Merged https://github.com/tianocore/edk2/pull/2142
f079e9b450b3896bb00eb7a9fed3a6ec7ed3cd04.. 8b76f235340922a6d293bff05978ba57d3b498e1 > -----Original Message----- > From: Xu, Min M <min.m...@intel.com> > Sent: Thursday, October 21, 2021 8:18 AM > To: devel@edk2.groups.io > Cc: Xu, Min M <min.m...@intel.com>; Ard Biesheuvel > <ardb+tianoc...@kernel.org>; Gerd Hoffmann <kra...@redhat.com>; Justen, > Jordan L <jordan.l.jus...@intel.com>; Brijesh Singh <brijesh.si...@amd.com>; > Erdem Aktas <erdemak...@google.com>; James Bottomley > <j...@linux.ibm.com>; Yao, Jiewen <jiewen....@intel.com>; Tom Lendacky > <thomas.lenda...@amd.com> > Subject: [PATCH V10 0/4] Add Intel TDX support in OvmfPkg/ResetVector > > REF: https://bugzilla.tianocore.org/show_bug.cgi?id=3429 > > Intel's Trust Domain Extensions (Intel TDX) refers to an Intel technology > that extends Virtual Machines Extensions (VMX) and Multi-Key Total Memory > Encryption (MKTME) with a new kind of virutal machines guest called a > Trust Domain (TD). A TD is desinged to run in a CPU mode that protects the > confidentiality of TD memory contents and the TD's CPU state from other > software, including the hosting Virtual-Machine Monitor (VMM), unless > explicitly shared by the TD itself. > > The patch-sets to support Intel TDX in OvmfPkg is split into several > waves. This is wave-1 which adds Intel TDX support in OvmfPkg/ResetVector. > Note: TDX only works in X64. > > Patch #1: Ovmf uses its own Main.asm to reduce the complexity of Main.asm > in UefiCpuPkg. This Main.asm is an unmodified copy from > UefiCpuPkg/ReseteVector/Vtf0 (so no functional change) and the actual > changes for tdx come as incremental patches. > > Patch #2: WORK_AREA_GUEST_TYPE is cleared in Main.asm instead of in > WORK_AREA_GUEST_TYPE. > > Patch #3: Introduce IntelTdxMetadata.asm which describes the information > about the image for VMM use. > > Patch #4: Enable TDX in OvmfPkg/ResetVector for ARCH_X64. > > [TDX]: https://software.intel.com/content/dam/develop/external/us/en/ > documents/tdx-whitepaper-final9-17.pdf > > [TDVF]: https://software.intel.com/content/dam/develop/external/us/en/ > documents/tdx-virtual-firmware-design-guide-rev-1.pdf > > Code is at https://github.com/mxu9/edk2/tree/tdvf_wave1.v10 > > v10 changes: > - Clear the OVMF_WORK_AREA in both ARCH_IA32 and ARCH_X64. > - Update the ReloadFlat32 based on the review comments. > - Other minor changes and update some comments. > > v9 changes: > - Introduce IntelTdxMetadata.asm in a separate commit. > - Use absolute offset for the start of TdxMetadata so that VMM can > easily reach to the start of the metadata. > > v8 changes: > - Create a separate commit for Main.asm. > - Create a separate commit for the clearance of WORK_AREA_GUEST_TYPE. > - Fix some inaccurate comments. > > v7 changes: > - Refine the offset of TdxMetadata and remove the definition of > PcdOvmfImageSizeInKB > - Use MOV CR* instead of smsw in ResetVector > - Remove the new field (SubType) in > CONFIDENTIAL_COMPUTING_WORK_AREA_HEADER. > > v6 changes: > - Remove the 5-level paging support. 5-level paging enabling is *NOT* > super critical for TDX enabling at this moment. It will be enabled > later in a separate patch. > - Add a new field (SubType) in > CONFIDENTIAL_COMPUTING_WORK_AREA_HEADER > to record the VM Guest SubType. > - In Main16 entry point, after TransitionFromReal16To32BitFlat, > WORK_AREA_GUEST_TYPE is cleared to 0. WORK_AREA_GUEST_TYPE was > previously cleared in SetCr3ForPageTables64 (see commit ab77b60). > This doesn't work after TDX is introduced in Ovmf. It is because all > TDX CPUs (BSP and APs) start to run from 0xfffffff0. In previous code > WORK_AREA_GUEST_TYPE will be cleared multi-times in TDX guest. So for > SEV and Legacy guest it is moved to Main16 entry point (after > TransitionFromReal16To32BitFlat). For TDX guest WORK_AREA_GUEST_TYPE > is cleared and set in InitTdxWorkarea. > - Make the return result of IsTdx be consistent with IsTdxEnabled. > - Fix some typo in the code comments. > > v5 changes: > - Remove the changes of OVMF_WORK_AREA because Commit ab77b60 covers > those changes. > - Refine the TDX related changes in PageTables64.asm and > Flat32ToFlat64.asm. > - Add CheckTdxFeaturesBeforeBuildPagetables to check Non-Tdx, Tdx-BSP or > Tdx-APs. This routine is called before building page tables. > > v4 changes: > - Refine the PageTables64.asm and Flat32ToFlat64.asm to enable TDX. > - Refine SEV_ES_WORK_AREA so that SEV/TDX/Legach guest all can use this > memory region. https://edk2.groups.io/g/devel/message/78345 is the > discussion. > - AmdSev.asm is removed because Brijesh Singh has done it in > https://edk2.groups.io/g/devel/message/78241. > > v3 changes: > - Refine PageTables64.asm and Flat32ToFlat64.asm based on the review > comments in [ReviewComment-1] and [ReviewComment-2]. > - SEV codes are in AmdSev.asm > - TDX codes are in IntelTdx.asm > - Main.asm is created in OvmfPkg/ResetVector. The one in > UefiCpuPkg/ResetVector/Vtf0 is not used. > - Init32.asm/ReloadFlat32.asm in UefiCpuPkg/ResetVector/Vtf0/Ia32 are > deleted. They're moved to OvmfPkg/ResetVector/Ia32. > - InitTdx.asm is renamed to InteTdx.asm > > v2 changes: > - Move InitTdx.asm and ReloadFlat32.asm from UefiCpuPkg/ResetVector/Vtf0 > to OvmfPkg/ResetVector. Init32.asm is created which is a null stub of > 32-bit initialization. In Main32 just simply call Init32. It makes > the Main.asm in UefiCpuPkg/ResetVector clean and clear. > - Init32.asm/InitTdx.asm/ReloadFlat32.asm are created under > OvmfPkg/ResetVector/Ia32. > - Update some descriptions of the patch-sets. > - Update the REF link in cover letter. > - Add Ard Biesheuvel in Cc list. > > v1: https://edk2.groups.io/g/devel/message/77675 > > Cc: Ard Biesheuvel <ardb+tianoc...@kernel.org> > Cc: Gerd Hoffmann <kra...@redhat.com> > Cc: Jordan Justen <jordan.l.jus...@intel.com> > Cc: Brijesh Singh <brijesh.si...@amd.com> > Cc: Erdem Aktas <erdemak...@google.com> > Cc: James Bottomley <j...@linux.ibm.com> > Cc: Jiewen Yao <jiewen....@intel.com> > Cc: Tom Lendacky <thomas.lenda...@amd.com> > Signed-off-by: Min Xu <min.m...@intel.com> > > Min Xu (4): > OvmfPkg: Copy Main.asm from UefiCpuPkg to OvmfPkg's ResetVector > OvmfPkg: Clear WORK_AREA_GUEST_TYPE in Main.asm > OvmfPkg: Add IntelTdxMetadata.asm > OvmfPkg: Enable TDX in ResetVector > > OvmfPkg/OvmfPkg.dec | 9 + > OvmfPkg/OvmfPkgDefines.fdf.inc | 9 + > OvmfPkg/ResetVector/Ia16/ResetVectorVtf0.asm | 39 ++++ > OvmfPkg/ResetVector/Ia32/Flat32ToFlat64.asm | 11 + > OvmfPkg/ResetVector/Ia32/IntelTdx.asm | 222 +++++++++++++++++++ > OvmfPkg/ResetVector/Ia32/PageTables64.asm | 22 +- > OvmfPkg/ResetVector/Main.asm | 121 ++++++++++ > OvmfPkg/ResetVector/ResetVector.inf | 9 + > OvmfPkg/ResetVector/ResetVector.nasmb | 28 +++ > OvmfPkg/ResetVector/X64/IntelTdxMetadata.asm | 115 ++++++++++ > 10 files changed, 581 insertions(+), 4 deletions(-) > create mode 100644 OvmfPkg/ResetVector/Ia32/IntelTdx.asm > create mode 100644 OvmfPkg/ResetVector/Main.asm > create mode 100644 OvmfPkg/ResetVector/X64/IntelTdxMetadata.asm > > -- > 2.29.2.windows.2 -=-=-=-=-=-=-=-=-=-=-=- Groups.io Links: You receive all messages sent to this group. View/Reply Online (#82605): https://edk2.groups.io/g/devel/message/82605 Mute This Topic: https://groups.io/mt/86479662/21656 Group Owner: devel+ow...@edk2.groups.io Unsubscribe: https://edk2.groups.io/g/devel/unsub [arch...@mail-archive.com] -=-=-=-=-=-=-=-=-=-=-=-