8b76f23534
RFC： https://bugzilla.tianocore.org/show_bug.cgi?id=3429 Intel's Trust Domain Extensions (Intel TDX) refers to an Intel technology that extends Virtual Machines Extensions (VMX) and Multi-Key Total Memory Encryption (MKTME) with a new kind of virutal machines guest called a Trust Domain (TD). A TD is desinged to run in a CPU mode that protects the confidentiality of TD memory contents and the TD's CPU state from other software, including the hosting Virtual-Machine Monitor (VMM), unless explicitly shared by the TD itself. Note: Intel TDX is only available on X64, so the Tdx related changes are in X64 path. In IA32 path, there may be null stub to make the build success. This patch includes below major changes. 1. Ia32/IntelTdx.asm IntelTdx.asm includes below routines used in ResetVector - IsTdx Check if the running system is Tdx guest. - InitTdxWorkarea It initialize the TDX_WORK_AREA. Because it is called by both BSP and APs and to avoid the race condition, only BSP can initialize the WORK_AREA. AP will wait until the field of TDX_WORK_AREA_PGTBL_READY is set. - ReloadFlat32 After reset all CPUs in TDX are initialized to 32-bit protected mode. But GDT register is not set. So this routine loads the GDT then jump to Flat 32 protected mode again. - InitTdx This routine wrap above 3 routines together to do Tdx initialization in ResetVector phase. - IsTdxEnabled It is a OneTimeCall to probe if TDX is enabled by checking the CC_WORK_AREA. - CheckTdxFeaturesBeforeBuildPagetables This routine is called to check if it is Non-TDX guest, TDX-Bsp or TDX-APs. Because in TDX guest all the initialization is done by BSP (including the page tables). APs should not build the tables. - TdxPostBuildPageTables It is called after Page Tables are built by BSP. byte[TDX_WORK_AREA_PGTBL_READY] is set by BSP to indicate APs can leave spin and go. 2. Ia32/PageTables64.asm As described above only the TDX BSP build the page tables. So PageTables64.asm is updated to make sure only TDX BSP build the PageTables. TDX APs will skip the page table building and set Cr3 directly. 3. Ia16/ResetVectorVtf0.asm In Tdx all CPUs "reset" to run on 32-bit protected mode with flat descriptor (paging disabled). But in Non-Td guest the initial state of CPUs is 16-bit real mode. To resolve this conflict, BITS 16/32 is used in the ResetVectorVtf0.asm. It checks the 32-bit protected mode or 16-bit real mode, then jump to the corresponding entry point. Cc: Ard Biesheuvel <ardb+tianocore@kernel.org> Cc: Jordan Justen <jordan.l.justen@intel.com> Cc: Gerd Hoffmann <kraxel@redhat.com> Cc: Brijesh Singh <brijesh.singh@amd.com> Cc: Erdem Aktas <erdemaktas@google.com> Cc: James Bottomley <jejb@linux.ibm.com> Cc: Jiewen Yao <jiewen.yao@intel.com> Cc: Tom Lendacky <thomas.lendacky@amd.com> Signed-off-by: Min Xu <min.m.xu@intel.com> Reviewed-by: Jiewen Yao <jiewen.yao@intel.com>
122 lines
2.8 KiB
NASM
122 lines
2.8 KiB
NASM
;------------------------------------------------------------------------------
|
|
; @file
|
|
; Main routine of the pre-SEC code up through the jump into SEC
|
|
;
|
|
; Copyright (c) 2008 - 2009, Intel Corporation. All rights reserved.<BR>
|
|
; SPDX-License-Identifier: BSD-2-Clause-Patent
|
|
;
|
|
;------------------------------------------------------------------------------
|
|
|
|
|
|
BITS 16
|
|
|
|
;
|
|
; Modified: EBX, ECX, EDX, EBP
|
|
;
|
|
; @param[in,out] RAX/EAX Initial value of the EAX register
|
|
; (BIST: Built-in Self Test)
|
|
; @param[in,out] DI 'BP': boot-strap processor, or
|
|
; 'AP': application processor
|
|
; @param[out] RBP/EBP Address of Boot Firmware Volume (BFV)
|
|
; @param[out] DS Selector allowing flat access to all addresses
|
|
; @param[out] ES Selector allowing flat access to all addresses
|
|
; @param[out] FS Selector allowing flat access to all addresses
|
|
; @param[out] GS Selector allowing flat access to all addresses
|
|
; @param[out] SS Selector allowing flat access to all addresses
|
|
;
|
|
; @return None This routine jumps to SEC and does not return
|
|
;
|
|
Main16:
|
|
OneTimeCall EarlyInit16
|
|
|
|
;
|
|
; Transition the processor from 16-bit real mode to 32-bit flat mode
|
|
;
|
|
OneTimeCall TransitionFromReal16To32BitFlat
|
|
|
|
BITS 32
|
|
|
|
; Clear the WorkArea header. The SEV probe routines will populate the
|
|
; work area when detected.
|
|
mov byte[WORK_AREA_GUEST_TYPE], 0
|
|
|
|
%ifdef ARCH_X64
|
|
|
|
jmp SearchBfv
|
|
|
|
;
|
|
; Entry point of Main32
|
|
;
|
|
Main32:
|
|
OneTimeCall InitTdx
|
|
|
|
SearchBfv:
|
|
|
|
%endif
|
|
|
|
;
|
|
; Search for the Boot Firmware Volume (BFV)
|
|
;
|
|
OneTimeCall Flat32SearchForBfvBase
|
|
|
|
;
|
|
; EBP - Start of BFV
|
|
;
|
|
|
|
;
|
|
; Search for the SEC entry point
|
|
;
|
|
OneTimeCall Flat32SearchForSecEntryPoint
|
|
|
|
;
|
|
; ESI - SEC Core entry point
|
|
; EBP - Start of BFV
|
|
;
|
|
|
|
%ifdef ARCH_IA32
|
|
|
|
;
|
|
; Restore initial EAX value into the EAX register
|
|
;
|
|
mov eax, esp
|
|
|
|
;
|
|
; Jump to the 32-bit SEC entry point
|
|
;
|
|
jmp esi
|
|
|
|
%else
|
|
|
|
;
|
|
; Transition the processor from 32-bit flat mode to 64-bit flat mode
|
|
;
|
|
OneTimeCall Transition32FlatTo64Flat
|
|
|
|
BITS 64
|
|
|
|
;
|
|
; Some values were calculated in 32-bit mode. Make sure the upper
|
|
; 32-bits of 64-bit registers are zero for these values.
|
|
;
|
|
mov rax, 0x00000000ffffffff
|
|
and rsi, rax
|
|
and rbp, rax
|
|
and rsp, rax
|
|
|
|
;
|
|
; RSI - SEC Core entry point
|
|
; RBP - Start of BFV
|
|
;
|
|
|
|
;
|
|
; Restore initial EAX value into the RAX register
|
|
;
|
|
mov rax, rsp
|
|
|
|
;
|
|
; Jump to the 64-bit SEC entry point
|
|
;
|
|
jmp rsi
|
|
|
|
%endif
|