linux-kernel - Re: [PATCH] x86/sev: Improve handling of writes to intercepted GUEST_TSC

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <85h5zdx22e.fsf@amd.com>
Date: Tue, 15 Jul 2025 08:58:49 +0000
From: Nikunj A Dadhania <nikunj@....com>
To: Borislav Petkov <bp@...en8.de>
CC: Sean Christopherson <seanjc@...gle.com>, Tom Lendacky
	<thomas.lendacky@....com>, <linux-kernel@...r.kernel.org>, <x86@...nel.org>,
	<tglx@...utronix.de>, <mingo@...hat.com>, <dave.hansen@...ux.intel.com>,
	<santosh.shukla@....com>
Subject: Re: [PATCH] x86/sev: Improve handling of writes to intercepted
 GUEST_TSC_FREQ

Borislav Petkov <bp@...en8.de> writes:

> On Tue, Jul 15, 2025 at 08:37:38AM +0000, Nikunj A Dadhania wrote:
>>   Currently, when a Secure TSC enabled SNP guest attempts to write to
>>   the intercepted GUEST_TSC_FREQ MSR (a read-only MSR), the guest kernel
>>   #VC handler terminates the SNP guest by returning ES_VMM_ERROR. This
>>   response incorrectly implies a VMM configuration error, when in fact
>>   it's a valid VMM configuration to intercept writes to read-only MSRs,
>
> Not only valid - it is the usual thing the HV does with MSRs IMHO.

Right, will update

>
>>   unless explicitly documented.
>> 
>>   Modify the intercepted GUEST_TSC_FREQ MSR #VC handler to ignore writes
>>   instead of terminating the guest. Since GUEST_TSC_FREQ is a guest-only
>>   MSR, ignoring writes directly (rather than forwarding to the VMM and
>>   handling the resulting #GP) eliminates a round trip to the VMM.
>
> Probably.
>
> But I think the main point here is that this is the default action the HV
> does.

Correct, to adhere to that behaviour, I had sent the following patch
earlier [1]. If GUEST_TSC_FREQ is intercepted by VMM:

MSR read will terminate the guest, same behavior as earlier.

MSR write will be passed to the VMM and VMM will inject the GP# back.

>
>> Add a
>>   WARN_ONCE to log the incident, as well-behaved guest kernels should
>>   never attempt to write to this read-only MSR.
>> 
>>   However, continue to terminate the guest(via ES_VMM_ERROR) when
>
> ES_EXCEPTION

Are you suggesting to change the intercepted GUEST_TSC_FREQ MSR read
behaviour from panic to ES_EXCEPTION?

>
>>   reading from intercepted GUEST_TSC_FREQ MSR with Secure TSC enabled,
>>   as intercepted reads indicate an improper VMM configuration for Secure
>>   TSC enabled SNP guests.
>
> It is getting close to the gist of what we talked yesterday tho.

Ack

Regards,
Nikunj

1. https://lore.kernel.org/kvm/85h5zkuxa2.fsf@amd.com/