On Wed, Dec 20, 2023 at 9:44 PM Xiaoyao Li <xiaoyao.li@xxxxxxxxx> wrote: > > On 12/21/2023 6:07 AM, Sean Christopherson wrote: > > On Tue, Dec 19, 2023, Isaku Yamahata wrote: > >> On Mon, Dec 18, 2023 at 07:53:45PM -0800, Jim Mattson <jmattson@xxxxxxxxxx> wrote: > >>>> There are several options to address this. > >>>> 1. Make the KVM able to configure APIC bus frequency (This patch). > >>>> Pros: It resembles the existing hardware. The recent Intel CPUs > >>>> adapts 25MHz. > >>>> Cons: Require the VMM to emulate the APIC timer at 25MHz. > >>>> 2. Make the TDX architecture enumerate CPUID 0x15 to configurable > >>>> frequency or not enumerate it. > >>>> Pros: Any APIC bus frequency is allowed. > >>>> Cons: Deviation from the real hardware. > > > > I don't buy this as a valid Con. TDX is one gigantic deviation from real hardware, > > and since TDX obviously can't guarantee the APIC timer is emulated at the correct > > frequency, there can't possibly be any security benefits. If this were truly a > > Con that anyone cared about, we would have gotten patches to "fix" KVM a long time > > ago. > > > > If the TDX module wasn't effectively hardware-defined software, i.e. was actually > > able to adapt at the speed of software, then fixing this in TDX would be a complete > > no-brainer. > > > > The KVM uAPI required to play nice is relatively minor, so I'm not totally opposed > > to adding it. But I totally agree with Jim that forcing KVM to change 13+ years > > of behavior just because someone at Intel decided that 25MHz was a good number is > > ridiculous. > > I believe 25MHz was chosen because it's the value from hardware that > supports TDX and it is not going to change for the following known > generations that support TDX. > > It's mainly the core crystal frequency. Yes, it also represents the APIC > frequency when it's enumerated in CPUID 0x15. However, it also relates > other things, like intel-pt MTC Freq. If it is configured to other value > different from hardware, I think it will break the correctness of > INTEL-PT MTC packets in TDs. LOL! That suggests that no one is really using KVM's Intel PT virtualization. This is certainly a compelling reason for having a variable frequency virtual APIC. Thank you! > >>>> 3. Make the TDX guest kernel use 1GHz when it's running on KVM. > >>>> Cons: The kernel ignores CPUID leaf 0x15. > >>> > >>> 4. Change CPUID.15H under TDX to report the crystal clock frequency as 1 GHz. > >>> Pro: This has been the virtual APIC frequency for KVM guests for 13 years. > >>> Pro: This requires changing only one hard-coded constant in TDX. > >>> > >>> I see no compelling reason to complicate KVM with support for > >>> configurable APIC frequencies, and I see no advantages to doing so. > >> > >> Because TDX isn't specific to KVM, it should work with other VMM technologies. > >> If we'd like to go for this route, the frequency would be configurable. What > >> frequency should be acceptable securely is obscure. 25MHz has long history with > >> the real hardware. > > >
