mirror of
https://github.com/acidanthera/audk.git
synced 2025-07-31 01:24:12 +02:00
202fb22be6
BZ: https://bugzilla.tianocore.org/show_bug.cgi?id=3275 The VMM launch sequence should have pre-validated all the data pages used in the Reset vector. The range does not cover the data pages used during the SEC phase (mainly PEI and DXE firmware volume decompression memory). When SEV-SNP is active, the memory must be pre-validated before the access. Add support to pre-validate the memory range from SnpSecPreValidatedStart to SnpSecPreValidatedEnd. This should be sufficent to enter into the PEI phase. Cc: Michael Roth <michael.roth@amd.com> Cc: James Bottomley <jejb@linux.ibm.com> Cc: Min Xu <min.m.xu@intel.com> Cc: Jiewen Yao <jiewen.yao@intel.com> Cc: Tom Lendacky <thomas.lendacky@amd.com> Cc: Jordan Justen <jordan.l.justen@intel.com> Cc: Ard Biesheuvel <ardb+tianocore@kernel.org> Cc: Erdem Aktas <erdemaktas@google.com> Cc: Gerd Hoffmann <kraxel@redhat.com> Acked-by: Jiewen Yao <Jiewen.yao@intel.com> Acked-by: Gerd Hoffmann <kraxel@redhat.com> Signed-off-by: Brijesh Singh <brijesh.singh@amd.com>
95 lines
1.9 KiB
C
95 lines
1.9 KiB
C
/** @file
|
|
File defines the Sec routines for the AMD SEV
|
|
|
|
Copyright (c) 2021, Advanced Micro Devices, Inc. All rights reserved.<BR>
|
|
|
|
SPDX-License-Identifier: BSD-2-Clause-Patent
|
|
|
|
**/
|
|
|
|
#ifndef _AMD_SEV_SEC_INTERNAL_H__
|
|
#define _AMD_SEV_SEC_INTERNAL_H__
|
|
|
|
/**
|
|
Handle an SEV-ES/GHCB protocol check failure.
|
|
|
|
Notify the hypervisor using the VMGEXIT instruction that the SEV-ES guest
|
|
wishes to be terminated.
|
|
|
|
@param[in] ReasonCode Reason code to provide to the hypervisor for the
|
|
termination request.
|
|
|
|
**/
|
|
VOID
|
|
SevEsProtocolFailure (
|
|
IN UINT8 ReasonCode
|
|
);
|
|
|
|
/**
|
|
Validate the SEV-ES/GHCB protocol level.
|
|
|
|
Verify that the level of SEV-ES/GHCB protocol supported by the hypervisor
|
|
and the guest intersect. If they don't intersect, request termination.
|
|
|
|
**/
|
|
VOID
|
|
SevEsProtocolCheck (
|
|
VOID
|
|
);
|
|
|
|
/**
|
|
Determine if the SEV is active.
|
|
|
|
During the early booting, GuestType is set in the work area. Verify that it
|
|
is an SEV guest.
|
|
|
|
@retval TRUE SEV is enabled
|
|
@retval FALSE SEV is not enabled
|
|
|
|
**/
|
|
BOOLEAN
|
|
IsSevGuest (
|
|
VOID
|
|
);
|
|
|
|
/**
|
|
Determine if SEV-ES is active.
|
|
|
|
During early booting, SEV-ES support code will set a flag to indicate that
|
|
SEV-ES is enabled. Return the value of this flag as an indicator that SEV-ES
|
|
is enabled.
|
|
|
|
@retval TRUE SEV-ES is enabled
|
|
@retval FALSE SEV-ES is not enabled
|
|
|
|
**/
|
|
BOOLEAN
|
|
SevEsIsEnabled (
|
|
VOID
|
|
);
|
|
|
|
/**
|
|
Validate System RAM used for decompressing the PEI and DXE firmware volumes
|
|
when SEV-SNP is active. The PCDs SecValidatedStart and SecValidatedEnd are
|
|
set in OvmfPkg/FvmainCompactScratchEnd.fdf.inc.
|
|
|
|
**/
|
|
VOID
|
|
SecValidateSystemRam (
|
|
VOID
|
|
);
|
|
|
|
/**
|
|
Determine if SEV-SNP is active.
|
|
|
|
@retval TRUE SEV-SNP is enabled
|
|
@retval FALSE SEV-SNP is not enabled
|
|
|
|
**/
|
|
BOOLEAN
|
|
SevSnpIsEnabled (
|
|
VOID
|
|
);
|
|
|
|
#endif
|