* [PATCH 1/2] OvmfPkg: Add SecPeiCcProbeLib
2022-07-07 6:17 [PATCH 0/2] Re-design CcProbeLib Min Xu
@ 2022-07-07 6:17 ` Min Xu
2022-07-07 6:17 ` [PATCH 2/2] OvmfPkg: Update CcProbeLib Min Xu
1 sibling, 0 replies; 3+ messages in thread
From: Min Xu @ 2022-07-07 6:17 UTC (permalink / raw)
To: devel
Cc: Min M Xu, Erdem Aktas, James Bottomley, Jiewen Yao, Gerd Hoffmann,
Tom Lendacky, Yuan Yu
From: Min M Xu <min.m.xu@intel.com>
BZ: https://bugzilla.tianocore.org/show_bug.cgi?id=3974
SecPeiCcProbeLib is designed to probe the Confidential Computing guest
type in SEC/PEI phase. The CC guest type was set by each CC guest at
the beginning of boot up and saved in PcdOvmfWorkArea.
Cc: Erdem Aktas <erdemaktas@google.com>
Cc: James Bottomley <jejb@linux.ibm.com>
Cc: Jiewen Yao <jiewen.yao@intel.com>
Cc: Gerd Hoffmann <kraxel@redhat.com>
Cc: Tom Lendacky <thomas.lendacky@amd.com>
Cc: Yuan Yu <yuanyu@google.com>
Signed-off-by: Min Xu <min.m.xu@intel.com>
---
OvmfPkg/Library/CcProbeLib/SecPeiCcProbeLib.c | 31 +++++++++++++++++++
.../Library/CcProbeLib/SecPeiCcProbeLib.inf | 25 +++++++++++++++
2 files changed, 56 insertions(+)
create mode 100644 OvmfPkg/Library/CcProbeLib/SecPeiCcProbeLib.c
create mode 100644 OvmfPkg/Library/CcProbeLib/SecPeiCcProbeLib.inf
diff --git a/OvmfPkg/Library/CcProbeLib/SecPeiCcProbeLib.c b/OvmfPkg/Library/CcProbeLib/SecPeiCcProbeLib.c
new file mode 100644
index 000000000000..d698e5c8d7f8
--- /dev/null
+++ b/OvmfPkg/Library/CcProbeLib/SecPeiCcProbeLib.c
@@ -0,0 +1,31 @@
+/** @file
+
+ CcProbeLib is used to probe the Confidential computing guest type.
+
+ Copyright (c) 2022, Intel Corporation. All rights reserved.<BR>
+ SPDX-License-Identifier: BSD-2-Clause-Patent
+
+**/
+
+#include <Library/CcProbeLib.h>
+#include <WorkArea.h>
+
+/**
+ Probe the ConfidentialComputing Guest type. See defition of
+ CC_GUEST_TYPE in <ConfidentialComputingGuestAttr.h>.
+
+ @return The guest type
+
+**/
+UINT8
+EFIAPI
+CcProbe (
+ VOID
+ )
+{
+ OVMF_WORK_AREA *WorkArea;
+
+ WorkArea = (OVMF_WORK_AREA *)FixedPcdGet32 (PcdOvmfWorkAreaBase);
+
+ return WorkArea != NULL ? WorkArea->Header.GuestType : CcGuestTypeNonEncrypted;
+}
diff --git a/OvmfPkg/Library/CcProbeLib/SecPeiCcProbeLib.inf b/OvmfPkg/Library/CcProbeLib/SecPeiCcProbeLib.inf
new file mode 100644
index 000000000000..f63ed71e7c28
--- /dev/null
+++ b/OvmfPkg/Library/CcProbeLib/SecPeiCcProbeLib.inf
@@ -0,0 +1,25 @@
+## @file
+# CcProbeLib is used to probe Confidential Computing guest type.
+#
+# Copyright (c) 2022, Intel Corporation. All rights reserved.<BR>
+# SPDX-License-Identifier: BSD-2-Clause-Patent
+#
+##
+
+[Defines]
+ INF_VERSION = 0x00010005
+ BASE_NAME = SecPeiCcProbeLib
+ FILE_GUID = 78eb7f2a-a42a-4b01-b160-5a05a0a52bac
+ MODULE_TYPE = BASE
+ VERSION_STRING = 1.0
+ LIBRARY_CLASS = CcProbeLib|SEC PEIM PEI_CORE
+
+[Sources]
+ SecPeiCcProbeLib.c
+
+[Packages]
+ MdePkg/MdePkg.dec
+ OvmfPkg/OvmfPkg.dec
+
+[Pcd]
+ gUefiOvmfPkgTokenSpaceGuid.PcdOvmfWorkAreaBase
--
2.29.2.windows.2
^ permalink raw reply related [flat|nested] 3+ messages in thread* [PATCH 2/2] OvmfPkg: Update CcProbeLib
2022-07-07 6:17 [PATCH 0/2] Re-design CcProbeLib Min Xu
2022-07-07 6:17 ` [PATCH 1/2] OvmfPkg: Add SecPeiCcProbeLib Min Xu
@ 2022-07-07 6:17 ` Min Xu
1 sibling, 0 replies; 3+ messages in thread
From: Min Xu @ 2022-07-07 6:17 UTC (permalink / raw)
To: devel
Cc: Min M Xu, Gerd Hoffmann, Erdem Aktas, James Bottomley, Jiewen Yao,
Tom Lendacky, Yuan Yu
From: Min M Xu <min.m.xu@intel.com>
BZ: https://bugzilla.tianocore.org/show_bug.cgi?id=3974
CcProbeLib once was designed to probe the Confidential Computing guest
type by checking the PcdOvmfWorkArea. But this memory is allocated with
either EfiACPIMemoryNVS or EfiBootServicesData. It cannot be accessed
after ExitBootService. Please see the detailed analysis in BZ#3974.
To fix this issue, CcProbeLib is redesigned as 2 implementation:
- SecPeiCcProbeLib
- CcProbeLib
In SecPeiCcProbeLib we still check the CC guest type by reading the
PcdOvmfWorkArea. Because it is used in SEC / PEI and we don't worry about
the issues in BZ#3974.
In CcProbeLib we call TdIsEnabled() to check if it is of Tdx guest. To
improve the efficiency the result is cached in a global variable. In
current stage only the Tdx related code is added in CcProbeLib. SEV code
may be added in the future.
The reason why we probe CC guest type in 2 different ways is the global
varialbe. Global variable cannot be used in SEC/PEI and CcProbe is called
very frequently.
Cc: Gerd Hoffmann <kraxel@redhat.com>
Cc: Erdem Aktas <erdemaktas@google.com>
Cc: James Bottomley <jejb@linux.ibm.com>
Cc: Jiewen Yao <jiewen.yao@intel.com>
Cc: Tom Lendacky <thomas.lendacky@amd.com>
Cc: Yuan Yu <yuanyu@google.com>
Signed-off-by: Min Xu <min.m.xu@intel.com>
---
OvmfPkg/IntelTdx/IntelTdxX64.dsc | 1 +
OvmfPkg/Library/CcProbeLib/CcProbeLib.c | 24 +++++++++++++++++++----
OvmfPkg/Library/CcProbeLib/CcProbeLib.inf | 5 +----
OvmfPkg/OvmfPkgX64.dsc | 3 +++
4 files changed, 25 insertions(+), 8 deletions(-)
diff --git a/OvmfPkg/IntelTdx/IntelTdxX64.dsc b/OvmfPkg/IntelTdx/IntelTdxX64.dsc
index 144d50aa9dba..ca41d9d13e7a 100644
--- a/OvmfPkg/IntelTdx/IntelTdxX64.dsc
+++ b/OvmfPkg/IntelTdx/IntelTdxX64.dsc
@@ -234,6 +234,7 @@
HobLib|EmbeddedPkg/Library/PrePiHobLib/PrePiHobLib.inf
PrePiLib|EmbeddedPkg/Library/PrePiLib/PrePiLib.inf
PeilessStartupLib|OvmfPkg/Library/PeilessStartupLib/PeilessStartupLib.inf
+ CcProbeLib|OvmfPkg/Library/CcProbeLib/SecPeiCcProbeLib.inf
[LibraryClasses.common.DXE_CORE]
HobLib|MdePkg/Library/DxeCoreHobLib/DxeCoreHobLib.inf
diff --git a/OvmfPkg/Library/CcProbeLib/CcProbeLib.c b/OvmfPkg/Library/CcProbeLib/CcProbeLib.c
index d698e5c8d7f8..efb929ef8b21 100644
--- a/OvmfPkg/Library/CcProbeLib/CcProbeLib.c
+++ b/OvmfPkg/Library/CcProbeLib/CcProbeLib.c
@@ -7,8 +7,12 @@
**/
+#include <Base.h>
+#include <Library/BaseLib.h>
#include <Library/CcProbeLib.h>
-#include <WorkArea.h>
+
+STATIC UINT8 CcProbeGuestType = 0;
+STATIC BOOLEAN CcProbed = FALSE;
/**
Probe the ConfidentialComputing Guest type. See defition of
@@ -23,9 +27,21 @@ CcProbe (
VOID
)
{
- OVMF_WORK_AREA *WorkArea;
+ if (CcProbed) {
+ return CcProbeGuestType;
+ }
- WorkArea = (OVMF_WORK_AREA *)FixedPcdGet32 (PcdOvmfWorkAreaBase);
+ if (TdIsEnabled ()) {
+ CcProbeGuestType = CcGuestTypeIntelTdx;
+ } else {
+ //
+ // SEV code should be added here to determine if it is CcGuestTypeAmdSev.
+ // Now we set CcProbeGuestType to CcGuestTypeNonEncrypted.
+ //
+ CcProbeGuestType = CcGuestTypeNonEncrypted;
+ }
- return WorkArea != NULL ? WorkArea->Header.GuestType : CcGuestTypeNonEncrypted;
+ CcProbed = TRUE;
+
+ return CcProbeGuestType;
}
diff --git a/OvmfPkg/Library/CcProbeLib/CcProbeLib.inf b/OvmfPkg/Library/CcProbeLib/CcProbeLib.inf
index 5300c9ba2644..99b7434d6180 100644
--- a/OvmfPkg/Library/CcProbeLib/CcProbeLib.inf
+++ b/OvmfPkg/Library/CcProbeLib/CcProbeLib.inf
@@ -12,7 +12,7 @@
FILE_GUID = 05184ec9-abb0-4491-8584-e388639a7c48
MODULE_TYPE = BASE
VERSION_STRING = 1.0
- LIBRARY_CLASS = CcProbeLib
+ LIBRARY_CLASS = CcProbeLib|DXE_CORE DXE_DRIVER DXE_RUNTIME_DRIVER DXE_SMM_DRIVER UEFI_DRIVER UEFI_APPLICATION
[Sources]
CcProbeLib.c
@@ -20,6 +20,3 @@
[Packages]
MdePkg/MdePkg.dec
OvmfPkg/OvmfPkg.dec
-
-[Pcd]
- gUefiOvmfPkgTokenSpaceGuid.PcdOvmfWorkAreaBase
diff --git a/OvmfPkg/OvmfPkgX64.dsc b/OvmfPkg/OvmfPkgX64.dsc
index 8ad04b50f74f..59d47ae272bb 100644
--- a/OvmfPkg/OvmfPkgX64.dsc
+++ b/OvmfPkg/OvmfPkgX64.dsc
@@ -287,6 +287,7 @@
!endif
VmgExitLib|OvmfPkg/Library/VmgExitLib/SecVmgExitLib.inf
MemEncryptSevLib|OvmfPkg/Library/BaseMemEncryptSevLib/SecMemEncryptSevLib.inf
+ CcProbeLib|OvmfPkg/Library/CcProbeLib/SecPeiCcProbeLib.inf
[LibraryClasses.common.PEI_CORE]
HobLib|MdePkg/Library/PeiHobLib/PeiHobLib.inf
@@ -303,6 +304,7 @@
DebugLib|OvmfPkg/Library/PlatformDebugLibIoPort/PlatformDebugLibIoPort.inf
!endif
PeCoffLib|MdePkg/Library/BasePeCoffLib/BasePeCoffLib.inf
+ CcProbeLib|OvmfPkg/Library/CcProbeLib/SecPeiCcProbeLib.inf
[LibraryClasses.common.PEIM]
HobLib|MdePkg/Library/PeiHobLib/PeiHobLib.inf
@@ -332,6 +334,7 @@
PlatformInitLib|OvmfPkg/Library/PlatformInitLib/PlatformInitLib.inf
MemEncryptSevLib|OvmfPkg/Library/BaseMemEncryptSevLib/PeiMemEncryptSevLib.inf
+ CcProbeLib|OvmfPkg/Library/CcProbeLib/SecPeiCcProbeLib.inf
[LibraryClasses.common.DXE_CORE]
HobLib|MdePkg/Library/DxeCoreHobLib/DxeCoreHobLib.inf
--
2.29.2.windows.2
^ permalink raw reply related [flat|nested] 3+ messages in thread