From nobody Fri May 3 16:21:10 2024 Delivered-To: importer@patchew.org Authentication-Results: mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of groups.io designates 66.175.222.108 as permitted sender) smtp.mailfrom=bounce+27952+85833+1787277+3901457@groups.io; arc=fail (BodyHash is different from the expected one) Received: from mail02.groups.io (mail02.groups.io [66.175.222.108]) by mx.zohomail.com with SMTPS id 1642633436990245.56414528986227; Wed, 19 Jan 2022 15:03:56 -0800 (PST) Return-Path: X-Received: by 127.0.0.2 with SMTP id p2J1YY1788612xM6Cj9D6lKk; Wed, 19 Jan 2022 15:03:56 -0800 X-Received: from NAM10-DM6-obe.outbound.protection.outlook.com (NAM10-DM6-obe.outbound.protection.outlook.com [40.107.93.58]) by mx.groups.io with SMTP id smtpd.web08.4215.1642633434926991925 for ; Wed, 19 Jan 2022 15:03:55 -0800 ARC-Seal: i=1; a=rsa-sha256; s=arcselector9901; d=microsoft.com; cv=none; b=PdpWrTq5o2yP2u4rwmNFwy6iYOUAH5x/xYaNwGymHKPId8SvCDIIKjAT/WYZSdmCxvVzsQLOKViZunNy67njunkuqH6O5SjZa9fiSX6RNif0L6cFodwHYstrBOjajocFhO6lInTVp94VqI/MjFpsvj4VToxn/a2ggEvy0+BtO1XztPib4K+efAqID+41vmjOsH/nbSaooTYYP7HyKqQTCOvSYHsmWwtjEsRoyK+iFZve8p4sL8vjPtOqvKtawUzSlF3D2mTReIoXxiGlKjH0wBJVdslZwuprH5cNc7B+vYE1XC18DU6Gkco3URoPc1edwNDJdnxeDrgK7G40cujJfw== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=arcselector9901; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-AntiSpam-MessageData-ChunkCount:X-MS-Exchange-AntiSpam-MessageData-0:X-MS-Exchange-AntiSpam-MessageData-1; bh=iwVY5U0KS+QSxQQxbrqQruOg2/MGiLb/vOPwHbLDTCA=; b=DqY+FOIdGRWncWVtsxzq6iPe6tJAd3xh5BsP9vz5xJNpAp/2oaJDVmyB/7bQwPWRgFnm7j2RJ0VRKQ8MSMyo2WK5Z37Folz23BiElWjXBVr+wuIO9WCKQ0xnqN44qS5bQhp7hWYlwwmBWKApr1+fU8cZWWbs1MKG7/IjvHYebvUioygbuFDC4qUrQQqaywUTSEoz3zukuTiwgNnlNFrfGyjc00jDHjGnsP2SJUZNmKNgBXzOZ0ZKlr1gUYTlEmTaNu/6+wzuB/78jPwxfU2XoIG8Z1RIZl2HFabyBLmff8a77F7RTXCLLnK97q0N+PV7a3mj6876FcZFfhvbdNvTpQ== ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=pass (sender ip is 165.204.84.17) smtp.rcpttodomain=edk2.groups.io smtp.mailfrom=amd.com; dmarc=pass (p=quarantine sp=quarantine pct=100) action=none header.from=amd.com; dkim=none (message not signed); arc=none X-Received: from DS7PR05CA0059.namprd05.prod.outlook.com (2603:10b6:8:2f::32) by MN2PR12MB2927.namprd12.prod.outlook.com (2603:10b6:208:103::26) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.4909.8; Wed, 19 Jan 2022 23:03:53 +0000 X-Received: from DM6NAM11FT013.eop-nam11.prod.protection.outlook.com (2603:10b6:8:2f:cafe::34) by DS7PR05CA0059.outlook.office365.com (2603:10b6:8:2f::32) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.4930.4 via Frontend Transport; Wed, 19 Jan 2022 23:03:52 +0000 X-MS-Exchange-Authentication-Results: spf=pass (sender IP is 165.204.84.17) smtp.mailfrom=amd.com; dkim=none (message not signed) header.d=none;dmarc=pass action=none header.from=amd.com; Received-SPF: pass (zohomail.com: domain of groups.io designates 66.175.222.108 as permitted sender) client-ip=66.175.222.108; envelope-from=bounce+27952+85833+1787277+3901457@groups.io; helo=mail02.groups.io; Received-SPF: Pass (protection.outlook.com: domain of amd.com designates 165.204.84.17 as permitted sender) receiver=protection.outlook.com; client-ip=165.204.84.17; helo=SATLEXMB04.amd.com; X-Received: from SATLEXMB04.amd.com (165.204.84.17) by DM6NAM11FT013.mail.protection.outlook.com (10.13.173.142) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256) id 15.20.4909.7 via Frontend Transport; Wed, 19 Jan 2022 23:03:52 +0000 X-Received: from sbrijesh-desktop.amd.com (10.180.168.240) by SATLEXMB04.amd.com (10.181.40.145) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256) id 15.1.2375.18; Wed, 19 Jan 2022 17:03:51 -0600 From: "Brijesh Singh via groups.io" To: CC: James Bottomley , Min Xu , "Jiewen Yao" , Tom Lendacky , "Jordan Justen" , Ard Biesheuvel , Erdem Aktas , "Michael Roth" , Gerd Hoffmann , Brijesh Singh Subject: [edk2-devel] [PATCH 1/2] OvmfPkg/ResetVector: cache the SEV status MSR value in workarea Date: Wed, 19 Jan 2022 17:03:31 -0600 Message-ID: <20220119230332.44888-2-brijesh.singh@amd.com> In-Reply-To: <20220119230332.44888-1-brijesh.singh@amd.com> References: <20220119230332.44888-1-brijesh.singh@amd.com> MIME-Version: 1.0 X-Originating-IP: [10.180.168.240] X-ClientProxiedBy: SATLEXMB03.amd.com (10.181.40.144) To SATLEXMB04.amd.com (10.181.40.145) X-EOPAttributedMessage: 0 X-MS-PublicTrafficType: Email X-MS-Office365-Filtering-Correlation-Id: 44b21e8e-d616-4714-bfc8-08d9db9ff662 X-MS-TrafficTypeDiagnostic: MN2PR12MB2927:EE_ X-Microsoft-Antispam-PRVS: X-MS-Oob-TLC-OOBClassifiers: OLM:4125; X-MS-Exchange-SenderADCheck: 1 X-MS-Exchange-AntiSpam-Relay: 0 X-Microsoft-Antispam-Message-Info: nZfaJ6bIpLPb/CRZlvYvvBtY8rnka1dCl7f4kuu7hsLHD1DVzEVoGsy5/QtdQM+yr9+dUTxX5GLxVP/zAKGRYYxajMi9RvnA/sMLR+KITU3XxLzipTT/p2ZGbd59YQHeEeMcE8HPtBZUnYyLrMcQbSCamfra/TEeJdd9xszSheYfVO3l0mZUk4ZWlCvNpUSdeLu/hBFmO+qb1/eZVam2yWjPnnluL+d1vJuYQo9hgLSZfEejf//FeYBxm3DN4GvtNaUTA8iBbnxKM+Xk5k1o+0kYqYtCnyU/eq2tpzfAcLeWeRzKnS0kThh2SNjYdf3YOkyRapt4yR0gNvrdOyJ5i4aIh5eKNqnbBv+Gbqf0zvtaW3NO+syp884v0COKvQDhj0u49CijrfhKX/HfS7ENgwNBcSatpoF9zQzUFIz9Ylrw0m/jJ7ZNKn9HJf0bceEKcH6BgO1oLdqCxfdpd5Yewtq3atJnVQI8fYFf7JI+Od+NXwO1NSBuJbcO++0a6HVdgKlknWvAyQLLs4xykbl7QcHOyvm8GO8YoExKn8ADojN5EOqGjxwE4+2Wo809Kx9tNwamjrFKn2lJWuFeVSRRatRut8IVxMv17T3mOiFE5mmu4HPZmITseHZI7PIUUdNMDuXLGR9p4oUszmroGs3ur48sTem6LxYxfPLrWa9hbEb71WCh/ncu9voblv2Djm5hxW/hOdPomwfyiyH9rqTEOubPa9AtKNe6N+8ogzEp/BG1yfwOxy63lX0CXMk7QuhE3KDXfpp7NvYdW3zMgOj26Dzqre8vGbaXrgNGNvtksKg= X-OriginatorOrg: amd.com X-MS-Exchange-CrossTenant-OriginalArrivalTime: 19 Jan 2022 23:03:52.8648 (UTC) X-MS-Exchange-CrossTenant-Network-Message-Id: 44b21e8e-d616-4714-bfc8-08d9db9ff662 X-MS-Exchange-CrossTenant-Id: 3dd8961f-e488-4e60-8e11-a82d994e183d X-MS-Exchange-CrossTenant-OriginalAttributedTenantConnectingIp: TenantId=3dd8961f-e488-4e60-8e11-a82d994e183d;Ip=[165.204.84.17];Helo=[SATLEXMB04.amd.com] X-MS-Exchange-CrossTenant-AuthSource: DM6NAM11FT013.eop-nam11.prod.protection.outlook.com X-MS-Exchange-CrossTenant-AuthAs: Anonymous X-MS-Exchange-CrossTenant-FromEntityHeader: HybridOnPrem X-MS-Exchange-Transport-CrossTenantHeadersStamped: MN2PR12MB2927 Precedence: Bulk List-Unsubscribe: List-Subscribe: List-Help: Sender: devel@edk2.groups.io List-Id: Mailing-List: list devel@edk2.groups.io; contact devel+owner@edk2.groups.io Reply-To: devel@edk2.groups.io,brijesh.singh@amd.com X-Gm-Message-State: P4Jk0rZw45kDzkYRAcBlxivlx1787277AA= Content-Transfer-Encoding: quoted-printable DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=groups.io; q=dns/txt; s=20140610; t=1642633436; bh=yPO8kTZVYPdsr3+hPWf6ncxA1VjPN8Dphf/Np0KwQ5E=; h=CC:Content-Type:Date:From:Reply-To:Subject:To; b=nLXupPkjTHvPB/0VPJfPVnWjX1UtoNyUjPC4+d3lUrBOWPdZJFsJV3qOVQnXzOhOCfR ibxHiaAt6r3uEBy0bfdGJZTlMkawyOwJsiLVun80SmtdVJVg2S60/booxaQvWoD0ZTNsg nKbGid/3KucD4k1GCYgwFXuJBJXuXX8IVFM= X-ZohoMail-DKIM: pass (identity @groups.io) X-ZM-MESSAGEID: 1642633438818100004 Content-Type: text/plain; charset="utf-8" In order to probe the SEV feature the BaseMemEncryptLib and Reset vector reads the SEV_STATUS MSR. Cache the value on the first read in the workarea. In the next patches the value saved in the workarea will be used by the BaseMemEncryptLib. This not only eliminates the extra MSR reads it also helps cleaning up the code in BaseMemEncryptLib. Cc: Min Xu Cc: Jiewen Yao Cc: Tom Lendacky Cc: Jordan Justen Cc: Ard Biesheuvel Cc: Erdem Aktas Cc: Gerd Hoffmann Signed-off-by: Brijesh Singh Acked-by: Gerd Hoffmann --- OvmfPkg/Include/WorkArea.h | 12 +++++-- OvmfPkg/Sec/AmdSev.c | 2 +- OvmfPkg/ResetVector/Ia32/AmdSev.asm | 38 +++++++++++++-------- OvmfPkg/ResetVector/Ia32/Flat32ToFlat64.asm | 3 +- OvmfPkg/ResetVector/ResetVector.nasmb | 3 ++ 5 files changed, 39 insertions(+), 19 deletions(-) diff --git a/OvmfPkg/Include/WorkArea.h b/OvmfPkg/Include/WorkArea.h index ce60d97aa886..d982e026def7 100644 --- a/OvmfPkg/Include/WorkArea.h +++ b/OvmfPkg/Include/WorkArea.h @@ -46,12 +46,20 @@ typedef struct _CONFIDENTIAL_COMPUTING_WORK_AREA_HEADER= { // any changes must stay in sync with its usage. // typedef struct _SEC_SEV_ES_WORK_AREA { - UINT8 SevEsEnabled; - UINT8 Reserved1[7]; + // + // Hold the SevStatus MSR value read by OvmfPkg/ResetVector/Ia32/AmdSev.c + // + UINT64 SevStatusMsrValue; =20 UINT64 RandomData; =20 UINT64 EncryptionMask; + + // + // Indicator that the VC handler is called. It is used during the SevFea= ture + // detection in OvmfPkg/ResetVector/Ia32/AmdSev.c + // + UINT8 ReceivedVc; } SEC_SEV_ES_WORK_AREA; =20 // diff --git a/OvmfPkg/Sec/AmdSev.c b/OvmfPkg/Sec/AmdSev.c index 499d0c27d8fa..d8fd35650d7d 100644 --- a/OvmfPkg/Sec/AmdSev.c +++ b/OvmfPkg/Sec/AmdSev.c @@ -278,7 +278,7 @@ SevEsIsEnabled ( =20 SevEsWorkArea =3D (SEC_SEV_ES_WORK_AREA *)FixedPcdGet32 (PcdSevEsWorkAre= aBase); =20 - return (SevEsWorkArea->SevEsEnabled !=3D 0); + return ((SevEsWorkArea->SevStatusMsrValue & BIT1) !=3D 0); } =20 /** diff --git a/OvmfPkg/ResetVector/Ia32/AmdSev.asm b/OvmfPkg/ResetVector/Ia32= /AmdSev.asm index 1f827da3b929..864d68385342 100644 --- a/OvmfPkg/ResetVector/Ia32/AmdSev.asm +++ b/OvmfPkg/ResetVector/Ia32/AmdSev.asm @@ -157,8 +157,9 @@ SevClearPageEncMaskForGhcbPage: jnz SevClearPageEncMaskForGhcbPageExit =20 ; Check if SEV-ES is enabled - cmp byte[SEV_ES_WORK_AREA], 1 - jnz SevClearPageEncMaskForGhcbPageExit + mov ecx, 1 + bt [SEV_ES_WORK_AREA_STATUS_MSR], ecx + jnc SevClearPageEncMaskForGhcbPageExit =20 ; ; The initial GHCB will live at GHCB_BASE and needs to be un-encrypted. @@ -219,12 +220,16 @@ GetSevCBitMaskAbove31Exit: ; If SEV is disabled then EAX will be zero. ; CheckSevFeatures: - ; Set the first byte of the workarea to zero to communicate to the SEC - ; phase that SEV-ES is not enabled. If SEV-ES is enabled, the CPUID - ; instruction will trigger a #VC exception where the first byte of the - ; workarea will be set to one or, if CPUID is not being intercepted, - ; the MSR check below will set the first byte of the workarea to one. - mov byte[SEV_ES_WORK_AREA], 0 + ; + ; Clear the workarea, if SEV is enabled then later part of routine + ; will populate the workarea fields. + ; + mov ecx, SEV_ES_WORK_AREA_SIZE + mov eax, SEV_ES_WORK_AREA +ClearSevEsWorkArea: + mov byte [eax], 0 + inc eax + loop ClearSevEsWorkArea =20 ; ; Set up exception handlers to check for SEV-ES @@ -265,6 +270,10 @@ CheckSevFeatures: ; Set the work area header to indicate that the SEV is enabled mov byte[WORK_AREA_GUEST_TYPE], 1 =20 + ; Save the SevStatus MSR value in the workarea + mov [SEV_ES_WORK_AREA_STATUS_MSR], eax + mov [SEV_ES_WORK_AREA_STATUS_MSR + 4], edx + ; Check for SEV-ES memory encryption feature: ; CPUID Fn8000_001F[EAX] - Bit 3 ; CPUID raises a #VC exception if running as an SEV-ES guest @@ -280,10 +289,6 @@ CheckSevFeatures: bt eax, 1 jnc GetSevEncBit =20 - ; Set the first byte of the workarea to one to communicate to the SEC - ; phase that SEV-ES is enabled. - mov byte[SEV_ES_WORK_AREA], 1 - GetSevEncBit: ; Get pte bit position to enable memory encryption ; CPUID Fn8000_001F[EBX] - Bits 5:0 @@ -313,7 +318,10 @@ NoSev: ; ; Perform an SEV-ES sanity check by seeing if a #VC exception occurred. ; - cmp byte[SEV_ES_WORK_AREA], 0 + ; If SEV-ES is enabled, the CPUID instruction will trigger a #VC excep= tion + ; where the RECEIVED_VC offset in the workarea will be set to one. + ; + cmp byte[SEV_ES_WORK_AREA_RECEIVED_VC], 0 jz NoSevPass =20 ; @@ -407,9 +415,9 @@ SevEsIdtVmmComm: ; If we're here, then we are an SEV-ES guest and this ; was triggered by a CPUID instruction ; - ; Set the first byte of the workarea to one to communicate that + ; Set the recievedVc field in the workarea to communicate that ; a #VC was taken. - mov byte[SEV_ES_WORK_AREA], 1 + mov byte[SEV_ES_WORK_AREA_RECEIVED_VC], 1 =20 pop ecx ; Error code cmp ecx, 0x72 ; Be sure it was CPUID diff --git a/OvmfPkg/ResetVector/Ia32/Flat32ToFlat64.asm b/OvmfPkg/ResetVec= tor/Ia32/Flat32ToFlat64.asm index eb3546668ef8..c5c683ebed3e 100644 --- a/OvmfPkg/ResetVector/Ia32/Flat32ToFlat64.asm +++ b/OvmfPkg/ResetVector/Ia32/Flat32ToFlat64.asm @@ -42,7 +42,8 @@ Transition32FlatTo64Flat: ; xor ebx, ebx =20 - cmp byte[SEV_ES_WORK_AREA], 0 + mov ecx, 1 + bt [SEV_ES_WORK_AREA_STATUS_MSR], ecx jz EnablePaging =20 ; diff --git a/OvmfPkg/ResetVector/ResetVector.nasmb b/OvmfPkg/ResetVector/Re= setVector.nasmb index cc364748b592..9421f4818907 100644 --- a/OvmfPkg/ResetVector/ResetVector.nasmb +++ b/OvmfPkg/ResetVector/ResetVector.nasmb @@ -100,8 +100,11 @@ %define GHCB_BASE (FixedPcdGet32 (PcdOvmfSecGhcbBase)) %define GHCB_SIZE (FixedPcdGet32 (PcdOvmfSecGhcbSize)) %define SEV_ES_WORK_AREA (FixedPcdGet32 (PcdSevEsWorkAreaBase)) + %define SEV_ES_WORK_AREA_SIZE 25 + %define SEV_ES_WORK_AREA_STATUS_MSR (FixedPcdGet32 (PcdSevEsWorkAreaBase= )) %define SEV_ES_WORK_AREA_RDRAND (FixedPcdGet32 (PcdSevEsWorkAreaBase) + = 8) %define SEV_ES_WORK_AREA_ENC_MASK (FixedPcdGet32 (PcdSevEsWorkAreaBase) = + 16) + %define SEV_ES_WORK_AREA_RECEIVED_VC (FixedPcdGet32 (PcdSevEsWorkAreaBas= e) + 24) %define SEV_ES_VC_TOP_OF_STACK (FixedPcdGet32 (PcdOvmfSecPeiTempRamBase)= + FixedPcdGet32 (PcdOvmfSecPeiTempRamSize)) %define SEV_SNP_SECRETS_BASE (FixedPcdGet32 (PcdOvmfSnpSecretsBase)) %define SEV_SNP_SECRETS_SIZE (FixedPcdGet32 (PcdOvmfSnpSecretsSize)) --=20 2.25.1 -=3D-=3D-=3D-=3D-=3D-=3D-=3D-=3D-=3D-=3D-=3D- Groups.io Links: You receive all messages sent to this group. View/Reply Online (#85833): https://edk2.groups.io/g/devel/message/85833 Mute This Topic: https://groups.io/mt/88547249/1787277 Group Owner: devel+owner@edk2.groups.io Unsubscribe: https://edk2.groups.io/g/devel/unsub [importer@patchew.org] -=3D-=3D-=3D-=3D-=3D-=3D-=3D-=3D-=3D-=3D-=3D- From nobody Fri May 3 16:21:10 2024 Delivered-To: importer@patchew.org Authentication-Results: mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of groups.io designates 66.175.222.108 as permitted sender) smtp.mailfrom=bounce+27952+85835+1787277+3901457@groups.io; arc=fail (BodyHash is different from the expected one) Received: from mail02.groups.io (mail02.groups.io [66.175.222.108]) by mx.zohomail.com with SMTPS id 1642633437679168.1713793288285; Wed, 19 Jan 2022 15:03:57 -0800 (PST) Return-Path: X-Received: by 127.0.0.2 with SMTP id lyHRYY1788612xxELGiHFRbS; Wed, 19 Jan 2022 15:03:57 -0800 X-Received: from NAM12-BN8-obe.outbound.protection.outlook.com (NAM12-BN8-obe.outbound.protection.outlook.com [40.107.237.74]) by mx.groups.io with SMTP id smtpd.web08.4217.1642633436327530995 for ; Wed, 19 Jan 2022 15:03:56 -0800 ARC-Seal: i=1; a=rsa-sha256; s=arcselector9901; d=microsoft.com; cv=none; b=bLz8tVygecxt62PZZrptj+0dRgm2aKUncpjznfCv6iEKxhlR1MH0aA7Iu9SMTeg5/JP8gi5xGXJ8WrgJIrrwcxW0SpLiGz6We5+sqxWxxIUlwzP6w/cGRM51lLkJ+YJDx0s+vPpbViiL6O2Gk7oIYj91HcEQUYSm9kvQio6zJZOj2Pwa0NXjkvP+fmu6tqVahP1xfdUvVmGRXjNPAC0G+tGQcnwe8lwIH6ml+SITkxlF4ff7IAaxpIvnMgPTAOYZ6USo0jt++zfnpzWzJVly+oHTYNa7JLw7E/O5Xy8j1sDuW7OXFFi4eEfmoXgfCApi51Xp2u/Ui9BjyxPmAPZWUA== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=arcselector9901; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-AntiSpam-MessageData-ChunkCount:X-MS-Exchange-AntiSpam-MessageData-0:X-MS-Exchange-AntiSpam-MessageData-1; bh=73qVof4+bOgQJI5x758j2IXdqvXw4r4sJ2jvFIXc0Y0=; b=fB9nlBSo6Wc5780GAKmp9JUPShm+C3MMVg1+FcIfv/beaXR5AaelYjkj2qq9/ASk6k2cXXqglxX1Ze5LMINWbT3iiX5Yusvy7PpDTe4DztoIpOyRhMxFtvlMgwheNXvpVhjgPg/8X2P7wppFAjLZW6QyJvZM1jsRa+EbyyHF3LMQ7PdKuiISvgXK2vw/FspXp5YmtNVWwxo3AMomFdY3LeYeQ0HV4zjDgviCtbu6/L9V6mBwYvkhHkkjJ/w3xX+Y/TN2YhX2E1hWSOi76FI3+nsZdJGLNnf0itjQ1LLHUxmLXv4pe/y46i/xuOrshK3OhAliOSRKowW/tzWgWW/KTQ== ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=pass (sender ip is 165.204.84.17) smtp.rcpttodomain=edk2.groups.io smtp.mailfrom=amd.com; dmarc=pass (p=quarantine sp=quarantine pct=100) action=none header.from=amd.com; dkim=none (message not signed); arc=none X-Received: from DS7PR05CA0034.namprd05.prod.outlook.com (2603:10b6:8:2f::35) by SJ0PR12MB5487.namprd12.prod.outlook.com (2603:10b6:a03:301::16) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.4909.7; Wed, 19 Jan 2022 23:03:53 +0000 X-Received: from DM6NAM11FT013.eop-nam11.prod.protection.outlook.com (2603:10b6:8:2f:cafe::c4) by DS7PR05CA0034.outlook.office365.com (2603:10b6:8:2f::35) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.4909.3 via Frontend Transport; Wed, 19 Jan 2022 23:03:53 +0000 X-MS-Exchange-Authentication-Results: spf=pass (sender IP is 165.204.84.17) smtp.mailfrom=amd.com; dkim=none (message not signed) header.d=none;dmarc=pass action=none header.from=amd.com; Received-SPF: pass (zohomail.com: domain of groups.io designates 66.175.222.108 as permitted sender) client-ip=66.175.222.108; envelope-from=bounce+27952+85835+1787277+3901457@groups.io; helo=mail02.groups.io; Received-SPF: Pass (protection.outlook.com: domain of amd.com designates 165.204.84.17 as permitted sender) receiver=protection.outlook.com; client-ip=165.204.84.17; helo=SATLEXMB04.amd.com; X-Received: from SATLEXMB04.amd.com (165.204.84.17) by DM6NAM11FT013.mail.protection.outlook.com (10.13.173.142) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256) id 15.20.4909.7 via Frontend Transport; Wed, 19 Jan 2022 23:03:53 +0000 X-Received: from sbrijesh-desktop.amd.com (10.180.168.240) by SATLEXMB04.amd.com (10.181.40.145) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256) id 15.1.2375.18; Wed, 19 Jan 2022 17:03:51 -0600 From: "Brijesh Singh via groups.io" To: CC: James Bottomley , Min Xu , "Jiewen Yao" , Tom Lendacky , "Jordan Justen" , Ard Biesheuvel , Erdem Aktas , "Michael Roth" , Gerd Hoffmann , Brijesh Singh Subject: [edk2-devel] [PATCH 2/2] OvmfPkg/BaseMemEncryptLib: use the SEV_STATUS MSR value from workarea Date: Wed, 19 Jan 2022 17:03:32 -0600 Message-ID: <20220119230332.44888-3-brijesh.singh@amd.com> In-Reply-To: <20220119230332.44888-1-brijesh.singh@amd.com> References: <20220119230332.44888-1-brijesh.singh@amd.com> MIME-Version: 1.0 X-Originating-IP: [10.180.168.240] X-ClientProxiedBy: SATLEXMB03.amd.com (10.181.40.144) To SATLEXMB04.amd.com (10.181.40.145) X-EOPAttributedMessage: 0 X-MS-PublicTrafficType: Email X-MS-Office365-Filtering-Correlation-Id: f2179f01-ed5b-4858-ce74-08d9db9ff6b3 X-MS-TrafficTypeDiagnostic: SJ0PR12MB5487:EE_ X-Microsoft-Antispam-PRVS: X-MS-Oob-TLC-OOBClassifiers: OLM:7691; X-MS-Exchange-SenderADCheck: 1 X-MS-Exchange-AntiSpam-Relay: 0 X-Microsoft-Antispam-Message-Info: uTf8l1aZLfsTvECtnEsrF/LvEqrbP+ZzFfuvbjK4f3IIYRuRXZshITjzFIjRqpfxBsnsjuGCEjztIFMRSDGHmw7DxyXTcVSsUP5ky+wEV1t/E0LrgR0hqvGH2zCj61N980zfKLow2gHua0pMbiD5XqYwjLdqZt5VXXfuJEFIZIoUX7r1faJ38x770YMWWeeDUPl2yydLCp5Mxley7WsgFjpv3NTbZFx7AU0io+5Lob7uwGeW7EUFXn6x1EupTbG70VhPLz/HT+0BaVANNa28ap0yPccCtdAbNKDdzaYGJqr2oTNIfmsm7hwVAzCDlEXAU3e5xqHqi88x6VA2c/1h9k0j79dGyXbsg0AkRREDifqzSHewHKZkgxpZvjvoz7q+vOA3PpbKZmr4WgTq0cdqa8ao5FARGzPFqWrylvQmuLzThv3JqiWjEdJ5h84mID/K/4LWXk+ch9aEhe92iElF6ygor3cIT2fD6nNdTF2TebEsk+PMPm2bpbyFKk+O/8GvPgbxBcevPEmdd+s9HWq8hvpOJXihegRNaxeIIUb+UHgc0uznLN8kZMGo7MeGlxNJN9EjtuU31OW2yN2hFH4gqQwjWv9NiLwTmPVmqM5HP9L7+tM/rqhbsroNC8+kccjlvLRANBwiV+gL+Pkg1cTR45ptsBheX2EOmkxQsDi5HX/EGl9Jia8gkzOnhFFkj5bBS6r5X2ZmKm7dOQRSKfZvMz/PK9mJIqC1uYUv+DuFTI9e5DZdM1KdQdmE2FvwCV6YA4ZCjIwIlHWtS5YiDK8dit7EEZYpJGamzEXq23wpcVw= X-OriginatorOrg: amd.com X-MS-Exchange-CrossTenant-OriginalArrivalTime: 19 Jan 2022 23:03:53.3804 (UTC) X-MS-Exchange-CrossTenant-Network-Message-Id: f2179f01-ed5b-4858-ce74-08d9db9ff6b3 X-MS-Exchange-CrossTenant-Id: 3dd8961f-e488-4e60-8e11-a82d994e183d X-MS-Exchange-CrossTenant-OriginalAttributedTenantConnectingIp: TenantId=3dd8961f-e488-4e60-8e11-a82d994e183d;Ip=[165.204.84.17];Helo=[SATLEXMB04.amd.com] X-MS-Exchange-CrossTenant-AuthSource: DM6NAM11FT013.eop-nam11.prod.protection.outlook.com X-MS-Exchange-CrossTenant-AuthAs: Anonymous X-MS-Exchange-CrossTenant-FromEntityHeader: HybridOnPrem X-MS-Exchange-Transport-CrossTenantHeadersStamped: SJ0PR12MB5487 Precedence: Bulk List-Unsubscribe: List-Subscribe: List-Help: Sender: devel@edk2.groups.io List-Id: Mailing-List: list devel@edk2.groups.io; contact devel+owner@edk2.groups.io Reply-To: devel@edk2.groups.io,brijesh.singh@amd.com X-Gm-Message-State: i3joGfqJMCv4RgsgsUrwp6pax1787277AA= Content-Transfer-Encoding: quoted-printable DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=groups.io; q=dns/txt; s=20140610; t=1642633437; bh=3xVENIEE5RbrMlt7CGtJaE36cO7pyMW7KPDi4SnYVPY=; h=CC:Content-Type:Date:From:Reply-To:Subject:To; b=VBRHIsssTaUymzW1aSre/eIHREMi6E5+cGq+KDQydxOMBNrPRBlCTjE4fO1n9JgR6O9 5fBy3677YodCCwuq8KdEulDqZKl4rJSjJwmVwq109Pus6dX41jeIrHHLJ+U18RCJm0eXL bquvgoXtB/DQNTQS9ugLbuEvX7y+H5ReWk4= X-ZohoMail-DKIM: pass (identity @groups.io) X-ZM-MESSAGEID: 1642633438865100005 Content-Type: text/plain; charset="utf-8" Improve the MemEncryptSev{Es,Snp}IsEnabled() to use the SEV_STATUS MSR value saved in the workarea. Since workarea is valid until the PEI phase, so, for the Dxe phase use the PcdConfidentialComputingGuestAttr to determine which SEV technology is enabled. Cc: Min Xu Cc: Jiewen Yao Cc: Tom Lendacky Cc: Jordan Justen Cc: Ard Biesheuvel Cc: Erdem Aktas Cc: Gerd Hoffmann Signed-off-by: Brijesh Singh Acked-by: Gerd Hoffmann --- .../DxeMemEncryptSevLib.inf | 1 + .../PeiMemEncryptSevLib.inf | 1 + .../SecMemEncryptSevLib.inf | 1 + .../DxeMemEncryptSevLibInternal.c | 142 ++++++++---------- .../PeiMemEncryptSevLibInternal.c | 139 ++++++----------- .../SecMemEncryptSevLibInternal.c | 80 +++++----- 6 files changed, 150 insertions(+), 214 deletions(-) diff --git a/OvmfPkg/Library/BaseMemEncryptSevLib/DxeMemEncryptSevLib.inf b= /OvmfPkg/Library/BaseMemEncryptSevLib/DxeMemEncryptSevLib.inf index f613bb314f5f..35b7d519d938 100644 --- a/OvmfPkg/Library/BaseMemEncryptSevLib/DxeMemEncryptSevLib.inf +++ b/OvmfPkg/Library/BaseMemEncryptSevLib/DxeMemEncryptSevLib.inf @@ -58,3 +58,4 @@ [FeaturePcd] =20 [Pcd] gEfiMdeModulePkgTokenSpaceGuid.PcdPteMemoryEncryptionAddressOrMask + gEfiMdePkgTokenSpaceGuid.PcdConfidentialComputingGuestAttr diff --git a/OvmfPkg/Library/BaseMemEncryptSevLib/PeiMemEncryptSevLib.inf b= /OvmfPkg/Library/BaseMemEncryptSevLib/PeiMemEncryptSevLib.inf index 50c83859d7e7..714da3323765 100644 --- a/OvmfPkg/Library/BaseMemEncryptSevLib/PeiMemEncryptSevLib.inf +++ b/OvmfPkg/Library/BaseMemEncryptSevLib/PeiMemEncryptSevLib.inf @@ -58,6 +58,7 @@ [FeaturePcd] =20 [FixedPcd] gUefiCpuPkgTokenSpaceGuid.PcdSevEsWorkAreaBase + gUefiOvmfPkgTokenSpaceGuid.PcdOvmfWorkAreaBase gUefiOvmfPkgTokenSpaceGuid.PcdOvmfPeiMemFvBase gUefiOvmfPkgTokenSpaceGuid.PcdOvmfSecPageTablesBase gUefiOvmfPkgTokenSpaceGuid.PcdOvmfSecValidatedEnd diff --git a/OvmfPkg/Library/BaseMemEncryptSevLib/SecMemEncryptSevLib.inf b= /OvmfPkg/Library/BaseMemEncryptSevLib/SecMemEncryptSevLib.inf index 939af0a91ea4..284e5acc1177 100644 --- a/OvmfPkg/Library/BaseMemEncryptSevLib/SecMemEncryptSevLib.inf +++ b/OvmfPkg/Library/BaseMemEncryptSevLib/SecMemEncryptSevLib.inf @@ -52,3 +52,4 @@ [LibraryClasses] =20 [FixedPcd] gUefiCpuPkgTokenSpaceGuid.PcdSevEsWorkAreaBase + gUefiOvmfPkgTokenSpaceGuid.PcdOvmfWorkAreaBase diff --git a/OvmfPkg/Library/BaseMemEncryptSevLib/DxeMemEncryptSevLibIntern= al.c b/OvmfPkg/Library/BaseMemEncryptSevLib/DxeMemEncryptSevLibInternal.c index 15fcd5529587..25768daf5467 100644 --- a/OvmfPkg/Library/BaseMemEncryptSevLib/DxeMemEncryptSevLibInternal.c +++ b/OvmfPkg/Library/BaseMemEncryptSevLib/DxeMemEncryptSevLibInternal.c @@ -16,83 +16,77 @@ #include #include #include - -STATIC BOOLEAN mSevStatus =3D FALSE; -STATIC BOOLEAN mSevEsStatus =3D FALSE; -STATIC BOOLEAN mSevSnpStatus =3D FALSE; -STATIC BOOLEAN mSevStatusChecked =3D FALSE; +#include =20 STATIC UINT64 mSevEncryptionMask =3D 0; STATIC BOOLEAN mSevEncryptionMaskSaved =3D FALSE; =20 /** - Reads and sets the status of SEV features. + The function check if the specified Attr is set. =20 - **/ + @param[in] CurrentAttr The current attribute. + @param[in] Attr The attribute to check. + + @retval TRUE The specified Attr is set. + @retval FALSE The specified Attr is not set. + +**/ +STATIC +BOOLEAN +AmdMemEncryptionAttrCheck ( + IN UINT64 CurrentAttr, + IN CONFIDENTIAL_COMPUTING_GUEST_ATTR Attr + ) +{ + switch (Attr) { + case CCAttrAmdSev: + // + // SEV is automatically enabled if SEV-ES or SEV-SNP is active. + // + return CurrentAttr >=3D CCAttrAmdSev; + case CCAttrAmdSevEs: + // + // SEV-ES is automatically enabled if SEV-SNP is active. + // + return CurrentAttr >=3D CCAttrAmdSevEs; + case CCAttrAmdSevSnp: + return CurrentAttr =3D=3D CCAttrAmdSevSnp; + default: + return FALSE; + } +} + +/** + Check if the specified confidential computing attribute is active. + + @param[in] Attr The attribute to check. + + @retval TRUE The specified Attr is active. + @retval FALSE The specified Attr is not active. + +**/ STATIC -VOID +BOOLEAN EFIAPI -InternalMemEncryptSevStatus ( - VOID +ConfidentialComputingGuestHas ( + IN CONFIDENTIAL_COMPUTING_GUEST_ATTR Attr ) { - UINT32 RegEax; - MSR_SEV_STATUS_REGISTER Msr; - CPUID_MEMORY_ENCRYPTION_INFO_EAX Eax; - BOOLEAN ReadSevMsr; - UINT64 EncryptionMask; - - ReadSevMsr =3D FALSE; - - EncryptionMask =3D PcdGet64 (PcdPteMemoryEncryptionAddressOrMask); - if (EncryptionMask !=3D 0) { - // - // The MSR has been read before, so it is safe to read it again and av= oid - // having to validate the CPUID information. - // - ReadSevMsr =3D TRUE; - } else { - // - // Check if memory encryption leaf exist - // - AsmCpuid (CPUID_EXTENDED_FUNCTION, &RegEax, NULL, NULL, NULL); - if (RegEax >=3D CPUID_MEMORY_ENCRYPTION_INFO) { - // - // CPUID Fn8000_001F[EAX] Bit 1 (Sev supported) - // - AsmCpuid (CPUID_MEMORY_ENCRYPTION_INFO, &Eax.Uint32, NULL, NULL, NUL= L); - - if (Eax.Bits.SevBit) { - ReadSevMsr =3D TRUE; - } - } - } - - if (ReadSevMsr) { - // - // Check MSR_0xC0010131 Bit 0 (Sev Enabled) - // - Msr.Uint32 =3D AsmReadMsr32 (MSR_SEV_STATUS); - if (Msr.Bits.SevBit) { - mSevStatus =3D TRUE; - } - - // - // Check MSR_0xC0010131 Bit 1 (Sev-Es Enabled) - // - if (Msr.Bits.SevEsBit) { - mSevEsStatus =3D TRUE; - } - - // - // Check MSR_0xC0010131 Bit 2 (Sev-Snp Enabled) - // - if (Msr.Bits.SevSnpBit) { - mSevSnpStatus =3D TRUE; - } + UINT64 CurrentAttr; + + // + // Get the current CC attribute. + // + CurrentAttr =3D PcdGet64 (PcdConfidentialComputingGuestAttr); + + // + // If attr is for the AMD group then call AMD specific checks. + // + if (((RShiftU64 (CurrentAttr, 8)) & 0xff) =3D=3D 1) { + return AmdMemEncryptionAttrCheck (CurrentAttr, Attr); } =20 - mSevStatusChecked =3D TRUE; + return (CurrentAttr =3D=3D Attr); } =20 /** @@ -107,11 +101,7 @@ MemEncryptSevSnpIsEnabled ( VOID ) { - if (!mSevStatusChecked) { - InternalMemEncryptSevStatus (); - } - - return mSevSnpStatus; + return ConfidentialComputingGuestHas (CCAttrAmdSevSnp); } =20 /** @@ -126,11 +116,7 @@ MemEncryptSevEsIsEnabled ( VOID ) { - if (!mSevStatusChecked) { - InternalMemEncryptSevStatus (); - } - - return mSevEsStatus; + return ConfidentialComputingGuestHas (CCAttrAmdSevEs); } =20 /** @@ -145,11 +131,7 @@ MemEncryptSevIsEnabled ( VOID ) { - if (!mSevStatusChecked) { - InternalMemEncryptSevStatus (); - } - - return mSevStatus; + return ConfidentialComputingGuestHas (CCAttrAmdSev); } =20 /** diff --git a/OvmfPkg/Library/BaseMemEncryptSevLib/PeiMemEncryptSevLibIntern= al.c b/OvmfPkg/Library/BaseMemEncryptSevLib/PeiMemEncryptSevLibInternal.c index d68ff08c3ea6..3f8f91a5da12 100644 --- a/OvmfPkg/Library/BaseMemEncryptSevLib/PeiMemEncryptSevLibInternal.c +++ b/OvmfPkg/Library/BaseMemEncryptSevLib/PeiMemEncryptSevLibInternal.c @@ -17,82 +17,51 @@ #include #include =20 -STATIC BOOLEAN mSevStatus =3D FALSE; -STATIC BOOLEAN mSevEsStatus =3D FALSE; -STATIC BOOLEAN mSevSnpStatus =3D FALSE; -STATIC BOOLEAN mSevStatusChecked =3D FALSE; +/** + Read the workarea to determine whether SEV is enabled. If enabled, + then return the SevEsWorkArea pointer. + + **/ +STATIC +SEC_SEV_ES_WORK_AREA * +EFIAPI +GetSevEsWorkArea ( + VOID + ) +{ + OVMF_WORK_AREA *WorkArea; + + WorkArea =3D (OVMF_WORK_AREA *)FixedPcdGet32 (PcdOvmfWorkAreaBase); + + // + // If its not SEV guest then SevEsWorkArea is not valid. + // + if ((WorkArea =3D=3D NULL) || (WorkArea->Header.GuestType !=3D GUEST_TYP= E_AMD_SEV)) { + return NULL; + } =20 -STATIC UINT64 mSevEncryptionMask =3D 0; -STATIC BOOLEAN mSevEncryptionMaskSaved =3D FALSE; + return (SEC_SEV_ES_WORK_AREA *)FixedPcdGet32 (PcdSevEsWorkAreaBase); +} =20 /** - Reads and sets the status of SEV features. + Read the SEV Status MSR value from the workarea =20 **/ STATIC -VOID +UINT32 EFIAPI InternalMemEncryptSevStatus ( VOID ) { - UINT32 RegEax; - MSR_SEV_STATUS_REGISTER Msr; - CPUID_MEMORY_ENCRYPTION_INFO_EAX Eax; - BOOLEAN ReadSevMsr; - SEC_SEV_ES_WORK_AREA *SevEsWorkArea; + SEC_SEV_ES_WORK_AREA *SevEsWorkArea; =20 - ReadSevMsr =3D FALSE; - - SevEsWorkArea =3D (SEC_SEV_ES_WORK_AREA *)FixedPcdGet32 (PcdSevEsWorkAre= aBase); - if ((SevEsWorkArea !=3D NULL) && (SevEsWorkArea->EncryptionMask !=3D 0))= { - // - // The MSR has been read before, so it is safe to read it again and av= oid - // having to validate the CPUID information. - // - ReadSevMsr =3D TRUE; - } else { - // - // Check if memory encryption leaf exist - // - AsmCpuid (CPUID_EXTENDED_FUNCTION, &RegEax, NULL, NULL, NULL); - if (RegEax >=3D CPUID_MEMORY_ENCRYPTION_INFO) { - // - // CPUID Fn8000_001F[EAX] Bit 1 (Sev supported) - // - AsmCpuid (CPUID_MEMORY_ENCRYPTION_INFO, &Eax.Uint32, NULL, NULL, NUL= L); - - if (Eax.Bits.SevBit) { - ReadSevMsr =3D TRUE; - } - } - } - - if (ReadSevMsr) { - // - // Check MSR_0xC0010131 Bit 0 (Sev Enabled) - // - Msr.Uint32 =3D AsmReadMsr32 (MSR_SEV_STATUS); - if (Msr.Bits.SevBit) { - mSevStatus =3D TRUE; - } - - // - // Check MSR_0xC0010131 Bit 1 (Sev-Es Enabled) - // - if (Msr.Bits.SevEsBit) { - mSevEsStatus =3D TRUE; - } - - // - // Check MSR_0xC0010131 Bit 2 (Sev-Snp Enabled) - // - if (Msr.Bits.SevSnpBit) { - mSevSnpStatus =3D TRUE; - } + SevEsWorkArea =3D GetSevEsWorkArea (); + if (SevEsWorkArea =3D=3D NULL) { + return 0; } =20 - mSevStatusChecked =3D TRUE; + return (UINT32)(UINTN)SevEsWorkArea->SevStatusMsrValue; } =20 /** @@ -107,11 +76,11 @@ MemEncryptSevSnpIsEnabled ( VOID ) { - if (!mSevStatusChecked) { - InternalMemEncryptSevStatus (); - } + MSR_SEV_STATUS_REGISTER Msr; =20 - return mSevSnpStatus; + Msr.Uint32 =3D InternalMemEncryptSevStatus (); + + return Msr.Bits.SevSnpBit ? TRUE : FALSE; } =20 /** @@ -126,11 +95,11 @@ MemEncryptSevEsIsEnabled ( VOID ) { - if (!mSevStatusChecked) { - InternalMemEncryptSevStatus (); - } + MSR_SEV_STATUS_REGISTER Msr; =20 - return mSevEsStatus; + Msr.Uint32 =3D InternalMemEncryptSevStatus (); + + return Msr.Bits.SevEsBit ? TRUE : FALSE; } =20 /** @@ -145,11 +114,11 @@ MemEncryptSevIsEnabled ( VOID ) { - if (!mSevStatusChecked) { - InternalMemEncryptSevStatus (); - } + MSR_SEV_STATUS_REGISTER Msr; =20 - return mSevStatus; + Msr.Uint32 =3D InternalMemEncryptSevStatus (); + + return Msr.Bits.SevBit ? TRUE : FALSE; } =20 /** @@ -163,24 +132,12 @@ MemEncryptSevGetEncryptionMask ( VOID ) { - if (!mSevEncryptionMaskSaved) { - SEC_SEV_ES_WORK_AREA *SevEsWorkArea; + SEC_SEV_ES_WORK_AREA *SevEsWorkArea; =20 - SevEsWorkArea =3D (SEC_SEV_ES_WORK_AREA *)FixedPcdGet32 (PcdSevEsWorkA= reaBase); - if (SevEsWorkArea !=3D NULL) { - mSevEncryptionMask =3D SevEsWorkArea->EncryptionMask; - } else { - CPUID_MEMORY_ENCRYPTION_INFO_EBX Ebx; - - // - // CPUID Fn8000_001F[EBX] Bit 0:5 (memory encryption bit position) - // - AsmCpuid (CPUID_MEMORY_ENCRYPTION_INFO, NULL, &Ebx.Uint32, NULL, NUL= L); - mSevEncryptionMask =3D LShiftU64 (1, Ebx.Bits.PtePosBits); - } - - mSevEncryptionMaskSaved =3D TRUE; + SevEsWorkArea =3D GetSevEsWorkArea (); + if (SevEsWorkArea =3D=3D NULL) { + return 0; } =20 - return mSevEncryptionMask; + return SevEsWorkArea->EncryptionMask; } diff --git a/OvmfPkg/Library/BaseMemEncryptSevLib/SecMemEncryptSevLibIntern= al.c b/OvmfPkg/Library/BaseMemEncryptSevLib/SecMemEncryptSevLibInternal.c index 5d912b2a4a5e..80aceba01bcf 100644 --- a/OvmfPkg/Library/BaseMemEncryptSevLib/SecMemEncryptSevLibInternal.c +++ b/OvmfPkg/Library/BaseMemEncryptSevLib/SecMemEncryptSevLibInternal.c @@ -18,7 +18,33 @@ #include =20 /** - Reads and sets the status of SEV features. + Read the workarea to determine whether SEV is enabled. If enabled, + then return the SevEsWorkArea pointer. + + **/ +STATIC +SEC_SEV_ES_WORK_AREA * +EFIAPI +GetSevEsWorkArea ( + VOID + ) +{ + OVMF_WORK_AREA *WorkArea; + + WorkArea =3D (OVMF_WORK_AREA *)FixedPcdGet32 (PcdOvmfWorkAreaBase); + + // + // If its not SEV guest then SevEsWorkArea is not valid. + // + if ((WorkArea =3D=3D NULL) || (WorkArea->Header.GuestType !=3D GUEST_TYP= E_AMD_SEV)) { + return NULL; + } + + return (SEC_SEV_ES_WORK_AREA *)FixedPcdGet32 (PcdSevEsWorkAreaBase); +} + +/** + Read the SEV Status MSR value from the workarea =20 **/ STATIC @@ -28,38 +54,14 @@ InternalMemEncryptSevStatus ( VOID ) { - UINT32 RegEax; - CPUID_MEMORY_ENCRYPTION_INFO_EAX Eax; - BOOLEAN ReadSevMsr; - SEC_SEV_ES_WORK_AREA *SevEsWorkArea; + SEC_SEV_ES_WORK_AREA *SevEsWorkArea; =20 - ReadSevMsr =3D FALSE; - - SevEsWorkArea =3D (SEC_SEV_ES_WORK_AREA *)FixedPcdGet32 (PcdSevEsWorkAre= aBase); - if ((SevEsWorkArea !=3D NULL) && (SevEsWorkArea->EncryptionMask !=3D 0))= { - // - // The MSR has been read before, so it is safe to read it again and av= oid - // having to validate the CPUID information. - // - ReadSevMsr =3D TRUE; - } else { - // - // Check if memory encryption leaf exist - // - AsmCpuid (CPUID_EXTENDED_FUNCTION, &RegEax, NULL, NULL, NULL); - if (RegEax >=3D CPUID_MEMORY_ENCRYPTION_INFO) { - // - // CPUID Fn8000_001F[EAX] Bit 1 (Sev supported) - // - AsmCpuid (CPUID_MEMORY_ENCRYPTION_INFO, &Eax.Uint32, NULL, NULL, NUL= L); - - if (Eax.Bits.SevBit) { - ReadSevMsr =3D TRUE; - } - } + SevEsWorkArea =3D GetSevEsWorkArea (); + if (SevEsWorkArea =3D=3D NULL) { + return 0; } =20 - return ReadSevMsr ? AsmReadMsr32 (MSR_SEV_STATUS) : 0; + return (UINT32)(UINTN)SevEsWorkArea->SevStatusMsrValue; } =20 /** @@ -130,22 +132,14 @@ MemEncryptSevGetEncryptionMask ( VOID ) { - CPUID_MEMORY_ENCRYPTION_INFO_EBX Ebx; - SEC_SEV_ES_WORK_AREA *SevEsWorkArea; - UINT64 EncryptionMask; + SEC_SEV_ES_WORK_AREA *SevEsWorkArea; =20 - SevEsWorkArea =3D (SEC_SEV_ES_WORK_AREA *)FixedPcdGet32 (PcdSevEsWorkAre= aBase); - if (SevEsWorkArea !=3D NULL) { - EncryptionMask =3D SevEsWorkArea->EncryptionMask; - } else { - // - // CPUID Fn8000_001F[EBX] Bit 0:5 (memory encryption bit position) - // - AsmCpuid (CPUID_MEMORY_ENCRYPTION_INFO, NULL, &Ebx.Uint32, NULL, NULL); - EncryptionMask =3D LShiftU64 (1, Ebx.Bits.PtePosBits); + SevEsWorkArea =3D GetSevEsWorkArea (); + if (SevEsWorkArea =3D=3D NULL) { + return 0; } =20 - return EncryptionMask; + return SevEsWorkArea->EncryptionMask; } =20 /** --=20 2.25.1 -=3D-=3D-=3D-=3D-=3D-=3D-=3D-=3D-=3D-=3D-=3D- Groups.io Links: You receive all messages sent to this group. View/Reply Online (#85835): https://edk2.groups.io/g/devel/message/85835 Mute This Topic: https://groups.io/mt/88547251/1787277 Group Owner: devel+owner@edk2.groups.io Unsubscribe: https://edk2.groups.io/g/devel/unsub [importer@patchew.org] -=3D-=3D-=3D-=3D-=3D-=3D-=3D-=3D-=3D-=3D-=3D-