1 // SPDX-License-Identifier: GPL-2.0-or-later
2 /*
3 * Copyright (C) 2023 SUSE LLC
4 * Author: Nicolai Stange <[email protected]>
5 * LTP port: Martin Doucha <[email protected]>
6 */
7
8 /*\
9 * Check that KVM correctly intercepts the CLGI instruction in a nested
10 * virtual machine even when the parent guest disables intercept.
11 * If KVM does not override the disabled intercept, it'll allow the nested VM
12 * to hold the physical CPU indefinitely and potentially perform a denial
13 * of service attack against the host kernel. CPU lockup fixed in:
14 *
15 * commit 91b7130cb6606d8c6b3b77e54426b3f3a83f48b1
16 * Author: Paolo Bonzini <[email protected]>
17 * Date: Fri May 22 12:28:52 2020 -0400
18 *
19 * KVM: SVM: preserve VGIF across VMCB switch
20 */
21
22 #include "kvm_test.h"
23
24 #ifdef COMPILE_PAYLOAD
25 #if defined(__i386__) || defined(__x86_64__)
26
27 #include "kvm_x86_svm.h"
28
29 /* Disable global interrupts */
guest_clgi(void)30 static int guest_clgi(void)
31 {
32 int ret, *result = (int *)KVM_RESULT_BASEADDR;
33
34 /*
35 * Make sure that result page is present in memory. CLGI may disable
36 * page fault handling on the current CPU. The actual value
37 * at that address is irrelevant.
38 */
39 ret = *result;
40
41 /* Disable global interrupts */
42 asm ("clgi");
43
44 /* Signal host to kill the VM and wait */
45 tst_wait_host(NULL);
46 return ret;
47 }
48
main(void)49 void main(void)
50 {
51 struct kvm_svm_vcpu *vcpu;
52
53 kvm_init_svm();
54 vcpu = kvm_create_svm_vcpu(guest_clgi, 1);
55 kvm_vmcb_set_intercept(vcpu->vmcb, SVM_INTERCEPT_CLGI, 0);
56 kvm_svm_vmrun(vcpu);
57
58 if (vcpu->vmcb->exitcode != SVM_EXIT_HLT)
59 tst_brk(TBROK, "Nested VM exited unexpectedly");
60 }
61
62 #else /* defined(__i386__) || defined(__x86_64__) */
63 TST_TEST_TCONF("Test supported only on x86");
64 #endif /* defined(__i386__) || defined(__x86_64__) */
65
66 #else /* COMPILE_PAYLOAD */
67
68 #include <pthread.h>
69 #include "tst_safe_pthread.h"
70 #include "tst_safe_clocks.h"
71
72 static struct tst_kvm_instance test_vm = { .vm_fd = -1 };
73 static pthread_mutex_t mutex;
74 static int mutex_init;
75
sighandler(int sig LTP_ATTRIBUTE_UNUSED)76 static void sighandler(int sig LTP_ATTRIBUTE_UNUSED)
77 {
78
79 }
80
vm_thread(void * arg)81 static void *vm_thread(void *arg)
82 {
83 SAFE_PTHREAD_MUTEX_LOCK(&mutex);
84 tst_kvm_run_instance(&test_vm, EINTR);
85 SAFE_PTHREAD_MUTEX_UNLOCK(&mutex);
86 return arg;
87 }
88
setup(void)89 static void setup(void)
90 {
91 struct sigaction sa = { .sa_handler = sighandler };
92 pthread_mutexattr_t attr;
93
94 SAFE_PTHREAD_MUTEXATTR_INIT(&attr);
95 SAFE_PTHREAD_MUTEXATTR_SETTYPE(&attr, PTHREAD_MUTEX_NORMAL);
96 SAFE_PTHREAD_MUTEX_INIT(&mutex, &attr);
97 mutex_init = 1;
98 SAFE_PTHREAD_MUTEXATTR_DESTROY(&attr);
99 SAFE_SIGACTION(SIGUSR1, &sa, NULL);
100 }
101
run(void)102 static void run(void)
103 {
104 struct timespec timeout;
105 pthread_t tid;
106 int ret;
107
108 tst_kvm_create_instance(&test_vm, DEFAULT_RAM_SIZE);
109
110 SAFE_PTHREAD_CREATE(&tid, NULL, vm_thread, NULL);
111 ret = tst_kvm_wait_guest(&test_vm, 2000);
112
113 if (ret == KVM_TEXIT) {
114 SAFE_PTHREAD_JOIN(tid, NULL);
115 tst_brk(TCONF, "Guest exited early");
116 }
117
118 if (ret)
119 tst_brk(TBROK, "Wait for guest initialization timed out");
120
121 SAFE_PTHREAD_KILL(tid, SIGUSR1);
122 SAFE_CLOCK_GETTIME(CLOCK_REALTIME, &timeout);
123 timeout.tv_sec += 2;
124
125 if (SAFE_PTHREAD_MUTEX_TIMEDLOCK(&mutex, &timeout)) {
126 tst_kvm_clear_guest_signal(&test_vm);
127 tst_res(TFAIL, "VM thread does not respond to signals");
128 } else {
129 SAFE_PTHREAD_MUTEX_UNLOCK(&mutex);
130 tst_res(TPASS, "VM thread was interrupted by signal");
131 }
132
133 SAFE_PTHREAD_JOIN(tid, NULL);
134 tst_kvm_destroy_instance(&test_vm);
135 tst_free_all();
136 }
137
cleanup(void)138 static void cleanup(void)
139 {
140 /*
141 * If the mutex is locked, the VM is likely still running, cannot
142 * clean up anything
143 */
144 if (!mutex_init || SAFE_PTHREAD_MUTEX_TRYLOCK(&mutex))
145 return;
146
147 if (!SAFE_PTHREAD_MUTEX_UNLOCK(&mutex))
148 SAFE_PTHREAD_MUTEX_DESTROY(&mutex);
149
150 tst_kvm_destroy_instance(&test_vm);
151 }
152
153 static struct tst_test test = {
154 .test_all = run,
155 .setup = setup,
156 .cleanup = cleanup,
157 .min_cpus = 2,
158 .supported_archs = (const char *const []) {
159 "x86_64",
160 "x86",
161 NULL
162 },
163 .tags = (struct tst_tag[]){
164 {"linux-git", "91b7130cb660"},
165 {}
166 }
167 };
168
169 #endif /* COMPILE_PAYLOAD */
170