Branch: refs/heads/master
Home: https://github.com/tianocore/edk2
Commit: 580a6b616b92282189d421ef5f7046d755961e86
https://github.com/tianocore/edk2/commit/580a6b616b92282189d421ef5f7046d755961e86
Author: Min Xu <[email protected]>
Date: 2022-04-02 (Sat, 02 Apr 2022)
Changed paths:
M OvmfPkg/Include/WorkArea.h
Log Message:
-----------
OvmfPkg: Add TdxWorkArea definition
RFC: https://bugzilla.tianocore.org/show_bug.cgi?id=3429
Add the TDX work area definition.
Cc: Michael D Kinney <[email protected]>
Cc: Brijesh Singh <[email protected]>
Cc: Erdem Aktas <[email protected]>
Cc: James Bottomley <[email protected]>
Cc: Jiewen Yao <[email protected]>
Cc: Tom Lendacky <[email protected]>
Cc: Gerd Hoffmann <[email protected]>
Acked-by: Gerd Hoffmann <[email protected]>
Reviewed-by: Jiewen Yao <[email protected]>
Signed-off-by: Min Xu <[email protected]>
Commit: 75942a52aeff8192b2dd74f69b51391b3db29a95
https://github.com/tianocore/edk2/commit/75942a52aeff8192b2dd74f69b51391b3db29a95
Author: Min Xu <[email protected]>
Date: 2022-04-02 (Sat, 02 Apr 2022)
Changed paths:
A OvmfPkg/IntelTdx/PrePiHobListPointerLibTdx/PrePiHobListPointer.c
A OvmfPkg/IntelTdx/PrePiHobListPointerLibTdx/PrePiHobListPointerLibTdx.inf
Log Message:
-----------
OvmfPkg: Add PrePiHobListPointerLibTdx
RFC: https://bugzilla.tianocore.org/show_bug.cgi?id=3429
This library sets / gets the Hob list pointer in TDX_WORK_AREA.
This is because it is designed to be used in SEC where the value of
global variable cannot be saved, so the Hob list pointer is saved
in TDX_WORK_AREA.
TDX_WORK_AREA shares the same base address as SEV_WORK_AREA which is
pointed by PcdSevEsWorkAreaBase. This PCD will be renamed to
PcdCcWorkAreaBase as Gerd suggested.
See https://edk2.groups.io/g/devel/message/86642
Cc: Michael D Kinney <[email protected]>
Cc: Brijesh Singh <[email protected]>
Cc: Erdem Aktas <[email protected]>
Cc: James Bottomley <[email protected]>
Cc: Jiewen Yao <[email protected]>
Cc: Tom Lendacky <[email protected]>
Cc: Gerd Hoffmann <[email protected]>
Acked-by: Gerd Hoffmann <[email protected]>
Reviewed-by: Jiewen Yao <[email protected]>
Signed-off-by: Min Xu <[email protected]>
Commit: 4fe26784112328fb9dff6fe85f973845d5d7d49e
https://github.com/tianocore/edk2/commit/4fe26784112328fb9dff6fe85f973845d5d7d49e
Author: Min Xu <[email protected]>
Date: 2022-04-02 (Sat, 02 Apr 2022)
Changed paths:
A OvmfPkg/Include/Library/PeilessStartupLib.h
A OvmfPkg/Library/PeilessStartupLib/DxeLoad.c
A OvmfPkg/Library/PeilessStartupLib/Hob.c
A OvmfPkg/Library/PeilessStartupLib/PeilessStartup.c
A OvmfPkg/Library/PeilessStartupLib/PeilessStartupInternal.h
A OvmfPkg/Library/PeilessStartupLib/PeilessStartupLib.inf
A OvmfPkg/Library/PeilessStartupLib/X64/PageTables.h
A OvmfPkg/Library/PeilessStartupLib/X64/VirtualMemory.c
M OvmfPkg/OvmfPkg.dec
Log Message:
-----------
OvmfPkg: Add PeilessStartupLib
RFC: https://bugzilla.tianocore.org/show_bug.cgi?id=3429
PeilessStarupLib provides a function (PeilessStartup) which brings
up both Legacy and Tdx guest from SEC phase to DXE phase. PEI phase
is skipped so that the attack surfaces are reduced as much as possible.
PeilessStartup() does below tasks:
1. Contruct the FW hoblist.
Since PEI is skipped, we must find a memory region which is the
largest one below 4GB. Then this memory region will be used as the
firmware hoblist.
2. Initialize the platform.
3. Build various Hobs, such as SecFv Hob, DxeFv Hob, Stack Hob, etc.
4. At last DXE Core is located / loaded and transfer control to it.
Cc: Michael D Kinney <[email protected]>
Cc: Brijesh Singh <[email protected]>
Cc: Erdem Aktas <[email protected]>
Cc: James Bottomley <[email protected]>
Cc: Jiewen Yao <[email protected]>
Cc: Tom Lendacky <[email protected]>
Cc: Gerd Hoffmann <[email protected]>
Acked-by: Gerd Hoffmann <[email protected]>
Reviewed-by: Jiewen Yao <[email protected]>
Signed-off-by: Min Xu <[email protected]>
Commit: 1f29de4d2079876d66582886a6cd7335c98d527e
https://github.com/tianocore/edk2/commit/1f29de4d2079876d66582886a6cd7335c98d527e
Author: Min Xu <[email protected]>
Date: 2022-04-02 (Sat, 02 Apr 2022)
Changed paths:
A OvmfPkg/IntelTdx/Sec/SecMain.c
A OvmfPkg/IntelTdx/Sec/SecMain.inf
A OvmfPkg/IntelTdx/Sec/X64/SecEntry.nasm
Log Message:
-----------
OvmfPkg/IntelTdx: Add Sec to bring up both Legacy and Tdx guest
RFC: https://bugzilla.tianocore.org/show_bug.cgi?id=3429
OvmfPkg/IntelTdx/Sec is a simplied version of OvmfPkg/Sec. There
are below differences between these 2 Sec
- IntelTdx/Sec only supports Legacy guest and Tdx guest in X64.
- IntelTdx/Sec calls PeilessStartup () to jump from SEC to DXE directly.
- IntelTdx/Sec uses MemoryAllocationLib / HobLib / PrePiLib in
EmbeddedPkg.
Cc: Michael D Kinney <[email protected]>
Cc: Brijesh Singh <[email protected]>
Cc: Erdem Aktas <[email protected]>
Cc: James Bottomley <[email protected]>
Cc: Jiewen Yao <[email protected]>
Cc: Tom Lendacky <[email protected]>
Cc: Gerd Hoffmann <[email protected]>
Acked-by: Gerd Hoffmann <[email protected]>
Reviewed-by: Jiewen Yao <[email protected]>
Signed-off-by: Min Xu <[email protected]>
Commit: 55fda68a80088e709e6393b0a03c68ab59e27390
https://github.com/tianocore/edk2/commit/55fda68a80088e709e6393b0a03c68ab59e27390
Author: Min Xu <[email protected]>
Date: 2022-04-02 (Sat, 02 Apr 2022)
Changed paths:
M OvmfPkg/TdxDxe/TdxDxe.c
M OvmfPkg/TdxDxe/TdxDxe.inf
Log Message:
-----------
OvmfPkg: Update TdxDxe to set TDX PCDs
RFC: https://bugzilla.tianocore.org/show_bug.cgi?id=3429
TDX_PEI_LESS_BOOT indicates the boot without PEI phase. In this case
settings in EFI_HOB_PLATFORM_INFO should be set to its according PCDs.
TdxDxe driver is workable for both Legacy guest and Tdx guest. It is
because for Legacy guest (in PEI-less boot) there should be a place
to set the PCDs based on EFI_HOB_PLATFORM_INFO hob. TdxDxe driver is
the right place to do this work.
Cc: Michael D Kinney <[email protected]>
Cc: Brijesh Singh <[email protected]>
Cc: Erdem Aktas <[email protected]>
Cc: James Bottomley <[email protected]>
Cc: Jiewen Yao <[email protected]>
Cc: Tom Lendacky <[email protected]>
Cc: Gerd Hoffmann <[email protected]>
Acked-by: Gerd Hoffmann <[email protected]>
Reviewed-by: Jiewen Yao <[email protected]>
Signed-off-by: Min Xu <[email protected]>
Commit: f674fa9cde3d2d6919bb3e35b94d95c098b6696a
https://github.com/tianocore/edk2/commit/f674fa9cde3d2d6919bb3e35b94d95c098b6696a
Author: Min Xu <[email protected]>
Date: 2022-04-02 (Sat, 02 Apr 2022)
Changed paths:
M OvmfPkg/Library/AcpiTimerLib/DxeAcpiTimerLib.c
M OvmfPkg/Library/AcpiTimerLib/DxeAcpiTimerLib.inf
Log Message:
-----------
OvmfPkg: Update DxeAcpiTimerLib to read HostBridgeDevId in PlatformInfoHob
RFC: https://bugzilla.tianocore.org/show_bug.cgi?id=3429
The entrypoint of DxeAcpiTimerLib checks HostBridgeDevId by reading
PcdOvmfHostBridgePciDevId. If the DevId is not set, ASSERT is
triggered. Normally this DevId is set in PlatformPei which is executed
in PEI phase.
This patch-set is introducing PEI-less boot which means PEI phase is
skipped. So there is no chance to set this DevId. Instead HostBridgeDevId
is set in PlatformInfoHob. So we can check if PlatformInfoHob exists and
if HostBridgeDevId is set in this Hob.
Cc: Michael D Kinney <[email protected]>
Cc: Brijesh Singh <[email protected]>
Cc: Erdem Aktas <[email protected]>
Cc: James Bottomley <[email protected]>
Cc: Jiewen Yao <[email protected]>
Cc: Tom Lendacky <[email protected]>
Cc: Gerd Hoffmann <[email protected]>
Acked-by: Gerd Hoffmann <[email protected]>
Reviewed-by: Jiewen Yao <[email protected]>
Signed-off-by: Min Xu <[email protected]>
Commit: 149ed8e421602266a3079188d8b58bbbab6095da
https://github.com/tianocore/edk2/commit/149ed8e421602266a3079188d8b58bbbab6095da
Author: Min Xu <[email protected]>
Date: 2022-04-02 (Sat, 02 Apr 2022)
Changed paths:
M OvmfPkg/IncompatiblePciDeviceSupportDxe/IncompatiblePciDeviceSupport.c
Log Message:
-----------
OvmfPkg/IncompatiblePciDeviceSupportDxe: Refine the configuration
RFC: https://bugzilla.tianocore.org/show_bug.cgi?id=3429
MMIO64_PREFERENCE is a fixed length data structure which contains one
AddressSpaceDesc and one EndDesc. This patch removes MMIO64_PREFERENCE
and create AddressSpaceDesc and EndDesc respectively. This change
gives the chance to add more AddressSpaceDesc when CheckDevice is
called.
Cc: Michael D Kinney <[email protected]>
Cc: Brijesh Singh <[email protected]>
Cc: Erdem Aktas <[email protected]>
Cc: James Bottomley <[email protected]>
Cc: Jiewen Yao <[email protected]>
Cc: Tom Lendacky <[email protected]>
Cc: Gerd Hoffmann <[email protected]>
Acked-by: Gerd Hoffmann <[email protected]>
Reviewed-by: Jiewen Yao <[email protected]>
Signed-off-by: Min Xu <[email protected]>
Commit: c477b2783f6d95b62266f4fff9b0c286ac1d7bb8
https://github.com/tianocore/edk2/commit/c477b2783f6d95b62266f4fff9b0c286ac1d7bb8
Author: Min Xu <[email protected]>
Date: 2022-04-02 (Sat, 02 Apr 2022)
Changed paths:
M OvmfPkg/IncompatiblePciDeviceSupportDxe/IncompatiblePciDeviceSupport.c
Log Message:
-----------
OvmfPkg/IncompatiblePciDeviceSupportDxe: Ignore OptionRom in Td guest
RFC: https://bugzilla.tianocore.org/show_bug.cgi?id=3429
Host VMM may inject OptionRom which is untrusted in Td guest. So PCI
OptionRom needs to be ignored if it is Td guest. According to
"Table 20. ACPI 2.0 & 3.0 QWORD Address Space Descriptor Usage"
PI spec 1.7, type-specific flags can be set to 0 when Address
Translation Offset == 6 to skip device option ROM.
Cc: Michael D Kinney <[email protected]>
Cc: Brijesh Singh <[email protected]>
Cc: Erdem Aktas <[email protected]>
Cc: James Bottomley <[email protected]>
Cc: Jiewen Yao <[email protected]>
Cc: Tom Lendacky <[email protected]>
Cc: Gerd Hoffmann <[email protected]>
Acked-by: Gerd Hoffmann <[email protected]>
Reviewed-by: Jiewen Yao <[email protected]>
Signed-off-by: Min Xu <[email protected]>
Commit: cb8349f01ae05cce46213fc98308ee524adf257b
https://github.com/tianocore/edk2/commit/cb8349f01ae05cce46213fc98308ee524adf257b
Author: Min Xu <[email protected]>
Date: 2022-04-02 (Sat, 02 Apr 2022)
Changed paths:
M MdeModulePkg/Bus/Pci/PciBusDxe/PciEnumeratorSupport.c
M MdeModulePkg/Bus/Pci/PciBusDxe/PciEnumeratorSupport.h
Log Message:
-----------
MdeModulePkg: Update PciEnumeratorSupport to ignore OptionRom if needed
RFC: https://bugzilla.tianocore.org/show_bug.cgi?id=3429
Function of UpdatePciInfo() in PciEnumeratorSupport.c is used to update
the bar information for those incompatible PCI device. It is the right
place to check if the OptionRom need to be ignored.
According to "Table 20. ACPI 2.0 & 3.0 QWORD Address Space Descriptor
Usage" in PI Spec 1.7, Type-specific flags can be set to 0 when Address
Translation Offset == 6 to skip device option ROM (do not probe option
rom BAR).
Cc: Jian J Wang <[email protected]>
Cc: Liming Gao <[email protected]>
Cc: Hao A Wu <[email protected]>
Cc: Ray Ni <[email protected]>
Cc: Brijesh Singh <[email protected]>
Cc: Erdem Aktas <[email protected]>
Cc: James Bottomley <[email protected]>
Cc: Jiewen Yao <[email protected]>
Cc: Tom Lendacky <[email protected]>
Cc: Gerd Hoffmann <[email protected]>
Acked-by: Gerd Hoffmann <[email protected]>
Reviewed-by: Ray Ni <[email protected]>
Reviewed-by: Jiewen Yao <[email protected]>
Signed-off-by: Min Xu <[email protected]>
Commit: 44a53a3bdd9c76e37f1750b5aa6a745de5d77391
https://github.com/tianocore/edk2/commit/44a53a3bdd9c76e37f1750b5aa6a745de5d77391
Author: Min Xu <[email protected]>
Date: 2022-04-02 (Sat, 02 Apr 2022)
Changed paths:
A OvmfPkg/IntelTdx/IntelTdxX64.dsc
A OvmfPkg/IntelTdx/IntelTdxX64.fdf
Log Message:
-----------
OvmfPkg: Introduce IntelTdxX64 for TDVF Config-B
RFC: https://bugzilla.tianocore.org/show_bug.cgi?id=3429
Intel's Trust Domain Extensions (Intel TDX) refers to an Intel technology
that extends Virtual Machines Extensions (VMX) and Multi-Key Total Memory
Encryption (MKTME) with a new kind of virutal machines guest called a
Trust Domain (TD). A TD is desinged to run in a CPU mode that protects the
confidentiality of TD memory contents and the TD's CPU state from other
software, including the hosting Virtual-Machine Monitor (VMM), unless
explicitly shared by the TD itself.
There are 2 configurations for TDVF to upstream. See below link for
the definitions of the 2 configurations.
https://edk2.groups.io/g/devel/message/76367
This patch-set is to enable the basic feature of Config-B in OvmfPkg.
- Add a standalone IntelTdxX64.dsc to a TDX specific directory for a
*full* feature TDVF. (Align with existing SEV)
- IntelTdx.dsc includes Tdx/Legacy OVMF basic boot capability. The
final binary can run on Tdx/Legacy OVMF.
- PEI phase is skipped.
By design in Config-B there should be more advanced features, such as:
- RTMR based measurement and measure boot.
- Remove unnecessary drivers to reduce attack surface, such as
network stack.
To make the code review more efficiency, Config-B is split into 2 waves:
- Basic feature of Config-B
- Advanced feature of Config-B
This patch contains 2 files (IntelTdxX64.dsc/IntelTdxX64.fdf) which
enable the basic feature of Config-B. In the waves of Advanced feature
of Config-B, we will re-visit these 2 files.
TDX_PEI_LESS_BOOT is defined in IntelTdxX64.dsc to indicate it boots up
without PEI phase.
Cc: Michael D Kinney <[email protected]>
Cc: Brijesh Singh <[email protected]>
Cc: Erdem Aktas <[email protected]>
Cc: James Bottomley <[email protected]>
Cc: Jiewen Yao <[email protected]>
Cc: Tom Lendacky <[email protected]>
Cc: Gerd Hoffmann <[email protected]>
Acked-by: Gerd Hoffmann <[email protected]>
Reviewed-by: Jiewen Yao <[email protected]>
Signed-off-by: Min Xu <[email protected]>
Compare: https://github.com/tianocore/edk2/compare/c37cbc030d96...44a53a3bdd9c
_______________________________________________
edk2-commits mailing list
[email protected]
https://lists.sourceforge.net/lists/listinfo/edk2-commits
