Script 'mail_helper' called by obssrc
Hello community,
here is the log from the commit of package ovmf for openSUSE:Factory checked in
at 2025-05-06 16:40:07
++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
Comparing /work/SRC/openSUSE:Factory/ovmf (Old)
and /work/SRC/openSUSE:Factory/.ovmf.new.30101 (New)
++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
Package is "ovmf"
Tue May 6 16:40:07 2025 rev:115 rq:1274608 version:202502
Changes:
--------
--- /work/SRC/openSUSE:Factory/ovmf/ovmf.changes 2025-04-07
17:34:57.912677861 +0200
+++ /work/SRC/openSUSE:Factory/.ovmf.new.30101/ovmf.changes 2025-05-06
16:40:08.908957710 +0200
@@ -1,0 +2,32 @@
+Mon Apr 28 03:59:31 UTC 2025 - YI HSIN Lyu <richard....@suse.com>
+
+- Add TDX flavor OVMF using Config-B (OvmfPkg/IntelTdx/IntelTdxX64.dsc).
+Full TDX functionality has been supported with Config-B.
+- Config-A (OvmfPkg/OvmfPkgX64.dsc) will be proposed for switching
+from Config-B once TDX upstream support becomes more complete and integration
is
+more mature.
+- Below is the difference between Config-A and Config-B.
+ - Config-A:
+ - Merge the basic TDVF feature to existing OvmfPkgX64.dsc. (Align with
existing SEV)
+ - Threat model: VMM is NOT out of TCB. (We don't make things worse)
+ - The OvmfPkgX64.dsc includes SEV/TDX/normal OVMF basic boot
capability. The final binary can run on SEV/TDX/normal OVMF.
+ - No changes to existing OvmfPkgX64 image layout.
+ - No need to remove features if they exist today.
+ - PEI phase is NOT skipped in either TD or Non-TD.
+ - RTMR based measurement (CC_MEASUREMENT) is supported as an optional
requirement.
+ - External inputs from Host VMM are measured, such as TdHob, CFV.
+ - Other external inputs are measured, such as FW_CFG data, os loader,
initrd, etc.
+ - Config-B:
+ - Add a standalone IntelTdxX64.dsc to a TDX specific directory
(OvmfPkg/IntelTdx) for a full feature TDVF.(Align with existing SEV)
+ - Threat model: VMM is out of TCB. (We need necessary change to
prevent attack from VMM)
+ - IntelTdxX64.dsc includes TDX/normal OVMF basic boot capability. The
final binary can run on TDX/normal OVMF.
+ - It might eventually merge with AmdSev.dsc, but NOT at this point of
time. And we don't know when it will happen. We need sync with AMD in the
community after both of us think the solutions are mature to merge.
+ - RTMR based measurement (CC_MEASUREMENT) is supported as a mandatory
requirement.
+ - External inputs from Host VMM are measured, such as TdHob, CFV.
+ - Other external inputs are measured, such as FW_CFG data, os loader,
initrd, etc.
+ - PEI phase is skipped to remove unnecessary attack surface.
+ - DXE FV is split into 2 FVs (DXEFV & NCCFV) to remove the unnecessary
attack surface in a TD guest..
+ - When launching a TD guest, only drivers in DXEFV are loaded.
+ - When launching a Non-TD guest, dirvers in both DXEFV and NCCFV are
loaded.
+
+-------------------------------------------------------------------
++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
Other differences:
------------------
++++++ ovmf.spec ++++++
--- /var/tmp/diff_new_pack.s6RWr1/_old 2025-05-06 16:40:09.888998669 +0200
+++ /var/tmp/diff_new_pack.s6RWr1/_new 2025-05-06 16:40:09.888998669 +0200
@@ -440,6 +440,22 @@
find source/ovmf-x86_64 -name *.c -type f -exec chmod 0644 {} \;
%endif
+# The extra TDX flavor for x86_64
+BUILD_OPTION_X64_TDX=" \
+ -p OvmfPkg/IntelTdx/IntelTdxX64.dsc \
+ -a X64 \
+ -b DEBUG \
+ -t $TOOL_CHAIN \
+"
+
+build $BUILD_OPTION_X64_TDX
+cp Build/IntelTdx/DEBUG_*/FV/OVMF.fd ovmf-x86_64-tdx.bin
+cp Build/IntelTdx/DEBUG_*/FV/OVMF_CODE.fd ovmf-x86_64-tdx-code.bin
+cp Build/IntelTdx/DEBUG_*/FV/OVMF_VARS.fd ovmf-x86_64-tdx-vars.bin
+
+# Remove the temporary build files to reduce the disk usage (bsc#1178244)
+rm -rf Build/IntelTdx/
+
# The extra Xen flavor for x86_64
BUILD_OPTION_X64_XEN=" \
-p OvmfPkg/OvmfXen.dsc \
