OvmfPkg: Update CcProbeLib to DxeCcProbeLib

BZ: https://bugzilla.tianocore.org/show_bug.cgi?id=3974

CcProbeLib once was designed to probe the Confidential Computing guest
type by checking the PcdOvmfWorkArea. But this memory is allocated with
either EfiACPIMemoryNVS or EfiBootServicesData. It cannot be accessed
after ExitBootService. Please see the detailed analysis in BZ#3974.

To fix this issue, CcProbeLib is redesigned as 2 implementation:
 - SecPeiCcProbeLib
 - DxeCcProbeLib

In SecPeiCcProbeLib we check the CC guest type by reading the
PcdOvmfWorkArea. Because it is used in SEC / PEI and we don't worry about
the issues in BZ#3974.

In DxeCcProbeLib we cache the GuestType in Ovmf work area in a variable.
After that the Guest type is returned with the cached value. So that we
don't need to worry about the access to Ovmf work area after
ExitBootService.

The reason why we probe CC guest type in 2 different ways is the global
varialbe. Global variable cannot be used in SEC/PEI and CcProbe is called
very frequently.

Cc: Gerd Hoffmann <kraxel@redhat.com>
Cc: Erdem Aktas <erdemaktas@google.com>
Cc: James Bottomley <jejb@linux.ibm.com>
Cc: Jiewen Yao <jiewen.yao@intel.com>
Cc: Tom Lendacky <thomas.lendacky@amd.com>
Signed-off-by: Min Xu <min.m.xu@intel.com>
Acked-by: Gerd Hoffmann <kraxel@redhat.com>
Reviewed-by: Jiewen Yao <jiewen.yao@intel.com>

diff --git a/OvmfPkg/IntelTdx/IntelTdxX64.dsc b/OvmfPkg/IntelTdx/IntelTdxX64.dsc
index 71b1cf8e7090e426ce10e82b11bb639ec2defd81..1a7ecd503e50cb924b835af5211efd1281b5ad74 100644 (file)
--- a/OvmfPkg/IntelTdx/IntelTdxX64.dsc
+++ b/OvmfPkg/IntelTdx/IntelTdxX64.dsc
@@ -140,7 +140,7 @@
   PciCapLib|OvmfPkg/Library/BasePciCapLib/BasePciCapLib.inf\r
   PciCapPciSegmentLib|OvmfPkg/Library/BasePciCapPciSegmentLib/BasePciCapPciSegmentLib.inf\r
   PciCapPciIoLib|OvmfPkg/Library/UefiPciCapPciIoLib/UefiPciCapPciIoLib.inf\r
-  CcProbeLib|OvmfPkg/Library/CcProbeLib/CcProbeLib.inf\r
+  CcProbeLib|OvmfPkg/Library/CcProbeLib/DxeCcProbeLib.inf\r
   IoLib|MdePkg/Library/BaseIoLibIntrinsic/BaseIoLibIntrinsicSev.inf\r
   OemHookStatusCodeLib|MdeModulePkg/Library/OemHookStatusCodeLibNull/OemHookStatusCodeLibNull.inf\r
   SerialPortLib|PcAtChipsetPkg/Library/SerialIoLib/SerialIoLib.inf\r
@@ -234,6 +234,7 @@
   HobLib|EmbeddedPkg/Library/PrePiHobLib/PrePiHobLib.inf\r
   PrePiLib|EmbeddedPkg/Library/PrePiLib/PrePiLib.inf\r
   PeilessStartupLib|OvmfPkg/Library/PeilessStartupLib/PeilessStartupLib.inf\r
+  CcProbeLib|OvmfPkg/Library/CcProbeLib/SecPeiCcProbeLib.inf\r
 \r
 [LibraryClasses.common.DXE_CORE]\r
   HobLib|MdePkg/Library/DxeCoreHobLib/DxeCoreHobLib.inf\r

diff --git a/OvmfPkg/Library/CcProbeLib/CcProbeLib.c b/OvmfPkg/Library/CcProbeLib/CcProbeLib.c
deleted file mode 100644 (file)
index d698e5c..0000000
--- a/OvmfPkg/Library/CcProbeLib/CcProbeLib.c
+++ /dev/null
@@ -1,31 +0,0 @@
-/** @file\r
-\r
-  CcProbeLib is used to probe the Confidential computing guest type.\r
-\r
-  Copyright (c) 2022, Intel Corporation. All rights reserved.<BR>\r
-  SPDX-License-Identifier: BSD-2-Clause-Patent\r
-\r
-**/\r
-\r
-#include <Library/CcProbeLib.h>\r
-#include <WorkArea.h>\r
-\r
-/**\r
-  Probe the ConfidentialComputing Guest type. See defition of\r
-  CC_GUEST_TYPE in <ConfidentialComputingGuestAttr.h>.\r
-\r
-  @return The guest type\r
-\r
-**/\r
-UINT8\r
-EFIAPI\r
-CcProbe (\r
-  VOID\r
-  )\r
-{\r
-  OVMF_WORK_AREA  *WorkArea;\r
-\r
-  WorkArea = (OVMF_WORK_AREA *)FixedPcdGet32 (PcdOvmfWorkAreaBase);\r
-\r
-  return WorkArea != NULL ? WorkArea->Header.GuestType : CcGuestTypeNonEncrypted;\r
-}\r

diff --git a/OvmfPkg/Library/CcProbeLib/CcProbeLib.inf b/OvmfPkg/Library/CcProbeLib/CcProbeLib.inf
deleted file mode 100644 (file)
index 5300c9b..0000000
--- a/OvmfPkg/Library/CcProbeLib/CcProbeLib.inf
+++ /dev/null
@@ -1,25 +0,0 @@
-## @file\r
-# CcProbeLib is used to probe Confidential Computing guest type.\r
-#\r
-#  Copyright (c) 2022, Intel Corporation. All rights reserved.<BR>\r
-#  SPDX-License-Identifier: BSD-2-Clause-Patent\r
-#\r
-##\r
-\r
-[Defines]\r
-  INF_VERSION                    = 0x00010005\r
-  BASE_NAME                      = CcProbeLib\r
-  FILE_GUID                      = 05184ec9-abb0-4491-8584-e388639a7c48\r
-  MODULE_TYPE                    = BASE\r
-  VERSION_STRING                 = 1.0\r
-  LIBRARY_CLASS                  = CcProbeLib\r
-\r
-[Sources]\r
-  CcProbeLib.c\r
-\r
-[Packages]\r
-  MdePkg/MdePkg.dec\r
-  OvmfPkg/OvmfPkg.dec\r
-\r
-[Pcd]\r
-  gUefiOvmfPkgTokenSpaceGuid.PcdOvmfWorkAreaBase\r

diff --git a/OvmfPkg/Library/CcProbeLib/DxeCcProbeLib.c b/OvmfPkg/Library/CcProbeLib/DxeCcProbeLib.c
new file mode 100644 (file)
index 0000000..868e32b
--- /dev/null
+++ b/OvmfPkg/Library/CcProbeLib/DxeCcProbeLib.c
@@ -0,0 +1,68 @@
+/** @file\r
+\r
+  CcProbeLib is used to probe the Confidential computing guest type.\r
+\r
+  Copyright (c) 2022, Intel Corporation. All rights reserved.<BR>\r
+  SPDX-License-Identifier: BSD-2-Clause-Patent\r
+\r
+**/\r
+\r
+#include <Uefi/UefiBaseType.h>\r
+#include <Library/CcProbeLib.h>\r
+#include <WorkArea.h>\r
+\r
+STATIC UINT8    mCcProbeGuestType = 0;\r
+STATIC BOOLEAN  mCcProbed         = FALSE;\r
+\r
+/**\r
+ * Read the the ConfidentialComputing Guest type from Ovmf work-area.\r
+ *\r
+ * @return The ConfidentialComputing Guest type\r
+ */\r
+STATIC\r
+UINT8\r
+ReadCcGuestType (\r
+  VOID\r
+  )\r
+{\r
+  OVMF_WORK_AREA  *WorkArea;\r
+\r
+  if (!mCcProbed) {\r
+    WorkArea          = (OVMF_WORK_AREA *)FixedPcdGet32 (PcdOvmfWorkAreaBase);\r
+    mCcProbeGuestType = WorkArea != NULL ? WorkArea->Header.GuestType : CcGuestTypeNonEncrypted;\r
+    mCcProbed         = TRUE;\r
+  }\r
+\r
+  return mCcProbeGuestType;\r
+}\r
+\r
+/**\r
+  Probe the ConfidentialComputing Guest type. See defition of\r
+  CC_GUEST_TYPE in <ConfidentialComputingGuestAttr.h>.\r
+\r
+  @return The guest type\r
+\r
+**/\r
+UINT8\r
+EFIAPI\r
+CcProbe (\r
+  VOID\r
+  )\r
+{\r
+  return ReadCcGuestType ();\r
+}\r
+\r
+/**\r
+ * Constructor of DxeCcProbeLib\r
+ *\r
+ * @return EFI_SUCCESS Successfully called of constructor\r
+ */\r
+EFI_STATUS\r
+EFIAPI\r
+DxeCcProbeLibConstructor (\r
+  VOID\r
+  )\r
+{\r
+  ReadCcGuestType ();\r
+  return EFI_SUCCESS;\r
+}\r

diff --git a/OvmfPkg/Library/CcProbeLib/DxeCcProbeLib.inf b/OvmfPkg/Library/CcProbeLib/DxeCcProbeLib.inf
new file mode 100644 (file)
index 0000000..2fd0b4d
--- /dev/null
+++ b/OvmfPkg/Library/CcProbeLib/DxeCcProbeLib.inf
@@ -0,0 +1,26 @@
+## @file\r
+# CcProbeLib is used to probe Confidential Computing guest type.\r
+#\r
+#  Copyright (c) 2022, Intel Corporation. All rights reserved.<BR>\r
+#  SPDX-License-Identifier: BSD-2-Clause-Patent\r
+#\r
+##\r
+\r
+[Defines]\r
+  INF_VERSION                    = 0x00010005\r
+  BASE_NAME                      = DxeCcProbeLib\r
+  FILE_GUID                      = 05184ec9-abb0-4491-8584-e388639a7c48\r
+  MODULE_TYPE                    = BASE\r
+  VERSION_STRING                 = 1.0\r
+  LIBRARY_CLASS                  = CcProbeLib|DXE_CORE DXE_DRIVER DXE_RUNTIME_DRIVER DXE_SMM_DRIVER UEFI_DRIVER UEFI_APPLICATION\r
+  CONSTRUCTOR                    = DxeCcProbeLibConstructor\r
+\r
+[Sources]\r
+  DxeCcProbeLib.c\r
+\r
+[Packages]\r
+  MdePkg/MdePkg.dec\r
+  OvmfPkg/OvmfPkg.dec\r
+\r
+[Pcd]\r
+  gUefiOvmfPkgTokenSpaceGuid.PcdOvmfWorkAreaBase\r

diff --git a/OvmfPkg/OvmfPkgX64.dsc b/OvmfPkg/OvmfPkgX64.dsc
index 5a6b68bcb106d4c89e99af5311b2af9272f71dc2..56012fba8eff630c74c329f480236e95c68b50e2 100644 (file)
--- a/OvmfPkg/OvmfPkgX64.dsc
+++ b/OvmfPkg/OvmfPkgX64.dsc
@@ -204,7 +204,7 @@
 \r
 !if $(SMM_REQUIRE) == FALSE\r
   LockBoxLib|OvmfPkg/Library/LockBoxLib/LockBoxBaseLib.inf\r
-  CcProbeLib|OvmfPkg/Library/CcProbeLib/CcProbeLib.inf\r
+  CcProbeLib|OvmfPkg/Library/CcProbeLib/DxeCcProbeLib.inf\r
 !else\r
   CcProbeLib|MdePkg/Library/CcProbeLibNull/CcProbeLibNull.inf\r
 !endif\r
@@ -295,6 +295,7 @@
 !endif\r
   VmgExitLib|OvmfPkg/Library/VmgExitLib/SecVmgExitLib.inf\r
   MemEncryptSevLib|OvmfPkg/Library/BaseMemEncryptSevLib/SecMemEncryptSevLib.inf\r
+  CcProbeLib|OvmfPkg/Library/CcProbeLib/SecPeiCcProbeLib.inf\r
 \r
 [LibraryClasses.common.PEI_CORE]\r
   HobLib|MdePkg/Library/PeiHobLib/PeiHobLib.inf\r
@@ -311,6 +312,7 @@
   DebugLib|OvmfPkg/Library/PlatformDebugLibIoPort/PlatformDebugLibIoPort.inf\r
 !endif\r
   PeCoffLib|MdePkg/Library/BasePeCoffLib/BasePeCoffLib.inf\r
+  CcProbeLib|OvmfPkg/Library/CcProbeLib/SecPeiCcProbeLib.inf\r
 \r
 [LibraryClasses.common.PEIM]\r
   HobLib|MdePkg/Library/PeiHobLib/PeiHobLib.inf\r
@@ -340,6 +342,7 @@
   PlatformInitLib|OvmfPkg/Library/PlatformInitLib/PlatformInitLib.inf\r
 \r
   MemEncryptSevLib|OvmfPkg/Library/BaseMemEncryptSevLib/PeiMemEncryptSevLib.inf\r
+  CcProbeLib|OvmfPkg/Library/CcProbeLib/SecPeiCcProbeLib.inf\r
 \r
 [LibraryClasses.common.DXE_CORE]\r
   HobLib|MdePkg/Library/DxeCoreHobLib/DxeCoreHobLib.inf\r