Series: reviewed-by: Jiewen Yao <[email protected]> > -----Original Message----- > From: Xu, Min M <[email protected]> > Sent: Sunday, March 13, 2022 8:41 AM > To: [email protected] > Cc: Xu, Min M <[email protected]>; Kinney, Michael D > <[email protected]>; Brijesh Singh <[email protected]>; Aktas, > Erdem <[email protected]>; James Bottomley <[email protected]>; > Yao, Jiewen <[email protected]>; Tom Lendacky > <[email protected]>; Gerd Hoffmann <[email protected]>; Leif > Lindholm <[email protected]>; Ard Biesheuvel <[email protected]>; > Chang, Abner <[email protected]>; Schaefer, Daniel > <[email protected]>; Ni, Ray <[email protected]> > Subject: [PATCH V5 00/10] Introduce TDVF Config-B (basic) in OvmfPkg > > RFC: https://bugzilla.tianocore.org/show_bug.cgi?id=3429 > > Intel's Trust Domain Extensions (Intel TDX) refers to an Intel technology > that extends Virtual Machines Extensions (VMX) and Multi-Key Total Memory > Encryption (MKTME) with a new kind of virutal machines guest called a > Trust Domain (TD). A TD is desinged to run in a CPU mode that protects the > confidentiality of TD memory contents and the TD's CPU state from other > software, including the hosting Virtual-Machine Monitor (VMM), unless > explicitly shared by the TD itself. > > There are 2 configurations for TDVF to upstream. See below link for > the definitions of the 2 configurations. > https://edk2.groups.io/g/devel/message/76367 > > This patch-set is to enable the basic feature of Config-B in OvmfPkg. > - Add a standalone IntelTdxX64.dsc to a TDX specific directory for a > *full* feature TDVF. (Align with existing SEV) > - IntelTdxX64.dsc includes TDX/normal OVMF basic boot capability. The > final binary can run on TDX/normal OVMF. > - PEI phase is skipped. > > By design in Config-B there should be more advanced features, such as: > - RTMR based measurement and measure boot. > - Remove unnecessary drivers to reduce attack surface, such as > network stack. > > To make the code review more efficiency, Config-B is split into 2 waves: > - Basic feature of Config-B > - Advanced feature of Config-B > This patch-set is for *Basic feature of Config-B*. > > Code at: https://github.com/mxu9/edk2/tree/tdvf_wave3.v5 > > Please be noted: > This patch-set is based on tdvf_wave2.v8 which is at: > https://github.com/mxu9/edk2/tree/tdvf_wave2.v8 > > v5 changes: > - Move PeilessStartupLib to OvmfPkg/Library. > - Split the changes of IncompatiblePciDeviceSupportDxe to 2 patch. > Please see Patch 7 & 8. > > v4 changes: > - Rename TdxStartupLib to PeilessStartupLib. > - Check HostBridgeDevId from PlatformInfoHob in DxeAcpiTimerLib. > - Add 2 more patches (#8 #9) to ignore PCI OptionRom in Td guest. > > v3 changes: > - Drop the PcdTdxWorkAreaBase introduced in v2. Instead PcdSevEsWorkArea > is used to point to the TDX WorkArea. PcdSevEsWorkArea will be renamed > to PcdCcWorkAreaBase in the future. > - In v2 TdHob is processed in OvmfPkg/IntelTdx/Sec/IntelTdx.c. Since > the codes have been moved to PlatformInitLib, IntelTdx.c is deleted. > - Add comments in DxeAcpiTimerLib to explain why both > PcdOvmfHostBridgePciDevId and EFI_HOB_PLATFORM_INFO are checked to > read HostBridgeDevId. > > v2 changes: > - In v1 PEI phase is skipped during boot process. But the code is still > in the image. It is not a good way. So in v2 the code of PEI is > removed as well. > - In v1 PrePiLib in EmbeddedPkg are updated to meet the requirement of > TDVF-Config-B. This is because PrePiLib in EmbeddedPkg is designed for > the situation of PEI-less boot. So after PEI is removed, this change > is not needed anymore. > - In v1 only Tdx guest can be brought up. Now v2 brings up both Legacy > guest and Tdx guest. > - Platform initialization in TdxStartup is refactored with the > PlatformInitLib. > - OvmfPkg/IntelTdx/Sec is introduced. It is a simplied version of > OvmfPkg/Sec. > > Cc: Michael D Kinney <[email protected]> > Cc: Brijesh Singh <[email protected]> > Cc: Erdem Aktas <[email protected]> > Cc: James Bottomley <[email protected]> > Cc: Jiewen Yao <[email protected]> > Cc: Tom Lendacky <[email protected]> > Cc: Gerd Hoffmann <[email protected]> > Cc: Leif Lindholm <[email protected]> > Cc: Ard Biesheuvel <[email protected]> > Cc: Abner Chang <[email protected]> > Cc: Daniel Schaefer <[email protected]> > Cc: Ray Ni <[email protected]> > Signed-off-by: Min Xu <[email protected]> > > Min Xu (10): > OvmfPkg: Add TdxWorkArea definition > OvmfPkg: Add PrePiHobListPointerLibTdx > OvmfPkg: Add PeilessStartupLib > OvmfPkg/IntelTdx: Add Sec to bring up both Legacy and Tdx guest > OvmfPkg: Update TdxDxe to set TDX PCDs > OvmfPkg: Update DxeAcpiTimerLib to read HostBridgeDevId in > PlatformInfoHob > OvmfPkg/IncompatiblePciDeviceSupportDxe: Refine the configuration > OvmfPkg/IncompatiblePciDeviceSupportDxe: Ignore OptionRom in Td guest > MdeModulePkg: Update PciEnumeratorSupport to ignore OptionRom if > needed > OvmfPkg: Introduce IntelTdxX64 for TDVF Config-B > > .../Bus/Pci/PciBusDxe/PciEnumeratorSupport.c | 23 +- > .../Bus/Pci/PciBusDxe/PciEnumeratorSupport.h | 4 +- > OvmfPkg/Include/Library/PeilessStartupLib.h | 34 + > OvmfPkg/Include/WorkArea.h | 15 + > .../IncompatiblePciDeviceSupport.c | 108 +- > OvmfPkg/IntelTdx/IntelTdxX64.dsc | 721 ++++++++++++++ > OvmfPkg/IntelTdx/IntelTdxX64.fdf | 401 ++++++++ > .../PrePiHobListPointer.c | 57 ++ > .../PrePiHobListPointerLibTdx.inf | 29 + > OvmfPkg/IntelTdx/Sec/SecMain.c | 198 ++++ > OvmfPkg/IntelTdx/Sec/SecMain.inf | 61 ++ > OvmfPkg/IntelTdx/Sec/X64/SecEntry.nasm | 151 +++ > .../Library/AcpiTimerLib/DxeAcpiTimerLib.c | 25 +- > .../Library/AcpiTimerLib/DxeAcpiTimerLib.inf | 7 +- > OvmfPkg/Library/PeilessStartupLib/DxeLoad.c | 218 ++++ > OvmfPkg/Library/PeilessStartupLib/Hob.c | 135 +++ > .../PeilessStartupLib/PeilessStartup.c | 223 +++++ > .../PeilessStartupInternal.h | 55 ++ > .../PeilessStartupLib/PeilessStartupLib.inf | 86 ++ > .../PeilessStartupLib/X64/PageTables.h | 206 ++++ > .../PeilessStartupLib/X64/VirtualMemory.c | 935 ++++++++++++++++++ > OvmfPkg/OvmfPkg.dec | 4 + > OvmfPkg/TdxDxe/TdxDxe.c | 66 +- > OvmfPkg/TdxDxe/TdxDxe.inf | 4 + > 24 files changed, 3724 insertions(+), 42 deletions(-) > create mode 100644 OvmfPkg/Include/Library/PeilessStartupLib.h > create mode 100644 OvmfPkg/IntelTdx/IntelTdxX64.dsc > create mode 100644 OvmfPkg/IntelTdx/IntelTdxX64.fdf > create mode 100644 > OvmfPkg/IntelTdx/PrePiHobListPointerLibTdx/PrePiHobListPointer.c > create mode 100644 > OvmfPkg/IntelTdx/PrePiHobListPointerLibTdx/PrePiHobListPointerLibTdx.inf > create mode 100644 OvmfPkg/IntelTdx/Sec/SecMain.c > create mode 100644 OvmfPkg/IntelTdx/Sec/SecMain.inf > create mode 100644 OvmfPkg/IntelTdx/Sec/X64/SecEntry.nasm > create mode 100644 OvmfPkg/Library/PeilessStartupLib/DxeLoad.c > create mode 100644 OvmfPkg/Library/PeilessStartupLib/Hob.c > create mode 100644 OvmfPkg/Library/PeilessStartupLib/PeilessStartup.c > create mode 100644 > OvmfPkg/Library/PeilessStartupLib/PeilessStartupInternal.h > create mode 100644 OvmfPkg/Library/PeilessStartupLib/PeilessStartupLib.inf > create mode 100644 OvmfPkg/Library/PeilessStartupLib/X64/PageTables.h > create mode 100644 OvmfPkg/Library/PeilessStartupLib/X64/VirtualMemory.c > > -- > 2.29.2.windows.2
-=-=-=-=-=-=-=-=-=-=-=- Groups.io Links: You receive all messages sent to this group. View/Reply Online (#88374): https://edk2.groups.io/g/devel/message/88374 Mute This Topic: https://groups.io/mt/89743599/21656 Group Owner: [email protected] Unsubscribe: https://edk2.groups.io/g/devel/unsub [[email protected]] -=-=-=-=-=-=-=-=-=-=-=-
