TD Guest performance

[Chuqiz]

Hi, I would like to ask some questions about the performance of the TD guest.

I'm currently using the run_td.sh to boot the TD guest, and using ssh -p 10022 root@localhost inside the host to SSH into the guest. However, during the operation, I experience very long latency between the host keyboard typing and the responding within the TD guest. To be specific, here are some concrete lists of performance slowdown:

1. Using git clone to download a repo, TD guest's network throughput is 10x slower than running it as a normal KVM guest.

2. Using sysbench cpu --threads=1 run to test the CPU performance, TD Guest's CPU speed (events per second) is 160, while running it as a normal KVM guest's CPU speed (events per second) is 2239.15.

I'm not sure whether the performance issue is due to TDX's protection or my bad TD guest configuration. The current performance of our TD guest makes it really hard to execute any realistic workloads. Are there any suggestions to optimize its performance?

Host Settings: INTEL(R) XEON(R) PLATINUM 8570 with 224 CPU threads, and 1TB memory.

TD Guest Settings: 32 VCPU cores, and 24GB memory.

Here are the detailed options to boot the TD:

qemu-system-x86_64 -D /tmp/tdx-guest-td.log \
		   -accel kvm \
		   -m 24G\
           -cpu host,-pdpe1gb \
           -smp 32,maxcpus=32 \
		   -name ${PROCESS_NAME},process=${PROCESS_NAME}\
		   -object tdx-guest,id=tdx \
		   -machine q35,kernel_irqchip=split,confidential-guest-support=tdx,hpet=off \
		   -bios ${TDVF_FIRMWARE} \
		   -nographic\
		   -nodefaults -daemonize\
		   -no-reboot \
           -netdev user,id=nic0_td,hostfwd=tcp::${SSH_PORT}-:22 \
           -device virtio-net-pci,netdev=nic0_td \
		   -drive file=${VMDISK_TDX},if=none,id=virtio-disk0 \
		   -device virtio-blk-pci,drive=virtio-disk0 \
		   ${QUOTE_ARGS} \
		   -pidfile /tmp/tdx-demo-td-pid.pid

[syncronize-issues-to-jira]

Thank you for reporting us your feedback!

The internal ticket has been created: https://warthogs.atlassian.net/browse/PEK-705.

This message was autogenerated

[Hector Cao]

Hello, we experience a performance drop with old version of the firmware. Please update your firmware to the latest firmware we are using : TDX Module . Please see : #91

[Chuqiz]

@hector-cao Thanks. Where can I obtain the signed TDX module of TDX_1.5.05.46.698?

[Hector Cao]

The most straightforward way is to update the BIOS to latest version, i think you can reach out to your hardware vendor (OEM).

[Chuqiz]

Thanks. Is there any way I can check my TDX module version?

From my dmesg | grep -i tdx, the host shows:

[    0.000000] Command line: BOOT_IMAGE=/boot/vmlinuz-6.8.1+ root=UUID=8617a4cb-7c3d-4ca9-a741-4743cecc4ce0 ro kvm_intel.tdx=1 nohibernate nomodeset
[    2.447228] Kernel command line: BOOT_IMAGE=/boot/vmlinuz-6.8.1+ root=UUID=8617a4cb-7c3d-4ca9-a741-4743cecc4ce0 ro kvm_intel.tdx=1 nohibernate nomodeset
[    5.331762] virt/tdx: BIOS enabled: private KeyID range [64, 128)
[    5.331766] virt/tdx: Disable ACPI S3. Turn off TDX in the BIOS to use ACPI S3.
[   16.382463] virt/tdx: TDX module: attributes 0x0, vendor_id 0x8086, major_version 1, minor_version 5, build_date 20231008, build_num 595

[Hector Cao]

This is where you can get the version : major_version 1, minor_version 5, build_date 20231008, build_num 595

[Bun K Tan]

@Icegrave0391 - Please try the latest recommended version TDX_1.5.05.46.698.

[Diego Araujo]

@bktan8 Do you know where I can get the new version? I can't find it anywhere

[Bun K Tan]

@bktan8 Do you know where I can get the new version? I can't find it anywhere

Hi @diegoara96 - Can you contact your system vendor? They might have the latest firmware.

[Diego Araujo]

@bktan8 thanks, In the end I tried updating the entire BIOS and that updated the tdx as well.

[Bun K Tan]

@bktan8 thanks, In the end I tried updating the entire BIOS and that updated the tdx as well.

Very nice. Which TDX module version did you end up with?

[Diego Araujo]

@bktan8 thanks, In the end I tried updating the entire BIOS and that updated the tdx as well.

Very nice. Which TDX module version did you end up with?

I think it's the last one
[ 7.421728] virt/tdx: TDX module: attributes 0x0, vendor_id 0x8086, major_version 1, minor_version 5, build_date 20240129, build_num 698

[Chuqiz]

Hi @bktan8 and @hector-cao ,

Thanks for your suggestions. Updating the firmware to TDX_1.5.05.46.698 does resolve the problem. I observed a x10 performance gain by using the latest firmware.

[Bun K Tan]

Great! Issue resolved.