From 45388d046c3506bd49dca29aed8ec74756e6165c Mon Sep 17 00:00:00 2001 From: Tom Lendacky Date: Thu, 7 Jan 2021 12:48:17 -0600 Subject: OvmfPkg: Obtain SEV encryption mask with the new MemEncryptSevLib API BZ: https://bugzilla.tianocore.org/show_bug.cgi?id=3108 The early assembler code performs validation for some of the SEV-related information, specifically the encryption bit position. The new MemEncryptSevGetEncryptionMask() interface provides access to this validated value. To ensure that we always use a validated encryption mask for an SEV-ES guest, update all locations that use CPUID to calculate the encryption mask to use the new interface. Also, clean up some call areas where extra masking was being performed and where a function call was being used instead of the local variable that was just set using the function. Cc: Jordan Justen Cc: Laszlo Ersek Cc: Ard Biesheuvel Cc: Rebecca Cran Cc: Peter Grehan Cc: Brijesh Singh Cc: Anthony Perard Cc: Julien Grall Reviewed-by: Laszlo Ersek Signed-off-by: Tom Lendacky Message-Id: <9de678c0d66443c6cc33e004a4cac0a0223c2ebc.1610045305.git.thomas.lendacky@amd.com> --- OvmfPkg/Bhyve/PlatformPei/AmdSev.c | 12 ++---------- OvmfPkg/Library/BaseMemEncryptSevLib/X64/VirtualMemory.c | 15 +++++---------- OvmfPkg/PlatformPei/AmdSev.c | 12 ++---------- OvmfPkg/XenPlatformPei/AmdSev.c | 12 ++---------- 4 files changed, 11 insertions(+), 40 deletions(-) diff --git a/OvmfPkg/Bhyve/PlatformPei/AmdSev.c b/OvmfPkg/Bhyve/PlatformPei/AmdSev.c index e484f4b..e3ed785 100644 --- a/OvmfPkg/Bhyve/PlatformPei/AmdSev.c +++ b/OvmfPkg/Bhyve/PlatformPei/AmdSev.c @@ -1,7 +1,7 @@ /**@file Initialize Secure Encrypted Virtualization (SEV) support - Copyright (c) 2017, Advanced Micro Devices. All rights reserved.
+ Copyright (c) 2017 - 2020, Advanced Micro Devices. All rights reserved.
SPDX-License-Identifier: BSD-2-Clause-Patent @@ -15,8 +15,6 @@ #include #include #include -#include -#include #include #include "Platform.h" @@ -32,7 +30,6 @@ AmdSevInitialize ( VOID ) { - CPUID_MEMORY_ENCRYPTION_INFO_EBX Ebx; UINT64 EncryptionMask; RETURN_STATUS PcdStatus; @@ -44,14 +41,9 @@ AmdSevInitialize ( } // - // CPUID Fn8000_001F[EBX] Bit 0:5 (memory encryption bit position) - // - AsmCpuid (CPUID_MEMORY_ENCRYPTION_INFO, NULL, &Ebx.Uint32, NULL, NULL); - EncryptionMask = LShiftU64 (1, Ebx.Bits.PtePosBits); - - // // Set Memory Encryption Mask PCD // + EncryptionMask = MemEncryptSevGetEncryptionMask (); PcdStatus = PcdSet64S (PcdPteMemoryEncryptionAddressOrMask, EncryptionMask); ASSERT_RETURN_ERROR (PcdStatus); diff --git a/OvmfPkg/Library/BaseMemEncryptSevLib/X64/VirtualMemory.c b/OvmfPkg/Library/BaseMemEncryptSevLib/X64/VirtualMemory.c index 5e110c8..6422bc5 100644 --- a/OvmfPkg/Library/BaseMemEncryptSevLib/X64/VirtualMemory.c +++ b/OvmfPkg/Library/BaseMemEncryptSevLib/X64/VirtualMemory.c @@ -3,7 +3,7 @@ Virtual Memory Management Services to set or clear the memory encryption bit Copyright (c) 2006 - 2018, Intel Corporation. All rights reserved.
- Copyright (c) 2017, AMD Incorporated. All rights reserved.
+ Copyright (c) 2017 - 2020, AMD Incorporated. All rights reserved.
SPDX-License-Identifier: BSD-2-Clause-Patent @@ -12,6 +12,7 @@ **/ #include +#include #include #include @@ -39,17 +40,12 @@ GetMemEncryptionAddressMask ( ) { UINT64 EncryptionMask; - CPUID_MEMORY_ENCRYPTION_INFO_EBX Ebx; if (mAddressEncMaskChecked) { return mAddressEncMask; } - // - // CPUID Fn8000_001F[EBX] Bit 0:5 (memory encryption bit position) - // - AsmCpuid (CPUID_MEMORY_ENCRYPTION_INFO, NULL, &Ebx.Uint32, NULL, NULL); - EncryptionMask = LShiftU64 (1, Ebx.Bits.PtePosBits); + EncryptionMask = MemEncryptSevGetEncryptionMask (); mAddressEncMask = EncryptionMask & PAGING_1G_ADDRESS_MASK_64; mAddressEncMaskChecked = TRUE; @@ -289,8 +285,7 @@ SetPageTablePoolReadOnly ( LevelSize[3] = SIZE_1GB; LevelSize[4] = SIZE_512GB; - AddressEncMask = GetMemEncryptionAddressMask() & - PAGING_1G_ADDRESS_MASK_64; + AddressEncMask = GetMemEncryptionAddressMask(); PageTable = (UINT64 *)(UINTN)PageTableBase; PoolUnitSize = PAGE_TABLE_POOL_UNIT_SIZE; @@ -437,7 +432,7 @@ Split1GPageTo2M ( AddressEncMask = GetMemEncryptionAddressMask (); ASSERT (PageDirectoryEntry != NULL); - ASSERT (*PageEntry1G & GetMemEncryptionAddressMask ()); + ASSERT (*PageEntry1G & AddressEncMask); // // Fill in 1G page entry. // diff --git a/OvmfPkg/PlatformPei/AmdSev.c b/OvmfPkg/PlatformPei/AmdSev.c index 4a515a4..954d53e 100644 --- a/OvmfPkg/PlatformPei/AmdSev.c +++ b/OvmfPkg/PlatformPei/AmdSev.c @@ -1,7 +1,7 @@ /**@file Initialize Secure Encrypted Virtualization (SEV) support - Copyright (c) 2017, Advanced Micro Devices. All rights reserved.
+ Copyright (c) 2017 - 2020, Advanced Micro Devices. All rights reserved.
SPDX-License-Identifier: BSD-2-Clause-Patent @@ -17,9 +17,7 @@ #include #include #include -#include #include -#include #include #include "Platform.h" @@ -116,7 +114,6 @@ AmdSevInitialize ( VOID ) { - CPUID_MEMORY_ENCRYPTION_INFO_EBX Ebx; UINT64 EncryptionMask; RETURN_STATUS PcdStatus; @@ -128,14 +125,9 @@ AmdSevInitialize ( } // - // CPUID Fn8000_001F[EBX] Bit 0:5 (memory encryption bit position) - // - AsmCpuid (CPUID_MEMORY_ENCRYPTION_INFO, NULL, &Ebx.Uint32, NULL, NULL); - EncryptionMask = LShiftU64 (1, Ebx.Bits.PtePosBits); - - // // Set Memory Encryption Mask PCD // + EncryptionMask = MemEncryptSevGetEncryptionMask (); PcdStatus = PcdSet64S (PcdPteMemoryEncryptionAddressOrMask, EncryptionMask); ASSERT_RETURN_ERROR (PcdStatus); diff --git a/OvmfPkg/XenPlatformPei/AmdSev.c b/OvmfPkg/XenPlatformPei/AmdSev.c index 7ebbb5c..4ed4486 100644 --- a/OvmfPkg/XenPlatformPei/AmdSev.c +++ b/OvmfPkg/XenPlatformPei/AmdSev.c @@ -1,7 +1,7 @@ /**@file Initialize Secure Encrypted Virtualization (SEV) support - Copyright (c) 2017, Advanced Micro Devices. All rights reserved.
+ Copyright (c) 2017 - 2020, Advanced Micro Devices. All rights reserved.
Copyright (c) 2019, Citrix Systems, Inc. SPDX-License-Identifier: BSD-2-Clause-Patent @@ -14,8 +14,6 @@ #include #include #include -#include -#include #include "Platform.h" @@ -30,7 +28,6 @@ AmdSevInitialize ( VOID ) { - CPUID_MEMORY_ENCRYPTION_INFO_EBX Ebx; UINT64 EncryptionMask; RETURN_STATUS PcdStatus; @@ -42,14 +39,9 @@ AmdSevInitialize ( } // - // CPUID Fn8000_001F[EBX] Bit 0:5 (memory encryption bit position) - // - AsmCpuid (CPUID_MEMORY_ENCRYPTION_INFO, NULL, &Ebx.Uint32, NULL, NULL); - EncryptionMask = LShiftU64 (1, Ebx.Bits.PtePosBits); - - // // Set Memory Encryption Mask PCD // + EncryptionMask = MemEncryptSevGetEncryptionMask (); PcdStatus = PcdSet64S (PcdPteMemoryEncryptionAddressOrMask, EncryptionMask); ASSERT_RETURN_ERROR (PcdStatus); -- cgit v1.1