Re-enabling AES-NI on VPSes that don't pass the feature through

forest

Oops, I made a mistake. /etc/environment is only for PAM. The real solution is to set the variable in DefaultEnvironment for /etc/systemd/system.conf and then export it in /etc/profile or a file in /etc/profile.d.

Example after doing it correctly:

root@forest-noackhosting-1-se:~# grep OPENSSL_ia32cap /etc/systemd/system.conf
DefaultEnvironment="OPENSSL_ia32cap=0x82202003479bfffd"
root@forest-noackhosting-1-se:~# grep OPENSSL_ia32cap /etc/profile.d/openssl-cpuid-override.sh
export OPENSSL_ia32cap=0x82202003479bfffd

I hate that I can't update my post to fix it.

raindog308

Updated

forest

@raindog308 said:
Updated

Thank you!!

Seems there was a small truncation though. It's missing << 57))/e' at the very end of the perl line (i.e. it should end in | (1 << 57))/e' instead of | (1).

Edit: I see you already fixed it. Thanks!

raindog308

Weird...it was there. I changed the pre tags to code tags which fixed it.

Silly Vanilla.

TimboJones

@forest said:
Annoyingly, No Ack Hosting (https://noackhosting.se) has just told me they cannot do host passthrough or accept any flag passthrough besides AES-NI, so for everything but unauthenticated AES, I'm stuck with pre-2005 features. Apparently, the last time they "tried to add special flags" they lost the whole node and had to spend 8 hours bringing it back.

Well, at least I have been able to forcibly re-enable PCLMULQDQ, but I'm still stuck without important security features, including some which allow cross-VM snooping and even breaking encryption due to low-entropy at boot (a problem that was solved in 2012). So yeah... If they didn't allow exits, I'd be cancelling right now.

Plot twist: intentionally old insecure CPUs to spy on TOR.

They say it's a limit of the Hostbill control software, but they really have no reason not to just enable full CPU passthrough (which Hostbill can do). I can re-enable all the performance features I need myself since they aren't disabled, just not advertised, but some of the security-relevant features actually do require hypervisor cooperation, sadly. I won't be an MJJ and argue with him in tickets about whether or not host CPU passthrough "exposes the host to the guests" or try to convince him that, yes, virtio-rng is something that is used for VPSes, so I'll have to leave it be. It is what it is.

Fuck. When the AIs figure out how to exploit these old CPUs it's Internet Armageddon.