From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from NAM10-BN7-obe.outbound.protection.outlook.com (NAM10-BN7-obe.outbound.protection.outlook.com [40.107.92.88]) by mx.groups.io with SMTP id smtpd.web11.6942.1639020561672524975 for ; Wed, 08 Dec 2021 19:29:21 -0800 Authentication-Results: mx.groups.io; dkim=fail reason="body hash did not verify" header.i=@amd.com header.s=selector1 header.b=rkG66muf; spf=permerror, err=parse error for token &{10 18 %{i}._ip.%{h}._ehlo.%{d}._spf.vali.email}: invalid domain name (domain: amd.com, ip: 40.107.92.88, mailfrom: brijesh.singh@amd.com) ARC-Seal: i=1; a=rsa-sha256; s=arcselector9901; d=microsoft.com; cv=none; b=MNZSnN0iemh7YyXBAiv49FO4RaRhZeUkDx/1P0PyLEEv4i0rcfI7p1niWzz1gnQ09nsJY4PT55iHLgJQGcdituAoufgyOFfkzKxPynePq0a3cw6KxdXk9iipk8LtzRz4WT8QZ+/Ghj8fMYsitaiE18ND2Dm2CzjuFYkUzXxjHBJhix9BSjya6NsLOdIHykqnZlUE+cBE3CX5TcALlKebXU2anZY5M4DpjxsX5B6er3F8PGvrywhjlIFzj943/9QLB/QkO9nx4d+utnI4za1kGnC906GitTkQG59vc6kAq/TsZwyBDwRUUvAcUEF5HeezfljZ6fqGanoiP+zwoK8FIg== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=arcselector9901; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-AntiSpam-MessageData-ChunkCount:X-MS-Exchange-AntiSpam-MessageData-0:X-MS-Exchange-AntiSpam-MessageData-1; bh=duJqfwl50RSHSHGaf6w5AoL5e9h/JECmlVQe7V7850I=; b=PXoWVMF2LzjtLFWciHIAM/4nF3fEj8JWLRxi9q/Jo2Q9XtyNuuFZB5AsEW4/EAkEkJLnXBbeMBvM4eFWrSxCCEhFkr4hVUEaIMaeuSRjhiWPZc5PzeksugOyweQQZacG1I7km6Yuwjl561uESqmFG9ULl0IYMbDruRlE7rLF3HuVwJy1oFl3Yq2SwM5y77njS0Nm5HrbSql7iDbDIb5iNnOxGYU/bVGmdYAu1WUQArWVjcsfKJ5AMw7hKT7S7xhXvhQ4B+PrpBEXoEvA0zoCJJlsQxF/Kuk8yZnmbsSAk2ZDYDPod4VGIYa3PsnSyb0vkwVlxyl4qeLvvZD2Tq8YzQ== ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=pass (sender ip is 165.204.84.17) smtp.rcpttodomain=edk2.groups.io smtp.mailfrom=amd.com; dmarc=pass (p=quarantine sp=quarantine pct=100) action=none header.from=amd.com; dkim=none (message not signed); arc=none DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=amd.com; s=selector1; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=duJqfwl50RSHSHGaf6w5AoL5e9h/JECmlVQe7V7850I=; b=rkG66muf5dqgAgaS21Z5C91j6dIgG5VNgOSmmmZDZtp1Fk1Me5S/RbyC3Fhvoj30ft9UOosedaL61lM1X7UUoWSGNfyDLvUjourzMloRxj02XYXv9SSiIYDXA3W+1Xd0F2rxBdqcz3uFXW2obFCiLZNg4KkOBzP3i/jOmZPo0bo= Received: from CO2PR04CA0198.namprd04.prod.outlook.com (2603:10b6:104:5::28) by DM4PR12MB5152.namprd12.prod.outlook.com (2603:10b6:5:393::16) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.4734.23; Thu, 9 Dec 2021 03:29:19 +0000 Received: from CO1NAM11FT031.eop-nam11.prod.protection.outlook.com (2603:10b6:104:5:cafe::df) by CO2PR04CA0198.outlook.office365.com (2603:10b6:104:5::28) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.4778.12 via Frontend Transport; Thu, 9 Dec 2021 03:29:19 +0000 X-MS-Exchange-Authentication-Results: spf=pass (sender IP is 165.204.84.17) smtp.mailfrom=amd.com; dkim=none (message not signed) header.d=none;dmarc=pass action=none header.from=amd.com; Received-SPF: Pass (protection.outlook.com: domain of amd.com designates 165.204.84.17 as permitted sender) receiver=protection.outlook.com; client-ip=165.204.84.17; helo=SATLEXMB03.amd.com; Received: from SATLEXMB03.amd.com (165.204.84.17) by CO1NAM11FT031.mail.protection.outlook.com (10.13.174.118) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256) id 15.20.4755.13 via Frontend Transport; Thu, 9 Dec 2021 03:29:19 +0000 Received: from sbrijesh-desktop.amd.com (10.180.168.240) by SATLEXMB03.amd.com (10.181.40.144) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256) id 15.1.2375.17; Wed, 8 Dec 2021 21:29:11 -0600 From: "Brijesh Singh" To: CC: James Bottomley , Min Xu , "Jiewen Yao" , Tom Lendacky , "Jordan Justen" , Ard Biesheuvel , Erdem Aktas , "Michael Roth" , Gerd Hoffmann , "Michael D Kinney" , Liming Gao , Zhiguang Liu , Ray Ni , Rahul Kumar , Eric Dong , Brijesh Singh , Michael Roth Subject: [PATCH v14 22/32] UefiCpuPkg/MpInitLib: use PcdConfidentialComputingAttr to check SEV status Date: Wed, 8 Dec 2021 21:27:50 -0600 Message-ID: <20211209032800.3802995-23-brijesh.singh@amd.com> X-Mailer: git-send-email 2.25.1 In-Reply-To: <20211209032800.3802995-1-brijesh.singh@amd.com> References: <20211209032800.3802995-1-brijesh.singh@amd.com> MIME-Version: 1.0 Return-Path: brijesh.singh@amd.com X-Originating-IP: [10.180.168.240] X-ClientProxiedBy: SATLEXMB03.amd.com (10.181.40.144) To SATLEXMB03.amd.com (10.181.40.144) X-EOPAttributedMessage: 0 X-MS-PublicTrafficType: Email X-MS-Office365-Filtering-Correlation-Id: 8566a903-17dc-4327-9228-08d9bac41612 X-MS-TrafficTypeDiagnostic: DM4PR12MB5152:EE_ X-Microsoft-Antispam-PRVS: X-MS-Oob-TLC-OOBClassifiers: OLM:409; X-MS-Exchange-SenderADCheck: 1 X-MS-Exchange-AntiSpam-Relay: 0 X-Microsoft-Antispam: BCL:0; X-Microsoft-Antispam-Message-Info: sIi9A0FZhBjk1t5+VMMdkxsl1kB9xCq0ncEzzE9WHRAKH9qvwSICkSJHw3iks/DT/5b2XJI7Dux15WeJYAcVFdOiqQwQSrOZFiSbEvUxKSFpW5jDIUU5CvOphtpkYniIv10htrkWrQn+5DQHN4qzZ0RPMZ2fe/iBSfxlABNWqawOKv0n85EPel18rZeisfugJDP4JJZ2JA836JTj8M1F78uEh5UKYDcStJnbOfE3YYeunFSVgbCWD7QzvM7n3gp4EA8aHA5k4k320jX6ToqAiLw/YK1nTfcpIfLPdvcFTgFNipF8UafCnnFs2JK15qRwy+Xd2KQLYMYxp7uwE16ZpE3AEUMQhc3HtcZT+UqCwoRXUh5HrfoU/tbNwBal0QkxM3qeFXtkmww4gPnJ9yQq6FlUjorN+lZVpONfR08zOsA/X9LXNcfJ9skKex+nfnWZzbQR8SfkABbFY1A0rPi+v22QgOS1Q7F51DHq1eDCWr0LJ9nvf6tN6CTK5dYy5DqOChaLbP46ZFnbHtOJZv4m35ZBSvF2h0Gx9L61Xj63bZZih9mNm/YialR14cYBgNLnuWgk//RnHKE8znJSEVu/pjXWjI16UpivnarMyPWvv4ZlzGi9KUCFn0Gen7iMJ09JkbS8siKhWAgjt1t5+o0Zm1Uw9BNwXbGHnr8eLAuAwgSJzal5BK/lVNaM+JeBo+9RUpuEHGViE0eo7ZQawQyzK/x3P473r5ET3pQQVVeoqn1a9yxdxLiUy+hym0pXCKyNG83++9ovcF5fmTtBFzorBOOULQw9cPS39jloz89IXoP6rN1JggcT8ls2p868Y2gZ2xWmlrIOYLB0Q3eHtrhiqHxb/201vtNiGpNgYGW/WDHL5gOcPHTP/zl7jqfA0MWJ X-Forefront-Antispam-Report: CIP:165.204.84.17;CTRY:US;LANG:en;SCL:1;SRV:;IPV:CAL;SFV:NSPM;H:SATLEXMB03.amd.com;PTR:InfoDomainNonexistent;CAT:NONE;SFS:(6029001)(4636009)(46966006)(36840700001)(40470700001)(36756003)(966005)(356005)(7696005)(8936002)(2616005)(82310400004)(81166007)(2906002)(40460700001)(316002)(26005)(508600001)(86362001)(336012)(8676002)(54906003)(16526019)(4326008)(5660300002)(7416002)(83380400001)(70586007)(44832011)(70206006)(1076003)(47076005)(186003)(6916009)(6666004)(36860700001)(426003)(36900700001);DIR:OUT;SFP:1101; X-OriginatorOrg: amd.com X-MS-Exchange-CrossTenant-OriginalArrivalTime: 09 Dec 2021 03:29:19.4589 (UTC) X-MS-Exchange-CrossTenant-Network-Message-Id: 8566a903-17dc-4327-9228-08d9bac41612 X-MS-Exchange-CrossTenant-Id: 3dd8961f-e488-4e60-8e11-a82d994e183d X-MS-Exchange-CrossTenant-OriginalAttributedTenantConnectingIp: TenantId=3dd8961f-e488-4e60-8e11-a82d994e183d;Ip=[165.204.84.17];Helo=[SATLEXMB03.amd.com] X-MS-Exchange-CrossTenant-AuthSource: CO1NAM11FT031.eop-nam11.prod.protection.outlook.com X-MS-Exchange-CrossTenant-AuthAs: Anonymous X-MS-Exchange-CrossTenant-FromEntityHeader: HybridOnPrem X-MS-Exchange-Transport-CrossTenantHeadersStamped: DM4PR12MB5152 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain BZ: https://bugzilla.tianocore.org/show_bug.cgi?id=3D3275 Previous commit introduced a generic confidential computing PCD that can determine whether AMD SEV-ES is enabled. Update the MpInitLib to drop the PcdSevEsIsEnabled in favor of PcdConfidentialComputingAttr. Cc: Michael Roth Cc: Ray Ni Cc: Rahul Kumar Cc: Eric Dong Cc: James Bottomley Cc: Min Xu Cc: Jiewen Yao Cc: Tom Lendacky Cc: Jordan Justen Cc: Ard Biesheuvel Cc: Erdem Aktas Cc: Gerd Hoffmann Acked-by: Gerd Hoffmann Acked-by: Ray Ni Suggested-by: Jiewen Yao Signed-off-by: Brijesh Singh --- UefiCpuPkg/Library/MpInitLib/DxeMpInitLib.inf | 2 +- UefiCpuPkg/Library/MpInitLib/PeiMpInitLib.inf | 2 +- UefiCpuPkg/Library/MpInitLib/MpLib.h | 13 ++++ UefiCpuPkg/Library/MpInitLib/DxeMpLib.c | 6 +- UefiCpuPkg/Library/MpInitLib/MpLib.c | 73 ++++++++++++++++++- UefiCpuPkg/Library/MpInitLib/PeiMpLib.c | 4 +- 6 files changed, 90 insertions(+), 10 deletions(-) diff --git a/UefiCpuPkg/Library/MpInitLib/DxeMpInitLib.inf b/UefiCpuPkg/Lib= rary/MpInitLib/DxeMpInitLib.inf index 6e510aa89120..de705bc54bb4 100644 --- a/UefiCpuPkg/Library/MpInitLib/DxeMpInitLib.inf +++ b/UefiCpuPkg/Library/MpInitLib/DxeMpInitLib.inf @@ -73,7 +73,7 @@ [Pcd] gUefiCpuPkgTokenSpaceGuid.PcdCpuApLoopMode ## = CONSUMES gUefiCpuPkgTokenSpaceGuid.PcdCpuApTargetCstate ## = SOMETIMES_CONSUMES gUefiCpuPkgTokenSpaceGuid.PcdCpuApStatusCheckIntervalInMicroSeconds ## = CONSUMES - gUefiCpuPkgTokenSpaceGuid.PcdSevEsIsEnabled ## = CONSUMES gUefiCpuPkgTokenSpaceGuid.PcdSevEsWorkAreaBase ## = SOMETIMES_CONSUMES gEfiMdeModulePkgTokenSpaceGuid.PcdCpuStackGuard ## = CONSUMES gEfiMdeModulePkgTokenSpaceGuid.PcdGhcbBase ## = CONSUMES + gEfiMdePkgTokenSpaceGuid.PcdConfidentialComputingGuestAttr ## = CONSUMES diff --git a/UefiCpuPkg/Library/MpInitLib/PeiMpInitLib.inf b/UefiCpuPkg/Lib= rary/MpInitLib/PeiMpInitLib.inf index 2cbd9b8b8acc..b7e15ee023f0 100644 --- a/UefiCpuPkg/Library/MpInitLib/PeiMpInitLib.inf +++ b/UefiCpuPkg/Library/MpInitLib/PeiMpInitLib.inf @@ -63,9 +63,9 @@ [Pcd] gUefiCpuPkgTokenSpaceGuid.PcdCpuMicrocodePatchRegionSize ## CONS= UMES gUefiCpuPkgTokenSpaceGuid.PcdCpuApLoopMode ## CONS= UMES gUefiCpuPkgTokenSpaceGuid.PcdCpuApTargetCstate ## SOME= TIMES_CONSUMES - gUefiCpuPkgTokenSpaceGuid.PcdSevEsIsEnabled ## CONS= UMES gUefiCpuPkgTokenSpaceGuid.PcdSevEsWorkAreaBase ## SOME= TIMES_CONSUMES gEfiMdeModulePkgTokenSpaceGuid.PcdGhcbBase ## CONS= UMES + gEfiMdePkgTokenSpaceGuid.PcdConfidentialComputingGuestAttr ## CONS= UMES =20 [Ppis] gEdkiiPeiShadowMicrocodePpiGuid ## SOMETIMES_CONSUMES diff --git a/UefiCpuPkg/Library/MpInitLib/MpLib.h b/UefiCpuPkg/Library/MpIn= itLib/MpLib.h index 16b4d76d019b..a84df60519ed 100644 --- a/UefiCpuPkg/Library/MpInitLib/MpLib.h +++ b/UefiCpuPkg/Library/MpInitLib/MpLib.h @@ -33,6 +33,7 @@ #include #include #include +#include =20 #include #include @@ -773,4 +774,16 @@ SevEsPlaceApHlt ( CPU_MP_DATA *CpuMpData ); =20 +/** + Check if the specified confidential computing attribute is active. + + @retval TRUE The specified Attr is active. + @retval FALSE The specified Attr is not active. +**/ +BOOLEAN +EFIAPI +ConfidentialComputingGuestHas ( + CONFIDENTIAL_COMPUTING_GUEST_ATTR Attr + ); + #endif diff --git a/UefiCpuPkg/Library/MpInitLib/DxeMpLib.c b/UefiCpuPkg/Library/M= pInitLib/DxeMpLib.c index 9d9206d20915..02bc9c2bd2c4 100644 --- a/UefiCpuPkg/Library/MpInitLib/DxeMpLib.c +++ b/UefiCpuPkg/Library/MpInitLib/DxeMpLib.c @@ -93,7 +93,7 @@ GetWakeupBuffer ( EFI_PHYSICAL_ADDRESS StartAddress; EFI_MEMORY_TYPE MemoryType; =20 - if (PcdGetBool (PcdSevEsIsEnabled)) { + if (ConfidentialComputingGuestHas (CCAttrAmdSevEs)) { MemoryType =3D EfiReservedMemoryType; } else { MemoryType =3D EfiBootServicesData; @@ -107,7 +107,7 @@ GetWakeupBuffer ( // LagacyBios driver depends on CPU Arch protocol which guarantees below // allocation runs earlier than LegacyBios driver. // - if (PcdGetBool (PcdSevEsIsEnabled)) { + if (ConfidentialComputingGuestHas (CCAttrAmdSevEs)) { // // SEV-ES Wakeup buffer should be under 0x88000 and under any previous= one // @@ -125,7 +125,7 @@ GetWakeupBuffer ( ASSERT_EFI_ERROR (Status); if (EFI_ERROR (Status)) { StartAddress =3D (EFI_PHYSICAL_ADDRESS)-1; - } else if (PcdGetBool (PcdSevEsIsEnabled)) { + } else if (ConfidentialComputingGuestHas (CCAttrAmdSevEs)) { // // Next SEV-ES wakeup buffer allocation must be below this allocation // diff --git a/UefiCpuPkg/Library/MpInitLib/MpLib.c b/UefiCpuPkg/Library/MpIn= itLib/MpLib.c index 34555c069331..64fddb497e1e 100644 --- a/UefiCpuPkg/Library/MpInitLib/MpLib.c +++ b/UefiCpuPkg/Library/MpInitLib/MpLib.c @@ -295,7 +295,7 @@ GetApLoopMode ( ApLoopMode =3D ApInHltLoop; } =20 - if (PcdGetBool (PcdSevEsIsEnabled)) { + if (ConfidentialComputingGuestHas (CCAttrAmdSevEs)) { // // For SEV-ES, force AP in Hlt-loop mode in order to use the GHCB // protocol for starting APs @@ -1055,7 +1055,7 @@ AllocateResetVector ( // The AP reset stack is only used by SEV-ES guests. Do not allocate i= t // if SEV-ES is not enabled. // - if (PcdGetBool (PcdSevEsIsEnabled)) { + if (ConfidentialComputingGuestHas (CCAttrAmdSevEs)) { // // Stack location is based on ProcessorNumber, so use the total numb= er // of processors for calculating the total stack area. @@ -1847,7 +1847,7 @@ MpInitLibInitialize ( CpuMpData->CpuData =3D (CPU_AP_DATA *)(CpuMpData + 1); CpuMpData->CpuInfoInHob =3D (UINT64)(UINTN)(CpuMpData->CpuData + Max= LogicalProcessorNumber); InitializeSpinLock (&CpuMpData->MpLock); - CpuMpData->SevEsIsEnabled =3D PcdGetBool (PcdSevEsIsEnabled); + CpuMpData->SevEsIsEnabled =3D ConfidentialComputingGuestHas (CCAttrAmdSe= vEs); CpuMpData->SevEsAPBuffer =3D (UINTN)-1; CpuMpData->GhcbBase =3D PcdGet64 (PcdGhcbBase); =20 @@ -2755,3 +2755,70 @@ MpInitLibStartupAllCPUs ( NULL ); } + +/** + The function check if the specified Attr is set. + + @param[in] CurrentAttr The current attribute. + @param[in] Attr The attribute to check. + + @retval TRUE The specified Attr is set. + @retval FALSE The specified Attr is not set. + +**/ +STATIC +BOOLEAN +AmdMemEncryptionAttrCheck ( + IN UINT64 CurrentAttr, + IN CONFIDENTIAL_COMPUTING_GUEST_ATTR Attr + ) +{ + switch (Attr) { + case CCAttrAmdSev: + // + // SEV is automatically enabled if SEV-ES or SEV-SNP is active. + // + return CurrentAttr >=3D CCAttrAmdSev; + case CCAttrAmdSevEs: + // + // SEV-ES is automatically enabled if SEV-SNP is active. + // + return CurrentAttr >=3D CCAttrAmdSevEs; + case CCAttrAmdSevSnp: + return CurrentAttr =3D=3D CCAttrAmdSevSnp; + default: + return FALSE; + } +} + +/** + Check if the specified confidential computing attribute is active. + + @param[in] Attr The attribute to check. + + @retval TRUE The specified Attr is active. + @retval FALSE The specified Attr is not active. + +**/ +BOOLEAN +EFIAPI +ConfidentialComputingGuestHas ( + IN CONFIDENTIAL_COMPUTING_GUEST_ATTR Attr + ) +{ + UINT64 CurrentAttr; + + // + // Get the current CC attribute. + // + CurrentAttr =3D PcdGet64 (PcdConfidentialComputingGuestAttr); + + // + // If attr is for the AMD group then call AMD specific checks. + // + if (((RShiftU64 (CurrentAttr, 8)) & 0xff) =3D=3D 1) { + return AmdMemEncryptionAttrCheck (CurrentAttr, Attr); + } + + return (CurrentAttr =3D=3D Attr); +} diff --git a/UefiCpuPkg/Library/MpInitLib/PeiMpLib.c b/UefiCpuPkg/Library/M= pInitLib/PeiMpLib.c index ab79360bb935..efce5747277a 100644 --- a/UefiCpuPkg/Library/MpInitLib/PeiMpLib.c +++ b/UefiCpuPkg/Library/MpInitLib/PeiMpLib.c @@ -225,7 +225,7 @@ GetWakeupBuffer ( // Need memory under 1MB to be collected here // WakeupBufferEnd =3D Hob.ResourceDescriptor->PhysicalStart + Hob.Re= sourceDescriptor->ResourceLength; - if (PcdGetBool (PcdSevEsIsEnabled) && + if (ConfidentialComputingGuestHas (CCAttrAmdSevEs) && (WakeupBufferEnd > mSevEsPeiWakeupBuffer)) { // @@ -264,7 +264,7 @@ GetWakeupBuffer ( WakeupBufferSize )); =20 - if (PcdGetBool (PcdSevEsIsEnabled)) { + if (ConfidentialComputingGuestHas (CCAttrAmdSevEs)) { // // Next SEV-ES wakeup buffer allocation must be below this // allocation --=20 2.25.1