From: "Min Xu" <min.m.xu@intel.com>
To: devel@edk2.groups.io
Cc: Min Xu <min.m.xu@intel.com>,
Brijesh Singh <brijesh.singh@amd.com>,
Erdem Aktas <erdemaktas@google.com>,
Gerd Hoffmann <kraxel@redhat.com>,
James Bottomley <jejb@linux.ibm.com>,
Jiewen Yao <jiewen.yao@intel.com>,
Tom Lendacky <thomas.lendacky@amd.com>
Subject: [PATCH 1/1] OvmfPkg: Add README for TDVF
Date: Mon, 25 Apr 2022 08:27:57 +0800 [thread overview]
Message-ID: <0fc7719aab0567c5857807c2223d999503b8bfaf.1650846417.git.min.m.xu@intel.com> (raw)
In-Reply-To: <cover.1650846417.git.min.m.xu@intel.com>
RFC: https://bugzilla.tianocore.org/show_bug.cgi?id=3249
Add README for TDVF.
Cc: Brijesh Singh <brijesh.singh@amd.com>
Cc: Erdem Aktas <erdemaktas@google.com>
Cc: Gerd Hoffmann <kraxel@redhat.com>
Cc: James Bottomley <jejb@linux.ibm.com>
Cc: Jiewen Yao <jiewen.yao@intel.com>
Cc: Tom Lendacky <thomas.lendacky@amd.com>
Signed-off-by: Min Xu <min.m.xu@intel.com>
---
OvmfPkg/IntelTdx/README | 88 +++++++++++++++++++++++++++++++++++++++++
1 file changed, 88 insertions(+)
create mode 100644 OvmfPkg/IntelTdx/README
diff --git a/OvmfPkg/IntelTdx/README b/OvmfPkg/IntelTdx/README
new file mode 100644
index 000000000000..302afac68c75
--- /dev/null
+++ b/OvmfPkg/IntelTdx/README
@@ -0,0 +1,88 @@
+TDVF Overview
+-------------
+
+<b>Intel Trust Domain Extension (TDX)</b> is Intel Architecture extension
+to provide trusted, isolated VM execution by removing CSP software
+(hypervisor etc) from the TCB. <b>TDX Virtual Firmware (TDVF)</b> is an
+EDK II based project to enable UEFI support for TDX based Virtual
+Machines. It provides the capability to launch a TD.
+
+The <b>Intel® TDX Virtual Firmware Design Guide</b> is at
+https://www.intel.com/content/dam/develop/external/us/en/documents/tdx-virtual-firmware-design-guide-rev-1.01.pdf.
+
+More information can be found at:
+https://www.intel.com/content/www/us/en/developer/articles/technical/intel-trust-domain-extensions.html
+
+
+Configurations and Features
+----------------------------
+
+There are 2 configurations for TDVF.
+
+<b>Config-A:</b>
+ - Merge the *basic* TDVF feature to existing OvmfX64Pkg.dsc. (Align
+ with existing SEV)
+ - Threat model: VMM is NOT out of TCB. (We don’t make things worse)
+ - The OvmfX64Pkg.dsc includes SEV/TDX/normal OVMF basic boot capability.
+ The final binary can run on SEV/TDX/normal OVMF.
+ - No changes to existing OvmfPkgX64 image layout.
+ - No need to add additional security features if they do not exist today.
+ - No need to remove features if they exist today.
+ - RTMR is not supported.
+ - PEI phase is NOT skipped in either Td or Non-Td.
+
+<b>Config-B:</b>
+ - (*) Add a standalone IntelTdx.dsc to a TDX specific directory for a *full*
+ feature TDVF.(Align with existing SEV)
+ - (*) Threat model: VMM is out of TCB. (We need necessary change to prevent
+ attack from VMM)
+ - (*) IntelTdx.dsc includes TDX/normal OVMF basic boot capability. The final
+ binary can run on TDX/normal OVMF.
+ - It might eventually merge with AmdSev.dsc, but NOT at this point of
+ time. And we don’t know when it will happen. We need sync with AMD in
+ the community after both of us think the solutions are mature to merge.
+ - Need to add necessary security feature as mandatory requirement, such
+ as RTMR based Trusted Boot support.
+ - Need to measure the external input from Host VMM, such as TdHob, CFV.
+ - Need to measure other external input, such as FW_CFG data, os loader,
+ initrd, etc.
+ - Need to remove unnecessary attack surfaces, such as network stack.
+
+In current stage, <b>Config-A</b> has been merged into edk2-master branch.
+The corresponding pkg file is OvmfPkg/OvmfPkgX64.dsc.
+
+<b>Config-B</b> is split into several waves. The corresponding pkg file is
+OvmfPkg/IntelTdx/IntelTdxX64.dsc. The features with (*) have been implemented
+and merged into edk2-master branch. Others are in upstreaming progress.
+
+Build
+------
+- Build the TDVF (Config-A) target:
+`cd /path/to/edk2`
+`source edksetup.sh`
+`build.sh -p OvmfPkg/OvmfPkgX64.dsc -a X64 -t GCC5`
+
+- Build the TDVF (Config-B) target:
+`cd /path/to/edk2`
+`source edksetup.sh`
+`build.sh -p OvmfPkg/IntelTdx/IntelTdxX64.dsc -a X64 -t GCC5`
+
+Usage
+-----
+
+Assuming TDX-QEMU/TDX-KVM are already built, one can start a TD virtual
+machine as follows:
+
+`$ /path/to/qemu-system-x86_64 \`
+`-accel kvm \`
+`-name process=tdxvm,debug-threads=on \`
+`-smp 2,sockets=1 \`
+`-m 2G -vga none -nographic -no-hpet \`
+`-object tdx-guest,id=tdx,debug=on \`
+`-machine q35,kvm-type=tdx,pic=no,kernel_irqchip=split,confidential-guest-support=tdx \`
+`-device loader,file=/path/to/OVMF.fd,id=fd0 \`
+`-cpu host,pmu=off,-kvm-steal-time \`
+`-chardev stdio,id=mux,mux=on,signal=off,logfile=/path/to/logfile \`
+`-device virtio-serial,romfile= \`
+`-device virtconsole,chardev=mux -serial chardev:mux -monitor chardev:mux \`
+`-drive file=/path/to/guest_img,if=virtio,format=raw`
--
2.29.2.windows.2
next parent reply other threads:[~2022-04-25 0:28 UTC|newest]
Thread overview: 3+ messages / expand[flat|nested] mbox.gz Atom feed top
[not found] <cover.1650846417.git.min.m.xu@intel.com>
2022-04-25 0:27 ` Min Xu [this message]
2022-04-25 7:00 ` [PATCH 1/1] OvmfPkg: Add README for TDVF Gerd Hoffmann
2022-04-29 3:09 ` Min Xu
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-list from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=0fc7719aab0567c5857807c2223d999503b8bfaf.1650846417.git.min.m.xu@intel.com \
--to=devel@edk2.groups.io \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox