From: Min M Xu <min.m...@intel.com>
BZ: https://bugzilla.tianocore.org/show_bug.cgi?id=4756
There are below updates in this patch:
1. Rename README to README.md so that it can be show as markdown
document.
2. Update some information about TDVF.
2. Fix some typo.
Cc: Jiewen Yao <jiewen....@intel.com>
Cc: Gerd Hoffmann <kra...@redhat.com>
Signed-off-by: Min Xu <min.m...@intel.com>
---
OvmfPkg/IntelTdx/{README => README.md} | 64 +++++++++++++++-----------
1 file changed, 38 insertions(+), 26 deletions(-)
rename OvmfPkg/IntelTdx/{README => README.md} (52%)
diff --git a/OvmfPkg/IntelTdx/README b/OvmfPkg/IntelTdx/README.md
similarity index 52%
rename from OvmfPkg/IntelTdx/README
rename to OvmfPkg/IntelTdx/README.md
index 7307ede78faf..c168167c1271 100644
--- a/OvmfPkg/IntelTdx/README
+++ b/OvmfPkg/IntelTdx/README.md
@@ -1,13 +1,13 @@
TDVF Overview
-------------
-<b>Intel Trust Domain Extension (TDX)</b> is Intel Architecture extension
+**Intel Trust Domain Extension (TDX)** is Intel Architecture extension
to provide trusted, isolated VM execution by removing CSP software
-(hypervisor etc) from the TCB. <b>TDX Virtual Firmware (TDVF)</b> is an
+(hypervisor etc) from the TCB. **TDX Virtual Firmware (TDVF)** is an
EDK II based project to enable UEFI support for TDX based Virtual
Machines. It provides the capability to launch a TD.
-The <b>Intel? TDX Virtual Firmware Design Guide</b> is at
+The **Intel TDX Virtual Firmware Design Guide** is at
https://www.intel.com/content/dam/develop/external/us/en/documents/tdx-virtual-firmware-design-guide-rev-1.01.pdf.
More information can be found at:
@@ -19,49 +19,61 @@ Configurations and Features
There are 2 configurations for TDVF.
-<b>Config-A:</b>
- - Merge the *basic* TDVF feature to existing OvmfX64Pkg.dsc. (Align
+**Config-A:**
+ - Merge the *basic* TDVF feature to existing **OvmfPkgX64.dsc**. (Align
with existing SEV)
- - Threat model: VMM is NOT out of TCB. (We don?t make things worse)
- - The OvmfX64Pkg.dsc includes SEV/TDX/normal OVMF basic boot capability.
+ - Threat model: VMM is **NOT** out of TCB. (We don't make things worse)
+ - The OvmfPkgX64.dsc includes SEV/TDX/normal OVMF basic boot capability.
The final binary can run on SEV/TDX/normal OVMF.
- No changes to existing OvmfPkgX64 image layout.
- No need to remove features if they exist today.
- - PEI phase is NOT skipped in either Td or Non-Td.
- - RTMR based measurement is supported.
+ - PEI phase is **NOT** skipped in either TD or Non-TD.
+ - RTMR based measurement (CC_MEASUREMENT) is supported as an optional
requirement.
- External inputs from Host VMM are measured, such as TdHob, CFV.
- Other external inputs are measured, such as FW_CFG data, os loader,
initrd, etc.
-<b>Config-B:</b>
- - Add a standalone IntelTdx.dsc to a TDX specific directory for a *full*
- feature TDVF.(Align with existing SEV)
+**Config-B:**
+ - Add a standalone **IntelTdxX64.dsc** to a TDX specific directory
+ (**OvmfPkg/IntelTdx**) for a *full* feature TDVF.(Align with existing SEV)
- Threat model: VMM is out of TCB. (We need necessary change to prevent
attack from VMM)
- - IntelTdx.dsc includes TDX/normal OVMF basic boot capability. The final
+ - IntelTdxX64.dsc includes TDX/normal OVMF basic boot capability. The final
binary can run on TDX/normal OVMF.
- It might eventually merge with AmdSev.dsc, but NOT at this point of
- time. And we don?t know when it will happen. We need sync with AMD in
+ time. And we don't know when it will happen. We need sync with AMD in
the community after both of us think the solutions are mature to merge.
- - Need to add necessary security feature as mandatory requirement, such
- as RTMR based Trusted Boot support.
- - Need to measure the external input from Host VMM, such as TdHob, CFV.
- - Need to measure other external input, such as FW_CFG data, os loader,
+ - RTMR based measurement (CC_MEASUREMENT) is supported as a mandatory
requirement.
+ - External inputs from Host VMM are measured, such as TdHob, CFV.
+ - Other external inputs are measured, such as FW_CFG data, os loader,
initrd, etc.
- - Need to remove unnecessary attack surfaces, such as network stack.
+ - PEI phase is skipped to remove unnecessary attack surface.
+ - DXE FV is split into 2 FVs (DXEFV & NCCFV) to remove the unnecessary attack
+ surface in a TD guest..
+ - When launching a TD guest, only drivers in DXEFV are loaded.
+ - When launching a Non-TD guest, dirvers in both DXEFV and NCCFV are
+ loaded.
Build
------
- Build the TDVF (Config-A) target:
-`cd /path/to/edk2`
-`source edksetup.sh`
-`build.sh -p OvmfPkg/OvmfPkgX64.dsc -a X64 -t GCC5`
+```
+cd /path/to/edk2
+source edksetup.sh
+
+## without CC_MEASUREMENT enabled
+build -p OvmfPkg/OvmfPkgX64.dsc -a X64 -t GCC5 -b RELEASE
+
+## CC_MEASUREMENT enabled
+build -p OvmfPkg/OvmfPkgX64.dsc -a X64 -t GCC5 -D CC_MEASUREMENT_ENABLE=TRUE
-b RELEASE
+```
- Build the TDVF (Config-B) target:
-`cd /path/to/edk2`
-`set PACKAGES_PATH=/path/to/edk2/OvmfPkg`
-`source edksetup.sh`
-`build.sh -p OvmfPkg/IntelTdx/IntelTdxX64.dsc -a X64 -t GCC5`
+```
+cd /path/to/edk2
+source edksetup.sh
+build -p OvmfPkg/IntelTdx/IntelTdxX64.dsc -a X64 -t GCC5 -b RELEASE
+```
Usage
-----
--
2.44.0.windows.1
-=-=-=-=-=-=-=-=-=-=-=-
Groups.io Links: You receive all messages sent to this group.
View/Reply Online (#118001): https://edk2.groups.io/g/devel/message/118001
Mute This Topic: https://groups.io/mt/105609363/21656
Group Owner: devel+ow...@edk2.groups.io
Unsubscribe: https://edk2.groups.io/g/devel/unsub [arch...@mail-archive.com]
-=-=-=-=-=-=-=-=-=-=-=-
