tyler.durden
/
audk
mirror of https://github.com/acidanthera/audk.git
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

OvmfPkg/MemEncryptSevLib: Make the MemEncryptSevLib available for SEC 

BZ: https://bugzilla.tianocore.org/show_bug.cgi?id=3108

In preparation for a new interface to be added to the MemEncryptSevLib
library that will be used in SEC, create an SEC version of the library.

This requires the creation of SEC specific files.

Some of the current MemEncryptSevLib functions perform memory allocations
which cannot be performed in SEC, so these interfaces will return an error
during SEC. Also, the current MemEncryptSevLib library uses some static
variables to optimize access to variables, which cannot be used in SEC.

Cc: Jordan Justen <jordan.l.justen@intel.com>
Cc: Laszlo Ersek <lersek@redhat.com>
Cc: Ard Biesheuvel <ard.biesheuvel@arm.com>
Cc: Brijesh Singh <brijesh.singh@amd.com>
Acked-by: Laszlo Ersek <lersek@redhat.com>
Signed-off-by: Tom Lendacky <thomas.lendacky@amd.com>
Message-Id: <bc7fa76cc23784ab3f37356b6c10dfec61942c38.1610045305.git.thomas.lendacky@amd.com>
This commit is contained in:
Tom Lendacky 2021-01-07 12:48:21 -06:00 committed by mergify[bot]
parent 60b195d257
commit a746ca5b47
7 changed files with 289 additions and 4 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

4
OvmfPkg/Library/BaseMemEncryptSevLib/DxeMemEncryptSevLib.inf
View File

@ -31,11 +31,11 @@
[Sources]
DxeMemEncryptSevLibInternal.c
MemEncryptSevLibInternal.c
PeiDxeMemEncryptSevLibInternal.c
[Sources.X64]
X64/MemEncryptSevLib.c
X64/VirtualMemory.c
X64/PeiDxeVirtualMemory.c
X64/VirtualMemory.h
[Sources.IA32]

0
OvmfPkg/Library/BaseMemEncryptSevLib/MemEncryptSevLibInternal.c → OvmfPkg/Library/BaseMemEncryptSevLib/PeiDxeMemEncryptSevLibInternal.c
View File

4
OvmfPkg/Library/BaseMemEncryptSevLib/PeiMemEncryptSevLib.inf
View File

@ -30,12 +30,12 @@
UefiCpuPkg/UefiCpuPkg.dec
[Sources]
MemEncryptSevLibInternal.c
PeiDxeMemEncryptSevLibInternal.c
PeiMemEncryptSevLibInternal.c
[Sources.X64]
X64/MemEncryptSevLib.c
X64/VirtualMemory.c
X64/PeiDxeVirtualMemory.c
X64/VirtualMemory.h
[Sources.IA32]

50
OvmfPkg/Library/BaseMemEncryptSevLib/SecMemEncryptSevLib.inf Normal file
View File

@ -0,0 +1,50 @@
## @file
# Library provides the helper functions for SEV guest
#
# Copyright (c) 2020 Advanced Micro Devices. All rights reserved.<BR>
#
# SPDX-License-Identifier: BSD-2-Clause-Patent
#
#
##
[Defines]
INF_VERSION = 1.25
BASE_NAME = SecMemEncryptSevLib
FILE_GUID = 046388b4-430e-4e61-88f6-51ea21db2632
MODULE_TYPE = BASE
VERSION_STRING = 1.0
LIBRARY_CLASS = MemEncryptSevLib|SEC
#
# The following information is for reference only and not required by the build
# tools.
#
# VALID_ARCHITECTURES = IA32 X64
#
[Packages]
MdeModulePkg/MdeModulePkg.dec
MdePkg/MdePkg.dec
OvmfPkg/OvmfPkg.dec
UefiCpuPkg/UefiCpuPkg.dec
[Sources]
SecMemEncryptSevLibInternal.c
[Sources.X64]
X64/MemEncryptSevLib.c
X64/SecVirtualMemory.c
X64/VirtualMemory.h
[Sources.IA32]
Ia32/MemEncryptSevLib.c
[LibraryClasses]
BaseLib
CpuLib
DebugLib
PcdLib
[FixedPcd]
gUefiCpuPkgTokenSpaceGuid.PcdSevEsWorkAreaBase

155
OvmfPkg/Library/BaseMemEncryptSevLib/SecMemEncryptSevLibInternal.c Normal file
View File

@ -0,0 +1,155 @@
/** @file
Secure Encrypted Virtualization (SEV) library helper function
Copyright (c) 2020, Advanced Micro Devices, Inc. All rights reserved.<BR>
SPDX-License-Identifier: BSD-2-Clause-Patent
**/
#include <Library/BaseLib.h>
#include <Library/DebugLib.h>
#include <Library/MemEncryptSevLib.h>
#include <Library/PcdLib.h>
#include <Register/Amd/Cpuid.h>
#include <Register/Amd/Msr.h>
#include <Register/Cpuid.h>
#include <Uefi/UefiBaseType.h>
/**
Reads and sets the status of SEV features.
**/
STATIC
UINT32
EFIAPI
InternalMemEncryptSevStatus (
VOID
)
{
UINT32 RegEax;
CPUID_MEMORY_ENCRYPTION_INFO_EAX Eax;
BOOLEAN ReadSevMsr;
SEC_SEV_ES_WORK_AREA *SevEsWorkArea;
ReadSevMsr = FALSE;
SevEsWorkArea = (SEC_SEV_ES_WORK_AREA *) FixedPcdGet32 (PcdSevEsWorkAreaBase);
if (SevEsWorkArea != NULL && SevEsWorkArea->EncryptionMask != 0) {
//
// The MSR has been read before, so it is safe to read it again and avoid
// having to validate the CPUID information.
//
ReadSevMsr = TRUE;
} else {
//
// Check if memory encryption leaf exist
//
AsmCpuid (CPUID_EXTENDED_FUNCTION, &RegEax, NULL, NULL, NULL);
if (RegEax >= CPUID_MEMORY_ENCRYPTION_INFO) {
//
// CPUID Fn8000_001F[EAX] Bit 1 (Sev supported)
//
AsmCpuid (CPUID_MEMORY_ENCRYPTION_INFO, &Eax.Uint32, NULL, NULL, NULL);
if (Eax.Bits.SevBit) {
ReadSevMsr = TRUE;
}
}
}
return ReadSevMsr ? AsmReadMsr32 (MSR_SEV_STATUS) : 0;
}
/**
Returns a boolean to indicate whether SEV-ES is enabled.
@retval TRUE SEV-ES is enabled
@retval FALSE SEV-ES is not enabled
**/
BOOLEAN
EFIAPI
MemEncryptSevEsIsEnabled (
VOID
)
{
MSR_SEV_STATUS_REGISTER Msr;
Msr.Uint32 = InternalMemEncryptSevStatus ();
return Msr.Bits.SevEsBit ? TRUE : FALSE;
}
/**
Returns a boolean to indicate whether SEV is enabled.
@retval TRUE SEV is enabled
@retval FALSE SEV is not enabled
**/
BOOLEAN
EFIAPI
MemEncryptSevIsEnabled (
VOID
)
{
MSR_SEV_STATUS_REGISTER Msr;
Msr.Uint32 = InternalMemEncryptSevStatus ();
return Msr.Bits.SevBit ? TRUE : FALSE;
}
/**
Returns the SEV encryption mask.
@return The SEV pagtable encryption mask
**/
UINT64
EFIAPI
MemEncryptSevGetEncryptionMask (
VOID
)
{
CPUID_MEMORY_ENCRYPTION_INFO_EBX Ebx;
SEC_SEV_ES_WORK_AREA *SevEsWorkArea;
UINT64 EncryptionMask;
SevEsWorkArea = (SEC_SEV_ES_WORK_AREA *) FixedPcdGet32 (PcdSevEsWorkAreaBase);
if (SevEsWorkArea != NULL) {
EncryptionMask = SevEsWorkArea->EncryptionMask;
} else {
//
// CPUID Fn8000_001F[EBX] Bit 0:5 (memory encryption bit position)
//
AsmCpuid (CPUID_MEMORY_ENCRYPTION_INFO, NULL, &Ebx.Uint32, NULL, NULL);
EncryptionMask = LShiftU64 (1, Ebx.Bits.PtePosBits);
}
return EncryptionMask;
}
/**
Locate the page range that covers the initial (pre-SMBASE-relocation) SMRAM
Save State Map.
@param[out] BaseAddress The base address of the lowest-address page that
covers the initial SMRAM Save State Map.
@param[out] NumberOfPages The number of pages in the page range that covers
the initial SMRAM Save State Map.
@retval RETURN_SUCCESS BaseAddress and NumberOfPages have been set on
output.
@retval RETURN_UNSUPPORTED SMM is unavailable.
**/
RETURN_STATUS
EFIAPI
MemEncryptSevLocateInitialSmramSaveStateMapPages (
OUT UINTN *BaseAddress,
OUT UINTN *NumberOfPages
)
{
return RETURN_UNSUPPORTED;
}

0
OvmfPkg/Library/BaseMemEncryptSevLib/X64/VirtualMemory.c → OvmfPkg/Library/BaseMemEncryptSevLib/X64/PeiDxeVirtualMemory.c
View File

80
OvmfPkg/Library/BaseMemEncryptSevLib/X64/SecVirtualMemory.c Normal file
View File

@ -0,0 +1,80 @@
/** @file
Virtual Memory Management Services to set or clear the memory encryption bit
Copyright (c) 2020, AMD Incorporated. All rights reserved.<BR>
SPDX-License-Identifier: BSD-2-Clause-Patent
**/
#include <Library/CpuLib.h>
#include <Library/MemEncryptSevLib.h>
#include "VirtualMemory.h"
/**
This function clears memory encryption bit for the memory region specified by
PhysicalAddress and Length from the current page table context.
@param[in] Cr3BaseAddress Cr3 Base Address (if zero then use
current CR3)
@param[in] PhysicalAddress The physical address that is the start
address of a memory region.
@param[in] Length The length of memory region
@param[in] Flush Flush the caches before applying the
encryption mask
@retval RETURN_SUCCESS The attributes were cleared for the
memory region.
@retval RETURN_INVALID_PARAMETER Number of pages is zero.
@retval RETURN_UNSUPPORTED Clearing the memory encyrption attribute
is not supported
**/
RETURN_STATUS
EFIAPI
InternalMemEncryptSevSetMemoryDecrypted (
IN PHYSICAL_ADDRESS Cr3BaseAddress,
IN PHYSICAL_ADDRESS PhysicalAddress,
IN UINTN Length,
IN BOOLEAN Flush
)
{
//
// This function is not available during SEC.
//
return RETURN_UNSUPPORTED;
}
/**
This function sets memory encryption bit for the memory region specified by
PhysicalAddress and Length from the current page table context.
@param[in] Cr3BaseAddress Cr3 Base Address (if zero then use
current CR3)
@param[in] PhysicalAddress The physical address that is the start
address of a memory region.
@param[in] Length The length of memory region
@param[in] Flush Flush the caches before applying the
encryption mask
@retval RETURN_SUCCESS The attributes were set for the memory
region.
@retval RETURN_INVALID_PARAMETER Number of pages is zero.
@retval RETURN_UNSUPPORTED Setting the memory encyrption attribute
is not supported
**/
RETURN_STATUS
EFIAPI
InternalMemEncryptSevSetMemoryEncrypted (
IN PHYSICAL_ADDRESS Cr3BaseAddress,
IN PHYSICAL_ADDRESS PhysicalAddress,
IN UINTN Length,
IN BOOLEAN Flush
)
{
//
// This function is not available during SEC.
//
return RETURN_UNSUPPORTED;
}