On 6/21/21 8:57 AM, Ashish Kalra wrote:
> From: Ashish Kalra <[email protected]>
>
> Detect for KVM hypervisor and check for SEV live migration
> feature support via KVM_FEATURE_CPUID, if detected setup a new
> UEFI enviroment variable to indicate OVMF support for SEV
> live migration.
>
> Signed-off-by: Ashish Kalra <[email protected]>
> ---
> OvmfPkg/Include/Guid/MemEncryptLib.h | 20 ++++
> OvmfPkg/OvmfPkg.dec | 1 +
> OvmfPkg/PlatformDxe/AmdSev.c | 108 ++++++++++++++++++++
> OvmfPkg/PlatformDxe/Platform.c | 5 +
> OvmfPkg/PlatformDxe/Platform.inf | 2 +
> OvmfPkg/PlatformDxe/PlatformConfig.h | 5 +
> 6 files changed, 141 insertions(+)
>
> diff --git a/OvmfPkg/Include/Guid/MemEncryptLib.h
> b/OvmfPkg/Include/Guid/MemEncryptLib.h
> new file mode 100644
> index 0000000000..4c046ba439
> --- /dev/null
> +++ b/OvmfPkg/Include/Guid/MemEncryptLib.h
> @@ -0,0 +1,20 @@
> +/** @file
> +
> + AMD Memory Encryption GUID, define a new GUID for defining
> + new UEFI enviroment variables assocaiated with SEV Memory Encryption.
> +
> + Copyright (c) 2020, AMD Inc. All rights reserved.<BR>
> +
> + SPDX-License-Identifier: BSD-2-Clause-Patent
> +
> +**/
> +
> +#ifndef __MEMENCRYPT_LIB_H__
> +#define __MEMENCRYPT_LIB_H__
> +
> +#define MEMENCRYPT_GUID \
> +{0x0cf29b71, 0x9e51, 0x433a, {0xa3, 0xb7, 0x81, 0xf3, 0xab, 0x16, 0xb8,
> 0x75}}
> +
> +extern EFI_GUID gMemEncryptGuid;
> +
> +#endif
> diff --git a/OvmfPkg/OvmfPkg.dec b/OvmfPkg/OvmfPkg.dec
> index 6ae733f6e3..e452dc8494 100644
> --- a/OvmfPkg/OvmfPkg.dec
> +++ b/OvmfPkg/OvmfPkg.dec
> @@ -122,6 +122,7 @@
> gQemuKernelLoaderFsMediaGuid = {0x1428f772, 0xb64a, 0x441e,
> {0xb8, 0xc3, 0x9e, 0xbd, 0xd7, 0xf8, 0x93, 0xc7}}
> gGrubFileGuid = {0xb5ae312c, 0xbc8a, 0x43b1,
> {0x9c, 0x62, 0xeb, 0xb8, 0x26, 0xdd, 0x5d, 0x07}}
> gConfidentialComputingSecretGuid = {0xadf956ad, 0xe98c, 0x484c,
> {0xae, 0x11, 0xb5, 0x1c, 0x7d, 0x33, 0x64, 0x47}}
> + gMemEncryptGuid = {0x0cf29b71, 0x9e51, 0x433a,
> {0xa3, 0xb7, 0x81, 0xf3, 0xab, 0x16, 0xb8, 0x75}}
>
> [Ppis]
> # PPI whose presence in the PPI database signals that the TPM base address
> diff --git a/OvmfPkg/PlatformDxe/AmdSev.c b/OvmfPkg/PlatformDxe/AmdSev.c
> new file mode 100644
> index 0000000000..3dbf17a8cd
> --- /dev/null
> +++ b/OvmfPkg/PlatformDxe/AmdSev.c
Can this be done in OvmfPkg/AmdSevDxe/AmdSevDxe.c or is that too early?
> @@ -0,0 +1,108 @@
> +/**@file
> + Detect KVM hypervisor support for SEV live migration and if
> + detected, setup a new UEFI enviroment variable indicating
> + OVMF support for SEV live migration.
> +
> + Copyright (c) 2020, Advanced Micro Devices. All rights reserved.<BR>
> +
> + SPDX-License-Identifier: BSD-2-Clause-Patent
> +
> +**/
> +//
> +// The package level header files this module uses
> +//
> +
> +#include <Library/BaseLib.h>
> +#include <Library/BaseMemoryLib.h>
> +#include <Library/DebugLib.h>
> +#include <Library/UefiBootServicesTableLib.h>
> +#include <Library/UefiRuntimeServicesTableLib.h>
> +#include <Guid/MemEncryptLib.h>
> +
> +#define KVM_FEATURE_MIGRATION_CONTROL 17
BIT17
> +
> +/**
> + Figures out if we are running inside KVM HVM and
> + KVM HVM supports SEV Live Migration feature.
> +
> + @retval TRUE KVM was detected and Live Migration supported
> + @retval FALSE KVM was not detected or Live Migration not supported
> +
> +**/
> +BOOLEAN
> +KvmDetectSevLiveMigrationFeature(
> + VOID
> + )
> +{
> + UINT8 Signature[13];
> + UINT32 mKvmLeaf = 0;
> + UINT32 RegEax, RegEbx, RegEcx, RegEdx;
> +
> + Signature[12] = '\0';
> + for (mKvmLeaf = 0x40000000; mKvmLeaf < 0x40010000; mKvmLeaf += 0x100) {
What's the reason for the loop? I would think that just checking
0x40000000 would be enough, so a comment seems to be warranted.
> + AsmCpuid (mKvmLeaf,
> + NULL,
> + (UINT32 *) &Signature[0],
> + (UINT32 *) &Signature[4],
> + (UINT32 *) &Signature[8]);
> +
> + if (!AsciiStrCmp ((CHAR8 *) Signature, "KVMKVMKVM\0\0\0")) {
> + DEBUG ((
> + DEBUG_ERROR,
DEBUG_INFO, it doesn't seem like an error.
> + "%a: KVM Detected, signature = %s\n",
> + __FUNCTION__,
> + Signature
> + ));
> +> + RegEax = 0x40000001;
Should this be mKvmLeaf + 1? It is confusing that you may check 0x40000100
and then not do 0x40000101.
> + RegEcx = 0;
> + AsmCpuid (0x40000001, &RegEax, &RegEbx, &RegEcx, &RegEdx);
> + if (RegEax & (1 << KVM_FEATURE_MIGRATION_CONTROL)) {
This needs to be (assuming BIT17 is used above):
if ((RegEax & KVM_FEATURE_MIGRATION_CONTROL) != 0) {
You must use an actual comparison if the variable is not a boolean.
> + DEBUG ((
> + DEBUG_ERROR,
> + "%a: Live Migration feature supported\n",
DEBUG_INFO again.
> + __FUNCTION__
> + ));
> + return TRUE;
> + }
> + }
> + }
> +
> + return FALSE;
> +}
> +
> +/**
> +
> + Function checks if SEV Live Migration support is available, if present
> then it sets
> + a UEFI enviroment variable to be queried later using Runtime services.
> +
> + **/
> +VOID
> +AmdSevSetConfig(
Kind of a generic name for what is being done.
> + VOID
> + )
> +{
> + EFI_STATUS Status;
> + BOOLEAN SevLiveMigrationEnabled;
> +
> + SevLiveMigrationEnabled = KvmDetectSevLiveMigrationFeature();
> +
> + if (SevLiveMigrationEnabled) {
> + Status = gRT->SetVariable (
> + L"SevLiveMigrationEnabled",
> + &gMemEncryptGuid,
> + EFI_VARIABLE_NON_VOLATILE |
> + EFI_VARIABLE_BOOTSERVICE_ACCESS |
> + EFI_VARIABLE_RUNTIME_ACCESS,
> + sizeof (BOOLEAN),
> + &SevLiveMigrationEnabled
> + );
> +
> + DEBUG ((
> + DEBUG_ERROR,
> + "%a: Setting SevLiveMigrationEnabled variable, status = %lx\n",
DEBUG_INFO.
Thanks,
Tom
> + __FUNCTION__,
> + Status
> + ));
> + }
> +}
> diff --git a/OvmfPkg/PlatformDxe/Platform.c b/OvmfPkg/PlatformDxe/Platform.c
> index f2e51960ce..f61302d98b 100644
> --- a/OvmfPkg/PlatformDxe/Platform.c
> +++ b/OvmfPkg/PlatformDxe/Platform.c
> @@ -763,6 +763,11 @@ PlatformInit (
> {
> EFI_STATUS Status;
>
> + //
> + // Set Amd Sev configuation
> + //
> + AmdSevSetConfig();
> +
> ExecutePlatformConfig ();
>
> mConfigAccess.ExtractConfig = &ExtractConfig;
> diff --git a/OvmfPkg/PlatformDxe/Platform.inf
> b/OvmfPkg/PlatformDxe/Platform.inf
> index 14727c1220..2896f0a1d1 100644
> --- a/OvmfPkg/PlatformDxe/Platform.inf
> +++ b/OvmfPkg/PlatformDxe/Platform.inf
> @@ -24,6 +24,7 @@
> PlatformConfig.c
> PlatformConfig.h
> PlatformForms.vfr
> + AmdSev.c
>
> [Packages]
> MdePkg/MdePkg.dec
> @@ -56,6 +57,7 @@
> [Guids]
> gEfiIfrTianoGuid
> gOvmfPlatformConfigGuid
> + gMemEncryptGuid
>
> [Depex]
> gEfiHiiConfigRoutingProtocolGuid AND
> diff --git a/OvmfPkg/PlatformDxe/PlatformConfig.h
> b/OvmfPkg/PlatformDxe/PlatformConfig.h
> index 716514da21..4f662aafa4 100644
> --- a/OvmfPkg/PlatformDxe/PlatformConfig.h
> +++ b/OvmfPkg/PlatformDxe/PlatformConfig.h
> @@ -44,6 +44,11 @@ PlatformConfigLoad (
> OUT UINT64 *OptionalElements
> );
>
> +VOID
> +AmdSevSetConfig(
> + VOID
> + );
> +
> //
> // Feature flags for OptionalElements.
> //
>
-=-=-=-=-=-=-=-=-=-=-=-
Groups.io Links: You receive all messages sent to this group.
View/Reply Online (#76876): https://edk2.groups.io/g/devel/message/76876
Mute This Topic: https://groups.io/mt/83688901/21656
Group Owner: [email protected]
Unsubscribe: https://edk2.groups.io/g/devel/unsub [[email protected]]
-=-=-=-=-=-=-=-=-=-=-=-
