UefiCpuPkg/MpInitLib: use PcdConfidentialComputingAttr to check SEV status

BZ: https://bugzilla.tianocore.org/show_bug.cgi?id=3275

Previous commit introduced a generic confidential computing PCD that can
determine whether AMD SEV-ES is enabled. Update the MpInitLib to drop the
PcdSevEsIsEnabled in favor of PcdConfidentialComputingAttr.

Cc: Michael Roth <michael.roth@amd.com>
Cc: Ray Ni <ray.ni@intel.com>
Cc: Rahul Kumar <rahul1.kumar@intel.com>
Cc: Eric Dong <eric.dong@intel.com>
Cc: James Bottomley <jejb@linux.ibm.com>
Cc: Min Xu <min.m.xu@intel.com>
Cc: Jiewen Yao <jiewen.yao@intel.com>
Cc: Tom Lendacky <thomas.lendacky@amd.com>
Cc: Jordan Justen <jordan.l.justen@intel.com>
Cc: Ard Biesheuvel <ardb+tianocore@kernel.org>
Cc: Erdem Aktas <erdemaktas@google.com>
Cc: Gerd Hoffmann <kraxel@redhat.com>
Acked-by: Gerd Hoffmann <kraxel@redhat.com>
Acked-by: Ray Ni <ray.ni@intel.com>
Suggested-by: Jiewen Yao <jiewen.yao@intel.com>
Signed-off-by: Brijesh Singh <brijesh.singh@amd.com>

6 files changed, 90 insertions, 10 deletions

diff --git a/UefiCpuPkg/Library/MpInitLib/DxeMpInitLib.inf b/UefiCpuPkg/Library/MpInitLib/DxeMpInitLib.inf
index 6e510aa891..de705bc54b 100644
--- a/UefiCpuPkg/Library/MpInitLib/DxeMpInitLib.inf
+++ b/UefiCpuPkg/Library/MpInitLib/DxeMpInitLib.inf
@@ -73,7 +73,7 @@
   gUefiCpuPkgTokenSpaceGuid.PcdCpuApLoopMode                           ## CONSUMES

   gUefiCpuPkgTokenSpaceGuid.PcdCpuApTargetCstate                       ## SOMETIMES_CONSUMES

   gUefiCpuPkgTokenSpaceGuid.PcdCpuApStatusCheckIntervalInMicroSeconds  ## CONSUMES

-  gUefiCpuPkgTokenSpaceGuid.PcdSevEsIsEnabled                          ## CONSUMES

   gUefiCpuPkgTokenSpaceGuid.PcdSevEsWorkAreaBase                       ## SOMETIMES_CONSUMES

   gEfiMdeModulePkgTokenSpaceGuid.PcdCpuStackGuard                      ## CONSUMES

   gEfiMdeModulePkgTokenSpaceGuid.PcdGhcbBase                           ## CONSUMES

+  gEfiMdePkgTokenSpaceGuid.PcdConfidentialComputingGuestAttr           ## CONSUMES

diff --git a/UefiCpuPkg/Library/MpInitLib/DxeMpLib.c b/UefiCpuPkg/Library/MpInitLib/DxeMpLib.c
index 9d9206d209..02bc9c2bd2 100644
--- a/UefiCpuPkg/Library/MpInitLib/DxeMpLib.c
+++ b/UefiCpuPkg/Library/MpInitLib/DxeMpLib.c
@@ -93,7 +93,7 @@ GetWakeupBuffer (
   EFI_PHYSICAL_ADDRESS  StartAddress;

   EFI_MEMORY_TYPE       MemoryType;

 

-  if (PcdGetBool (PcdSevEsIsEnabled)) {

+  if (ConfidentialComputingGuestHas (CCAttrAmdSevEs)) {

     MemoryType = EfiReservedMemoryType;

   } else {

     MemoryType = EfiBootServicesData;

@@ -107,7 +107,7 @@ GetWakeupBuffer (
   // LagacyBios driver depends on CPU Arch protocol which guarantees below

   // allocation runs earlier than LegacyBios driver.

   //

-  if (PcdGetBool (PcdSevEsIsEnabled)) {

+  if (ConfidentialComputingGuestHas (CCAttrAmdSevEs)) {

     //

     // SEV-ES Wakeup buffer should be under 0x88000 and under any previous one

     //

@@ -125,7 +125,7 @@ GetWakeupBuffer (
   ASSERT_EFI_ERROR (Status);

   if (EFI_ERROR (Status)) {

     StartAddress = (EFI_PHYSICAL_ADDRESS)-1;

-  } else if (PcdGetBool (PcdSevEsIsEnabled)) {

+  } else if (ConfidentialComputingGuestHas (CCAttrAmdSevEs)) {

     //

     // Next SEV-ES wakeup buffer allocation must be below this allocation

     //

diff --git a/UefiCpuPkg/Library/MpInitLib/MpLib.c b/UefiCpuPkg/Library/MpInitLib/MpLib.c
index 34555c0693..64fddb497e 100644
--- a/UefiCpuPkg/Library/MpInitLib/MpLib.c
+++ b/UefiCpuPkg/Library/MpInitLib/MpLib.c
@@ -295,7 +295,7 @@ GetApLoopMode (
       ApLoopMode = ApInHltLoop;

     }

 

-    if (PcdGetBool (PcdSevEsIsEnabled)) {

+    if (ConfidentialComputingGuestHas (CCAttrAmdSevEs)) {

       //

       // For SEV-ES, force AP in Hlt-loop mode in order to use the GHCB

       // protocol for starting APs

@@ -1055,7 +1055,7 @@ AllocateResetVector (
     // The AP reset stack is only used by SEV-ES guests. Do not allocate it

     // if SEV-ES is not enabled.

     //

-    if (PcdGetBool (PcdSevEsIsEnabled)) {

+    if (ConfidentialComputingGuestHas (CCAttrAmdSevEs)) {

       //

       // Stack location is based on ProcessorNumber, so use the total number

       // of processors for calculating the total stack area.

@@ -1847,7 +1847,7 @@ MpInitLibInitialize (
   CpuMpData->CpuData          = (CPU_AP_DATA *)(CpuMpData + 1);

   CpuMpData->CpuInfoInHob     = (UINT64)(UINTN)(CpuMpData->CpuData + MaxLogicalProcessorNumber);

   InitializeSpinLock (&CpuMpData->MpLock);

-  CpuMpData->SevEsIsEnabled = PcdGetBool (PcdSevEsIsEnabled);

+  CpuMpData->SevEsIsEnabled = ConfidentialComputingGuestHas (CCAttrAmdSevEs);

   CpuMpData->SevEsAPBuffer  = (UINTN)-1;

   CpuMpData->GhcbBase       = PcdGet64 (PcdGhcbBase);

 

@@ -2755,3 +2755,70 @@ MpInitLibStartupAllCPUs (
            NULL

            );

 }

+

+/**

+  The function check if the specified Attr is set.

+

+  @param[in]  CurrentAttr   The current attribute.

+  @param[in]  Attr          The attribute to check.

+

+  @retval  TRUE      The specified Attr is set.

+  @retval  FALSE     The specified Attr is not set.

+

+**/

+STATIC

+BOOLEAN

+AmdMemEncryptionAttrCheck (

+  IN  UINT64                             CurrentAttr,

+  IN  CONFIDENTIAL_COMPUTING_GUEST_ATTR  Attr

+  )

+{

+  switch (Attr) {

+    case CCAttrAmdSev:

+      //

+      // SEV is automatically enabled if SEV-ES or SEV-SNP is active.

+      //

+      return CurrentAttr >= CCAttrAmdSev;

+    case CCAttrAmdSevEs:

+      //

+      // SEV-ES is automatically enabled if SEV-SNP is active.

+      //

+      return CurrentAttr >= CCAttrAmdSevEs;

+    case CCAttrAmdSevSnp:

+      return CurrentAttr == CCAttrAmdSevSnp;

+    default:

+      return FALSE;

+  }

+}

+

+/**

+  Check if the specified confidential computing attribute is active.

+

+  @param[in]  Attr          The attribute to check.

+

+  @retval TRUE   The specified Attr is active.

+  @retval FALSE  The specified Attr is not active.

+

+**/

+BOOLEAN

+EFIAPI

+ConfidentialComputingGuestHas (

+  IN  CONFIDENTIAL_COMPUTING_GUEST_ATTR  Attr

+  )

+{

+  UINT64  CurrentAttr;

+

+  //

+  // Get the current CC attribute.

+  //

+  CurrentAttr = PcdGet64 (PcdConfidentialComputingGuestAttr);

+

+  //

+  // If attr is for the AMD group then call AMD specific checks.

+  //

+  if (((RShiftU64 (CurrentAttr, 8)) & 0xff) == 1) {

+    return AmdMemEncryptionAttrCheck (CurrentAttr, Attr);

+  }

+

+  return (CurrentAttr == Attr);

+}

diff --git a/UefiCpuPkg/Library/MpInitLib/MpLib.h b/UefiCpuPkg/Library/MpInitLib/MpLib.h
index 16b4d76d01..a84df60519 100644
--- a/UefiCpuPkg/Library/MpInitLib/MpLib.h
+++ b/UefiCpuPkg/Library/MpInitLib/MpLib.h
@@ -33,6 +33,7 @@
 #include <Library/HobLib.h>

 #include <Library/PcdLib.h>

 #include <Library/MicrocodeLib.h>

+#include <ConfidentialComputingGuestAttr.h>

 

 #include <Register/Amd/Fam17Msr.h>

 #include <Register/Amd/Ghcb.h>

@@ -773,4 +774,16 @@ SevEsPlaceApHlt (
   CPU_MP_DATA  *CpuMpData

   );

 

+/**

+ Check if the specified confidential computing attribute is active.

+

+ @retval TRUE   The specified Attr is active.

+ @retval FALSE  The specified Attr is not active.

+**/

+BOOLEAN

+EFIAPI

+ConfidentialComputingGuestHas (

+  CONFIDENTIAL_COMPUTING_GUEST_ATTR  Attr

+  );

+

 #endif

diff --git a/UefiCpuPkg/Library/MpInitLib/PeiMpInitLib.inf b/UefiCpuPkg/Library/MpInitLib/PeiMpInitLib.inf
index 2cbd9b8b8a..b7e15ee023 100644
--- a/UefiCpuPkg/Library/MpInitLib/PeiMpInitLib.inf
+++ b/UefiCpuPkg/Library/MpInitLib/PeiMpInitLib.inf
@@ -63,9 +63,9 @@
   gUefiCpuPkgTokenSpaceGuid.PcdCpuMicrocodePatchRegionSize         ## CONSUMES

   gUefiCpuPkgTokenSpaceGuid.PcdCpuApLoopMode                       ## CONSUMES

   gUefiCpuPkgTokenSpaceGuid.PcdCpuApTargetCstate                   ## SOMETIMES_CONSUMES

-  gUefiCpuPkgTokenSpaceGuid.PcdSevEsIsEnabled                      ## CONSUMES

   gUefiCpuPkgTokenSpaceGuid.PcdSevEsWorkAreaBase                   ## SOMETIMES_CONSUMES

   gEfiMdeModulePkgTokenSpaceGuid.PcdGhcbBase                       ## CONSUMES

+  gEfiMdePkgTokenSpaceGuid.PcdConfidentialComputingGuestAttr       ## CONSUMES

 

 [Ppis]

   gEdkiiPeiShadowMicrocodePpiGuid        ## SOMETIMES_CONSUMES

diff --git a/UefiCpuPkg/Library/MpInitLib/PeiMpLib.c b/UefiCpuPkg/Library/MpInitLib/PeiMpLib.c
index ab79360bb9..efce574727 100644
--- a/UefiCpuPkg/Library/MpInitLib/PeiMpLib.c
+++ b/UefiCpuPkg/Library/MpInitLib/PeiMpLib.c
@@ -225,7 +225,7 @@ GetWakeupBuffer (
         // Need memory under 1MB to be collected here

         //

         WakeupBufferEnd = Hob.ResourceDescriptor->PhysicalStart + Hob.ResourceDescriptor->ResourceLength;

-        if (PcdGetBool (PcdSevEsIsEnabled) &&

+        if (ConfidentialComputingGuestHas (CCAttrAmdSevEs) &&

             (WakeupBufferEnd > mSevEsPeiWakeupBuffer))

         {

           //

@@ -264,7 +264,7 @@ GetWakeupBuffer (
             WakeupBufferSize

             ));

 

-          if (PcdGetBool (PcdSevEsIsEnabled)) {

+          if (ConfidentialComputingGuestHas (CCAttrAmdSevEs)) {

             //

             // Next SEV-ES wakeup buffer allocation must be below this

             // allocation