Re-enabling AES-NI on VPSes that don't pass the feature through

Comments

• forest Member

  July 20 edited July 21

  Oops, I made a mistake. /etc/environment is only for PAM. The real solution is to set the variable in DefaultEnvironment for /etc/systemd/system.conf and then export it in /etc/profile or a file in /etc/profile.d.

  Example after doing it correctly:

  root@forest-noackhosting-1-se:~# grep OPENSSL_ia32cap /etc/systemd/system.conf
  DefaultEnvironment="OPENSSL_ia32cap=0x82202003479bfffd"
  root@forest-noackhosting-1-se:~# grep OPENSSL_ia32cap /etc/profile.d/openssl-cpuid-override.sh
  export OPENSSL_ia32cap=0x82202003479bfffd
  

  I hate that I can't update my post to fix it.
• raindog308 Administrator, Veteran

  July 21

  Updated

  

  Thanked by 1forest
• forest Member

  July 21 edited July 21

  @raindog308 said:
  Updated

  

  Thank you!!

  Seems there was a small truncation though. It's missing << 57))/e' at the very end of the perl line (i.e. it should end in | (1 << 57))/e' instead of | (1).

  Edit: I see you already fixed it. Thanks!
• raindog308 Administrator, Veteran

  July 21

  Weird...it was there. I changed the pre tags to code tags which fixed it.

  Silly Vanilla.

  Thanked by 3forest rpqu tux
• TimboJones Member

  July 21

  @forest said:
  Annoyingly, No Ack Hosting (https://noackhosting.se) has just told me they cannot do host passthrough or accept any flag passthrough besides AES-NI, so for everything but unauthenticated AES, I'm stuck with pre-2005 features. Apparently, the last time they "tried to add special flags" they lost the whole node and had to spend 8 hours bringing it back.

  Well, at least I have been able to forcibly re-enable PCLMULQDQ, but I'm still stuck without important security features, including some which allow cross-VM snooping and even breaking encryption due to low-entropy at boot (a problem that was solved in 2012). So yeah... If they didn't allow exits, I'd be cancelling right now.

  Plot twist: intentionally old insecure CPUs to spy on TOR.

  They say it's a limit of the Hostbill control software, but they really have no reason not to just enable full CPU passthrough (which Hostbill can do). I can re-enable all the performance features I need myself since they aren't disabled, just not advertised, but some of the security-relevant features actually do require hypervisor cooperation, sadly. I won't be an MJJ and argue with him in tickets about whether or not host CPU passthrough "exposes the host to the guests" or try to convince him that, yes, virtio-rng is something that is used for VPSes, so I'll have to leave it be. It is what it is.

  Fuck. When the AIs figure out how to exploit these old CPUs it's Internet Armageddon.

  Thanked by 1tux
• duracell3 Member

  12:31AM edited 12:33AM

  The process was slightly different running Alpine with OpenRC.
  we write the output to /etc/profile.d/aes-ni.sh and make it executable (kind of looks like so):
  export OPENSSL_ia32cap=0x82202001479bfffd:0x0000000000000000:0x0000000000000000:0x0000000000000000:0x0000000000000000

  Increased my openssl benchmarks between 2-7x on a Sandy-Bridge era Xeon from Dedirock.
  I can only imagine how much money they are throwing away on their already oversold CPU boxes.

  Thanked by 1forest