linux-kernel - [PATCH v3 0/2] KVM: SVM: Fix a bug where TSC

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Message-ID: <20250923153738.1875174-1-seanjc@google.com>
Date: Tue, 23 Sep 2025 08:37:36 -0700
From: Sean Christopherson <seanjc@...gle.com>
To: Sean Christopherson <seanjc@...gle.com>, Paolo Bonzini <pbonzini@...hat.com>
Cc: kvm@...r.kernel.org, linux-kernel@...r.kernel.org, 
	Hou Wenlong <houwenlong.hwl@...group.com>, Xiaoyao Li <xiaoyao.li@...el.com>, 
	Lai Jiangshan <jiangshan.ljs@...group.com>
Subject: [PATCH v3 0/2] KVM: SVM: Fix a bug where TSC_AUX can get clobbered

Fix a bug where an SEV-ES vCPU running on the same pCPU as a non-SEV-ES vCPU
could clobber TSC_AUX due to loading the host's TSC_AUX on #VMEXIT, as opposed
to restoring whatever was in hardware at the time of VMRUN.

v3:
 - Collect reviews. [Xiaoyao]
 - Make tsc_aux_uret_slot globally visible instead of passing it as a param.
   [Xiaoyao]
 - Mark tsc_aux_uret_slot __ro_after_init.

v2:
 - https://lore.kernel.org/all/20250919213806.1582673-1-seanjc@google.com
 - Drop "cache" from the user_return API.
 - Handle the SEV-ES case in SEV-ES code.
 - Tag everything for stable@.
 - Massage changelog to avoid talking about the host's value and instead
   focus on failing to restore what KVM thinks is in hardware.

v1: https://lore.kernel.org/all/05a018a6997407080b3b7921ba692aa69a720f07.1758166596.git.houwenlong.hwl@antgroup.com

Hou Wenlong (2):
  KVM: x86: Add helper to retrieve current value of user return MSR
  KVM: SVM: Re-load current, not host, TSC_AUX on #VMEXIT from SEV-ES
    guest

 arch/x86/include/asm/kvm_host.h |  1 +
 arch/x86/kvm/svm/sev.c          | 10 ++++++++++
 arch/x86/kvm/svm/svm.c          | 25 ++++++-------------------
 arch/x86/kvm/svm/svm.h          |  2 ++
 arch/x86/kvm/x86.c              |  6 ++++++
 5 files changed, 25 insertions(+), 19 deletions(-)


base-commit: c8fbf7ceb2ae3f64b0c377c8c21f6df577a13eb4
-- 
2.51.0.534.gc79095c0ca-goog