msr.Bits.SevBit ? TRUE : FALSE;\r
 }\r
 \r
 /**\r
@@ -163,24 +132,12 @@ MemEncryptSevGetEncryptionMask (
   VOID\r
   )\r
 {\r
-  if (!mSevEncryptionMaskSaved) {\r
-    SEC_SEV_ES_WORK_AREA  *SevEsWorkArea;\r
-\r
-    SevEsWorkArea = (SEC_SEV_ES_WORK_AREA *)FixedPcdGet32 (PcdSevEsWorkAreaBase);\r
-    if (SevEsWorkArea != NULL) {\r
-      mSevEncryptionMask = SevEsWorkArea->EncryptionMask;\r
-    } else {\r
-      CPUID_MEMORY_ENCRYPTION_INFO_EBX  Ebx;\r
-\r
-      //\r
-      // CPUID Fn8000_001F[EBX] Bit 0:5 (memory encryption bit position)\r
-      //\r
-      AsmCpuid (CPUID_MEMORY_ENCRYPTION_INFO, NULL, &Ebx.Uint32, NULL, NULL);\r
-      mSevEncryptionMask = LShiftU64 (1, Ebx.Bits.PtePosBits);\r
-    }\r
-\r
-    mSevEncryptionMaskSaved = TRUE;\r
+  SEC_SEV_ES_WORK_AREA  *SevEsWorkArea;\r
+\r
+  SevEsWorkArea = GetSevEsWorkArea ();\r
+  if (SevEsWorkArea == NULL) {\r
+    return 0;\r
   }\r
 \r
-  return mSevEncryptionMask;\r
+  return SevEsWorkArea->EncryptionMask;\r
 }\r

diff --git a/OvmfPkg/Library/BaseMemEncryptSevLib/SecMemEncryptSevLib.inf b/OvmfPkg/Library/BaseMemEncryptSevLib/SecMemEncryptSevLib.inf
index 939af0a91ea4c41907a0d8c92b5d7c34be536e9d..284e5acc11779a1b85b88ac6c942e6f747484216 100644 (file)
--- a/OvmfPkg/Library/BaseMemEncryptSevLib/SecMemEncryptSevLib.inf
+++ b/OvmfPkg/Library/BaseMemEncryptSevLib/SecMemEncryptSevLib.inf
@@ -52,3 +52,4 @@
 \r
 [FixedPcd]\r
   gUefiCpuPkgTokenSpaceGuid.PcdSevEsWorkAreaBase\r
+  gUefiOvmfPkgTokenSpaceGuid.PcdOvmfWorkAreaBase\r

diff --git a/OvmfPkg/Library/BaseMemEncryptSevLib/SecMemEncryptSevLibInternal.c b/OvmfPkg/Library/BaseMemEncryptSevLib/SecMemEncryptSevLibInternal.c
index 5d912b2a4a5e4a043f8e8aa758bd55237a8540af..80aceba01bcf28a7f8b013b5f8b2fce7fd713627 100644 (file)
--- a/OvmfPkg/Library/BaseMemEncryptSevLib/SecMemEncryptSevLibInternal.c
+++ b/OvmfPkg/Library/BaseMemEncryptSevLib/SecMemEncryptSevLibInternal.c
@@ -18,7 +18,33 @@
 #include <Uefi/UefiBaseType.h>\r
 \r
 /**\r
-  Reads and sets the status of SEV features.\r
+   Read the workarea to determine whether SEV is enabled. If enabled,\r
+   then return the SevEsWorkArea pointer.\r
+\r
+  **/\r
+STATIC\r
+SEC_SEV_ES_WORK_AREA *\r
+EFIAPI\r
+GetSevEsWorkArea (\r
+  VOID\r
+  )\r
+{\r
+  OVMF_WORK_AREA  *WorkArea;\r
+\r
+  WorkArea = (OVMF_WORK_AREA *)FixedPcdGet32 (PcdOvmfWorkAreaBase);\r
+\r
+  //\r
+  // If its not SEV guest then SevEsWorkArea is not valid.\r
+  //\r
+  if ((WorkArea == NULL) || (WorkArea->Header.GuestType != GUEST_TYPE_AMD_SEV)) {\r
+    return NULL;\r
+  }\r
+\r
+  return (SEC_SEV_ES_WORK_AREA *)FixedPcdGet32 (PcdSevEsWorkAreaBase);\r
+}\r
+\r
+/**\r
+  Read the SEV Status MSR value from the workarea\r
 \r
   **/\r
 STATIC\r
@@ -28,38 +54,14 @@ InternalMemEncryptSevStatus (
   VOID\r
   )\r
 {\r
-  UINT32                            RegEax;\r
-  CPUID_MEMORY_ENCRYPTION_INFO_EAX  Eax;\r
-  BOOLEAN                           ReadSevMsr;\r
-  SEC_SEV_ES_WORK_AREA              *SevEsWorkArea;\r
-\r
-  ReadSevMsr = FALSE;\r
-\r
-  SevEsWorkArea = (SEC_SEV_ES_WORK_AREA *)FixedPcdGet32 (PcdSevEsWorkAreaBase);\r
-  if ((SevEsWorkArea != NULL) && (SevEsWorkArea->EncryptionMask != 0)) {\r
-    //\r
-    // The MSR has been read before, so it is safe to read it again and avoid\r
-    // having to validate the CPUID information.\r
-    //\r
-    ReadSevMsr = TRUE;\r
-  } else {\r
-    //\r
-    // Check if memory encryption leaf exist\r
-    //\r
-    AsmCpuid (CPUID_EXTENDED_FUNCTION, &RegEax, NULL, NULL, NULL);\r
-    if (RegEax >= CPUID_MEMORY_ENCRYPTION_INFO) {\r
-      //\r
-      // CPUID Fn8000_001F[EAX] Bit 1 (Sev supported)\r
-      //\r
-      AsmCpuid (CPUID_MEMORY_ENCRYPTION_INFO, &Eax.Uint32, NULL, NULL, NULL);\r
-\r
-      if (Eax.Bits.SevBit) {\r
-        ReadSevMsr = TRUE;\r
-      }\r
-    }\r
+  SEC_SEV_ES_WORK_AREA  *SevEsWorkArea;\r
+\r
+  SevEsWorkArea = GetSevEsWorkArea ();\r
+  if (SevEsWorkArea == NULL) {\r
+    return 0;\r
   }\r
 \r
-  return ReadSevMsr ? AsmReadMsr32 (MSR_SEV_STATUS) : 0;\r
+  return (UINT32)(UINTN)SevEsWorkArea->SevStatusMsrValue;\r
 }\r
 \r
 /**\r
@@ -130,22 +132,14 @@ MemEncryptSevGetEncryptionMask (
   VOID\r
   )\r
 {\r
-  CPUID_MEMORY_ENCRYPTION_INFO_EBX  Ebx;\r
-  SEC_SEV_ES_WORK_AREA              *SevEsWorkArea;\r
-  UINT64                            EncryptionMask;\r
-\r
-  SevEsWorkArea = (SEC_SEV_ES_WORK_AREA *)FixedPcdGet32 (PcdSevEsWorkAreaBase);\r
-  if (SevEsWorkArea != NULL) {\r
-    EncryptionMask = SevEsWorkArea->EncryptionMask;\r
-  } else {\r
-    //\r
-    // CPUID Fn8000_001F[EBX] Bit 0:5 (memory encryption bit position)\r
-    //\r
-    AsmCpuid (CPUID_MEMORY_ENCRYPTION_INFO, NULL, &Ebx.Uint32, NULL, NULL);\r
-    EncryptionMask = LShiftU64 (1, Ebx.Bits.PtePosBits);\r
+  SEC_SEV_ES_WORK_AREA  *SevEsWorkArea;\r
+\r
+  SevEsWorkArea = GetSevEsWorkArea ();\r
+  if (SevEsWorkArea == NULL) {\r
+    return 0;\r
   }\r
 \r
-  return EncryptionMask;\r
+  return SevEsWorkArea->EncryptionMask;\r
 }\r
 \r
 /**\r