REF: https://bugzilla.tianocore.org/show_bug.cgi?id=3249
Intel's Trust Domain Extensions (Intel TDX) refers to an Intel technology
that extends Virtual Machines Extensions (VMX) and Multi-Key Total Memory
Encryption (MKTME) with a new kind of virutal machines guest called a
Trust Domain (TD). A TD is desinged to run in a CPU mode that protects the
confidentiality of TD memory contents and the TD's CPU state from other
software, including the hosting Virtual-Machine Monitor (VMM), unless
explicitly shared by the TD itself.
There are 2 configurations for TDVF to upstream. See below link for
the definitions of the 2 configurations.
https://edk2.groups.io/g/devel/message/76367
This patch-set is to enable Config-A in OvmfPkg.
- Merge the *basic* TDVF feature to existing OvmfX64Pkg.dsc. (Align
with existing SEV)
- Threat model: VMM is NOT out of TCB. (We don’t make things worse.)
- The OvmfX64Pkg.dsc includes SEV/TDX/normal OVMF basic boot capability.
The final binary can run on SEV/TDX/normal OVMF
- No changes to existing OvmfPkgX64 image layout.
- No need to add additional security features if they do not exist today
- No need to remove features if they exist today.
- RTMR is not supported
- PEI phase is NOT skipped in either Td or Non-Td
Note:
To improve the review efficiency the whole TDVF upstream to EDK2 is
splitted into several waves. Wave-1 is focused on the changes in
OvmfPkg/ResetVector. It is still in review.
This patch-set is Wave-2 which is focused on the changes in SEC/PEI/DXE
phases. Wave-2 has little dependencies on Wave-1 except some PCDs
definitions. So reviewers can skip Patch 01-03. Once Wave-1 is done,
Wave-2 will be rebased on the latest code base. Thanks for your
understanding.
Patch 01-03 are the patches of Wave-1 (ResetVector phase). They can be
skipped.
Patch 04 - 18 are changes in SEC phase. Also some libraries in these
patches are workable in both SEC and PEI.
Patch 19 - 21 are changes for PEI phase.
Patch 22 is copied from SEV's patch which defines a new PCD
(PcdConfidentialComputingGuestAttr). Because SEV is also doing the
upstream and some of the code is shared between TDX and SEV.
Reviewer can skip this patch.
Patch 23 - 28 are changes in DXE phase.
[TDX]: https://software.intel.com/content/dam/develop/external/us/en/
documents/tdx-whitepaper-final9-17.pdf
[TDX-Module]: https://software.intel.com/content/dam/develop/external/
us/en/documents/tdx-module-1.0-public-spec-v0.931.pdf
[TDVF]: https://software.intel.com/content/dam/develop/external/us/en/
documents/tdx-virtual-firmware-design-guide-rev-1.pdf
[GCHI]: https://software.intel.com/content/dam/develop/external/us/en/
documents/intel-tdx-guest-hypervisor-communication-interface-1.0-344426-002.pdf
Code is at https://github.com/mxu9/edk2/tree/tdvf_wave2.v2
v2 changes:
- Remove TdxProbeLib. It is to reduce the depencies of the lib.
- In v1 a new function (AllocatePagesWithMemoryType) is added in
PeiMemoryAllocationLib. This function is not necessary. It can
be replaced by PeiServicesAllocatePages.
- IoLibFifo.c is added in BaseIoLibIntrinsic. This file includes
the functions of read/write of I/O port fifo. These functions
will call TdIoReadFifo or SevIoReadFifo by checking TDX or SEV
in run-time.
- DXE related patches are added. (Patch 22-28)
- Fix typo in commit/comment message, or some minor changes.
- Rebase the edk2 code base. (4cc1458dbe00)
Cc: Brijesh Singh <brijesh.singh@amd.com>
Cc: Eric Dong <eric.dong@intel.com>
Cc: Erdem Aktas <erdemaktas@google.com>
Cc: Hao A Wu <hao.a.wu@intel.com>
Cc: Jian J Wang <jian.j.wang@intel.com>
Cc: James Bottomley <jejb@linux.ibm.com>
Cc: Jiewen Yao <jiewen.yao@intel.com>
Cc: Liming Gao <gaoliming@byosoft.com.cn>
Cc: Michael D Kinney <michael.d.kinney@intel.com>
Cc: Ray Ni <ray.ni@intel.com>
Cc: Rahul Kumar <rahul1.kumar@intel.com>
Cc: Tom Lendacky <thomas.lendacky@amd.com>
Cc: Zhiguang Liu <zhiguang.liu@intel.com>
Signed-off-by: Min Xu <min.m.xu@intel.com>
Min Xu (28):
OvmfPkg: Copy Main.asm from UefiCpuPkg to OvmfPkg's ResetVector
OvmfPkg: Enable TDX in ResetVector
OvmfPkg: Merge TEMP_MEM entries in Tdx metadata
MdePkg: Add Tdx.h
MdePkg: Add TdxLib to wrap Tdx operations
MdePkg: Update BaseIoLibIntrinsicSev to support Tdx
UefiCpuPkg: Support TDX in BaseXApicX2ApicLib
UefiCpuPkg: Add VmTdExitLibNull
UefiPayloadPkg: Prepare UefiPayloadPkg to use the VmTdExitLib library
OvmfPkg: Prepare OvmfPkg to use the VmTdExitLib library
OvmfPkg: Implement library support for VmTdExitLib in Ovmf
UefiCpuPkg/CpuExceptionHandler: Add base support for the #VE exception
UefiCpuPkg: Enable Tdx support in MpInitLib
OvmfPkg: Update SecEntry.nasm to support Tdx
OvmfPkg: Add IntelTdx.h in OvmfPkg/Include/IndustryStandard
OvmfPkg: Add TdxMailboxLib
MdePkg: Add EFI_RESOURCE_ATTRIBUTE_ENCRYPTED in PiHob.h
OvmfPkg: Enable Tdx in SecMain.c
OvmfPkg: Check Tdx in QemuFwCfgPei to avoid DMA operation
MdeModulePkg: EFER should not be changed in TDX
OvmfPkg: Update PlatformPei to support TDX
UefiCpuPkg: Define ConfidentialComputingGuestAttr (Temp)
OvmfPkg: Update AcpiPlatformDxe to alter MADT table
OvmfPkg: Add TdxDxe driver
OvmfPkg/BaseMemEncryptTdxLib: Add TDX helper library
OvmfPkg/QemuFwCfgLib: Support Tdx in QemuFwCfgDxe
OvmfPkg: Update IoMmuDxe to support TDX
OvmfPkg: Add LocalApicTimerDxe
MdeModulePkg/Core/DxeIplPeim/DxeIpl.inf | 1 +
.../Core/DxeIplPeim/X64/VirtualMemory.c | 6 +
MdeModulePkg/MdeModulePkg.dec | 5 +
MdePkg/Include/IndustryStandard/Tdx.h | 203 ++++
MdePkg/Include/Library/TdxLib.h | 167 ++++
MdePkg/Include/Pi/PiHob.h | 8 +
.../BaseIoLibIntrinsic/BaseIoLibIntrinsic.inf | 2 +
.../BaseIoLibIntrinsicSev.inf | 7 +-
MdePkg/Library/BaseIoLibIntrinsic/IoLib.c | 97 +-
MdePkg/Library/BaseIoLibIntrinsic/IoLibFifo.c | 216 ++++
MdePkg/Library/BaseIoLibIntrinsic/IoLibGcc.c | 49 +-
.../BaseIoLibIntrinsic/IoLibInternalTdx.c | 735 ++++++++++++++
.../BaseIoLibIntrinsic/IoLibInternalTdxNull.c | 499 ++++++++++
MdePkg/Library/BaseIoLibIntrinsic/IoLibMsc.c | 73 +-
MdePkg/Library/BaseIoLibIntrinsic/IoLibSev.h | 166 ++++
MdePkg/Library/BaseIoLibIntrinsic/IoLibTdx.h | 411 ++++++++
.../BaseIoLibIntrinsic/X64/IoFifoSev.nasm | 34 +-
MdePkg/Library/TdxLib/AcceptPages.c | 136 +++
MdePkg/Library/TdxLib/Rtmr.c | 118 +++
MdePkg/Library/TdxLib/TdInfo.c | 103 ++
MdePkg/Library/TdxLib/TdxLib.inf | 39 +
MdePkg/Library/TdxLib/TdxLibNull.c | 192 ++++
MdePkg/Library/TdxLib/X64/Tdcall.nasm | 85 ++
MdePkg/Library/TdxLib/X64/Tdvmcall.nasm | 207 ++++
MdePkg/MdePkg.dec | 3 +
MdePkg/MdePkg.dsc | 1 +
OvmfPkg/8254TimerDxe/8254Timer.inf | 3 +
OvmfPkg/8254TimerDxe/Timer.c | 5 +
OvmfPkg/8254TimerDxe/Timer.h | 1 +
OvmfPkg/8259InterruptControllerDxe/8259.c | 1 +
OvmfPkg/8259InterruptControllerDxe/8259.inf | 1 +
OvmfPkg/AcpiPlatformDxe/QemuFwCfgAcpi.c | 12 +-
.../QemuFwCfgAcpiPlatformDxe.inf | 1 +
OvmfPkg/Include/IndustryStandard/AcpiTdx.h | 23 +
OvmfPkg/Include/IndustryStandard/IntelTdx.h | 76 ++
OvmfPkg/Include/Library/MemEncryptTdxLib.h | 81 ++
OvmfPkg/Include/Library/TdxMailboxLib.h | 75 ++
.../Include/Protocol/QemuAcpiTableNotify.h | 29 +
OvmfPkg/Include/Protocol/TimerSelector.h | 16 +
OvmfPkg/Include/TdxCommondefs.inc | 51 +
OvmfPkg/IoMmuDxe/AmdSevIoMmu.c | 134 ++-
OvmfPkg/IoMmuDxe/AmdSevIoMmu.h | 12 +
OvmfPkg/IoMmuDxe/IoMmuDxe.c | 4 +-
OvmfPkg/IoMmuDxe/IoMmuDxe.inf | 1 +
.../BaseMemEncryptTdxLib.inf | 45 +
.../BaseMemEncryptTdxLibNull.inf | 35 +
.../BaseMemoryEncryptionNull.c | 90 ++
.../BaseMemEncryptTdxLib/MemoryEncryption.c | 938 ++++++++++++++++++
.../BaseMemEncryptTdxLib/VirtualMemory.h | 181 ++++
OvmfPkg/Library/QemuFwCfgLib/QemuFwCfgDxe.c | 9 +-
.../Library/QemuFwCfgLib/QemuFwCfgDxeLib.inf | 1 +
.../QemuFwCfgLib/QemuFwCfgLibInternal.h | 11 +
OvmfPkg/Library/QemuFwCfgLib/QemuFwCfgPei.c | 32 +
.../Library/QemuFwCfgLib/QemuFwCfgPeiLib.inf | 2 +
OvmfPkg/Library/TdxMailboxLib/TdxMailbox.c | 138 +++
.../Library/TdxMailboxLib/TdxMailboxLib.inf | 52 +
.../Library/TdxMailboxLib/TdxMailboxNull.c | 86 ++
OvmfPkg/Library/VmTdExitLib/VmTdExitLib.inf | 39 +
.../Library/VmTdExitLib/VmTdExitVeHandler.c | 515 ++++++++++
OvmfPkg/LocalApicTimerDxe/LocalApicTimer.c | 488 +++++++++
.../LocalApicTimerDxe/LocalApicTimerDxe.inf | 52 +
.../LocalApicTimerDxe/LocalApicTimerDxe.uni | 13 +
OvmfPkg/OvmfPkg.dec | 45 +
OvmfPkg/OvmfPkgDefines.fdf.inc | 9 +
OvmfPkg/OvmfPkgIa32.dsc | 4 +
OvmfPkg/OvmfPkgIa32X64.dsc | 4 +
OvmfPkg/OvmfPkgX64.dsc | 15 +
OvmfPkg/OvmfPkgX64.fdf | 4 +
OvmfPkg/OvmfXen.dsc | 1 +
OvmfPkg/PlatformPei/FeatureControl.c | 8 +-
OvmfPkg/PlatformPei/IntelTdx.c | 286 ++++++
OvmfPkg/PlatformPei/IntelTdxNull.c | 49 +
OvmfPkg/PlatformPei/MemDetect.c | 57 +-
OvmfPkg/PlatformPei/Platform.c | 1 +
OvmfPkg/PlatformPei/Platform.h | 28 +
OvmfPkg/PlatformPei/PlatformPei.inf | 13 +
OvmfPkg/PlatformPei/X64/ApRunLoop.nasm | 83 ++
OvmfPkg/ResetVector/Ia16/ResetVectorVtf0.asm | 39 +
OvmfPkg/ResetVector/Ia32/Flat32ToFlat64.asm | 11 +
OvmfPkg/ResetVector/Ia32/IntelTdx.asm | 235 +++++
OvmfPkg/ResetVector/Ia32/PageTables64.asm | 21 +-
OvmfPkg/ResetVector/Main.asm | 119 +++
OvmfPkg/ResetVector/ResetVector.inf | 9 +
OvmfPkg/ResetVector/ResetVector.nasmb | 37 +-
OvmfPkg/ResetVector/X64/IntelTdxMetadata.asm | 86 ++
OvmfPkg/Sec/IntelTdx.c | 608 ++++++++++++
OvmfPkg/Sec/IntelTdx.h | 33 +
OvmfPkg/Sec/SecMain.c | 60 +-
OvmfPkg/Sec/SecMain.inf | 7 +
OvmfPkg/Sec/X64/SecEntry.nasm | 314 ++++++
OvmfPkg/TdxDxe/TdxAcpiTable.c | 207 ++++
OvmfPkg/TdxDxe/TdxAcpiTable.h | 38 +
OvmfPkg/TdxDxe/TdxDxe.c | 210 ++++
OvmfPkg/TdxDxe/TdxDxe.inf | 63 ++
.../Include/ConfidentialComputingGuestAttr.h | 25 +
UefiCpuPkg/Include/Library/VmTdExitLib.h | 47 +
.../BaseXApicX2ApicLib/BaseXApicX2ApicLib.c | 233 ++++-
.../BaseXApicX2ApicLib/BaseXApicX2ApicLib.inf | 1 +
.../DxeCpuExceptionHandlerLib.inf | 1 +
.../PeiCpuExceptionHandlerLib.inf | 1 +
.../PeiDxeSmmCpuException.c | 18 +
.../SecPeiCpuException.c | 19 +
.../SecPeiCpuExceptionHandlerLib.inf | 1 +
.../SmmCpuExceptionHandlerLib.inf | 1 +
.../Xcode5SecPeiCpuExceptionHandlerLib.inf | 1 +
UefiCpuPkg/Library/MpInitLib/DxeMpInitLib.inf | 4 +
UefiCpuPkg/Library/MpInitLib/DxeMpLib.c | 14 +-
UefiCpuPkg/Library/MpInitLib/MpIntelTdx.h | 107 ++
UefiCpuPkg/Library/MpInitLib/MpLib.c | 26 +
UefiCpuPkg/Library/MpInitLib/MpLibTdx.c | 186 ++++
UefiCpuPkg/Library/MpInitLib/MpLibTdxNull.c | 117 +++
UefiCpuPkg/Library/MpInitLib/PeiMpInitLib.inf | 4 +
.../Library/MpInitLib/X64/IntelTdcall.nasm | 120 +++
.../Library/VmTdExitLibNull/VmTdExitLibNull.c | 37 +
.../VmTdExitLibNull/VmTdExitLibNull.inf | 34 +
UefiCpuPkg/UefiCpuPkg.dec | 7 +
UefiCpuPkg/UefiCpuPkg.dsc | 3 +
UefiPayloadPkg/UefiPayloadPkg.dsc | 3 +
118 files changed, 10387 insertions(+), 143 deletions(-)
create mode 100644 MdePkg/Include/IndustryStandard/Tdx.h
create mode 100644 MdePkg/Include/Library/TdxLib.h
create mode 100644 MdePkg/Library/BaseIoLibIntrinsic/IoLibFifo.c
create mode 100644 MdePkg/Library/BaseIoLibIntrinsic/IoLibInternalTdx.c
create mode 100644 MdePkg/Library/BaseIoLibIntrinsic/IoLibInternalTdxNull.c
create mode 100644 MdePkg/Library/BaseIoLibIntrinsic/IoLibSev.h
create mode 100644 MdePkg/Library/BaseIoLibIntrinsic/IoLibTdx.h
create mode 100644 MdePkg/Library/TdxLib/AcceptPages.c
create mode 100644 MdePkg/Library/TdxLib/Rtmr.c
create mode 100644 MdePkg/Library/TdxLib/TdInfo.c
create mode 100644 MdePkg/Library/TdxLib/TdxLib.inf
create mode 100644 MdePkg/Library/TdxLib/TdxLibNull.c
create mode 100644 MdePkg/Library/TdxLib/X64/Tdcall.nasm
create mode 100644 MdePkg/Library/TdxLib/X64/Tdvmcall.nasm
create mode 100644 OvmfPkg/Include/IndustryStandard/AcpiTdx.h
create mode 100644 OvmfPkg/Include/IndustryStandard/IntelTdx.h
create mode 100644 OvmfPkg/Include/Library/MemEncryptTdxLib.h
create mode 100644 OvmfPkg/Include/Library/TdxMailboxLib.h
create mode 100644 OvmfPkg/Include/Protocol/QemuAcpiTableNotify.h
create mode 100644 OvmfPkg/Include/Protocol/TimerSelector.h
create mode 100644 OvmfPkg/Include/TdxCommondefs.inc
create mode 100644 OvmfPkg/Library/BaseMemEncryptTdxLib/BaseMemEncryptTdxLib.inf
create mode 100644 OvmfPkg/Library/BaseMemEncryptTdxLib/BaseMemEncryptTdxLibNull.inf
create mode 100644 OvmfPkg/Library/BaseMemEncryptTdxLib/BaseMemoryEncryptionNull.c
create mode 100644 OvmfPkg/Library/BaseMemEncryptTdxLib/MemoryEncryption.c
create mode 100644 OvmfPkg/Library/BaseMemEncryptTdxLib/VirtualMemory.h
create mode 100644 OvmfPkg/Library/TdxMailboxLib/TdxMailbox.c
create mode 100644 OvmfPkg/Library/TdxMailboxLib/TdxMailboxLib.inf
create mode 100644 OvmfPkg/Library/TdxMailboxLib/TdxMailboxNull.c
create mode 100644 OvmfPkg/Library/VmTdExitLib/VmTdExitLib.inf
create mode 100644 OvmfPkg/Library/VmTdExitLib/VmTdExitVeHandler.c
create mode 100644 OvmfPkg/LocalApicTimerDxe/LocalApicTimer.c
create mode 100644 OvmfPkg/LocalApicTimerDxe/LocalApicTimerDxe.inf
create mode 100644 OvmfPkg/LocalApicTimerDxe/LocalApicTimerDxe.uni
create mode 100644 OvmfPkg/PlatformPei/IntelTdx.c
create mode 100644 OvmfPkg/PlatformPei/IntelTdxNull.c
create mode 100644 OvmfPkg/PlatformPei/X64/ApRunLoop.nasm
create mode 100644 OvmfPkg/ResetVector/Ia32/IntelTdx.asm
create mode 100644 OvmfPkg/ResetVector/Main.asm
create mode 100644 OvmfPkg/ResetVector/X64/IntelTdxMetadata.asm
create mode 100644 OvmfPkg/Sec/IntelTdx.c
create mode 100644 OvmfPkg/Sec/IntelTdx.h
create mode 100644 OvmfPkg/TdxDxe/TdxAcpiTable.c
create mode 100644 OvmfPkg/TdxDxe/TdxAcpiTable.h
create mode 100644 OvmfPkg/TdxDxe/TdxDxe.c
create mode 100644 OvmfPkg/TdxDxe/TdxDxe.inf
create mode 100644 UefiCpuPkg/Include/ConfidentialComputingGuestAttr.h
create mode 100644 UefiCpuPkg/Include/Library/VmTdExitLib.h
create mode 100644 UefiCpuPkg/Library/MpInitLib/MpIntelTdx.h
create mode 100644 UefiCpuPkg/Library/MpInitLib/MpLibTdx.c
create mode 100644 UefiCpuPkg/Library/MpInitLib/MpLibTdxNull.c
create mode 100644 UefiCpuPkg/Library/MpInitLib/X64/IntelTdcall.nasm
create mode 100644 UefiCpuPkg/Library/VmTdExitLibNull/VmTdExitLibNull.c
create mode 100644 UefiCpuPkg/Library/VmTdExitLibNull/VmTdExitLibNull.inf
--
2.29.2.windows.2
-=-=-=-=-=-=-=-=-=-=-=-
Groups.io Links: You receive all messages sent to this group.
View/Reply Online (#81472): https://edk2.groups.io/g/devel/message/81472
Mute This Topic: https://groups.io/mt/86085720/1787277
Group Owner: devel+owner@edk2.groups.io
Unsubscribe: https://edk2.groups.io/g/devel/unsub [importer@patchew.org]
-=-=-=-=-=-=-=-=-=-=-=-