Received-SPF: pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 23.128.96.37 as permitted sender) client-ip=23.128.96.37;
Message-ID: <9acf1f56-f8d8-40e3-8fec-fa982db1a7a1@amd.com>
Date:   Thu, 2 Nov 2023 11:17:55 +0530
User-Agent: Mozilla Thunderbird
Reply-To: nikunj@amd.com
Subject: Re: [PATCH v5 11/14] x86/sev: Prevent RDTSC/RDTSCP interception for
 Secure TSC enabled guests
Content-Language: en-US
To:     Tom Lendacky <thomas.lendacky@amd.com>,
        linux-kernel@vger.kernel.org, x86@kernel.org, kvm@vger.kernel.org
Cc:     bp@alien8.de, mingo@redhat.com, tglx@linutronix.de,
        dave.hansen@linux.intel.com, dionnaglaze@google.com,
        pgonda@google.com, seanjc@google.com, pbonzini@redhat.com
References: <20231030063652.68675-1-nikunj@amd.com>
 <20231030063652.68675-12-nikunj@amd.com>
 <8bd907ec-3f91-2e3d-de7c-ef753a005ea7@amd.com>
From:   "Nikunj A. Dadhania" <nikunj@amd.com>
In-Reply-To: <8bd907ec-3f91-2e3d-de7c-ef753a005ea7@amd.com>
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit
MIME-Version: 1.0
X-MS-Exchange-AntiSpam-MessageData-ChunkCount: 1
X-MS-Exchange-AntiSpam-MessageData-0: =?utf-8?B?U2IvUlFFNENJZENycWxHd1lwS3RPMDV6bWhkQzdzSGIzaEQ2b2x6VXBOYlpJ?=
 =?utf-8?B?WE5lQVh0ZXJpOG8vSC9IVk9laUNEbU1HQk5xQW9vWnQxNE4rcUpCZWRlSkJO?=
 =?utf-8?B?U05rcFZsOVl6RHQxQjl5WVFDSVJ5cE8vbTRMR21KWFFzYXpBUXZEdy9CeElh?=
 =?utf-8?B?WU1oeXNZUjhoeHJxMDl1djhSMDlRVjdKOVRUdnBiNlMvM1NwbWl1VWhjL1A3?=
 =?utf-8?B?MEZNakloemxGaEhQZndzcTM2ODV2STVhTnlrWlVrWWg4bEZ3QVJicVdPaUF2?=
 =?utf-8?B?bkZHVEhRdFo4WDlvTjJ6QVVLNHhVYXBZaUFBcHp3UVNwaXBHZkVDL2JiNVVK?=
 =?utf-8?B?M2NTTkg1V0R5SVNKaTNsKzlCZnNiQ2JwaGJ1ZzY0Z3JaVU5wY0lVYzEyUkhl?=
 =?utf-8?B?bnpSbFh5cGgvVzJ5aWlNQ0pnZngreXRMZnEwRW1SKytoNEJKR0UxaUZ1cVdx?=
 =?utf-8?B?YUtQMXErRmRXakFESU1Gbk8xdk54d2owdm5WaGJmVVR4QllKdmFQZW5YMmlo?=
 =?utf-8?B?SnVXa3J4eTBFdzNZOC9vbzhLV1ZUVitQSzBRWFdNMGVVOXptYzRZT0RiWUxC?=
 =?utf-8?B?Wk9HdlBOTU5oRmkxcFZ0ZjNJSGlvaUg1VkRJN0VKU2REOVJwbTdzd3Z0cW5D?=
 =?utf-8?B?Z25TbGdwWVNUQ0RBLys3TmcrZHdkbERRYjdha3FrSzF5WHY5Uk9VZGR5MmFO?=
 =?utf-8?B?WWdYUmY3emVqREZsNkhXZnFDNmpKcnpkcnI5MUF3MmRENDFEQ20vZFdSNG5S?=
 =?utf-8?B?QTErZWVSMG9BMXpvN3ROaitralB3TmFUMXcxYmF2dFJ5bDVab2pjVzVWQU9C?=
 =?utf-8?B?RjZTZFR0R1Q3aTNLSkdDSGo2TnhiNlBMNUgvU08xWHVuTDh4c0s1YTd2dHc1?=
 =?utf-8?B?MTJQc1Z3SUk3ZllNNHJUaTI0a2hLby9EWk9NMTJDV1JmN0xNM09NS0FMTnVK?=
 =?utf-8?B?M1YvdEltM3NSenZwWlIwaEJyVTIzbXM4SjV0aXRoNHp1ZU9GMG5YSUNEb3Qz?=
 =?utf-8?B?MnZFTkpWN3J3dEVZT09jUjBFUzRMdDJzVXJtNUM4Zlk5Szcya0MwK2tubWlD?=
 =?utf-8?B?dWt1TzBiN0oxYVJKYUFDeWtnVDIramE0UDM1cWJlMlZZQ3hLNnV3SGVweXNj?=
 =?utf-8?B?VmNDTEJRTEZZSFJUVElkY0hRZ3VicVRJa0VDNVllUXVSMHBpT0hsMFlmZVpu?=
 =?utf-8?B?U1BFRHVOaU1lQm45dHFHZmtZcTd6RTdHU29tUFUwcCs3NEtwM0hVaWtNeUZ6?=
 =?utf-8?B?MXBmdzVlYkNuY1ZDNGh2UFY5dkREeWhqYUNiSTNocjZDTTlzSlVMMXhQZ2s3?=
 =?utf-8?B?RUJKWk9IdHk4b3dOTmtXdFQybHMyeWJuYk80dHloclZSR011dVNtRU5GRmQr?=
 =?utf-8?B?RWYwZThxdzUwTWkwUUdwaGIvWTNlcmZMeFV6R1Axck5jYnhRN2wvc1NKNHJi?=
 =?utf-8?B?NUlxNVpLNFFWRi90OFZIeTUyblc3UDVtZE42YjBUWjdBeDM5aUNLY1BtdlhD?=
 =?utf-8?B?OXFsbkF3eXptbmNDdGM4Sk83U1lock03cmxCUUY5dE85aTVQSzh1ajhIUjRv?=
 =?utf-8?B?eU8yUlFMVzEySGZ4OXpJdElUZXhRRG9JZWFNRmNxT0tsd1NFcHRUMkVUSGlU?=
 =?utf-8?B?ZWwwOG16aitsUW44Z0hRazRsUURTOE5NZC8zTFRTQzdYeC9UaWtUcVRBejB6?=
 =?utf-8?B?dXZ6NUZkZ1ZXRU1Ba1FaY2JpLzlhcWVua3h1c3B6WklnS1BRRk4xMXhzSzJE?=
 =?utf-8?B?c01hVVhuK1A3ZHZoa0p3ZEtPY1dkL2tOazNXOEU0L3VuQnN5RDlVbGV3Wi9k?=
 =?utf-8?B?dDZ4Tm0xaUlOZU16cERrVkpXeEsvUU1sMXhia2NoVGJjNU1PSDUxYWx1bHlr?=
 =?utf-8?B?bGVjT05hVWlYR2FYT2Q1UHpGQm4yak9UUHZkeVIyWXMvQVY5WGR4ZlBMQkN5?=
 =?utf-8?B?cGRtNUhMTXFvTW1LcDNCYXAva2Y1dURwaW50aGoxYW05eVUxVTFOVEJBOS9t?=
 =?utf-8?B?TjI3U1h1akRnRkEwNTRFR2xoK0JXbkJqVHFHNjZYK1h2cUdkYmlDUmJHYW1r?=
 =?utf-8?B?OHNxbzByUkJQeXU0TmlvdlVpb09MVTl2eEM2OCtNbkhYQkhHV28vWGJoQk11?=
 =?utf-8?Q?hzd0Lm30Cb0lpnoByRSt7z49E?=
X-OriginatorOrg: amd.com
X-MS-Exchange-CrossTenant-Network-Message-Id: 8de6921a-8c06-43b2-7a11-08dbdb674932
X-MS-Exchange-CrossTenant-AuthSource: DS7PR12MB6309.namprd12.prod.outlook.com
X-MS-Exchange-CrossTenant-AuthAs: Internal
X-MS-Exchange-CrossTenant-OriginalArrivalTime: 02 Nov 2023 05:48:06.9959
 (UTC)
X-MS-Exchange-CrossTenant-FromEntityHeader: Hosted
X-MS-Exchange-CrossTenant-Id: 3dd8961f-e488-4e60-8e11-a82d994e183d
X-MS-Exchange-CrossTenant-MailboxType: HOSTED
X-MS-Exchange-CrossTenant-UserPrincipalName: yB8P+nZFm8QqWd/1lMpLYo+oyQnnhjnTIcvR/c2Qzpjo9IqOzY/QiLEKxm8OXG2X+rNa7Oxzntz8lhhYzG2i1Q==
X-MS-Exchange-Transport-CrossTenantHeadersStamped: PH7PR12MB5781
X-Spam-Status: No, score=-1.5 required=5.0 tests=BAYES_00,DKIMWL_WL_HIGH,
        DKIM_SIGNED,DKIM_VALID,DKIM_VALID_AU,DKIM_VALID_EF,FORGED_SPF_HELO,
        RCVD_IN_DNSWL_BLOCKED,RCVD_IN_MSPIKE_H2,SPF_HELO_PASS,SPF_NONE,
        T_SCC_BODY_TEXT_LINE,URIBL_BLOCKED autolearn=no autolearn_force=no
        version=3.4.6
X-Spam-Checker-Version: SpamAssassin 3.4.6 (2021-04-09) on
        lindbergh.monkeyblade.net
Precedence: bulk
List-ID: <linux-kernel.vger.kernel.org>
X-Mailing-List: linux-kernel@vger.kernel.org
X-Greylist: Sender passed SPF test, not delayed by milter-greylist-4.6.4 (snail.vger.email [0.0.0.0]); Wed, 01 Nov 2023 22:48:26 -0700 (PDT)

On 10/31/2023 2:02 AM, Tom Lendacky wrote:
> On 10/30/23 01:36, Nikunj A Dadhania wrote:
>> The hypervisor should not be intercepting RDTSC/RDTSCP when Secure TSC
>> is enabled. A #VC exception will be generated if the RDTSC/RDTSCP
>> instructions are being intercepted. If this should occur and Secure
>> TSC is enabled, terminate guest execution.
>>
>> Signed-off-by: Nikunj A Dadhania <nikunj@amd.com>
>> ---
>>   arch/x86/kernel/sev-shared.c | 7 +++++++
>>   1 file changed, 7 insertions(+)
>>
>> diff --git a/arch/x86/kernel/sev-shared.c b/arch/x86/kernel/sev-shared.c
>> index ccb0915e84e1..833b0ae38f0b 100644
>> --- a/arch/x86/kernel/sev-shared.c
>> +++ b/arch/x86/kernel/sev-shared.c
>> @@ -991,6 +991,13 @@ static enum es_result vc_handle_rdtsc(struct ghcb *ghcb,
>>       bool rdtscp = (exit_code == SVM_EXIT_RDTSCP);
>>       enum es_result ret;
>>   +    /*
>> +     * RDTSC and RDTSCP should not be intercepted when Secure TSC is
>> +     * enabled. Terminate the SNP guest when the interception is enabled.
>> +     */
>> +    if (sev_status & MSR_AMD64_SNP_SECURE_TSC)
> 
> If you have to use sev_status, then please document why cc_platform_has() can't be used in the comment above.

Right, for sev-shared.c, cc_platform_has() is not available when compiling boot/compressed.

Regards
Nikunj