From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from mga07.intel.com (mga07.intel.com [134.134.136.100]) by mx.groups.io with SMTP id smtpd.web11.1120.1641867879611092104 for ; Mon, 10 Jan 2022 18:24:40 -0800 Authentication-Results: mx.groups.io; dkim=fail reason="unable to parse pub key" header.i=@intel.com header.s=intel header.b=cdg2PQNl; spf=pass (domain: intel.com, ip: 134.134.136.100, mailfrom: min.m.xu@intel.com) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=intel.com; i=@intel.com; q=dns/txt; s=Intel; t=1641867879; x=1673403879; h=from:to:cc:subject:date:message-id:references: in-reply-to:content-transfer-encoding:mime-version; bh=d/dGiX9KNNUWt9TSKBZama5GO53u9F9WJy3mH3UWEv4=; b=cdg2PQNlErO/LHK9XXp8Oe9pzr+3ZWk/twsQHfvh6adqGo+iHpWBroQ+ DJvLJbI9RSHjp1yBd3DqE1AKPuwm3522zMHO877WJpN7M/MBvlXUKDbSv szGjJKHJEGPkpw7DvGqL5dB3mKKKk+CKQJEpdIZhP2iWlDNhw2ECEwP5n lbVA1sCLZLkKDfo1wzwKmYo37qBaKRFZ8v1v9aVFqG2kH4tlpTPifTaSx UXGrxUvM3jDi33qGfcdExf1VKR81ohH97TV87MNI9JL5pRhlQ5XnZNASu yz+cbDv4uiKff/a0hjCFCq+8nHPfwEog8+u64wn4njTbFnbrhS1yP7rYm w==; X-IronPort-AV: E=McAfee;i="6200,9189,10223"; a="306736790" X-IronPort-AV: E=Sophos;i="5.88,278,1635231600"; d="scan'208";a="306736790" Received: from fmsmga008.fm.intel.com ([10.253.24.58]) by orsmga105.jf.intel.com with ESMTP/TLS/ECDHE-RSA-AES256-GCM-SHA384; 10 Jan 2022 18:24:38 -0800 X-ExtLoop1: 1 X-IronPort-AV: E=Sophos;i="5.88,278,1635231600"; d="scan'208";a="576034034" Received: from fmsmsx601.amr.corp.intel.com ([10.18.126.81]) by fmsmga008.fm.intel.com with ESMTP; 10 Jan 2022 18:24:38 -0800 Received: from fmsmsx605.amr.corp.intel.com (10.18.126.85) by fmsmsx601.amr.corp.intel.com (10.18.126.81) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256) id 15.1.2308.20; Mon, 10 Jan 2022 18:24:37 -0800 Received: from fmsedg602.ED.cps.intel.com (10.1.192.136) by fmsmsx605.amr.corp.intel.com (10.18.126.85) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256) id 15.1.2308.20 via Frontend Transport; Mon, 10 Jan 2022 18:24:37 -0800 Received: from NAM11-CO1-obe.outbound.protection.outlook.com (104.47.56.170) by edgegateway.intel.com (192.55.55.71) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.1.2308.20; Mon, 10 Jan 2022 18:24:37 -0800 ARC-Seal: i=1; a=rsa-sha256; s=arcselector9901; d=microsoft.com; cv=none; b=cicv3wpZEsOuMcsLcQsj4tqEqSzp1MBPZJfdHVVOZoQj/7AA78U/02/MKPk/+MRNLX8xHD4o0mBS35+w/30h2xQGbvxZV+zGs+h3/n1iWMLxIt0engeFfumUJJj+AQFsF65i4gu+19HFls2ZyITX/J+4r0rWTtfkc30jJrJfkX+Ly8ZTnYz0DSMBO1ubD2Npl9P6WlbLdZAd5gA6Dc9ZURoAUQx2QW2TsawxaXB7+4z9818IE1Ur/b/1rV4tKOC4kBS3mapxtMU9RDeFjhPMr62jUfzF1W5w6ItUp0TzSixLcA90z9/Jmx3LRkpKQLidBxItqNQrYKubY/VKrtKvYA== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=arcselector9901; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-AntiSpam-MessageData-ChunkCount:X-MS-Exchange-AntiSpam-MessageData-0:X-MS-Exchange-AntiSpam-MessageData-1; bh=Lmxu0XRslMsJOD+2Xpk2W76DHVrnqlrB1/iwBfWJZlY=; b=DmDxqMVAZeVnPgA4IPYSf8yiBxpZn11qZ50V3kcAS9RoruPIiAzqd3J8hEBEDQBVYUSxkRpASXh6ReXtE1vROge6NcJgt7pujUJHrsD6g0FBdWP3r42neY/eTjI68Z2aBORhAaPu/lak0qQwlSbLVOcHT6kPUq7LInwq21/QN53k1xzNLPvpPeWawcZrivyL3goe0qMIKiIGxx+/+0Zq4q+RYj+DOjL3lY/RLLtpCo/spbvXeI0NMFnKEb+xnKtvUfdl8GcTMqYhrI6BL7sEtaaCpvAlist+ARUFwCrBzPZtruY94sawLxFOXBCv5yCTrzsl3WMnmE9yPJlUJI2lsA== ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=pass smtp.mailfrom=intel.com; dmarc=pass action=none header.from=intel.com; dkim=pass header.d=intel.com; arc=none Received: from PH0PR11MB5064.namprd11.prod.outlook.com (2603:10b6:510:3b::15) by PH0PR11MB5080.namprd11.prod.outlook.com (2603:10b6:510:3f::23) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.4867.9; Tue, 11 Jan 2022 02:24:36 +0000 Received: from PH0PR11MB5064.namprd11.prod.outlook.com ([fe80::fd42:b334:5030:af8d]) by PH0PR11MB5064.namprd11.prod.outlook.com ([fe80::fd42:b334:5030:af8d%5]) with mapi id 15.20.4867.012; Tue, 11 Jan 2022 02:24:36 +0000 From: "Min Xu" To: "kraxel@redhat.com" CC: "devel@edk2.groups.io" , "Kinney, Michael D" , Brijesh Singh , "Aktas, Erdem" , James Bottomley , "Yao, Jiewen" , Tom Lendacky Subject: Re: [edk2-devel] [PATCH 08/10] OvmfPkg: Update Sec to support Tdvf Config-B Thread-Topic: [edk2-devel] [PATCH 08/10] OvmfPkg: Update Sec to support Tdvf Config-B Thread-Index: AQHX8PBp3T4AYRIE0EySqY5nWcpMV6wzWvSAgAGrRwCAAClsgIAD7/RAgAI0B4CAAsQ50IAS9rgAgAYeU7CABOAhgIABKqRQ Date: Tue, 11 Jan 2022 02:24:36 +0000 Message-ID: References: <20211214134126.869-1-min.m.xu@intel.com> <20211214134126.869-9-min.m.xu@intel.com> <20211215102753.m4bp56bdxzgmdzkr@sirius.home.kraxel.org> <20211216142525.pkaxszwaevlpg4ap@sirius.home.kraxel.org> <20211220121145.aiqcqs6vd2hb2sb4@sirius.home.kraxel.org> <20220103080218.ap7tktgh4fuvw6sf@sirius.home.kraxel.org> <20220110075537.2dxghysjlz5rmwhm@sirius.home.kraxel.org> In-Reply-To: <20220110075537.2dxghysjlz5rmwhm@sirius.home.kraxel.org> Accept-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: dlp-product: dlpe-windows dlp-reaction: no-action dlp-version: 11.6.200.16 authentication-results: dkim=none (message not signed) header.d=none;dmarc=none action=none header.from=intel.com; x-ms-publictraffictype: Email x-ms-office365-filtering-correlation-id: 18b6be9d-a92d-4f9a-7b3c-08d9d4a9833b x-ms-traffictypediagnostic: PH0PR11MB5080:EE_ x-ld-processed: 46c98d88-e344-4ed4-8496-4ed7712e255d,ExtAddr x-microsoft-antispam-prvs: x-ms-oob-tlc-oobclassifiers: OLM:10000; x-ms-exchange-senderadcheck: 1 x-ms-exchange-antispam-relay: 0 x-microsoft-antispam: BCL:0; x-microsoft-antispam-message-info: C4/oXK9eF5GU3xX3Bi0wTY9x5OWBqtm/OwJCEAX5aQJHYxPyG0uAWVnNqBSIyuVolck8MO7qSX4IRIh5zUuNveedI/OAF73SE+3HLf0ePV8pMTnLK3phlTq8k9wGBls3OJ5/qyoTskAM26h2AXzx2LQvB7Szbh79XBnuCF7VhnWOxOV6izNfV5S2Ysbzwe1Grtjoa0iweHQmvQAlKLn92nMsYFvthJrakR2BEkjuR0ZVWW3DCSjRS/Hwn4O33q272BmSr2m4iYNQfNbO4+wdRa49tQofWX9m7I7ug1/U9uwhlR7u862u2XNyBeCqvn6mbL6jNQ4PRoM+E87DsgjIIWxW7AUd053y4JhA7+ab7dAUX0ib8LKpnIpMU2cXbCnhx3ZyFVBEGDu9NkGEDGGIt7jSUhojBAsTni/Gow7Sfw9i9XCQXkMWvut/k1IHAjA3PVDIG5HqI2L6pWg5lDlMkIptdA6DKzOaIcz6uuwo4d3M7Vrh3IMtWyqvIE3Z/UEhgM+WeMlatUFw/qtXom3xdElW4sZbc0ZXh1Zj4ghxsJp51owfKfGLK+0YLPoDC7MRHdDcG2CU+Uh/8QwF8JSU+aQh8Yv0raNjCaLfqoFH8FO67VFU5cAbyTTXpVEOsBLiRp9Rh15Sz4qlS5UIXhGr0Ll2W3l2OpsOzUA1hFC4mzd92EWCFBGmevZi5O1znHWIriruku0MDZIz8qS4ZWw6xQ== x-forefront-antispam-report: CIP:255.255.255.255;CTRY:;LANG:en;SCL:1;SRV:;IPV:NLI;SFV:NSPM;H:PH0PR11MB5064.namprd11.prod.outlook.com;PTR:;CAT:NONE;SFS:(366004)(66946007)(33656002)(66476007)(8936002)(76116006)(66446008)(55016003)(66556008)(8676002)(19627235002)(38100700002)(186003)(71200400001)(508600001)(6916009)(122000001)(4326008)(2906002)(86362001)(316002)(26005)(9686003)(83380400001)(6506007)(52536014)(7696005)(82960400001)(54906003)(38070700005)(5660300002)(64756008);DIR:OUT;SFP:1102; x-ms-exchange-antispam-messagedata-chunkcount: 1 x-ms-exchange-antispam-messagedata-0: =?us-ascii?Q?MTHnjHQxh4HdwRJcw5CiTXuNY5P8ui+NJfYGU8Up/9Vrcs5YW97L+IuzxatN?= =?us-ascii?Q?bZqgHwTJKE35/j2FZW+JkzTf7WIQByj1e0YKV06O3DGNrUb4caZBAI0dk0AK?= =?us-ascii?Q?PMtiRyipPyGBnqnicgk+vg0dHWwG5HsDw05doG5ankGkirHWS21nVNBymK+G?= =?us-ascii?Q?qKnrA/4onjm+L5IjodFlKskhqLbnuhqqQdQuV1uXwhXbZ9wAg749254em9lJ?= =?us-ascii?Q?HguhW77AFtVSYi3DYyWa0MBwxIdJAfWKq4HswZ6VydDBALd7NsLvguuNhp+H?= =?us-ascii?Q?Awv0/7+w3DPL+x8TVlQfSWvH+x23woXksB8c+gidj9wnUm865yrIYa0JlNzU?= =?us-ascii?Q?MZTXNy7uGa96yAmQsoLfLhmVKlxdBJYgGddb62XdIxNiDT7SLNXe+OgH0KQC?= =?us-ascii?Q?RAHXWcyByOjIBQzJ9jDILb8CWO2irbJedZp00556f9abVrsvKXki2rZKqEGG?= =?us-ascii?Q?bJwAoyiYFEoFw+n0VP6wT7xRv64AYS/tE3jdmiIY3gIYUBVfQNpucSfeZZbW?= =?us-ascii?Q?O23t6dqDUNoJ8+Q1j8Zfl2CWSCsyTEAMxbQ6nyzZZseALlrW7g4qtbz5p27K?= =?us-ascii?Q?T3pPOPwx67S3Jprb1GT27RdYFMqkUXLdwiULTr40SQ/ZSmdZihGRKg4/R6Eb?= =?us-ascii?Q?EGHmKkGHQ10qMbhRl0OqTlWH+fNUC0IDtimJjSzIreKPEFTHGvG/R+yi/+pP?= =?us-ascii?Q?rpW9ipZF1eyrtG5QiRddT+190XXo+jzi0dq9z62eChxPVTFmGYZ3OhHWT18c?= =?us-ascii?Q?G7ShxXwGfYouWllrr+x0Vv6by3PTzqr7BAGh3Zb6K+qAr82j+fuFp9qa++T7?= =?us-ascii?Q?X23ahDL/VBci+GPctMrsVXbSZOQTNXgl4e2D3ar+mPdPF0yRq5ENszt5MIlm?= =?us-ascii?Q?CdsAtfv1cXh8LWmRSTbuHOQM8aK0UriqlI6mG85xcChcGwPLFDRpaI4Bj9aj?= =?us-ascii?Q?MKA9w2UsXAtIWSwqPXe/f+rE3NW4HTl4y8EaY9gle7JHjMFE/IKjhi0zxw0+?= =?us-ascii?Q?7Xj+zLccET2s3sti073PETpn7ELuVfr7ebxyO3PzaB+Cw2u6bgGggj4X5Fc/?= =?us-ascii?Q?IhO/wE6Ja/Q06MfKO8KQR31gmcK9hAU/kxT0Vo7NR/58OF2XA8zrzz2HH9kD?= =?us-ascii?Q?y/bBGDYQWG5L4QSVrTszZwu8PtPcC4Drr00PE2I6BHtl2oNIIeNFqryDOTz5?= =?us-ascii?Q?jipQOK/X3FCR+IDYnYgJBFTZ9e785xcQSXhIHqVY6JSDbNIO5sJz6j+9buOm?= =?us-ascii?Q?JzvCdlSo5cvowIlfm/eO+4Do6RbEI0i8Yd6GqEyO813Luxj38um5DzvgQ+NL?= =?us-ascii?Q?2mZEyA7jCzHLwDY8jqCvJmBgbJsFTrl97cMEFa2sGVXpMLehlawgne6ktKK4?= =?us-ascii?Q?ur1T4GDxuWGYvmdpCCESQCVb7JsYbwbw9cxSB3JeniqW0JKKPS4yvs38LQ+9?= =?us-ascii?Q?gC7HagvwsPM1ycj0HkpsPr6KOginnfVt02V7mfAwU+WQnLBAeqOBIEvn9JRP?= =?us-ascii?Q?efXYTdr3IBUSAySB6/nvPp/1uzn0rlvF0FdBuXXNAMC8iKAoOPPXx53t8g7u?= =?us-ascii?Q?6LQ+xIfpzddLsgPBwi6NXfYjm5KGgJpcGDDvfaM3RJmkFDI5+DCrlwJsHg+E?= =?us-ascii?Q?KA9tZELo5ecEtqDgq3H38MU=3D?= MIME-Version: 1.0 X-MS-Exchange-CrossTenant-AuthAs: Internal X-MS-Exchange-CrossTenant-AuthSource: PH0PR11MB5064.namprd11.prod.outlook.com X-MS-Exchange-CrossTenant-Network-Message-Id: 18b6be9d-a92d-4f9a-7b3c-08d9d4a9833b X-MS-Exchange-CrossTenant-originalarrivaltime: 11 Jan 2022 02:24:36.5054 (UTC) X-MS-Exchange-CrossTenant-fromentityheader: Hosted X-MS-Exchange-CrossTenant-id: 46c98d88-e344-4ed4-8496-4ed7712e255d X-MS-Exchange-CrossTenant-mailboxtype: HOSTED X-MS-Exchange-CrossTenant-userprincipalname: sKuoqqGgLVV8QaaRlYMnKQO0JtNeJiqN6i5ukerbNinlWA7qnAeJh0IPVFvELOgLrOsbp5KDGQDZbIGvnTdC5w== X-MS-Exchange-Transport-CrossTenantHeadersStamped: PH0PR11MB5080 Return-Path: min.m.xu@intel.com X-OriginatorOrg: intel.com Content-Language: en-US Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: quoted-printable On January 10, 2022 3:56 PM, Gerd Hoffmann wrote: > On Fri, Jan 07, 2022 at 06:13:37AM +0000, Xu, Min M wrote: > > On January 3, 2022 4:02 PM, Gerd Hoffmann wrote: > > > > > > > PCDs cannot be set in SEC phase, so the values should be saved in > > > > a Hob (for example, PLATFORM_INFO_HOB). In early DXE phase these > > > > values are set to the PCDs. This is how TdxDxe does today. > > > > > > > > Other tasks can be done in SEC phase. I think there should be a > > > > lib (for example, PlatformPeiLib) to wrap these functions so that > > > > they can be re-used by OvmfPkg/PlatformPei. > > > > > > Yes, I think we need a PlatformLib for the platform initialization > > > code. With PEI we would simply link the lib into PlatformPei, > > > without PEI we would link parts of the lib into SEC and parts of the = lib into > DXE. >=20 > > After carefully study the PlatformPei code and a quick PoC > > (PlatformInitLib which wraps the basic functions in PlatformPei), I > > found it's not a easy task for such a lib which can be used in both > > PlatformPei and Pei-less boot. >=20 > > 1. PlatformInitLib should work both in SEC and PEI. So it cannot use > > global variables between different functions. mHostBridgeDevId and > > mPhysMemAddressWidth are the examples. So these variables must be > > provided by the caller thru the input function parameters. >=20 > > 2. PlatformInitLib cannot set PCDs in the code. So a Guid hob should > > be created to store the PCDs and pass them to DXE phase. Then these > > PCDs will be set at the very beginning of DXE phase. >=20 > Yes. Your patches add a PlatformInitHob because of that. I think right = now it > only has some tdx-specific variables, but we can move more variables into= the > hob to allow platform init code run in both SEC and PEI phase. I think i= t makes > sense to have the hob in both PEI and PEI-less mode to minimize the code > differences. Yes, we can use EFI_HOB_PLATFORM_INFO. >=20 > > 4. In PlatformPei there are many if-else to check if it is > > SMM/S3/Microvm/Cloud-Hypervisor/SEV/TDX. There are also Bhyve and > Xen > > PlatformPei variants. In the current PlatformPei those if-else check > > depends on the PCDs and global variables. Because of (1) it needs > > input parameters for all these if-else check. Maybe a big environment > > variable data structure is needed. >=20 > Use PlatformInitHob? Yes, we can use this data structure. >=20 > > But anyway a complete functional PlatformInitLib is a big task. My > > suggestion is that in TDVF-Config-B we first propose a basic > > functional PlatformInitLib. This lib can boot up Tdx guest and legacy > > OVMF guest in TDVF-Config-B. OvmfPkg/PlatformPei is not refactored by > > this basic PlatformInitLib this time. >=20 > Well. The whole point of adding PlatformInitLib is to move over (and ref= actor if > needed) existing code in PlatformPei so we can avoid code duplication. N= ow > you want add PlatformInitLib without touching PlatformPei, probably by > copying code. That doesn't make sense at all. >=20 > > This is because PlatformPei serves > > SMM/S3/Microvm/Cloud-Hypervisor/SEV/TDX. It is a big risk for such > > refactor. We can revisit PlatformPei in the future. >=20 > Well, if you want avoid the refactoring because of the risk there is stil= l the > option to have tdx config-b use the normal PEI boot flow. > Then revisit refactoring and adding support for PEI-less boot later. >=20 I think it still makes sense (Adding a basic PlatformInitLib which brings u= p tdx guest and legacy guest in Pei-less boot, but not touch PlatformPei). 1. The goal of TDVF-Config-B is to bring up tdx guest and legacy guest with= out PEI. So that attack surface can be reduced. 2. There are common functions when bring up tdx guest and legacy guest in C= onfig-B. So PlatformInitLib is necessary. 3. As I explained there are many if-else checks in PlatformPei and the logi= cs are rather complicated (because PlatformPei serves S3/SMM/SEV/TDX/Legacy= /Microvm/CloudHypervisor, etc). To be honest I have not so much confidence = to abstract PlatformPei's common function to PlatformInitLib. 4. But a basic version of PlatformInitLib is a good start. During the devel= opment and community review, we can understand better what functions should= be wrapped into PlatformInitLib. After that PlatformInitLib can be evolved= for OvmfPkg/PlatformPei, Bhyve/PlatformPei, XenPlatformPei. Thanks Min