AmdSev.c 2.9 KB

1234567891011121314151617181920212223242526272829303132333435363738394041424344454647484950515253545556575859606162636465666768697071727374757677787980818283848586878889909192939495969798
  1. /**@file
  2. Initialize Secure Encrypted Virtualization (SEV) support
  3. Copyright (c) 2017 - 2020, Advanced Micro Devices. All rights reserved.<BR>
  4. SPDX-License-Identifier: BSD-2-Clause-Patent
  5. **/
  6. //
  7. // The package level header files this module uses
  8. //
  9. #include <IndustryStandard/Q35MchIch9.h>
  10. #include <Library/DebugLib.h>
  11. #include <Library/HobLib.h>
  12. #include <Library/MemEncryptSevLib.h>
  13. #include <Library/PcdLib.h>
  14. #include <PiPei.h>
  15. #include <Register/Intel/SmramSaveStateMap.h>
  16. #include "Platform.h"
  17. /**
  18. Function checks if SEV support is available, if present then it sets
  19. the dynamic PcdPteMemoryEncryptionAddressOrMask with memory encryption mask.
  20. **/
  21. VOID
  22. AmdSevInitialize (
  23. VOID
  24. )
  25. {
  26. UINT64 EncryptionMask;
  27. RETURN_STATUS PcdStatus;
  28. //
  29. // Check if SEV is enabled
  30. //
  31. if (!MemEncryptSevIsEnabled ()) {
  32. return;
  33. }
  34. //
  35. // Set Memory Encryption Mask PCD
  36. //
  37. EncryptionMask = MemEncryptSevGetEncryptionMask ();
  38. PcdStatus = PcdSet64S (PcdPteMemoryEncryptionAddressOrMask, EncryptionMask);
  39. ASSERT_RETURN_ERROR (PcdStatus);
  40. DEBUG ((DEBUG_INFO, "SEV is enabled (mask 0x%lx)\n", EncryptionMask));
  41. //
  42. // Set Pcd to Deny the execution of option ROM when security
  43. // violation.
  44. //
  45. PcdStatus = PcdSet32S (PcdOptionRomImageVerificationPolicy, 0x4);
  46. ASSERT_RETURN_ERROR (PcdStatus);
  47. //
  48. // When SMM is required, cover the pages containing the initial SMRAM Save
  49. // State Map with a memory allocation HOB:
  50. //
  51. // There's going to be a time interval between our decrypting those pages for
  52. // SMBASE relocation and re-encrypting the same pages after SMBASE
  53. // relocation. We shall ensure that the DXE phase stay away from those pages
  54. // until after re-encryption, in order to prevent an information leak to the
  55. // hypervisor.
  56. //
  57. if (FeaturePcdGet (PcdSmmSmramRequire) && (mBootMode != BOOT_ON_S3_RESUME)) {
  58. RETURN_STATUS LocateMapStatus;
  59. UINTN MapPagesBase;
  60. UINTN MapPagesCount;
  61. LocateMapStatus = MemEncryptSevLocateInitialSmramSaveStateMapPages (
  62. &MapPagesBase,
  63. &MapPagesCount
  64. );
  65. ASSERT_RETURN_ERROR (LocateMapStatus);
  66. if (mQ35SmramAtDefaultSmbase) {
  67. //
  68. // The initial SMRAM Save State Map has been covered as part of a larger
  69. // reserved memory allocation in InitializeRamRegions().
  70. //
  71. ASSERT (SMM_DEFAULT_SMBASE <= MapPagesBase);
  72. ASSERT (
  73. (MapPagesBase + EFI_PAGES_TO_SIZE (MapPagesCount) <=
  74. SMM_DEFAULT_SMBASE + MCH_DEFAULT_SMBASE_SIZE)
  75. );
  76. } else {
  77. BuildMemoryAllocationHob (
  78. MapPagesBase, // BaseAddress
  79. EFI_PAGES_TO_SIZE (MapPagesCount), // Length
  80. EfiBootServicesData // MemoryType
  81. );
  82. }
  83. }
  84. }