RFC: https://bugzilla.tianocore.org/show_bug.cgi?id=3853
Intel's Trust Domain Extensions (Intel TDX) refers to an Intel technology
that extends Virtual Machines Extensions (VMX) and Multi-Key Total Memory
Encryption (MKTME) with a new kind of virutal machines guest called a
Trust Domain (TD). A TD is desinged to run in a CPU mode that protects the
confidentiality of TD memory contents and the TD's CPU state from other
software, including the hosting Virtual-Machine Monitor (VMM), unless
explicitly shared by the TD itself.
There are 2 configurations for TDVF to upstream. See below link for
the definitions of the 2 configurations.
https://edk2.groups.io/g/devel/message/76367
This patch-set is to enable below features of Config-B in OvmfPkg.
- Enable RTMR based measurement and measured boot
- Install CC_MEASUREMENT_PROTOCOL instance in Td guest
The measurement for the other components, such as kernel image, initrd,
will be in the following patch-sets.
Patch 1:
HashLibBaseCryptoRouterTdx provides SHA384 service and extend to
RTMR registers.
Patch 2:
SecCryptLib is the cryptographic library instance for SEC.
Patch 3 - 7:
These 5 patches are related to RTMR based measurement and
CC Eventlog ACPI table.
Patch 8:
Update IntelTdxX64.dsc/IntelTdxX64.fdf to support RTMR based
measurement and measured boot.
Code at: https://github.com/mxu9/edk2/tree/tdvf_wave4.v2
v2 changes:
- Move the definition of EFI_CC_EVENT_HOB_GUID from MdePkg to
SecurityPkg.
- Update the definition of EFI_CC_EVENTLOG_ACPI_TABLE based
on below discussion:
https://edk2.groups.io/g/devel/message/87396
https://edk2.groups.io/g/devel/message/87402
- Update the code base to 94f905b3bf.
Cc: Jiewen Yao <jiewen.yao@intel.com>
Cc: Jian J Wang <jian.j.wang@intel.com>
Cc: Gerd Hoffmann <kraxel@redhat.com>
Cc: Xiaoyu Lu <xiaoyu1.lu@intel.com>
Cc: Guomin Jiang <guomin.jiang@intel.com>
Cc: Michael D Kinney <michael.d.kinney@intel.com>
Cc: Liming Gao <gaoliming@byosoft.com.cn>
Cc: Zhiguang Liu <zhiguang.liu@intel.com>
Cc: Sami Mujawar <sami.mujawar@arm.com>
Cc: Ken Lu <ken.lu@intel.com>
Cc: Ard Biesheuvel <ardb+tianocore@kernel.org>
Cc: Jordan Justen <jordan.l.justen@intel.com>
Cc: Brijesh Singh <brijesh.singh@amd.com>
Cc: Erdem Aktas <erdemaktas@google.com>
Cc: James Bottomley <jejb@linux.ibm.com>
Cc: Tom Lendacky <thomas.lendacky@amd.com>
Signed-off-by: Min Xu <min.m.xu@intel.com>
Min Xu (8):
Security: Add HashLibBaseCryptoRouterTdx
CryptoPkg: Add SecCryptLib
SecurityPkg: Add definition of EFI_CC_EVENT_HOB_GUID
OvmfPkg/IntelTdx: Measure Td HobList and Configuration FV
OvmfPkg: Add PCDs for LAML/LASA field in CC EVENTLOG ACPI table
MdePkg: Define CC Measure EventLog ACPI Table
OvmfPkg/IntelTdx: Add TdTcg2Dxe
OvmfPkg/IntelTdx: Enable RTMR based measurement and measure boot
CryptoPkg/CryptoPkg.dsc | 4 +
.../Library/BaseCryptLib/SecCryptLib.inf | 67 +
MdePkg/Include/Protocol/CcMeasurement.h | 21 +
OvmfPkg/IntelTdx/IntelTdxX64.dsc | 15 +-
OvmfPkg/IntelTdx/IntelTdxX64.fdf | 5 +
.../IntelTdx/TdTcg2Dxe/MeasureBootPeCoff.c | 407 +++
OvmfPkg/IntelTdx/TdTcg2Dxe/TdTcg2Dxe.c | 2489 +++++++++++++++++
OvmfPkg/IntelTdx/TdTcg2Dxe/TdTcg2Dxe.inf | 101 +
OvmfPkg/Library/PeilessStartupLib/IntelTdx.c | 498 ++++
.../PeilessStartupLib/PeilessStartup.c | 30 +
.../PeilessStartupInternal.h | 57 +
.../PeilessStartupLib/PeilessStartupLib.inf | 7 +-
OvmfPkg/OvmfPkg.dec | 6 +
SecurityPkg/Include/Guid/CcEventHob.h | 22 +
.../HashLibBaseCryptoRouterTdx.c | 214 ++
.../HashLibBaseCryptoRouterTdx.inf | 41 +
SecurityPkg/SecurityPkg.dec | 4 +
SecurityPkg/SecurityPkg.dsc | 10 +
18 files changed, 3995 insertions(+), 3 deletions(-)
create mode 100644 CryptoPkg/Library/BaseCryptLib/SecCryptLib.inf
create mode 100644 OvmfPkg/IntelTdx/TdTcg2Dxe/MeasureBootPeCoff.c
create mode 100644 OvmfPkg/IntelTdx/TdTcg2Dxe/TdTcg2Dxe.c
create mode 100644 OvmfPkg/IntelTdx/TdTcg2Dxe/TdTcg2Dxe.inf
create mode 100644 OvmfPkg/Library/PeilessStartupLib/IntelTdx.c
create mode 100644 SecurityPkg/Include/Guid/CcEventHob.h
create mode 100644 SecurityPkg/Library/HashLibBaseCryptoRouter/HashLibBaseCryptoRouterTdx.c
create mode 100644 SecurityPkg/Library/HashLibBaseCryptoRouter/HashLibBaseCryptoRouterTdx.inf
--
2.29.2.windows.2
-=-=-=-=-=-=-=-=-=-=-=-
Groups.io Links: You receive all messages sent to this group.
View/Reply Online (#88580): https://edk2.groups.io/g/devel/message/88580
Mute This Topic: https://groups.io/mt/90330661/1787277
Group Owner: devel+owner@edk2.groups.io
Unsubscribe: https://edk2.groups.io/g/devel/unsub [importer@patchew.org]
-=-=-=-=-=-=-=-=-=-=-=-