RFC: https://bugzilla.tianocore.org/show_bug.cgi?id=3429
Intel's Trust Domain Extensions (Intel TDX) refers to an Intel technology that extends Virtual Machines Extensions (VMX) and Multi-Key Total Memory Encryption (MKTME) with a new kind of virutal machines guest called a Trust Domain (TD). A TD is desinged to run in a CPU mode that protects the confidentiality of TD memory contents and the TD's CPU state from other software, including the hosting Virtual-Machine Monitor (VMM), unless explicitly shared by the TD itself. There are 2 configurations for TDVF to upstream. See below link for the definitions of the 2 configurations. https://edk2.groups.io/g/devel/message/76367 This patch-set is to enable the basic feature of Config-B in OvmfPkg. - Add a standalone IntelTdxX64.dsc to a TDX specific directory for a *full* feature TDVF. (Align with existing SEV) - IntelTdxX64.dsc includes TDX/normal OVMF basic boot capability. The final binary can run on TDX/normal OVMF. - PEI phase is skipped. By design in Config-B there should be more advanced features, such as: - RTMR based measurement and measure boot. - Remove unnecessary drivers to reduce attack surface, such as network stack. To make the code review more efficiency, Config-B is split into 2 waves: - Basic feature of Config-B - Advanced feature of Config-B Code at: https://github.com/mxu9/edk2/tree/tdvf_wave3.v2 Please be noted: This patch-set is based on the code base of tdvf_wave2.v5 which is at: https://github.com/mxu9/edk2/tree/tdvf_wave2.v5 v2 changes: - In v1 PEI phase is skipped during boot process. But the code is still in the image. It is not a good way. So in v2 the code of PEI is removed as well. - In v1 PrePiLib in EmbeddedPkg are updated to meet the requirement of TDVF-Config-B. This is because PrePiLib in EmbeddedPkg is designed for the situation of PEI-less boot. So after PEI is removed, this change is not needed anymore. - In v1 only Tdx guest can be brought up. Now v2 brings up both Legacy guest and Tdx guest. - Platform initialization in TdxStartup is refactored with the PlatformInitLib. - OvmfPkg/IntelTdx/Sec is introduced. It is a simplied version of OvmfPkg/Sec. Cc: Michael D Kinney <michael.d.kin...@intel.com> Cc: Brijesh Singh <brijesh.si...@amd.com> Cc: Erdem Aktas <erdemak...@google.com> Cc: James Bottomley <j...@linux.ibm.com> Cc: Jiewen Yao <jiewen....@intel.com> Cc: Tom Lendacky <thomas.lenda...@amd.com> Cc: Gerd Hoffmann <kra...@redhat.com> Cc: Leif Lindholm <l...@nuviainc.com> Cc: Ard Biesheuvel <ardb+tianoc...@kernel.org> Cc: Abner Chang <abner.ch...@hpe.com> Cc: Daniel Schaefer <daniel.schae...@hpe.com> Cc: Ray Ni <ray...@intel.com> Signed-off-by: Min Xu <min.m...@intel.com> Min Xu (10): EmbeddedPkg: Fix a build error in FwVol.c in X64 arch UefiCpuPkg: Add PcdTdxWorkAreaBase OvmfPkg: Add TdxWorkArea definition OvmfPkg: Add PrePiHobListPointerLibTdx OvmfPkg: Update EFI_HOB_PLATFORM_INFO with more platform settings OvmfPkg: Add TdxStartupLib OvmfPkg/IntelTdx: Add Sec to bring up both Legacy and Tdx guest OvmfPkg: Update TdxDxe to set TDX PCDs OvmfPkg: Update DxeAcpiTimerLib to read HostBridgeDevId in PlatformInfoHob OvmfPkg: Introduce IntelTdxX64 for TDVF Config-B EmbeddedPkg/Library/PrePiLib/FwVol.c | 6 +- OvmfPkg/Include/IndustryStandard/IntelTdx.h | 17 + OvmfPkg/Include/Library/TdxStartupLib.h | 34 + OvmfPkg/Include/WorkArea.h | 15 + OvmfPkg/IntelTdx/IntelTdxX64.dsc | 718 ++++++++++++++ OvmfPkg/IntelTdx/IntelTdxX64.fdf | 402 ++++++++ .../PrePiHobListPointer.c | 57 ++ .../PrePiHobListPointerLibTdx.inf | 29 + OvmfPkg/IntelTdx/Sec/IntelTdx.c | 508 ++++++++++ OvmfPkg/IntelTdx/Sec/IntelTdx.h | 46 + OvmfPkg/IntelTdx/Sec/SecMain.c | 200 ++++ OvmfPkg/IntelTdx/Sec/SecMain.inf | 73 ++ OvmfPkg/IntelTdx/Sec/X64/SecEntry.nasm | 151 +++ OvmfPkg/IntelTdx/TdxStartupLib/DxeLoad.c | 218 ++++ OvmfPkg/IntelTdx/TdxStartupLib/Hob.c | 130 +++ OvmfPkg/IntelTdx/TdxStartupLib/TdxStartup.c | 240 +++++ .../TdxStartupLib/TdxStartupInternal.h | 55 ++ .../IntelTdx/TdxStartupLib/TdxStartupLib.inf | 86 ++ .../TdxStartupLib/TdxStartupLibNull.inf | 40 + .../IntelTdx/TdxStartupLib/TdxStartupNull.c | 19 + .../IntelTdx/TdxStartupLib/X64/PageTables.h | 206 ++++ .../TdxStartupLib/X64/VirtualMemory.c | 935 ++++++++++++++++++ .../Library/AcpiTimerLib/DxeAcpiTimerLib.c | 23 +- .../Library/AcpiTimerLib/DxeAcpiTimerLib.inf | 4 + OvmfPkg/OvmfPkg.dec | 4 + OvmfPkg/TdxDxe/TdxDxe.c | 71 +- OvmfPkg/TdxDxe/TdxDxe.inf | 5 + UefiCpuPkg/UefiCpuPkg.dec | 4 + 28 files changed, 4288 insertions(+), 8 deletions(-) create mode 100644 OvmfPkg/Include/Library/TdxStartupLib.h create mode 100644 OvmfPkg/IntelTdx/IntelTdxX64.dsc create mode 100644 OvmfPkg/IntelTdx/IntelTdxX64.fdf create mode 100644 OvmfPkg/IntelTdx/PrePiHobListPointerLibTdx/PrePiHobListPointer.c create mode 100644 OvmfPkg/IntelTdx/PrePiHobListPointerLibTdx/PrePiHobListPointerLibTdx.inf create mode 100644 OvmfPkg/IntelTdx/Sec/IntelTdx.c create mode 100644 OvmfPkg/IntelTdx/Sec/IntelTdx.h create mode 100644 OvmfPkg/IntelTdx/Sec/SecMain.c create mode 100644 OvmfPkg/IntelTdx/Sec/SecMain.inf create mode 100644 OvmfPkg/IntelTdx/Sec/X64/SecEntry.nasm create mode 100644 OvmfPkg/IntelTdx/TdxStartupLib/DxeLoad.c create mode 100644 OvmfPkg/IntelTdx/TdxStartupLib/Hob.c create mode 100644 OvmfPkg/IntelTdx/TdxStartupLib/TdxStartup.c create mode 100644 OvmfPkg/IntelTdx/TdxStartupLib/TdxStartupInternal.h create mode 100644 OvmfPkg/IntelTdx/TdxStartupLib/TdxStartupLib.inf create mode 100644 OvmfPkg/IntelTdx/TdxStartupLib/TdxStartupLibNull.inf create mode 100644 OvmfPkg/IntelTdx/TdxStartupLib/TdxStartupNull.c create mode 100644 OvmfPkg/IntelTdx/TdxStartupLib/X64/PageTables.h create mode 100644 OvmfPkg/IntelTdx/TdxStartupLib/X64/VirtualMemory.c -- 2.29.2.windows.2 -=-=-=-=-=-=-=-=-=-=-=- Groups.io Links: You receive all messages sent to this group. View/Reply Online (#86038): https://edk2.groups.io/g/devel/message/86038 Mute This Topic: https://groups.io/mt/88666798/21656 Group Owner: devel+ow...@edk2.groups.io Unsubscribe: https://edk2.groups.io/g/devel/unsub [arch...@mail-archive.com] -=-=-=-=-=-=-=-=-=-=-=-
