tyler.durden
/
audk
mirror of https://github.com/acidanthera/audk.git
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

OvmfPkg/IntelTdx: Update TDVF README 

BZ: https://bugzilla.tianocore.org/show_bug.cgi?id=4756

There are below updates in this patch:
1. Rename README to README.md so that it can be show as markdown
   document.
2. Update some information about TDVF.
2. Fix some typo.

Cc: Jiewen Yao <jiewen.yao@intel.com>
Cc: Gerd Hoffmann <kraxel@redhat.com>
Signed-off-by: Min Xu <min.m.xu@intel.com>
Acked-by: Gerd Hoffmann <kraxel@redhat.com>
Reviewed-by: Jiewen Yao <jiewen.yao@intel.com>
This commit is contained in:
Min M Xu 2024-04-19 08:11:27 +08:00 committed by mergify[bot]
parent 6780b3aba0
commit be92e09206
1 changed files with 38 additions and 26 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

64
OvmfPkg/IntelTdx/README → OvmfPkg/IntelTdx/README.md
View File

@ -1,13 +1,13 @@
TDVF Overview
-------------
<b>Intel Trust Domain Extension (TDX)</b> is Intel Architecture extension
**Intel Trust Domain Extension (TDX)** is Intel Architecture extension
to provide trusted, isolated VM execution by removing CSP software
(hypervisor etc) from the TCB. <b>TDX Virtual Firmware (TDVF)</b> is an
(hypervisor etc) from the TCB. **TDX Virtual Firmware (TDVF)** is an
EDK II based project to enable UEFI support for TDX based Virtual
Machines. It provides the capability to launch a TD.
The <b>Intel? TDX Virtual Firmware Design Guide</b> is at
The **Intel TDX Virtual Firmware Design Guide** is at
https://www.intel.com/content/dam/develop/external/us/en/documents/tdx-virtual-firmware-design-guide-rev-1.01.pdf.
More information can be found at:
@ -19,49 +19,61 @@ Configurations and Features
There are 2 configurations for TDVF.
<b>Config-A:</b>
- Merge the *basic* TDVF feature to existing OvmfX64Pkg.dsc. (Align
**Config-A:**
- Merge the *basic* TDVF feature to existing **OvmfPkgX64.dsc**. (Align
with existing SEV)
- Threat model: VMM is NOT out of TCB. (We don?t make things worse)
- The OvmfX64Pkg.dsc includes SEV/TDX/normal OVMF basic boot capability.
- Threat model: VMM is **NOT** out of TCB. (We don't make things worse)
- The OvmfPkgX64.dsc includes SEV/TDX/normal OVMF basic boot capability.
The final binary can run on SEV/TDX/normal OVMF.
- No changes to existing OvmfPkgX64 image layout.
- No need to remove features if they exist today.
- PEI phase is NOT skipped in either Td or Non-Td.
- RTMR based measurement is supported.
- PEI phase is **NOT** skipped in either TD or Non-TD.
- RTMR based measurement (CC_MEASUREMENT) is supported as an optional requirement.
- External inputs from Host VMM are measured, such as TdHob, CFV.
- Other external inputs are measured, such as FW_CFG data, os loader,
initrd, etc.
<b>Config-B:</b>
- Add a standalone IntelTdx.dsc to a TDX specific directory for a *full*
feature TDVF.(Align with existing SEV)
**Config-B:**
- Add a standalone **IntelTdxX64.dsc** to a TDX specific directory
(**OvmfPkg/IntelTdx**) for a *full* feature TDVF.(Align with existing SEV)
- Threat model: VMM is out of TCB. (We need necessary change to prevent
attack from VMM)
- IntelTdx.dsc includes TDX/normal OVMF basic boot capability. The final
- IntelTdxX64.dsc includes TDX/normal OVMF basic boot capability. The final
binary can run on TDX/normal OVMF.
- It might eventually merge with AmdSev.dsc, but NOT at this point of
time. And we don?t know when it will happen. We need sync with AMD in
time. And we don't know when it will happen. We need sync with AMD in
the community after both of us think the solutions are mature to merge.
- Need to add necessary security feature as mandatory requirement, such
as RTMR based Trusted Boot support.
- Need to measure the external input from Host VMM, such as TdHob, CFV.
- Need to measure other external input, such as FW_CFG data, os loader,
- RTMR based measurement (CC_MEASUREMENT) is supported as a mandatory requirement.
- External inputs from Host VMM are measured, such as TdHob, CFV.
- Other external inputs are measured, such as FW_CFG data, os loader,
initrd, etc.
- Need to remove unnecessary attack surfaces, such as network stack.
- PEI phase is skipped to remove unnecessary attack surface.
- DXE FV is split into 2 FVs (DXEFV & NCCFV) to remove the unnecessary attack
surface in a TD guest..
- When launching a TD guest, only drivers in DXEFV are loaded.
- When launching a Non-TD guest, dirvers in both DXEFV and NCCFV are
loaded.
Build
------
- Build the TDVF (Config-A) target:
`cd /path/to/edk2`
`source edksetup.sh`
`build.sh -p OvmfPkg/OvmfPkgX64.dsc -a X64 -t GCC5`
```
cd /path/to/edk2
source edksetup.sh
## without CC_MEASUREMENT enabled
build -p OvmfPkg/OvmfPkgX64.dsc -a X64 -t GCC5 -b RELEASE
## CC_MEASUREMENT enabled
build -p OvmfPkg/OvmfPkgX64.dsc -a X64 -t GCC5 -D CC_MEASUREMENT_ENABLE=TRUE -b RELEASE
```
- Build the TDVF (Config-B) target:
`cd /path/to/edk2`
`set PACKAGES_PATH=/path/to/edk2/OvmfPkg`
`source edksetup.sh`
`build.sh -p OvmfPkg/IntelTdx/IntelTdxX64.dsc -a X64 -t GCC5`
```
cd /path/to/edk2
source edksetup.sh
build -p OvmfPkg/IntelTdx/IntelTdxX64.dsc -a X64 -t GCC5 -b RELEASE
```
Usage
-----