public inbox for devel@edk2.groups.io
 help / color / mirror / Atom feed
* [PATCH V4 00/10] Introduce TDVF Config-B (basic) in OvmfPkg
@ 2022-02-28  8:16 Min Xu
  2022-02-28  8:16 ` [PATCH V4 01/10] OvmfPkg: Add TdxWorkArea definition Min Xu
                   ` (9 more replies)
  0 siblings, 10 replies; 18+ messages in thread
From: Min Xu @ 2022-02-28  8:16 UTC (permalink / raw)
  To: devel
  Cc: Min Xu, Michael D Kinney, Brijesh Singh, Erdem Aktas,
	James Bottomley, Jiewen Yao, Tom Lendacky, Gerd Hoffmann,
	Leif Lindholm, Ard Biesheuvel, Abner Chang, Daniel Schaefer,
	Ray Ni

RFC: https://bugzilla.tianocore.org/show_bug.cgi?id=3429

Intel's Trust Domain Extensions (Intel TDX) refers to an Intel technology
that extends Virtual Machines Extensions (VMX) and Multi-Key Total Memory
Encryption (MKTME) with a new kind of virutal machines guest called a
Trust Domain (TD). A TD is desinged to run in a CPU mode that protects the
confidentiality of TD memory contents and the TD's CPU state from other
software, including the hosting Virtual-Machine Monitor (VMM), unless
explicitly shared by the TD itself.

There are 2 configurations for TDVF to upstream. See below link for
the definitions of the 2 configurations.
https://edk2.groups.io/g/devel/message/76367

This patch-set is to enable the basic feature of Config-B in OvmfPkg.
 - Add a standalone IntelTdxX64.dsc to a TDX specific directory for a
   *full* feature TDVF. (Align with existing SEV)
 - IntelTdxX64.dsc includes TDX/normal OVMF basic boot capability. The
   final binary can run on TDX/normal OVMF.
 - PEI phase is skipped.

By design in Config-B there should be more advanced features, such as:
 - RTMR based measurement and measure boot.
 - Remove unnecessary drivers to reduce attack surface, such as
   network stack.

To make the code review more efficiency, Config-B is split into 2 waves:
 - Basic feature of Config-B
 - Advanced feature of Config-B
This patch-set is for *Basic feature of Config-B*.

Code at: https://github.com/mxu9/edk2/tree/tdvf_wave3.v4

Please be noted:
This patch-set is based on tdvf_wave2.v7 which is at:
https://github.com/mxu9/edk2/tree/tdvf_wave2.v7

v4 changes:
 - Rename TdxStartupLib to PeilessStartupLib.
 - Check HostBridgeDevId from PlatformInfoHob in DxeAcpiTimerLib.
 - Add 2 more patches (#8 #9) to ignore PCI OptionRom in Td guest.

v3 changes:
 - Drop the PcdTdxWorkAreaBase introduced in v2. Instead PcdSevEsWorkArea
   is used to point to the TDX WorkArea. PcdSevEsWorkArea will be renamed
   to PcdCcWorkAreaBase in the future.
 - In v2 TdHob is processed in OvmfPkg/IntelTdx/Sec/IntelTdx.c. Since
   the codes have been moved to PlatformInitLib, IntelTdx.c is deleted.
 - Add comments in DxeAcpiTimerLib to explain why both
   PcdOvmfHostBridgePciDevId and EFI_HOB_PLATFORM_INFO are checked to
   read HostBridgeDevId.

v2 changes:
 - In v1 PEI phase is skipped during boot process. But the code is still
   in the image. It is not a good way. So in v2 the code of PEI is
   removed as well.
 - In v1 PrePiLib in EmbeddedPkg are updated to meet the requirement of
   TDVF-Config-B. This is because PrePiLib in EmbeddedPkg is designed for
   the situation of PEI-less boot. So after PEI is removed, this change
   is not needed anymore.
 - In v1 only Tdx guest can be brought up. Now v2 brings up both Legacy
   guest and Tdx guest.
 - Platform initialization in TdxStartup is refactored with the
   PlatformInitLib.
 - OvmfPkg/IntelTdx/Sec is introduced. It is a simplied version of
   OvmfPkg/Sec.

Cc: Michael D Kinney <michael.d.kinney@intel.com>
Cc: Brijesh Singh <brijesh.singh@amd.com>
Cc: Erdem Aktas <erdemaktas@google.com>
Cc: James Bottomley <jejb@linux.ibm.com>
Cc: Jiewen Yao <jiewen.yao@intel.com>
Cc: Tom Lendacky <thomas.lendacky@amd.com>
Cc: Gerd Hoffmann <kraxel@redhat.com>
Cc: Leif Lindholm <leif@nuviainc.com>
Cc: Ard Biesheuvel <ardb+tianocore@kernel.org>
Cc: Abner Chang <abner.chang@hpe.com>
Cc: Daniel Schaefer <daniel.schaefer@hpe.com>
Cc: Ray Ni <ray.ni@intel.com>
Signed-off-by: Min Xu <min.m.xu@intel.com>

Min Xu (10):
  OvmfPkg: Add TdxWorkArea definition
  OvmfPkg: Add PrePiHobListPointerLibTdx
  OvmfPkg: Update EFI_HOB_PLATFORM_INFO with more platform settings
  OvmfPkg: Add PeilessStartupLib
  OvmfPkg/IntelTdx: Add Sec to bring up both Legacy and Tdx guest
  OvmfPkg: Update TdxDxe to set TDX PCDs
  OvmfPkg: Update DxeAcpiTimerLib to read HostBridgeDevId in
    PlatformInfoHob
  OvmfPkg/IncompatiblePciDeviceSupportDxe: Ignore OptionRom in Td guest
  MdeModulePkg: Update PciEnumeratorSupport to ignore OptionRom if
    needed
  OvmfPkg: Introduce IntelTdxX64 for TDVF Config-B

 .../Bus/Pci/PciBusDxe/PciEnumeratorSupport.c  |  23 +-
 .../Bus/Pci/PciBusDxe/PciEnumeratorSupport.h  |   4 +-
 OvmfPkg/Include/Library/PeilessStartupLib.h   |  34 +
 OvmfPkg/Include/Library/PlatformInitLib.h     |  16 +
 OvmfPkg/Include/WorkArea.h                    |  15 +
 .../IncompatiblePciDeviceSupport.c            | 110 ++-
 OvmfPkg/IntelTdx/IntelTdxX64.dsc              | 718 ++++++++++++++
 OvmfPkg/IntelTdx/IntelTdxX64.fdf              | 401 ++++++++
 OvmfPkg/IntelTdx/PeilessStartupLib/DxeLoad.c  | 218 ++++
 OvmfPkg/IntelTdx/PeilessStartupLib/Hob.c      | 130 +++
 .../PeilessStartupLib/PeilessStartup.c        | 241 +++++
 .../PeilessStartupInternal.h                  |  55 ++
 .../PeilessStartupLib/PeilessStartupLib.inf   |  86 ++
 .../PeilessStartupLib/X64/PageTables.h        | 206 ++++
 .../PeilessStartupLib/X64/VirtualMemory.c     | 935 ++++++++++++++++++
 .../PrePiHobListPointer.c                     |  57 ++
 .../PrePiHobListPointerLibTdx.inf             |  29 +
 OvmfPkg/IntelTdx/Sec/SecMain.c                | 198 ++++
 OvmfPkg/IntelTdx/Sec/SecMain.inf              |  61 ++
 OvmfPkg/IntelTdx/Sec/X64/SecEntry.nasm        | 151 +++
 .../Library/AcpiTimerLib/DxeAcpiTimerLib.c    |  25 +-
 .../Library/AcpiTimerLib/DxeAcpiTimerLib.inf  |   7 +-
 OvmfPkg/OvmfPkg.dec                           |   4 +
 OvmfPkg/TdxDxe/TdxDxe.c                       |  69 +-
 OvmfPkg/TdxDxe/TdxDxe.inf                     |   5 +
 25 files changed, 3753 insertions(+), 45 deletions(-)
 create mode 100644 OvmfPkg/Include/Library/PeilessStartupLib.h
 create mode 100644 OvmfPkg/IntelTdx/IntelTdxX64.dsc
 create mode 100644 OvmfPkg/IntelTdx/IntelTdxX64.fdf
 create mode 100644 OvmfPkg/IntelTdx/PeilessStartupLib/DxeLoad.c
 create mode 100644 OvmfPkg/IntelTdx/PeilessStartupLib/Hob.c
 create mode 100644 OvmfPkg/IntelTdx/PeilessStartupLib/PeilessStartup.c
 create mode 100644 OvmfPkg/IntelTdx/PeilessStartupLib/PeilessStartupInternal.h
 create mode 100644 OvmfPkg/IntelTdx/PeilessStartupLib/PeilessStartupLib.inf
 create mode 100644 OvmfPkg/IntelTdx/PeilessStartupLib/X64/PageTables.h
 create mode 100644 OvmfPkg/IntelTdx/PeilessStartupLib/X64/VirtualMemory.c
 create mode 100644 OvmfPkg/IntelTdx/PrePiHobListPointerLibTdx/PrePiHobListPointer.c
 create mode 100644 OvmfPkg/IntelTdx/PrePiHobListPointerLibTdx/PrePiHobListPointerLibTdx.inf
 create mode 100644 OvmfPkg/IntelTdx/Sec/SecMain.c
 create mode 100644 OvmfPkg/IntelTdx/Sec/SecMain.inf
 create mode 100644 OvmfPkg/IntelTdx/Sec/X64/SecEntry.nasm

-- 
2.29.2.windows.2


^ permalink raw reply	[flat|nested] 18+ messages in thread

end of thread, other threads:[~2022-03-18 13:41 UTC | newest]

Thread overview: 18+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2022-02-28  8:16 [PATCH V4 00/10] Introduce TDVF Config-B (basic) in OvmfPkg Min Xu
2022-02-28  8:16 ` [PATCH V4 01/10] OvmfPkg: Add TdxWorkArea definition Min Xu
2022-02-28  8:16 ` [PATCH V4 02/10] OvmfPkg: Add PrePiHobListPointerLibTdx Min Xu
2022-02-28  8:16 ` [PATCH V4 03/10] OvmfPkg: Update EFI_HOB_PLATFORM_INFO with more platform settings Min Xu
2022-03-01 13:26   ` Gerd Hoffmann
2022-03-02  0:42     ` [edk2-devel] " Min Xu
2022-02-28  8:16 ` [PATCH V4 04/10] OvmfPkg: Add PeilessStartupLib Min Xu
2022-03-01 13:31   ` Gerd Hoffmann
2022-03-02  1:20     ` Min Xu
2022-02-28  8:16 ` [PATCH V4 05/10] OvmfPkg/IntelTdx: Add Sec to bring up both Legacy and Tdx guest Min Xu
2022-02-28  8:16 ` [PATCH V4 06/10] OvmfPkg: Update TdxDxe to set TDX PCDs Min Xu
2022-02-28  8:16 ` [PATCH V4 07/10] OvmfPkg: Update DxeAcpiTimerLib to read HostBridgeDevId in PlatformInfoHob Min Xu
2022-02-28  8:16 ` [PATCH V4 08/10] OvmfPkg/IncompatiblePciDeviceSupportDxe: Ignore OptionRom in Td guest Min Xu
2022-03-01 13:44   ` Gerd Hoffmann
2022-03-02  1:21     ` Min Xu
2022-02-28  8:16 ` [PATCH V4 09/10] MdeModulePkg: Update PciEnumeratorSupport to ignore OptionRom if needed Min Xu
2022-03-18 13:41   ` Ni, Ray
2022-02-28  8:16 ` [PATCH V4 10/10] OvmfPkg: Introduce IntelTdxX64 for TDVF Config-B Min Xu

This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox