87 lines
5.2 KiB
Markdown
87 lines
5.2 KiB
Markdown
# Patchsets, by the detection each one clears
|
|
|
|
Every patch here is grouped by the VMAware check it targets, so a patchset can be taken or left
|
|
on its own. Apply from the relevant source root with `patch -p1 < <file>`.
|
|
|
|
## KVM - `kvm/`
|
|
|
|
Built against kernel 7.2.x. Builds as `arch/x86/kvm` only, about five minutes; no full kernel
|
|
build is needed. See `packaging/` for a PKGBUILD that does it and keeps it rebuilt.
|
|
|
|
| Patch | Clears | What it does |
|
|
| --- | --- | --- |
|
|
| `0001-KVM-SVM-intercept-GP-when-guest-EFER.SVME-is-clear` | `SVM_EXCEPTIONS` | Closes a `FIXME` KVM already carries: a CPL3 SVM instruction faults `#GP` where hardware gives `#UD`. |
|
|
| `0002-KVM-x86-emulator-UD-not-GP-for-VMCALL-at-CPL-0` | `KVM_INTERCEPTION` | Adds `PrivUD` so `VMCALL` at CPL>0 raises `#UD` like hardware. |
|
|
| `0003-KVM-x86-UD-for-KVM-hypercalls-issued-at-CPL-0` | `KVM_INTERCEPTION` | A CPL>0 hypercall raised no exception at all; now raises `#UD`. |
|
|
| `0004-KVM-SVM-intercept-ICEBP-and-skip-it-before-injecting-its-DB` | `DBVM` | SVM re-injected the `ICEBP` `#DB` with RIP still on the `F1` byte; VMX and hardware report the next instruction. |
|
|
| `0005-KVM-selftests-verify-ICEBP-DB-reports-RIP-past-the-ICEBP` | - | The selftest for 0004: fails on unpatched SVM, passes with it. |
|
|
| `EXPERIMENTAL-0006-runtime-cpuid-passthrough` | `TIMER` | Drops CPUID and RDPRU interception on a 1:1-pinned vCPU and reprograms the AMD Processor Name String MSRs so raw `CPUID` still returns the declared brand. Opt-in via the `cpuid_passthrough` module parameter. |
|
|
|
|
**0002 and 0003 are a pair.** Either alone leaves `KVM_INTERCEPTION` standing, because the check
|
|
tries two stubs and only reports the first one that misbehaves.
|
|
|
|
The first five are written to be acceptable upstream: they make KVM match the architecture rather
|
|
than add anything on top of it, each carries its rationale in the commit message, and all four
|
|
pass `checkpatch.pl --strict`. `0000-cover-letter.txt` is the series cover letter. They
|
|
have been tested on AMD only; 0002 and 0003 are vendor-neutral code and the Intel reasoning is in
|
|
the cover letter.
|
|
|
|
**`EXPERIMENTAL-0006` is built into the `vfio-native-kvm-dkms` package but off by default.** It
|
|
removes the cost the `TIMER` instruction-latency detector measures, and with it the guest reads
|
|
raw host CPUID, so it applies itself only to vCPU threads confined to exactly one CPU and must be
|
|
enabled through the `cpuid_passthrough` module parameter after the guest has booted.
|
|
`docs/ANALYSIS.md` has the measurements and the constraints.
|
|
|
|
## QEMU - `qemu/`
|
|
|
|
Against QEMU v11.1.1. Apply in numeric order.
|
|
|
|
| Patch | Clears |
|
|
| --- | --- |
|
|
| `01-firmware` | `FIRMWARE` - ACPI link-device names, `PNP0A06` stubs, FADT C-state latencies |
|
|
| `02-disk-identity` | `VIRTUAL_DISK`, `DISK_SERIAL` - `QEMU HARDDISK`, empty serials, SCSI inquiry strings |
|
|
| `03-pci-ids` | `PCI_VENDOR`, `DEVICES` - Red Hat/QEMU vendor and subsystem IDs, ICH9 layout |
|
|
| `04-fw-cfg` | `QEMU_FW_CFG` - the fw_cfg device signature |
|
|
| `05-usb-hid` | `QEMU_USB` - USB HID descriptor strings |
|
|
| `06-audio` | `DEVICES` - HDA codec and controller identity |
|
|
| `07-edid` | none. Carried for other detectors; VMAware does not read EDID. |
|
|
| `08-cpu-misc` | none. CPU feature plumbing and one upstream backport. |
|
|
|
|
`patch -p1 < qemu/01-firmware.patch` and so on, then build with the prefix set to `/opt` so the
|
|
system QEMU package is left alone:
|
|
|
|
```sh
|
|
./configure --prefix=/opt/qemu-native --target-list=x86_64-softmmu
|
|
ninja -C build && ninja -C build install
|
|
```
|
|
|
|
## Approaches tried and rejected - kept so they are not re-derived
|
|
|
|
| Approach | Result |
|
|
| --- | --- |
|
|
| Patched OVMF firmware (`edk2`) | Builds, then hangs before console init at 100% CPU, cause undiagnosed. Stock OVMF is fine and costs only the boot-logo warning. |
|
|
| TSC compensation for `TIMER` (BetterTiming) | No detection change, 6x slower boot. |
|
|
| CPUID leaf override (Hypervisor-Phantom) | Halved the timing signature, still detected, and *added* a `SINGLE_STEP` detection. |
|
|
| Clearing `INTERCEPT_CPUID` outright | Guest never boots. |
|
|
| Intercept clearing, minimal hypercall | Triple fault, or no effect. |
|
|
|
|
`TIMER` has two detectors that OR together. The exception-latency one passes on stock KVM once it
|
|
is measured the way VMAware measures it; the instruction-latency one is removable with
|
|
`EXPERIMENTAL-0006`. `docs/ANALYSIS.md` has the measurements, including a direct reproduction of
|
|
both in `bench/timerprobe.c`.
|
|
|
|
## Identity values in these patches
|
|
|
|
Several patches carry a concrete make and model because no real machine leaves the field blank.
|
|
Every one of them is a placeholder. Change them before you use this, or a detector gains a
|
|
fingerprint shared by everyone who ran the same patch series.
|
|
|
|
| Where | Value | Replace with |
|
|
| --- | --- | --- |
|
|
| `02-disk-identity` | disk serial `S0123456789ABCD` | set `<serial>` on the disk in the domain XML; this fallback then never runs |
|
|
| `02-disk-identity` | disk and optical drive model strings | a drive you actually own, from `lsblk -o NAME,MODEL` |
|
|
| `07-edid` | monitor vendor and model | your own panel, from `edid-decode < /sys/class/drm/*/edid` |
|
|
|
|
The SMBIOS values are not patched into QEMU at all - they are domain XML, taken from a real
|
|
machine with `dmidecode`. Change every serial there too.
|