]>
Commit | Line | Data |
---|---|---|
247a0fc6 MX |
1 | TDVF Overview\r |
2 | -------------\r | |
3 | \r | |
4 | <b>Intel Trust Domain Extension (TDX)</b> is Intel Architecture extension\r | |
5 | to provide trusted, isolated VM execution by removing CSP software\r | |
6 | (hypervisor etc) from the TCB. <b>TDX Virtual Firmware (TDVF)</b> is an\r | |
7 | EDK II based project to enable UEFI support for TDX based Virtual\r | |
8 | Machines. It provides the capability to launch a TD.\r | |
9 | \r | |
10 | The <b>Intel? TDX Virtual Firmware Design Guide</b> is at\r | |
11 | https://www.intel.com/content/dam/develop/external/us/en/documents/tdx-virtual-firmware-design-guide-rev-1.01.pdf.\r | |
12 | \r | |
13 | More information can be found at:\r | |
14 | https://www.intel.com/content/www/us/en/developer/articles/technical/intel-trust-domain-extensions.html\r | |
15 | \r | |
16 | \r | |
17 | Configurations and Features\r | |
18 | ----------------------------\r | |
19 | \r | |
20 | There are 2 configurations for TDVF.\r | |
21 | \r | |
22 | <b>Config-A:</b>\r | |
23 | - Merge the *basic* TDVF feature to existing OvmfX64Pkg.dsc. (Align\r | |
24 | with existing SEV)\r | |
25 | - Threat model: VMM is NOT out of TCB. (We don?t make things worse)\r | |
26 | - The OvmfX64Pkg.dsc includes SEV/TDX/normal OVMF basic boot capability.\r | |
27 | The final binary can run on SEV/TDX/normal OVMF.\r | |
28 | - No changes to existing OvmfPkgX64 image layout.\r | |
29 | - No need to add additional security features if they do not exist today.\r | |
30 | - No need to remove features if they exist today.\r | |
31 | - RTMR is not supported.\r | |
32 | - PEI phase is NOT skipped in either Td or Non-Td.\r | |
33 | \r | |
34 | <b>Config-B:</b>\r | |
35 | - (*) Add a standalone IntelTdx.dsc to a TDX specific directory for a *full*\r | |
36 | feature TDVF.(Align with existing SEV)\r | |
37 | - (*) Threat model: VMM is out of TCB. (We need necessary change to prevent\r | |
38 | attack from VMM)\r | |
39 | - (*) IntelTdx.dsc includes TDX/normal OVMF basic boot capability. The final\r | |
40 | binary can run on TDX/normal OVMF.\r | |
41 | - It might eventually merge with AmdSev.dsc, but NOT at this point of\r | |
42 | time. And we don?t know when it will happen. We need sync with AMD in\r | |
43 | the community after both of us think the solutions are mature to merge.\r | |
44 | - Need to add necessary security feature as mandatory requirement, such\r | |
45 | as RTMR based Trusted Boot support.\r | |
46 | - Need to measure the external input from Host VMM, such as TdHob, CFV.\r | |
47 | - Need to measure other external input, such as FW_CFG data, os loader,\r | |
48 | initrd, etc.\r | |
49 | - Need to remove unnecessary attack surfaces, such as network stack.\r | |
50 | \r | |
51 | In current stage, <b>Config-A</b> has been merged into edk2-master branch.\r | |
52 | The corresponding pkg file is OvmfPkg/OvmfPkgX64.dsc.\r | |
53 | \r | |
54 | <b>Config-B</b> is split into several waves. The corresponding pkg file is\r | |
55 | OvmfPkg/IntelTdx/IntelTdxX64.dsc. The features with (*) have been implemented\r | |
56 | and merged into edk2-master branch. Others are in upstreaming progress.\r | |
57 | \r | |
58 | Build\r | |
59 | ------\r | |
60 | - Build the TDVF (Config-A) target:\r | |
61 | `cd /path/to/edk2`\r | |
62 | `source edksetup.sh`\r | |
63 | `build.sh -p OvmfPkg/OvmfPkgX64.dsc -a X64 -t GCC5`\r | |
64 | \r | |
65 | - Build the TDVF (Config-B) target:\r | |
66 | `cd /path/to/edk2`\r | |
67 | `set PACKAGES_PATH=/path/to/edk2/OvmfPkg`\r | |
68 | `source edksetup.sh`\r | |
69 | `build.sh -p OvmfPkg/IntelTdx/IntelTdxX64.dsc -a X64 -t GCC5`\r | |
70 | \r | |
71 | Usage\r | |
72 | -----\r | |
73 | \r | |
74 | Assuming TDX-QEMU/TDX-KVM are already built, one can start a TD virtual\r | |
75 | machine as [launching-td-guest](https://github.com/intel/qemu-tdx/blob/tdx-qemu-upstream-rfc-v3/docs/system/i386/tdx.rst#launching-a-td-tdx-vm):\r | |
76 | \r | |
77 | `qemu_system_x86 \`\r | |
78 | ` -machine ...,confidential-guest-support=tdx0 \`\r | |
79 | ` -object tdx-guest,id=tdx0,[sept-ve-disable=off] \`\r | |
80 | ` -drive if=pflash,format=raw,unit=0,file=/path/to/OVMF_CODE.fd \`\r | |
81 | ` -drive if=pflash,format=raw,unit=1,file=/path/to/OVMF_VARS.fd \`\r | |
82 | \r | |
83 | Note:\r | |
84 | TDX-QEMU/TDX-KVM are still in upstreaming progress. Please refer to:\r | |
85 | - kvm : https://github.com/intel/tdx/tree/kvm-upstream\r | |
86 | - qemu : https://github.com/intel/qemu-tdx/blob/tdx-qemu-upstream-rfc-v3\r | |
87 | \r | |
88 | Once above 2 upstreaming are completed a minimum qemu/kvm version will be updated here.\r |