| lists.openwall.net | lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC | |
|
Open Source and information security mailing list archives
| ||
|
Message-ID: <4097f4fe-f941-a8ef-8d93-3164f0b0441d@redhat.com>
Date: Sat, 9 May 2020 14:58:32 +0200
From: Paolo Bonzini <pbonzini@...hat.com>
To: Cathy Avery <cavery@...hat.com>, linux-kernel@...r.kernel.org,
kvm@...r.kernel.org
Subject: Re: [PATCH kvm-unit-tests] svm: Test V_IRQ injection
On 09/05/20 13:16, Cathy Avery wrote:
> Test V_IRQ injection from L1 to L2 with V_TPR less
> than or greater than V_INTR_PRIO. Also test VINTR
> intercept with differing V_TPR and V_INTR_PRIO.
>
> Signed-off-by: Cathy Avery <cavery@...hat.com>
> ---
> x86/svm_tests.c | 150 ++++++++++++++++++++++++++++++++++++++++++++++++
> 1 file changed, 150 insertions(+)
>
> diff --git a/x86/svm_tests.c b/x86/svm_tests.c
> index 65008ba..aa6f3c2 100644
> --- a/x86/svm_tests.c
> +++ b/x86/svm_tests.c
> @@ -1595,6 +1595,153 @@ static bool exc_inject_check(struct svm_test *test)
> return count_exc == 1 && get_test_stage(test) == 3;
> }
>
> +static volatile bool virq_fired;
> +
> +static void virq_isr(isr_regs_t *regs)
> +{
> + virq_fired = true;
> +}
> +
> +static void virq_inject_prepare(struct svm_test *test)
> +{
> + handle_irq(0xf1, virq_isr);
> + default_prepare(test);
> + vmcb->control.int_ctl = V_INTR_MASKING_MASK | V_IRQ_MASK |
> + (0x0f << V_INTR_PRIO_SHIFT); // Set to the highest priority
> + vmcb->control.int_vector = 0xf1;
> + virq_fired = false;
> + set_test_stage(test, 0);
> +}
> +
> +static void virq_inject_test(struct svm_test *test)
> +{
> + if (virq_fired) {
> + report(false, "virtual interrupt fired before L2 sti");
> + set_test_stage(test, -1);
> + vmmcall();
> + }
> +
> + irq_enable();
> + asm volatile ("nop");
> + irq_disable();
> +
> + if (!virq_fired) {
> + report(false, "virtual interrupt not fired after L2 sti");
> + set_test_stage(test, -1);
> + }
> +
> + vmmcall();
> +
> + if (virq_fired) {
> + report(false, "virtual interrupt fired before L2 sti after VINTR intercept");
> + set_test_stage(test, -1);
> + vmmcall();
> + }
> +
> + irq_enable();
> + asm volatile ("nop");
> + irq_disable();
> +
> + if (!virq_fired) {
> + report(false, "virtual interrupt not fired after return from VINTR intercept");
> + set_test_stage(test, -1);
> + }
> +
> + vmmcall();
> +
> + irq_enable();
> + asm volatile ("nop");
> + irq_disable();
> +
> + if (virq_fired) {
> + report(false, "virtual interrupt fired when V_IRQ_PRIO less than V_TPR");
> + set_test_stage(test, -1);
> + }
> +
> + vmmcall();
> + vmmcall();
> +}
> +
> +static bool virq_inject_finished(struct svm_test *test)
> +{
> + vmcb->save.rip += 3;
> +
> + switch (get_test_stage(test)) {
> + case 0:
> + if (vmcb->control.exit_code != SVM_EXIT_VMMCALL) {
> + report(false, "VMEXIT not due to vmmcall. Exit reason 0x%x",
> + vmcb->control.exit_code);
> + return true;
> + }
> + if (vmcb->control.int_ctl & V_IRQ_MASK) {
> + report(false, "V_IRQ not cleared on VMEXIT after firing");
> + return true;
> + }
> + virq_fired = false;
> + vmcb->control.intercept |= (1ULL << INTERCEPT_VINTR);
> + vmcb->control.int_ctl = V_INTR_MASKING_MASK | V_IRQ_MASK |
> + (0x0f << V_INTR_PRIO_SHIFT);
> + break;
> +
> + case 1:
> + if (vmcb->control.exit_code != SVM_EXIT_VINTR) {
> + report(false, "VMEXIT not due to vintr. Exit reason 0x%x",
> + vmcb->control.exit_code);
> + return true;
> + }
> + if (virq_fired) {
> + report(false, "V_IRQ fired before SVM_EXIT_VINTR");
> + return true;
> + }
> + vmcb->control.intercept &= ~(1ULL << INTERCEPT_VINTR);
> + break;
> +
> + case 2:
> + if (vmcb->control.exit_code != SVM_EXIT_VMMCALL) {
> + report(false, "VMEXIT not due to vmmcall. Exit reason 0x%x",
> + vmcb->control.exit_code);
> + return true;
> + }
> + virq_fired = false;
> + // Set irq to lower priority
> + vmcb->control.int_ctl = V_INTR_MASKING_MASK | V_IRQ_MASK |
> + (0x08 << V_INTR_PRIO_SHIFT);
> + // Raise guest TPR
> + vmcb->control.int_ctl |= 0x0a & V_TPR_MASK;
> + break;
> +
> + case 3:
> + if (vmcb->control.exit_code != SVM_EXIT_VMMCALL) {
> + report(false, "VMEXIT not due to vmmcall. Exit reason 0x%x",
> + vmcb->control.exit_code);
> + return true;
> + }
> + vmcb->control.intercept |= (1ULL << INTERCEPT_VINTR);
> + break;
> +
> + case 4:
> + // INTERCEPT_VINTR should be ignored because V_INTR_PRIO < V_TPR
> + if (vmcb->control.exit_code != SVM_EXIT_VMMCALL) {
> + report(false, "VMEXIT not due to vmmcall. Exit reason 0x%x",
> + vmcb->control.exit_code);
> + return true;
> + }
> + break;
> +
> + default:
> + return true;
> + }
> +
> + inc_test_stage(test);
> +
> + return get_test_stage(test) == 5;
> +}
> +
> +static bool virq_inject_check(struct svm_test *test)
> +{
> + return get_test_stage(test) == 5;
> +}
> +
> #define TEST(name) { #name, .v2 = name }
>
> /*
> @@ -1750,6 +1897,9 @@ struct svm_test svm_tests[] = {
> { "nmi_hlt", smp_supported, nmi_prepare,
> default_prepare_gif_clear, nmi_hlt_test,
> nmi_hlt_finished, nmi_hlt_check },
> + { "virq_inject", default_supported, virq_inject_prepare,
> + default_prepare_gif_clear, virq_inject_test,
> + virq_inject_finished, virq_inject_check },
> TEST(svm_guest_state_test),
> { NULL, NULL, NULL, NULL, NULL, NULL, NULL }
> };
>
Queued, thanks.
Paolo
Powered by blists - more mailing lists