RFC: https://bugzilla.tianocore.org/show_bug.cgi?id=3429
Intel's Trust Domain Extensions (Intel TDX) refers to an Intel technology
that extends Virtual Machines Extensions (VMX) and Multi-Key Total Memory
Encryption (MKTME) with a new kind of virutal machines guest called a
Trust Domain (TD). A TD is desinged to run in a CPU mode that protects the
confidentiality of TD memory contents and the TD's CPU state from other
software, including the hosting Virtual-Machine Monitor (VMM), unless
explicitly shared by the TD itself.
There are 2 configurations for TDVF to upstream. See below link for
the definitions of the 2 configurations.
https://edk2.groups.io/g/devel/message/76367
This patch-set is to enable the basic feature of Config-B in OvmfPkg.
- Add a standalone IntelTdxX64.dsc to a TDX specific directory for a
*full* feature TDVF. (Align with existing SEV)
- IntelTdxX64.dsc includes TDX/normal OVMF basic boot capability. The
final binary can run on TDX/normal OVMF.
- PEI phase is skipped.
By design in Config-B there should be more advanced features, such as:
- RTMR based measurement and measure boot.
- Remove unnecessary drivers to reduce attack surface, such as
network stack.
To make the code review more efficiency, Config-B is split into 2 waves:
- Basic feature of Config-B
- Advanced feature of Config-B
Code at: https://github.com/mxu9/edk2/tree/tdvf_wave3.v2
Please be noted:
This patch-set is based on the code base of tdvf_wave2.v5 which is at:
https://github.com/mxu9/edk2/tree/tdvf_wave2.v5
v2 changes:
- In v1 PEI phase is skipped during boot process. But the code is still
in the image. It is not a good way. So in v2 the code of PEI is
removed as well.
- In v1 PrePiLib in EmbeddedPkg are updated to meet the requirement of
TDVF-Config-B. This is because PrePiLib in EmbeddedPkg is designed for
the situation of PEI-less boot. So after PEI is removed, this change
is not needed anymore.
- In v1 only Tdx guest can be brought up. Now v2 brings up both Legacy
guest and Tdx guest.
- Platform initialization in TdxStartup is refactored with the
PlatformInitLib.
- OvmfPkg/IntelTdx/Sec is introduced. It is a simplied version of
OvmfPkg/Sec.
Cc: Michael D Kinney <michael.d.kinney@intel.com>
Cc: Brijesh Singh <brijesh.singh@amd.com>
Cc: Erdem Aktas <erdemaktas@google.com>
Cc: James Bottomley <jejb@linux.ibm.com>
Cc: Jiewen Yao <jiewen.yao@intel.com>
Cc: Tom Lendacky <thomas.lendacky@amd.com>
Cc: Gerd Hoffmann <kraxel@redhat.com>
Cc: Leif Lindholm <leif@nuviainc.com>
Cc: Ard Biesheuvel <ardb+tianocore@kernel.org>
Cc: Abner Chang <abner.chang@hpe.com>
Cc: Daniel Schaefer <daniel.schaefer@hpe.com>
Cc: Ray Ni <ray.ni@intel.com>
Signed-off-by: Min Xu <min.m.xu@intel.com>
Min Xu (10):
EmbeddedPkg: Fix a build error in FwVol.c in X64 arch
UefiCpuPkg: Add PcdTdxWorkAreaBase
OvmfPkg: Add TdxWorkArea definition
OvmfPkg: Add PrePiHobListPointerLibTdx
OvmfPkg: Update EFI_HOB_PLATFORM_INFO with more platform settings
OvmfPkg: Add TdxStartupLib
OvmfPkg/IntelTdx: Add Sec to bring up both Legacy and Tdx guest
OvmfPkg: Update TdxDxe to set TDX PCDs
OvmfPkg: Update DxeAcpiTimerLib to read HostBridgeDevId in
PlatformInfoHob
OvmfPkg: Introduce IntelTdxX64 for TDVF Config-B
EmbeddedPkg/Library/PrePiLib/FwVol.c | 6 +-
OvmfPkg/Include/IndustryStandard/IntelTdx.h | 17 +
OvmfPkg/Include/Library/TdxStartupLib.h | 34 +
OvmfPkg/Include/WorkArea.h | 15 +
OvmfPkg/IntelTdx/IntelTdxX64.dsc | 718 ++++++++++++++
OvmfPkg/IntelTdx/IntelTdxX64.fdf | 402 ++++++++
.../PrePiHobListPointer.c | 57 ++
.../PrePiHobListPointerLibTdx.inf | 29 +
OvmfPkg/IntelTdx/Sec/IntelTdx.c | 508 ++++++++++
OvmfPkg/IntelTdx/Sec/IntelTdx.h | 46 +
OvmfPkg/IntelTdx/Sec/SecMain.c | 200 ++++
OvmfPkg/IntelTdx/Sec/SecMain.inf | 73 ++
OvmfPkg/IntelTdx/Sec/X64/SecEntry.nasm | 151 +++
OvmfPkg/IntelTdx/TdxStartupLib/DxeLoad.c | 218 ++++
OvmfPkg/IntelTdx/TdxStartupLib/Hob.c | 130 +++
OvmfPkg/IntelTdx/TdxStartupLib/TdxStartup.c | 240 +++++
.../TdxStartupLib/TdxStartupInternal.h | 55 ++
.../IntelTdx/TdxStartupLib/TdxStartupLib.inf | 86 ++
.../TdxStartupLib/TdxStartupLibNull.inf | 40 +
.../IntelTdx/TdxStartupLib/TdxStartupNull.c | 19 +
.../IntelTdx/TdxStartupLib/X64/PageTables.h | 206 ++++
.../TdxStartupLib/X64/VirtualMemory.c | 935 ++++++++++++++++++
.../Library/AcpiTimerLib/DxeAcpiTimerLib.c | 23 +-
.../Library/AcpiTimerLib/DxeAcpiTimerLib.inf | 4 +
OvmfPkg/OvmfPkg.dec | 4 +
OvmfPkg/TdxDxe/TdxDxe.c | 71 +-
OvmfPkg/TdxDxe/TdxDxe.inf | 5 +
UefiCpuPkg/UefiCpuPkg.dec | 4 +
28 files changed, 4288 insertions(+), 8 deletions(-)
create mode 100644 OvmfPkg/Include/Library/TdxStartupLib.h
create mode 100644 OvmfPkg/IntelTdx/IntelTdxX64.dsc
create mode 100644 OvmfPkg/IntelTdx/IntelTdxX64.fdf
create mode 100644 OvmfPkg/IntelTdx/PrePiHobListPointerLibTdx/PrePiHobListPointer.c
create mode 100644 OvmfPkg/IntelTdx/PrePiHobListPointerLibTdx/PrePiHobListPointerLibTdx.inf
create mode 100644 OvmfPkg/IntelTdx/Sec/IntelTdx.c
create mode 100644 OvmfPkg/IntelTdx/Sec/IntelTdx.h
create mode 100644 OvmfPkg/IntelTdx/Sec/SecMain.c
create mode 100644 OvmfPkg/IntelTdx/Sec/SecMain.inf
create mode 100644 OvmfPkg/IntelTdx/Sec/X64/SecEntry.nasm
create mode 100644 OvmfPkg/IntelTdx/TdxStartupLib/DxeLoad.c
create mode 100644 OvmfPkg/IntelTdx/TdxStartupLib/Hob.c
create mode 100644 OvmfPkg/IntelTdx/TdxStartupLib/TdxStartup.c
create mode 100644 OvmfPkg/IntelTdx/TdxStartupLib/TdxStartupInternal.h
create mode 100644 OvmfPkg/IntelTdx/TdxStartupLib/TdxStartupLib.inf
create mode 100644 OvmfPkg/IntelTdx/TdxStartupLib/TdxStartupLibNull.inf
create mode 100644 OvmfPkg/IntelTdx/TdxStartupLib/TdxStartupNull.c
create mode 100644 OvmfPkg/IntelTdx/TdxStartupLib/X64/PageTables.h
create mode 100644 OvmfPkg/IntelTdx/TdxStartupLib/X64/VirtualMemory.c
--
2.29.2.windows.2
-=-=-=-=-=-=-=-=-=-=-=-
Groups.io Links: You receive all messages sent to this group.
View/Reply Online (#86038): https://edk2.groups.io/g/devel/message/86038
Mute This Topic: https://groups.io/mt/88666798/1787277
Group Owner: devel+owner@edk2.groups.io
Unsubscribe: https://edk2.groups.io/g/devel/unsub [importer@patchew.org]
-=-=-=-=-=-=-=-=-=-=-=-