Tianocore/edk2.git/OvmfPkg/Library/BaseMemEncryptSevLib, branch dependabot/github_actions/actions/github-script-8

OvmfPkg: Remove OVMF IA32

2025-09-09T18:49:32+00:00

This commit removes OVMF IA32 from edk2 per RFC https://edk2.groups.io/g/devel/topic/rfc_remove_ovmf_ia32_and/114152215. OVMF IA32 is a 32 bit only platform that no longer represents the vast majority of physical platforms. The RFC details more reasoning in much more depth. OVMF IA32 will be kept in a branch off the edk2-stable202508 tag for any long term consumers; it will receive build break updates only (e.g. if an upstream submodule changes location). Signed-off-by: Oliver Smith-Denny

OvmfPkg/MemEncryptSevLib: Check if SEV-SNP coherency mitigitation is needed

2025-09-09T17:43:31+00:00

CPUID bit Fn8000001F_EBX[31] defines the COHERNECY_SFW_NO CPUID bit that, when set, indicates that the software mitigation for this vulnerability is not needed. Add support to check for this CPUID bit and avoid the mitigation if set. Signed-off-by: Tom Lendacky

OvmfPkg/MemEncryptSevLib: Evict cache lines during SNP memory validation

2025-09-09T17:43:31+00:00

An SNP cache coherency vulnerability may require a mitigation to evict cache lines after memory has been validated. Perform this mitigation after having validated memory. CVE-2024-36331 Signed-off-by: Michael Roth Co-developed-by: Tom Lendacky Signed-off-by: Tom Lendacky

OvmfPkg: Enable AMD SEV-ES DebugVirtualization

2024-07-04T20:39:26+00:00

Write the feature bit into PcdConfidentialComputingGuestAttr and enable DebugVirtualization in PEI, SEC, DXE. Cc: Ard Biesheuvel Cc: Erdem Aktas Cc: Gerd Hoffmann Cc: Jiewen Yao Cc: Michael Roth Cc: Min Xu Reviewed-by: Tom Lendacky Signed-off-by: Alexey Kardashevskiy --- Changes: v5: * "rb" from Tom v4: * s/DebugSwap/DebugVirtualization/g

OvmfPkg: Add AMD SEV-ES DebugVirtualization feature support

2024-07-04T20:39:26+00:00

The SEV-ES DebugVirtualization feature enables type B swapping of debug registers on #VMEXIT and makes #DB and DR7 intercepts unnecessary and unwanted. When DebugVirtualization is enabled, this stops booting if interaction from the HV. Add new API to PEI, SEC, DXE. This does not change the existing behaviour yet. Cc: Ard Biesheuvel Cc: Erdem Aktas Cc: Gerd Hoffmann Cc: Jiewen Yao Cc: Michael Roth Cc: Min Xu Reviewed-by: Tom Lendacky Signed-off-by: Alexey Kardashevskiy --- Changes: v5: * "rb" from Tom v4: * s/DebugSwap/DebugVirtualization/

OvmfPkg/BaseMemEncryptLib: Check for presence of an SVSM when not at VMPL0

2024-04-17T20:04:41+00:00

BZ: https://bugzilla.tianocore.org/show_bug.cgi?id=4654 Currently, an SEV-SNP guest will terminate if it is not running at VMPL0. The requirement for running at VMPL0 is removed if an SVSM is present. Update the current VMPL0 check to additionally check for the presence of an SVSM is the guest is not running at VMPL0. Cc: Ard Biesheuvel Cc: Erdem Aktas Cc: Gerd Hoffmann Cc: Jiewen Yao Cc: Laszlo Ersek Cc: Michael Roth Cc: Min Xu Acked-by: Gerd Hoffmann Signed-off-by: Tom Lendacky

OvmfPkg/BaseMemEncryptSevLib: Maximize Page State Change efficiency

2024-04-17T20:04:41+00:00

BZ: https://bugzilla.tianocore.org/show_bug.cgi?id=4654 Similar to the Page State Change optimization added previously, also take into account the possiblity of using the SVSM for PVALIDATE instructions. Conditionally adjust the maximum number of entries based on how many entries the SVSM calling area can support. Cc: Ard Biesheuvel Cc: Erdem Aktas Cc: Gerd Hoffmann Cc: Jiewen Yao Cc: Laszlo Ersek Cc: Michael Roth Cc: Min Xu Acked-by: Gerd Hoffmann Signed-off-by: Tom Lendacky

OvmfPkg/BaseMemEncryptSevLib: Use AmdSvsmSnpPvalidate() to validate pages

2024-04-17T20:04:41+00:00

BZ: https://bugzilla.tianocore.org/show_bug.cgi?id=4654 The PVALIDATE instruction is used to change the SNP validation of a page, but that can only be done when running at VMPL0. To prepare for running at a less priviledged VMPL, use the AmdSvsmLib library API to perform the PVALIDATE. The AmdSvsmLib library will perform the proper operation on behalf of the caller. Cc: Ard Biesheuvel Cc: Erdem Aktas Cc: Gerd Hoffmann Cc: Jiewen Yao Cc: Laszlo Ersek Cc: Michael Roth Cc: Min Xu Signed-off-by: Tom Lendacky Acked-by: Gerd Hoffmann

OvmfPkg/BaseMemEncryptSevLib: Maximize Page State Change efficiency

2024-04-17T18:30:03+00:00

BZ: https://bugzilla.tianocore.org/show_bug.cgi?id=4654 When building the Page State Change entries for a range of memory, it can happen that multiple calls to BuildPageStateBuffer() need to be made. If the size of the input work area passed to BuildPageStateBuffer() exceeds the number of entries that can be passed to the hypervisor using the GHCB shared buffer, the Page State Change VMGEXIT support will issue multiple VMGEXITs to process all entries in the buffer. However, it could be that the final VMGEXIT for each round of Page State Changes is only for a small number of entries and subsequent VMGEXITs may still be issued to handle the full range of memory requested. To maximize the number of entries processed during the Page State Change VMGEXIT, limit BuildPageStateBuffer() to not build entries that exceed the maximum number of entries that can be handled in a single Page State Change VMGEXIT. Cc: Ard Biesheuvel Cc: Erdem Aktas Cc: Gerd Hoffmann Cc: Jiewen Yao Cc: Laszlo Ersek Cc: Michael Roth Cc: Min Xu Reviewed-by: Gerd Hoffmann Signed-off-by: Tom Lendacky

OvmfPkg/BaseMemEncryptSevLib: Re-organize page state change support

2024-04-17T18:30:03+00:00

BZ: https://bugzilla.tianocore.org/show_bug.cgi?id=4654 In preparation for running under an SVSM at VMPL1 or higher (higher numerically, lower privilege), re-organize the way a page state change is performed in order to free up the GHCB for use by the SVSM support. Currently, the page state change logic directly uses the GHCB shared buffer to build the page state change structures. However, this will be in conflict with the use of the GHCB should an SVSM call be required. Instead, use a separate buffer (an area in the workarea during SEC and an allocated page during PEI/DXE) to hold the page state change request and only update the GHCB shared buffer as needed. Since the information is copied to, and operated on, in the GHCB shared buffer this has the added benefit of not requiring to save the start and end entries for use when validating the memory during the page state change sequence. Cc: Ard Biesheuvel Cc: Erdem Aktas Cc: Gerd Hoffmann Cc: Jiewen Yao Cc: Laszlo Ersek Cc: Michael Roth Cc: Min Xu Signed-off-by: Tom Lendacky Acked-by: Gerd Hoffmann