RFC: https://bugzilla.tianocore.org/show_bug.cgi?id=3853
Intel's Trust Domain Extensions (Intel TDX) refers to an Intel technology that extends Virtual Machines Extensions (VMX) and Multi-Key Total Memory Encryption (MKTME) with a new kind of virutal machines guest called a Trust Domain (TD). A TD is desinged to run in a CPU mode that protects the confidentiality of TD memory contents and the TD's CPU state from other software, including the hosting Virtual-Machine Monitor (VMM), unless explicitly shared by the TD itself. There are 2 configurations for TDVF to upstream. See below link for the definitions of the 2 configurations. https://edk2.groups.io/g/devel/message/76367 This patch-set is to enable below features of Config-B in OvmfPkg. - Enable RTMR based measurement and measured boot - Install CC_MEASUREMENT_PROTOCOL instance in Td guest The measurement for the other components, such as kernel image, initrd, will be in the following patch-sets. Patch 1: HashLibBaseCryptoRouterTdx provides SHA384 service and extend to RTMR registers. Patch 2: SecCryptLib is the cryptographic library instance for SEC. Patch 3 - 7: These 5 patches are related to RTMR based measurement and CC Eventlog ACPI table. Patch 8: Update IntelTdxX64.dsc/IntelTdxX64.fdf to support RTMR based measurement and measured boot. Code at: https://github.com/mxu9/edk2/tree/tdvf_wave4.v1 Cc: Jiewen Yao <jiewen....@intel.com> Cc: Jian J Wang <jian.j.w...@intel.com> Cc: Gerd Hoffmann <kra...@redhat.com> Cc: Xiaoyu Lu <xiaoyu1...@intel.com> Cc: Guomin Jiang <guomin.ji...@intel.com> Cc: Michael D Kinney <michael.d.kin...@intel.com> Cc: Liming Gao <gaolim...@byosoft.com.cn> Cc: Zhiguang Liu <zhiguang....@intel.com> Cc: Sami Mujawar <sami.muja...@arm.com> Cc: Ken Lu <ken...@intel.com> Cc: Ard Biesheuvel <ardb+tianoc...@kernel.org> Cc: Jordan Justen <jordan.l.jus...@intel.com> Cc: Brijesh Singh <brijesh.si...@amd.com> Cc: Erdem Aktas <erdemak...@google.com> Cc: James Bottomley <j...@linux.ibm.com> Cc: Tom Lendacky <thomas.lenda...@amd.com> Signed-off-by: Min Xu <min.m...@intel.com> Min Xu (8): Security: Add HashLibBaseCryptoRouterTdx CryptoPkg: Add SecCryptLib MdePkg: Add definition of EFI_CC_EVENT_HOB_GUID OvmfPkg/IntelTdx: Measure Td HobList and Configuration FV MdePkg: Define CC Measure EventLog ACPI Table OvmfPkg: Add PCDs for LAML/LASA field in CC EVENTLOG ACPI table OvmfPkg/IntelTdx: Add TdTcg2Dxe OvmfPkg/IntelTdx: Enable RTMR based measurement and measure boot CryptoPkg/CryptoPkg.dsc | 4 + .../Library/BaseCryptLib/SecCryptLib.inf | 67 + MdePkg/Include/Protocol/CcMeasurement.h | 28 + MdePkg/MdePkg.dec | 1 + OvmfPkg/IntelTdx/IntelTdxX64.dsc | 15 +- OvmfPkg/IntelTdx/IntelTdxX64.fdf | 5 + OvmfPkg/IntelTdx/PeilessStartupLib/IntelTdx.c | 497 ++++ .../PeilessStartupLib/PeilessStartup.c | 30 + .../PeilessStartupInternal.h | 57 + .../PeilessStartupLib/PeilessStartupLib.inf | 7 +- .../IntelTdx/TdTcg2Dxe/MeasureBootPeCoff.c | 407 +++ OvmfPkg/IntelTdx/TdTcg2Dxe/TdTcg2Dxe.c | 2487 +++++++++++++++++ OvmfPkg/IntelTdx/TdTcg2Dxe/TdTcg2Dxe.inf | 101 + OvmfPkg/OvmfPkg.dec | 6 + .../HashLibBaseCryptoRouterTdx.c | 214 ++ .../HashLibBaseCryptoRouterTdx.inf | 41 + SecurityPkg/SecurityPkg.dsc | 10 + 17 files changed, 3974 insertions(+), 3 deletions(-) create mode 100644 CryptoPkg/Library/BaseCryptLib/SecCryptLib.inf create mode 100644 OvmfPkg/IntelTdx/PeilessStartupLib/IntelTdx.c create mode 100644 OvmfPkg/IntelTdx/TdTcg2Dxe/MeasureBootPeCoff.c create mode 100644 OvmfPkg/IntelTdx/TdTcg2Dxe/TdTcg2Dxe.c create mode 100644 OvmfPkg/IntelTdx/TdTcg2Dxe/TdTcg2Dxe.inf create mode 100644 SecurityPkg/Library/HashLibBaseCryptoRouter/HashLibBaseCryptoRouterTdx.c create mode 100644 SecurityPkg/Library/HashLibBaseCryptoRouter/HashLibBaseCryptoRouterTdx.inf -- 2.29.2.windows.2 -=-=-=-=-=-=-=-=-=-=-=- Groups.io Links: You receive all messages sent to this group. View/Reply Online (#87168): https://edk2.groups.io/g/devel/message/87168 Mute This Topic: https://groups.io/mt/89491510/21656 Group Owner: devel+ow...@edk2.groups.io Unsubscribe: https://edk2.groups.io/g/devel/unsub [arch...@mail-archive.com] -=-=-=-=-=-=-=-=-=-=-=-