confidential-containers / td-shim

Confidential Containers Shim Firmware

TD-shim - Confidential Containers Shim Firmware

Hardware virtualization-based containers are designed to launch and run containerized applications in hardware virtualized environments. While containers usually run directly as bare-metal applications, using TD or VT as an isolation layer from the host OS is used as a secure and efficient way of building multi-tenant Cloud-native infrastructures (e.g. Kubernetes).

In order to match the short start-up time and resource consumption overhead of bare-metal containers, runtime architectures for TD- and VT-based containers put a strong focus on minimizing boot time. They must also launch the container payload as quickly as possible. Hardware virtualization-based containers typically run on top of simplified and customized Linux kernels to minimize the overall guest boot time.

Simplified kernels typically have no UEFI dependencies and no ACPI ASL support. This allows guests to boot without firmware dependencies. Current VT-based container runtimes rely on VMMs that are capable of directly booting into the guest kernel without loading firmware.

TD Shim is a simplified TDX virtual firmware for the simplified kernel for TD container. This document describes a lightweight interface between the TD Shim and TD VMM and between the TD Shim and the simplified kernel.

Documents

• TD-Shim specification

• Introduction PDF and conference talk

Feature Introduction

This is a Shim Firmware to support Intel TDX.

The API specification is at td-shim specification.

The secure boot specification for td-shim is at secure boot specification

The design is at td-shim design.

The threat model analysis is at td-shim threat model.

How to build

Tools

1. Install RUST

please use nightly-2023-12-31.

NOTE: We need install nightly version because we use cargo-xbuild.

1.1. Install xbuild

cargo install cargo-xbuild

Please reinstall cargo-xbuild, after you update the rust toolchain.

2. Install NASM

Please make sure nasm can be found in PATH.

3. Install LLVM

Please make sure clang can be found in PATH.

Set env:

export CC=clang
export AR=llvm-ar

export CC_x86_64_unknown_none=clang
export AR_x86_64_unknown_none=llvm-ar

Secure boot support

Please follow Secure Boot Guide

Before build

git submodule update --init --recursive
./sh_script/preparation.sh

Use xtask to build TdShim image

Build TdShim image to launch a payload support Linux Boot Protocol

cargo image --release

Build TdShim image to launch an executable payload

cargo image -t executable -p /path/to/payload_binary --release

Build TdShim image to launch the example payload

cargo image --example-payload --release

Build TdShim manually

Build TdShim to launch a payload support Linux Boot Protocol

cargo xbuild -p td-shim --target x86_64-unknown-none --release --features=main,tdx
cargo run -p td-shim-tools --bin td-shim-ld --features=linker -- target/x86_64-unknown-none/release/ResetVector.bin target/x86_64-unknown-none/release/td-shim -o target/release/final.bin

Build TdShim to launch a executable payload

cargo xbuild -p td-shim --target x86_64-unknown-none --release --features=main,tdx --no-default-features

Build Elf format payload

cargo xbuild -p td-payload --target x86_64-unknown-none --release --bin example --features=tdx,start,cet-shstk,stack-guard
cargo run -p td-shim-tools --bin td-shim-ld -- target/x86_64-unknown-none/release/ResetVector.bin target/x86_64-unknown-none/release/td-shim -t executable -p target/x86_64-unknown-none/release/example -o target/release/final-elf.bin

To build the debug TdShim, please use dev-opt profile to build td-shim binary. For example:

cargo xbuild -p td-shim --target x86_64-unknown-none --profile dev-opt --features=main,tdx
cargo run -p td-shim-tools --bin td-shim-ld --features=linker -- target/x86_64-unknown-none/dev-opt/ResetVector.bin target/x86_64-unknown-none/dev-opt/td-shim -o target/debug/final.bin

Run

REF: https://github.com/tianocore/edk2-staging/tree/TDVF

./launch-rust-td.sh

Reproducible Build

Reproducible build of td-shim binary requires same system user and source code path (see #604).

The Dockerfile is provided to build the docker image with the td-shim compilation environment for reproducible build. You can use the docker.sh to build and run the docker container:

./sh_script/docker.sh -f devtools/dev_container

Code Contributions

1. install pre-commit
2. run pre-commit install
3. when you run git commit, pre-commit will do check-code things.

License

td-shim's Issues

Status track for merging the staging branch into the main branch

As the td-shim has been merged into the staging branch, we need a plan to eventually merge it into main branch. Let's get it done piece by piece. So a checklist table is maintained here to track the status.

Approvers may review and approve the project by components, and mark a component as ready for merging in the following table. One all components has received enough approves, the staging branch will be merged into the main branch. Anyone who is willing to help the migration process may add himself/herself into the below table as approvers.

Approver	Status	@c3d	@jiangliu	@jyao1	@sameo
Build System	Merged	Y	S	Y
devtools/dev-container	Merged	Y	S		Y
devtools/td-benchmark
devtools/td-layout-config	Merged	Y	S	Y
devtools/test-runner-server/client	Merged		S	Y
td-exception
td-layout	Merged	Y	S	Y
td-paging	Merged		S	Y
td-payload
td-shim
td-shim-enroll-key
td-shim-ld
td-shim-sign-payload
tdx-tdcall	Reviewing		S	Y
td-uefi-pi	Reviewing		S

Create a tool for generating fuzz seeds

cfv.bin
fv_buffer
hob_buffer

[Bug] Build commands in doc/secure_boot_guide.md need to be updated

Parts of build commands in doc/secure_boot_guide.md is too old. We can not use these commands to build secure boot image.
Eg.

cargo xbuild -p td-shim --features "secure-boot" --target x86_64-unknown-uefi --release

should be update to

cargo xbuild -p td-shim --target x86_64-unknown-uefi --release --features=main,tdx,secure-boot --no-default-features

[Bug] fill_end value requires bounds checking

// td-shim/td-loader/src/pe.rs

fill_end may be larger than loaded_buffer length when running fuzzing

// lines 208-210
if section.virtual_size as usize > section_size {
    let fill_end = dst_start.checked_add(section.virtual_size as usize)?;
    loaded_buffer[dst_end..fill_end].fill(0);
}

build script should check dependencies and fail early

Building the shim is currently somewhat awkward since you need:

• clang (GCC won't work).
• nasm
• cargo xbuild

Admittedly, this is documented in https://github.com/confidential-containers/td-shim/blob/staging/README.md, but we should make it easier for users by checking for the expected commands in build.rs so that the build can fail early (rather than letting it chug on and die in flames at some later stage).

Related:

• #2 (comment)
• #2 (comment)

TD-Shim needs to map all of the memory reported by VMM

TD-Shim constructs the page table but only maps 0-36GB at now

CI: Fails to build PE format payload

running "clang" "-O0" "-ffunction-sections" "-fdata-sections" "-g" "-fno-omit-frame-pointer" "--target=x86_64-pc-windows-msvc" "-I" "include" "-Wall" "-Wextra" "/GS" "/Gy" "/EHsc" "/GR-" "/Zc:wchar_t" "/Zc:forScope" "/Zc:inline" "/Zc:rvalueCast" "/sdl" "/Wall" "/wd4127" "/wd4464" "/wd4514" "/wd4710" "/wd4711" "/wd4820" "/wd5045" "/Od" "/RTCsu" "/WX" "-c" "/FoD:\a\td-shim\td-shim\target\debug\build\ring-917f19b5a6b6e7a0\out\aes_nohw.obj" "crypto/fipsmodule/aes/aes_nohw.c"
clang: error: no such file or directory: '/GS'
clang: error: no such file or directory: '/Gy'
clang: error: no such file or directory: '/EHsc'
clang: error: no such file or directory: '/GR-'
clang: error: no such file or directory: '/Zc:wchar_t'
clang: error: no such file or directory: '/Zc:forScope'
clang: error: no such file or directory: '/Zc:inline'
clang: error: no such file or directory: '/Zc:rvalueCast'
clang: error: no such file or directory: '/sdl'
clang: error: no such file or directory: '/Wall'; did you mean '-Wall'?
clang: error: no such file or directory: '/wd4127'
clang: error: no such file or directory: '/wd4464'
clang: error: no such file or directory: '/wd4514'
clang: error: no such file or directory: '/wd4710'
clang: error: no such file or directory: '/wd4711'
clang: error: no such file or directory: '/wd4820'
clang: error: no such file or directory: '/wd5045'
clang: error: no such file or directory: '/Od'
clang: error: no such file or directory: '/RTCsu'
clang: error: no such file or directory: '/WX'
clang: error: no such file or directory: '/FoD:\a\td-shim\td-shim\target\debug\build\ring-917f19b5a6b6e7a0\out\aes_nohw.obj'
thread 'main' panicked at 'execution failed', C:\Users\runneradmin.cargo\git\checkouts\ring-1836a5bf48f90a2a\3e04208\build.rs:663:9
note: run with RUST_BACKTRACE=1 environment variable to display a backtrace
warning: build failed, waiting for other jobs to finish...
Warning: error: build failed
Error: Process completed with exit code 1.

Does TD-Shim require patches to QEMU/KVM?

Of course, to test TD workloads, both QEMU and KVM must be TDX-enlightened.

But is it enough to use QEMU from https://github.com/intel/qemu-tdx/ and KVM from https://github.com/intel/tdx/tree/kvm repos?

Or are there any additional patches that must be applied specifically for TD-Shim?

Also, are there known "good stable" releases/commit hashes of QEMU and KVM that are recommended for use with TD-Shim?

When reading the TD-Shim spec, I got a feeling that QEMU/KVM do not need to be aware of TD-Shim. In other words, TD-Shim is more or less a drop-in replacement for TDVF. Is my understanding correct?

staging: compile td-payload generates a warning

root@7c4b62794fd1:/tdshim# cargo xbuild --target ./devtools/rustc-targets/x86_64-unknown-none.json -p td-payload --release
WARNING: There is no root package to read the cargo-xbuild config from.
warning: Linking two modules of different data layouts: '' is 'e-m:e-p270:32:32-p271:32:32-p272:64:64-i64:64-f80:128-n8:16:32:64-S128' whereas 'td_payload.35f7730e-cgu.8' is 'e-m:e-i64:64-f80:128-n8:16:32:64-S128'

warning: td-payload (bin "td-payload") generated 1 warning
Finished release [optimized] target(s) in 0.97s

[Bug] Should do sanity check for cfv before using it

td-shim/src/bin/td-shim/main.rs : line 471

#[cfg(feature = "secure-boot")]
{
let cfv = memslice::get_mem_slice(memslice::SliceType::Config);
let verifier = verifier::PayloadVerifier::new(payload, cfv);
if let Ok(verifier) = &verifier {
td_event_log.create_event_log(
4,
EV_PLATFORM_CONFIG_FLAGS,
b"td payload",
verifier::PayloadVerifier::get_trust_anchor(cfv).unwrap(),
);
verifier.verify().expect("Verification fails");
td_event_log.create_event_log(4, EV_PLATFORM_CONFIG_FLAGS, b"td payload", payload);
td_event_log.create_event_log(
4,
EV_PLATFORM_CONFIG_FLAGS,
b"td payload svn",
&u64::to_le_bytes(verifier.get_payload_svn()),
);

[Bug] Unit test error of td-uefi-pi/src/fv.rs

td-uefi-pi/src/fv.rs

running 9 tests
thread 'fv::test::test_get_image_from_fv' panicked at 'assertion failed: `(left != right)`
  left: `None`,
 right: `None`', uefi-pi/src/fv.rs:200:9
stack backtrace:
test fv::test::test_get_file_from_fv_with_wrong_signature ... ok
test fv::test::test_get_file_from_fv_with_wrong_guid ... ok
thread 'fv::test::test_get_file_from_fv' panicked at 'assertion failed: `(left != right)`
  left: `None`,
 right: `None`', uefi-pi/src/fv.rs:249:9
test fv::test::test_get_image_from_fv_with_wrong_section_type ... ok
test fv::test::test_get_image_from_fv_with_wrong_signature ... ok
test fv::test::test_read_fvh ... ok
test fv::test::test_get_image_from_fv_with_wrong_fv_file_type ... ok
test pi::fv::tests::test_fvh_checksum ... ok
   0: rust_begin_unwind
             at /rustc/6d64f7f695943541fe12bb960971403f440d7225/library/std/src/panicking.rs:517:5
   1: core::panicking::panic_fmt
             at /rustc/6d64f7f695943541fe12bb960971403f440d7225/library/core/src/panicking.rs:93:14
   2: core::panicking::assert_failed_inner
   3: core::panicking::assert_failed
             at /rustc/6d64f7f695943541fe12bb960971403f440d7225/library/core/src/panicking.rs:132:5
   4: uefi_pi::fv::test::test_get_image_from_fv
             at ./src/fv.rs:200:9
   5: uefi_pi::fv::test::test_get_image_from_fv::{{closure}}
             at ./src/fv.rs:195:5
   6: core::ops::function::FnOnce::call_once
             at /rustc/6d64f7f695943541fe12bb960971403f440d7225/library/core/src/ops/function.rs:227:5
   7: core::ops::function::FnOnce::call_once
             at /rustc/6d64f7f695943541fe12bb960971403f440d7225/library/core/src/ops/function.rs:227:5
note: Some details are omitted, run with `RUST_BACKTRACE=full` for a verbose backtrace.
stack backtrace:
test fv::test::test_get_image_from_fv ... FAILED
   0: rust_begin_unwind
             at /rustc/6d64f7f695943541fe12bb960971403f440d7225/library/std/src/panicking.rs:517:5
   1: core::panicking::panic_fmt
             at /rustc/6d64f7f695943541fe12bb960971403f440d7225/library/core/src/panicking.rs:93:14
   2: core::panicking::assert_failed_inner
   3: core::panicking::assert_failed
             at /rustc/6d64f7f695943541fe12bb960971403f440d7225/library/core/src/panicking.rs:132:5
   4: uefi_pi::fv::test::test_get_file_from_fv
             at ./src/fv.rs:249:9
   5: uefi_pi::fv::test::test_get_file_from_fv::{{closure}}
             at ./src/fv.rs:244:5
   6: core::ops::function::FnOnce::call_once
             at /rustc/6d64f7f695943541fe12bb960971403f440d7225/library/core/src/ops/function.rs:227:5
   7: core::ops::function::FnOnce::call_once
             at /rustc/6d64f7f695943541fe12bb960971403f440d7225/library/core/src/ops/function.rs:227:5
note: Some details are omitted, run with `RUST_BACKTRACE=full` for a verbose backtrace.
test fv::test::test_get_file_from_fv ... FAILED

failures:

failures:
    fv::test::test_get_file_from_fv
    fv::test::test_get_image_from_fv

test result: FAILED. 7 passed; 2 failed; 0 ignored; 0 measured; 7 filtered out; finished in 0.01s

Payload type detection

I have a question about TD Payload related to what the specification states:

If the VMM does not provide the payload image or the VMM does not know
the payload image format, the VMM shall not create this payload info HOB.
The TdShim must know the payload format and transfer to the payload in
right way. By default, PayloadImageTypeExecutablePayload is used.

Assuming the TD Shim has the ability to identify the payload type, why don't we always rely on the TD Shim to do so? I don't think we should expect the VMM to identify the payload type, especially since it's not doing anything with it other than passing it to the guest.

Add more doc for tdx-tdcall

It would be helpful to quote some spec documentation in the tdx-tdcall crate, so it would be easier to understand the code.

rename rudra.md to static_analysis.md

It helps people understand what rudra is.

Consider to remove direct mailbox access inside of mp consumer function.

Record this issue as comment in #45.

The mail_box is designed for BSP<->AP communication.

we can eliminate mailbox access inside of parallel_accept_memory() and mp_accept_memory_resource_range().

For example, we can use below APIs:

fn ap_assign_work(apic_id: u32, stack: u64, entry: u32, param1: u64, param2: u64, param3: u64, param4: u64)
fn parallel_accept_memory(apic_id: u64, param1: u64, param2: u64, param3: u64, param4: u64)

Consider renaming the repo

Although this repo is TDX specific for now, it may be able to support other TEEs. If there is both interest for that and technical feasibility, we should consider renaming it to e.g. cc-shim.

[Bug] Cannot create instances outside for some structs in tdx-tdcall/tdreport.rs

Cannot create instances outside for some structs in tdx-tdcall/tdreport.rs. Since the element "resverd" is not public in these structs.

pub struct ReportMac {
pub report_type: ReportType,
reserved0: [u8; 12],
pub cpu_svn: [u8; 16],
pub tee_tcb_info_hash: [u8; 48],
pub tee_info_hash: [u8; 48],
pub report_data: [u8; 64],
reserved1: [u8; 32],
pub mac: [u8; 32],
}

pub struct TeeTcbInfo {
pub valid: [u8; 8],
pub tee_tcb_svn: [u8; 16],
pub mrseam: [u8; 48],
pub mrsigner_seam: [u8; 48],
pub attributes: [u8; 8],
reserved: [u8; 111],
}

pub struct TdInfo {
pub attributes: [u8; 8],
pub xfam: [u8; 8],
pub mrtd: [u8; 48],
pub mrconfig_id: [u8; 48],
pub mrowner: [u8; 48],
pub mrownerconfig: [u8; 48],
pub rtmr0: [u8; 48],
pub rtmr1: [u8; 48],
pub rtmr2: [u8; 48],
pub rtmr3: [u8; 48],
reserved: [u8; 112],
}

pub struct TdxReport {
pub report_mac: ReportMac,
pub tee_tcb_info: TeeTcbInfo,
reserved: [u8; 17],
pub td_info: TdInfo,
}

staging: The branch is not buidable due to broken external dependencies (on February 19th, 2022)

[ffidenci@ffidenci-desk td-shim]$ export CC=clang; export AR=llvm-ar
[ffidenci@ffidenci-desk td-shim]$ 
[ffidenci@ffidenci-desk td-shim]$ cargo xbuild -p td-shim --target x86_64-unknown-uefi --release --features=main,tdx,boot-kernel
WARNING: There is no root package to read the cargo-xbuild config from.
   Compiling core v0.0.0 (/home/ffidenci/.rustup/toolchains/nightly-2021-08-20-x86_64-unknown-linux-gnu/lib/rustlib/src/rust/library/core)
   Compiling compiler_builtins v0.1.49
   Compiling rustc-std-workspace-core v1.99.0 (/home/ffidenci/.rustup/toolchains/nightly-2021-08-20-x86_64-unknown-linux-gnu/lib/rustlib/src/rust/library/rustc-std-workspace-core)
   Compiling alloc v0.0.0 (/tmp/cargo-xbuildwzHzo5)
    Finished release [optimized] target(s) in 10.77s
   Compiling proc-macro2 v1.0.36
   Compiling unicode-xid v0.2.2
   Compiling syn v1.0.86
   Compiling log v0.4.14
   Compiling cfg-if v1.0.0
   Compiling scopeguard v1.1.0
   Compiling cc v1.0.70 (https://github.com/jyao1/cc-rs.git?branch=uefi_support#3b0362f9)
   Compiling bitflags v1.3.2
   Compiling spin v0.5.2
   Compiling x86_64 v0.14.6
   Compiling bit_field v0.10.1
   Compiling volatile v0.4.4
   Compiling x86 v0.44.0
   Compiling r-efi v3.2.0
   Compiling bitfield v0.13.2
   Compiling untrusted v0.7.1
   Compiling byteorder v1.4.3
   Compiling raw-cpuid v10.2.0
   Compiling lock_api v0.4.6
   Compiling lazy_static v1.4.0
   Compiling spin v0.9.2
   Compiling spinning_top v0.2.4
   Compiling linked_list_allocator v0.9.1
   Compiling ring v0.16.20 (https://github.com/jyao1/ring.git?branch=uefi_support#3e042088)
   Compiling quote v1.0.15
error: failed to run custom build command for `ring v0.16.20 (https://github.com/jyao1/ring.git?branch=uefi_support#3e042088)`

Caused by:
  process didn't exit successfully: `/home/ffidenci/go/src/github.com/confidential-containers/td-shim/target/release/build/ring-71a085a804d92895/build-script-build` (exit status: 101)
  --- stderr
  running "perl" "crypto/fipsmodule/aes/asm/aesni-x86_64.pl" "nasm" "/home/ffidenci/go/src/github.com/confidential-containers/td-shim/target/x86_64-unknown-uefi/release/build/ring-6d4280e73a5949bb/out/aesni-x86_64-nasm.asm"
  running "perl" "crypto/fipsmodule/aes/asm/vpaes-x86_64.pl" "nasm" "/home/ffidenci/go/src/github.com/confidential-containers/td-shim/target/x86_64-unknown-uefi/release/build/ring-6d4280e73a5949bb/out/vpaes-x86_64-nasm.asm"
  running "perl" "crypto/fipsmodule/bn/asm/x86_64-mont.pl" "nasm" "/home/ffidenci/go/src/github.com/confidential-containers/td-shim/target/x86_64-unknown-uefi/release/build/ring-6d4280e73a5949bb/out/x86_64-mont-nasm.asm"
  running "perl" "crypto/fipsmodule/bn/asm/x86_64-mont5.pl" "nasm" "/home/ffidenci/go/src/github.com/confidential-containers/td-shim/target/x86_64-unknown-uefi/release/build/ring-6d4280e73a5949bb/out/x86_64-mont5-nasm.asm"
  running "perl" "crypto/chacha/asm/chacha-x86_64.pl" "nasm" "/home/ffidenci/go/src/github.com/confidential-containers/td-shim/target/x86_64-unknown-uefi/release/build/ring-6d4280e73a5949bb/out/chacha-x86_64-nasm.asm"
  running "perl" "crypto/fipsmodule/ec/asm/p256-x86_64-asm.pl" "nasm" "/home/ffidenci/go/src/github.com/confidential-containers/td-shim/target/x86_64-unknown-uefi/release/build/ring-6d4280e73a5949bb/out/p256-x86_64-asm-nasm.asm"
  running "perl" "crypto/fipsmodule/modes/asm/aesni-gcm-x86_64.pl" "nasm" "/home/ffidenci/go/src/github.com/confidential-containers/td-shim/target/x86_64-unknown-uefi/release/build/ring-6d4280e73a5949bb/out/aesni-gcm-x86_64-nasm.asm"
  running "perl" "crypto/fipsmodule/modes/asm/ghash-x86_64.pl" "nasm" "/home/ffidenci/go/src/github.com/confidential-containers/td-shim/target/x86_64-unknown-uefi/release/build/ring-6d4280e73a5949bb/out/ghash-x86_64-nasm.asm"
  running "perl" "crypto/fipsmodule/sha/asm/sha512-x86_64.pl" "nasm" "/home/ffidenci/go/src/github.com/confidential-containers/td-shim/target/x86_64-unknown-uefi/release/build/ring-6d4280e73a5949bb/out/sha512-x86_64-nasm.asm"
  running "perl" "crypto/cipher_extra/asm/chacha20_poly1305_x86_64.pl" "nasm" "/home/ffidenci/go/src/github.com/confidential-containers/td-shim/target/x86_64-unknown-uefi/release/build/ring-6d4280e73a5949bb/out/chacha20_poly1305_x86_64-nasm.asm"
  running "perl" "crypto/fipsmodule/sha/asm/sha512-x86_64.pl" "nasm" "/home/ffidenci/go/src/github.com/confidential-containers/td-shim/target/x86_64-unknown-uefi/release/build/ring-6d4280e73a5949bb/out/sha256-x86_64-nasm.asm"
  running "nasm" "-o" "/home/ffidenci/go/src/github.com/confidential-containers/td-shim/target/x86_64-unknown-uefi/release/build/ring-6d4280e73a5949bb/out/aesni-x86_64-nasm.o" "-f" "win64" "-Xgnu" "-gcv8" "/home/ffidenci/go/src/github.com/confidential-containers/td-shim/target/x86_64-unknown-uefi/release/build/ring-6d4280e73a5949bb/out/aesni-x86_64-nasm.asm"
  thread 'main' panicked at 'failed to execute ["nasm" "-o" "/home/ffidenci/go/src/github.com/confidential-containers/td-shim/target/x86_64-unknown-uefi/release/build/ring-6d4280e73a5949bb/out/aesni-x86_64-nasm.o" "-f" "win64" "-Xgnu" "-gcv8" "/home/ffidenci/go/src/github.com/confidential-containers/td-shim/target/x86_64-unknown-uefi/release/build/ring-6d4280e73a5949bb/out/aesni-x86_64-nasm.asm"]: No such file or directory (os error 2)', /home/ffidenci/.cargo/git/checkouts/ring-1836a5bf48f90a2a/3e04208/build.rs:660:9
  note: run with `RUST_BACKTRACE=1` environment variable to display a backtrace
warning: build failed, waiting for other jobs to finish...
error: build failed

Add unit cases for td-layout/memslice.rs

Current there's no unit test cases for td-layout/memslice.rs, it would be better to add unit test cases for it.

Clarify why shim won't build with GCC

https://github.com/confidential-containers/td-shim/blob/staging/README.md shows that the shim must be built with clang. However, we should:

• Explain why the default compiler oin most Linux distros (GCC) won't work.
• Understand and ideally fix the GCC issue.

Need to add sanity check for TDX Hob before use it

Remove build.rs from rust-td-layout

The build.rs is used to generate build time and runtime constants, it's a little over-complex. Should we remove the build.rs and maintain build_time.rs and runtime.rs directly?

Build td-shim/ staging fails

root@a484e09e9ade:/tdshim# cargo xbuild -p rust-tdshim --target x86_64-unknown-uefi --release
WARNING: There is no root package to read the cargo-xbuild config from.
Compiling ring v0.16.20 (https://github.com/jyao1/ring.git?branch=uefi_support#3e042088)
Compiling scroll_derive v0.10.5
error: failed to run custom build command for ring v0.16.20 (https://github.com/jyao1/ring.git?branch=uefi_support#3e042088)

Caused by:
process didn't exit successfully: /tdshim/target/release/build/ring-71a085a804d92895/build-script-build (exit status: 101)
--- stdout
OPT_LEVEL = Some("3")
TARGET = Some("x86_64-unknown-uefi")
HOST = Some("x86_64-unknown-linux-gnu")
CC_x86_64-unknown-uefi = None
CC_x86_64_unknown_uefi = None
TARGET_CC = None
CC = Some("clang")
CFLAGS_x86_64-unknown-uefi = None
CFLAGS_x86_64_unknown_uefi = None
TARGET_CFLAGS = None
CFLAGS = None
CRATE_CC_NO_DEFAULTS = None
DEBUG = Some("false")

--- stderr
running "clang" "-O3" "-ffunction-sections" "-fdata-sections" "--target=x86_64-unknown-windows-gnu" "-I" "include" "-Wall" "-Wextra" "-std=c1x" "-Wbad-function-cast" "-Wnested-externs" "-Wstrict-prototypes" "-pedantic" "-pedantic-errors" "-Wall" "-Wextra" "-Wcast-align" "-Wcast-qual" "-Wconversion" "-Wenum-compare" "-Wfloat-equal" "-Wformat=2" "-Winline" "-Winvalid-pch" "-Wmissing-field-initializers" "-Wmissing-include-dirs" "-Wredundant-decls" "-Wshadow" "-Wsign-compare" "-Wsign-conversion" "-Wundef" "-Wuninitialized" "-Wwrite-strings" "-fno-strict-aliasing" "-fvisibility=hidden" "-g3" "-nostdlibinc" "-ffreestanding" "-Werror" "-DNDEBUG" "-DGFp_NOSTDLIBINC=1" "-c" "-o/tdshim/target/x86_64-unknown-uefi/release/build/ring-6d4280e73a5949bb/out/aes_nohw.o" "crypto/fipsmodule/aes/aes_nohw.c"
thread 'main' panicked at 'failed to execute ["clang" "-O3" "-ffunction-sections" "-fdata-sections" "--target=x86_64-unknown-windows-gnu" "-I" "include" "-Wall" "-Wextra" "-std=c1x" "-Wbad-function-cast" "-Wnested-externs" "-Wstrict-prototypes" "-pedantic" "-pedantic-errors" "-Wall" "-Wextra" "-Wcast-align" "-Wcast-qual" "-Wconversion" "-Wenum-compare" "-Wfloat-equal" "-Wformat=2" "-Winline" "-Winvalid-pch" "-Wmissing-field-initializers" "-Wmissing-include-dirs" "-Wredundant-decls" "-Wshadow" "-Wsign-compare" "-Wsign-conversion" "-Wundef" "-Wuninitialized" "-Wwrite-strings" "-fno-strict-aliasing" "-fvisibility=hidden" "-g3" "-nostdlibinc" "-ffreestanding" "-Werror" "-DNDEBUG" "-DGFp_NOSTDLIBINC=1" "-c" "-o/tdshim/target/x86_64-unknown-uefi/release/build/ring-6d4280e73a5949bb/out/aes_nohw.o" "crypto/fipsmodule/aes/aes_nohw.c"]: No such file or directory (os error 2)', /root/.cargo/git/checkouts/ring-1836a5bf48f90a2a/3e04208/build.rs:660:9
note: run with RUST_BACKTRACE=1 environment variable to display a backtrace
warning: build failed, waiting for other jobs to finish...
^C Building [=================> ] 62/93: scroll_derive

Add unit tests for uefi-pi/fv

Relocate the MAILBOX page to be continuous to the ACPI/event log regions

The MAILBOX page should be relocated to upper address to be continuous to the ACPI/event log regions, so the lower region could be released.

Protect against Spectre v1 side channel attack from untrusted input

Enhance td-shim to support multi-arch

Currently the td-shim implementation has no support for AMD SEV/CSV etc, it would be great to enhance the td-shim code to prepare for mutli-arch support.

Report memory resources above 4G to payload

Memory above 4G should be reported to payload through E820 table according to https://github.com/confidential-containers/td-shim/blob/main/doc/tdshim_spec.md#memory-map

regression: MSR access cause exception

MSR access will cause VE exception that cause td-shim failure.

https://github.com/confidential-containers/td-shim/blob/staging/td-shim/src/bin/td-shim/td/tdx.rs

fn enable_execute_disable_bit() {
    let mut msr: u64;

    unsafe { msr = asm_read_msr64(0xC0000080) };
    msr |= 0x800;
    unsafe { asm_write_msr64(0xC0000080, msr) };
}

According to TDX spec,

1. the MSR access should be done by VMCALL, instead of MSR instruction.
2. the TDX module will enable NX by default. Not need to use MSR to enable them again.

This code is redundant and shall be removed.

TD-Shim spec doesn't mention device enumeration through the PCI bus

The TD-Shim spec has this section: https://github.com/confidential-containers/td-shim/blob/main/doc/tdshim_spec.md#device-reporting, saying:

Device Reporting
TD Shim does not report device to TD guest. The VMM may include the device in the boot parameter, or Flattened Device Tree (FDT).

From the other parts of the spec, I see that TD-Shim will provide the MCFG ACPI table to the guest kernel (if PCIe is exposed by the VMM). Also, TD-Shim will provide newly-defined Simple Static PCI Routing Table (SPRT) ACPI table to the guest kernel. Finally, combining the info from these two tables (MCFG and SPRT), we can examine the whole PCI configuration space and detect all devices, as well as their IRQ mappings.

So I'm confused as to why there is a sentence on The VMM may include the device in the boot parameter, or Flattened Device Tree (FDT)? And why is there no mention of the PCI bus?

Implement shim loader in td-shim-tools

We have a linker td-shim-ld in the td-shim-tools crate, there should be a loader too.
The loader should take the responsibilities:

1. parse td-shim binary file into sections
2. validate section information
3. enforce present sections follow the td-shim spec

Move more code from staging branch into main branch

Currently we are facing the trouble of developing on two branches concurrently. So it would be great to speed up the progress to merge code from staging into main branch. To achieve that, we may:

• submit all merged code applicable to the main branch into the main branch
• td-loader
• td-shim library
• td-shim binary
• td-payload binary
• td-shim-tools (non-secure boot parts)
• integration tests
• secure boot related td-shim-tools and docs
• fuzz tests

Enhance td-shim/ResetVector to support test on non-TDX hardware platfroms

It help ease the development if we could test td-shim on non-TDX hardware platforms. Of course, all TDX related functionality will be disabled on non-TDX hardware platform.
Basically we need to enhance ResetVector to support boot from real mode and then switch protected as what expected by TDX.

td-shim: Booting up a VM with 14+ vCPUs fail due to: "VmBoot(PopulateHob(GuestMemoryWriteHob(InvalidGuestAddress(GuestAddress(4278464512)))))"

When booting up a TDX VM using Cloud Hypervisor with td-shim, using kata-containers guest and kernel images, it fails.

The components used are:

• cloud-hypervisor: v22.1, built with --tdx support
  • http://jenkins.katacontainers.io/job/kata-containers-2.0-clh-tdx-x86_64/
• guest kernel: vmlinuz-tdx-guest-v5.15-4-90-tdx
  • http://jenkins.katacontainers.io/job/kata-containers-2.0-kernel-tdx-x86_64-nightly/lastSuccessfulBuild/artifact/artifacts/vmlinuz-tdx-guest-v5.15-4-90-tdx
• guest image: The one provided by the kata-containers official 2.4.0-rc0 release
  • https://github.com/kata-containers/kata-containers/releases/download/2.4.0-rc0/kata-static-2.4.0-rc0-x86_64.tar.xz
    • It's located under ./opt/kata/share/kata-containers/kata-containers.img
• td-shim: 85b71f2, from the staging branch.
  • Built with the following commands:

    cargo xbuild -p td-shim --target x86_64-unknown-uefi --release --features=main,tdx,boot-kernel
    cargo xbuild -p td-payload --target x86_64-unknown-uefi --release --features=main,tdx
    cargo run -p td-shim-tools --features=td-shim/default,td-shim/tdx,boot-kernel --bin td-shim-ld -- target/x86_64-unknown-uefi/release/ResetVector.bin target/x86_64-unknown-uefi/release/td-shim.efi target/x86_64-unknown-uefi/release/td-payload.efi -o target/x86_64-unknown-uefi/release/final-pe.bin
    

And the command line used to spawn the guest:

cloud-hypervisor --tdx firmware=final-pe.bin --kernel vmlinuz-tdx-guest-v5.15-4-90-tdx --cmdline "root=/dev/vda1 sonole=hvc0 rw force_tdx_guest tdx_disable_filter" --cpus boot=14 --memory size=2G --disk path=kata-containers.img -

Here you can find the full log:

$ ./cloud-hypervisor --tdx firmware=final-pe.bin --kernel vmlinuz-tdx-guest-v5.15-4-90-tdx --cmdline "root=/dev/vda1 sonole=hvc0 rw force_tdx_guest tdx_disable_filter" --cpus boot=14 --memory size=4G --disk path=kata-containers.img -v
cloud-hypervisor: 4.077994ms: <vmm> INFO:vmm/src/lib.rs:1578 -- API request event: VmCreate(Mutex { data: VmConfig { cpus: CpusConfig { boot_vcpus: 14, max_vcpus: 14, topology: None, kvm_hyperv: false, max_phys_bits: 46, affinity: None }, memory: MemoryConfig { size: 4294967296, mergeable: false, hotplug_method: Acpi, hotplug_size: None, hotplugged_size: None, shared: false, hugepages: false, hugepage_size: None, prefault: false, zones: None }, kernel: Some(KernelConfig { path: "vmlinuz-tdx-guest-v5.15-4-90-tdx" }), initramfs: None, cmdline: CmdlineConfig { args: "root=/dev/vda1 sonole=hvc0 rw force_tdx_guest tdx_disable_filter" }, disks: Some([DiskConfig { path: Some("kata-containers.img"), readonly: false, direct: false, iommu: false, num_queues: 1, queue_size: 128, vhost_user: false, vhost_socket: None, poll_queue: true, rate_limiter_config: None, id: None, disable_io_uring: false, pci_segment: 0 }]), net: None, rng: RngConfig { src: "/dev/urandom", iommu: false }, balloon: None, fs: None, pmem: None, serial: ConsoleConfig { file: None, mode: Null, iommu: false }, console: ConsoleConfig { file: None, mode: Tty, iommu: false }, devices: None, user_devices: None, vsock: None, iommu: false, sgx_epc: None, numa: None, watchdog: false, tdx: Some(TdxConfig { firmware: "final-pe.bin" }), platform: None }, poisoned: false, .. }, Sender { .. })
cloud-hypervisor: 5.205661ms: <vmm> INFO:vmm/src/lib.rs:1578 -- API request event: VmBoot(Sender { .. })
cloud-hypervisor: 8.254521ms: <vmm> INFO:vmm/src/memory_manager.rs:1475 -- Creating userspace mapping: 0 -> 7fc4c554a000 c0000000, slot 0
cloud-hypervisor: 12.545088ms: <vmm> INFO:vmm/src/memory_manager.rs:1509 -- Created userspace mapping: 0 -> 7fc4c554a000 c0000000
cloud-hypervisor: 12.594762ms: <vmm> INFO:vmm/src/memory_manager.rs:1475 -- Creating userspace mapping: 100000000 -> 7fc48554a000 40000000, slot 1
cloud-hypervisor: 13.312823ms: <vmm> INFO:vmm/src/memory_manager.rs:1509 -- Created userspace mapping: 100000000 -> 7fc48554a000 40000000
cloud-hypervisor: 13.364081ms: <vmm> INFO:vmm/src/vm.rs:567 -- Booting VM from config: Mutex { data: VmConfig { cpus: CpusConfig { boot_vcpus: 14, max_vcpus: 14, topology: None, kvm_hyperv: false, max_phys_bits: 46, affinity: None }, memory: MemoryConfig { size: 4294967296, mergeable: false, hotplug_method: Acpi, hotplug_size: None, hotplugged_size: None, shared: false, hugepages: false, hugepage_size: None, prefault: false, zones: None }, kernel: Some(KernelConfig { path: "vmlinuz-tdx-guest-v5.15-4-90-tdx" }), initramfs: None, cmdline: CmdlineConfig { args: "root=/dev/vda1 sonole=hvc0 rw force_tdx_guest tdx_disable_filter" }, disks: Some([DiskConfig { path: Some("kata-containers.img"), readonly: false, direct: false, iommu: false, num_queues: 1, queue_size: 128, vhost_user: false, vhost_socket: None, poll_queue: true, rate_limiter_config: None, id: None, disable_io_uring: false, pci_segment: 0 }]), net: None, rng: RngConfig { src: "/dev/urandom", iommu: false }, balloon: None, fs: None, pmem: None, serial: ConsoleConfig { file: None, mode: Null, iommu: false }, console: ConsoleConfig { file: None, mode: Tty, iommu: false }, devices: None, user_devices: None, vsock: None, iommu: false, sgx_epc: None, numa: None, watchdog: false, tdx: Some(TdxConfig { firmware: "final-pe.bin" }), platform: None }, poisoned: false, .. }
cloud-hypervisor: 14.326287ms: <vmm> INFO:vmm/src/pci_segment.rs:92 -- Adding PCI segment: id=0, PCI MMIO config address: 0xe8000000, device area [0x140000000-0x3fff3fffffff
cloud-hypervisor: 14.804367ms: <vmm> INFO:vmm/src/device_manager.rs:1959 -- Creating virtio-block device: DiskConfig { path: Some("kata-containers.img"), readonly: false, direct: false, iommu: false, num_queues: 1, queue_size: 128, vhost_user: false, vhost_socket: None, poll_queue: true, rate_limiter_config: None, id: Some("_disk0"), disable_io_uring: false, pci_segment: 0 }
cloud-hypervisor: 15.300825ms: <vmm> INFO:vmm/src/device_manager.rs:2041 -- Using asynchronous RAW disk file (io_uring)
cloud-hypervisor: 15.336665ms: <vmm> INFO:virtio-devices/src/block.rs:445 -- Disk topology: DiskTopology { logical_block_size: 512, physical_block_size: 512, minimum_io_size: 512, optimal_io_size: 0 }
cloud-hypervisor: 15.4434ms: <vmm> INFO:vmm/src/device_manager.rs:2274 -- Creating virtio-rng device: RngConfig { src: "/dev/urandom", iommu: false }
cloud-hypervisor: 16.009421ms: <vmm> INFO:vmm/src/vm.rs:2024 -- Booting VM
cloud-hypervisor: 16.121853ms: <vmm> INFO:vmm/src/cpu.rs:707 -- Request to create new vCPUs: desired = 14, max = 14, allocated = 0, present = 0
cloud-hypervisor: 16.181911ms: <vmm> INFO:vmm/src/cpu.rs:673 -- Creating vCPU: cpu_id = 0
cloud-hypervisor: 16.411887ms: <vmm> INFO:vmm/src/cpu.rs:297 -- Configuring vCPU: cpu_id = 0
cloud-hypervisor: 16.503299ms: <vmm> INFO:vmm/src/cpu.rs:673 -- Creating vCPU: cpu_id = 1
cloud-hypervisor: 16.669565ms: <vmm> INFO:vmm/src/cpu.rs:297 -- Configuring vCPU: cpu_id = 1
cloud-hypervisor: 16.731235ms: <vmm> INFO:vmm/src/cpu.rs:673 -- Creating vCPU: cpu_id = 2
cloud-hypervisor: 16.899037ms: <vmm> INFO:vmm/src/cpu.rs:297 -- Configuring vCPU: cpu_id = 2
cloud-hypervisor: 16.961675ms: <vmm> INFO:vmm/src/cpu.rs:673 -- Creating vCPU: cpu_id = 3
cloud-hypervisor: 17.132989ms: <vmm> INFO:vmm/src/cpu.rs:297 -- Configuring vCPU: cpu_id = 3
cloud-hypervisor: 17.210538ms: <vmm> INFO:vmm/src/cpu.rs:673 -- Creating vCPU: cpu_id = 4
cloud-hypervisor: 17.358418ms: <vmm> INFO:vmm/src/cpu.rs:297 -- Configuring vCPU: cpu_id = 4
cloud-hypervisor: 17.42129ms: <vmm> INFO:vmm/src/cpu.rs:673 -- Creating vCPU: cpu_id = 5
cloud-hypervisor: 17.56867ms: <vmm> INFO:vmm/src/cpu.rs:297 -- Configuring vCPU: cpu_id = 5
cloud-hypervisor: 17.627911ms: <vmm> INFO:vmm/src/cpu.rs:673 -- Creating vCPU: cpu_id = 6
cloud-hypervisor: 17.7789ms: <vmm> INFO:vmm/src/cpu.rs:297 -- Configuring vCPU: cpu_id = 6
cloud-hypervisor: 17.838235ms: <vmm> INFO:vmm/src/cpu.rs:673 -- Creating vCPU: cpu_id = 7
cloud-hypervisor: 17.989046ms: <vmm> INFO:vmm/src/cpu.rs:297 -- Configuring vCPU: cpu_id = 7
cloud-hypervisor: 18.055461ms: <vmm> INFO:vmm/src/cpu.rs:673 -- Creating vCPU: cpu_id = 8
cloud-hypervisor: 18.200898ms: <vmm> INFO:vmm/src/cpu.rs:297 -- Configuring vCPU: cpu_id = 8
cloud-hypervisor: 18.261859ms: <vmm> INFO:vmm/src/cpu.rs:673 -- Creating vCPU: cpu_id = 9
cloud-hypervisor: 18.441465ms: <vmm> INFO:vmm/src/cpu.rs:297 -- Configuring vCPU: cpu_id = 9
cloud-hypervisor: 18.500762ms: <vmm> INFO:vmm/src/cpu.rs:673 -- Creating vCPU: cpu_id = 10
cloud-hypervisor: 18.65526ms: <vmm> INFO:vmm/src/cpu.rs:297 -- Configuring vCPU: cpu_id = 10
cloud-hypervisor: 18.715195ms: <vmm> INFO:vmm/src/cpu.rs:673 -- Creating vCPU: cpu_id = 11
cloud-hypervisor: 18.866124ms: <vmm> INFO:vmm/src/cpu.rs:297 -- Configuring vCPU: cpu_id = 11
cloud-hypervisor: 18.925117ms: <vmm> INFO:vmm/src/cpu.rs:673 -- Creating vCPU: cpu_id = 12
cloud-hypervisor: 19.076542ms: <vmm> INFO:vmm/src/cpu.rs:297 -- Configuring vCPU: cpu_id = 12
cloud-hypervisor: 19.139282ms: <vmm> INFO:vmm/src/cpu.rs:673 -- Creating vCPU: cpu_id = 13
cloud-hypervisor: 19.293743ms: <vmm> INFO:vmm/src/cpu.rs:297 -- Configuring vCPU: cpu_id = 13
cloud-hypervisor: 19.396849ms: <vmm> INFO:vmm/src/vm.rs:1721 -- Allocating TDVF Section: TdvfSection { data_offset: 84000, data_size: f7c000, address: ff084000, size: f7c000, type: Bfv, attributes: 1 }
cloud-hypervisor: 19.559987ms: <vmm> INFO:vmm/src/memory_manager.rs:1475 -- Creating userspace mapping: ff084000 -> 7fc4845a4000 f7c000, slot 2
cloud-hypervisor: 19.695037ms: <vmm> INFO:vmm/src/memory_manager.rs:1509 -- Created userspace mapping: ff084000 -> 7fc4845a4000 f7c000
cloud-hypervisor: 19.736366ms: <vmm> INFO:vmm/src/vm.rs:1721 -- Allocating TDVF Section: TdvfSection { data_offset: 0, data_size: 40000, address: ff000000, size: 40000, type: Cfv, attributes: 0 }
cloud-hypervisor: 19.841677ms: <vmm> INFO:vmm/src/memory_manager.rs:1475 -- Creating userspace mapping: ff000000 -> 7fc484564000 40000, slot 3
cloud-hypervisor: 19.962693ms: <vmm> INFO:vmm/src/memory_manager.rs:1509 -- Created userspace mapping: ff000000 -> 7fc484564000 40000
cloud-hypervisor: 19.998031ms: <vmm> INFO:vmm/src/vm.rs:1721 -- Allocating TDVF Section: TdvfSection { data_offset: 0, data_size: 0, address: ff044000, size: 20000, type: TempMem, attributes: 0 }
cloud-hypervisor: 20.113847ms: <vmm> INFO:vmm/src/memory_manager.rs:1475 -- Creating userspace mapping: ff044000 -> 7fc484544000 20000, slot 4
cloud-hypervisor: 20.221783ms: <vmm> INFO:vmm/src/memory_manager.rs:1509 -- Created userspace mapping: ff044000 -> 7fc484544000 20000
cloud-hypervisor: 20.271874ms: <vmm> INFO:vmm/src/vm.rs:1721 -- Allocating TDVF Section: TdvfSection { data_offset: 0, data_size: 0, address: ff064000, size: 20000, type: TempMem, attributes: 0 }
cloud-hypervisor: 20.470107ms: <vmm> INFO:vmm/src/memory_manager.rs:1475 -- Creating userspace mapping: ff064000 -> 7fc484524000 20000, slot 5
cloud-hypervisor: 20.569556ms: <vmm> INFO:vmm/src/memory_manager.rs:1509 -- Created userspace mapping: ff064000 -> 7fc484524000 20000
cloud-hypervisor: 20.602652ms: <vmm> INFO:vmm/src/vm.rs:1721 -- Allocating TDVF Section: TdvfSection { data_offset: 0, data_size: 0, address: ff041000, size: 2000, type: TdHob, attributes: 0 }
cloud-hypervisor: 20.691252ms: <vmm> INFO:vmm/src/memory_manager.rs:1475 -- Creating userspace mapping: ff041000 -> 7fc484522000 2000, slot 6
cloud-hypervisor: 20.781046ms: <vmm> INFO:vmm/src/memory_manager.rs:1509 -- Created userspace mapping: ff041000 -> 7fc484522000 2000
cloud-hypervisor: 20.814265ms: <vmm> INFO:vmm/src/vm.rs:1721 -- Allocating TDVF Section: TdvfSection { data_offset: 0, data_size: 0, address: ff040000, size: 1000, type: TempMem, attributes: 0 }
cloud-hypervisor: 20.884102ms: <vmm> INFO:vmm/src/memory_manager.rs:1475 -- Creating userspace mapping: ff040000 -> 7fc484521000 1000, slot 7
cloud-hypervisor: 20.963797ms: <vmm> INFO:vmm/src/memory_manager.rs:1509 -- Created userspace mapping: ff040000 -> 7fc484521000 1000
cloud-hypervisor: 21.018152ms: <vmm> INFO:vmm/src/vm.rs:1714 -- Not allocating TDVF Section: TdvfSection { data_offset: 0, data_size: 0, address: 1100000, size: 2000000, type: Payload, attributes: 0 } since it is already part of guest RAM
cloud-hypervisor: 21.122657ms: <vmm> INFO:vmm/src/vm.rs:1714 -- Not allocating TDVF Section: TdvfSection { data_offset: 0, data_size: 0, address: 1000000, size: 100000, type: PayloadParam, attributes: 0 } since it is already part of guest RAM
cloud-hypervisor: 21.260169ms: <vmm> INFO:vmm/src/vm.rs:1741 -- Populating TDVF Section: TdvfSection { data_offset: 84000, data_size: f7c000, address: ff084000, size: f7c000, type: Bfv, attributes: 1 }
cloud-hypervisor: 21.351395ms: <vmm> INFO:vmm/src/vm.rs:1744 -- Copying section to guest memory
cloud-hypervisor: 53.304374ms: <vmm> INFO:vmm/src/vm.rs:1741 -- Populating TDVF Section: TdvfSection { data_offset: 0, data_size: 40000, address: ff000000, size: 40000, type: Cfv, attributes: 0 }
cloud-hypervisor: 53.375394ms: <vmm> INFO:vmm/src/vm.rs:1744 -- Copying section to guest memory
cloud-hypervisor: 53.909338ms: <vmm> INFO:vmm/src/vm.rs:1741 -- Populating TDVF Section: TdvfSection { data_offset: 0, data_size: 0, address: ff044000, size: 20000, type: TempMem, attributes: 0 }
cloud-hypervisor: 53.968101ms: <vmm> INFO:vmm/src/vm.rs:1741 -- Populating TDVF Section: TdvfSection { data_offset: 0, data_size: 0, address: ff064000, size: 20000, type: TempMem, attributes: 0 }
cloud-hypervisor: 54.024563ms: <vmm> INFO:vmm/src/vm.rs:1741 -- Populating TDVF Section: TdvfSection { data_offset: 0, data_size: 0, address: ff041000, size: 2000, type: TdHob, attributes: 0 }
cloud-hypervisor: 54.122442ms: <vmm> INFO:vmm/src/vm.rs:1741 -- Populating TDVF Section: TdvfSection { data_offset: 0, data_size: 0, address: ff040000, size: 1000, type: TempMem, attributes: 0 }
cloud-hypervisor: 54.225669ms: <vmm> INFO:vmm/src/vm.rs:1741 -- Populating TDVF Section: TdvfSection { data_offset: 0, data_size: 0, address: 1100000, size: 2000000, type: Payload, attributes: 0 }
cloud-hypervisor: 54.31914ms: <vmm> INFO:vmm/src/vm.rs:1759 -- Copying payload to guest memory
cloud-hypervisor: 70.09428ms: <vmm> INFO:vmm/src/vm.rs:1741 -- Populating TDVF Section: TdvfSection { data_offset: 0, data_size: 0, address: 1000000, size: 100000, type: PayloadParam, attributes: 0 }
cloud-hypervisor: 70.157342ms: <vmm> INFO:vmm/src/vm.rs:1808 -- Copying payload parameters to guest memory
cloud-hypervisor: 70.214806ms: <vmm> INFO:arch/src/x86_64/tdx/mod.rs:299 -- Writing HOB resource ff041038 HobResourceDescriptor { header: HobHeader { type: ResourceDescriptor, length: 30, reserved: 0 }, owner: EfiGuid { data1: 0, data2: 0, data3: 0, data4: [0, 0, 0, 0, 0, 0, 0, 0] }, resource_type: 0, resource_attribute: 4000007, physical_start: 0, resource_length: 1000000 }
cloud-hypervisor: 70.45265ms: <vmm> INFO:arch/src/x86_64/tdx/mod.rs:299 -- Writing HOB resource ff041068 HobResourceDescriptor { header: HobHeader { type: ResourceDescriptor, length: 30, reserved: 0 }, owner: EfiGuid { data1: 0, data2: 0, data3: 0, data4: [0, 0, 0, 0, 0, 0, 0, 0] }, resource_type: 5, resource_attribute: 4000007, physical_start: 1000000, resource_length: 100000 }
cloud-hypervisor: 70.628503ms: <vmm> INFO:arch/src/x86_64/tdx/mod.rs:299 -- Writing HOB resource ff041098 HobResourceDescriptor { header: HobHeader { type: ResourceDescriptor, length: 30, reserved: 0 }, owner: EfiGuid { data1: 0, data2: 0, data3: 0, data4: [0, 0, 0, 0, 0, 0, 0, 0] }, resource_type: 5, resource_attribute: 4000007, physical_start: 1100000, resource_length: 2000000 }
cloud-hypervisor: 70.880669ms: <vmm> INFO:arch/src/x86_64/tdx/mod.rs:299 -- Writing HOB resource ff0410c8 HobResourceDescriptor { header: HobHeader { type: ResourceDescriptor, length: 30, reserved: 0 }, owner: EfiGuid { data1: 0, data2: 0, data3: 0, data4: [0, 0, 0, 0, 0, 0, 0, 0] }, resource_type: 0, resource_attribute: 4000007, physical_start: 3100000, resource_length: bcf00000 }
cloud-hypervisor: 71.117393ms: <vmm> INFO:arch/src/x86_64/tdx/mod.rs:299 -- Writing HOB resource ff0410f8 HobResourceDescriptor { header: HobHeader { type: ResourceDescriptor, length: 30, reserved: 0 }, owner: EfiGuid { data1: 0, data2: 0, data3: 0, data4: [0, 0, 0, 0, 0, 0, 0, 0] }, resource_type: 5, resource_attribute: 4000007, physical_start: ff040000, resource_length: 1000 }
cloud-hypervisor: 71.374941ms: <vmm> INFO:arch/src/x86_64/tdx/mod.rs:299 -- Writing HOB resource ff041128 HobResourceDescriptor { header: HobHeader { type: ResourceDescriptor, length: 30, reserved: 0 }, owner: EfiGuid { data1: 0, data2: 0, data3: 0, data4: [0, 0, 0, 0, 0, 0, 0, 0] }, resource_type: 5, resource_attribute: 4000007, physical_start: ff041000, resource_length: 2000 }
cloud-hypervisor: 71.583705ms: <vmm> INFO:arch/src/x86_64/tdx/mod.rs:299 -- Writing HOB resource ff041158 HobResourceDescriptor { header: HobHeader { type: ResourceDescriptor, length: 30, reserved: 0 }, owner: EfiGuid { data1: 0, data2: 0, data3: 0, data4: [0, 0, 0, 0, 0, 0, 0, 0] }, resource_type: 0, resource_attribute: 4000007, physical_start: ff043000, resource_length: 1000 }
cloud-hypervisor: 71.77871ms: <vmm> INFO:arch/src/x86_64/tdx/mod.rs:299 -- Writing HOB resource ff041188 HobResourceDescriptor { header: HobHeader { type: ResourceDescriptor, length: 30, reserved: 0 }, owner: EfiGuid { data1: 0, data2: 0, data3: 0, data4: [0, 0, 0, 0, 0, 0, 0, 0] }, resource_type: 5, resource_attribute: 4000007, physical_start: ff044000, resource_length: 20000 }
cloud-hypervisor: 72.009529ms: <vmm> INFO:arch/src/x86_64/tdx/mod.rs:299 -- Writing HOB resource ff0411b8 HobResourceDescriptor { header: HobHeader { type: ResourceDescriptor, length: 30, reserved: 0 }, owner: EfiGuid { data1: 0, data2: 0, data3: 0, data4: [0, 0, 0, 0, 0, 0, 0, 0] }, resource_type: 5, resource_attribute: 4000007, physical_start: ff064000, resource_length: 20000 }
cloud-hypervisor: 72.222553ms: <vmm> INFO:arch/src/x86_64/tdx/mod.rs:299 -- Writing HOB resource ff0411e8 HobResourceDescriptor { header: HobHeader { type: ResourceDescriptor, length: 30, reserved: 0 }, owner: EfiGuid { data1: 0, data2: 0, data3: 0, data4: [0, 0, 0, 0, 0, 0, 0, 0] }, resource_type: 0, resource_attribute: 4000007, physical_start: ff084000, resource_length: 40f7c000 }
cloud-hypervisor: 72.447829ms: <vmm> INFO:arch/src/x86_64/tdx/mod.rs:299 -- Writing HOB resource ff041218 HobResourceDescriptor { header: HobHeader { type: ResourceDescriptor, length: 30, reserved: 0 }, owner: EfiGuid { data1: 0, data2: 0, data3: 0, data4: [0, 0, 0, 0, 0, 0, 0, 0] }, resource_type: 1, resource_attribute: 403, physical_start: c0000000, resource_length: 3ee00000 }
cloud-hypervisor: 72.622365ms: <vmm> INFO:arch/src/x86_64/tdx/mod.rs:299 -- Writing HOB resource ff041248 HobResourceDescriptor { header: HobHeader { type: ResourceDescriptor, length: 30, reserved: 0 }, owner: EfiGuid { data1: 0, data2: 0, data3: 0, data4: [0, 0, 0, 0, 0, 0, 0, 0] }, resource_type: 1, resource_attribute: 403, physical_start: 140000000, resource_length: 3ffebfeeffff }
cloud-hypervisor: 74.334481ms: <vmm> INFO:arch/src/x86_64/tdx/mod.rs:377 -- Writing HOB ACPI table ff041278 HobGuidType { header: HobHeader { type: GuidExtension, length: 1c70, reserved: 0 }, name: EfiGuid { data1: 6a0c5870, data2: d4ed, data3: 44f4, data4: [a1, 35, dd, 23, 8b, 6f, c, 8d] } } [44, 53, 44, 54, 51, 1c, 0, 0, 6, 99, 43, 4c, 4f, 55, 44, 48, 43, 48, 44, 53, 44, 54, 20, 20, 1, 0, 0, 0, 43, 4c, 44, 48, 0, 0, 0, 0, 5b, 82, 41, e, 2e, 5f, 53, 42, 5f, 50, 48, 50, 52, 8, 5f, 48, 49, 44, c, 41, d0, a, 6, 8, 5f, 53, 54, 41, a, b, 8, 5f, 55, 49, 44, d, 50, 43, 49, 20, 48, 6f, 74, 70, 6c, 75, 67, 20, 43, 6f, 6e, 74, 72, 6f, 6c, 6c, 65, 72, 0, 5b, 1, 42, 4c, 43, 4b, 0, 8, 5f, 43, 52, 53, 11, 33, a, 30, 8a, 2b, 0, 0, c, 1, 0, 0, 0, 0, 0, 0, 0, 0, 0, e0, fe, ff, ff, 3f, 0, 0, f, e0, fe, ff, ff, 3f, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 10, 0, 0, 0, 0, 0, 0, 0, 79, 0, 5b, 80, 50, 43, 53, 54, 0, e, 0, e0, fe, ff, ff, 3f, 0, 0, a, 10, 5b, 81, 1a, 50, 43, 53, 54, 43, 50, 43, 49, 55, 20, 50, 43, 49, 44, 20, 42, 30, 45, 4a, 20, 50, 53, 45, 47, 20, 14, 23, 50, 43, 45, 4a, a, 5b, 23, 42, 4c, 43, 4b, ff, ff, 70, 69, 50, 53, 45, 47, 79, 1, 68, 42, 30, 45, 4a, 5b, 27, 42, 4c, 43, 4b, a4, 0, 14, 15, 50, 53, 43, 4e, 8, 5c, 2f, 3, 5f, 53, 42, 5f, 50, 43, 49, 30, 50, 43, 4e, 54, 5b, 82, 46, d5, 2e, 5f, 53, 42, 5f, 50, 43, 49, 30, 8, 5f, 48, 49, 44, c, 41, d0, a, 8, 8, 5f, 43, 49, 44, c, 41, d0, a, 3, 8, 5f, 41, 44, 52, 0, 8, 5f, 53, 45, 47, b, 0, 0, 8, 5f, 55, 49, 44, 0, 8, 5f, 43, 43, 41, 1, 8, 53, 55, 50, 50, 0, 14, c, 5f, 50, 58, 4d, 0, a4, c, 0, 0, 0, 0, 14, 37, 5f, 44, 53, 4d, 4, a0, 2a, 93, 68, 11, 13, a, 10, d0, 37, c9, e5, 53, 35, 7a, 4d, 91, 17, ea, 4d, 19, c3, 43, 4d, a0, a, 93, 6a, 0, a4, 11, 4, a, 1, 21, a0, 7, 93, 6a, a, 5, a4, 0, a4, 11, 4, a, 1, 0, 8, 5f, 43, 52, 53, 11, 42, 9, a, 8e, 88, d, 0, 2, c, 0, 0, 0, 0, 0, 0, 0, 0, 0, 1, 0, 47, 1, f8, c, f8, c, 1, 8, 86, 9, 0, 1, 0, 0, 0, e8, 0, 0, 10, 0, 87, 17, 0, 0, c, 1, 0, 0, 0, 0, 0, 0, 0, c0, ff, ff, ff, e7, 0, 0, 0, 0, 0, 0, 0, 28, 8a, 2b, 0, 0, c, 1, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 40, 1, 0, 0, 0, ff, ff, ff, 3f, ff, 3f, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, fe, 3f, 0, 0, 88, d, 0, 1, c, 3, 0, 0, 0, 0, f7, c, 0, 0, f8, c, 88, d, 0, 1, c, 3, 0, 0, 0, d, ff, ff, 0, 0, 0, f3, 79, 0, 5b, 82, 34, 53, 30, 30, 30, 8, 5f, 53, 55, 4e, a, 0, 8, 5f, 41, 44, 52, c, 0, 0, 0, 0, 14, 1d, 5f, 45, 4a, 30, 9, 5c, 2f, 3, 5f, 53, 42, 5f, 50, 48, 50, 52, 50, 43, 45, 4a, 5f, 53, 55, 4e, 5f, 53, 45, 47, 5b, 82, 34, 53, 30, 30, 31, 8, 5f, 53, 55, 4e, a, 1, 8, 5f, 41, 44, 52, c, 0, 0, 1, 0, 14, 1d, 5f, 45, 4a, 30, 9, 5c, 2f, 3, 5f, 53, 42, 5f, 50, 48, 50, 52, 50, 43, 45, 4a, 5f, 53, 55, 4e, 5f, 53, 45, 47, 5b, 82, 34, 53, 30, 30, 32, 8, 5f, 53, 55, 4e, a, 2, 8, 5f, 41, 44, 52, c, 0, 0, 2, 0, 14, 1d, 5f, 45, 4a, 30, 9, 5c, 2f, 3, 5f, 53, 42, 5f, 50, 48, 50, 52, 50, 43, 45, 4a, 5f, 53, 55, 4e, 5f, 53, 45, 47, 5b, 82, 34, 53, 30, 30, 33, 8, 5f, 53, 55, 4e, a, 3, 8, 5f, 41, 44, 52, c, 0, 0, 3, 0, 14, 1d, 5f, 45, 4a, 30, 9, 5c, 2f, 3, 5f, 53, 42, 5f, 50, 48, 50, 52, 50, 43, 45, 4a, 5f, 53, 55, 4e, 5f, 53, 45, 47, 5b, 82, 34, 53, 30, 30, 34, 8, 5f, 53, 55, 4e, a, 4, 8, 5f, 41, 44, 52, c, 0, 0, 4, 0, 14, 1d, 5f, 45, 4a, 30, 9, 5c, 2f, 3, 5f, 53, 42, 5f, 50, 48, 50, 52, 50, 43, 45, 4a, 5f, 53, 55, 4e, 5f, 53, 45, 47, 5b, 82, 34, 53, 30, 30, 35, 8, 5f, 53, 55, 4e, a, 5, 8, 5f, 41, 44, 52, c, 0, 0, 5, 0, 14, 1d, 5f, 45, 4a, 30, 9, 5c, 2f, 3, 5f, 53, 42, 5f, 50, 48, 50, 52, 50, 43, 45, 4a, 5f, 53, 55, 4e, 5f, 53, 45, 47, 5b, 82, 34, 53, 30, 30, 36, 8, 5f, 53, 55, 4e, a, 6, 8, 5f, 41, 44, 52, c, 0, 0, 6, 0, 14, 1d, 5f, 45, 4a, 30, 9, 5c, 2f, 3, 5f, 53, 42, 5f, 50, 48, 50, 52, 50, 43, 45, 4a, 5f, 53, 55, 4e, 5f, 53, 45, 47, 5b, 82, 34, 53, 30, 30, 37, 8, 5f, 53, 55, 4e, a, 7, 8, 5f, 41, 44, 52, c, 0, 0, 7, 0, 14, 1d, 5f, 45, 4a, 30, 9, 5c, 2f, 3, 5f, 53, 42, 5f, 50, 48, 50, 52, 50, 43, 45, 4a, 5f, 53, 55, 4e, 5f, 53, 45, 47, 5b, 82, 34, 53, 30, 30, 38, 8, 5f, 53, 55, 4e, a, 8, 8, 5f, 41, 44, 52, c, 0, 0, 8, 0, 14, 1d, 5f, 45, 4a, 30, 9, 5c, 2f, 3, 5f, 53, 42, 5f, 50, 48, 50, 52, 50, 43, 45, 4a, 5f, 53, 55, 4e, 5f, 53, 45, 47, 5b, 82, 34, 53, 30, 30, 39, 8, 5f, 53, 55, 4e, a, 9, 8, 5f, 41, 44, 52, c, 0, 0, 9, 0, 14, 1d, 5f, 45, 4a, 30, 9, 5c, 2f, 3, 5f, 53, 42, 5f, 50, 48, 50, 52, 50, 43, 45, 4a, 5f, 53, 55, 4e, 5f, 53, 45, 47, 5b, 82, 34, 53, 30, 31, 30, 8, 5f, 53, 55, 4e, a, a, 8, 5f, 41, 44, 52, c, 0, 0, a, 0, 14, 1d, 5f, 45, 4a, 30, 9, 5c, 2f, 3, 5f, 53, 42, 5f, 50, 48, 50, 52, 50, 43, 45, 4a, 5f, 53, 55, 4e, 5f, 53, 45, 47, 5b, 82, 34, 53, 30, 31, 31, 8, 5f, 53, 55, 4e, a, b, 8, 5f, 41, 44, 52, c, 0, 0, b, 0, 14, 1d, 5f, 45, 4a, 30, 9, 5c, 2f, 3, 5f, 53, 42, 5f, 50, 48, 50, 52, 50, 43, 45, 4a, 5f, 53, 55, 4e, 5f, 53, 45, 47, 5b, 82, 34, 53, 30, 31, 32, 8, 5f, 53, 55, 4e, a, c, 8, 5f, 41, 44, 52, c, 0, 0, c, 0, 14, 1d, 5f, 45, 4a, 30, 9, 5c, 2f, 3, 5f, 53, 42, 5f, 50, 48, 50, 52, 50, 43, 45, 4a, 5f, 53, 55, 4e, 5f, 53, 45, 47, 5b, 82, 34, 53, 30, 31, 33, 8, 5f, 53, 55, 4e, a, d, 8, 5f, 41, 44, 52, c, 0, 0, d, 0, 14, 1d, 5f, 45, 4a, 30, 9, 5c, 2f, 3, 5f, 53, 42, 5f, 50, 48, 50, 52, 50, 43, 45, 4a, 5f, 53, 55, 4e, 5f, 53, 45, 47, 5b, 82, 34, 53, 30, 31, 34, 8, 5f, 53, 55, 4e, a, e, 8, 5f, 41, 44, 52, c, 0, 0, e, 0, 14, 1d, 5f, 45, 4a, 30, 9, 5c, 2f, 3, 5f, 53, 42, 5f, 50, 48, 50, 52, 50, 43, 45, 4a, 5f, 53, 55, 4e, 5f, 53, 45, 47, 5b, 82, 34, 53, 30, 31, 35, 8, 5f, 53, 55, 4e, a, f, 8, 5f, 41, 44, 52, c, 0, 0, f, 0, 14, 1d, 5f, 45, 4a, 30, 9, 5c, 2f, 3, 5f, 53, 42, 5f, 50, 48, 50, 52, 50, 43, 45, 4a, 5f, 53, 55, 4e, 5f, 53, 45, 47, 5b, 82, 34, 53, 30, 31, 36, 8, 5f, 53, 55, 4e, a, 10, 8, 5f, 41, 44, 52, c, 0, 0, 10, 0, 14, 1d, 5f, 45, 4a, 30, 9, 5c, 2f, 3, 5f, 53, 42, 5f, 50, 48, 50, 52, 50, 43, 45, 4a, 5f, 53, 55, 4e, 5f, 53, 45, 47, 5b, 82, 34, 53, 30, 31, 37, 8, 5f, 53, 55, 4e, a, 11, 8, 5f, 41, 44, 52, c, 0, 0, 11, 0, 14, 1d, 5f, 45, 4a, 30, 9, 5c, 2f, 3, 5f, 53, 42, 5f, 50, 48, 50, 52, 50, 43, 45, 4a, 5f, 53, 55, 4e, 5f, 53, 45, 47, 5b, 82, 34, 53, 30, 31, 38, 8, 5f, 53, 55, 4e, a, 12, 8, 5f, 41, 44, 52, c, 0, 0, 12, 0, 14, 1d, 5f, 45, 4a, 30, 9, 5c, 2f, 3, 5f, 53, 42, 5f, 50, 48, 50, 52, 50, 43, 45, 4a, 5f, 53, 55, 4e, 5f, 53, 45, 47, 5b, 82, 34, 53, 30, 31, 39, 8, 5f, 53, 55, 4e, a, 13, 8, 5f, 41, 44, 52, c, 0, 0, 13, 0, 14, 1d, 5f, 45, 4a, 30, 9, 5c, 2f, 3, 5f, 53, 42, 5f, 50, 48, 50, 52, 50, 43, 45, 4a, 5f, 53, 55, 4e, 5f, 53, 45, 47, 5b, 82, 34, 53, 30, 32, 30, 8, 5f, 53, 55, 4e, a, 14, 8, 5f, 41, 44, 52, c, 0, 0, 14, 0, 14, 1d, 5f, 45, 4a, 30, 9, 5c, 2f, 3, 5f, 53, 42, 5f, 50, 48, 50, 52, 50, 43, 45, 4a, 5f, 53, 55, 4e, 5f, 53, 45, 47, 5b, 82, 34, 53, 30, 32, 31, 8, 5f, 53, 55, 4e, a, 15, 8, 5f, 41, 44, 52, c, 0, 0, 15, 0, 14, 1d, 5f, 45, 4a, 30, 9, 5c, 2f, 3, 5f, 53, 42, 5f, 50, 48, 50, 52, 50, 43, 45, 4a, 5f, 53, 55, 4e, 5f, 53, 45, 47, 5b, 82, 34, 53, 30, 32, 32, 8, 5f, 53, 55, 4e, a, 16, 8, 5f, 41, 44, 52, c, 0, 0, 16, 0, 14, 1d, 5f, 45, 4a, 30, 9, 5c, 2f, 3, 5f, 53, 42, 5f, 50, 48, 50, 52, 50, 43, 45, 4a, 5f, 53, 55, 4e, 5f, 53, 45, 47, 5b, 82, 34, 53, 30, 32, 33, 8, 5f, 53, 55, 4e, a, 17, 8, 5f, 41, 44, 52, c, 0, 0, 17, 0, 14, 1d, 5f, 45, 4a, 30, 9, 5c, 2f, 3, 5f, 53, 42, 5f, 50, 48, 50, 52, 50, 43, 45, 4a, 5f, 53, 55, 4e, 5f, 53, 45, 47, 5b, 82, 34, 53, 30, 32, 34, 8, 5f, 53, 55, 4e, a, 18, 8, 5f, 41, 44, 52, c, 0, 0, 18, 0, 14, 1d, 5f, 45, 4a, 30, 9, 5c, 2f, 3, 5f, 53, 42, 5f, 50, 48, 50, 52, 50, 43, 45, 4a, 5f, 53, 55, 4e, 5f, 53, 45, 47, 5b, 82, 34, 53, 30, 32, 35, 8, 5f, 53, 55, 4e, a, 19, 8, 5f, 41, 44, 52, c, 0, 0, 19, 0, 14, 1d, 5f, 45, 4a, 30, 9, 5c, 2f, 3, 5f, 53, 42, 5f, 50, 48, 50, 52, 50, 43, 45, 4a, 5f, 53, 55, 4e, 5f, 53, 45, 47, 5b, 82, 34, 53, 30, 32, 36, 8, 5f, 53, 55, 4e, a, 1a, 8, 5f, 41, 44, 52, c, 0, 0, 1a, 0, 14, 1d, 5f, 45, 4a, 30, 9, 5c, 2f, 3, 5f, 53, 42, 5f, 50, 48, 50, 52, 50, 43, 45, 4a, 5f, 53, 55, 4e, 5f, 53, 45, 47, 5b, 82, 34, 53, 30, 32, 37, 8, 5f, 53, 55, 4e, a, 1b, 8, 5f, 41, 44, 52, c, 0, 0, 1b, 0, 14, 1d, 5f, 45, 4a, 30, 9, 5c, 2f, 3, 5f, 53, 42, 5f, 50, 48, 50, 52, 50, 43, 45, 4a, 5f, 53, 55, 4e, 5f, 53, 45, 47, 5b, 82, 34, 53, 30, 32, 38, 8, 5f, 53, 55, 4e, a, 1c, 8, 5f, 41, 44, 52, c, 0, 0, 1c, 0, 14, 1d, 5f, 45, 4a, 30, 9, 5c, 2f, 3, 5f, 53, 42, 5f, 50, 48, 50, 52, 50, 43, 45, 4a, 5f, 53, 55, 4e, 5f, 53, 45, 47, 5b, 82, 34, 53, 30, 32, 39, 8, 5f, 53, 55, 4e, a, 1d, 8, 5f, 41, 44, 52, c, 0, 0, 1d, 0, 14, 1d, 5f, 45, 4a, 30, 9, 5c, 2f, 3, 5f, 53, 42, 5f, 50, 48, 50, 52, 50, 43, 45, 4a, 5f, 53, 55, 4e, 5f, 53, 45, 47, 5b, 82, 34, 53, 30, 33, 30, 8, 5f, 53, 55, 4e, a, 1e, 8, 5f, 41, 44, 52, c, 0, 0, 1e, 0, 14, 1d, 5f, 45, 4a, 30, 9, 5c, 2f, 3, 5f, 53, 42, 5f, 50, 48, 50, 52, 50, 43, 45, 4a, 5f, 53, 55, 4e, 5f, 53, 45, 47, 5b, 82, 34, 53, 30, 33, 31, 8, 5f, 53, 55, 4e, a, 1f, 8, 5f, 41, 44, 52, c, 0, 0, 1f, 0, 14, 1d, 5f, 45, 4a, 30, 9, 5c, 2f, 3, 5f, 53, 42, 5f, 50, 48, 50, 52, 50, 43, 45, 4a, 5f, 53, 55, 4e, 5f, 53, 45, 47, 14, 47, 2e, 44, 56, 4e, 54, a, 7b, 68, c, 1, 0, 0, 0, 60, a0, e, 93, 60, c, 1, 0, 0, 0, 86, 53, 30, 30, 30, 69, 7b, 68, c, 2, 0, 0, 0, 60, a0, e, 93, 60, c, 2, 0, 0, 0, 86, 53, 30, 30, 31, 69, 7b, 68, c, 4, 0, 0, 0, 60, a0, e, 93, 60, c, 4, 0, 0, 0, 86, 53, 30, 30, 32, 69, 7b, 68, c, 8, 0, 0, 0, 60, a0, e, 93, 60, c, 8, 0, 0, 0, 86, 53, 30, 30, 33, 69, 7b, 68, c, 10, 0, 0, 0, 60, a0, e, 93, 60, c, 10, 0, 0, 0, 86, 53, 30, 30, 34, 69, 7b, 68, c, 20, 0, 0, 0, 60, a0, e, 93, 60, c, 20, 0, 0, 0, 86, 53, 30, 30, 35, 69, 7b, 68, c, 40, 0, 0, 0, 60, a0, e, 93, 60, c, 40, 0, 0, 0, 86, 53, 30, 30, 36, 69, 7b, 68, c, 80, 0, 0, 0, 60, a0, e, 93, 60, c, 80, 0, 0, 0, 86, 53, 30, 30, 37, 69, 7b, 68, c, 0, 1, 0, 0, 60, a0, e, 93, 60, c, 0, 1, 0, 0, 86, 53, 30, 30, 38, 69, 7b, 68, c, 0, 2, 0, 0, 60, a0, e, 93, 60, c, 0, 2, 0, 0, 86, 53, 30, 30, 39, 69, 7b, 68, c, 0, 4, 0, 0, 60, a0, e, 93, 60, c, 0, 4, 0, 0, 86, 53, 30, 31, 30, 69, 7b, 68, c, 0, 8, 0, 0, 60, a0, e, 93, 60, c, 0, 8, 0, 0, 86, 53, 30, 31, 31, 69, 7b, 68, c, 0, 10, 0, 0, 60, a0, e, 93, 60, c, 0, 10, 0, 0, 86, 53, 30, 31, 32, 69, 7b, 68, c, 0, 20, 0, 0, 60, a0, e, 93, 60, c, 0, 20, 0, 0, 86, 53, 30, 31, 33, 69, 7b, 68, c, 0, 40, 0, 0, 60, a0, e, 93, 60, c, 0, 40, 0, 0, 86, 53, 30, 31, 34, 69, 7b, 68, c, 0, 80, 0, 0, 60, a0, e, 93, 60, c, 0, 80, 0, 0, 86, 53, 30, 31, 35, 69, 7b, 68, c, 0, 0, 1, 0, 60, a0, e, 93, 60, c, 0, 0, 1, 0, 86, 53, 30, 31, 36, 69, 7b, 68, c, 0, 0, 2, 0, 60, a0, e, 93, 60, c, 0, 0, 2, 0, 86, 53, 30, 31, 37, 69, 7b, 68, c, 0, 0, 4, 0, 60, a0, e, 93, 60, c, 0, 0, 4, 0, 86, 53, 30, 31, 38, 69, 7b, 68, c, 0, 0, 8, 0, 60, a0, e, 93, 60, c, 0, 0, 8, 0, 86, 53, 30, 31, 39, 69, 7b, 68, c, 0, 0, 10, 0, 60, a0, e, 93, 60, c, 0, 0, 10, 0, 86, 53, 30, 32, 30, 69, 7b, 68, c, 0, 0, 20, 0, 60, a0, e, 93, 60, c, 0, 0, 20, 0, 86, 53, 30, 32, 31, 69, 7b, 68, c, 0, 0, 40, 0, 60, a0, e, 93, 60, c, 0, 0, 40, 0, 86, 53, 30, 32, 32, 69, 7b, 68, c, 0, 0, 80, 0, 60, a0, e, 93, 60, c, 0, 0, 80, 0, 86, 53, 30, 32, 33, 69, 7b, 68, c, 0, 0, 0, 1, 60, a0, e, 93, 60, c, 0, 0, 0, 1, 86, 53, 30, 32, 34, 69, 7b, 68, c, 0, 0, 0, 2, 60, a0, e, 93, 60, c, 0, 0, 0, 2, 86, 53, 30, 32, 35, 69, 7b, 68, c, 0, 0, 0, 4, 60, a0, e, 93, 60, c, 0, 0, 0, 4, 86, 53, 30, 32, 36, 69, 7b, 68, c, 0, 0, 0, 8, 60, a0, e, 93, 60, c, 0, 0, 0, 8, 86, 53, 30, 32, 37, 69, 7b, 68, c, 0, 0, 0, 10, 60, a0, e, 93, 60, c, 0, 0, 0, 10, 86, 53, 30, 32, 38, 69, 7b, 68, c, 0, 0, 0, 20, 60, a0, e, 93, 60, c, 0, 0, 0, 20, 86, 53, 30, 32, 39, 69, 7b, 68, c, 0, 0, 0, 40, 60, a0, e, 93, 60, c, 0, 0, 0, 40, 86, 53, 30, 33, 30, 69, 7b, 68, c, 0, 0, 0, 80, 60, a0, e, 93, 60, c, 0, 0, 0, 80, 86, 53, 30, 33, 31, 69, 14, 48, 6, 50, 43, 4e, 54, 8, 5b, 23, 5c, 2f, 3, 5f, 53, 42, 5f, 50, 48, 50, 52, 42, 4c, 43, 4b, ff, ff, 70, 5f, 53, 45, 47, 5c, 2f, 3, 5f, 53, 42, 5f, 50, 48, 50, 52, 50, 53, 45, 47, 44, 56, 4e, 54, 5c, 2f, 3, 5f, 53, 42, 5f, 50, 48, 50, 52, 50, 43, 49, 55, 1, 44, 56, 4e, 54, 5c, 2f, 3, 5f, 53, 42, 5f, 50, 48, 50, 52, 50, 43, 49, 44, a, 3, 5b, 27, 5c, 2f, 3, 5f, 53, 42, 5f, 50, 48, 50, 52, 42, 4c, 43, 4b, 8, 5f, 50, 52, 54, 12, 43, 22, 20, 12, 10, 4, c, ff, ff, 0, 0, a, 0, a, 0, c, 5, 0, 0, 0, 12, 10, 4, c, ff, ff, 1, 0, a, 0, a, 0, c, 6, 0, 0, 0, 12, 10, 4, c, ff, ff, 2, 0, a, 0, a, 0, c, 7, 0, 0, 0, 12, 10, 4, c, ff, ff, 3, 0, a, 0, a, 0, c, 8, 0, 0, 0, 12, 10, 4, c, ff, ff, 4, 0, a, 0, a, 0, c, 9, 0, 0, 0, 12, 10, 4, c, ff, ff, 5, 0, a, 0, a, 0, c, a, 0, 0, 0, 12, 10, 4, c, ff, ff, 6, 0, a, 0, a, 0, c, b, 0, 0, 0, 12, 10, 4, c, ff, ff, 7, 0, a, 0, a, 0, c, c, 0, 0, 0, 12, 10, 4, c, ff, ff, 8, 0, a, 0, a, 0, c, 5, 0, 0, 0, 12, 10, 4, c, ff, ff, 9, 0, a, 0, a, 0, c, 6, 0, 0, 0, 12, 10, 4, c, ff, ff, a, 0, a, 0, a, 0, c, 7, 0, 0, 0, 12, 10, 4, c, ff, ff, b, 0, a, 0, a, 0, c, 8, 0, 0, 0, 12, 10, 4, c, ff, ff, c, 0, a, 0, a, 0, c, 9, 0, 0, 0, 12, 10, 4, c, ff, ff, d, 0, a, 0, a, 0, c, a, 0, 0, 0, 12, 10, 4, c, ff, ff, e, 0, a, 0, a, 0, c, b, 0, 0, 0, 12, 10, 4, c, ff, ff, f, 0, a, 0, a, 0, c, c, 0, 0, 0, 12, 10, 4, c, ff, ff, 10, 0, a, 0, a, 0, c, 5, 0, 0, 0, 12, 10, 4, c, ff, ff, 11, 0, a, 0, a, 0, c, 6, 0, 0, 0, 12, 10, 4, c, ff, ff, 12, 0, a, 0, a, 0, c, 7, 0, 0, 0, 12, 10, 4, c, ff, ff, 13, 0, a, 0, a, 0, c, 8, 0, 0, 0, 12, 10, 4, c, ff, ff, 14, 0, a, 0, a, 0, c, 9, 0, 0, 0, 12, 10, 4, c, ff, ff, 15, 0, a, 0, a, 0, c, a, 0, 0, 0, 12, 10, 4, c, ff, ff, 16, 0, a, 0, a, 0, c, b, 0, 0, 0, 12, 10, 4, c, ff, ff, 17, 0, a, 0, a, 0, c, c, 0, 0, 0, 12, 10, 4, c, ff, ff, 18, 0, a, 0, a, 0, c, 5, 0, 0, 0, 12, 10, 4, c, ff, ff, 19, 0, a, 0, a, 0, c, 6, 0, 0, 0, 12, 10, 4, c, ff, ff, 1a, 0, a, 0, a, 0, c, 7, 0, 0, 0, 12, 10, 4, c, ff, ff, 1b, 0, a, 0, a, 0, c, 8, 0, 0, 0, 12, 10, 4, c, ff, ff, 1c, 0, a, 0, a, 0, c, 9, 0, 0, 0, 12, 10, 4, c, ff, ff, 1d, 0, a, 0, a, 0, c, a, 0, 0, 0, 12, 10, 4, c, ff, ff, 1e, 0, a, 0, a, 0, c, b, 0, 0, 0, 12, 10, 4, c, ff, ff, 1f, 0, a, 0, a, 0, c, c, 0, 0, 0, 5b, 82, 31, 2e, 5f, 53, 42, 5f, 4d, 42, 52, 44, 8, 5f, 48, 49, 44, c, 41, d0, c, 2, 8, 5f, 55, 49, 44, 0, 8, 5f, 43, 52, 53, 11, 11, a, e, 86, 9, 0, 1, 0, 0, 0, e8, 0, 0, 10, 0, 79, 0, 5b, 82, 42, 4, 2e, 5f, 53, 42, 5f, 43, 4f, 4d, 31, 8, 5f, 48, 49, 44, c, 41, d0, 5, 1, 8, 5f, 55, 49, 44, 0, 8, 5f, 44, 44, 4e, d, 43, 4f, 4d, 31, 0, 8, 5f, 43, 52, 53, 11, 16, a, 13, 89, 6, 0, 3, 1, 4, 0, 0, 0, 47, 1, f8, 3, f8, 3, 0, 8, 79, 0, 8, 5f, 53, 35, 5f, 12, 4, 1, a, 5, 5b, 82, 1a, 2e, 5f, 53, 42, 5f, 50, 57, 52, 42, 8, 5f, 48, 49, 44, c, 41, d0, c, c, 8, 5f, 55, 49, 44, 0, 5b, 82, 45, c, 2e, 5f, 53, 42, 5f, 47, 45, 44, 5f, 8, 5f, 48, 49, 44, d, 41, 43, 50, 49, 30, 30, 31, 33, 0, 8, 5f, 55, 49, 44, 0, 8, 5f, 43, 52, 53, 11, e, a, b, 89, 6, 0, 3, 1, d, 0, 0, 0, 79, 0, 5b, 80, 47, 44, 53, 54, 0, e, 0, c0, fe, ff, ff, 3f, 0, 0, a, 1, 5b, 81, b, 47, 44, 53, 54, 41, 47, 44, 41, 54, 8, 14, 41, 7, 5f, 45, 56, 54, 9, 70, 47, 44, 41, 54, 60, 7b, 60, 1, 61, a0, 13, 93, 61, 1, 5c, 2f, 3, 5f, 53, 42, 5f, 43, 50, 55, 53, 43, 53, 43, 4e, 7b, 60, a, 2, 61, a0, 14, 93, 61, a, 2, 5c, 2f, 3, 5f, 53, 42, 5f, 4d, 48, 50, 43, 4d, 53, 43, 4e, 7b, 60, a, 4, 61, a0, 14, 93, 61, a, 4, 5c, 2f, 3, 5f, 53, 42, 5f, 50, 48, 50, 52, 50, 53, 43, 4e, 7b, 60, a, 8, 61, a0, 12, 93, 61, a, 8, 86, 5c, 2e, 5f, 53, 42, 5f, 50, 57, 52, 42, a, 80, 5b, 82, 4d, b, 2e, 5f, 53, 42, 5f, 50, 52, 45, 53, 8, 5f, 48, 49, 44, c, 41, d0, a, 6, 8, 5f, 55, 49, 44, d, 43, 50, 55, 20, 48, 6f, 74, 70, 6c, 75, 67, 20, 43, 6f, 6e, 74, 72, 6f, 6c, 6c, 65, 72, 0, 5b, 1, 43, 50, 4c, 4b, 0, 8, 5f, 43, 52, 53, 11, 33, a, 30, 8a, 2b, 0, 0, c, 1, 0, 0, 0, 0, 0, 0, 0, 0, 0, d0, fe, ff, ff, 3f, 0, 0, b, d0, fe, ff, ff, 3f, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, c, 0, 0, 0, 0, 0, 0, 0, 79, 0, 5b, 80, 50, 52, 53, 54, 0, e, 0, d0, fe, ff, ff, 3f, 0, 0, a, c, 5b, 81, 23, 50, 52, 53, 54, 41, 0, 20, 43, 50, 45, 4e, 1, 43, 49, 4e, 53, 1, 43, 52, 4d, 56, 1, 43, 45, 4a, 30, 1, 0, 4, 43, 43, 4d, 44, 8, 5b, 81, 12, 50, 52, 53, 54, 3, 43, 53, 45, 4c, 20, 0, 20, 43, 44, 41, 54, 20, 5b, 82, 4d, 6d, 2e, 5f, 53, 42, 5f, 43, 50, 55, 53, 8, 5f, 48, 49, 44, d, 41, 43, 50, 49, 30, 30, 31, 30, 0, 8, 5f, 43, 49, 44, c, 41, d0, a, 5, 14, 48, 5, 43, 53, 54, 41, 9, 5b, 23, 5c, 2f, 3, 5f, 53, 42, 5f, 50, 52, 45, 53, 43, 50, 4c, 4b, ff, ff, 70, 68, 5c, 2f, 3, 5f, 53, 42, 5f, 50, 52, 45, 53, 43, 53, 45, 4c, 70, 0, 60, a0, 16, 93, 5c, 2f, 3, 5f, 53, 42, 5f, 50, 52, 45, 53, 43, 50, 45, 4e, 1, 70, a, f, 60, 5b, 27, 5c, 2f, 3, 5f, 53, 42, 5f, 50, 52, 45, 53, 43, 50, 4c, 4b, a4, 60, 14, 4f, a, 43, 54, 46, 59, a, a0, b, 93, 68, a, 0, 86, 43, 30, 30, 30, 69, a0, b, 93, 68, a, 1, 86, 43, 30, 30, 31, 69, a0, b, 93, 68, a, 2, 86, 43, 30, 30, 32, 69, a0, b, 93, 68, a, 3, 86, 43, 30, 30, 33, 69, a0, b, 93, 68, a, 4, 86, 43, 30, 30, 34, 69, a0, b, 93, 68, a, 5, 86, 43, 30, 30, 35, 69, a0, b, 93, 68, a, 6, 86, 43, 30, 30, 36, 69, a0, b, 93, 68, a, 7, 86, 43, 30, 30, 37, 69, a0, b, 93, 68, a, 8, 86, 43, 30, 30, 38, 69, a0, b, 93, 68, a, 9, 86, 43, 30, 30, 39, 69, a0, b, 93, 68, a, a, 86, 43, 30, 31, 30, 69, a0, b, 93, 68, a, b, 86, 43, 30, 31, 31, 69, a0, b, 93, 68, a, c, 86, 43, 30, 31, 32, 69, a0, b, 93, 68, a, d, 86, 43, 30, 31, 33, 69, 14, 4d, 4, 43, 45, 4a, 30, 9, 5b, 23, 5c, 2f, 3, 5f, 53, 42, 5f, 50, 52, 45, 53, 43, 50, 4c, 4b, ff, ff, 70, 68, 5c, 2f, 3, 5f, 53, 42, 5f, 50, 52, 45, 53, 43, 53, 45, 4c, 70, 1, 5c, 2f, 3, 5f, 53, 42, 5f, 50, 52, 45, 53, 43, 45, 4a, 30, 5b, 27, 5c, 2f, 3, 5f, 53, 42, 5f, 50, 52, 45, 53, 43, 50, 4c, 4b, 14, 4f, 9, 43, 53, 43, 4e, 8, 5b, 23, 5c, 2f, 3, 5f, 53, 42, 5f, 50, 52, 45, 53, 43, 50, 4c, 4b, ff, ff, 70, 0, 60, a2, 40, 7, 95, 60, a, e, 70, 60, 5c, 2f, 3, 5f, 53, 42, 5f, 50, 52, 45, 53, 43, 53, 45, 4c, a0, 29, 93, 5c, 2f, 3, 5f, 53, 42, 5f, 50, 52, 45, 53, 43, 49, 4e, 53, 1, 43, 54, 46, 59, 60, 1, 70, 1, 5c, 2f, 3, 5f, 53, 42, 5f, 50, 52, 45, 53, 43, 49, 4e, 53, a0, 2a, 93, 5c, 2f, 3, 5f, 53, 42, 5f, 50, 52, 45, 53, 43, 52, 4d, 56, 1, 43, 54, 46, 59, 60, a, 3, 70, 1, 5c, 2f, 3, 5f, 53, 42, 5f, 50, 52, 45, 53, 43, 52, 4d, 56, 72, 60, 1, 60, 5b, 27, 5c, 2f, 3, 5f, 53, 42, 5f, 50, 52, 45, 53, 43, 50, 4c, 4b, 5b, 82, 45, 5, 43, 30, 30, 30, 8, 5f, 48, 49, 44, d, 41, 43, 50, 49, 30, 30, 30, 37, 0, 8, 5f, 55, 49, 44, a, 0, 14, d, 5f, 53, 54, 41, 0, a4, 43, 53, 54, 41, a, 0, 14, c, 5f, 50, 58, 4d, 0, a4, c, 0, 0, 0, 0, 8, 5f, 4d, 41, 54, 11, b, a, 8, 0, 8, 0, 0, 1, 0, 0, 0, 14, c, 5f, 45, 4a, 30, 1, 43, 45, 4a, 30, a, 0, 5b, 82, 45, 5, 43, 30, 30, 31, 8, 5f, 48, 49, 44, d, 41, 43, 50, 49, 30, 30, 30, 37, 0, 8, 5f, 55, 49, 44, a, 1, 14, d, 5f, 53, 54, 41, 0, a4, 43, 53, 54, 41, a, 1, 14, c, 5f, 50, 58, 4d, 0, a4, c, 0, 0, 0, 0, 8, 5f, 4d, 41, 54, 11, b, a, 8, 0, 8, 1, 1, 1, 0, 0, 0, 14, c, 5f, 45, 4a, 30, 1, 43, 45, 4a, 30, a, 1, 5b, 82, 45, 5, 43, 30, 30, 32, 8, 5f, 48, 49, 44, d, 41, 43, 50, 49, 30, 30, 30, 37, 0, 8, 5f, 55, 49, 44, a, 2, 14, d, 5f, 53, 54, 41, 0, a4, 43, 53, 54, 41, a, 2, 14, c, 5f, 50, 58, 4d, 0, a4, c, 0, 0, 0, 0, 8, 5f, 4d, 41, 54, 11, b, a, 8, 0, 8, 2, 2, 1, 0, 0, 0, 14, c, 5f, 45, 4a, 30, 1, 43, 45, 4a, 30, a, 2, 5b, 82, 45, 5, 43, 30, 30, 33, 8, 5f, 48, 49, 44, d, 41, 43, 50, 49, 30, 30, 30, 37, 0, 8, 5f, 55, 49, 44, a, 3, 14, d, 5f, 53, 54, 41, 0, a4, 43, 53, 54, 41, a, 3, 14, c, 5f, 50, 58, 4d, 0, a4, c, 0, 0, 0, 0, 8, 5f, 4d, 41, 54, 11, b, a, 8, 0, 8, 3, 3, 1, 0, 0, 0, 14, c, 5f, 45, 4a, 30, 1, 43, 45, 4a, 30, a, 3, 5b, 82, 45, 5, 43, 30, 30, 34, 8, 5f, 48, 49, 44, d, 41, 43, 50, 49, 30, 30, 30, 37, 0, 8, 5f, 55, 49, 44, a, 4, 14, d, 5f, 53, 54, 41, 0, a4, 43, 53, 54, 41, a, 4, 14, c, 5f, 50, 58, 4d, 0, a4, c, 0, 0, 0, 0, 8, 5f, 4d, 41, 54, 11, b, a, 8, 0, 8, 4, 4, 1, 0, 0, 0, 14, c, 5f, 45, 4a, 30, 1, 43, 45, 4a, 30, a, 4, 5b, 82, 45, 5, 43, 30, 30, 35, 8, 5f, 48, 49, 44, d, 41, 43, 50, 49, 30, 30, 30, 37, 0, 8, 5f, 55, 49, 44, a, 5, 14, d, 5f, 53, 54, 41, 0, a4, 43, 53, 54, 41, a, 5, 14, c, 5f, 50, 58, 4d, 0, a4, c, 0, 0, 0, 0, 8, 5f, 4d, 41, 54, 11, b, a, 8, 0, 8, 5, 5, 1, 0, 0, 0, 14, c, 5f, 45, 4a, 30, 1, 43, 45, 4a, 30, a, 5, 5b, 82, 45, 5, 43, 30, 30, 36, 8, 5f, 48, 49, 44, d, 41, 43, 50, 49, 30, 30, 30, 37, 0, 8, 5f, 55, 49, 44, a, 6, 14, d, 5f, 53, 54, 41, 0, a4, 43, 53, 54, 41, a, 6, 14, c, 5f, 50, 58, 4d, 0, a4, c, 0, 0, 0, 0, 8, 5f, 4d, 41, 54, 11, b, a, 8, 0, 8, 6, 6, 1, 0, 0, 0, 14, c, 5f, 45, 4a, 30, 1, 43, 45, 4a, 30, a, 6, 5b, 82, 45, 5, 43, 30, 30, 37, 8, 5f, 48, 49, 44, d, 41, 43, 50, 49, 30, 30, 30, 37, 0, 8, 5f, 55, 49, 44, a, 7, 14, d, 5f, 53, 54, 41, 0, a4, 43, 53, 54, 41, a, 7, 14, c, 5f, 50, 58, 4d, 0, a4, c, 0, 0, 0, 0, 8, 5f, 4d, 41, 54, 11, b, a, 8, 0, 8, 7, 7, 1, 0, 0, 0, 14, c, 5f, 45, 4a, 30, 1, 43, 45, 4a, 30, a, 7, 5b, 82, 45, 5, 43, 30, 30, 38, 8, 5f, 48, 49, 44, d, 41, 43, 50, 49, 30, 30, 30, 37, 0, 8, 5f, 55, 49, 44, a, 8, 14, d, 5f, 53, 54, 41, 0, a4, 43, 53, 54, 41, a, 8, 14, c, 5f, 50, 58, 4d, 0, a4, c, 0, 0, 0, 0, 8, 5f, 4d, 41, 54, 11, b, a, 8, 0, 8, 8, 8, 1, 0, 0, 0, 14, c, 5f, 45, 4a, 30, 1, 43, 45, 4a, 30, a, 8, 5b, 82, 45, 5, 43, 30, 30, 39, 8, 5f, 48, 49, 44, d, 41, 43, 50, 49, 30, 30, 30, 37, 0, 8, 5f, 55, 49, 44, a, 9, 14, d, 5f, 53, 54, 41, 0, a4, 43, 53, 54, 41, a, 9, 14, c, 5f, 50, 58, 4d, 0, a4, c, 0, 0, 0, 0, 8, 5f, 4d, 41, 54, 11, b, a, 8, 0, 8, 9, 9, 1, 0, 0, 0, 14, c, 5f, 45, 4a, 30, 1, 43, 45, 4a, 30, a, 9, 5b, 82, 45, 5, 43, 30, 31, 30, 8, 5f, 48, 49, 44, d, 41, 43, 50, 49, 30, 30, 30, 37, 0, 8, 5f, 55, 49, 44, a, a, 14, d, 5f, 53, 54, 41, 0, a4, 43, 53, 54, 41, a, a, 14, c, 5f, 50, 58, 4d, 0, a4, c, 0, 0, 0, 0, 8, 5f, 4d, 41, 54, 11, b, a, 8, 0, 8, a, a, 1, 0, 0, 0, 14, c, 5f, 45, 4a, 30, 1, 43, 45, 4a, 30, a, a, 5b, 82, 45, 5, 43, 30, 31, 31, 8, 5f, 48, 49, 44, d, 41, 43, 50, 49, 30, 30, 30, 37, 0, 8, 5f, 55, 49, 44, a, b, 14, d, 5f, 53, 54, 41, 0, a4, 43, 53, 54, 41, a, b, 14, c, 5f, 50, 58, 4d, 0, a4, c, 0, 0, 0, 0, 8, 5f, 4d, 41, 54, 11, b, a, 8, 0, 8, b, b, 1, 0, 0, 0, 14, c, 5f, 45, 4a, 30, 1, 43, 45, 4a, 30, a, b, 5b, 82, 45, 5, 43, 30, 31, 32, 8, 5f, 48, 49, 44, d, 41, 43, 50, 49, 30, 30, 30, 37, 0, 8, 5f, 55, 49, 44, a, c, 14, d, 5f, 53, 54, 41, 0, a4, 43, 53, 54, 41, a, c, 14, c, 5f, 50, 58, 4d, 0, a4, c, 0, 0, 0, 0, 8, 5f, 4d, 41, 54, 11, b, a, 8, 0, 8, c, c, 1, 0, 0, 0, 14, c, 5f, 45, 4a, 30, 1, 43, 45, 4a, 30, a, c, 5b, 82, 45, 5, 43, 30, 31, 33, 8, 5f, 48, 49, 44, d, 41, 43, 50, 49, 30, 30, 30, 37, 0, 8, 5f, 55, 49, 44, a, d, 14, d, 5f, 53, 54, 41, 0, a4, 43, 53, 54, 41, a, d, 14, c, 5f, 50, 58, 4d, 0, a4, c, 0, 0, 0, 0, 8, 5f, 4d, 41, 54, 11, b, a, 8, 0, 8, d, d, 1, 0, 0, 0, 14, c, 5f, 45, 4a, 30, 1, 43, 45, 4a, 30, a, d, 5b, 82, 4e, 4e, 2e, 5f, 53, 42, 5f, 4d, 48, 50, 43, 8, 5f, 48, 49, 44, c, 41, d0, a, 6, 8, 5f, 55, 49, 44, d, 4d, 65, 6d, 6f, 72, 79, 20, 48, 6f, 74, 70, 6c, 75, 67, 20, 43, 6f, 6e, 74, 72, 6f, 6c, 6c, 65, 72, 0, 5b, 1, 4d, 4c, 43, 4b, 0, 8, 5f, 43, 52, 53, 11, 33, a, 30, 8a, 2b, 0, 0, c, 1, 0, 0, 0, 0, 0, 0, 0, 0, 0, f0, fe, ff, ff, 3f, 0, 0, 17, f0, fe, ff, ff, 3f, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 18, 0, 0, 0, 0, 0, 0, 0, 79, 0, 5b, 80, 4d, 48, 50, 52, 0, e, 0, f0, fe, ff, ff, 3f, 0, 0, a, 18, 5b, 81, 1a, 4d, 48, 50, 52, 3, 4d, 48, 42, 4c, 20, 4d, 48, 42, 48, 20, 4d, 48, 4c, 4c, 20, 4d, 48, 4c, 48, 20, 5b, 81, e, 4d, 48, 50, 52, 3, 0, 40, 8, 4d, 48, 50, 58, 20, 5b, 81, 1d, 4d, 48, 50, 52, 41, 0, 40, a, 4d, 45, 4e, 5f, 1, 4d, 49, 4e, 53, 1, 4d, 52, 4d, 56, 1, 4d, 45, 4a, 30, 1, 5b, 81, 15, 4d, 48, 50, 52, 3, 4d, 53, 45, 4c, 20, 4d, 4f, 45, 56, 20, 4d, 4f, 53, 43, 20, 14, 47, 6, 4d, 54, 46, 59, a, a0, b, 93, 68, a, 0, 86, 4d, 30, 30, 30, 69, a0, b, 93, 68, a, 1, 86, 4d, 30, 30, 31, 69, a0, b, 93, 68, a, 2, 86, 4d, 30, 30, 32, 69, a0, b, 93, 68, a, 3, 86, 4d, 30, 30, 33, 69, a0, b, 93, 68, a, 4, 86, 4d, 30, 30, 34, 69, a0, b, 93, 68, a, 5, 86, 4d, 30, 30, 35, 69, a0, b, 93, 68, a, 6, 86, 4d, 30, 30, 36, 69, a0, b, 93, 68, a, 7, 86, 4d, 30, 30, 37, 69, 14, 49, 8, 4d, 53, 43, 4e, 8, 5b, 23, 4d, 4c, 43, 4b, ff, ff, 70, 0, 60, a2, 40, 7, 95, 60, a, 8, 70, 60, 5c, 2f, 3, 5f, 53, 42, 5f, 4d, 48, 50, 43, 4d, 53, 45, 4c, a0, 29, 93, 5c, 2f, 3, 5f, 53, 42, 5f, 4d, 48, 50, 43, 4d, 49, 4e, 53, 1, 4d, 54, 46, 59, 60, 1, 70, 1, 5c, 2f, 3, 5f, 53, 42, 5f, 4d, 48, 50, 43, 4d, 49, 4e, 53, a0, 2a, 93, 5c, 2f, 3, 5f, 53, 42, 5f, 4d, 48, 50, 43, 4d, 52, 4d, 56, 1, 4d, 54, 46, 59, 60, a, 3, 70, 1, 5c, 2f, 3, 5f, 53, 42, 5f, 4d, 48, 50, 43, 4d, 52, 4d, 56, 72, 60, 1, 60, 5b, 27, 4d, 4c, 43, 4b, 14, 42, 4, 4d, 53, 54, 41, 9, 5b, 23, 4d, 4c, 43, 4b, ff, ff, 70, 68, 5c, 2f, 3, 5f, 53, 42, 5f, 4d, 48, 50, 43, 4d, 53, 45, 4c, 70, 0, 60, a0, 16, 93, 5c, 2f, 3, 5f, 53, 42, 5f, 4d, 48, 50, 43, 4d, 45, 4e, 5f, 1, 70, a, f, 60, 5b, 27, 4d, 4c, 43, 4b, a4, 60, 14, 4f, 12, 4d, 43, 52, 53, 9, 5b, 23, 4d, 4c, 43, 4b, ff, ff, 70, 68, 5c, 2f, 3, 5f, 53, 42, 5f, 4d, 48, 50, 43, 4d, 53, 45, 4c, 8, 4d, 52, 36, 34, 11, 33, a, 30, 8a, 2b, 0, 0, c, 3, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, fe, ff, ff, ff, ff, ff, ff, ff, 0, 0, 0, 0, 0, 0, 0, 0, ff, ff, ff, ff, ff, ff, ff, ff, 79, 0, 8f, 4d, 52, 36, 34, a, e, 4d, 49, 4e, 4c, 8a, 4d, 52, 36, 34, a, 12, 4d, 49, 4e, 48, 8f, 4d, 52, 36, 34, a, 16, 4d, 41, 58, 4c, 8a, 4d, 52, 36, 34, a, 1a, 4d, 41, 58, 48, 8f, 4d, 52, 36, 34, a, 26, 4c, 45, 4e, 4c, 8a, 4d, 52, 36, 34, a, 2a, 4c, 45, 4e, 48, 70, 5c, 2f, 3, 5f, 53, 42, 5f, 4d, 48, 50, 43, 4d, 48, 42, 4c, 4d, 49, 4e, 4c, 70, 5c, 2f, 3, 5f, 53, 42, 5f, 4d, 48, 50, 43, 4d, 48, 42, 48, 4d, 49, 4e, 48, 70, 5c, 2f, 3, 5f, 53, 42, 5f, 4d, 48, 50, 43, 4d, 48, 4c, 4c, 4c, 45, 4e, 4c, 70, 5c, 2f, 3, 5f, 53, 42, 5f, 4d, 48, 50, 43, 4d, 48, 4c, 48, 4c, 45, 4e, 48, 72, 4d, 49, 4e, 4c, 4c, 45, 4e, 4c, 4d, 41, 58, 4c, 72, 4d, 49, 4e, 48, 4c, 45, 4e, 48, 4d, 41, 58, 48, a0, 14, 95, 4d, 41, 58, 4c, 4d, 49, 4e, 4c, 72, 1, 4d, 41, 58, 48, 4d, 41, 58, 48, 74, 4d, 41, 58, 4c, 1, 4d, 41, 58, 4c, 5b, 27, 4d, 4c, 43, 4b, a4, 4d, 52, 36, 34, 5b, 82, 32, 4d, 30, 30, 30, 8, 5f, 48, 49, 44, c, 41, d0, c, 80, 8, 5f, 55, 49, 44, a, 0, 14, d, 5f, 53, 54, 41, 0, a4, 4d, 53, 54, 41, a, 0, 14, d, 5f, 43, 52, 53, 0, a4, 4d, 43, 52, 53, a, 0, 5b, 82, 32, 4d, 30, 30, 31, 8, 5f, 48, 49, 44, c, 41, d0, c, 80, 8, 5f, 55, 49, 44, a, 1, 14, d, 5f, 53, 54, 41, 0, a4, 4d, 53, 54, 41, a, 1, 14, d, 5f, 43, 52, 53, 0, a4, 4d, 43, 52, 53, a, 1, 5b, 82, 32, 4d, 30, 30, 32, 8, 5f, 48, 49, 44, c, 41, d0, c, 80, 8, 5f, 55, 49, 44, a, 2, 14, d, 5f, 53, 54, 41, 0, a4, 4d, 53, 54, 41, a, 2, 14, d, 5f, 43, 52, 53, 0, a4, 4d, 43, 52, 53, a, 2, 5b, 82, 32, 4d, 30, 30, 33, 8, 5f, 48, 49, 44, c, 41, d0, c, 80, 8, 5f, 55, 49, 44, a, 3, 14, d, 5f, 53, 54, 41, 0, a4, 4d, 53, 54, 41, a, 3, 14, d, 5f, 43, 52, 53, 0, a4, 4d, 43, 52, 53, a, 3, 5b, 82, 32, 4d, 30, 30, 34, 8, 5f, 48, 49, 44, c, 41, d0, c, 80, 8, 5f, 55, 49, 44, a, 4, 14, d, 5f, 53, 54, 41, 0, a4, 4d, 53, 54, 41, a, 4, 14, d, 5f, 43, 52, 53, 0, a4, 4d, 43, 52, 53, a, 4, 5b, 82, 32, 4d, 30, 30, 35, 8, 5f, 48, 49, 44, c, 41, d0, c, 80, 8, 5f, 55, 49, 44, a, 5, 14, d, 5f, 53, 54, 41, 0, a4, 4d, 53, 54, 41, a, 5, 14, d, 5f, 43, 52, 53, 0, a4, 4d, 43, 52, 53, a, 5, 5b, 82, 32, 4d, 30, 30, 36, 8, 5f, 48, 49, 44, c, 41, d0, c, 80, 8, 5f, 55, 49, 44, a, 6, 14, d, 5f, 53, 54, 41, 0, a4, 4d, 53, 54, 41, a, 6, 14, d, 5f, 43, 52, 53, 0, a4, 4d, 43, 52, 53, a, 6, 5b, 82, 32, 4d, 30, 30, 37, 8, 5f, 48, 49, 44, c, 41, d0, c, 80, 8, 5f, 55, 49, 44, a, 7, 14, d, 5f, 53, 54, 41, 0, a4, 4d, 53, 54, 41, a, 7, 14, d, 5f, 43, 52, 53, 0, a4, 4d, 43, 52, 53, a, 7]
cloud-hypervisor: 104.794627ms: <vmm> INFO:arch/src/x86_64/tdx/mod.rs:377 -- Writing HOB ACPI table ff042ee8 HobGuidType { header: HobHeader { type: GuidExtension, length: 130, reserved: 0 }, name: EfiGuid { data1: 6a0c5870, data2: d4ed, data3: 44f4, data4: [a1, 35, dd, 23, 8b, 6f, c, 8d] } } [46, 41, 43, 50, 14, 1, 0, 0, 6, 99, 43, 4c, 4f, 55, 44, 48, 43, 48, 46, 41, 43, 50, 20, 20, 1, 0, 0, 0, 43, 4c, 44, 48, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 8, b0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 5, 10, 0, 1, 8, 0, 1, c0, 3, 0, 0, 0, 0, 0, 0, 1, 0, 0, 3, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 1, 20, 0, 4, 8, b0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 1, 8, 0, 1, c0, 3, 0, 0, 0, 0, 0, 0, 1, 8, 0, 1, c0, 3, 0, 0, 0, 0, 0, 0, f0, d2, d2, 85, c5, 7f, 0, 0]
Error booting VM: VmBoot(PopulateHob(GuestMemoryWriteHob(InvalidGuestAddress(GuestAddress(4278464512)))))

regression: Panic at Some(Entry point not found!) when secure-boot is enabled

INFO - panic ... PanicInfo { payload: Any { .. }, message: Some(Entry point not found!), location: Location { file: "td-shim/src/bin/td-shim/main.rs", line: 153, col: 61 } }

Add more tools to devtools/dev_container/Dockerfile and Makefile

Ref: #107 (comment)

We should add more tools to Dockerfile and Makefile, such as fuzzing (afl, libfuzzer, rudra, etc)

regression: td_payload: New assert in td-payload/src/main.rs", line: 103

This issue is found in commit hash 3a3bfe5

Run the latest code, it will show below exception message:

INFO - Starting td-payload hob - 0x3fa00000
INFO - setup_exception_handlers done
INFO - PhitHob:
INFO - version - 0x9
INFO - boot_mode - 0x0
INFO - efi_memory_top - 0x0000000040000000
INFO - efi_memory_bottom - 0x000000003d000000
INFO - efi_free_memory_top - 0x0000000040000000
INFO - efi_free_memory_bottom - 0x000000003d001000
INFO - efi_end_of_hob_list - 0x000000003fa00158
INFO - FirmwareVolume : 0x00000000ff084000 - 0x00000000ffcaefff
INFO - Cpu : mem size 36 , io size 16
INFO - MemoryAllocation 0x00000003 : 0x0000000001100000 - 0x0000000001d2afff
INFO - MemoryAllocation 0x00000004 : 0x0000000000800000 - 0x00000000008fffff
INFO - MemoryAllocation 0x00000004 : 0x000000003f000000 - 0x000000003f7fdfff
INFO - ResourceDescription 0x00000000 : 0x0000000000100000 - 0x000000003fffffff (0x00003c07)
INFO - ResourceDescription 0x00000000 : 0x0000000000000000 - 0x000000000009ffff (0x00003c07)
INFO - panic ... PanicInfo { payload: Any { .. }, message: Some(assertion failed: `(left == right)`
left: `1023410176`,
right: `1040187392`), location: Location { file: "td-payload/src/main.rs", line: 103, col: 9 } }

Failed to enable libfuzzer version 0.11.0

Rust has the cargo-fuzz library to call libfuzzer
I want to test td-loader.

$ cd td-loader
$ cargo fuzz init
$ cargo fuzz add elf
// td-loader/fuzz/fuzz_targets/elf.rs
#![no_main]
use libfuzzer_sys::fuzz_target;

use td_loader::elf;

fuzz_target!(|data: &[u8]| {
    // fuzzed code goes here
    let _ = elf::is_elf(data);
});

run elf

$ cargo fuzz run elf
fuzz@fuzz:~/td-shim/td-loader$ cargo fuzz run elf
   Compiling proc-macro2 v1.0.36
   Compiling unicode-xid v0.2.2
   Compiling syn v1.0.86
   Compiling log v0.4.14
   Compiling cc v1.0.73
   Compiling cfg-if v1.0.0
   Compiling arbitrary v1.1.0
   Compiling once_cell v1.9.0
   Compiling quote v1.0.15
   Compiling libfuzzer-sys v0.4.2
   Compiling scroll_derive v0.10.5
   Compiling scroll v0.10.2
   Compiling td-loader v0.1.0 (/home/fuzz/td-shim/td-loader)
warning: unknown pass `sancov-module`, ignoring

warning: `td-loader` (lib) generated 1 warning
   Compiling td-loader-fuzz v0.0.0 (/home/fuzz/td-shim/td-loader/fuzz)
warning: `td-loader-fuzz` (bin "elf") generated 1 warning (1 duplicate)
    Finished release [optimized] target(s) in 25.09s
warning: unknown pass `sancov-module`, ignoring

warning: `td-loader` (lib) generated 1 warning
warning: `td-loader-fuzz` (bin "elf") generated 1 warning (1 duplicate)
    Finished release [optimized] target(s) in 0.01s
     Running `fuzz/target/x86_64-unknown-linux-gnu/release/elf -artifact_prefix=/home/fuzz/td-shim/td-loader/fuzz/artifacts/elf/ /home/fuzz/td-shim/td-loader/fuzz/corpus/elf`
INFO: Running with entropic power schedule (0xFF, 100).
INFO: Seed: 383398225
INFO:        9 files found in /home/fuzz/td-shim/td-loader/fuzz/corpus/elf
INFO: -max_len is not provided; libFuzzer will not generate inputs larger than 4096 bytes
INFO: seed corpus: files: 9 min: 1b max: 40b total: 145b rss: 29Mb
#10     INITED exec/s: 0 rss: 30Mb
ERROR: no interesting inputs were found. Is the code instrumented for coverage? Exiting.
────────────────────────────────────────────────────────────────────────────────

Error: Fuzz target exited with exit status: 1

[Bug] Sections::parse and Files::parse offset require bounds checking

// td-shim/uefi-pi/src/fv.rs

offset value may be larger than sections_buffer length

// lines 78-84
impl<'a> Sections<'a> {
    pub fn parse(sections_buffer: &'a [u8], offset: usize) -> Option<Self> {
        Some(Sections {
            buffer: &sections_buffer[offset..],
        })
    }
}

fv_header_size value may be larger than fv_buffer length

// lines 78-84
impl<'a> Files<'a> {
    pub fn parse(fv_buffer: &'a [u8], fv_header_size: usize) -> Option<Self> {
        Some(Files {
            buffer: &fv_buffer[fv_header_size..],
        })
    }
}

Update readme and CI files to consistent with the flags change in PR 138

We will meet build issue on Windows if we follow current readme to set LLVM environment variable.

set CC_x86_64_unknown_uefi=clang
set AR_x86_64_unknown_uefi=llvm-ar

BTW, some CI files (format.yml integration.yml library.yml) also need to be updated.

Inconsistent interfaces compared to TDVF

TD Shim is described as a lightweight version of TDVF. In theory that should only mean it supports less features compared to what's supported by TDVF, but in practice we can see the interfaces are also different and the expectations on what can be passed from the VMM are different.
I think the goal is to be able to run both TDVF and TD Shim with the same internal implementation from the VMM, meaning that we can rely on the same interfaces.

Direct kernel boot

If we decide to support direct kernel boot by allowing Payload and PayloadParam as part of the TDVF section list for TD Shim, then the same mechanism should be supported by TDVF as well.

ACPI tables

TDVF supports any kind of ACPI table (both static and dynamic), but TD Shim only supports static ones, meaning the DSDT and SSDT can't be provided by the VMM.

@rbradford mentioned:

Not including the DSDT is, from my understanding, motivated by not wanting to support hotplug. However the DSDT serves multiple purposes in Cloud Hypervisor beyond hotplug:

PCI routing information
Serial port IRQ setup
Multiple PCI segment support
Specifying the value for the ACPI HW reduced shutdown register to trigger a shutdown
Power button triggering through GED

Further I think that it is possible to support PCI device hotplug with TDX.

The DSDT is specified as part of the FADT/FACP so the kernel will find it anyway if you give it the FADT table unless the TD shim to >manually create it's own RSDP and FADT tables.

A much simpler approach would be to just specify the RSDP address in the HOB (as per the TDVF based boot.)

We need some consistency on how ACPI tables are shared with TD Shim and TDVF, the address to the RSDP being the simplest one.

And the fact that TD Shim (because it doesn't support DSDT) requires a new table to be introduced in the ACPI spec (SPRT) feels like too much. If the requirement around not supporting dynamic table is about security, then either the VMM shouldn't expose a DSDT or the guest kernel shouldn't include the ASL/AML compiler. The requirement should not be part of the firmware itself.

Does TD-Shim support PVH-style direct kernel boot?

I couldn't find any information in this repo whether TD-Shim supports (or has plans to support) the PVH-style direct kernel boot, in addition to the traditional Linux Boot protocol.

For reference, PVH ABI is described here: https://xenbits.xen.org/docs/unstable/misc/pvh.html.

From what I understand, TD-Shim currently only supports the Linux Boot protocol (filling in the "zero page").

On the other hand, CloudHypervisor recently removed support for the Linux Boot protocol in favor of the PVH-style kernel boot: https://github.com/cloud-hypervisor/cloud-hypervisor/blob/95ca79974a32f3dab5987032361d0ecd2aa65512/release-notes.md#removed-functionality

At the same time, CloudHypervisor advertises its usage with TD-Shim: https://github.com/cloud-hypervisor/cloud-hypervisor/blob/072114d7c51fc42fd2a7b78a879018f13c8052e4/docs/intel_tdx.md#tdshim

This is confusing: how can TD-Shim be started with CloudHypervisor if TD-Shim doesn't support PVH and CloudHypervisor only supports PVH? Am I missing something?

Latest version "0.14.7" of crate x86_64 fails to build

Solve the problem temporarily by fixing crate version to "0.14.6": #12

error[E0658]: panicking in constant functions is unstable
--> C:\Users\gaojiaqi.cargo\registry\src\github.com-1ecc6299db9ec823\x86_64-0.14.7\src\addr.rs:547:5
|
547 | assert!(align.is_power_of_two(), "align must be a power of two");
| ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
|
= note: see issue #51999 rust-lang/rust#51999 for more information
= help: add #![feature(const_panic)] to the crate attributes to enable
= note: this error originates in the macro $crate::panic::panic_2015 (in Nightly builds, run with -Z macro-backtrace for more info)

[Bug] The 'integrity_check' of 'FfsFileHeader' should not be an hardcode value

The 'integrity_check' of 'FfsFileHeader' should not be a hardcode value. Refer to Platform Initialization Specification, Vol. 3 Chapter 3.2.3, it should be a checksum value.

Eg.
Line 64 integrity_check: 0xaae4, in td-shim/src/fv.rs.

regression: build failed, error[E0433]: failed to resolve: use of undeclared crate or module `td_layout`

Follow the compilation steps in the readme https://github.com/confidential-containers/td-shim/blob/3a3bfe5fbed2a1c942283fd9a8fcff2be6969514/README.md#build-tdshim will result in the following error:

error[E0433]: failed to resolve: use of undeclared crate or module `td_layout`
  --> td-shim/src/reset_vector.rs:10:5
   |
10 | use td_layout::build_time::TD_SHIM_RESET_VECTOR_SIZE;
   |     ^^^^^^^^^ use of undeclared crate or module `td_layout`

error[E0425]: cannot find value `TD_SHIM_RESET_VECTOR_SIZE` in this scope
  --> td-shim/src/reset_vector.rs:47:13
   |
47 |             TD_SHIM_RESET_VECTOR_SIZE + size_of::<ResetVectorHeader>() as u32,
   |             ^^^^^^^^^^^^^^^^^^^^^^^^^ not found in this scope

error[E0425]: cannot find value `TD_SHIM_RESET_VECTOR_SIZE` in this scope
  --> td-shim/src/reset_vector.rs:58:13
   |
58 |             TD_SHIM_RESET_VECTOR_SIZE + size_of::<CommonSectionHeader>() as u32,
   |             ^^^^^^^^^^^^^^^^^^^^^^^^^ not found in this scope

Some errors have detailed explanations: E0425, E0433.
For more information about an error, try `rustc --explain E0425`.
error: could not compile `td-shim` due to 3 previous errors

regression: HLT causes double exception

See code below in exception handle.

https://github.com/confidential-containers/td-shim/blob/staging/td-exception/src/interrupt.rs

fn deadloop() {
    // TBD: empty `loop {}` wastes CPU cycles
    #[allow(clippy::empty_loop)]
    loop {
        x86_64::instructions::interrupts::enable();
        x86_64::instructions::hlt();
    }
}

According to TDX spec, the HLT access should be done by VMCALL, instead of HLT instruction.

Using HLT directly will cause reentry to exception handle.

Convert build shell scripts into Makefile

Currently there are several shell scripts under sh_scripts to build/test the td-shim components, it would be better convert some of them into Makefile, so it would be easier to integrate with CI systems.

Switch to release versions of Rust build tools when possible

Right now, the stable version of the Rust toolchain is not sufficient to build td-shim.

This issue is to acknowledge that this is known and will be fixed when the stable tool chain is good enough.

See for example comments by @jodh-intel and @c3d, and response by @jyaho1 in #2 (comment)_

Make the global allocator thread safe

I have issues with memory ordering in the allocator as written.

For some reason, I updated a thread that was marked as "resolved", and it did not "unresolve" it. So here is a link to the comment in context, and here is a copy of that comment, because at least for me, the link to the resolved comment does not open it 😠 :

Original comment (slightly edited for clarity out of context)

The comment about the GlobalAlloc trait being unsafe is useful. Please add a link to this: https://doc.rust-lang.org/std/alloc/trait.GlobalAlloc.html.

But I'm sorry, I was actually referring to the unsafe wrapper and const-casting around used_heap and max_heap updates inside the implementation. In my opinion, the fact that the interface requires an unsafe impl does not mean that it's a good idea to add unsafe blocks inside (quite to the contrary, actually, you need to be double plus careful).

For instance, the original example in the URL above has things like:

        if self
            .remaining
            .fetch_update(SeqCst, SeqCst, |mut remaining| {
                if size > remaining {
                    return None;
                }
                remaining -= size;
                remaining &= align_mask_to_round_down;
                allocated = remaining;
                Some(remaining)
            })
            .is_err()

That sample implementation takes full advantage of the Rust type system, and is actually somewhat safer than yours. As you can see, it does not actually use any unsafe block (what I referred to), only unsafe interfaces.

Here are a few things I see as at least potentially problematic in your code:

• It is not thread safe, because it uses regular additions (with no obvious locking) instead of atomic operations. The sample code does use fetch_update, which is atomic.
• It is also not thread safe because it splits tests and the consequence of the tests (this is related to the above). For example, the if self.max_heap < self.used_heap condition could be true on thread 1, then thread 2 does an allocation, updates max_heap to some larger value than what you have, and by the time you do your assignment below, you overwrite the max_heap field with a bogus value. See below details of the sequence.

In short, either you tell me that this code is strictly single-threaded, or that it only deals with allocators that cannot possibly be shared between two threads, and then you have to put a fat large comment explaining that. Or your code is wrong as written. I don't know which one it is 😉.

Here is a possible (and likely) sequence of events for the code as written (illustrated with the second if in alloc, but alloc has at least two instances of this problem and dealloc at least one, probably two. Let's assume two threads A and B.

Thread A	Thread B	used_heap	max_heap	Comment
alloc(13)	alloc(17)	0	0	Two threads enter alloc
x = 13	x = 17	0	0	Each thread reads layout.size()
y = 0	y = 0	0	0	A reads used_heap, so does B
z = 13	z = 17	0	0	A and B both compute new used_heap value
write z	write z	17	0	A and B both write the value. B writes last, so used_heap is now 17.
t = 0	t = 0	17	0	A and B both read max_heap to be 0
if t < z checking 0 < 13	if t < z checking 0 < 17	17	0	OOOPS A may still use some cached / optimized value of used_heap, since unsafe blocks or functions have no impact on memory ordering semantics AFAICT.
A writes 13 in max_heap	B writes 17 in max_heap	17	13	OOOPS You were unlucky, this time A happens to write last, so now you have an inconsistent internal state

So what I need is:

• Either a comment explaining why the above was carefully considered and cannot possibly happen, for example because you know your code only works on the boot CPU and there is no AP yet.
• Or a rewrite of that code to use atomics properly

Originally posted by @c3d in #2 (review)

Combine elf-loader/pe-loader into td-loader

Combine elf-loader/pe-loader into td-loader, so we have little crates to manage.