sravan/system76-edk2
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

OvmfPkg/ResetVector: cache the SEV status MSR value in workarea

Browse Source 
BZ: https://bugzilla.tianocore.org/show_bug.cgi?id=3582

In order to probe the SEV feature the BaseMemEncryptLib and Reset vector
reads the SEV_STATUS MSR. Cache the value on the first read in the
workarea. In the next patches the value saved in the workarea will
be used by the BaseMemEncryptLib. This not only eliminates the extra
MSR reads it also helps cleaning up the code in BaseMemEncryptLib.

Cc: Min Xu <min.m.xu@intel.com>
Cc: Jiewen Yao <jiewen.yao@intel.com>
Cc: Tom Lendacky <thomas.lendacky@amd.com>
Cc: Jordan Justen <jordan.l.justen@intel.com>
Cc: Ard Biesheuvel <ardb+tianocore@kernel.org>
Cc: Erdem Aktas <erdemaktas@google.com>
Cc: Gerd Hoffmann <kraxel@redhat.com>
Acked-by: Gerd Hoffmann <kraxel@redhat.com>
Signed-off-by: Brijesh Singh <brijesh.singh@amd.com>
Acked-by: Jiewen Yao <jiewen.yao@intel.com>
This commit is contained in:
Brijesh Singh
2022-02-21 22:59:13 +08:00
committed by mergify[bot]
parent de463163d9
commit 63c50d3ff2
5 changed files with 39 additions and 19 deletions
Download Patch File Download Diff File Expand all files Collapse all files

38
OvmfPkg/ResetVector/Ia32/AmdSev.asm
View File

@@ -157,8 +157,9 @@ SevClearPageEncMaskForGhcbPage:
jnz SevClearPageEncMaskForGhcbPageExit
; Check if SEV-ES is enabled
cmp byte[SEV_ES_WORK_AREA], 1
jnz SevClearPageEncMaskForGhcbPageExit
mov ecx, 1
bt [SEV_ES_WORK_AREA_STATUS_MSR], ecx
jnc SevClearPageEncMaskForGhcbPageExit
;
; The initial GHCB will live at GHCB_BASE and needs to be un-encrypted.
@@ -219,12 +220,16 @@ GetSevCBitMaskAbove31Exit:
; If SEV is disabled then EAX will be zero.
;
CheckSevFeatures:
; Set the first byte of the workarea to zero to communicate to the SEC
; phase that SEV-ES is not enabled. If SEV-ES is enabled, the CPUID
; instruction will trigger a #VC exception where the first byte of the
; workarea will be set to one or, if CPUID is not being intercepted,
; the MSR check below will set the first byte of the workarea to one.
mov byte[SEV_ES_WORK_AREA], 0
;
; Clear the workarea, if SEV is enabled then later part of routine
; will populate the workarea fields.
;
mov ecx, SEV_ES_WORK_AREA_SIZE
mov eax, SEV_ES_WORK_AREA
ClearSevEsWorkArea:
mov byte [eax], 0
inc eax
loop ClearSevEsWorkArea
;
; Set up exception handlers to check for SEV-ES
@@ -265,6 +270,10 @@ CheckSevFeatures:
; Set the work area header to indicate that the SEV is enabled
mov byte[WORK_AREA_GUEST_TYPE], 1
; Save the SevStatus MSR value in the workarea
mov [SEV_ES_WORK_AREA_STATUS_MSR], eax
mov [SEV_ES_WORK_AREA_STATUS_MSR + 4], edx
; Check for SEV-ES memory encryption feature:
; CPUID Fn8000_001F[EAX] - Bit 3
; CPUID raises a #VC exception if running as an SEV-ES guest
@@ -280,10 +289,6 @@ CheckSevFeatures:
bt eax, 1
jnc GetSevEncBit
; Set the first byte of the workarea to one to communicate to the SEC
; phase that SEV-ES is enabled.
mov byte[SEV_ES_WORK_AREA], 1
GetSevEncBit:
; Get pte bit position to enable memory encryption
; CPUID Fn8000_001F[EBX] - Bits 5:0
@@ -313,7 +318,10 @@ NoSev:
;
; Perform an SEV-ES sanity check by seeing if a #VC exception occurred.
;
cmp byte[SEV_ES_WORK_AREA], 0
; If SEV-ES is enabled, the CPUID instruction will trigger a #VC exception
; where the RECEIVED_VC offset in the workarea will be set to one.
;
cmp byte[SEV_ES_WORK_AREA_RECEIVED_VC], 0
jz NoSevPass
;
@@ -407,9 +415,9 @@ SevEsIdtVmmComm:
; If we're here, then we are an SEV-ES guest and this
; was triggered by a CPUID instruction
;
; Set the first byte of the workarea to one to communicate that
; Set the recievedVc field in the workarea to communicate that
; a #VC was taken.
mov byte[SEV_ES_WORK_AREA], 1
mov byte[SEV_ES_WORK_AREA_RECEIVED_VC], 1
pop ecx ; Error code
cmp ecx, 0x72 ; Be sure it was CPUID