diff options
Diffstat (limited to 'OvmfPkg/Library')
11 files changed, 326 insertions, 28 deletions
diff --git a/OvmfPkg/Library/BaseMemEncryptSevLib/DxeMemEncryptSevLibInternal.c b/OvmfPkg/Library/BaseMemEncryptSevLib/DxeMemEncryptSevLibInternal.c index 4aba0075b9..9947d663de 100644 --- a/OvmfPkg/Library/BaseMemEncryptSevLib/DxeMemEncryptSevLibInternal.c +++ b/OvmfPkg/Library/BaseMemEncryptSevLib/DxeMemEncryptSevLibInternal.c @@ -40,19 +40,25 @@ AmdMemEncryptionAttrCheck ( IN CONFIDENTIAL_COMPUTING_GUEST_ATTR Attr
)
{
+ UINT64 CurrentLevel;
+
+ CurrentLevel = CurrentAttr & CCAttrTypeMask;
+
switch (Attr) {
case CCAttrAmdSev:
//
// SEV is automatically enabled if SEV-ES or SEV-SNP is active.
//
- return CurrentAttr >= CCAttrAmdSev;
+ return CurrentLevel >= CCAttrAmdSev;
case CCAttrAmdSevEs:
//
// SEV-ES is automatically enabled if SEV-SNP is active.
//
- return CurrentAttr >= CCAttrAmdSevEs;
+ return CurrentLevel >= CCAttrAmdSevEs;
case CCAttrAmdSevSnp:
- return CurrentAttr == CCAttrAmdSevSnp;
+ return CurrentLevel == CCAttrAmdSevSnp;
+ case CCAttrFeatureAmdSevEsDebugVirtualization:
+ return !!(CurrentAttr & CCAttrFeatureAmdSevEsDebugVirtualization);
default:
return FALSE;
}
@@ -159,3 +165,18 @@ MemEncryptSevGetEncryptionMask ( return mSevEncryptionMask;
}
+
+/**
+ Returns a boolean to indicate whether DebugVirtualization is enabled.
+
+ @retval TRUE DebugVirtualization is enabled
+ @retval FALSE DebugVirtualization is not enabled
+**/
+BOOLEAN
+EFIAPI
+MemEncryptSevEsDebugVirtualizationIsEnabled (
+ VOID
+ )
+{
+ return ConfidentialComputingGuestHas (CCAttrFeatureAmdSevEsDebugVirtualization);
+}
diff --git a/OvmfPkg/Library/BaseMemEncryptSevLib/PeiMemEncryptSevLibInternal.c b/OvmfPkg/Library/BaseMemEncryptSevLib/PeiMemEncryptSevLibInternal.c index 41d1246a5b..f381b9255b 100644 --- a/OvmfPkg/Library/BaseMemEncryptSevLib/PeiMemEncryptSevLibInternal.c +++ b/OvmfPkg/Library/BaseMemEncryptSevLib/PeiMemEncryptSevLibInternal.c @@ -141,3 +141,22 @@ MemEncryptSevGetEncryptionMask ( return SevEsWorkArea->EncryptionMask;
}
+
+/**
+ Returns a boolean to indicate whether DebugVirtualization is enabled.
+
+ @retval TRUE DebugVirtualization is enabled
+ @retval FALSE DebugVirtualization is not enabled
+**/
+BOOLEAN
+EFIAPI
+MemEncryptSevEsDebugVirtualizationIsEnabled (
+ VOID
+ )
+{
+ MSR_SEV_STATUS_REGISTER Msr;
+
+ Msr.Uint32 = InternalMemEncryptSevStatus ();
+
+ return Msr.Bits.DebugVirtualization ? TRUE : FALSE;
+}
diff --git a/OvmfPkg/Library/BaseMemEncryptSevLib/SecMemEncryptSevLibInternal.c b/OvmfPkg/Library/BaseMemEncryptSevLib/SecMemEncryptSevLibInternal.c index 27148c7e33..946bed2ada 100644 --- a/OvmfPkg/Library/BaseMemEncryptSevLib/SecMemEncryptSevLibInternal.c +++ b/OvmfPkg/Library/BaseMemEncryptSevLib/SecMemEncryptSevLibInternal.c @@ -143,6 +143,25 @@ MemEncryptSevGetEncryptionMask ( }
/**
+ Returns a boolean to indicate whether DebugVirtualization is enabled.
+
+ @retval TRUE DebugVirtualization is enabled
+ @retval FALSE DebugVirtualization is not enabled
+**/
+BOOLEAN
+EFIAPI
+MemEncryptSevEsDebugVirtualizationIsEnabled (
+ VOID
+ )
+{
+ MSR_SEV_STATUS_REGISTER Msr;
+
+ Msr.Uint32 = InternalMemEncryptSevStatus ();
+
+ return Msr.Bits.DebugVirtualization ? TRUE : FALSE;
+}
+
+/**
Locate the page range that covers the initial (pre-SMBASE-relocation) SMRAM
Save State Map.
diff --git a/OvmfPkg/Library/BlobVerifierLibNull/BlobVerifierNull.c b/OvmfPkg/Library/BlobVerifierLibNull/BlobVerifierNull.c index e817c3cc95..db5320571c 100644 --- a/OvmfPkg/Library/BlobVerifierLibNull/BlobVerifierNull.c +++ b/OvmfPkg/Library/BlobVerifierLibNull/BlobVerifierNull.c @@ -16,18 +16,21 @@ @param[in] BlobName The name of the blob
@param[in] Buf The data of the blob
@param[in] BufSize The size of the blob in bytes
+ @param[in] FetchStatus The status of the fetch of this blob
- @retval EFI_SUCCESS The blob was verified successfully.
- @retval EFI_ACCESS_DENIED The blob could not be verified, and therefore
- should be considered non-secure.
+ @retval EFI_SUCCESS The blob was verified successfully or was not
+ found in the hash table.
+ @retval EFI_ACCESS_DENIED Kernel hashes not supported but the boot can
+ continue safely.
**/
EFI_STATUS
EFIAPI
VerifyBlob (
IN CONST CHAR16 *BlobName,
IN CONST VOID *Buf,
- IN UINT32 BufSize
+ IN UINT32 BufSize,
+ IN EFI_STATUS FetchStatus
)
{
- return EFI_SUCCESS;
+ return FetchStatus;
}
diff --git a/OvmfPkg/Library/CcExitLib/CcExitVcHandler.c b/OvmfPkg/Library/CcExitLib/CcExitVcHandler.c index da8f1e5db9..2031fa9e22 100644 --- a/OvmfPkg/Library/CcExitLib/CcExitVcHandler.c +++ b/OvmfPkg/Library/CcExitLib/CcExitVcHandler.c @@ -1609,6 +1609,10 @@ Dr7WriteExit ( UINT64 *Register;
UINT64 Status;
+ if (MemEncryptSevEsDebugVirtualizationIsEnabled ()) {
+ return UnsupportedExit (Ghcb, Regs, InstructionData);
+ }
+
Ext = &InstructionData->Ext;
SevEsData = (SEV_ES_PER_CPU_DATA *)(Ghcb + 1);
@@ -1659,6 +1663,10 @@ Dr7ReadExit ( SEV_ES_PER_CPU_DATA *SevEsData;
UINT64 *Register;
+ if (MemEncryptSevEsDebugVirtualizationIsEnabled ()) {
+ return UnsupportedExit (Ghcb, Regs, InstructionData);
+ }
+
Ext = &InstructionData->Ext;
SevEsData = (SEV_ES_PER_CPU_DATA *)(Ghcb + 1);
diff --git a/OvmfPkg/Library/FdtNorFlashQemuLib/FdtNorFlashQemuLib.c b/OvmfPkg/Library/FdtNorFlashQemuLib/FdtNorFlashQemuLib.c new file mode 100644 index 0000000000..e5c7d4cdfa --- /dev/null +++ b/OvmfPkg/Library/FdtNorFlashQemuLib/FdtNorFlashQemuLib.c @@ -0,0 +1,165 @@ +/** @file
+
+ Copyright (c) 2014-2018, Linaro Ltd. All rights reserved.<BR>
+ Copyright (c) 2024 Loongson Technology Corporation Limited. All rights reserved.<BR>
+
+ SPDX-License-Identifier: BSD-2-Clause-Patent
+
+**/
+
+#include <Library/BaseLib.h>
+#include <Library/DebugLib.h>
+#include <Library/UefiBootServicesTableLib.h>
+#include <Library/VirtNorFlashPlatformLib.h>
+
+#include <Protocol/FdtClient.h>
+#include <stdbool.h>
+
+#define QEMU_NOR_BLOCK_SIZE SIZE_256KB
+#define MAX_FLASH_BANKS 4
+
+STATIC VIRT_NOR_FLASH_DESCRIPTION mNorFlashDevices[MAX_FLASH_BANKS];
+
+EFI_STATUS
+VirtNorFlashPlatformInitialization (
+ VOID
+ )
+{
+ return EFI_SUCCESS;
+}
+
+EFI_STATUS
+VirtNorFlashPlatformGetDevices (
+ OUT VIRT_NOR_FLASH_DESCRIPTION **NorFlashDescriptions,
+ OUT UINT32 *Count
+ )
+{
+ FDT_CLIENT_PROTOCOL *FdtClient;
+ INT32 Node;
+ EFI_STATUS Status;
+ EFI_STATUS FindNodeStatus;
+ CONST UINT32 *Reg;
+ UINT32 PropSize;
+ UINT32 Num;
+ UINT64 Base;
+ UINT64 Size;
+ BOOLEAN Found;
+
+ Status = gBS->LocateProtocol (
+ &gFdtClientProtocolGuid,
+ NULL,
+ (VOID **)&FdtClient
+ );
+ ASSERT_EFI_ERROR (Status);
+
+ Num = 0;
+ Found = FALSE;
+ for (FindNodeStatus = FdtClient->FindCompatibleNode (
+ FdtClient,
+ "cfi-flash",
+ &Node
+ );
+ !EFI_ERROR (FindNodeStatus) && Num < MAX_FLASH_BANKS;
+ FindNodeStatus = FdtClient->FindNextCompatibleNode (
+ FdtClient,
+ "cfi-flash",
+ Node,
+ &Node
+ ))
+ {
+ Status = FdtClient->GetNodeProperty (
+ FdtClient,
+ Node,
+ "reg",
+ (CONST VOID **)&Reg,
+ &PropSize
+ );
+ if (EFI_ERROR (Status)) {
+ DEBUG ((
+ DEBUG_ERROR,
+ "%a: GetNodeProperty () failed (Status == %r)\n",
+ __func__,
+ Status
+ ));
+ continue;
+ }
+
+ ASSERT ((PropSize % (4 * sizeof (UINT32))) == 0);
+
+ while (PropSize >= (4 * sizeof (UINT32)) && Num < MAX_FLASH_BANKS) {
+ Base = SwapBytes64 (ReadUnaligned64 ((VOID *)&Reg[0]));
+ Size = SwapBytes64 (ReadUnaligned64 ((VOID *)&Reg[2]));
+ Reg += 4;
+
+ PropSize -= 4 * sizeof (UINT32);
+
+ //
+ // Disregard any flash devices that overlap with the primary FV.
+ // The firmware is not updatable from inside the guest anyway.
+ //
+ if ((PcdGet32 (PcdOvmfFdBaseAddress) + PcdGet32 (PcdOvmfFirmwareFdSize) > Base) &&
+ ((Base + Size) > PcdGet32 (PcdOvmfFdBaseAddress)))
+ {
+ continue;
+ }
+
+ mNorFlashDevices[Num].DeviceBaseAddress = (UINTN)Base;
+ mNorFlashDevices[Num].RegionBaseAddress = (UINTN)Base;
+ mNorFlashDevices[Num].Size = (UINTN)Size;
+ mNorFlashDevices[Num].BlockSize = QEMU_NOR_BLOCK_SIZE;
+ Num++;
+ if (!Found) {
+ //
+ // By default, the second available flash is stored as a non-volatile variable.
+ //
+ Status = PcdSet32S (PcdFlashNvStorageVariableBase, Base);
+ ASSERT_EFI_ERROR (Status);
+
+ //
+ // The Base is the value of PcdFlashNvStorageVariableBase,
+ // PcdFlashNvStorageFtwWorkingBase can be got by
+ // PcdFlashNvStorageVariableBase + PcdFlashNvStorageVariableSize
+ //
+ Base += PcdGet32 (PcdFlashNvStorageVariableSize);
+ Status = PcdSet32S (PcdFlashNvStorageFtwWorkingBase, Base);
+ ASSERT_EFI_ERROR (Status);
+
+ //
+ // Now, the Base is the value of PcdFlashNvStorageFtwWorkingBase,
+ // PcdFlashNvStorageFtwSpareBase can be got by
+ // PcdFlashNvStorageFtwWorkingBase + PcdFlashNvStorageFtwWorkingSize.
+ //
+ Base += PcdGet32 (PcdFlashNvStorageFtwWorkingSize);
+ Status = PcdSet32S (PcdFlashNvStorageFtwSpareBase, Base);
+ ASSERT_EFI_ERROR (Status);
+ Found = TRUE;
+ }
+ }
+
+ //
+ // UEFI takes ownership of the NOR flash, and exposes its functionality
+ // through the UEFI Runtime Services GetVariable, SetVariable, etc. This
+ // means we need to disable it in the device tree to prevent the OS from
+ // attaching its device driver as well.
+ // Note that this also hides other flash banks, but the only other flash
+ // bank we expect to encounter is the one that carries the UEFI executable
+ // code, which is not intended to be guest updatable, and is usually backed
+ // in a readonly manner by QEMU anyway.
+ //
+ Status = FdtClient->SetNodeProperty (
+ FdtClient,
+ Node,
+ "status",
+ "disabled",
+ sizeof ("disabled")
+ );
+ if (EFI_ERROR (Status)) {
+ DEBUG ((DEBUG_WARN, "Failed to set NOR flash status to 'disabled'\n"));
+ }
+ }
+
+ *NorFlashDescriptions = mNorFlashDevices;
+ *Count = Num;
+
+ return EFI_SUCCESS;
+}
diff --git a/OvmfPkg/Library/FdtNorFlashQemuLib/FdtNorFlashQemuLib.inf b/OvmfPkg/Library/FdtNorFlashQemuLib/FdtNorFlashQemuLib.inf new file mode 100644 index 0000000000..14ddb4c11e --- /dev/null +++ b/OvmfPkg/Library/FdtNorFlashQemuLib/FdtNorFlashQemuLib.inf @@ -0,0 +1,46 @@ +## @file
+#
+# Copyright (c) 2014-2018, Linaro Ltd. All rights reserved.<BR>
+# Copyright (c) 2024 Loongson Technology Corporation Limited. All rights reserved.<BR>
+#
+# SPDX-License-Identifier: BSD-2-Clause-Patent
+#
+##
+
+[Defines]
+ INF_VERSION = 1.29
+ BASE_NAME = NorFlashQemuLib
+ FILE_GUID = E225C90F-6CB9-8AF3-095B-2668FC633A57
+ MODULE_TYPE = DXE_DRIVER
+ VERSION_STRING = 1.0
+ LIBRARY_CLASS = NorFlashQemuLib|DXE_DRIVER DXE_RUNTIME_DRIVER UEFI_DRIVER UEFI_APPLICATION
+
+[Sources]
+ FdtNorFlashQemuLib.c
+
+[Packages]
+ EmbeddedPkg/EmbeddedPkg.dec
+ MdePkg/MdePkg.dec
+ MdeModulePkg/MdeModulePkg.dec
+ OvmfPkg/OvmfPkg.dec
+
+[LibraryClasses]
+ BaseLib
+ DebugLib
+ UefiBootServicesTableLib
+
+[Protocols]
+ gFdtClientProtocolGuid ## CONSUMES
+
+[Depex]
+ gFdtClientProtocolGuid
+
+[Pcd]
+gUefiOvmfPkgTokenSpaceGuid.PcdOvmfFdBaseAddress
+gUefiOvmfPkgTokenSpaceGuid.PcdOvmfFirmwareFdSize
+gEfiMdeModulePkgTokenSpaceGuid.PcdFlashNvStorageVariableSize
+gEfiMdeModulePkgTokenSpaceGuid.PcdFlashNvStorageFtwSpareSize
+gEfiMdeModulePkgTokenSpaceGuid.PcdFlashNvStorageFtwWorkingSize
+gEfiMdeModulePkgTokenSpaceGuid.PcdFlashNvStorageVariableBase
+gEfiMdeModulePkgTokenSpaceGuid.PcdFlashNvStorageFtwWorkingBase
+gEfiMdeModulePkgTokenSpaceGuid.PcdFlashNvStorageFtwSpareBase
diff --git a/OvmfPkg/Library/HardwareInfoLib/HardwareInfoDxe.c b/OvmfPkg/Library/HardwareInfoLib/HardwareInfoDxe.c index 5a1a69dcc3..b4dc927a0e 100644 --- a/OvmfPkg/Library/HardwareInfoLib/HardwareInfoDxe.c +++ b/OvmfPkg/Library/HardwareInfoLib/HardwareInfoDxe.c @@ -89,7 +89,7 @@ FreeResources: FailedAllocate:
DEBUG ((
- EFI_D_ERROR,
+ DEBUG_ERROR,
"%a: Failed to allocate memory for hardware info\n",
__func__
));
diff --git a/OvmfPkg/Library/PlatformBootManagerLibBhyve/BdsPlatform.c b/OvmfPkg/Library/PlatformBootManagerLibBhyve/BdsPlatform.c index ac9c02cb1c..4489eaae0b 100644 --- a/OvmfPkg/Library/PlatformBootManagerLibBhyve/BdsPlatform.c +++ b/OvmfPkg/Library/PlatformBootManagerLibBhyve/BdsPlatform.c @@ -1433,7 +1433,8 @@ PlatformBdsConnectSequence ( VOID
)
{
- UINTN Index;
+ UINTN Index;
+ RETURN_STATUS Status;
DEBUG ((DEBUG_INFO, "PlatformBdsConnectSequence\n"));
@@ -1452,11 +1453,14 @@ PlatformBdsConnectSequence ( Index++;
}
- //
- // Just use the simple policy to connect all devices
- //
- DEBUG ((DEBUG_INFO, "EfiBootManagerConnectAll\n"));
- EfiBootManagerConnectAll ();
+ Status = ConnectDevicesFromQemu ();
+ if (RETURN_ERROR (Status)) {
+ //
+ // Just use the simple policy to connect all devices
+ //
+ DEBUG ((DEBUG_INFO, "EfiBootManagerConnectAll\n"));
+ EfiBootManagerConnectAll ();
+ }
}
/**
@@ -1581,6 +1585,7 @@ PlatformBootManagerAfterConsole ( );
RemoveStaleFvFileOptions ();
+ SetBootOrderFromQemu ();
PlatformBmPrintScRegisterHandler ();
}
diff --git a/OvmfPkg/Library/PlatformBootManagerLibBhyve/PlatformBootManagerLibBhyve.inf b/OvmfPkg/Library/PlatformBootManagerLibBhyve/PlatformBootManagerLibBhyve.inf index c1fb5119ef..abfe4f97e4 100644 --- a/OvmfPkg/Library/PlatformBootManagerLibBhyve/PlatformBootManagerLibBhyve.inf +++ b/OvmfPkg/Library/PlatformBootManagerLibBhyve/PlatformBootManagerLibBhyve.inf @@ -46,6 +46,7 @@ BootLogoLib
DevicePathLib
PciLib
+ QemuBootOrderLib
NvVarsFileLib
ReportStatusCodeLib
UefiLib
diff --git a/OvmfPkg/Library/PlatformInitLib/MemDetect.c b/OvmfPkg/Library/PlatformInitLib/MemDetect.c index e64c0ee324..bd6c79e4e4 100644 --- a/OvmfPkg/Library/PlatformInitLib/MemDetect.c +++ b/OvmfPkg/Library/PlatformInitLib/MemDetect.c @@ -633,6 +633,7 @@ PlatformAddressWidthFromCpuid ( {
UINT32 RegEax, RegEbx, RegEcx, RegEdx, Max;
UINT8 PhysBits;
+ UINT8 GuestPhysBits;
CHAR8 Signature[13];
IA32_CR4 Cr4;
BOOLEAN Valid = FALSE;
@@ -655,13 +656,17 @@ PlatformAddressWidthFromCpuid ( if (Max >= 0x80000008) {
AsmCpuid (0x80000008, &RegEax, NULL, NULL, NULL);
- PhysBits = (UINT8)RegEax;
+ PhysBits = (UINT8)RegEax;
+ GuestPhysBits = (UINT8)(RegEax >> 16);
} else {
- PhysBits = 36;
+ PhysBits = 36;
+ GuestPhysBits = 0;
}
if (!QemuQuirk) {
Valid = TRUE;
+ } else if (GuestPhysBits) {
+ Valid = TRUE;
} else if (PhysBits >= 41) {
Valid = TRUE;
} else if (AsciiStrCmp (Signature, "GenuineIntel") == 0) {
@@ -678,15 +683,21 @@ PlatformAddressWidthFromCpuid ( DEBUG ((
DEBUG_INFO,
- "%a: Signature: '%a', PhysBits: %d, QemuQuirk: %a, la57: %a, Valid: %a\n",
+ "%a: Signature: '%a', PhysBits: %d, GuestPhysBits: %d, QemuQuirk: %a, la57: %a, Valid: %a\n",
__func__,
Signature,
PhysBits,
+ GuestPhysBits,
QemuQuirk ? "On" : "Off",
Cr4.Bits.LA57 ? "On" : "Off",
Valid ? "Yes" : "No"
));
+ if (GuestPhysBits && (PhysBits > GuestPhysBits)) {
+ DEBUG ((DEBUG_INFO, "%a: limit PhysBits to %d (GuestPhysBits)\n", __func__, GuestPhysBits));
+ PhysBits = GuestPhysBits;
+ }
+
if (Valid) {
/*
* Due to the sign extension we can use only the lower half of the
@@ -695,7 +706,7 @@ PlatformAddressWidthFromCpuid ( * and a 56 bit wide address space with 5 paging levels.
*/
if (Cr4.Bits.LA57) {
- if (PhysBits > 48) {
+ if ((PhysBits > 48) && !GuestPhysBits) {
/*
* Some Intel CPUs support 5-level paging, have more than 48
* phys-bits but support only 4-level EPT, which effectively
@@ -705,11 +716,11 @@ PlatformAddressWidthFromCpuid ( * problem: They can handle guest phys-bits larger than 48
* only in case the host runs in 5-level paging mode.
*
- * Until we have some way to communicate that kind of
- * limitations from hypervisor to guest, limit phys-bits
- * to 48 unconditionally.
+ * GuestPhysBits is used to communicate that kind of
+ * limitations from hypervisor to guest. If GuestPhysBits is
+ * not set play safe and limit phys-bits to 48.
*/
- DEBUG ((DEBUG_INFO, "%a: limit PhysBits to 48 (5-level paging)\n", __func__));
+ DEBUG ((DEBUG_INFO, "%a: limit PhysBits to 48 (5-level paging, no GuestPhysBits)\n", __func__));
PhysBits = 48;
}
} else {
@@ -1164,18 +1175,18 @@ PlatformQemuInitializeRam ( MtrrGetAllMtrrs (&MtrrSettings);
//
- // MTRRs disabled, fixed MTRRs disabled, default type is uncached
+ // See SecMtrrSetup(), default type should be write back
//
- ASSERT ((MtrrSettings.MtrrDefType & BIT11) == 0);
+ ASSERT ((MtrrSettings.MtrrDefType & BIT11) != 0);
ASSERT ((MtrrSettings.MtrrDefType & BIT10) == 0);
- ASSERT ((MtrrSettings.MtrrDefType & 0xFF) == 0);
+ ASSERT ((MtrrSettings.MtrrDefType & 0xFF) == MTRR_CACHE_WRITE_BACK);
//
// flip default type to writeback
//
- SetMem (&MtrrSettings.Fixed, sizeof MtrrSettings.Fixed, 0x06);
+ SetMem (&MtrrSettings.Fixed, sizeof MtrrSettings.Fixed, MTRR_CACHE_WRITE_BACK);
ZeroMem (&MtrrSettings.Variables, sizeof MtrrSettings.Variables);
- MtrrSettings.MtrrDefType |= BIT11 | BIT10 | 6;
+ MtrrSettings.MtrrDefType |= BIT10;
MtrrSetAllMtrrs (&MtrrSettings);
//
|