UefiCpuPkg/MpInitLib: use PcdConfidentialComputingAttr to check SEV status

BZ: https://bugzilla.tianocore.org/show_bug.cgi?id=3275

Previous commit introduced a generic confidential computing PCD that can
determine whether AMD SEV-ES is enabled. Update the MpInitLib to drop the
PcdSevEsIsEnabled in favor of PcdConfidentialComputingAttr.

Cc: Michael Roth <michael.roth@amd.com>
Cc: Ray Ni <ray.ni@intel.com>
Cc: Rahul Kumar <rahul1.kumar@intel.com>
Cc: Eric Dong <eric.dong@intel.com>
Cc: James Bottomley <jejb@linux.ibm.com>
Cc: Min Xu <min.m.xu@intel.com>
Cc: Jiewen Yao <jiewen.yao@intel.com>
Cc: Tom Lendacky <thomas.lendacky@amd.com>
Cc: Jordan Justen <jordan.l.justen@intel.com>
Cc: Ard Biesheuvel <ardb+tianocore@kernel.org>
Cc: Erdem Aktas <erdemaktas@google.com>
Cc: Gerd Hoffmann <kraxel@redhat.com>
Acked-by: Gerd Hoffmann <kraxel@redhat.com>
Acked-by: Ray Ni <ray.ni@intel.com>
Suggested-by: Jiewen Yao <jiewen.yao@intel.com>
Signed-off-by: Brijesh Singh <brijesh.singh@amd.com>

diff --git a/UefiCpuPkg/Library/MpInitLib/DxeMpInitLib.inf b/UefiCpuPkg/Library/MpInitLib/DxeMpInitLib.inf
index 6e510aa891207a68c760ff32f1043e5e04e616b6..de705bc54bb42b34bf7d4f03150e1e5b839b160b 100644 (file)
--- a/UefiCpuPkg/Library/MpInitLib/DxeMpInitLib.inf
+++ b/UefiCpuPkg/Library/MpInitLib/DxeMpInitLib.inf
@@ -73,7 +73,7 @@
   gUefiCpuPkgTokenSpaceGuid.PcdCpuApLoopMode                           ## CONSUMES\r
   gUefiCpuPkgTokenSpaceGuid.PcdCpuApTargetCstate                       ## SOMETIMES_CONSUMES\r
   gUefiCpuPkgTokenSpaceGuid.PcdCpuApStatusCheckIntervalInMicroSeconds  ## CONSUMES\r
-  gUefiCpuPkgTokenSpaceGuid.PcdSevEsIsEnabled                          ## CONSUMES\r
   gUefiCpuPkgTokenSpaceGuid.PcdSevEsWorkAreaBase                       ## SOMETIMES_CONSUMES\r
   gEfiMdeModulePkgTokenSpaceGuid.PcdCpuStackGuard                      ## CONSUMES\r
   gEfiMdeModulePkgTokenSpaceGuid.PcdGhcbBase                           ## CONSUMES\r
+  gEfiMdePkgTokenSpaceGuid.PcdConfidentialComputingGuestAttr           ## CONSUMES\r

diff --git a/UefiCpuPkg/Library/MpInitLib/DxeMpLib.c b/UefiCpuPkg/Library/MpInitLib/DxeMpLib.c
index 9d9206d20915bc9d3d3a15b412d210cb142f24c1..02bc9c2bd2c4f763ba471ffb222b0ced8a8cea89 100644 (file)
--- a/UefiCpuPkg/Library/MpInitLib/DxeMpLib.c
+++ b/UefiCpuPkg/Library/MpInitLib/DxeMpLib.c
@@ -93,7 +93,7 @@ GetWakeupBuffer (
   EFI_PHYSICAL_ADDRESS  StartAddress;\r
   EFI_MEMORY_TYPE       MemoryType;\r
 \r
-  if (PcdGetBool (PcdSevEsIsEnabled)) {\r
+  if (ConfidentialComputingGuestHas (CCAttrAmdSevEs)) {\r
     MemoryType = EfiReservedMemoryType;\r
   } else {\r
     MemoryType = EfiBootServicesData;\r
@@ -107,7 +107,7 @@ GetWakeupBuffer (
   // LagacyBios driver depends on CPU Arch protocol which guarantees below\r
   // allocation runs earlier than LegacyBios driver.\r
   //\r
-  if (PcdGetBool (PcdSevEsIsEnabled)) {\r
+  if (ConfidentialComputingGuestHas (CCAttrAmdSevEs)) {\r
     //\r
     // SEV-ES Wakeup buffer should be under 0x88000 and under any previous one\r
     //\r
@@ -125,7 +125,7 @@ GetWakeupBuffer (
   ASSERT_EFI_ERROR (Status);\r
   if (EFI_ERROR (Status)) {\r
     StartAddress = (EFI_PHYSICAL_ADDRESS)-1;\r
-  } else if (PcdGetBool (PcdSevEsIsEnabled)) {\r
+  } else if (ConfidentialComputingGuestHas (CCAttrAmdSevEs)) {\r
     //\r
     // Next SEV-ES wakeup buffer allocation must be below this allocation\r
     //\r

diff --git a/UefiCpuPkg/Library/MpInitLib/MpLib.c b/UefiCpuPkg/Library/MpInitLib/MpLib.c
index 34555c069331c4e2e4a2897db43a0b358ac05909..64fddb497e1e7f59c93a95e56690cfe7719c408d 100644 (file)
--- a/UefiCpuPkg/Library/MpInitLib/MpLib.c
+++ b/UefiCpuPkg/Library/MpInitLib/MpLib.c
@@ -295,7 +295,7 @@ GetApLoopMode (
       ApLoopMode = ApInHltLoop;\r
     }\r
 \r
-    if (PcdGetBool (PcdSevEsIsEnabled)) {\r
+    if (ConfidentialComputingGuestHas (CCAttrAmdSevEs)) {\r
       //\r
       // For SEV-ES, force AP in Hlt-loop mode in order to use the GHCB\r
       // protocol for starting APs\r
@@ -1055,7 +1055,7 @@ AllocateResetVector (
     // The AP reset stack is only used by SEV-ES guests. Do not allocate it\r
     // if SEV-ES is not enabled.\r
     //\r
-    if (PcdGetBool (PcdSevEsIsEnabled)) {\r
+    if (ConfidentialComputingGuestHas (CCAttrAmdSevEs)) {\r
       //\r
       // Stack location is based on ProcessorNumber, so use the total number\r
       // of processors for calculating the total stack area.\r
@@ -1847,7 +1847,7 @@ MpInitLibInitialize (
   CpuMpData->CpuData          = (CPU_AP_DATA *)(CpuMpData + 1);\r
   CpuMpData->CpuInfoInHob     = (UINT64)(UINTN)(CpuMpData->CpuData + MaxLogicalProcessorNumber);\r
   InitializeSpinLock (&CpuMpData->MpLock);\r
-  CpuMpData->SevEsIsEnabled = PcdGetBool (PcdSevEsIsEnabled);\r
+  CpuMpData->SevEsIsEnabled = ConfidentialComputingGuestHas (CCAttrAmdSevEs);\r
   CpuMpData->SevEsAPBuffer  = (UINTN)-1;\r
   CpuMpData->GhcbBase       = PcdGet64 (PcdGhcbBase);\r
 \r
@@ -2755,3 +2755,70 @@ MpInitLibStartupAllCPUs (
            NULL\r
            );\r
 }\r
+\r
+/**\r
+  The function check if the specified Attr is set.\r
+\r
+  @param[in]  CurrentAttr   The current attribute.\r
+  @param[in]  Attr          The attribute to check.\r
+\r
+  @retval  TRUE      The specified Attr is set.\r
+  @retval  FALSE     The specified Attr is not set.\r
+\r
+**/\r
+STATIC\r
+BOOLEAN\r
+AmdMemEncryptionAttrCheck (\r
+  IN  UINT64                             CurrentAttr,\r
+  IN  CONFIDENTIAL_COMPUTING_GUEST_ATTR  Attr\r
+  )\r
+{\r
+  switch (Attr) {\r
+    case CCAttrAmdSev:\r
+      //\r
+      // SEV is automatically enabled if SEV-ES or SEV-SNP is active.\r
+      //\r
+      return CurrentAttr >= CCAttrAmdSev;\r
+    case CCAttrAmdSevEs:\r
+      //\r
+      // SEV-ES is automatically enabled if SEV-SNP is active.\r
+      //\r
+      return CurrentAttr >= CCAttrAmdSevEs;\r
+    case CCAttrAmdSevSnp:\r
+      return CurrentAttr == CCAttrAmdSevSnp;\r
+    default:\r
+      return FALSE;\r
+  }\r
+}\r
+\r
+/**\r
+  Check if the specified confidential computing attribute is active.\r
+\r
+  @param[in]  Attr          The attribute to check.\r
+\r
+  @retval TRUE   The specified Attr is active.\r
+  @retval FALSE  The specified Attr is not active.\r
+\r
+**/\r
+BOOLEAN\r
+EFIAPI\r
+ConfidentialComputingGuestHas (\r
+  IN  CONFIDENTIAL_COMPUTING_GUEST_ATTR  Attr\r
+  )\r
+{\r
+  UINT64  CurrentAttr;\r
+\r
+  //\r
+  // Get the current CC attribute.\r
+  //\r
+  CurrentAttr = PcdGet64 (PcdConfidentialComputingGuestAttr);\r
+\r
+  //\r
+  // If attr is for the AMD group then call AMD specific checks.\r
+  //\r
+  if (((RShiftU64 (CurrentAttr, 8)) & 0xff) == 1) {\r
+    return AmdMemEncryptionAttrCheck (CurrentAttr, Attr);\r
+  }\r
+\r
+  return (CurrentAttr == Attr);\r
+}\r

diff --git a/UefiCpuPkg/Library/MpInitLib/MpLib.h b/UefiCpuPkg/Library/MpInitLib/MpLib.h
index 16b4d76d019bc7d6a58037bb53a075ffb8c1d1a0..a84df60519ed75a7cd3e5fe251a2dfbbc15bb536 100644 (file)
--- a/UefiCpuPkg/Library/MpInitLib/MpLib.h
+++ b/UefiCpuPkg/Library/MpInitLib/MpLib.h
@@ -33,6 +33,7 @@
 #include <Library/HobLib.h>\r
 #include <Library/PcdLib.h>\r
 #include <Library/MicrocodeLib.h>\r
+#include <ConfidentialComputingGuestAttr.h>\r
 \r
 #include <Register/Amd/Fam17Msr.h>\r
 #include <Register/Amd/Ghcb.h>\r
@@ -773,4 +774,16 @@ SevEsPlaceApHlt (
   CPU_MP_DATA  *CpuMpData\r
   );\r
 \r
+/**\r
+ Check if the specified confidential computing attribute is active.\r
+\r
+ @retval TRUE   The specified Attr is active.\r
+ @retval FALSE  The specified Attr is not active.\r
+**/\r
+BOOLEAN\r
+EFIAPI\r
+ConfidentialComputingGuestHas (\r
+  CONFIDENTIAL_COMPUTING_GUEST_ATTR  Attr\r
+  );\r
+\r
 #endif\r

diff --git a/UefiCpuPkg/Library/MpInitLib/PeiMpInitLib.inf b/UefiCpuPkg/Library/MpInitLib/PeiMpInitLib.inf
index 2cbd9b8b8acc24428e9b15e78ebe73f92a259d94..b7e15ee023f0291c7c267212e19faf34a7a9cd40 100644 (file)
--- a/UefiCpuPkg/Library/MpInitLib/PeiMpInitLib.inf
+++ b/UefiCpuPkg/Library/MpInitLib/PeiMpInitLib.inf
@@ -63,9 +63,9 @@
   gUefiCpuPkgTokenSpaceGuid.PcdCpuMicrocodePatchRegionSize         ## CONSUMES\r
   gUefiCpuPkgTokenSpaceGuid.PcdCpuApLoopMode                       ## CONSUMES\r
   gUefiCpuPkgTokenSpaceGuid.PcdCpuApTargetCstate                   ## SOMETIMES_CONSUMES\r
-  gUefiCpuPkgTokenSpaceGuid.PcdSevEsIsEnabled                      ## CONSUMES\r
   gUefiCpuPkgTokenSpaceGuid.PcdSevEsWorkAreaBase                   ## SOMETIMES_CONSUMES\r
   gEfiMdeModulePkgTokenSpaceGuid.PcdGhcbBase                       ## CONSUMES\r
+  gEfiMdePkgTokenSpaceGuid.PcdConfidentialComputingGuestAttr       ## CONSUMES\r
 \r
 [Ppis]\r
   gEdkiiPeiShadowMicrocodePpiGuid        ## SOMETIMES_CONSUMES\r

diff --git a/UefiCpuPkg/Library/MpInitLib/PeiMpLib.c b/UefiCpuPkg/Library/MpInitLib/PeiMpLib.c
index ab79360bb935eaaed47fe57e85e54a4d03756530..efce5747277a2b6d507ebcad5d1d4f002b4e7701 100644 (file)
--- a/UefiCpuPkg/Library/MpInitLib/PeiMpLib.c
+++ b/UefiCpuPkg/Library/MpInitLib/PeiMpLib.c
@@ -225,7 +225,7 @@ GetWakeupBuffer (
         // Need memory under 1MB to be collected here\r
         //\r
         WakeupBufferEnd = Hob.ResourceDescriptor->PhysicalStart + Hob.ResourceDescriptor->ResourceLength;\r
-        if (PcdGetBool (PcdSevEsIsEnabled) &&\r
+        if (ConfidentialComputingGuestHas (CCAttrAmdSevEs) &&\r
             (WakeupBufferEnd > mSevEsPeiWakeupBuffer))\r
         {\r
           //\r
@@ -264,7 +264,7 @@ GetWakeupBuffer (
             WakeupBufferSize\r
             ));\r
 \r
-          if (PcdGetBool (PcdSevEsIsEnabled)) {\r
+          if (ConfidentialComputingGuestHas (CCAttrAmdSevEs)) {\r
             //\r
             // Next SEV-ES wakeup buffer allocation must be below this\r
             // allocation\r