[edk2-devel] [PATCH V5 00/10] Introduce TDVF Config-B (basic) in OvmfPkg
Yao, Jiewen
jiewen.yao at intel.com
Sat Apr 2 08:20:17 UTC 2022
Series: reviewed-by: Jiewen Yao <Jiewen.yao at intel.com>
> -----Original Message-----
> From: Xu, Min M <min.m.xu at intel.com>
> Sent: Sunday, March 13, 2022 8:41 AM
> To: devel at edk2.groups.io
> Cc: Xu, Min M <min.m.xu at intel.com>; Kinney, Michael D
> <michael.d.kinney at intel.com>; Brijesh Singh <brijesh.singh at amd.com>; Aktas,
> Erdem <erdemaktas at google.com>; James Bottomley <jejb at linux.ibm.com>;
> Yao, Jiewen <jiewen.yao at intel.com>; Tom Lendacky
> <thomas.lendacky at amd.com>; Gerd Hoffmann <kraxel at redhat.com>; Leif
> Lindholm <leif at nuviainc.com>; Ard Biesheuvel <ardb+tianocore at kernel.org>;
> Chang, Abner <abner.chang at hpe.com>; Schaefer, Daniel
> <daniel.schaefer at hpe.com>; Ni, Ray <ray.ni at intel.com>
> Subject: [PATCH V5 00/10] Introduce TDVF Config-B (basic) in OvmfPkg
>
> RFC: https://bugzilla.tianocore.org/show_bug.cgi?id=3429
>
> Intel's Trust Domain Extensions (Intel TDX) refers to an Intel technology
> that extends Virtual Machines Extensions (VMX) and Multi-Key Total Memory
> Encryption (MKTME) with a new kind of virutal machines guest called a
> Trust Domain (TD). A TD is desinged to run in a CPU mode that protects the
> confidentiality of TD memory contents and the TD's CPU state from other
> software, including the hosting Virtual-Machine Monitor (VMM), unless
> explicitly shared by the TD itself.
>
> There are 2 configurations for TDVF to upstream. See below link for
> the definitions of the 2 configurations.
> https://edk2.groups.io/g/devel/message/76367
>
> This patch-set is to enable the basic feature of Config-B in OvmfPkg.
> - Add a standalone IntelTdxX64.dsc to a TDX specific directory for a
> *full* feature TDVF. (Align with existing SEV)
> - IntelTdxX64.dsc includes TDX/normal OVMF basic boot capability. The
> final binary can run on TDX/normal OVMF.
> - PEI phase is skipped.
>
> By design in Config-B there should be more advanced features, such as:
> - RTMR based measurement and measure boot.
> - Remove unnecessary drivers to reduce attack surface, such as
> network stack.
>
> To make the code review more efficiency, Config-B is split into 2 waves:
> - Basic feature of Config-B
> - Advanced feature of Config-B
> This patch-set is for *Basic feature of Config-B*.
>
> Code at: https://github.com/mxu9/edk2/tree/tdvf_wave3.v5
>
> Please be noted:
> This patch-set is based on tdvf_wave2.v8 which is at:
> https://github.com/mxu9/edk2/tree/tdvf_wave2.v8
>
> v5 changes:
> - Move PeilessStartupLib to OvmfPkg/Library.
> - Split the changes of IncompatiblePciDeviceSupportDxe to 2 patch.
> Please see Patch 7 & 8.
>
> v4 changes:
> - Rename TdxStartupLib to PeilessStartupLib.
> - Check HostBridgeDevId from PlatformInfoHob in DxeAcpiTimerLib.
> - Add 2 more patches (#8 #9) to ignore PCI OptionRom in Td guest.
>
> v3 changes:
> - Drop the PcdTdxWorkAreaBase introduced in v2. Instead PcdSevEsWorkArea
> is used to point to the TDX WorkArea. PcdSevEsWorkArea will be renamed
> to PcdCcWorkAreaBase in the future.
> - In v2 TdHob is processed in OvmfPkg/IntelTdx/Sec/IntelTdx.c. Since
> the codes have been moved to PlatformInitLib, IntelTdx.c is deleted.
> - Add comments in DxeAcpiTimerLib to explain why both
> PcdOvmfHostBridgePciDevId and EFI_HOB_PLATFORM_INFO are checked to
> read HostBridgeDevId.
>
> v2 changes:
> - In v1 PEI phase is skipped during boot process. But the code is still
> in the image. It is not a good way. So in v2 the code of PEI is
> removed as well.
> - In v1 PrePiLib in EmbeddedPkg are updated to meet the requirement of
> TDVF-Config-B. This is because PrePiLib in EmbeddedPkg is designed for
> the situation of PEI-less boot. So after PEI is removed, this change
> is not needed anymore.
> - In v1 only Tdx guest can be brought up. Now v2 brings up both Legacy
> guest and Tdx guest.
> - Platform initialization in TdxStartup is refactored with the
> PlatformInitLib.
> - OvmfPkg/IntelTdx/Sec is introduced. It is a simplied version of
> OvmfPkg/Sec.
>
> Cc: Michael D Kinney <michael.d.kinney at intel.com>
> Cc: Brijesh Singh <brijesh.singh at amd.com>
> Cc: Erdem Aktas <erdemaktas at google.com>
> Cc: James Bottomley <jejb at linux.ibm.com>
> Cc: Jiewen Yao <jiewen.yao at intel.com>
> Cc: Tom Lendacky <thomas.lendacky at amd.com>
> Cc: Gerd Hoffmann <kraxel at redhat.com>
> Cc: Leif Lindholm <leif at nuviainc.com>
> Cc: Ard Biesheuvel <ardb+tianocore at kernel.org>
> Cc: Abner Chang <abner.chang at hpe.com>
> Cc: Daniel Schaefer <daniel.schaefer at hpe.com>
> Cc: Ray Ni <ray.ni at intel.com>
> Signed-off-by: Min Xu <min.m.xu at intel.com>
>
> Min Xu (10):
> OvmfPkg: Add TdxWorkArea definition
> OvmfPkg: Add PrePiHobListPointerLibTdx
> OvmfPkg: Add PeilessStartupLib
> OvmfPkg/IntelTdx: Add Sec to bring up both Legacy and Tdx guest
> OvmfPkg: Update TdxDxe to set TDX PCDs
> OvmfPkg: Update DxeAcpiTimerLib to read HostBridgeDevId in
> PlatformInfoHob
> OvmfPkg/IncompatiblePciDeviceSupportDxe: Refine the configuration
> OvmfPkg/IncompatiblePciDeviceSupportDxe: Ignore OptionRom in Td guest
> MdeModulePkg: Update PciEnumeratorSupport to ignore OptionRom if
> needed
> OvmfPkg: Introduce IntelTdxX64 for TDVF Config-B
>
> .../Bus/Pci/PciBusDxe/PciEnumeratorSupport.c | 23 +-
> .../Bus/Pci/PciBusDxe/PciEnumeratorSupport.h | 4 +-
> OvmfPkg/Include/Library/PeilessStartupLib.h | 34 +
> OvmfPkg/Include/WorkArea.h | 15 +
> .../IncompatiblePciDeviceSupport.c | 108 +-
> OvmfPkg/IntelTdx/IntelTdxX64.dsc | 721 ++++++++++++++
> OvmfPkg/IntelTdx/IntelTdxX64.fdf | 401 ++++++++
> .../PrePiHobListPointer.c | 57 ++
> .../PrePiHobListPointerLibTdx.inf | 29 +
> OvmfPkg/IntelTdx/Sec/SecMain.c | 198 ++++
> OvmfPkg/IntelTdx/Sec/SecMain.inf | 61 ++
> OvmfPkg/IntelTdx/Sec/X64/SecEntry.nasm | 151 +++
> .../Library/AcpiTimerLib/DxeAcpiTimerLib.c | 25 +-
> .../Library/AcpiTimerLib/DxeAcpiTimerLib.inf | 7 +-
> OvmfPkg/Library/PeilessStartupLib/DxeLoad.c | 218 ++++
> OvmfPkg/Library/PeilessStartupLib/Hob.c | 135 +++
> .../PeilessStartupLib/PeilessStartup.c | 223 +++++
> .../PeilessStartupInternal.h | 55 ++
> .../PeilessStartupLib/PeilessStartupLib.inf | 86 ++
> .../PeilessStartupLib/X64/PageTables.h | 206 ++++
> .../PeilessStartupLib/X64/VirtualMemory.c | 935 ++++++++++++++++++
> OvmfPkg/OvmfPkg.dec | 4 +
> OvmfPkg/TdxDxe/TdxDxe.c | 66 +-
> OvmfPkg/TdxDxe/TdxDxe.inf | 4 +
> 24 files changed, 3724 insertions(+), 42 deletions(-)
> create mode 100644 OvmfPkg/Include/Library/PeilessStartupLib.h
> create mode 100644 OvmfPkg/IntelTdx/IntelTdxX64.dsc
> create mode 100644 OvmfPkg/IntelTdx/IntelTdxX64.fdf
> create mode 100644
> OvmfPkg/IntelTdx/PrePiHobListPointerLibTdx/PrePiHobListPointer.c
> create mode 100644
> OvmfPkg/IntelTdx/PrePiHobListPointerLibTdx/PrePiHobListPointerLibTdx.inf
> create mode 100644 OvmfPkg/IntelTdx/Sec/SecMain.c
> create mode 100644 OvmfPkg/IntelTdx/Sec/SecMain.inf
> create mode 100644 OvmfPkg/IntelTdx/Sec/X64/SecEntry.nasm
> create mode 100644 OvmfPkg/Library/PeilessStartupLib/DxeLoad.c
> create mode 100644 OvmfPkg/Library/PeilessStartupLib/Hob.c
> create mode 100644 OvmfPkg/Library/PeilessStartupLib/PeilessStartup.c
> create mode 100644
> OvmfPkg/Library/PeilessStartupLib/PeilessStartupInternal.h
> create mode 100644 OvmfPkg/Library/PeilessStartupLib/PeilessStartupLib.inf
> create mode 100644 OvmfPkg/Library/PeilessStartupLib/X64/PageTables.h
> create mode 100644 OvmfPkg/Library/PeilessStartupLib/X64/VirtualMemory.c
>
> --
> 2.29.2.windows.2
-=-=-=-=-=-=-=-=-=-=-=-
Groups.io Links: You receive all messages sent to this group.
View/Reply Online (#88374): https://edk2.groups.io/g/devel/message/88374
Mute This Topic: https://groups.io/mt/89743599/1813853
Group Owner: devel+owner at edk2.groups.io
Unsubscribe: https://edk2.groups.io/g/devel/unsub [edk2-devel-archive at redhat.com]
-=-=-=-=-=-=-=-=-=-=-=-
More information about the edk2-devel-archive
mailing list