cachepc

Prime+Probe cache-based side-channel attack on AMD SEV-SNP protected virtual machines
git clone https://git.sinitax.com/sinitax/cachepc
Log | Files | Refs | Submodules | README | sfeed.txt

commit a44801f079e684dbc0956d9c3d6281eb6216957b
parent 0c0a898d2a5221561907c416757f6240b292e9c3
Author: Louis Burda <quent.burda@gmail.com>
Date:   Wed,  1 Feb 2023 07:03:51 -0600

Fix build, add more build instructions to README

Diffstat:
MMakefile | 12++++++------
MREADME | 17++++++++++++-----
Mcachepc/kvm.c | 2+-
3 files changed, 19 insertions(+), 12 deletions(-)

diff --git a/Makefile b/Makefile @@ -1,5 +1,5 @@ LINUX ?= linux -CORES ?= $(shell ls /dev/cpu | wc -l) +CORES ?= $(shell getconf _NPROCESSORS_ONLN) LOAD ?= $(CORES) JOBS ?= $(CORES) @@ -39,16 +39,16 @@ clean: $(LINUX)/arch/x86/kvm/cachepc: ln -sf $(PWD)/cachepc $@ -host: +linux: # build host kernel and Module.symvers for depmod cp extra/.config linux/.config git -C $(LINUX) add . git -C $(LINUX) stash - git -C $(LINUX) checkout 0aaa1e5 + git -C $(LINUX) checkout d9bd54fea4d2 rm -f $(LINUX)/arch/x86/kvm/cachepc - $(MAKE) -C $(LINUX) -j $(JOBS) -l $(LOAD) bindeb-pkg + $(MAKE) -C $(LINUX) -j $(JOBS) -l $(LOAD) git -C $(LINUX) checkout master - git -C $(LINUX) stash pop + git -C $(LINUX) stash pop || true build: $(LINUX)/arch/x86/kvm/cachepc $(MAKE) -C $(LINUX) -j $(JOBS) -l $(LOAD) M=arch/x86/kvm modules @@ -95,4 +95,4 @@ test/qemu-%: test/qemu-%.c $(TEST_SRCS) test/qemu-%_guest: test/qemu-%_guest.c $(CC) -o $@ $(filter %.c,$^) $(filter %.S,$^) $(GUEST_CFLAGS) $(LDLIBS) -.PHONY: all clean host build load prep +.PHONY: all clean linux build load prep diff --git a/README b/README @@ -95,8 +95,8 @@ Testing was done on a Supermicro H12SSL-i V1.01 motherboard and AMD EPYC 72F3 The following non-default BIOS settings were used: Advanced > CPU Configuration > Local APIC Mode = xAPIC -Advanced > CPU Configuration > Core Performance Boost = Disabled Advanced > CPU Configuration > SMT Control = Disabled +Advanced > CPU Configuration > Core Performance Boost = Disabled Advanced > CPU Configuration > Global C-state Control = Disabled Advanced > CPU Configuration > L1 Stream HW Prefetcher = Disabled Advanced > CPU Configuration > L2 Stream HW Prefetcher = Disabled @@ -105,18 +105,25 @@ Advanced > CPU Configuration > SEV ASID Count = 509 Advanced > CPU Configuration > SEV ASID Space Limit Control = Manual Advanced > CPU Configuration > SEV ASID Space Limit = 110 Advanced > CPU Configuration > SNP Memory (RMP Table) Coverage = Enabled +Advanced > CPU Configuration > SVM Mode = Enabled Advanced > North Bridge Configuration > SEV-SNP Support = Enabled Advanced > North Bridge Configuration > Memory Configuration > TSME = Disabled +The host kernel is built using the AMDESE/AMDSEV repo on branch sev-snp-devel +at commmit a480a51. Build and install the the host kernel and qemu by running: + +# ./bulid.sh --package +# cd snp-release-`date "+%Y-%m-%d"` +# ./install.sh + The following kernel parameters were used: -kvm_amd.sev=1 kvm_amd.sev_es=1 nokaslr debug systemd.log_level=info +kvm_amd.sev=1 kvm_amd.sev_es=1 nokaslr nosplash debug systemd.log_level=debug isolcpus=2,10,3,11 nohz_full=2,10,3,11 rcu_nocbs=2,10,3,11 nmi_watchdog=0 - transparent_hugepage=never apic lapic panic=-1 preempt=none quiet + transparent_hugepage=never apic lapic panic=-1 preempt=none To successfully build and load the kvm.ko and kvm-amd.ko modules, ensure -that a host kernel debian package was built using `make host`. - +that the full kernel was build atleast once using `make linux`. Note, the checked out commit of the modified kernel (previously the kernel patch file) may be incorrect for revisions older than 864f5fa9d539. diff --git a/cachepc/kvm.c b/cachepc/kvm.c @@ -590,7 +590,7 @@ cpc_req_pause_ioctl(void __user *arg_user) } long -cpc_ioctl(struct file *file, unsigned int ioctl, unsigned long arg) +cpc_kvm_ioctl(struct file *file, unsigned int ioctl, unsigned long arg) { void __user *arg_user;