blob: 9947d663deae94f908bb64f7c8686d719b42cc77 (
plain)
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
|
/** @file
Secure Encrypted Virtualization (SEV) library helper function
Copyright (c) 2017 - 2020, AMD Incorporated. All rights reserved.<BR>
SPDX-License-Identifier: BSD-2-Clause-Patent
**/
#include <Library/BaseLib.h>
#include <Library/DebugLib.h>
#include <Library/MemEncryptSevLib.h>
#include <Library/PcdLib.h>
#include <Register/Amd/Cpuid.h>
#include <Register/Amd/Msr.h>
#include <Register/Cpuid.h>
#include <Uefi/UefiBaseType.h>
#include <ConfidentialComputingGuestAttr.h>
STATIC UINT64 mCurrentAttr = 0;
STATIC BOOLEAN mCurrentAttrRead = FALSE;
STATIC UINT64 mSevEncryptionMask = 0;
STATIC BOOLEAN mSevEncryptionMaskSaved = FALSE;
/**
The function check if the specified Attr is set.
@param[in] CurrentAttr The current attribute.
@param[in] Attr The attribute to check.
@retval TRUE The specified Attr is set.
@retval FALSE The specified Attr is not set.
**/
STATIC
BOOLEAN
AmdMemEncryptionAttrCheck (
IN UINT64 CurrentAttr,
IN CONFIDENTIAL_COMPUTING_GUEST_ATTR Attr
)
{
UINT64 CurrentLevel;
CurrentLevel = CurrentAttr & CCAttrTypeMask;
switch (Attr) {
case CCAttrAmdSev:
//
// SEV is automatically enabled if SEV-ES or SEV-SNP is active.
//
return CurrentLevel >= CCAttrAmdSev;
case CCAttrAmdSevEs:
//
// SEV-ES is automatically enabled if SEV-SNP is active.
//
return CurrentLevel >= CCAttrAmdSevEs;
case CCAttrAmdSevSnp:
return CurrentLevel == CCAttrAmdSevSnp;
case CCAttrFeatureAmdSevEsDebugVirtualization:
return !!(CurrentAttr & CCAttrFeatureAmdSevEsDebugVirtualization);
default:
return FALSE;
}
}
/**
Check if the specified confidential computing attribute is active.
@param[in] Attr The attribute to check.
@retval TRUE The specified Attr is active.
@retval FALSE The specified Attr is not active.
**/
STATIC
BOOLEAN
EFIAPI
ConfidentialComputingGuestHas (
IN CONFIDENTIAL_COMPUTING_GUEST_ATTR Attr
)
{
//
// Get the current CC attribute.
//
// We avoid reading the PCD on every check because this routine could be indirectly
// called during the virtual pointer conversion. And its not safe to access the
// PCDs during the virtual pointer conversion.
//
if (!mCurrentAttrRead) {
mCurrentAttr = PcdGet64 (PcdConfidentialComputingGuestAttr);
mCurrentAttrRead = TRUE;
}
//
// If attr is for the AMD group then call AMD specific checks.
//
if (((RShiftU64 (mCurrentAttr, 8)) & 0xff) == 1) {
return AmdMemEncryptionAttrCheck (mCurrentAttr, Attr);
}
return (mCurrentAttr == Attr);
}
/**
Returns a boolean to indicate whether SEV-SNP is enabled.
@retval TRUE SEV-SNP is enabled
@retval FALSE SEV-SNP is not enabled
**/
BOOLEAN
EFIAPI
MemEncryptSevSnpIsEnabled (
VOID
)
{
return ConfidentialComputingGuestHas (CCAttrAmdSevSnp);
}
/**
Returns a boolean to indicate whether SEV-ES is enabled.
@retval TRUE SEV-ES is enabled
@retval FALSE SEV-ES is not enabled
**/
BOOLEAN
EFIAPI
MemEncryptSevEsIsEnabled (
VOID
)
{
return ConfidentialComputingGuestHas (CCAttrAmdSevEs);
}
/**
Returns a boolean to indicate whether SEV is enabled.
@retval TRUE SEV is enabled
@retval FALSE SEV is not enabled
**/
BOOLEAN
EFIAPI
MemEncryptSevIsEnabled (
VOID
)
{
return ConfidentialComputingGuestHas (CCAttrAmdSev);
}
/**
Returns the SEV encryption mask.
@return The SEV pagtable encryption mask
**/
UINT64
EFIAPI
MemEncryptSevGetEncryptionMask (
VOID
)
{
if (!mSevEncryptionMaskSaved) {
mSevEncryptionMask = PcdGet64 (PcdPteMemoryEncryptionAddressOrMask);
mSevEncryptionMaskSaved = TRUE;
}
return mSevEncryptionMask;
}
/**
Returns a boolean to indicate whether DebugVirtualization is enabled.
@retval TRUE DebugVirtualization is enabled
@retval FALSE DebugVirtualization is not enabled
**/
BOOLEAN
EFIAPI
MemEncryptSevEsDebugVirtualizationIsEnabled (
VOID
)
{
return ConfidentialComputingGuestHas (CCAttrFeatureAmdSevEsDebugVirtualization);
}
|
