On 6/21/21 8:57 AM, Ashish Kalra wrote: > From: Ashish Kalra <ashish.ka...@amd.com> > > Detect for KVM hypervisor and check for SEV live migration > feature support via KVM_FEATURE_CPUID, if detected setup a new > UEFI enviroment variable to indicate OVMF support for SEV > live migration. > > Signed-off-by: Ashish Kalra <ashish.ka...@amd.com> > --- > OvmfPkg/Include/Guid/MemEncryptLib.h | 20 ++++ > OvmfPkg/OvmfPkg.dec | 1 + > OvmfPkg/PlatformDxe/AmdSev.c | 108 ++++++++++++++++++++ > OvmfPkg/PlatformDxe/Platform.c | 5 + > OvmfPkg/PlatformDxe/Platform.inf | 2 + > OvmfPkg/PlatformDxe/PlatformConfig.h | 5 + > 6 files changed, 141 insertions(+) > > diff --git a/OvmfPkg/Include/Guid/MemEncryptLib.h > b/OvmfPkg/Include/Guid/MemEncryptLib.h > new file mode 100644 > index 0000000000..4c046ba439 > --- /dev/null > +++ b/OvmfPkg/Include/Guid/MemEncryptLib.h > @@ -0,0 +1,20 @@ > +/** @file > + > + AMD Memory Encryption GUID, define a new GUID for defining > + new UEFI enviroment variables assocaiated with SEV Memory Encryption. > + > + Copyright (c) 2020, AMD Inc. All rights reserved.<BR> > + > + SPDX-License-Identifier: BSD-2-Clause-Patent > + > +**/ > + > +#ifndef __MEMENCRYPT_LIB_H__ > +#define __MEMENCRYPT_LIB_H__ > + > +#define MEMENCRYPT_GUID \ > +{0x0cf29b71, 0x9e51, 0x433a, {0xa3, 0xb7, 0x81, 0xf3, 0xab, 0x16, 0xb8, > 0x75}} > + > +extern EFI_GUID gMemEncryptGuid; > + > +#endif > diff --git a/OvmfPkg/OvmfPkg.dec b/OvmfPkg/OvmfPkg.dec > index 6ae733f6e3..e452dc8494 100644 > --- a/OvmfPkg/OvmfPkg.dec > +++ b/OvmfPkg/OvmfPkg.dec > @@ -122,6 +122,7 @@ > gQemuKernelLoaderFsMediaGuid = {0x1428f772, 0xb64a, 0x441e, > {0xb8, 0xc3, 0x9e, 0xbd, 0xd7, 0xf8, 0x93, 0xc7}} > gGrubFileGuid = {0xb5ae312c, 0xbc8a, 0x43b1, > {0x9c, 0x62, 0xeb, 0xb8, 0x26, 0xdd, 0x5d, 0x07}} > gConfidentialComputingSecretGuid = {0xadf956ad, 0xe98c, 0x484c, > {0xae, 0x11, 0xb5, 0x1c, 0x7d, 0x33, 0x64, 0x47}} > + gMemEncryptGuid = {0x0cf29b71, 0x9e51, 0x433a, > {0xa3, 0xb7, 0x81, 0xf3, 0xab, 0x16, 0xb8, 0x75}} > > [Ppis] > # PPI whose presence in the PPI database signals that the TPM base address > diff --git a/OvmfPkg/PlatformDxe/AmdSev.c b/OvmfPkg/PlatformDxe/AmdSev.c > new file mode 100644 > index 0000000000..3dbf17a8cd > --- /dev/null > +++ b/OvmfPkg/PlatformDxe/AmdSev.c
Can this be done in OvmfPkg/AmdSevDxe/AmdSevDxe.c or is that too early? > @@ -0,0 +1,108 @@ > +/**@file > + Detect KVM hypervisor support for SEV live migration and if > + detected, setup a new UEFI enviroment variable indicating > + OVMF support for SEV live migration. > + > + Copyright (c) 2020, Advanced Micro Devices. All rights reserved.<BR> > + > + SPDX-License-Identifier: BSD-2-Clause-Patent > + > +**/ > +// > +// The package level header files this module uses > +// > + > +#include <Library/BaseLib.h> > +#include <Library/BaseMemoryLib.h> > +#include <Library/DebugLib.h> > +#include <Library/UefiBootServicesTableLib.h> > +#include <Library/UefiRuntimeServicesTableLib.h> > +#include <Guid/MemEncryptLib.h> > + > +#define KVM_FEATURE_MIGRATION_CONTROL 17 BIT17 > + > +/** > + Figures out if we are running inside KVM HVM and > + KVM HVM supports SEV Live Migration feature. > + > + @retval TRUE KVM was detected and Live Migration supported > + @retval FALSE KVM was not detected or Live Migration not supported > + > +**/ > +BOOLEAN > +KvmDetectSevLiveMigrationFeature( > + VOID > + ) > +{ > + UINT8 Signature[13]; > + UINT32 mKvmLeaf = 0; > + UINT32 RegEax, RegEbx, RegEcx, RegEdx; > + > + Signature[12] = '\0'; > + for (mKvmLeaf = 0x40000000; mKvmLeaf < 0x40010000; mKvmLeaf += 0x100) { What's the reason for the loop? I would think that just checking 0x40000000 would be enough, so a comment seems to be warranted. > + AsmCpuid (mKvmLeaf, > + NULL, > + (UINT32 *) &Signature[0], > + (UINT32 *) &Signature[4], > + (UINT32 *) &Signature[8]); > + > + if (!AsciiStrCmp ((CHAR8 *) Signature, "KVMKVMKVM\0\0\0")) { > + DEBUG (( > + DEBUG_ERROR, DEBUG_INFO, it doesn't seem like an error. > + "%a: KVM Detected, signature = %s\n", > + __FUNCTION__, > + Signature > + )); > +> + RegEax = 0x40000001; Should this be mKvmLeaf + 1? It is confusing that you may check 0x40000100 and then not do 0x40000101. > + RegEcx = 0; > + AsmCpuid (0x40000001, &RegEax, &RegEbx, &RegEcx, &RegEdx); > + if (RegEax & (1 << KVM_FEATURE_MIGRATION_CONTROL)) { This needs to be (assuming BIT17 is used above): if ((RegEax & KVM_FEATURE_MIGRATION_CONTROL) != 0) { You must use an actual comparison if the variable is not a boolean. > + DEBUG (( > + DEBUG_ERROR, > + "%a: Live Migration feature supported\n", DEBUG_INFO again. > + __FUNCTION__ > + )); > + return TRUE; > + } > + } > + } > + > + return FALSE; > +} > + > +/** > + > + Function checks if SEV Live Migration support is available, if present > then it sets > + a UEFI enviroment variable to be queried later using Runtime services. > + > + **/ > +VOID > +AmdSevSetConfig( Kind of a generic name for what is being done. > + VOID > + ) > +{ > + EFI_STATUS Status; > + BOOLEAN SevLiveMigrationEnabled; > + > + SevLiveMigrationEnabled = KvmDetectSevLiveMigrationFeature(); > + > + if (SevLiveMigrationEnabled) { > + Status = gRT->SetVariable ( > + L"SevLiveMigrationEnabled", > + &gMemEncryptGuid, > + EFI_VARIABLE_NON_VOLATILE | > + EFI_VARIABLE_BOOTSERVICE_ACCESS | > + EFI_VARIABLE_RUNTIME_ACCESS, > + sizeof (BOOLEAN), > + &SevLiveMigrationEnabled > + ); > + > + DEBUG (( > + DEBUG_ERROR, > + "%a: Setting SevLiveMigrationEnabled variable, status = %lx\n", DEBUG_INFO. Thanks, Tom > + __FUNCTION__, > + Status > + )); > + } > +} > diff --git a/OvmfPkg/PlatformDxe/Platform.c b/OvmfPkg/PlatformDxe/Platform.c > index f2e51960ce..f61302d98b 100644 > --- a/OvmfPkg/PlatformDxe/Platform.c > +++ b/OvmfPkg/PlatformDxe/Platform.c > @@ -763,6 +763,11 @@ PlatformInit ( > { > EFI_STATUS Status; > > + // > + // Set Amd Sev configuation > + // > + AmdSevSetConfig(); > + > ExecutePlatformConfig (); > > mConfigAccess.ExtractConfig = &ExtractConfig; > diff --git a/OvmfPkg/PlatformDxe/Platform.inf > b/OvmfPkg/PlatformDxe/Platform.inf > index 14727c1220..2896f0a1d1 100644 > --- a/OvmfPkg/PlatformDxe/Platform.inf > +++ b/OvmfPkg/PlatformDxe/Platform.inf > @@ -24,6 +24,7 @@ > PlatformConfig.c > PlatformConfig.h > PlatformForms.vfr > + AmdSev.c > > [Packages] > MdePkg/MdePkg.dec > @@ -56,6 +57,7 @@ > [Guids] > gEfiIfrTianoGuid > gOvmfPlatformConfigGuid > + gMemEncryptGuid > > [Depex] > gEfiHiiConfigRoutingProtocolGuid AND > diff --git a/OvmfPkg/PlatformDxe/PlatformConfig.h > b/OvmfPkg/PlatformDxe/PlatformConfig.h > index 716514da21..4f662aafa4 100644 > --- a/OvmfPkg/PlatformDxe/PlatformConfig.h > +++ b/OvmfPkg/PlatformDxe/PlatformConfig.h > @@ -44,6 +44,11 @@ PlatformConfigLoad ( > OUT UINT64 *OptionalElements > ); > > +VOID > +AmdSevSetConfig( > + VOID > + ); > + > // > // Feature flags for OptionalElements. > // > -=-=-=-=-=-=-=-=-=-=-=- Groups.io Links: You receive all messages sent to this group. View/Reply Online (#76876): https://edk2.groups.io/g/devel/message/76876 Mute This Topic: https://groups.io/mt/83688901/21656 Group Owner: devel+ow...@edk2.groups.io Unsubscribe: https://edk2.groups.io/g/devel/unsub [arch...@mail-archive.com] -=-=-=-=-=-=-=-=-=-=-=-