From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from mga12.intel.com (mga12.intel.com [192.55.52.136]) by mx.groups.io with SMTP id smtpd.web08.25742.1639489321528370744 for ; Tue, 14 Dec 2021 05:42:09 -0800 Authentication-Results: mx.groups.io; dkim=fail reason="signature has expired" header.i=@intel.com header.s=intel header.b=AhEcYwHD; spf=pass (domain: intel.com, ip: 192.55.52.136, mailfrom: min.m.xu@intel.com) DKIM-Signature: v=1; a=rsa-sha256; c=simple/simple; d=intel.com; i=@intel.com; q=dns/txt; s=Intel; t=1639489328; x=1671025328; h=from:to:cc:subject:date:message-id:in-reply-to: references:mime-version:content-transfer-encoding; bh=SLwWqHljapL6IrKoKgdbckck/ZCv1YefY9TL1v7Dk5E=; b=AhEcYwHDKQL4MdYaZBcEqdxw2kg48viiz9atfffahaF9aHUf1CnWm3ZB iMm+LXHzDTePr7Y+vZ4oeniXIAOrTVmXjeiFrqqMJFbRXv8/mFNARLuEt H4rLk55JQ27c/F5XJPGd2SlOqI0ZWdwHI5dNNRXDN4tBnphy9UJ/Mc1es EHchDYrAyiMF410HXfc6LOum/2g5TweqRm9UTdjIyfA3sIRNwk8SeCXol 1McRUxVHDf76jtQV62WCZ1scK6Tvus8AXHUdYdLpgY5utXCvBULKj2+ER jD7Te1vrx4o/JVx4dEBEmv4ZxD6q4ns+34aH+UkWuJ4/1OEm9ZCGzYAT7 Q==; X-IronPort-AV: E=McAfee;i="6200,9189,10197"; a="218993685" X-IronPort-AV: E=Sophos;i="5.88,205,1635231600"; d="scan'208";a="218993685" Received: from orsmga006.jf.intel.com ([10.7.209.51]) by fmsmga106.fm.intel.com with ESMTP/TLS/ECDHE-RSA-AES256-GCM-SHA384; 14 Dec 2021 05:42:08 -0800 X-IronPort-AV: E=Sophos;i="5.88,205,1635231600"; d="scan'208";a="465094264" Received: from mxu9-mobl1.ccr.corp.intel.com ([10.255.30.115]) by orsmga006-auth.jf.intel.com with ESMTP/TLS/ECDHE-RSA-AES256-GCM-SHA384; 14 Dec 2021 05:42:06 -0800 From: "Min Xu" To: devel@edk2.groups.io Cc: Min Xu , Michael D Kinney , Brijesh Singh , Erdem Aktas , James Bottomley , Jiewen Yao , Tom Lendacky , Gerd Hoffmann Subject: [PATCH 08/10] OvmfPkg: Update Sec to support Tdvf Config-B Date: Tue, 14 Dec 2021 21:41:24 +0800 Message-Id: <20211214134126.869-9-min.m.xu@intel.com> X-Mailer: git-send-email 2.29.2.windows.2 In-Reply-To: <20211214134126.869-1-min.m.xu@intel.com> References: <20211214134126.869-1-min.m.xu@intel.com> MIME-Version: 1.0 Content-Transfer-Encoding: 8bit RFC: https://bugzilla.tianocore.org/show_bug.cgi?id=3429 Tdvf Config-B skip PEI phase to reduce attack surface. So instead of jumping to SecStartupPhase2 (), TdxStartup () is called. This function brings up Tdx guest from SEC phase to DXE phase. Cc: Michael D Kinney Cc: Brijesh Singh Cc: Erdem Aktas Cc: James Bottomley Cc: Jiewen Yao Cc: Tom Lendacky Cc: Gerd Hoffmann Signed-off-by: Min Xu --- OvmfPkg/Sec/IntelTdx.c | 7 ++++++- OvmfPkg/Sec/SecMain.c | 17 +++++++++++++++++ OvmfPkg/Sec/SecMain.inf | 2 ++ 3 files changed, 25 insertions(+), 1 deletion(-) diff --git a/OvmfPkg/Sec/IntelTdx.c b/OvmfPkg/Sec/IntelTdx.c index d1d952e8d433..f9d44617b211 100644 --- a/OvmfPkg/Sec/IntelTdx.c +++ b/OvmfPkg/Sec/IntelTdx.c @@ -12,7 +12,7 @@ #include #include #include -#include +#include #include #include #include @@ -25,6 +25,11 @@ #define ALIGNED_2MB_MASK 0x1fffff +#define GET_HOB_TYPE(Hob) ((Hob).Header->HobType) +#define GET_HOB_LENGTH(Hob) ((Hob).Header->HobLength) +#define GET_NEXT_HOB(Hob) ((Hob).Raw + GET_HOB_LENGTH (Hob)) +#define END_OF_HOB_LIST(Hob) (GET_HOB_TYPE (Hob) == EFI_HOB_TYPE_END_OF_HOB_LIST) + /** Check TDX is enabled. diff --git a/OvmfPkg/Sec/SecMain.c b/OvmfPkg/Sec/SecMain.c index e2f3ede93901..c5dd066941fe 100644 --- a/OvmfPkg/Sec/SecMain.c +++ b/OvmfPkg/Sec/SecMain.c @@ -33,6 +33,10 @@ #include "IntelTdx.h" #include "AmdSev.h" +#ifdef INTEL_TDX_FULL_FEATURE + #include +#endif + #define SEC_IDT_ENTRY_COUNT 34 typedef struct _SEC_IDT_TABLE { @@ -913,6 +917,19 @@ SecCoreStartupWithStack ( InitializeApicTimer (0, MAX_UINT32, TRUE, 5); DisableApicTimerInterrupt (); + #ifdef INTEL_TDX_FULL_FEATURE + if (SecTdxIsEnabled ()) { + TdxStartup (&SecCoreData); + + // + // Never arrived here + // + ASSERT (FALSE); + CpuDeadLoop (); + } + + #endif + // // Initialize Debug Agent to support source level debug in SEC/PEI phases before memory ready. // diff --git a/OvmfPkg/Sec/SecMain.inf b/OvmfPkg/Sec/SecMain.inf index 230ee5e465b9..05e49ab5ae81 100644 --- a/OvmfPkg/Sec/SecMain.inf +++ b/OvmfPkg/Sec/SecMain.inf @@ -38,6 +38,7 @@ MdeModulePkg/MdeModulePkg.dec UefiCpuPkg/UefiCpuPkg.dec OvmfPkg/OvmfPkg.dec + EmbeddedPkg/EmbeddedPkg.dec [LibraryClasses] BaseLib @@ -58,6 +59,7 @@ [LibraryClasses.X64] TdxLib + TdxStartupLib [Ppis] gEfiTemporaryRamSupportPpiGuid # PPI ALWAYS_PRODUCED -- 2.29.2.windows.2