linux-kernel - Re: [PATCH v12 00/19] Add Secure TSC support for SNP guests

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <52279d55-11bf-490f-b3c7-69e6fe246c9d@intel.com>
Date: Wed, 9 Oct 2024 09:08:21 -0700
From: Dave Hansen <dave.hansen@...el.com>
To: Nikunj A Dadhania <nikunj@....com>, linux-kernel@...r.kernel.org,
 thomas.lendacky@....com, bp@...en8.de, x86@...nel.org, kvm@...r.kernel.org
Cc: mingo@...hat.com, tglx@...utronix.de, dave.hansen@...ux.intel.com,
 pgonda@...gle.com, seanjc@...gle.com, pbonzini@...hat.com
Subject: Re: [PATCH v12 00/19] Add Secure TSC support for SNP guests

On 10/9/24 02:28, Nikunj A Dadhania wrote:
> Secure TSC allows guests to securely use RDTSC/RDTSCP instructions as the
> parameters being used cannot be changed by hypervisor once the guest is
> launched. More details in the AMD64 APM Vol 2, Section "Secure TSC".
> 
> In order to enable secure TSC, SEV-SNP guests need to send a TSC_INFO guest
> message before the APs are booted.

Superficially, this seems kinda silly.  If you ask someone, do you want
more security or less, they usually say "more".

Why do guests need to turn this on instead of just always having a
secure TSC?  There must be _some_ compromise, either backward
compatibility or performance or...