| Message ID | 20250317052308.498244-5-nikunj@amd.com (mailing list archive) |
|---|---|
| State | New |
| Headers | show |
| Series | Enable Secure TSC for SEV-SNP | expand |
On 3/17/25 00:23, Nikunj A Dadhania wrote: > From: Ketan Chaturvedi <Ketan.Chaturvedi@amd.com> > > Add support for Secure TSC, allowing userspace to configure the Secure TSC > feature for SNP guests. Use the SNP specification's desired TSC frequency > parameter during the SNP_LAUNCH_START command to set the mean TSC > frequency in KHz for Secure TSC enabled guests. > > As the frequency needs to be set in the SNP_LAUNCH_START command, userspace > should set the frequency using the KVM_CAP_SET_TSC_KHZ VM ioctl instead of > the VCPU ioctl. The desired_tsc_khz defaults to kvm->arch.default_tsc_khz. > > Signed-off-by: Ketan Chaturvedi <Ketan.Chaturvedi@amd.com> > Co-developed-by: Nikunj A Dadhania <nikunj@amd.com> > Signed-off-by: Nikunj A Dadhania <nikunj@amd.com> Just one minor comment below, that can be ignored unless you have to do another version. Reviewed-by: Tom Lendacky <thomas.lendacky@amd.com> > --- > arch/x86/include/uapi/asm/kvm.h | 3 ++- > arch/x86/kvm/svm/sev.c | 14 ++++++++++++++ > 2 files changed, 16 insertions(+), 1 deletion(-) > > diff --git a/arch/x86/include/uapi/asm/kvm.h b/arch/x86/include/uapi/asm/kvm.h > index 9e75da97bce0..87ed9f77314d 100644 > --- a/arch/x86/include/uapi/asm/kvm.h > +++ b/arch/x86/include/uapi/asm/kvm.h > @@ -836,7 +836,8 @@ struct kvm_sev_snp_launch_start { > __u64 policy; > __u8 gosvw[16]; > __u16 flags; > - __u8 pad0[6]; > + __u8 pad0[2]; > + __u32 desired_tsc_khz; > __u64 pad1[4]; > }; > > diff --git a/arch/x86/kvm/svm/sev.c b/arch/x86/kvm/svm/sev.c > index 80a80929e6a3..4ee8d233f61f 100644 > --- a/arch/x86/kvm/svm/sev.c > +++ b/arch/x86/kvm/svm/sev.c > @@ -2226,6 +2226,14 @@ static int snp_launch_start(struct kvm *kvm, struct kvm_sev_cmd *argp) > > start.gctx_paddr = __psp_pa(sev->snp_context); > start.policy = params.policy; > + > + if (snp_secure_tsc_enabled(kvm)) { > + if (!kvm->arch.default_tsc_khz) > + return -EINVAL; > + > + start.desired_tsc_khz = kvm->arch.default_tsc_khz; > + } > + > memcpy(start.gosvw, params.gosvw, sizeof(params.gosvw)); > rc = __sev_issue_cmd(argp->sev_fd, SEV_CMD_SNP_LAUNCH_START, &start, &argp->error); > if (rc) { > @@ -2467,6 +2475,9 @@ static int snp_launch_update_vmsa(struct kvm *kvm, struct kvm_sev_cmd *argp) > } > > svm->vcpu.arch.guest_state_protected = true; > + if (snp_secure_tsc_enabled(kvm)) > + svm->vcpu.arch.guest_tsc_protected = true; > + This could just be: vcpu->arch.guest_tsc_protected = snp_secure_tsc_enabled(kvm); (and you could clean up the line above to: vcpu->arch.guest_state_protected = true; while you're at it.) Thanks, Tom > /* > * SEV-ES (and thus SNP) guest mandates LBR Virtualization to > * be _always_ ON. Enable it only after setting > @@ -3079,6 +3090,9 @@ void __init sev_hardware_setup(void) > sev_supported_vmsa_features = 0; > if (sev_es_debug_swap_enabled) > sev_supported_vmsa_features |= SVM_SEV_FEAT_DEBUG_SWAP; > + > + if (sev_snp_enabled && cpu_feature_enabled(X86_FEATURE_SNP_SECURE_TSC)) > + sev_supported_vmsa_features |= SVM_SEV_FEAT_SECURE_TSC; > } > > void sev_hardware_unsetup(void)
diff --git a/arch/x86/include/uapi/asm/kvm.h b/arch/x86/include/uapi/asm/kvm.h index 9e75da97bce0..87ed9f77314d 100644 --- a/arch/x86/include/uapi/asm/kvm.h +++ b/arch/x86/include/uapi/asm/kvm.h @@ -836,7 +836,8 @@ struct kvm_sev_snp_launch_start { __u64 policy; __u8 gosvw[16]; __u16 flags; - __u8 pad0[6]; + __u8 pad0[2]; + __u32 desired_tsc_khz; __u64 pad1[4]; }; diff --git a/arch/x86/kvm/svm/sev.c b/arch/x86/kvm/svm/sev.c index 80a80929e6a3..4ee8d233f61f 100644 --- a/arch/x86/kvm/svm/sev.c +++ b/arch/x86/kvm/svm/sev.c @@ -2226,6 +2226,14 @@ static int snp_launch_start(struct kvm *kvm, struct kvm_sev_cmd *argp) start.gctx_paddr = __psp_pa(sev->snp_context); start.policy = params.policy; + + if (snp_secure_tsc_enabled(kvm)) { + if (!kvm->arch.default_tsc_khz) + return -EINVAL; + + start.desired_tsc_khz = kvm->arch.default_tsc_khz; + } + memcpy(start.gosvw, params.gosvw, sizeof(params.gosvw)); rc = __sev_issue_cmd(argp->sev_fd, SEV_CMD_SNP_LAUNCH_START, &start, &argp->error); if (rc) { @@ -2467,6 +2475,9 @@ static int snp_launch_update_vmsa(struct kvm *kvm, struct kvm_sev_cmd *argp) } svm->vcpu.arch.guest_state_protected = true; + if (snp_secure_tsc_enabled(kvm)) + svm->vcpu.arch.guest_tsc_protected = true; + /* * SEV-ES (and thus SNP) guest mandates LBR Virtualization to * be _always_ ON. Enable it only after setting @@ -3079,6 +3090,9 @@ void __init sev_hardware_setup(void) sev_supported_vmsa_features = 0; if (sev_es_debug_swap_enabled) sev_supported_vmsa_features |= SVM_SEV_FEAT_DEBUG_SWAP; + + if (sev_snp_enabled && cpu_feature_enabled(X86_FEATURE_SNP_SECURE_TSC)) + sev_supported_vmsa_features |= SVM_SEV_FEAT_SECURE_TSC; } void sev_hardware_unsetup(void)