linux-kernel - Re: [RFC PATCH] clocksource: hyper-v: Enable the tsc

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date: Thu, 23 May 2024 15:06:23 +0300
From: "Kirill A. Shutemov" <kirill.shutemov@...ux.intel.com>
To: Dexuan Cui <decui@...rosoft.com>
Cc: x86@...nel.org, linux-coco@...ts.linux.dev, bp@...en8.de, 
	dave.hansen@...el.com, dave.hansen@...ux.intel.com, haiyangz@...rosoft.com, 
	hpa@...or.com, kys@...rosoft.com, luto@...nel.org, mingo@...hat.com, 
	peterz@...radead.org, sathyanarayanan.kuppuswamy@...ux.intel.com, tglx@...utronix.de, 
	wei.liu@...nel.org, Jason@...c4.com, mhklinux@...look.com, thomas.lendacky@....com, 
	tytso@....edu, ardb@...nel.org, linux-hyperv@...r.kernel.org, 
	linux-kernel@...r.kernel.org, Tianyu.Lan@...rosoft.com, 
	Elena Reshetova <elena.reshetova@...el.com>
Subject: Re: [RFC PATCH] clocksource: hyper-v: Enable the tsc_page for a TDX
 VM in TD mode

On Wed, May 22, 2024 at 07:24:41PM -0700, Dexuan Cui wrote:
> A TDX VM on Hyper-V may run in TD mode or Partitioned TD mode (L2). For
> the former, the VM has not enabled the Hyper-V TSC page (which is defined
> in drivers/clocksource/hyperv_timer.c: "... tsc_pg __bss_decrypted ...")
> because, for such a VM, the hypervisor requires that the page should be
> shared, but currently the __bss_decrypted is not working for such a VM
> yet.

I don't see how it is safe. It opens guest clock for manipulations form
VMM. Could you elaborate on security implications?

> Hyper-V TSC page can work as a clocksource device similar to KVM pv
> clock, and it's also used by the Hyper-V timer code to get the current
> time: see hv_init_tsc_clocksource(), which sets the global function
> pointer hv_read_reference_counter to read_hv_clock_tsc(); when
> Hyper-V TSC page is not enabled, hv_read_reference_counter defaults to
> be drivers/hv/hv_common.c: __hv_read_ref_counter(), which is suboptimal
> as it uses the slow MSR interface to get the time info.

Why can't the guest just read the TSC directly? Why do we need the page?
I am confused.

-- 
  Kiryl Shutsemau / Kirill A. Shutemov