From: "Min Xu" <min.m.xu@intel.com>
To: devel@edk2.groups.io
Cc: Min Xu <min.m.xu@intel.com>,
Ard Biesheuvel <ardb+tianocore@kernel.org>,
Jordan Justen <jordan.l.justen@intel.com>,
Brijesh Singh <brijesh.singh@amd.com>,
Erdem Aktas <erdemaktas@google.com>,
James Bottomley <jejb@linux.ibm.com>,
Jiewen Yao <jiewen.yao@intel.com>,
Tom Lendacky <thomas.lendacky@amd.com>,
Eric Dong <eric.dong@intel.com>, Ray Ni <ray.ni@intel.com>,
Debkumar De <debkumar.de@intel.com>
Subject: [PATCH V2 0/4] Add Intel TDX support in OvmfPkg/ResetVector
Date: Thu, 22 Jul 2021 13:52:12 +0800 [thread overview]
Message-ID: <cover.1626931332.git.min.m.xu@intel.com> (raw)
REF: https://bugzilla.tianocore.org/show_bug.cgi?id=3429
Intel's Trust Domain Extensions (Intel TDX) refers to an Intel technology
that extends Virtual Machines Extensions (VMX) and Multi-Key Total Memory
Encryption (MKTME) with a new kind of virutal machines guest called a
Trust Domain (TD). A TD is desinged to run in a CPU mode that protects the
confidentiality of TD memory contents and the TD's CPU state from other
software, including the hosting Virtual-Machine Monitor (VMM), unless
explicitly shared by the TD itself.
The patch-sets to support Intel TDX in OvmfPkg is split into several
waves. This is wave1 which adds Intel TDX support in OvmfPkg/ResetVector.
Note: TDX only works in X64.
Patch 1 add the PCDs of BFV/CFV. BFV is the code part of the image. CFV is
the configuration part. BFV is measured by VMM and CFV is measured by TDVF
itself.
Patch 2 add TdxMetadata in OvmfPkg/ResetVector. It describes the
information about the image so that VMM can do the initialization and
measurement based on these information.
Patch 3 updates the UefiCpuPkg/Vtf0/Main.asm to add Main32 entrypoint. It
is because on reset all the CPUs are in 32-bit protected mode. In the
Main32 entry point, Init32 is called to do the 32-bit initializaiton. In
UefiCpuPkg/ResetVector/Vtf0/Ia32, Init32.asm is added. It is a null stub
of the 32-bit initialization. The actual work is implemented in OvmfPkg.
In Patch 4, InitTdx.asm does the tdx initialization, ReloadFlat32 loads
the GDT and sets the CR0, then jump to 32-bit protected mode. Init32.asm
put above 2 together to complete the 32-bit initializaiton. After that
page tables are built and set, then jump to SecEntry.
[TDX]: https://software.intel.com/content/dam/develop/external/us/en/
documents/tdx-whitepaper-final9-17.pdf
[TDVF]: https://software.intel.com/content/dam/develop/external/us/en/
documents/tdx-virtual-firmware-design-guide-rev-1.pdf
Code is at https://github.com/mxu9/edk2/tree/tdvf_wave1.v2
v2 changes:
- Move InitTdx.asm and ReloadFlat32.asm from UefiCpuPkg/ResetVector/Vtf0
to OvmfPkg/ResetVector. Init32.asm is created which is a null stub of
32-bit initialization. In Main32 just simply call Init32. It makes
the Main.asm in UefiCpuPkg/ResetVector clean and clear.
- Init32.asm/InitTdx.asm/ReloadFlat32.asm are created under
OvmfPkg/ResetVector/Ia32.
- Update some descriptions of the patch-sets.
- Update the REF link in cover letter.
- Add Ard Biesheuvel in Cc list.
v1: https://edk2.groups.io/g/devel/message/77675
Cc: Ard Biesheuvel <ardb+tianocore@kernel.org>
Cc: Jordan Justen <jordan.l.justen@intel.com>
Cc: Brijesh Singh <brijesh.singh@amd.com>
Cc: Erdem Aktas <erdemaktas@google.com>
Cc: James Bottomley <jejb@linux.ibm.com>
Cc: Jiewen Yao <jiewen.yao@intel.com>
Cc: Tom Lendacky <thomas.lendacky@amd.com>
Cc: Eric Dong <eric.dong@intel.com>
Cc: Ray Ni <ray.ni@intel.com>
CC: Debkumar De <debkumar.de@intel.com>
Signed-off-by: Min Xu <min.m.xu@intel.com>
Min Xu (4):
OvmfPkg: Add Tdx BFV/CFV PCDs and PcdOvmfImageSizeInKb
OvmfPkg: Add Tdx metadata
UefiCpuPkg/ResetVector: Add Main32 entry point in Main.asm
OvmfPkg/ResetVector: Update ResetVector to support Tdx
OvmfPkg/OvmfPkg.dec | 13 +++
OvmfPkg/OvmfPkgDefines.fdf.inc | 12 ++-
OvmfPkg/ResetVector/Ia16/ResetVectorVtf0.asm | 38 ++++++++
OvmfPkg/ResetVector/Ia32/Flat32ToFlat64.asm | 47 ++++++++++
OvmfPkg/ResetVector/Ia32/Init32.asm | 34 +++++++
OvmfPkg/ResetVector/Ia32/InitTdx.asm | 57 ++++++++++++
OvmfPkg/ResetVector/Ia32/PageTables64.asm | 41 +++++++++
OvmfPkg/ResetVector/Ia32/ReloadFlat32.asm | 44 +++++++++
OvmfPkg/ResetVector/ResetVector.inf | 11 ++-
OvmfPkg/ResetVector/ResetVector.nasmb | 65 ++++++++++++-
OvmfPkg/ResetVector/X64/TdxMetadata.asm | 97 ++++++++++++++++++++
UefiCpuPkg/ResetVector/Vtf0/Ia32/Init32.asm | 13 +++
UefiCpuPkg/ResetVector/Vtf0/Main.asm | 14 +++
UefiCpuPkg/ResetVector/Vtf0/Vtf0.nasmb | 2 +-
14 files changed, 483 insertions(+), 5 deletions(-)
create mode 100644 OvmfPkg/ResetVector/Ia32/Init32.asm
create mode 100644 OvmfPkg/ResetVector/Ia32/InitTdx.asm
create mode 100644 OvmfPkg/ResetVector/Ia32/ReloadFlat32.asm
create mode 100644 OvmfPkg/ResetVector/X64/TdxMetadata.asm
create mode 100644 UefiCpuPkg/ResetVector/Vtf0/Ia32/Init32.asm
--
2.29.2.windows.2
next reply other threads:[~2021-07-22 5:53 UTC|newest]
Thread overview: 16+ messages / expand[flat|nested] mbox.gz Atom feed top
2021-07-22 5:52 Min Xu [this message]
2021-07-22 5:52 ` [PATCH V2 1/4] OvmfPkg: Add Tdx BFV/CFV PCDs and PcdOvmfImageSizeInKb Min Xu
2021-07-22 5:52 ` [PATCH V2 2/4] OvmfPkg: Add Tdx metadata Min Xu
2021-07-22 5:52 ` [PATCH V2 3/4] UefiCpuPkg/ResetVector: Add Main32 entry point in Main.asm Min Xu
2021-07-23 2:33 ` Ni, Ray
2021-07-25 6:07 ` Yao, Jiewen
2021-07-25 7:41 ` Min Xu
2021-07-25 7:43 ` Yao, Jiewen
2021-07-25 7:46 ` Min Xu
2021-07-22 5:52 ` [PATCH V2 4/4] OvmfPkg/ResetVector: Update ResetVector to support Tdx Min Xu
2021-07-22 17:07 ` Lendacky, Thomas
2021-07-22 22:58 ` Min Xu
2021-07-23 13:35 ` Lendacky, Thomas
2021-07-24 1:54 ` [edk2-devel] " Min Xu
2021-07-25 6:00 ` Yao, Jiewen
2021-07-25 7:50 ` Min Xu
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-list from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=cover.1626931332.git.min.m.xu@intel.com \
--to=devel@edk2.groups.io \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox