cachepc

Prime+Probe cache-based side-channel attack on AMD SEV-SNP protected virtual machines
git clone https://git.sinitax.com/sinitax/cachepc
Log | Files | Refs | Submodules | README | sfeed.txt

commit bb2c0277010fa5fc3010dca79685d527bd87d9fb
parent 1f418a1c4480cef90b8596ae17bdca9cc7ca1b88
Author: Louis Burda <quent.burda@gmail.com>
Date:   Fri, 27 Jan 2023 16:33:27 +0100

Add CPC_TRACK_STEPS and make apic reset more robust

Diffstat:
MMakefile | 2+-
Mcachepc/cachepc.h | 6++++++
Mcachepc/const.h | 1+
Mcachepc/event.c | 6+++---
Mcachepc/kvm.c | 6++++++
Mcachepc/uapi.h | 3+--
Mtest/kvm-step.c | 4----
Mtest/qemu-eviction.c | 5++---
Mtest/qemu-pagestep | 0
Mtest/qemu-pagestep.c | 15++++++++-------
10 files changed, 28 insertions(+), 20 deletions(-)

diff --git a/Makefile b/Makefile @@ -73,7 +73,7 @@ test/%.o: test/%.S test/%: test/%.c $(TEST_SRCS) $(CC) -o $@ $(filter %.c,$^) $(filter %.S,$^) $(CFLAGS) $(LDLIBS) -test/kvm-%_guest: test/kvm-%_guest.o test/guest.lds +test/kvm-%_guest: test/kvm-%_guest.o test/kvm-guest.lds $(LD) -Ttest/kvm-guest.lds -o $@ $< test/kvm-%: test/kvm-%.c $(TEST_SRCS) diff --git a/cachepc/cachepc.h b/cachepc/cachepc.h @@ -43,6 +43,11 @@ struct cpc_track_pages { bool step; }; +struct cpc_track_steps { + bool exec_avail; + bool exec_gfn; +}; + struct cpc_track_steps_signalled { bool enabled; bool target_avail; @@ -106,6 +111,7 @@ extern uint64_t cachepc_rip_prev; extern bool cachepc_rip_prev_set; extern struct cpc_track_pages cpc_track_pages; +extern struct cpc_track_steps cpc_track_steps; extern struct cpc_track_steps_signalled cpc_track_steps_signalled; extern struct list_head cachepc_faults; diff --git a/cachepc/const.h b/cachepc/const.h @@ -21,3 +21,4 @@ #define CPC_CL_COUNT_OFFSET 16 #define CPC_APIC_TIMER_SOFTDIV 3 +#define CPC_APIC_TIMER_MIN (100 * CPC_APIC_TIMER_SOFTDIV) diff --git a/cachepc/event.c b/cachepc/event.c @@ -113,10 +113,11 @@ cachepc_send_track_step_event(struct list_head *list) break; event.step.fault_gfns[count] = fault->gfn; event.step.fault_errs[count] = fault->err; + if (fault->err & PFERR_FETCH_MASK) + event.step.inst_gfn = fault->gfn; count += 1; } event.step.fault_count = count; - event.step.timestamp_ns = ktime_get_real_ns(); event.step.retinst = cachepc_retinst; return cachepc_send_event(event); @@ -131,7 +132,6 @@ cachepc_send_track_page_event(uint64_t gfn_prev, uint64_t gfn, uint64_t retinst) event.type = CPC_EVENT_TRACK_PAGE; event.page.inst_gfn_prev = gfn_prev; event.page.inst_gfn = gfn; - event.page.timestamp_ns = ktime_get_real_ns(); event.page.retinst = retinst; return cachepc_send_event(event); @@ -147,7 +147,7 @@ cachepc_send_track_step_event_single(uint64_t gfn, uint32_t err, uint64_t retins event.step.fault_count = 1; event.step.fault_gfns[0] = gfn; event.step.fault_errs[0] = err; - event.step.timestamp_ns = ktime_get_real_ns(); + event.step.inst_gfn = gfn; event.step.retinst = retinst; return cachepc_send_event(event); diff --git a/cachepc/kvm.c b/cachepc/kvm.c @@ -72,8 +72,10 @@ LIST_HEAD(cachepc_faults); EXPORT_SYMBOL(cachepc_faults); struct cpc_track_pages cpc_track_pages; +struct cpc_track_steps cpc_track_steps; struct cpc_track_steps_signalled cpc_track_steps_signalled; EXPORT_SYMBOL(cpc_track_pages); +EXPORT_SYMBOL(cpc_track_steps); EXPORT_SYMBOL(cpc_track_steps_signalled); struct cacheline *cachepc_ds_ul = NULL; @@ -485,6 +487,9 @@ cachepc_kvm_track_mode_ioctl(void __user *arg_user) memset(&cpc_track_pages, 0, sizeof(cpc_track_pages)); cachepc_track_all(vcpu, KVM_PAGE_TRACK_EXEC); break; + case CPC_TRACK_STEPS: + memset(&cpc_track_steps, 0, sizeof(cpc_track_steps)); + break; case CPC_TRACK_STEPS_AND_FAULTS: cachepc_prime_probe = true; cachepc_track_all(vcpu, KVM_PAGE_TRACK_ACCESS); @@ -666,6 +671,7 @@ cachepc_kvm_init(void) cachepc_long_step = false; cachepc_singlestep = false; cachepc_singlestep_reset = false; + cachepc_prime_probe = false; cachepc_track_mode = CPC_TRACK_NONE; cachepc_apic_oneshot = false; diff --git a/cachepc/uapi.h b/cachepc/uapi.h @@ -72,14 +72,13 @@ struct cpc_track_step_event { __u64 fault_gfns[16]; __u32 fault_errs[16]; __u64 fault_count; - __u64 timestamp_ns; + __u64 inst_gfn; __u64 retinst; }; struct cpc_track_page_event { __u64 inst_gfn_prev; __u64 inst_gfn; - __u64 timestamp_ns; __u64 retinst; }; diff --git a/test/kvm-step.c b/test/kvm-step.c @@ -136,20 +136,16 @@ main(int argc, const char **argv) eventcnt += monitor(&kvm, true); } - printf("Monitor req pause\n"); ret = ioctl(kvm_dev, KVM_CPC_VM_REQ_PAUSE); if (ret) err(1, "KVM_CPC_VM_REQ_PAUSE"); while (1) { - printf("Monitor Polling\n"); ret = ioctl(kvm_dev, KVM_CPC_POLL_EVENT, &event); if (ret && errno == EAGAIN) continue; if (ret) err(1, "KVM_CPC_POLL_EVENT"); - printf("Monitor Event\n"); if (event.type == CPC_EVENT_PAUSE) break; - printf("Skipping non-pause event..\n"); ret = ioctl(kvm_dev, KVM_CPC_ACK_EVENT, &event.id); if (ret) err(1, "KVM_CPC_ACK_EVENT"); } diff --git a/test/qemu-eviction.c b/test/qemu-eviction.c @@ -38,10 +38,9 @@ monitor(bool baseline) if (ret) err(1, "KVM_CPC_READ_COUNTS"); printf("Event: rip:%016llx cnt:%llu " - "inst:%08llx data:%08llx ret:%llu\n", + "inst:%08llx ret:%llu\n", vm_get_rip(), event.step.fault_count, - event.step.fault_gfns[0], event.step.fault_gfns[1], - event.step.retinst); + event.step.inst_gfn, event.step.retinst); print_counts(counts); printf("\n"); print_counts_raw(counts); diff --git a/test/qemu-pagestep b/test/qemu-pagestep Binary files differ. diff --git a/test/qemu-pagestep.c b/test/qemu-pagestep.c @@ -25,13 +25,14 @@ monitor(void) if (ret && errno == EAGAIN) return; if (ret) err(1, "KVM_CPC_POLL_EVENT"); - if (event.type != CPC_EVENT_TRACK_PAGE) - errx(1, "unexpected event type %i", event.type); - - printf("Event: rip:%016llx prev:%08llx next:%08llx ret:%llu\n", - vm_get_rip(), event.page.inst_gfn_prev, - event.page.inst_gfn, event.page.retinst); - printf("\n"); + if (event.type == CPC_EVENT_TRACK_PAGE) { + printf("Event: rip:%016llx prev:%08llx next:%08llx ret:%llu\n", + vm_get_rip(), event.page.inst_gfn_prev, + event.page.inst_gfn, event.page.retinst); + printf("\n"); + } else { + printf("Unexpected event type %i\n", event.type); + } ret = ioctl(kvm_dev, KVM_CPC_ACK_EVENT, &event.id); if (ret) err(1, "KVM_CPC_ACK_EVENT");