| lists.openwall.net | lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC | |
|
Open Source and information security mailing list archives
| ||
|
Date: Sat, 9 May 2020 07:16:22 -0400
From: Cathy Avery <cavery@...hat.com>
To: linux-kernel@...r.kernel.org, kvm@...r.kernel.org,
pbonzini@...hat.com
Subject: [PATCH kvm-unit-tests] svm: Test V_IRQ injection
Test V_IRQ injection from L1 to L2 with V_TPR less
than or greater than V_INTR_PRIO. Also test VINTR
intercept with differing V_TPR and V_INTR_PRIO.
Signed-off-by: Cathy Avery <cavery@...hat.com>
---
x86/svm_tests.c | 150 ++++++++++++++++++++++++++++++++++++++++++++++++
1 file changed, 150 insertions(+)
diff --git a/x86/svm_tests.c b/x86/svm_tests.c
index 65008ba..aa6f3c2 100644
--- a/x86/svm_tests.c
+++ b/x86/svm_tests.c
@@ -1595,6 +1595,153 @@ static bool exc_inject_check(struct svm_test *test)
return count_exc == 1 && get_test_stage(test) == 3;
}
+static volatile bool virq_fired;
+
+static void virq_isr(isr_regs_t *regs)
+{
+ virq_fired = true;
+}
+
+static void virq_inject_prepare(struct svm_test *test)
+{
+ handle_irq(0xf1, virq_isr);
+ default_prepare(test);
+ vmcb->control.int_ctl = V_INTR_MASKING_MASK | V_IRQ_MASK |
+ (0x0f << V_INTR_PRIO_SHIFT); // Set to the highest priority
+ vmcb->control.int_vector = 0xf1;
+ virq_fired = false;
+ set_test_stage(test, 0);
+}
+
+static void virq_inject_test(struct svm_test *test)
+{
+ if (virq_fired) {
+ report(false, "virtual interrupt fired before L2 sti");
+ set_test_stage(test, -1);
+ vmmcall();
+ }
+
+ irq_enable();
+ asm volatile ("nop");
+ irq_disable();
+
+ if (!virq_fired) {
+ report(false, "virtual interrupt not fired after L2 sti");
+ set_test_stage(test, -1);
+ }
+
+ vmmcall();
+
+ if (virq_fired) {
+ report(false, "virtual interrupt fired before L2 sti after VINTR intercept");
+ set_test_stage(test, -1);
+ vmmcall();
+ }
+
+ irq_enable();
+ asm volatile ("nop");
+ irq_disable();
+
+ if (!virq_fired) {
+ report(false, "virtual interrupt not fired after return from VINTR intercept");
+ set_test_stage(test, -1);
+ }
+
+ vmmcall();
+
+ irq_enable();
+ asm volatile ("nop");
+ irq_disable();
+
+ if (virq_fired) {
+ report(false, "virtual interrupt fired when V_IRQ_PRIO less than V_TPR");
+ set_test_stage(test, -1);
+ }
+
+ vmmcall();
+ vmmcall();
+}
+
+static bool virq_inject_finished(struct svm_test *test)
+{
+ vmcb->save.rip += 3;
+
+ switch (get_test_stage(test)) {
+ case 0:
+ if (vmcb->control.exit_code != SVM_EXIT_VMMCALL) {
+ report(false, "VMEXIT not due to vmmcall. Exit reason 0x%x",
+ vmcb->control.exit_code);
+ return true;
+ }
+ if (vmcb->control.int_ctl & V_IRQ_MASK) {
+ report(false, "V_IRQ not cleared on VMEXIT after firing");
+ return true;
+ }
+ virq_fired = false;
+ vmcb->control.intercept |= (1ULL << INTERCEPT_VINTR);
+ vmcb->control.int_ctl = V_INTR_MASKING_MASK | V_IRQ_MASK |
+ (0x0f << V_INTR_PRIO_SHIFT);
+ break;
+
+ case 1:
+ if (vmcb->control.exit_code != SVM_EXIT_VINTR) {
+ report(false, "VMEXIT not due to vintr. Exit reason 0x%x",
+ vmcb->control.exit_code);
+ return true;
+ }
+ if (virq_fired) {
+ report(false, "V_IRQ fired before SVM_EXIT_VINTR");
+ return true;
+ }
+ vmcb->control.intercept &= ~(1ULL << INTERCEPT_VINTR);
+ break;
+
+ case 2:
+ if (vmcb->control.exit_code != SVM_EXIT_VMMCALL) {
+ report(false, "VMEXIT not due to vmmcall. Exit reason 0x%x",
+ vmcb->control.exit_code);
+ return true;
+ }
+ virq_fired = false;
+ // Set irq to lower priority
+ vmcb->control.int_ctl = V_INTR_MASKING_MASK | V_IRQ_MASK |
+ (0x08 << V_INTR_PRIO_SHIFT);
+ // Raise guest TPR
+ vmcb->control.int_ctl |= 0x0a & V_TPR_MASK;
+ break;
+
+ case 3:
+ if (vmcb->control.exit_code != SVM_EXIT_VMMCALL) {
+ report(false, "VMEXIT not due to vmmcall. Exit reason 0x%x",
+ vmcb->control.exit_code);
+ return true;
+ }
+ vmcb->control.intercept |= (1ULL << INTERCEPT_VINTR);
+ break;
+
+ case 4:
+ // INTERCEPT_VINTR should be ignored because V_INTR_PRIO < V_TPR
+ if (vmcb->control.exit_code != SVM_EXIT_VMMCALL) {
+ report(false, "VMEXIT not due to vmmcall. Exit reason 0x%x",
+ vmcb->control.exit_code);
+ return true;
+ }
+ break;
+
+ default:
+ return true;
+ }
+
+ inc_test_stage(test);
+
+ return get_test_stage(test) == 5;
+}
+
+static bool virq_inject_check(struct svm_test *test)
+{
+ return get_test_stage(test) == 5;
+}
+
#define TEST(name) { #name, .v2 = name }
/*
@@ -1750,6 +1897,9 @@ struct svm_test svm_tests[] = {
{ "nmi_hlt", smp_supported, nmi_prepare,
default_prepare_gif_clear, nmi_hlt_test,
nmi_hlt_finished, nmi_hlt_check },
+ { "virq_inject", default_supported, virq_inject_prepare,
+ default_prepare_gif_clear, virq_inject_test,
+ virq_inject_finished, virq_inject_check },
TEST(svm_guest_state_test),
{ NULL, NULL, NULL, NULL, NULL, NULL, NULL }
};
--
2.20.1
Powered by blists - more mailing lists