From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from NAM12-DM6-obe.outbound.protection.outlook.com (NAM12-DM6-obe.outbound.protection.outlook.com [40.107.243.45]) by mx.groups.io with SMTP id smtpd.web12.121.1634144280373423647 for ; Wed, 13 Oct 2021 09:58:00 -0700 Authentication-Results: mx.groups.io; dkim=fail reason="body hash did not verify" header.i=@amd.com header.s=selector1 header.b=HRT25VHN; spf=permerror, err=parse error for token &{10 18 %{i}._ip.%{h}._ehlo.%{d}._spf.vali.email}: invalid domain name (domain: amd.com, ip: 40.107.243.45, mailfrom: brijesh.singh@amd.com) ARC-Seal: i=1; a=rsa-sha256; s=arcselector9901; d=microsoft.com; cv=none; b=XKzdURLgyUKD+sSpCQg4IohFzPM85sQcU6Oo8l+yexLmWb4c5ZuZ7Cgwduk8UnIinOJPfUhGI1ytXodGGsshIleMxtg748Dyi2YYSZIRtQ7zKp4fH5Cy6A/i/ZHgEWeyZ0ScrY+fU7GbuxemjppBPnZcQD/lPLIKISpdxSUeTNijzNjsuBXHIcgJfGyC6sCABcwhYUZqGry+WY/xNZuzeoAPtwoZnHNPIMbE1R5u9Tq8csjAPdX8xbGKK/zo08CWDGRjTm04G8b1HrcWRNRgvgL3XfEOtG4mCthFcdhDHvBkgNU19/3Y2VioqWqZtf2/SDYcjZB6AZEqv9vAZPk1LA== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=arcselector9901; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-AntiSpam-MessageData-ChunkCount:X-MS-Exchange-AntiSpam-MessageData-0:X-MS-Exchange-AntiSpam-MessageData-1; bh=R30K3WwP7vSaKdEkB5HJepUhyo17FpVQOgylv6ZlCmI=; b=dkbjNePEMxD5NlRqIWwLIPowzz7k0iA8fXbwRjpoT4O0mVeGrQvEDrlJhgIa16NiWwApdFfC8yF/hu9EEzkIBpxI3mBUEKzinID5GkroUPdYFyI5SlSqE8dOxJ+feHRbrQbU863kagd7nYH5/b5L//PJHoGkiVgQ/0wkrOZ3vA/hH9L4wnw+kPDOGN6lbT+1thSKjdeWRs4iHc+XtqbLGCV+9dXdKXb+Fxi+6hJlkGectT44z71G6OCSoX8Hy7KbHKZBxj/F/YVo8IRQlJboUQsr5iHvd6wJC2Zwc/zL8xrsYMEtbOQleDPF0a7pE7xe7qX1/T+M88XahKfiPZt5Yg== ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=pass (sender ip is 165.204.84.17) smtp.rcpttodomain=edk2.groups.io smtp.mailfrom=amd.com; dmarc=pass (p=quarantine sp=quarantine pct=100) action=none header.from=amd.com; dkim=none (message not signed); arc=none DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=amd.com; s=selector1; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=R30K3WwP7vSaKdEkB5HJepUhyo17FpVQOgylv6ZlCmI=; b=HRT25VHNoPzC4kQsLuQn/gez8vYA+ovOfvfp8enZYw0/HO3hCbIuBIRRsxubrzJYxbwRkWi2kgmarJknRh+9qa/4wAiW359K7vxJW+oU2EIIxNEqd3QoS8JS6V1tcOr6zKmRhFCjnojh7t5hlcbgFibWFQnpgAYtmfbx90+46f8= Received: from MWHPR15CA0062.namprd15.prod.outlook.com (2603:10b6:301:4c::24) by BL1PR12MB5192.namprd12.prod.outlook.com (2603:10b6:208:311::16) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.4587.22; Wed, 13 Oct 2021 16:57:57 +0000 Received: from CO1NAM11FT014.eop-nam11.prod.protection.outlook.com (2603:10b6:301:4c:cafe::b5) by MWHPR15CA0062.outlook.office365.com (2603:10b6:301:4c::24) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.4608.15 via Frontend Transport; Wed, 13 Oct 2021 16:57:57 +0000 X-MS-Exchange-Authentication-Results: spf=pass (sender IP is 165.204.84.17) smtp.mailfrom=amd.com; edk2.groups.io; dkim=none (message not signed) header.d=none;edk2.groups.io; dmarc=pass action=none header.from=amd.com; Received-SPF: Pass (protection.outlook.com: domain of amd.com designates 165.204.84.17 as permitted sender) receiver=protection.outlook.com; client-ip=165.204.84.17; helo=SATLEXMB04.amd.com; Received: from SATLEXMB04.amd.com (165.204.84.17) by CO1NAM11FT014.mail.protection.outlook.com (10.13.175.99) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256) id 15.20.4608.15 via Frontend Transport; Wed, 13 Oct 2021 16:57:57 +0000 Received: from sbrijesh-desktop.amd.com (10.180.168.240) by SATLEXMB04.amd.com (10.181.40.145) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256) id 15.1.2308.8; Wed, 13 Oct 2021 11:57:53 -0500 From: "Brijesh Singh" To: CC: James Bottomley , Min Xu , "Jiewen Yao" , Tom Lendacky , "Jordan Justen" , Ard Biesheuvel , Erdem Aktas , "Michael Roth" , Gerd Hoffmann , Brijesh Singh , Michael Roth , Ray Ni , Rahul Kumar , Eric Dong Subject: [PATCH v9 22/32] UefiCpuPkg/MpInitLib: use PcdConfidentialComputingAttr to check SEV status Date: Wed, 13 Oct 2021 11:57:03 -0500 Message-ID: <20211013165713.727815-23-brijesh.singh@amd.com> X-Mailer: git-send-email 2.25.1 In-Reply-To: <20211013165713.727815-1-brijesh.singh@amd.com> References: <20211013165713.727815-1-brijesh.singh@amd.com> MIME-Version: 1.0 Return-Path: brijesh.singh@amd.com X-Originating-IP: [10.180.168.240] X-ClientProxiedBy: SATLEXMB04.amd.com (10.181.40.145) To SATLEXMB04.amd.com (10.181.40.145) X-EOPAttributedMessage: 0 X-MS-PublicTrafficType: Email X-MS-Office365-Filtering-Correlation-Id: e25f7148-63a0-46c6-c054-08d98e6a9b5c X-MS-TrafficTypeDiagnostic: BL1PR12MB5192: X-Microsoft-Antispam-PRVS: X-MS-Oob-TLC-OOBClassifiers: OLM:1468; X-MS-Exchange-SenderADCheck: 1 X-MS-Exchange-AntiSpam-Relay: 0 X-Microsoft-Antispam: BCL:0; X-Microsoft-Antispam-Message-Info: HYAn21iTgY4S561UVPx6TngWA8YPQJkZI9+m1YvzNA6txj3ItiWWXZqnBmk2io22yAnSrcBuj7sExGljhDlZc4LJtKyv6cOKWQDFi0skpAGKoAl0fTJDQeG9UyC6cekdKBIkmEVRiOES+vFPJj+w2g1keQazlEJVzgJOQhfIplMF8o6pH/UHfZ7RHbPp+V9+HhO99xwSxuL4YrOrODmwrDi1m86OYOEYjdGBtwpcodDyy/G0c6erP9gEr1lsMy8YdMl0VGOfNeQAlzuwjPT9A8D7K14pWalpoVt3A7knlCUjI1HyT+Y9N0D0Bw8Vk5gcnhoLufeK6UYbmagRNUtsnMepK8q1YP3noxPGeJmr3JInFjsdIPgZN0GtXMfM2G5cdMQkxeno6RfX07sboa1mF0/WYu2CCOXg1f6kwh1hRb8XRPvedP9pYMTj9STvdIcYKfgkQlv8l1mEMVRpwvTnn73rkrIz/D4fVXcFvx40+jEyfsajfnMKIqwTy2wgAx9Lu+yAmCXikprar2Lj0L0TpKf47r4yhxMkWJHXYhCmyigFNAQcOu7ga9pZ6EAtDdbWSeFeI+VslR2awrZp+BX2W+DnE/m1OHhY3hN7a7gaJt65SopFxJuTUG767deHqnH5IcSK72JL6W59DWbyT93/cpQBW5+Ofsj2+jPtkNtSDBhf9XI8qnCSY8uOLo6qeCWLMiieJq/ywRJX+51re7ky5wA/ugimuKodre2rN8UScc/EyZ64L/MUgWgdumjX365bxEoWYRKq0jpfuZSPZp7kDk3dSzO/75IIGjhmeQWgu7APrHI0pvqUlomJMCrkndq7 X-Forefront-Antispam-Report: CIP:165.204.84.17;CTRY:US;LANG:en;SCL:1;SRV:;IPV:CAL;SFV:NSPM;H:SATLEXMB04.amd.com;PTR:InfoDomainNonexistent;CAT:NONE;SFS:(6029001)(4636009)(36840700001)(46966006)(5660300002)(44832011)(36756003)(6666004)(1076003)(7696005)(316002)(82310400003)(966005)(8936002)(70206006)(54906003)(16526019)(4326008)(8676002)(70586007)(47076005)(81166007)(186003)(7416002)(83380400001)(426003)(86362001)(36860700001)(356005)(26005)(2906002)(6916009)(2616005)(336012)(508600001)(36900700001);DIR:OUT;SFP:1101; X-OriginatorOrg: amd.com X-MS-Exchange-CrossTenant-OriginalArrivalTime: 13 Oct 2021 16:57:57.2351 (UTC) X-MS-Exchange-CrossTenant-Network-Message-Id: e25f7148-63a0-46c6-c054-08d98e6a9b5c X-MS-Exchange-CrossTenant-Id: 3dd8961f-e488-4e60-8e11-a82d994e183d X-MS-Exchange-CrossTenant-OriginalAttributedTenantConnectingIp: TenantId=3dd8961f-e488-4e60-8e11-a82d994e183d;Ip=[165.204.84.17];Helo=[SATLEXMB04.amd.com] X-MS-Exchange-CrossTenant-AuthSource: CO1NAM11FT014.eop-nam11.prod.protection.outlook.com X-MS-Exchange-CrossTenant-AuthAs: Anonymous X-MS-Exchange-CrossTenant-FromEntityHeader: HybridOnPrem X-MS-Exchange-Transport-CrossTenantHeadersStamped: BL1PR12MB5192 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain BZ: https://bugzilla.tianocore.org/show_bug.cgi?id=3D3275 Previous commit introduced a generic confidential computing PCD that can determine whether AMD SEV-ES is enabled. Update the MpInitLib to drop the PcdSevEsIsEnabled in favor of PcdConfidentialComputingAttr. Cc: Michael Roth Cc: Ray Ni Cc: Rahul Kumar Cc: Eric Dong Cc: James Bottomley Cc: Min Xu Cc: Jiewen Yao Cc: Tom Lendacky Cc: Jordan Justen Cc: Ard Biesheuvel Cc: Erdem Aktas Cc: Gerd Hoffmann Suggested-by: Jiewen Yao Signed-off-by: Brijesh Singh --- UefiCpuPkg/Library/MpInitLib/DxeMpInitLib.inf | 2 +- UefiCpuPkg/Library/MpInitLib/PeiMpInitLib.inf | 2 +- UefiCpuPkg/Library/MpInitLib/MpLib.h | 13 ++++ UefiCpuPkg/Library/MpInitLib/DxeMpLib.c | 6 +- UefiCpuPkg/Library/MpInitLib/MpLib.c | 60 ++++++++++++++++++- UefiCpuPkg/Library/MpInitLib/PeiMpLib.c | 4 +- 6 files changed, 77 insertions(+), 10 deletions(-) diff --git a/UefiCpuPkg/Library/MpInitLib/DxeMpInitLib.inf b/UefiCpuPkg/Lib= rary/MpInitLib/DxeMpInitLib.inf index 6e510aa89120..28764418d7c1 100644 --- a/UefiCpuPkg/Library/MpInitLib/DxeMpInitLib.inf +++ b/UefiCpuPkg/Library/MpInitLib/DxeMpInitLib.inf @@ -73,7 +73,7 @@ [Pcd] gUefiCpuPkgTokenSpaceGuid.PcdCpuApLoopMode ## = CONSUMES gUefiCpuPkgTokenSpaceGuid.PcdCpuApTargetCstate ## = SOMETIMES_CONSUMES gUefiCpuPkgTokenSpaceGuid.PcdCpuApStatusCheckIntervalInMicroSeconds ## = CONSUMES - gUefiCpuPkgTokenSpaceGuid.PcdSevEsIsEnabled ## = CONSUMES gUefiCpuPkgTokenSpaceGuid.PcdSevEsWorkAreaBase ## = SOMETIMES_CONSUMES gEfiMdeModulePkgTokenSpaceGuid.PcdCpuStackGuard ## = CONSUMES gEfiMdeModulePkgTokenSpaceGuid.PcdGhcbBase ## = CONSUMES + gUefiCpuPkgTokenSpaceGuid.PcdConfidentialComputingGuestAttr ## = CONSUMES diff --git a/UefiCpuPkg/Library/MpInitLib/PeiMpInitLib.inf b/UefiCpuPkg/Lib= rary/MpInitLib/PeiMpInitLib.inf index 2cbd9b8b8acc..cbc3c1460423 100644 --- a/UefiCpuPkg/Library/MpInitLib/PeiMpInitLib.inf +++ b/UefiCpuPkg/Library/MpInitLib/PeiMpInitLib.inf @@ -63,9 +63,9 @@ [Pcd] gUefiCpuPkgTokenSpaceGuid.PcdCpuMicrocodePatchRegionSize ## CONS= UMES gUefiCpuPkgTokenSpaceGuid.PcdCpuApLoopMode ## CONS= UMES gUefiCpuPkgTokenSpaceGuid.PcdCpuApTargetCstate ## SOME= TIMES_CONSUMES - gUefiCpuPkgTokenSpaceGuid.PcdSevEsIsEnabled ## CONS= UMES gUefiCpuPkgTokenSpaceGuid.PcdSevEsWorkAreaBase ## SOME= TIMES_CONSUMES gEfiMdeModulePkgTokenSpaceGuid.PcdGhcbBase ## CONS= UMES + gUefiCpuPkgTokenSpaceGuid.PcdConfidentialComputingGuestAttr ## CONS= UMES =20 [Ppis] gEdkiiPeiShadowMicrocodePpiGuid ## SOMETIMES_CONSUMES diff --git a/UefiCpuPkg/Library/MpInitLib/MpLib.h b/UefiCpuPkg/Library/MpIn= itLib/MpLib.h index 3d4446df8ce6..2107f3f705a2 100644 --- a/UefiCpuPkg/Library/MpInitLib/MpLib.h +++ b/UefiCpuPkg/Library/MpInitLib/MpLib.h @@ -33,6 +33,7 @@ #include #include #include +#include =20 #include #include @@ -774,5 +775,17 @@ SevEsPlaceApHlt ( CPU_MP_DATA *CpuMpData ); =20 +/** + Check if the specified confidential computing attribute is active. + + @retval TRUE The specified Attr is active. + @retval FALSE The specified Attr is not active. +**/ +BOOLEAN +EFIAPI +ConfidentialComputingGuestHas ( + CONFIDENTIAL_COMPUTING_GUEST_ATTR Attr + ); + #endif =20 diff --git a/UefiCpuPkg/Library/MpInitLib/DxeMpLib.c b/UefiCpuPkg/Library/M= pInitLib/DxeMpLib.c index 93fc63bf93e3..657a73dca05e 100644 --- a/UefiCpuPkg/Library/MpInitLib/DxeMpLib.c +++ b/UefiCpuPkg/Library/MpInitLib/DxeMpLib.c @@ -93,7 +93,7 @@ GetWakeupBuffer ( EFI_PHYSICAL_ADDRESS StartAddress; EFI_MEMORY_TYPE MemoryType; =20 - if (PcdGetBool (PcdSevEsIsEnabled)) { + if (ConfidentialComputingGuestHas (CCAttrAmdSevEs)) { MemoryType =3D EfiReservedMemoryType; } else { MemoryType =3D EfiBootServicesData; @@ -107,7 +107,7 @@ GetWakeupBuffer ( // LagacyBios driver depends on CPU Arch protocol which guarantees below // allocation runs earlier than LegacyBios driver. // - if (PcdGetBool (PcdSevEsIsEnabled)) { + if (ConfidentialComputingGuestHas (CCAttrAmdSevEs)) { // // SEV-ES Wakeup buffer should be under 0x88000 and under any previous= one // @@ -124,7 +124,7 @@ GetWakeupBuffer ( ASSERT_EFI_ERROR (Status); if (EFI_ERROR (Status)) { StartAddress =3D (EFI_PHYSICAL_ADDRESS) -1; - } else if (PcdGetBool (PcdSevEsIsEnabled)) { + } else if (ConfidentialComputingGuestHas (CCAttrAmdSevEs)) { // // Next SEV-ES wakeup buffer allocation must be below this allocation // diff --git a/UefiCpuPkg/Library/MpInitLib/MpLib.c b/UefiCpuPkg/Library/MpIn= itLib/MpLib.c index 890945bc5994..16a1602c3079 100644 --- a/UefiCpuPkg/Library/MpInitLib/MpLib.c +++ b/UefiCpuPkg/Library/MpInitLib/MpLib.c @@ -295,7 +295,7 @@ GetApLoopMode ( ApLoopMode =3D ApInHltLoop; } =20 - if (PcdGetBool (PcdSevEsIsEnabled)) { + if (ConfidentialComputingGuestHas (CCAttrAmdSevEs)) { // // For SEV-ES, force AP in Hlt-loop mode in order to use the GHCB // protocol for starting APs @@ -1046,7 +1046,7 @@ AllocateResetVector ( // The AP reset stack is only used by SEV-ES guests. Do not allocate i= t // if SEV-ES is not enabled. // - if (PcdGetBool (PcdSevEsIsEnabled)) { + if (ConfidentialComputingGuestHas (CCAttrAmdSevEs)) { // // Stack location is based on ProcessorNumber, so use the total numb= er // of processors for calculating the total stack area. @@ -1816,7 +1816,7 @@ MpInitLibInitialize ( CpuMpData->CpuData =3D (CPU_AP_DATA *) (CpuMpData + 1); CpuMpData->CpuInfoInHob =3D (UINT64) (UINTN) (CpuMpData->CpuData + M= axLogicalProcessorNumber); InitializeSpinLock(&CpuMpData->MpLock); - CpuMpData->SevEsIsEnabled =3D PcdGetBool (PcdSevEsIsEnabled); + CpuMpData->SevEsIsEnabled =3D ConfidentialComputingGuestHas (CCAttrAmdSe= vEs); CpuMpData->SevEsAPBuffer =3D (UINTN) -1; CpuMpData->GhcbBase =3D PcdGet64 (PcdGhcbBase); =20 @@ -2706,3 +2706,57 @@ MpInitLibStartupAllCPUs ( NULL ); } + +/** + The function check if the specified Attr is set in the CurrentAttr. + + @retval TRUE The specified Attr is set. + @retval FALSE The specified Attr is not set. +**/ +STATIC +BOOLEAN +AmdMemEncryptionAttrCheck ( + UINT64 CurrentAttr, + CONFIDENTIAL_COMPUTING_GUEST_ATTR Attr + ) +{ + switch (Attr) { + case CCAttrAmdSev: + return CurrentAttr >=3D CCAttrAmdSev; + case CCAttrAmdSevEs: + return CurrentAttr >=3D CCAttrAmdSevEs; + case CCAttrAmdSevSnp: + return CurrentAttr =3D=3D CCAttrAmdSevSnp; + default: + return FALSE; + } +} + +/** + Check if the specified confidential computing attribute is active. + + @retval TRUE The specified Attr is active. + @retval FALSE The specified Attr is not active. +**/ +BOOLEAN +EFIAPI +ConfidentialComputingGuestHas ( + CONFIDENTIAL_COMPUTING_GUEST_ATTR Attr + ) +{ + UINT64 CurrentAttr; + + // + // Get the current CC attribute. + // + CurrentAttr =3D PcdGet64 (PcdConfidentialComputingGuestAttr); + + // + // If attr is for the AMD group then call AMD specific checks. + // + if (((CurrentAttr >> 8) & 0xff) =3D=3D 1) { + return AmdMemEncryptionAttrCheck (CurrentAttr, Attr); + } + + return (CurrentAttr =3D=3D Attr); +} diff --git a/UefiCpuPkg/Library/MpInitLib/PeiMpLib.c b/UefiCpuPkg/Library/M= pInitLib/PeiMpLib.c index 90015c650c68..2f333a00460a 100644 --- a/UefiCpuPkg/Library/MpInitLib/PeiMpLib.c +++ b/UefiCpuPkg/Library/MpInitLib/PeiMpLib.c @@ -222,7 +222,7 @@ GetWakeupBuffer ( // Need memory under 1MB to be collected here // WakeupBufferEnd =3D Hob.ResourceDescriptor->PhysicalStart + Hob.Re= sourceDescriptor->ResourceLength; - if (PcdGetBool (PcdSevEsIsEnabled) && + if (ConfidentialComputingGuestHas (CCAttrAmdSevEs) && WakeupBufferEnd > mSevEsPeiWakeupBuffer) { // // SEV-ES Wakeup buffer should be under 1MB and under any previo= us one @@ -253,7 +253,7 @@ GetWakeupBuffer ( DEBUG ((DEBUG_INFO, "WakeupBufferStart =3D %x, WakeupBufferSize = =3D %x\n", WakeupBufferStart, WakeupBufferSize)); =20 - if (PcdGetBool (PcdSevEsIsEnabled)) { + if (ConfidentialComputingGuestHas (CCAttrAmdSevEs)) { // // Next SEV-ES wakeup buffer allocation must be below this // allocation --=20 2.25.1