REF: https://bugzilla.tianocore.org/show_bug.cgi?id=3429
Intel's Trust Domain Extensions (Intel TDX) refers to an Intel technology that extends Virtual Machines Extensions (VMX) and Multi-Key Total Memory Encryption (MKTME) with a new kind of virutal machines guest called a Trust Domain (TD). A TD is desinged to run in a CPU mode that protects the confidentiality of TD memory contents and the TD's CPU state from other software, including the hosting Virtual-Machine Monitor (VMM), unless explicitly shared by the TD itself. The patch-sets to support Intel TDX in OvmfPkg is split into several waves. This is wave-1 which adds Intel TDX support in OvmfPkg/ResetVector. Note: TDX only works in X64. [TDX]: https://software.intel.com/content/dam/develop/external/us/en/ documents/tdx-whitepaper-final9-17.pdf [TDVF]: https://software.intel.com/content/dam/develop/external/us/en/ documents/tdx-virtual-firmware-design-guide-rev-1.pdf Code is at https://github.com/mxu9/edk2/tree/tdvf_wave1.v7 v7 changes: - Refine the offset of TdxMetadata and remove the definition of PcdOvmfImageSizeInKB - Use MOV CR* instead of smsw in ResetVector - Remove the new field (SubType) in CONFIDENTIAL_COMPUTING_WORK_AREA_HEADER. v6 changes: - Remove the 5-level paging support. 5-level paging enabling is *NOT* super critical for TDX enabling at this moment. It will be enabled later in a separate patch. - Add a new field (SubType) in CONFIDENTIAL_COMPUTING_WORK_AREA_HEADER to record the VM Guest SubType. - In Main16 entry point, after TransitionFromReal16To32BitFlat, WORK_AREA_GUEST_TYPE is cleared to 0. WORK_AREA_GUEST_TYPE was previously cleared in SetCr3ForPageTables64 (see commit ab77b60). This doesn't work after TDX is introduced in Ovmf. It is because all TDX CPUs (BSP and APs) start to run from 0xfffffff0. In previous code WORK_AREA_GUEST_TYPE will be cleared multi-times in TDX guest. So for SEV and Legacy guest it is moved to Main16 entry point (after TransitionFromReal16To32BitFlat). For TDX guest WORK_AREA_GUEST_TYPE is cleared and set in InitTdxWorkarea. - Make the return result of IsTdx be consistent with IsTdxEnabled. - Fix some typo in the code comments. v5 changes: - Remove the changes of OVMF_WORK_AREA because Commit ab77b60 covers those changes. - Refine the TDX related changes in PageTables64.asm and Flat32ToFlat64.asm. - Add CheckTdxFeaturesBeforeBuildPagetables to check Non-Tdx, Tdx-BSP or Tdx-APs. This routine is called before building page tables. v4 changes: - Refine the PageTables64.asm and Flat32ToFlat64.asm to enable TDX. - Refine SEV_ES_WORK_AREA so that SEV/TDX/Legach guest all can use this memory region. https://edk2.groups.io/g/devel/message/78345 is the discussion. - AmdSev.asm is removed because Brijesh Singh has done it in https://edk2.groups.io/g/devel/message/78241. v3 changes: - Refine PageTables64.asm and Flat32ToFlat64.asm based on the review comments in [ReviewComment-1] and [ReviewComment-2]. - SEV codes are in AmdSev.asm - TDX codes are in IntelTdx.asm - Main.asm is created in OvmfPkg/ResetVector. The one in UefiCpuPkg/ResetVector/Vtf0 is not used. - Init32.asm/ReloadFlat32.asm in UefiCpuPkg/ResetVector/Vtf0/Ia32 are deleted. They're moved to OvmfPkg/ResetVector/Ia32. - InitTdx.asm is renamed to InteTdx.asm v2 changes: - Move InitTdx.asm and ReloadFlat32.asm from UefiCpuPkg/ResetVector/Vtf0 to OvmfPkg/ResetVector. Init32.asm is created which is a null stub of 32-bit initialization. In Main32 just simply call Init32. It makes the Main.asm in UefiCpuPkg/ResetVector clean and clear. - Init32.asm/InitTdx.asm/ReloadFlat32.asm are created under OvmfPkg/ResetVector/Ia32. - Update some descriptions of the patch-sets. - Update the REF link in cover letter. - Add Ard Biesheuvel in Cc list. v1: https://edk2.groups.io/g/devel/message/77675 Cc: Ard Biesheuvel <ardb+tianoc...@kernel.org> Cc: Gerd Hoffmann <kra...@redhat.com> Cc: Jordan Justen <jordan.l.jus...@intel.com> Cc: Brijesh Singh <brijesh.si...@amd.com> Cc: Erdem Aktas <erdemak...@google.com> Cc: James Bottomley <j...@linux.ibm.com> Cc: Jiewen Yao <jiewen....@intel.com> Cc: Tom Lendacky <thomas.lenda...@amd.com> Signed-off-by: Min Xu <min.m...@intel.com> Min Xu (1): OvmfPkg: Enable TDX in ResetVector OvmfPkg/OvmfPkg.dec | 9 + OvmfPkg/OvmfPkgDefines.fdf.inc | 9 + OvmfPkg/ResetVector/Ia16/ResetVectorVtf0.asm | 39 +++ OvmfPkg/ResetVector/Ia32/Flat32ToFlat64.asm | 11 + OvmfPkg/ResetVector/Ia32/IntelTdx.asm | 235 +++++++++++++++++++ OvmfPkg/ResetVector/Ia32/PageTables64.asm | 21 +- OvmfPkg/ResetVector/Main.asm | 119 ++++++++++ OvmfPkg/ResetVector/ResetVector.inf | 9 + OvmfPkg/ResetVector/ResetVector.nasmb | 40 +++- OvmfPkg/ResetVector/X64/IntelTdxMetadata.asm | 102 ++++++++ 10 files changed, 587 insertions(+), 7 deletions(-) create mode 100644 OvmfPkg/ResetVector/Ia32/IntelTdx.asm create mode 100644 OvmfPkg/ResetVector/Main.asm create mode 100644 OvmfPkg/ResetVector/X64/IntelTdxMetadata.asm -- 2.29.2.windows.2 -=-=-=-=-=-=-=-=-=-=-=- Groups.io Links: You receive all messages sent to this group. View/Reply Online (#80927): https://edk2.groups.io/g/devel/message/80927 Mute This Topic: https://groups.io/mt/85761660/21656 Group Owner: devel+ow...@edk2.groups.io Unsubscribe: https://edk2.groups.io/g/devel/unsub [arch...@mail-archive.com] -=-=-=-=-=-=-=-=-=-=-=-
