linux-kernel - Re: kvm: RDTSCP on AMD

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:	Wed, 6 Jul 2016 15:01:04 +0200
From:	Paolo Bonzini <pbonzini@...hat.com>
To:	Borislav Petkov <bp@...en8.de>,
	Eduardo Habkost <ehabkost@...hat.com>
Cc:	Jörg Rödel <joro@...tes.org>,
	Andre Przywara <andre.przywara@....com>,
	kvm ML <kvm@...r.kernel.org>,
	lkml <linux-kernel@...r.kernel.org>
Subject: Re: kvm: RDTSCP on AMD

On 06/07/2016 14:44, Borislav Petkov wrote:
> Hi guys,
> 
> how about this below to enable RDTSCP emulation on AMD? IOW, I'm staring
> at
> 
>   33b5e8c03ae7 ("target-i386: Disable rdtscp on Opteron_G* CPU models")
> 
> in the qemu repo.
> 
> It seems to work here, RDTSCP in the guest gives me node and cpu as
> vsyscall_set_cpu() in the guest kernel has set them.
> 
> Thoughts?
> 
> (Below is the simple qemu diff reenabling RDTSCP)
> 
> @@ -3919,6 +3935,7 @@ static int (*const svm_exit_handlers[])(struct vcpu_svm *svm) = {
>  	[SVM_EXIT_STGI]				= stgi_interception,
>  	[SVM_EXIT_CLGI]				= clgi_interception,
>  	[SVM_EXIT_SKINIT]			= skinit_interception,
> +	[SVM_EXIT_RDTSCP]			= rdtscp_interception,
>  	[SVM_EXIT_WBINVD]                       = wbinvd_interception,
>  	[SVM_EXIT_MONITOR]			= monitor_interception,
>  	[SVM_EXIT_MWAIT]			= mwait_interception,

Nothing is needed in the kernel actually.  You can skip the intercept
by running the guest with MSR_TSC_AUX set to the guest's expected value.
 Which KVM does, except that it's botched so I need to apply the
patch in https://lkml.org/lkml/2016/4/13/802.

> ---
> 
> qemu diff:
> 
> ---
> diff --git a/target-i386/cpu.c b/target-i386/cpu.c
> index 3bd3cfc3ad16..aa6d0d027d00 100644
> --- a/target-i386/cpu.c
> +++ b/target-i386/cpu.c

This is not enough because it's missing some backwards compatibility
gunk (similar to the include/hw/i386/pc.h parts of 33b5e8c03ae), but
it's enough for a proof of concept and to discuss it.

The main issue with this is that it would force a lockstep update of
QEMU and kernel, which we try to avoid.  I'm not sure if we have a
solution for this problem.  Eduardo?

Paolo