diff options
| author | Nikunj A Dadhania <nikunj@amd.com> | 2025-01-06 18:16:27 +0530 |
|---|---|---|
| committer | Borislav Petkov (AMD) <bp@alien8.de> | 2025-01-07 21:26:19 +0100 |
| commit | 38cc6495cdec18a448b9e1de45fedce4118833a2 (patch) | |
| tree | c6416ab18ffbf5ff73f88b5907bc01a2823e229b /arch/x86/coco/sev/core.c | |
| parent | 0f0502b8865c0a4c402e73aeb0fb406acc19d0d2 (diff) | |
x86/sev: Prevent GUEST_TSC_FREQ MSR interception for Secure TSC enabled guests
The hypervisor should not be intercepting GUEST_TSC_FREQ MSR(0xcOO10134)
when Secure TSC is enabled. A #VC exception will be generated otherwise. If
this should occur and Secure TSC is enabled, terminate guest execution.
Signed-off-by: Nikunj A Dadhania <nikunj@amd.com>
Signed-off-by: Borislav Petkov (AMD) <bp@alien8.de>
Reviewed-by: Tom Lendacky <thomas.lendacky@amd.com>
Link: https://lore.kernel.org/r/20250106124633.1418972-8-nikunj@amd.com
Diffstat (limited to 'arch/x86/coco/sev/core.c')
| -rw-r--r-- | arch/x86/coco/sev/core.c | 10 |
1 files changed, 9 insertions, 1 deletions
diff --git a/arch/x86/coco/sev/core.c b/arch/x86/coco/sev/core.c index cd5b9b723755..106bdeda58c5 100644 --- a/arch/x86/coco/sev/core.c +++ b/arch/x86/coco/sev/core.c @@ -1436,13 +1436,20 @@ static enum es_result __vc_handle_msr_caa(struct pt_regs *regs, bool write) /* * TSC related accesses should not exit to the hypervisor when a guest is * executing with Secure TSC enabled, so special handling is required for - * accesses of MSR_IA32_TSC. + * accesses of MSR_IA32_TSC and MSR_AMD64_GUEST_TSC_FREQ. */ static enum es_result __vc_handle_secure_tsc_msrs(struct pt_regs *regs, bool write) { u64 tsc; /* + * GUEST_TSC_FREQ should not be intercepted when Secure TSC is enabled. + * Terminate the SNP guest when the interception is enabled. + */ + if (regs->cx == MSR_AMD64_GUEST_TSC_FREQ) + return ES_VMM_ERROR; + + /* * Writes: Writing to MSR_IA32_TSC can cause subsequent reads of the TSC * to return undefined values, so ignore all writes. * @@ -1474,6 +1481,7 @@ static enum es_result vc_handle_msr(struct ghcb *ghcb, struct es_em_ctxt *ctxt) case MSR_SVSM_CAA: return __vc_handle_msr_caa(regs, write); case MSR_IA32_TSC: + case MSR_AMD64_GUEST_TSC_FREQ: if (sev_status & MSR_AMD64_SNP_SECURE_TSC) return __vc_handle_secure_tsc_msrs(regs, write); else |