lists.openwall.net   lists  /  announce  owl-users  owl-dev  john-users  john-dev  passwdqc-users  yescrypt  popa3d-users  /  oss-security  kernel-hardening  musl  sabotage  tlsify  passwords  /  crypt-dev  xvendor  /  Bugtraq  Full-Disclosure  linux-kernel  linux-netdev  linux-ext4  linux-hardening  PHC 
Open Source and information security mailing list archives
 
Hash Suite: Windows password security audit tool. GUI, reports in PDF.
[<prev] [next>] [thread-next>] [day] [month] [year] [list]
Date:   Sat,  9 May 2020 07:16:22 -0400
From:   Cathy Avery <cavery@...hat.com>
To:     linux-kernel@...r.kernel.org, kvm@...r.kernel.org,
        pbonzini@...hat.com
Subject: [PATCH kvm-unit-tests] svm: Test V_IRQ injection

Test V_IRQ injection from L1 to L2 with V_TPR less
than or greater than V_INTR_PRIO. Also test VINTR
intercept with differing V_TPR and V_INTR_PRIO.

Signed-off-by: Cathy Avery <cavery@...hat.com>
---
 x86/svm_tests.c | 150 ++++++++++++++++++++++++++++++++++++++++++++++++
 1 file changed, 150 insertions(+)

diff --git a/x86/svm_tests.c b/x86/svm_tests.c
index 65008ba..aa6f3c2 100644
--- a/x86/svm_tests.c
+++ b/x86/svm_tests.c
@@ -1595,6 +1595,153 @@ static bool exc_inject_check(struct svm_test *test)
     return count_exc == 1 && get_test_stage(test) == 3;
 }
 
+static volatile bool virq_fired;
+
+static void virq_isr(isr_regs_t *regs)
+{
+    virq_fired = true;
+}
+
+static void virq_inject_prepare(struct svm_test *test)
+{
+    handle_irq(0xf1, virq_isr);
+    default_prepare(test);
+    vmcb->control.int_ctl = V_INTR_MASKING_MASK | V_IRQ_MASK |
+                            (0x0f << V_INTR_PRIO_SHIFT); // Set to the highest priority
+    vmcb->control.int_vector = 0xf1;
+    virq_fired = false;
+    set_test_stage(test, 0);
+}
+
+static void virq_inject_test(struct svm_test *test)
+{
+    if (virq_fired) {
+        report(false, "virtual interrupt fired before L2 sti");
+        set_test_stage(test, -1);
+        vmmcall();
+    }
+
+    irq_enable();
+    asm volatile ("nop");
+    irq_disable();
+
+    if (!virq_fired) {
+        report(false, "virtual interrupt not fired after L2 sti");
+        set_test_stage(test, -1);
+    }
+
+    vmmcall();
+
+    if (virq_fired) {
+        report(false, "virtual interrupt fired before L2 sti after VINTR intercept");
+        set_test_stage(test, -1);
+        vmmcall();
+    }
+
+    irq_enable();
+    asm volatile ("nop");
+    irq_disable();
+
+    if (!virq_fired) {
+        report(false, "virtual interrupt not fired after return from VINTR intercept");
+        set_test_stage(test, -1);
+    }
+
+    vmmcall();
+
+    irq_enable();
+    asm volatile ("nop");
+    irq_disable();
+
+    if (virq_fired) {
+        report(false, "virtual interrupt fired when V_IRQ_PRIO less than V_TPR");
+        set_test_stage(test, -1);
+    }
+
+    vmmcall();
+    vmmcall();
+}
+
+static bool virq_inject_finished(struct svm_test *test)
+{
+    vmcb->save.rip += 3;
+
+    switch (get_test_stage(test)) {
+    case 0:
+        if (vmcb->control.exit_code != SVM_EXIT_VMMCALL) {
+            report(false, "VMEXIT not due to vmmcall. Exit reason 0x%x",
+                   vmcb->control.exit_code);
+            return true;
+        }
+        if (vmcb->control.int_ctl & V_IRQ_MASK) {
+            report(false, "V_IRQ not cleared on VMEXIT after firing");
+            return true;
+        }
+        virq_fired = false;
+        vmcb->control.intercept |= (1ULL << INTERCEPT_VINTR);
+        vmcb->control.int_ctl = V_INTR_MASKING_MASK | V_IRQ_MASK |
+                            (0x0f << V_INTR_PRIO_SHIFT);
+        break;
+
+    case 1:
+        if (vmcb->control.exit_code != SVM_EXIT_VINTR) {
+            report(false, "VMEXIT not due to vintr. Exit reason 0x%x",
+                   vmcb->control.exit_code);
+            return true;
+        }
+        if (virq_fired) {
+            report(false, "V_IRQ fired before SVM_EXIT_VINTR");
+            return true;
+        }
+        vmcb->control.intercept &= ~(1ULL << INTERCEPT_VINTR);
+        break;
+
+    case 2:
+        if (vmcb->control.exit_code != SVM_EXIT_VMMCALL) {
+            report(false, "VMEXIT not due to vmmcall. Exit reason 0x%x",
+                   vmcb->control.exit_code);
+            return true;
+        }
+        virq_fired = false;
+        // Set irq to lower priority
+        vmcb->control.int_ctl = V_INTR_MASKING_MASK | V_IRQ_MASK |
+                            (0x08 << V_INTR_PRIO_SHIFT);
+        // Raise guest TPR
+        vmcb->control.int_ctl |= 0x0a & V_TPR_MASK;
+        break;
+
+    case 3:
+        if (vmcb->control.exit_code != SVM_EXIT_VMMCALL) {
+            report(false, "VMEXIT not due to vmmcall. Exit reason 0x%x",
+                   vmcb->control.exit_code);
+            return true;
+        }
+        vmcb->control.intercept |= (1ULL << INTERCEPT_VINTR);
+        break;
+
+    case 4:
+        // INTERCEPT_VINTR should be ignored because V_INTR_PRIO < V_TPR
+        if (vmcb->control.exit_code != SVM_EXIT_VMMCALL) {
+            report(false, "VMEXIT not due to vmmcall. Exit reason 0x%x",
+                   vmcb->control.exit_code);
+            return true;
+        }
+        break;
+
+    default:
+        return true;
+    }
+
+    inc_test_stage(test);
+
+    return get_test_stage(test) == 5;
+}
+
+static bool virq_inject_check(struct svm_test *test)
+{
+    return get_test_stage(test) == 5;
+}
+
 #define TEST(name) { #name, .v2 = name }
 
 /*
@@ -1750,6 +1897,9 @@ struct svm_test svm_tests[] = {
     { "nmi_hlt", smp_supported, nmi_prepare,
       default_prepare_gif_clear, nmi_hlt_test,
       nmi_hlt_finished, nmi_hlt_check },
+    { "virq_inject", default_supported, virq_inject_prepare,
+      default_prepare_gif_clear, virq_inject_test,
+      virq_inject_finished, virq_inject_check },
     TEST(svm_guest_state_test),
     { NULL, NULL, NULL, NULL, NULL, NULL, NULL }
 };
-- 
2.20.1

Powered by blists - more mailing lists