linux-kernel - Re: [PATCH 1/2] KVM: x86: Reject KVM_SET_TSC

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <150fc6eca8e66d97a4280fefcf16ba33ac19ce68.camel@intel.com>
Date: Sun, 13 Jul 2025 07:27:50 +0000
From: "Huang, Kai" <kai.huang@...el.com>
To: "pbonzini@...hat.com" <pbonzini@...hat.com>, "seanjc@...gle.com"
	<seanjc@...gle.com>, "nikunj@....com" <nikunj@....com>
CC: "thomas.lendacky@....com" <thomas.lendacky@....com>, "kvm@...r.kernel.org"
	<kvm@...r.kernel.org>, "Li, Xiaoyao" <xiaoyao.li@...el.com>,
	"linux-kernel@...r.kernel.org" <linux-kernel@...r.kernel.org>, "Edgecombe,
 Rick P" <rick.p.edgecombe@...el.com>, "bp@...en8.de" <bp@...en8.de>,
	"Yamahata, Isaku" <isaku.yamahata@...el.com>
Subject: Re: [PATCH 1/2] KVM: x86: Reject KVM_SET_TSC_KHZ vCPU ioctl for TSC
 protected guest

On Fri, 2025-07-11 at 06:22 +0000, Nikunj A Dadhania wrote:
> "Huang, Kai" <kai.huang@...el.com> writes:
> 
> > On Wed, 2025-07-09 at 14:09 +0530, Nikunj A. Dadhania wrote:
> > > 
> > > On 7/9/2025 11:07 AM, Kai Huang wrote:
> > > > Reject KVM_SET_TSC_KHZ vCPU ioctl if guest's TSC is protected and not
> > > > changeable by KVM.
> > > > 
> > > > For such TSC protected guests, e.g. TDX guests, typically the TSC is
> > > > configured once at VM level before any vCPU are created and remains
> > > > unchanged during VM's lifetime.  KVM provides the KVM_SET_TSC_KHZ VM
> > > > scope ioctl to allow the userspace VMM to configure the TSC of such VM.
> > > > After that the userspace VMM is not supposed to call the KVM_SET_TSC_KHZ
> > > > vCPU scope ioctl anymore when creating the vCPU.
> > > > 
> > > > The de facto userspace VMM Qemu does this for TDX guests.  The upcoming
> > > > SEV-SNP guests with Secure TSC should follow.
> > > > 
> > > > Note this could be a break of ABI.  But for now only TDX guests are TSC
> > > > protected and only Qemu supports TDX, thus in practice this should not
> > > > break any existing userspace.
> > > > 
> > > > Suggested-by: Sean Christopherson <seanjc@...gle.com>
> > > > Signed-off-by: Kai Huang <kai.huang@...el.com>
> > > 
> > > Need to add this in Documentation/virt/kvm/api.rst as well, saying that
> > > for TDX and SecureTSC enabled SNP guests, KVM_SET_TSC_KHZ vCPU ioctl is
> > > not valid.
> > > 
> > > 
> > 
> > Good point.  Thanks for bringing it up.
> > 
> > I will add below to the doc unless someone has comments?
> > 
> > I'll probably split the doc diff into two parts and merge each to the
> > respective code change patch, since the change to the doc contains change
> > to both vm ioctl and vcpu ioctl.
> > 
> > Btw, I think I'll not mention Secure TSC enabled SEV-SNP guests for now
> > because it is not in upstream yet.  But I tried to make the text in a way
> > that could be easily extended to cover Secure TSC guests.
> 
> Sure, I can add that later.
> 
> > 
> > diff --git a/Documentation/virt/kvm/api.rst
> > b/Documentation/virt/kvm/api.rst
> > index 43ed57e048a8..ad61bcba3791 100644
> > --- a/Documentation/virt/kvm/api.rst
> > +++ b/Documentation/virt/kvm/api.rst
> > @@ -2006,7 +2006,13 @@ frequency is KHz.
> >  
> >  If the KVM_CAP_VM_TSC_CONTROL capability is advertised, this can also
> >  be used as a vm ioctl to set the initial tsc frequency of subsequently
> > -created vCPUs.
> > +created vCPUs.  It must be called before any vCPU is created.
> 
> s/It/The VM Scope ioctl/

OK.  I'll use "The vm ioctl", though, to make it consistent with the
previous sentence.

> 
> > +
> > +For TSC protected CoCo VMs where TSC is configured once at VM scope
> > and
> 
> s/CoCo/Confidential Computing (CoCo)/
> s/TSC is/TSC frequency is/

OK.

> 
> > +remains unchanged during VM's lifetime, the VM ioctl should be used to
> > +configure the TSC and the vCPU ioctl fails.
> 
> s/TSC/TSC frequency/
> 
> s/vcpu ioctl fails/vcpu ioctl is not supported/

OK.

> 
> > +
> > +
> > +Example of such CoCo VMs: TDX guests.
> 
> Regards
> Nikunj