linux-kernel - Re: [PATCH] KVM: SVM: fix trashing of MSR_TSC

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:	Wed, 6 Jul 2016 16:29:35 +0200
From:	Paolo Bonzini <pbonzini@...hat.com>
To:	Borislav Petkov <bp@...en8.de>
Cc:	linux-kernel@...r.kernel.org, kvm@...r.kernel.org,
	stable@...r.kernel.org
Subject: Re: [PATCH] KVM: SVM: fix trashing of MSR_TSC_AUX



On 06/07/2016 16:18, Borislav Petkov wrote:
> Something's still missing. I have a small program which does RDTSCP in
> the guest:
> 
> $ taskset -c 3 ./rdtscp
> aux1: 0x0
> aux2: 0x0
> p1: 195514968442, p2: 195515255582, 287140
> 
> and the aux things which are %ecx, are 0 (should be 3 in that case).

Ok, I'll take a look at it tomorrow.

Can you test this in the meanwhile:

   git clone git://git.kernel.org/pub/scm/virt/kvm/kvm-unit-tests.git
   cd kvm-unit-tests
   ./configure
   make
   ./x86/run x86/tsc.flat -cpu kvm64,+rdtscp

On Intel I see:

   enabling apic
   rdtsc latency 18
   rdtsc after wrtsc(0): 727124155
   rdtsc after wrtsc(100000000000): 100000001759
   PASS: Test RDTSCP 0
   PASS: Test RDTSCP 10
   PASS: Test RDTSCP 256
   SUMMARY: 3 tests

> It did work with my patch with the RDTSCP intercept:
> 
> $ taskset -c 3 ./rdtscp
> aux1: 0x3
> aux2: 0x3
> p1: 157117003683, p2: 157119280794, 2277111
> 
> Btw, just for my own understanding: if we don't intercept RDTSCP, does
> it get emulated? Where does the TSC value come from, qemu?

It comes from the processor's TSC + the TSC offset field in the VMCB.

Paolo

> 
> Here's the program.
> 
> ---
> 
> #include <stdio.h>
> #include <stdlib.h>
> #include <unistd.h>
> 
> typedef unsigned long long u64;
> 
> #define DECLARE_ARGS(val, low, high)    unsigned low, high
> #define EAX_EDX_VAL(val, low, high)     ((low) | ((u64)(high) << 32))
> #define EAX_EDX_ARGS(val, low, high)    "a" (low), "d" (high)
> #define EAX_EDX_RET(val, low, high)     "=a" (low), "=d" (high)
> 
> static __always_inline unsigned long long rdtscp(unsigned int *aux)
> {
> 	unsigned int lo, hi;
> 
>         asm volatile("rdtscp" : "=a" (lo), "=d" (hi), "=c" (*aux));
> 
>         return EAX_EDX_VAL(0, lo, hi);
> }
> 
> int main()
> {
> 	unsigned long long p1, p2;
> 	unsigned int aux;
> 
> 	p1 = rdtscp(&aux);
> 	printf("aux1: 0x%x\n", aux);
> 	p2 = rdtscp(&aux);
> 	printf("aux2: 0x%x\n", aux);
> 
> 	printf("p1: %llu, p2: %llu, %lld\n", p1, p2, p2 - p1);
> 
> 	return 0;
> }
>