Re: [PATCH] KVM: SVM: fix trashing of MSR_TSC_AUX

From: Paolo Bonzini
Date: Wed Jul 06 2016 - 10:29:51 EST




On 06/07/2016 16:18, Borislav Petkov wrote:
> Something's still missing. I have a small program which does RDTSCP in
> the guest:
>
> $ taskset -c 3 ./rdtscp
> aux1: 0x0
> aux2: 0x0
> p1: 195514968442, p2: 195515255582, 287140
>
> and the aux things which are %ecx, are 0 (should be 3 in that case).

Ok, I'll take a look at it tomorrow.

Can you test this in the meanwhile:

git clone git://git.kernel.org/pub/scm/virt/kvm/kvm-unit-tests.git
cd kvm-unit-tests
./configure
make
./x86/run x86/tsc.flat -cpu kvm64,+rdtscp

On Intel I see:

enabling apic
rdtsc latency 18
rdtsc after wrtsc(0): 727124155
rdtsc after wrtsc(100000000000): 100000001759
PASS: Test RDTSCP 0
PASS: Test RDTSCP 10
PASS: Test RDTSCP 256
SUMMARY: 3 tests

> It did work with my patch with the RDTSCP intercept:
>
> $ taskset -c 3 ./rdtscp
> aux1: 0x3
> aux2: 0x3
> p1: 157117003683, p2: 157119280794, 2277111
>
> Btw, just for my own understanding: if we don't intercept RDTSCP, does
> it get emulated? Where does the TSC value come from, qemu?

It comes from the processor's TSC + the TSC offset field in the VMCB.

Paolo

>
> Here's the program.
>
> ---
>
> #include <stdio.h>
> #include <stdlib.h>
> #include <unistd.h>
>
> typedef unsigned long long u64;
>
> #define DECLARE_ARGS(val, low, high) unsigned low, high
> #define EAX_EDX_VAL(val, low, high) ((low) | ((u64)(high) << 32))
> #define EAX_EDX_ARGS(val, low, high) "a" (low), "d" (high)
> #define EAX_EDX_RET(val, low, high) "=a" (low), "=d" (high)
>
> static __always_inline unsigned long long rdtscp(unsigned int *aux)
> {
> unsigned int lo, hi;
>
> asm volatile("rdtscp" : "=a" (lo), "=d" (hi), "=c" (*aux));
>
> return EAX_EDX_VAL(0, lo, hi);
> }
>
> int main()
> {
> unsigned long long p1, p2;
> unsigned int aux;
>
> p1 = rdtscp(&aux);
> printf("aux1: 0x%x\n", aux);
> p2 = rdtscp(&aux);
> printf("aux2: 0x%x\n", aux);
>
> printf("p1: %llu, p2: %llu, %lld\n", p1, p2, p2 - p1);
>
> return 0;
> }
>