Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

kvm/x86: Add pristine ECTX check #897

Closed
wants to merge 2 commits into from
Closed

kvm/x86: Add pristine ECTX check #897

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
93bb089
arch/x86: Add function to check for unmodified ectx
mschlumpp May 16, 2023
e8c8342
plat/kvm: Add ectx assertion in interrupt handler
mschlumpp May 16, 2023
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
28 changes: 28 additions & 0 deletions arch/x86/ectx.c
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -40,6 +40,7 @@
#include <uk/essentials.h>
#include <uk/assert.h>
#include <uk/print.h>
#include <uk/hexdump.h>
#include <string.h> /* memset */

enum x86_save_method {
Expand Down Expand Up @@ -173,3 +174,30 @@ void ukarch_ectx_load(struct ukarch_ectx *state)
break;
}
}

#ifdef CONFIG_ARCH_X86_64
void ukarch_ectx_assert_equal(struct ukarch_ectx *state)
{
__u8 ectxbuf[ectx_size + ectx_align];
struct ukarch_ectx *current;

/* Store the current state */
current = (struct ukarch_ectx *)ALIGN_UP((__uptr)ectxbuf, ectx_align);
ukarch_ectx_init(current);

if (memcmp(current, state, ectx_size) != 0) {
uk_pr_crit("Modified ECTX detected!\n");
uk_pr_crit("Current:\n");
uk_hexdumpk(KLVL_CRIT, current, ectx_size,
UK_HXDF_ADDR | UK_HXDF_GRPQWORD | UK_HXDF_COMPRESS,
2);

uk_pr_crit("Expected:\n");
uk_hexdumpk(KLVL_CRIT, state, ectx_size,
UK_HXDF_ADDR | UK_HXDF_GRPQWORD | UK_HXDF_COMPRESS,
2);
mschlumpp marked this conversation as resolved.
Show resolved Hide resolved

UK_CRASH("Modified ECTX\n");
}
}
#endif
11 changes: 11 additions & 0 deletions include/uk/arch/ctx.h
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -231,5 +231,16 @@ void ukarch_ectx_store(struct ukarch_ectx *state);
*/
void ukarch_ectx_load(struct ukarch_ectx *state);

#ifdef CONFIG_ARCH_X86_64
/**
* Compare the given extended context with the state of the currently executing
* CPU. If the state is different, crash the kernel.
*
* @param state
* Reference to extended context to compare to
*/
void ukarch_ectx_assert_equal(struct ukarch_ectx *state);
#endif

#endif /* !__ASSEMBLY__ */
#endif /* __UKARCH_CTX_H__ */
5 changes: 5 additions & 0 deletions plat/Config.uk
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -41,6 +41,11 @@ config UKPLAT_LCPU_WAKEUP_IRQ

endmenu

config UKPLAT_ISR_ECTX_ASSERTIONS
bool "Check for unmodified ECTX in interrupt handlers"
default n
depends on (ARCH_X86_64 && PLAT_KVM)

menuconfig PAGING
bool "Virtual memory API"
default n
Expand Down
14 changes: 14 additions & 0 deletions plat/kvm/irq.c
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -38,6 +38,9 @@
#include <uk/print.h>
#include <errno.h>
#include <uk/bitops.h>
#ifdef CONFIG_UKPLAT_ISR_ECTX_ASSERTIONS
#include <uk/arch/ctx.h>
#endif

UK_EVENT(UKPLAT_EVENT_IRQ);

Expand Down Expand Up @@ -99,6 +102,14 @@ void _ukplat_irq_handle(struct __regs *regs, unsigned long irq)
int i;
int rc;
struct ukplat_event_irq_data ctx;
#ifdef CONFIG_UKPLAT_ISR_ECTX_ASSERTIONS
__sz ectx_align = ukarch_ectx_align();
__u8 ectxbuf[ukarch_ectx_size() + ectx_align];
struct ukarch_ectx *ectx = (struct ukarch_ectx *)
ALIGN_UP((__uptr) ectxbuf, ectx_align);

ukarch_ectx_init(ectx);
#endif

UK_ASSERT(irq < __MAX_IRQ);

Expand Down Expand Up @@ -143,6 +154,9 @@ void _ukplat_irq_handle(struct __regs *regs, unsigned long irq)
trace_plat_kvm_unhandled_irq(irq);

exit_ack:
#ifdef CONFIG_UKPLAT_ISR_ECTX_ASSERTIONS
ukarch_ectx_assert_equal(ectx);
#endif
intctrl_ack_irq(irq);
}

Expand Down