linux-kernel - Re: [PATCH 1/2] KVM: x86: Reject KVM_SET_TSC

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <85ms9btfez.fsf@amd.com>
Date: Fri, 11 Jul 2025 06:22:44 +0000
From: Nikunj A Dadhania <nikunj@....com>
To: "Huang, Kai" <kai.huang@...el.com>, "pbonzini@...hat.com"
	<pbonzini@...hat.com>, "seanjc@...gle.com" <seanjc@...gle.com>
CC: "thomas.lendacky@....com" <thomas.lendacky@....com>, "kvm@...r.kernel.org"
	<kvm@...r.kernel.org>, "Li, Xiaoyao" <xiaoyao.li@...el.com>,
	"linux-kernel@...r.kernel.org" <linux-kernel@...r.kernel.org>, "Edgecombe,
 Rick P" <rick.p.edgecombe@...el.com>, "bp@...en8.de" <bp@...en8.de>,
	"Yamahata, Isaku" <isaku.yamahata@...el.com>
Subject: Re: [PATCH 1/2] KVM: x86: Reject KVM_SET_TSC_KHZ vCPU ioctl for TSC
 protected guest

"Huang, Kai" <kai.huang@...el.com> writes:

> On Wed, 2025-07-09 at 14:09 +0530, Nikunj A. Dadhania wrote:
>> 
>> On 7/9/2025 11:07 AM, Kai Huang wrote:
>> > Reject KVM_SET_TSC_KHZ vCPU ioctl if guest's TSC is protected and not
>> > changeable by KVM.
>> > 
>> > For such TSC protected guests, e.g. TDX guests, typically the TSC is
>> > configured once at VM level before any vCPU are created and remains
>> > unchanged during VM's lifetime.  KVM provides the KVM_SET_TSC_KHZ VM
>> > scope ioctl to allow the userspace VMM to configure the TSC of such VM.
>> > After that the userspace VMM is not supposed to call the KVM_SET_TSC_KHZ
>> > vCPU scope ioctl anymore when creating the vCPU.
>> > 
>> > The de facto userspace VMM Qemu does this for TDX guests.  The upcoming
>> > SEV-SNP guests with Secure TSC should follow.
>> > 
>> > Note this could be a break of ABI.  But for now only TDX guests are TSC
>> > protected and only Qemu supports TDX, thus in practice this should not
>> > break any existing userspace.
>> > 
>> > Suggested-by: Sean Christopherson <seanjc@...gle.com>
>> > Signed-off-by: Kai Huang <kai.huang@...el.com>
>> 
>> Need to add this in Documentation/virt/kvm/api.rst as well, saying that
>> for TDX and SecureTSC enabled SNP guests, KVM_SET_TSC_KHZ vCPU ioctl is
>> not valid.
>> 
>> 
>
> Good point.  Thanks for bringing it up.
>
> I will add below to the doc unless someone has comments?
>
> I'll probably split the doc diff into two parts and merge each to the
> respective code change patch, since the change to the doc contains change
> to both vm ioctl and vcpu ioctl.
>
> Btw, I think I'll not mention Secure TSC enabled SEV-SNP guests for now
> because it is not in upstream yet.  But I tried to make the text in a way
> that could be easily extended to cover Secure TSC guests.

Sure, I can add that later.

>
> diff --git a/Documentation/virt/kvm/api.rst
> b/Documentation/virt/kvm/api.rst
> index 43ed57e048a8..ad61bcba3791 100644
> --- a/Documentation/virt/kvm/api.rst
> +++ b/Documentation/virt/kvm/api.rst
> @@ -2006,7 +2006,13 @@ frequency is KHz.
>  
>  If the KVM_CAP_VM_TSC_CONTROL capability is advertised, this can also
>  be used as a vm ioctl to set the initial tsc frequency of subsequently
> -created vCPUs.
> +created vCPUs.  It must be called before any vCPU is created.

s/It/The VM Scope ioctl/

> +
> +For TSC protected CoCo VMs where TSC is configured once at VM scope
> and

s/CoCo/Confidential Computing (CoCo)/
s/TSC is/TSC frequency is/

> +remains unchanged during VM's lifetime, the VM ioctl should be used to
> +configure the TSC and the vCPU ioctl fails.

s/TSC/TSC frequency/

s/vcpu ioctl fails/vcpu ioctl is not supported/

> +
> +
> +Example of such CoCo VMs: TDX guests.

Regards
Nikunj