cachepc

Prime+Probe cache-based side-channel attack on AMD SEV-SNP protected virtual machines
git clone https://git.sinitax.com/sinitax/cachepc
Log | Files | Refs | Submodules | README | sfeed.txt

commit 67a8d49c83c224e8e0a4e71ebe6fc52e3425f121
parent 73d05743b02dd32f516c1d31fb01eb6fc11e3d6a
Author: Vincent Ulitzsch <vincent@sec.tu-berlin.de>
Date:   Wed, 31 Aug 2022 00:48:58 +0200

Hang reproducible, but no bugfix yet

Diffstat:
Mtest/sev.c | 13++++++++-----
1 file changed, 8 insertions(+), 5 deletions(-)

diff --git a/test/sev.c b/test/sev.c @@ -62,13 +62,16 @@ static int cachepc_fd; #define TARGET_CACHE_LINESIZE 64 #define TARGET_SET 15 +//https://events19.linuxfoundation.org/wp-content/uploads/2017/12/Extending-Secure-Encrypted-Virtualization-with-SEV-ES-Thomas-Lendacky-AMD.pdf +//https://www.spinics.net/lists/linux-kselftest/msg27206.html __attribute__((section("guest_with"))) void vm_guest_with(void) { while (1) { - asm volatile("mov (%[v]), %%bl" - : : [v] "r" (TARGET_CACHE_LINESIZE * TARGET_SET)); + //asm volatile("mov (%[v]), %%bl" + // : : [v] "r" (TARGET_CACHE_LINESIZE * TARGET_SET)); asm volatile("hlt"); + //asm volatile("rep; vmmcall\n\r"); //asm volatile("out %%al, (%%dx)" : : ); } } @@ -571,9 +574,9 @@ main(int argc, const char **argv) //return 0; for (i = 0; i < SAMPLE_COUNT; i++) { - counts = collect("without", __start_guest_without, __stop_guest_without); - memcpy(without_access[i], counts, 64 * sizeof(uint16_t)); - free(counts); + //counts = collect("without", __start_guest_without, __stop_guest_without); + //memcpy(without_access[i], counts, 64 * sizeof(uint16_t)); + //free(counts); counts = collect("with", __start_guest_with, __stop_guest_with); memcpy(with_access[i], counts, 64 * sizeof(uint16_t));