linux-kernel.vger.kernel.org archive mirror
 help / color / mirror / Atom feed
From: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
To: linux-kernel@vger.kernel.org
Cc: Greg Kroah-Hartman <gregkh@linuxfoundation.org>,
	stable@vger.kernel.org, Bart Oldeman <bartoldeman@gmail.com>,
	Andy Lutomirski <luto@kernel.org>, Borislav Petkov <bp@alien8.de>,
	Brian Gerst <brgerst@gmail.com>,
	Denys Vlasenko <dvlasenk@redhat.com>,
	"H. Peter Anvin" <hpa@zytor.com>,
	Josh Poimboeuf <jpoimboe@redhat.com>,
	Linus Torvalds <torvalds@linux-foundation.org>,
	Peter Zijlstra <peterz@infradead.org>,
	Stas Sergeev <stsp@list.ru>, Thomas Gleixner <tglx@linutronix.de>,
	Ingo Molnar <mingo@kernel.org>
Subject: [PATCH 4.15 04/52] selftests/x86/entry_from_vm86: Add test cases for POPF
Date: Mon, 19 Mar 2018 19:08:02 +0100	[thread overview]
Message-ID: <20180319180735.259095372@linuxfoundation.org> (raw)
In-Reply-To: <20180319180734.976730813@linuxfoundation.org>

4.15-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Andy Lutomirski <luto@kernel.org>

commit 78393fdde2a456cafa414b171c90f26a3df98b20 upstream.

POPF is currently broken -- add tests to catch the error.  This
results in:

   [RUN]	POPF with VIP set and IF clear from vm86 mode
   [INFO]	Exited vm86 mode due to STI
   [FAIL]	Incorrect return reason (started at eip = 0xd, ended at eip = 0xf)

because POPF currently fails to check IF before reporting a pending
interrupt.

This patch also makes the FAIL message a bit more informative.

Reported-by: Bart Oldeman <bartoldeman@gmail.com>
Signed-off-by: Andy Lutomirski <luto@kernel.org>
Cc: Borislav Petkov <bp@alien8.de>
Cc: Brian Gerst <brgerst@gmail.com>
Cc: Denys Vlasenko <dvlasenk@redhat.com>
Cc: H. Peter Anvin <hpa@zytor.com>
Cc: Josh Poimboeuf <jpoimboe@redhat.com>
Cc: Linus Torvalds <torvalds@linux-foundation.org>
Cc: Peter Zijlstra <peterz@infradead.org>
Cc: Stas Sergeev <stsp@list.ru>
Cc: Thomas Gleixner <tglx@linutronix.de>
Cc: stable@vger.kernel.org
Link: http://lkml.kernel.org/r/a16270b5cfe7832d6d00c479d0f871066cbdb52b.1521003603.git.luto@kernel.org
Signed-off-by: Ingo Molnar <mingo@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 tools/testing/selftests/x86/entry_from_vm86.c |   30 +++++++++++++++++++++++---
 1 file changed, 27 insertions(+), 3 deletions(-)

--- a/tools/testing/selftests/x86/entry_from_vm86.c
+++ b/tools/testing/selftests/x86/entry_from_vm86.c
@@ -95,6 +95,10 @@ asm (
 	"int3\n\t"
 	"vmcode_int80:\n\t"
 	"int $0x80\n\t"
+	"vmcode_popf_hlt:\n\t"
+	"push %ax\n\t"
+	"popf\n\t"
+	"hlt\n\t"
 	"vmcode_umip:\n\t"
 	/* addressing via displacements */
 	"smsw (2052)\n\t"
@@ -124,8 +128,8 @@ asm (
 
 extern unsigned char vmcode[], end_vmcode[];
 extern unsigned char vmcode_bound[], vmcode_sysenter[], vmcode_syscall[],
-	vmcode_sti[], vmcode_int3[], vmcode_int80[], vmcode_umip[],
-	vmcode_umip_str[], vmcode_umip_sldt[];
+	vmcode_sti[], vmcode_int3[], vmcode_int80[], vmcode_popf_hlt[],
+	vmcode_umip[], vmcode_umip_str[], vmcode_umip_sldt[];
 
 /* Returns false if the test was skipped. */
 static bool do_test(struct vm86plus_struct *v86, unsigned long eip,
@@ -175,7 +179,7 @@ static bool do_test(struct vm86plus_stru
 	    (VM86_TYPE(ret) == rettype && VM86_ARG(ret) == retarg)) {
 		printf("[OK]\tReturned correctly\n");
 	} else {
-		printf("[FAIL]\tIncorrect return reason\n");
+		printf("[FAIL]\tIncorrect return reason (started at eip = 0x%lx, ended at eip = 0x%lx)\n", eip, v86->regs.eip);
 		nerrs++;
 	}
 
@@ -264,6 +268,9 @@ int main(void)
 	v86.regs.ds = load_addr / 16;
 	v86.regs.es = load_addr / 16;
 
+	/* Use the end of the page as our stack. */
+	v86.regs.esp = 4096;
+
 	assert((v86.regs.cs & 3) == 0);	/* Looks like RPL = 0 */
 
 	/* #BR -- should deliver SIG??? */
@@ -295,6 +302,23 @@ int main(void)
 	v86.regs.eflags &= ~X86_EFLAGS_IF;
 	do_test(&v86, vmcode_sti - vmcode, VM86_STI, 0, "STI with VIP set");
 
+	/* POPF with VIP set but IF clear: should not trap */
+	v86.regs.eflags = X86_EFLAGS_VIP;
+	v86.regs.eax = 0;
+	do_test(&v86, vmcode_popf_hlt - vmcode, VM86_UNKNOWN, 0, "POPF with VIP set and IF clear");
+
+	/* POPF with VIP set and IF set: should trap */
+	v86.regs.eflags = X86_EFLAGS_VIP;
+	v86.regs.eax = X86_EFLAGS_IF;
+	do_test(&v86, vmcode_popf_hlt - vmcode, VM86_STI, 0, "POPF with VIP and IF set");
+
+	/* POPF with VIP clear and IF set: should not trap */
+	v86.regs.eflags = 0;
+	v86.regs.eax = X86_EFLAGS_IF;
+	do_test(&v86, vmcode_popf_hlt - vmcode, VM86_UNKNOWN, 0, "POPF with VIP clear and IF set");
+
+	v86.regs.eflags = 0;
+
 	/* INT3 -- should cause #BP */
 	do_test(&v86, vmcode_int3 - vmcode, VM86_TRAP, 3, "INT3");
 

  parent reply	other threads:[~2018-03-19 18:08 UTC|newest]

Thread overview: 62+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2018-03-19 18:07 [PATCH 4.15 00/52] 4.15.12-stable review Greg Kroah-Hartman
2018-03-19 18:07 ` [PATCH 4.15 01/52] x86/cpufeatures: Add Intel Total Memory Encryption cpufeature Greg Kroah-Hartman
2018-03-19 18:08 ` [PATCH 4.15 02/52] x86/cpufeatures: Add Intel PCONFIG cpufeature Greg Kroah-Hartman
2018-03-19 18:08 ` [PATCH 4.15 03/52] selftests/x86/entry_from_vm86: Exit with 1 if we fail Greg Kroah-Hartman
2018-03-19 18:08 ` Greg Kroah-Hartman [this message]
2018-03-19 18:08 ` [PATCH 4.15 05/52] x86/vm86/32: Fix POPF emulation Greg Kroah-Hartman
2018-03-19 18:08 ` [PATCH 4.15 06/52] x86/speculation, objtool: Annotate indirect calls/jumps for objtool on 32-bit kernels Greg Kroah-Hartman
2018-03-19 18:08 ` [PATCH 4.15 07/52] x86/speculation: Remove Skylake C2 from Speculation Control microcode blacklist Greg Kroah-Hartman
2018-03-19 18:08 ` [PATCH 4.15 08/52] KVM: x86: Fix device passthrough when SME is active Greg Kroah-Hartman
2018-03-19 18:08 ` [PATCH 4.15 09/52] x86/mm: Fix vmalloc_fault to use pXd_large Greg Kroah-Hartman
2018-03-19 18:08 ` [PATCH 4.15 10/52] parisc: Handle case where flush_cache_range is called with no context Greg Kroah-Hartman
2018-03-19 18:08 ` [PATCH 4.15 11/52] ALSA: pcm: Fix UAF in snd_pcm_oss_get_formats() Greg Kroah-Hartman
2018-03-19 18:08 ` [PATCH 4.15 12/52] ALSA: hda - Revert power_save option default value Greg Kroah-Hartman
2018-03-19 18:08 ` [PATCH 4.15 13/52] ALSA: seq: Fix possible UAF in snd_seq_check_queue() Greg Kroah-Hartman
2018-03-19 18:08 ` [PATCH 4.15 14/52] ALSA: seq: Clear client entry before deleting else at closing Greg Kroah-Hartman
2018-03-19 18:08 ` [PATCH 4.15 15/52] drm/nouveau/bl: Fix oops on driver unbind Greg Kroah-Hartman
2018-03-19 18:08 ` [PATCH 4.15 16/52] drm/nouveau/mmu: ALIGN_DOWN correct variable Greg Kroah-Hartman
2018-03-19 18:08 ` [PATCH 4.15 17/52] drm/amdgpu: fix prime teardown order Greg Kroah-Hartman
2018-03-19 18:08 ` [PATCH 4.15 18/52] drm/radeon: " Greg Kroah-Hartman
2018-03-19 18:08 ` [PATCH 4.15 19/52] drm/amdgpu/dce: Dont turn off DP sink when disconnected Greg Kroah-Hartman
2018-03-19 18:08 ` [PATCH 4.15 20/52] fs: Teach path_connected to handle nfs filesystems with multiple roots Greg Kroah-Hartman
2018-03-19 18:08 ` [PATCH 4.15 21/52] KVM: arm/arm64: Reduce verbosity of KVM init log Greg Kroah-Hartman
2018-03-19 18:08 ` [PATCH 4.15 22/52] KVM: arm/arm64: Reset mapped IRQs on VM reset Greg Kroah-Hartman
2018-03-19 18:08 ` [PATCH 4.15 23/52] kvm: arm/arm64: vgic-v3: Tighten synchronization for guests using v2 on v3 Greg Kroah-Hartman
2018-03-19 18:08 ` [PATCH 4.15 24/52] KVM: arm/arm64: vgic: Dont populate multiple LRs with the same vintid Greg Kroah-Hartman
2018-03-19 18:08 ` [PATCH 4.15 25/52] lock_parent() needs to recheck if dentry got __dentry_killed under it Greg Kroah-Hartman
2018-03-19 18:08 ` [PATCH 4.15 26/52] fs/aio: Add explicit RCU grace period when freeing kioctx Greg Kroah-Hartman
2018-03-19 18:08 ` [PATCH 4.15 27/52] fs/aio: Use RCU accessors for kioctx_table->table[] Greg Kroah-Hartman
2018-03-19 18:08 ` [PATCH 4.15 28/52] RDMAVT: Fix synchronization around percpu_ref Greg Kroah-Hartman
2018-03-19 18:08 ` [PATCH 4.15 29/52] irqchip/gic-v3-its: Ensure nr_ites >= nr_lpis Greg Kroah-Hartman
2018-03-19 18:08 ` [PATCH 4.15 30/52] nvme: fix subsystem multiple controllers support check Greg Kroah-Hartman
2018-03-19 18:08 ` [PATCH 4.15 31/52] xfs: preserve i_rdev when recycling a reclaimable inode Greg Kroah-Hartman
2018-03-19 18:08 ` [PATCH 4.15 32/52] btrfs: Fix NULL pointer exception in find_bio_stripe Greg Kroah-Hartman
2018-03-19 18:08 ` [PATCH 4.15 33/52] btrfs: add missing initialization in btrfs_check_shared Greg Kroah-Hartman
2018-03-19 18:08 ` [PATCH 4.15 34/52] btrfs: alloc_chunk: fix DUP stripe size handling Greg Kroah-Hartman
2018-03-19 18:08 ` [PATCH 4.15 35/52] btrfs: Fix use-after-free when cleaning up fs_devs with a single stale device Greg Kroah-Hartman
2018-03-19 18:08 ` [PATCH 4.15 36/52] btrfs: remove spurious WARN_ON(ref->count < 0) in find_parent_nodes Greg Kroah-Hartman
2018-03-19 18:08 ` [PATCH 4.15 37/52] btrfs: Fix memory barriers usage with device stats counters Greg Kroah-Hartman
2018-03-19 18:08 ` [PATCH 4.15 38/52] scsi: qla2xxx: Fix smatch warning in qla25xx_delete_{rsp|req}_que Greg Kroah-Hartman
2018-03-19 18:08 ` [PATCH 4.15 39/52] scsi: qla2xxx: Fix NULL pointer access for fcport structure Greg Kroah-Hartman
2018-03-19 18:08 ` [PATCH 4.15 40/52] scsi: qla2xxx: Fix logo flag for qlt_free_session_done() Greg Kroah-Hartman
2018-03-19 18:08 ` [PATCH 4.15 41/52] scsi: qla2xxx: Fix crashes in qla2x00_probe_one on probe failure Greg Kroah-Hartman
2018-03-19 18:08 ` [PATCH 4.15 42/52] usb: dwc2: fix STM32F7 USB OTG HS compatible Greg Kroah-Hartman
2018-03-19 18:08 ` [PATCH 4.15 43/52] dt-bindings: usb: fix the STM32F7 DWC2 OTG HS core binding Greg Kroah-Hartman
2018-03-19 18:08 ` [PATCH 4.15 44/52] USB: gadget: udc: Add missing platform_device_put() on error in bdc_pci_probe() Greg Kroah-Hartman
2018-03-19 18:08 ` [PATCH 4.15 45/52] usb: dwc3: Fix GDBGFIFOSPACE_TYPE values Greg Kroah-Hartman
2018-03-19 18:08 ` [PATCH 4.15 46/52] usb: dwc3: core: Power-off core/PHYs on system_suspend in host mode Greg Kroah-Hartman
2018-03-19 18:08 ` [PATCH 4.15 47/52] usb: dwc3: of-simple: fix oops by unbalanced clk disable call Greg Kroah-Hartman
2018-03-19 18:08 ` [PATCH 4.15 48/52] usb: gadget: udc: renesas_usb3: fix oops in renesas_usb3_remove() Greg Kroah-Hartman
2018-03-19 18:08 ` [PATCH 4.15 49/52] phy: phy-brcm-usb: Fix two DT properties to match bindings doc Greg Kroah-Hartman
2018-03-19 18:08 ` [PATCH 4.15 50/52] phy: phy-brcm-usb-init: Some Low Speed keyboards fail on 7271 Greg Kroah-Hartman
2018-03-19 18:08 ` [PATCH 4.15 51/52] phy: phy-brcm-usb-init: DRD mode can cause crash on startup Greg Kroah-Hartman
2018-03-19 18:08 ` [PATCH 4.15 52/52] phy: phy-brcm-usb-init: Power down USB 3.0 PHY when XHCI disabled Greg Kroah-Hartman
2018-03-19 23:20 ` [PATCH 4.15 00/52] 4.15.12-stable review kernelci.org bot
2018-03-20  6:47 ` Naresh Kamboju
2018-03-20  7:44   ` Greg Kroah-Hartman
2018-03-20 12:24 ` Thadeu Lima de Souza Cascardo
2018-03-21 11:07   ` Greg Kroah-Hartman
2018-03-20 16:11 ` Guenter Roeck
2018-03-21 12:29   ` Greg Kroah-Hartman
2018-03-20 20:11 ` Shuah Khan
2018-03-21  9:42   ` Greg Kroah-Hartman

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=20180319180735.259095372@linuxfoundation.org \
    --to=gregkh@linuxfoundation.org \
    --cc=bartoldeman@gmail.com \
    --cc=bp@alien8.de \
    --cc=brgerst@gmail.com \
    --cc=dvlasenk@redhat.com \
    --cc=hpa@zytor.com \
    --cc=jpoimboe@redhat.com \
    --cc=linux-kernel@vger.kernel.org \
    --cc=luto@kernel.org \
    --cc=mingo@kernel.org \
    --cc=peterz@infradead.org \
    --cc=stable@vger.kernel.org \
    --cc=stsp@list.ru \
    --cc=tglx@linutronix.de \
    --cc=torvalds@linux-foundation.org \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).