MdePkg: Add code to detect running as an SEV guest Similar to Intel's Tdx, we need a mechanism to detect running as an AMD SEV guest that will work in all phases everywhere. This will be immediately used to prevent usage of MTRRs with SEV guests. Signed-off-by: Richard Relph <richard.relph@amd.com>
diff --git a/MdePkg/Include/Library/BaseLib.h b/MdePkg/Include/Library/BaseLib.h index b50a1d5..a2b5b01 100644 --- a/MdePkg/Include/Library/BaseLib.h +++ b/MdePkg/Include/Library/BaseLib.h
@@ -5396,6 +5396,18 @@ VOID ); +/** + Probe if running as some kind of SEV guest. + + @return FALSE Not running as a guest under any kind of SEV + @return TRUE Running as a guest under any kind of SEV +**/ +BOOLEAN +EFIAPI +SevGuestIsEnabled ( + VOID + ); + #if defined (MDE_CPU_X64) // // The page size for the PVALIDATE instruction
diff --git a/MdePkg/Library/BaseLib/AmdSevNull.c b/MdePkg/Library/BaseLib/AmdSevNull.c new file mode 100644 index 0000000..7610b6e --- /dev/null +++ b/MdePkg/Library/BaseLib/AmdSevNull.c
@@ -0,0 +1,26 @@ +/** @file + + Null stub of SevLib + + Copyright (c) 2025, Advanced Micro Devices, Inc. All rights reserved.<BR> + SPDX-License-Identifier: BSD-2-Clause-Patent + +**/ + +#include <Library/BaseLib.h> +#include <Uefi/UefiBaseType.h> + +/** + Probe if running as some kind of SEV guest. + + @return FALSE Not running as a guest under any kind of SEV + @return TRUE Running as a guest under any kind of SEV +**/ +BOOLEAN +EFIAPI +SevGuestIsEnabled ( + VOID + ) +{ + return FALSE; +}
diff --git a/MdePkg/Library/BaseLib/BaseLib.inf b/MdePkg/Library/BaseLib/BaseLib.inf index 7925d8c..aa067a7 100644 --- a/MdePkg/Library/BaseLib/BaseLib.inf +++ b/MdePkg/Library/BaseLib/BaseLib.inf
@@ -213,6 +213,7 @@ X86PatchInstruction.c X86SpeculationBarrier.c IntelTdxNull.c + X64/SevProbe.c [Sources.X64] X64/Thunk16.nasm @@ -299,6 +300,7 @@ X64/TdCall.nasm X64/TdVmcall.nasm X64/TdProbe.c + X64/SevProbe.c X64/Non-existing.c Math64.c @@ -340,6 +342,7 @@ Unaligned.c Math64.c IntelTdxNull.c + AmdSevNull.c [Sources.AARCH64] AArch64/InternalSwitchStack.c @@ -368,6 +371,7 @@ AArch64/ArmReadCntPctReg.asm | MSFT AArch64/ArmReadIdAA64Isar0Reg.asm | MSFT IntelTdxNull.c + AmdSevNull.c [Sources.RISCV64] Math64.c @@ -390,6 +394,7 @@ RiscV64/RiscVMmu.S | GCC RiscV64/SpeculationBarrier.S | GCC IntelTdxNull.c + AmdSevNull.c [Sources.LOONGARCH64] Math64.c @@ -411,6 +416,7 @@ LoongArch64/Cpucfg.S | GCC LoongArch64/ReadStableCounter.S | GCC IntelTdxNull.c + AmdSevNull.c [Packages] MdePkg/MdePkg.dec
diff --git a/MdePkg/Library/BaseLib/UnitTestHostBaseLib.inf b/MdePkg/Library/BaseLib/UnitTestHostBaseLib.inf index 190e3b6..776c7cc 100644 --- a/MdePkg/Library/BaseLib/UnitTestHostBaseLib.inf +++ b/MdePkg/Library/BaseLib/UnitTestHostBaseLib.inf
@@ -130,6 +130,7 @@ X86SpeculationBarrier.c X86UnitTestHost.c IntelTdxNull.c + AmdSevNull.c [Sources.X64] X64/LongJump.nasm @@ -170,6 +171,7 @@ X64/RdRand.nasm X86UnitTestHost.c IntelTdxNull.c + AmdSevNull.c [Sources.EBC] Ebc/CpuBreakpoint.c
diff --git a/MdePkg/Library/BaseLib/X64/SevProbe.c b/MdePkg/Library/BaseLib/X64/SevProbe.c new file mode 100644 index 0000000..2d1ab01 --- /dev/null +++ b/MdePkg/Library/BaseLib/X64/SevProbe.c
@@ -0,0 +1,45 @@ +/** @file + + Copyright (c) 2025, Advanced Micro Devices, Inc. All rights reserved.<BR> + SPDX-License-Identifier: BSD-2-Clause-Patent + +**/ + +#include <Library/BaseLib.h> +#include <Register/Amd/Cpuid.h> +#include <Register/Amd/SevSnpMsr.h> +#include <Register/Intel/Cpuid.h> + +/** + Probe if running as some kind of SEV guest. + + @return FALSE Not running as a guest under any kind of SEV + @return TRUE Running as a guest under any kind of SEV +**/ +BOOLEAN +EFIAPI +SevGuestIsEnabled ( + VOID + ) +{ + UINT32 MaxExtendedLeaf; + MSR_SEV_STATUS_REGISTER SevStatus; + CPUID_MEMORY_ENCRYPTION_INFO_EAX MemoryEncryptionInfoEax; + + // Check max extended CPUID leaf + AsmCpuid (CPUID_EXTENDED_FUNCTION, &MaxExtendedLeaf, NULL, NULL, NULL); + if (MaxExtendedLeaf < CPUID_MEMORY_ENCRYPTION_INFO) { + return FALSE; + } + + // Check SEV support + AsmCpuid (CPUID_MEMORY_ENCRYPTION_INFO, &MemoryEncryptionInfoEax.Uint32, NULL, NULL, NULL); + if (MemoryEncryptionInfoEax.Bits.SevBit == 0) { + return FALSE; + } + + // Read SEV_STATUS MSR + SevStatus.Uint64 = AsmReadMsr64 (MSR_SEV_STATUS); + + return (SevStatus.Bits.SevBit | SevStatus.Bits.SevEsBit | SevStatus.Bits.SevSnpBit) ? TRUE : FALSE; +}