From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from mga12.intel.com (mga12.intel.com [192.55.52.136]) by mx.groups.io with SMTP id smtpd.web08.25739.1639489318669943344 for ; Tue, 14 Dec 2021 05:41:59 -0800 Authentication-Results: mx.groups.io; dkim=pass header.i=@intel.com header.s=intel header.b=EAoYDHLt; spf=pass (domain: intel.com, ip: 192.55.52.136, mailfrom: min.m.xu@intel.com) DKIM-Signature: v=1; a=rsa-sha256; c=simple/simple; d=intel.com; i=@intel.com; q=dns/txt; s=Intel; t=1639489318; x=1671025318; h=from:to:cc:subject:date:message-id:mime-version: content-transfer-encoding; bh=fHR1BWMc+CtYZH5hy9FCmRGcQb57aL9zSlunbLBFZKc=; b=EAoYDHLts91AUibMnzBtnj+U4J8A1xHDL3nQq6iGuUqWAJ5lP/Oopvbo xqWlMvW3E3Gb5hNVyAO1dmf4kdFmdsfOe+5uffOAc/kpHKX/Y3mSeSlvs 6Tz/XpXWi7KkA6FB7cyXKHAutHf73GysZqN0xWBbnTp2WSnbCozrqIQ7J zZLpey3Rkgmjb1HCLDThSqn93B3iHKnwLEwe1KFktW/oeXqPpA3T0DTDZ CtbTNGxbuiDcqCMoJjmDOxEkLh/CG+vl1J7RuEN6lH8KgaLbmOkUmUn0E q7wMV26rec8roD4609SS0qC6L7GhnBkyEoh+LgFkYnLSuX7zTnqb1nmrZ g==; X-IronPort-AV: E=McAfee;i="6200,9189,10197"; a="218993572" X-IronPort-AV: E=Sophos;i="5.88,205,1635231600"; d="scan'208";a="218993572" Received: from orsmga006.jf.intel.com ([10.7.209.51]) by fmsmga106.fm.intel.com with ESMTP/TLS/ECDHE-RSA-AES256-GCM-SHA384; 14 Dec 2021 05:41:43 -0800 X-IronPort-AV: E=Sophos;i="5.88,205,1635231600"; d="scan'208";a="465093923" Received: from mxu9-mobl1.ccr.corp.intel.com ([10.255.30.115]) by orsmga006-auth.jf.intel.com with ESMTP/TLS/ECDHE-RSA-AES256-GCM-SHA384; 14 Dec 2021 05:41:40 -0800 From: "Min Xu" To: devel@edk2.groups.io Cc: Min Xu , Michael D Kinney , Brijesh Singh , Erdem Aktas , James Bottomley , Jiewen Yao , Tom Lendacky , Gerd Hoffmann , Leif Lindholm , Ard Biesheuvel , Abner Chang , Daniel Schaefer Subject: [PATCH 00/10] Introduce TDVF Config-B (basic) in OvmfPkg Date: Tue, 14 Dec 2021 21:41:16 +0800 Message-Id: <20211214134126.869-1-min.m.xu@intel.com> X-Mailer: git-send-email 2.29.2.windows.2 MIME-Version: 1.0 Content-Transfer-Encoding: 8bit RFC: https://bugzilla.tianocore.org/show_bug.cgi?id=3429 Intel's Trust Domain Extensions (Intel TDX) refers to an Intel technology that extends Virtual Machines Extensions (VMX) and Multi-Key Total Memory Encryption (MKTME) with a new kind of virutal machines guest called a Trust Domain (TD). A TD is desinged to run in a CPU mode that protects the confidentiality of TD memory contents and the TD's CPU state from other software, including the hosting Virtual-Machine Monitor (VMM), unless explicitly shared by the TD itself. There are 2 configurations for TDVF to upstream. See below link for the definitions of the 2 configurations. https://edk2.groups.io/g/devel/message/76367 This patch-set is to enable the basic feature of Config-B in OvmfPkg. - Add a standalone IntelTdxX64.dsc to a TDX specific directory for a *full* feature TDVF. (Align with existing SEV) - IntelTdxX64.dsc includes TDX/normal OVMF basic boot capability. The final binary can run on TDX/normal OVMF. - PEI phase is skipped. By design in Config-B there should be more advanced features, such as: - RTMR based measurement and measure boot. - Remove unnecessary drivers to reduce attack surface, such as network stack. To make the code review more efficiency, Config-B is split into 2 waves: - Basic feature of Config-B - Advanced feature of Config-B Patch 1: Create standalone IntelTdxX64.dsc / IntelTdxX64.fdf Patch 2/3: This patch-set leverage the PrePiLib and MemoryAllocationLib in EmbeddedPkg. Some new funtions are added to meet the Tdvf Config-B requirement. Patch 4/5/6: They are helper libs used in Tdvf Config-B. TdxStartupLib is the most important one which brings up Tdx guest from SEC to PEI. Patch 7: This patch updates TdxDxe driver for the Tdvf Config-B. Patch 8: Now it's time to update SecMain to call TdxStartup () to bring Tdx guest from SEC to DXE. Patch 9: This patch update DxeAcpiTimerLib for the Tdvf Config-B. Patch 10: With the introduction of Config-B changes, some Tdx libs should be added in OvmfPkg's dsc to prevent the broken of building. Code at: https://github.com/mxu9/edk2/tree/tdvf_wave3 Please be noted: This patch-set is based on the code base of tdvf_wave2.v4 which is at: https://github.com/mxu9/edk2/tree/tdvf_wave2.v4 Cc: Michael D Kinney Cc: Brijesh Singh Cc: Erdem Aktas Cc: James Bottomley Cc: Jiewen Yao Cc: Tom Lendacky Cc: Gerd Hoffmann Cc: Leif Lindholm Cc: Ard Biesheuvel Cc: Abner Chang Cc: Daniel Schaefer Signed-off-by: Min Xu Min Xu (10): OvmfPkg: Introduce IntelTdxX64 for TDVF Config-B EmbeddedPkg/PrePiLib: Update PrePiLib EmbeddedPkg/MemoryAllocationLib: Add null stub for AllocateCopyPool OvmfPkg: Add PrePiHobListPointerLibTdx OvmfPkg: Add SecPlatformLibQemuTdx OvmfPkg: Add TdxStartupLib OvmfPkg: Update TdxDxe to set TDX PCDs OvmfPkg: Update Sec to support Tdvf Config-B OvmfPkg: Update DxeAcpiTimerLib to read HostBridgeDevId in PlatformInfoHob OvmfPkg: Add Tdx libs to prevent building broken EmbeddedPkg/Include/Library/PrePiLib.h | 21 +- EmbeddedPkg/Library/PrePiLib/FwVol.c | 399 +++++++- .../MemoryAllocationLib.c | 28 + OvmfPkg/AmdSev/AmdSevX64.dsc | 3 + OvmfPkg/Bhyve/BhyveX64.dsc | 3 + OvmfPkg/Include/Library/TdxPlatformLib.h | 38 + OvmfPkg/Include/Library/TdxStartupLib.h | 35 + .../IntelTdxX64.dsc} | 23 +- OvmfPkg/IntelTdx/IntelTdxX64.fdf | 548 +++++++++++ .../PrePiHobListPointer.c | 45 + .../PrePiHobListPointerLibTdx.inf | 25 + .../IntelTdx/SecPlatformLibQemuTdx/Platform.c | 286 ++++++ .../SecPlatformLibQemuTdx/TdxPlatformLib.inf | 49 + OvmfPkg/IntelTdx/TdxStartupLib/DxeLoad.c | 344 +++++++ OvmfPkg/IntelTdx/TdxStartupLib/Hob.c | 150 +++ OvmfPkg/IntelTdx/TdxStartupLib/TdxStartup.c | 143 +++ .../TdxStartupLib/TdxStartupInternal.h | 68 ++ .../IntelTdx/TdxStartupLib/TdxStartupLib.inf | 85 ++ .../TdxStartupLib/TdxStartupLibNull.inf | 40 + .../IntelTdx/TdxStartupLib/TdxStartupNull.c | 19 + .../IntelTdx/TdxStartupLib/X64/PageTables.h | 206 ++++ .../TdxStartupLib/X64/VirtualMemory.c | 915 ++++++++++++++++++ .../Library/AcpiTimerLib/DxeAcpiTimerLib.c | 23 +- .../Library/AcpiTimerLib/DxeAcpiTimerLib.inf | 4 + OvmfPkg/Microvm/MicrovmX64.dsc | 5 + OvmfPkg/OvmfPkg.dec | 11 + OvmfPkg/OvmfPkgX64.dsc | 1 + OvmfPkg/OvmfXen.dsc | 3 + OvmfPkg/Sec/IntelTdx.c | 7 +- OvmfPkg/Sec/SecMain.c | 17 + OvmfPkg/Sec/SecMain.inf | 2 + OvmfPkg/TdxDxe/TdxDxe.c | 12 + OvmfPkg/TdxDxe/TdxDxe.inf | 3 + 33 files changed, 3550 insertions(+), 11 deletions(-) create mode 100644 OvmfPkg/Include/Library/TdxPlatformLib.h create mode 100644 OvmfPkg/Include/Library/TdxStartupLib.h copy OvmfPkg/{OvmfPkgX64.dsc => IntelTdx/IntelTdxX64.dsc} (96%) create mode 100644 OvmfPkg/IntelTdx/IntelTdxX64.fdf create mode 100644 OvmfPkg/IntelTdx/PrePiHobListPointerLibTdx/PrePiHobListPointer.c create mode 100644 OvmfPkg/IntelTdx/PrePiHobListPointerLibTdx/PrePiHobListPointerLibTdx.inf create mode 100644 OvmfPkg/IntelTdx/SecPlatformLibQemuTdx/Platform.c create mode 100644 OvmfPkg/IntelTdx/SecPlatformLibQemuTdx/TdxPlatformLib.inf create mode 100644 OvmfPkg/IntelTdx/TdxStartupLib/DxeLoad.c create mode 100644 OvmfPkg/IntelTdx/TdxStartupLib/Hob.c create mode 100644 OvmfPkg/IntelTdx/TdxStartupLib/TdxStartup.c create mode 100644 OvmfPkg/IntelTdx/TdxStartupLib/TdxStartupInternal.h create mode 100644 OvmfPkg/IntelTdx/TdxStartupLib/TdxStartupLib.inf create mode 100644 OvmfPkg/IntelTdx/TdxStartupLib/TdxStartupLibNull.inf create mode 100644 OvmfPkg/IntelTdx/TdxStartupLib/TdxStartupNull.c create mode 100644 OvmfPkg/IntelTdx/TdxStartupLib/X64/PageTables.h create mode 100644 OvmfPkg/IntelTdx/TdxStartupLib/X64/VirtualMemory.c -- 2.29.2.windows.2