public inbox for devel@edk2.groups.io
 help / color / mirror / Atom feed
* [PATCH 0/8] Enable RTMR based measurement and measure boot for Td guest
@ 2022-03-02  0:27 Min Xu
  2022-03-02  0:28 ` [PATCH 1/8] Security: Add HashLibBaseCryptoRouterTdx Min Xu
                   ` (7 more replies)
  0 siblings, 8 replies; 18+ messages in thread
From: Min Xu @ 2022-03-02  0:27 UTC (permalink / raw)
  To: devel
  Cc: Min Xu, Jiewen Yao, Jian J Wang, Gerd Hoffmann, Xiaoyu Lu,
	Guomin Jiang, Michael D Kinney, Liming Gao, Zhiguang Liu,
	Sami Mujawar, Ken Lu, Ard Biesheuvel, Jordan Justen,
	Brijesh Singh, Erdem Aktas, James Bottomley, Tom Lendacky

RFC: https://bugzilla.tianocore.org/show_bug.cgi?id=3853

Intel's Trust Domain Extensions (Intel TDX) refers to an Intel technology
that extends Virtual Machines Extensions (VMX) and Multi-Key Total Memory
Encryption (MKTME) with a new kind of virutal machines guest called a
Trust Domain (TD). A TD is desinged to run in a CPU mode that protects the
confidentiality of TD memory contents and the TD's CPU state from other
software, including the hosting Virtual-Machine Monitor (VMM), unless
explicitly shared by the TD itself.

There are 2 configurations for TDVF to upstream. See below link for
the definitions of the 2 configurations.
https://edk2.groups.io/g/devel/message/76367

This patch-set is to enable below features of Config-B in OvmfPkg.
 - Enable RTMR based measurement and measured boot
 - Install CC_MEASUREMENT_PROTOCOL instance in Td guest

The measurement for the other components, such as kernel image, initrd,
will be in the following patch-sets.

Patch 1:
HashLibBaseCryptoRouterTdx provides SHA384 service and extend to 
RTMR registers.

Patch 2:
SecCryptLib is the cryptographic library instance for SEC.

Patch 3 - 7:
These 5 patches are related to RTMR based measurement and
CC Eventlog ACPI table.

Patch 8:
Update IntelTdxX64.dsc/IntelTdxX64.fdf to support RTMR based
measurement and measured boot.

Code at: https://github.com/mxu9/edk2/tree/tdvf_wave4.v1

Cc: Jiewen Yao <jiewen.yao@intel.com>
Cc: Jian J Wang <jian.j.wang@intel.com>
Cc: Gerd Hoffmann <kraxel@redhat.com>
Cc: Xiaoyu Lu <xiaoyu1.lu@intel.com>
Cc: Guomin Jiang <guomin.jiang@intel.com>
Cc: Michael D Kinney <michael.d.kinney@intel.com>
Cc: Liming Gao <gaoliming@byosoft.com.cn>
Cc: Zhiguang Liu <zhiguang.liu@intel.com>
Cc: Sami Mujawar <sami.mujawar@arm.com>
Cc: Ken Lu <ken.lu@intel.com>
Cc: Ard Biesheuvel <ardb+tianocore@kernel.org>
Cc: Jordan Justen <jordan.l.justen@intel.com>
Cc: Brijesh Singh <brijesh.singh@amd.com>
Cc: Erdem Aktas <erdemaktas@google.com>
Cc: James Bottomley <jejb@linux.ibm.com>
Cc: Tom Lendacky <thomas.lendacky@amd.com>
Signed-off-by: Min Xu <min.m.xu@intel.com>

Min Xu (8):
  Security: Add HashLibBaseCryptoRouterTdx
  CryptoPkg: Add SecCryptLib
  MdePkg: Add definition of EFI_CC_EVENT_HOB_GUID
  OvmfPkg/IntelTdx: Measure Td HobList and Configuration FV
  MdePkg: Define CC Measure EventLog ACPI Table
  OvmfPkg: Add PCDs for LAML/LASA field in CC EVENTLOG ACPI table
  OvmfPkg/IntelTdx: Add TdTcg2Dxe
  OvmfPkg/IntelTdx: Enable RTMR based measurement and measure boot

 CryptoPkg/CryptoPkg.dsc                       |    4 +
 .../Library/BaseCryptLib/SecCryptLib.inf      |   67 +
 MdePkg/Include/Protocol/CcMeasurement.h       |   28 +
 MdePkg/MdePkg.dec                             |    1 +
 OvmfPkg/IntelTdx/IntelTdxX64.dsc              |   15 +-
 OvmfPkg/IntelTdx/IntelTdxX64.fdf              |    5 +
 OvmfPkg/IntelTdx/PeilessStartupLib/IntelTdx.c |  497 ++++
 .../PeilessStartupLib/PeilessStartup.c        |   30 +
 .../PeilessStartupInternal.h                  |   57 +
 .../PeilessStartupLib/PeilessStartupLib.inf   |    7 +-
 .../IntelTdx/TdTcg2Dxe/MeasureBootPeCoff.c    |  407 +++
 OvmfPkg/IntelTdx/TdTcg2Dxe/TdTcg2Dxe.c        | 2487 +++++++++++++++++
 OvmfPkg/IntelTdx/TdTcg2Dxe/TdTcg2Dxe.inf      |  101 +
 OvmfPkg/OvmfPkg.dec                           |    6 +
 .../HashLibBaseCryptoRouterTdx.c              |  214 ++
 .../HashLibBaseCryptoRouterTdx.inf            |   41 +
 SecurityPkg/SecurityPkg.dsc                   |   10 +
 17 files changed, 3974 insertions(+), 3 deletions(-)
 create mode 100644 CryptoPkg/Library/BaseCryptLib/SecCryptLib.inf
 create mode 100644 OvmfPkg/IntelTdx/PeilessStartupLib/IntelTdx.c
 create mode 100644 OvmfPkg/IntelTdx/TdTcg2Dxe/MeasureBootPeCoff.c
 create mode 100644 OvmfPkg/IntelTdx/TdTcg2Dxe/TdTcg2Dxe.c
 create mode 100644 OvmfPkg/IntelTdx/TdTcg2Dxe/TdTcg2Dxe.inf
 create mode 100644 SecurityPkg/Library/HashLibBaseCryptoRouter/HashLibBaseCryptoRouterTdx.c
 create mode 100644 SecurityPkg/Library/HashLibBaseCryptoRouter/HashLibBaseCryptoRouterTdx.inf

-- 
2.29.2.windows.2


^ permalink raw reply	[flat|nested] 18+ messages in thread

end of thread, other threads:[~2022-03-17 13:33 UTC | newest]

Thread overview: 18+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2022-03-02  0:27 [PATCH 0/8] Enable RTMR based measurement and measure boot for Td guest Min Xu
2022-03-02  0:28 ` [PATCH 1/8] Security: Add HashLibBaseCryptoRouterTdx Min Xu
2022-03-02  0:28 ` [PATCH 2/8] CryptoPkg: Add SecCryptLib Min Xu
2022-03-02  0:28 ` [PATCH 3/8] MdePkg: Add definition of EFI_CC_EVENT_HOB_GUID Min Xu
2022-03-02  1:52   ` 回复: " gaoliming
2022-03-03  7:13     ` [edk2-devel] " Min Xu
2022-03-02  0:28 ` [PATCH 4/8] OvmfPkg/IntelTdx: Measure Td HobList and Configuration FV Min Xu
2022-03-02  0:28 ` [PATCH 5/8] MdePkg: Define CC Measure EventLog ACPI Table Min Xu
2022-03-09 15:35   ` Sami Mujawar
2022-03-10  5:48     ` Yao, Jiewen
2022-03-10 10:27       ` Sami Mujawar
2022-03-17 13:10         ` Sami Mujawar
2022-03-17 13:23           ` Yao, Jiewen
2022-03-17 13:25             ` Samer El-Haj-Mahmoud
2022-03-17 13:33               ` [edk2-devel] " Yao, Jiewen
2022-03-02  0:28 ` [PATCH 6/8] OvmfPkg: Add PCDs for LAML/LASA field in CC EVENTLOG ACPI table Min Xu
2022-03-02  0:28 ` [PATCH 7/8] OvmfPkg/IntelTdx: Add TdTcg2Dxe Min Xu
2022-03-02  0:28 ` [PATCH 8/8] OvmfPkg/IntelTdx: Enable RTMR based measurement and measure boot Min Xu

This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox