Commit eef679a4 authored by Nikunj A Dadhania's avatar Nikunj A Dadhania Committed by Borislav Petkov (AMD)
Browse files

x86/sev: Prevent RDTSC/RDTSCP interception for Secure TSC enabled guests 



The hypervisor should not be intercepting RDTSC/RDTSCP when Secure TSC is
enabled. A #VC exception will be generated if the RDTSC/RDTSCP instructions
are being intercepted. If this should occur and Secure TSC is enabled,
guest execution should be terminated as the guest cannot rely on the TSC
value provided by the hypervisor.

Signed-off-by: default avatarNikunj A Dadhania <nikunj@amd.com>
Signed-off-by: default avatarBorislav Petkov (AMD) <bp@alien8.de>
Reviewed-by: default avatarTom Lendacky <thomas.lendacky@amd.com>
Tested-by: default avatarPeter Gonda <pgonda@google.com>
Link: https://lore.kernel.org/r/20250106124633.1418972-9-nikunj@amd.com
parent 38cc6495

arch/x86/coco/sev/shared.c

+10 −0
Original line number Diff line number Diff line
@@ -1140,6 +1140,16 @@ static enum es_result vc_handle_rdtsc(struct ghcb *ghcb, 
	bool rdtscp = (exit_code == SVM_EXIT_RDTSCP);

	enum es_result ret;



	/*

	 * The hypervisor should not be intercepting RDTSC/RDTSCP when Secure

	 * TSC is enabled. A #VC exception will be generated if the RDTSC/RDTSCP

	 * instructions are being intercepted. If this should occur and Secure

	 * TSC is enabled, guest execution should be terminated as the guest

	 * cannot rely on the TSC value provided by the hypervisor.

	 */

	if (sev_status & MSR_AMD64_SNP_SECURE_TSC)

		return ES_VMM_ERROR;



	ret = sev_es_ghcb_hv_call(ghcb, ctxt, exit_code, 0, 0);

	if (ret != ES_OK)

		return ret;