Tianocore/edk2.git/OvmfPkg/Library/BaseMemEncryptSevLib/DxeMemEncryptSevLibInternal.c, branch master

OvmfPkg/BaseMemEncryptSevLib: Fetch Sev data from the work area

2026-08-27T06:37:01+00:00

The first call to MemEncryptSevGetEncryptionMask() in the Dxe phase will look for the encryption mask for the page table entry by reading the PcdPteMemoryEncryptionAddressOrMask (dynamic PCD) token. The value is then cached for subsequent accesses. But if the first call has interrupts disabled, as is the case in the MmioExit function in the #VC handler then the PcdGet64() will re-enable interrupts unexpectedly. A hypervisor may then inject interrupts into the guest whilst the guest is not expected to be interrupted. This leads to the ovmf image hanging when handling too many nested #VC exceptions. This patch avoids using the PcdPteMemoryEncryptionAddressOrMask token in the MemEncryptSevGetEncryptionMask() function as it cannot be called safely from a context where interrupts are disabled. Instead, we fetch the values from the SEC_SEV_ES_WORK_AREA in the Dxe phase. The work area is already used in the Pei phase, and is available in the Dxe phase as it is marked as either EfiBootServicesData or EfiACPIMemoryNVS. However, the work area will be inaccessible when SetVirtualAddressMap() is called, so we only read the work area in the Dxe phase through a constructor function. Signed-off-by: John Berg Signed-off-by: Ivan Orlov

OvmfPkg/BaseMemEncryptSevLib: Make GetSevEsWorkArea() Pei/Dxe shared

2026-08-27T06:37:01+00:00

This is a small refactor to the BaseMemEncryptSevLib in the OvmfPkg which moves the function used in the Pei phase for accessing the SEC_SEV_ES_WORK_AREA, into the common Pei and Dxe code. The Dxe phase will consume the work area in a subsequent patch. Signed-off-by: John Berg

OvmfPkg/MemEncryptSevLib: Check if SEV-SNP coherency mitigitation is needed

2025-09-09T17:43:31+00:00

CPUID bit Fn8000001F_EBX[31] defines the COHERNECY_SFW_NO CPUID bit that, when set, indicates that the software mitigation for this vulnerability is not needed. Add support to check for this CPUID bit and avoid the mitigation if set. Signed-off-by: Tom Lendacky

OvmfPkg: Add AMD SEV-ES DebugVirtualization feature support

2024-07-04T20:39:26+00:00

The SEV-ES DebugVirtualization feature enables type B swapping of debug registers on #VMEXIT and makes #DB and DR7 intercepts unnecessary and unwanted. When DebugVirtualization is enabled, this stops booting if interaction from the HV. Add new API to PEI, SEC, DXE. This does not change the existing behaviour yet. Cc: Ard Biesheuvel Cc: Erdem Aktas Cc: Gerd Hoffmann Cc: Jiewen Yao Cc: Michael Roth Cc: Min Xu Reviewed-by: Tom Lendacky Signed-off-by: Alexey Kardashevskiy --- Changes: v5: * "rb" from Tom v4: * s/DebugSwap/DebugVirtualization/

OvmfPkg/BaseMemEncryptLib: use the SEV_STATUS MSR value from workarea

2022-02-28T02:46:08+00:00

BZ: https://bugzilla.tianocore.org/show_bug.cgi?id=3582 Improve the MemEncryptSev{Es,Snp}IsEnabled() to use the SEV_STATUS MSR value saved in the workarea. Since workarea is valid until the PEI phase, so, for the Dxe phase use the PcdConfidentialComputingGuestAttr to determine which SEV technology is enabled. Cc: Min Xu Cc: Jiewen Yao Cc: Tom Lendacky Cc: Jordan Justen Cc: Ard Biesheuvel Cc: Erdem Aktas Cc: Gerd Hoffmann Acked-by: Gerd Hoffmann Signed-off-by: Brijesh Singh Acked-by: Jiewen Yao

OvmfPkg/MemEncryptSevLib: add MemEncryptSevSnpEnabled()

2021-12-09T06:28:10+00:00

BZ: https://bugzilla.tianocore.org/show_bug.cgi?id=3275 Create a function that can be used to determine if VM is running as an SEV-SNP guest. Cc: Michael Roth Cc: James Bottomley Cc: Min Xu Cc: Jiewen Yao Cc: Tom Lendacky Cc: Jordan Justen Cc: Ard Biesheuvel Cc: Erdem Aktas Cc: Gerd Hoffmann Acked-by: Jiewen Yao Acked-by: Gerd Hoffmann Signed-off-by: Brijesh Singh

OvmfPkg: Apply uncrustify changes

2021-12-07T17:24:28+00:00

REF: https://bugzilla.tianocore.org/show_bug.cgi?id=3737 Apply uncrustify changes to .c/.h files in the OvmfPkg package Cc: Andrew Fish Cc: Leif Lindholm Cc: Michael D Kinney Signed-off-by: Michael Kubacki Reviewed-by: Andrew Fish

OvmfPkg/MemEncryptSevLib: Add an interface to retrieve the encryption mask

2021-01-07T19:34:39+00:00

BZ: https://bugzilla.tianocore.org/show_bug.cgi?id=3108 To ensure that we always use a validated encryption mask for an SEV-ES guest, create a new interface in the MemEncryptSevLib library to return the encryption mask. This can be used in place of the multiple locations where CPUID is used to retrieve the value (which would require validation again) and allows the validated mask to be returned. The PEI phase will use the value from the SEV-ES work area. Since the SEV-ES work area isn't valid in the DXE phase, the DXE phase will use the PcdPteMemoryEncryptionAddressOrMask PCD which is set during PEI. Cc: Jordan Justen Cc: Laszlo Ersek Cc: Ard Biesheuvel Cc: Rebecca Cran Cc: Peter Grehan Cc: Anthony Perard Cc: Julien Grall Cc: Brijesh Singh Acked-by: Laszlo Ersek Signed-off-by: Tom Lendacky Message-Id: