b97dc4b92b
BZ: https://bugzilla.tianocore.org/show_bug.cgi?id=3108 To ensure that we always use a validated encryption mask for an SEV-ES guest, create a new interface in the MemEncryptSevLib library to return the encryption mask. This can be used in place of the multiple locations where CPUID is used to retrieve the value (which would require validation again) and allows the validated mask to be returned. The PEI phase will use the value from the SEV-ES work area. Since the SEV-ES work area isn't valid in the DXE phase, the DXE phase will use the PcdPteMemoryEncryptionAddressOrMask PCD which is set during PEI. Cc: Jordan Justen <jordan.l.justen@intel.com> Cc: Laszlo Ersek <lersek@redhat.com> Cc: Ard Biesheuvel <ard.biesheuvel@arm.com> Cc: Rebecca Cran <rebecca@bsdio.com> Cc: Peter Grehan <grehan@freebsd.org> Cc: Anthony Perard <anthony.perard@citrix.com> Cc: Julien Grall <julien@xen.org> Cc: Brijesh Singh <brijesh.singh@amd.com> Acked-by: Laszlo Ersek <lersek@redhat.com> Signed-off-by: Tom Lendacky <thomas.lendacky@amd.com> Message-Id: <e12044dc01b21e6fc2e9535760ddf3a38a142a71.1610045305.git.thomas.lendacky@amd.com>
151 lines
4.7 KiB
C
151 lines
4.7 KiB
C
/** @file
|
|
|
|
Define Secure Encrypted Virtualization (SEV) base library helper function
|
|
|
|
Copyright (c) 2017 - 2020, AMD Incorporated. All rights reserved.<BR>
|
|
|
|
SPDX-License-Identifier: BSD-2-Clause-Patent
|
|
|
|
**/
|
|
|
|
#ifndef _MEM_ENCRYPT_SEV_LIB_H_
|
|
#define _MEM_ENCRYPT_SEV_LIB_H_
|
|
|
|
#include <Base.h>
|
|
|
|
//
|
|
// Internal structure for holding SEV-ES information needed during SEC phase
|
|
// and valid only during SEC phase and early PEI during platform
|
|
// initialization.
|
|
//
|
|
// This structure is also used by assembler files:
|
|
// OvmfPkg/ResetVector/ResetVector.nasmb
|
|
// OvmfPkg/ResetVector/Ia32/PageTables64.asm
|
|
// OvmfPkg/ResetVector/Ia32/Flat32ToFlat64.asm
|
|
// any changes must stay in sync with its usage.
|
|
//
|
|
typedef struct _SEC_SEV_ES_WORK_AREA {
|
|
UINT8 SevEsEnabled;
|
|
UINT8 Reserved1[7];
|
|
|
|
UINT64 RandomData;
|
|
|
|
UINT64 EncryptionMask;
|
|
} SEC_SEV_ES_WORK_AREA;
|
|
|
|
/**
|
|
Returns a boolean to indicate whether SEV-ES is enabled.
|
|
|
|
@retval TRUE SEV-ES is enabled
|
|
@retval FALSE SEV-ES is not enabled
|
|
**/
|
|
BOOLEAN
|
|
EFIAPI
|
|
MemEncryptSevEsIsEnabled (
|
|
VOID
|
|
);
|
|
|
|
/**
|
|
Returns a boolean to indicate whether SEV is enabled
|
|
|
|
@retval TRUE SEV is enabled
|
|
@retval FALSE SEV is not enabled
|
|
**/
|
|
BOOLEAN
|
|
EFIAPI
|
|
MemEncryptSevIsEnabled (
|
|
VOID
|
|
);
|
|
|
|
/**
|
|
This function clears memory encryption bit for the memory region specified by
|
|
BaseAddress and NumPages from the current page table context.
|
|
|
|
@param[in] Cr3BaseAddress Cr3 Base Address (if zero then use
|
|
current CR3)
|
|
@param[in] BaseAddress The physical address that is the start
|
|
address of a memory region.
|
|
@param[in] NumPages The number of pages from start memory
|
|
region.
|
|
@param[in] Flush Flush the caches before clearing the bit
|
|
(mostly TRUE except MMIO addresses)
|
|
|
|
@retval RETURN_SUCCESS The attributes were cleared for the
|
|
memory region.
|
|
@retval RETURN_INVALID_PARAMETER Number of pages is zero.
|
|
@retval RETURN_UNSUPPORTED Clearing the memory encryption attribute
|
|
is not supported
|
|
**/
|
|
RETURN_STATUS
|
|
EFIAPI
|
|
MemEncryptSevClearPageEncMask (
|
|
IN PHYSICAL_ADDRESS Cr3BaseAddress,
|
|
IN PHYSICAL_ADDRESS BaseAddress,
|
|
IN UINTN NumPages,
|
|
IN BOOLEAN Flush
|
|
);
|
|
|
|
/**
|
|
This function sets memory encryption bit for the memory region specified by
|
|
BaseAddress and NumPages from the current page table context.
|
|
|
|
@param[in] Cr3BaseAddress Cr3 Base Address (if zero then use
|
|
current CR3)
|
|
@param[in] BaseAddress The physical address that is the start
|
|
address of a memory region.
|
|
@param[in] NumPages The number of pages from start memory
|
|
region.
|
|
@param[in] Flush Flush the caches before setting the bit
|
|
(mostly TRUE except MMIO addresses)
|
|
|
|
@retval RETURN_SUCCESS The attributes were set for the memory
|
|
region.
|
|
@retval RETURN_INVALID_PARAMETER Number of pages is zero.
|
|
@retval RETURN_UNSUPPORTED Setting the memory encryption attribute
|
|
is not supported
|
|
**/
|
|
RETURN_STATUS
|
|
EFIAPI
|
|
MemEncryptSevSetPageEncMask (
|
|
IN PHYSICAL_ADDRESS Cr3BaseAddress,
|
|
IN PHYSICAL_ADDRESS BaseAddress,
|
|
IN UINTN NumPages,
|
|
IN BOOLEAN Flush
|
|
);
|
|
|
|
|
|
/**
|
|
Locate the page range that covers the initial (pre-SMBASE-relocation) SMRAM
|
|
Save State Map.
|
|
|
|
@param[out] BaseAddress The base address of the lowest-address page that
|
|
covers the initial SMRAM Save State Map.
|
|
|
|
@param[out] NumberOfPages The number of pages in the page range that covers
|
|
the initial SMRAM Save State Map.
|
|
|
|
@retval RETURN_SUCCESS BaseAddress and NumberOfPages have been set on
|
|
output.
|
|
|
|
@retval RETURN_UNSUPPORTED SMM is unavailable.
|
|
**/
|
|
RETURN_STATUS
|
|
EFIAPI
|
|
MemEncryptSevLocateInitialSmramSaveStateMapPages (
|
|
OUT UINTN *BaseAddress,
|
|
OUT UINTN *NumberOfPages
|
|
);
|
|
|
|
/**
|
|
Returns the SEV encryption mask.
|
|
|
|
@return The SEV pagetable encryption mask
|
|
**/
|
|
UINT64
|
|
EFIAPI
|
|
MemEncryptSevGetEncryptionMask (
|
|
VOID
|
|
);
|
|
|
|
#endif // _MEM_ENCRYPT_SEV_LIB_H_
|