From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from mga07.intel.com (mga07.intel.com [134.134.136.100]) by mx.groups.io with SMTP id smtpd.web08.3858.1650328002343868729 for ; Mon, 18 Apr 2022 17:26:42 -0700 Authentication-Results: mx.groups.io; dkim=fail reason="unable to parse pub key" header.i=@intel.com header.s=intel header.b=YR+5ctz1; spf=pass (domain: intel.com, ip: 134.134.136.100, mailfrom: min.m.xu@intel.com) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=intel.com; i=@intel.com; q=dns/txt; s=Intel; t=1650328002; x=1681864002; h=from:to:cc:subject:date:message-id:mime-version: content-transfer-encoding; bh=zFuHS2kkjawnXgxNGpIrHYsdEslBuzp3+7kAbjpqniQ=; b=YR+5ctz1jZU5cJMnAmmCXSqNz+PfolmNadIZR40blrMZaay8Ew9HZ36t 0Argpnuz4VT3giAhB7i/vT7us5OZpOpaDN7cyrCNU32U5Wxu1lbLutDSp U0W6qejfzaf6VYlDr6C0FRhiXPptLGj9LxXhG5NhS4TofoBUI08DpRD62 S4nUfjjgKsEej0qXm+6CUsPtPvw0v+XhcRcw5HvUyW/pVmLCW8c1AQOAc zUaTCjqqwqPJVLgLgYKohoO4FKEYhowTTn9xvd6PxdWk/gzY0oYzQu7by 6Q90jo/ifFWdQEKcvRsIlQpREPJ3m1tUKrhLlbt7BPzOk9O9rl2l7pqsC w==; X-IronPort-AV: E=McAfee;i="6400,9594,10321"; a="326540288" X-IronPort-AV: E=Sophos;i="5.90,271,1643702400"; d="scan'208";a="326540288" Received: from orsmga006.jf.intel.com ([10.7.209.51]) by orsmga105.jf.intel.com with ESMTP/TLS/ECDHE-RSA-AES256-GCM-SHA384; 18 Apr 2022 17:26:41 -0700 X-IronPort-AV: E=Sophos;i="5.90,271,1643702400"; d="scan'208";a="529079924" Received: from mxu9-mobl1.ccr.corp.intel.com ([10.249.171.121]) by orsmga006-auth.jf.intel.com with ESMTP/TLS/ECDHE-RSA-AES256-GCM-SHA384; 18 Apr 2022 17:26:38 -0700 From: "Min Xu" To: devel@edk2.groups.io Cc: Min Xu , Michael D Kinney , Liming Gao , Zhiguang Liu , James Bottomley , Jiewen Yao , Gerd Hoffmann , Brijesh Singh , Erdem Aktas , Tom Lendacky Subject: [PATCH V4 0/7] Introduce CcProbe in MdePkg Date: Tue, 19 Apr 2022 08:26:21 +0800 Message-Id: X-Mailer: git-send-email 2.29.2.windows.2 MIME-Version: 1.0 Content-Transfer-Encoding: 8bit BZ: https://bugzilla.tianocore.org/show_bug.cgi?id=3902 Bad IO performance in SEC phase is observed after TDX features was introduced. (after commit b6b2de884864 - "MdePkg: Support mmio for Tdx guest in BaseIoLibIntrinsic"). This is because IsTdxGuest() will be called in each MMIO operation. It is trying to cache the result of the probe in the efi data segment. However, that doesn't work in SEC, because the data segment is read only (so the write seems to succeed but a read will always return the original value), leading to us calling TdIsEnabled() check for every mmio we do, which is causing the slowdown because it's very expensive. CcProbe is introduced in this patch-set. It is called in BaseIoLibIntrinsicSev instead of IsTdxGuest. There are 2 versions of the CcProbeLib. Null instance of CcProbe always returns CCGuestTypeNonEncrypted. Its OvmfPkg version checks the Ovmf work area and returns the CC guest type. In this patch-set another issue is fixed with CcProbe as well. If the working guest is SEV and in the beginning of SecMain.c TdIsEnabled() was called. At this point, exception handling is not established and a CPUID instruction will generate a #VC and cause the booting SEV guest to crash. Patch #7 is to fix this broken. Code is at: https://github.com/mxu9/edk2/tree/cc_probe.v4 v4 changes: - Rename the field name in CC_GUEST_TYPE from CCXxx to CcXxx based on the community feedback. v3 changes: - Fix the broken issue in SEV guest at SecMain.c. Please refer to Patch #7. v2 changes: - Rename TdProbe to CcProbe to make the lib work for Confidential Computing guests. - Rename the GUEST_TYPE to CC_GUEST_TYPE and move it from WorkArea.h@OvmfPkg to ConfidentialComputingGuestAttr.h@MdePkg. This is because CcProbeLib is designed to return the CC Guest type and the lib is located at MdePkg. - Rename the CC_GUEST_TYPE's fields name to Camel style. See the commit message in patch #1. Cc: Michael D Kinney Cc: Liming Gao Cc: Zhiguang Liu Cc: James Bottomley Cc: Jiewen Yao Cc: Gerd Hoffmann Cc: Brijesh Singh Cc: Erdem Aktas Cc: Tom Lendacky Signed-off-by: Min Xu Min Xu (7): MdePkg: Add CC_GUEST_TYPE in ConfidentialComputingGuestAttr.h OvmfPkg: Replace GUEST_TYPE with CC_GUEST_TYPE MdePkg: Add CcProbeLibNull OvmfPkg: Add CcProbeLib OvmfPkg: Add CcProbeLib in *.dsc MdePkg: Probe Cc guest in BaseIoLibIntrinsicSev OvmfPkg: Call CcProbe in SecMain.c instead of TsIsEnabled .../Include/ConfidentialComputingGuestAttr.h | 11 ++++++- MdePkg/Include/Library/CcProbeLib.h | 26 ++++++++++++++++ .../BaseIoLibIntrinsicSev.inf | 1 + .../BaseIoLibIntrinsic/IoLibInternalTdx.c | 13 ++------ .../Library/CcProbeLibNull/CcProbeLibNull.c | 26 ++++++++++++++++ .../Library/CcProbeLibNull/CcProbeLibNull.inf | 21 +++++++++++++ MdePkg/MdePkg.dec | 5 +++ MdePkg/MdePkg.dsc | 1 + OvmfPkg/AmdSev/AmdSevX64.dsc | 1 + OvmfPkg/Bhyve/BhyveX64.dsc | 1 + OvmfPkg/CloudHv/CloudHvX64.dsc | 1 + OvmfPkg/Include/WorkArea.h | 9 +----- OvmfPkg/IntelTdx/IntelTdxX64.dsc | 1 + OvmfPkg/IntelTdx/Sec/SecMain.c | 6 ++-- OvmfPkg/IntelTdx/Sec/SecMain.inf | 1 + .../PeiMemEncryptSevLibInternal.c | 2 +- .../SecMemEncryptSevLibInternal.c | 2 +- OvmfPkg/Library/CcProbeLib/CcProbeLib.c | 31 +++++++++++++++++++ OvmfPkg/Library/CcProbeLib/CcProbeLib.inf | 25 +++++++++++++++ OvmfPkg/Library/QemuFwCfgLib/QemuFwCfgPei.c | 2 +- OvmfPkg/Microvm/MicrovmX64.dsc | 1 + OvmfPkg/OvmfPkgIa32.dsc | 1 + OvmfPkg/OvmfPkgIa32X64.dsc | 1 + OvmfPkg/OvmfPkgX64.dsc | 1 + OvmfPkg/OvmfXen.dsc | 1 + OvmfPkg/Sec/AmdSev.c | 2 +- OvmfPkg/Sec/SecMain.c | 5 +-- OvmfPkg/Sec/SecMain.inf | 1 + 28 files changed, 170 insertions(+), 29 deletions(-) create mode 100644 MdePkg/Include/Library/CcProbeLib.h create mode 100644 MdePkg/Library/CcProbeLibNull/CcProbeLibNull.c create mode 100644 MdePkg/Library/CcProbeLibNull/CcProbeLibNull.inf create mode 100644 OvmfPkg/Library/CcProbeLib/CcProbeLib.c create mode 100644 OvmfPkg/Library/CcProbeLib/CcProbeLib.inf -- 2.29.2.windows.2