b867c18285
- kvm-hw-ide-reset-cancel-async-DMA-operation-before-reset.patch [RHEL-15437] - kvm-tests-qtest-ahci-test-add-test-exposing-reset-issue-.patch [RHEL-15437] - Resolves: RHEL-15437 (CVE-2023-5088 virt:rhel/qemu-kvm: QEMU: improper IDE controller reset can lead to MBR overwrite [rhel-8])
152 lines
5.2 KiB
Diff
152 lines
5.2 KiB
Diff
From b5a7e5e22a52d11034b997d2bd363c3f83f168e9 Mon Sep 17 00:00:00 2001
|
|
From: Jon Maloy <jmaloy@redhat.com>
|
|
Date: Fri, 24 Nov 2023 12:17:53 -0500
|
|
Subject: [PATCH 2/2] tests/qtest: ahci-test: add test exposing reset issue
|
|
with pending callback
|
|
MIME-Version: 1.0
|
|
Content-Type: text/plain; charset=UTF-8
|
|
Content-Transfer-Encoding: 8bit
|
|
|
|
RH-Author: Jon Maloy <jmaloy@redhat.com>
|
|
RH-MergeRequest: 335: hw/ide: reset: cancel async DMA operation before resetting state
|
|
RH-Jira: RHEL-15437
|
|
RH-Acked-by: Hanna Czenczek <hreitz@redhat.com>
|
|
RH-Acked-by: Paolo Bonzini <pbonzini@redhat.com>
|
|
RH-Commit: [2/2] 364e0703d22d69a4c1cfcff250ad0a3c81ada7b2 (redhat/rhel/src/qemu-kvm/jons-qemu-kvm-2)
|
|
|
|
JIRA: https://issues.redhat.com/browse/RHEL-15437
|
|
CVE: CVE-2023-5088
|
|
Upstream: Merged
|
|
|
|
commit cc610857bbd3551f4b86ae2299336b5d9aa0db2b
|
|
Author: Fiona Ebner <f.ebner@proxmox.com>
|
|
Date: Wed Sep 6 15:09:22 2023 +0200
|
|
|
|
tests/qtest: ahci-test: add test exposing reset issue with pending callback
|
|
|
|
Before commit "hw/ide: reset: cancel async DMA operation before
|
|
resetting state", this test would fail, because a reset with a
|
|
pending write operation would lead to an unsolicited write to the
|
|
first sector of the disk.
|
|
|
|
The test writes a pattern to the beginning of the disk and verifies
|
|
that it is still intact after a reset with a pending operation. It
|
|
also checks that the pending operation actually completes correctly.
|
|
|
|
Signed-off-by: Fiona Ebner <f.ebner@proxmox.com>
|
|
Message-ID: <20230906130922.142845-2-f.ebner@proxmox.com>
|
|
Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
|
|
|
|
Signed-off-by: Jon Maloy <jmaloy@redhat.com>
|
|
---
|
|
tests/qtest/ahci-test.c | 86 ++++++++++++++++++++++++++++++++++++++++-
|
|
1 file changed, 85 insertions(+), 1 deletion(-)
|
|
|
|
diff --git a/tests/qtest/ahci-test.c b/tests/qtest/ahci-test.c
|
|
index 8073ccc205..b4d15566e1 100644
|
|
--- a/tests/qtest/ahci-test.c
|
|
+++ b/tests/qtest/ahci-test.c
|
|
@@ -1425,6 +1425,89 @@ static void test_reset(void)
|
|
ahci_shutdown(ahci);
|
|
}
|
|
|
|
+static void test_reset_pending_callback(void)
|
|
+{
|
|
+ AHCIQState *ahci;
|
|
+ AHCICommand *cmd;
|
|
+ uint8_t port;
|
|
+ uint64_t ptr1;
|
|
+ uint64_t ptr2;
|
|
+
|
|
+ int bufsize = 4 * 1024;
|
|
+ int speed = bufsize + (bufsize / 2);
|
|
+ int offset1 = 0;
|
|
+ int offset2 = bufsize / AHCI_SECTOR_SIZE;
|
|
+
|
|
+ g_autofree unsigned char *tx1 = g_malloc(bufsize);
|
|
+ g_autofree unsigned char *tx2 = g_malloc(bufsize);
|
|
+ g_autofree unsigned char *rx1 = g_malloc0(bufsize);
|
|
+ g_autofree unsigned char *rx2 = g_malloc0(bufsize);
|
|
+
|
|
+ /* Uses throttling to make test independent of specific environment. */
|
|
+ ahci = ahci_boot_and_enable("-drive if=none,id=drive0,file=%s,"
|
|
+ "cache=writeback,format=%s,"
|
|
+ "throttling.bps-write=%d "
|
|
+ "-M q35 "
|
|
+ "-device ide-hd,drive=drive0 ",
|
|
+ tmp_path, imgfmt, speed);
|
|
+
|
|
+ port = ahci_port_select(ahci);
|
|
+ ahci_port_clear(ahci, port);
|
|
+
|
|
+ ptr1 = ahci_alloc(ahci, bufsize);
|
|
+ ptr2 = ahci_alloc(ahci, bufsize);
|
|
+
|
|
+ g_assert(ptr1 && ptr2);
|
|
+
|
|
+ /* Need two different patterns. */
|
|
+ do {
|
|
+ generate_pattern(tx1, bufsize, AHCI_SECTOR_SIZE);
|
|
+ generate_pattern(tx2, bufsize, AHCI_SECTOR_SIZE);
|
|
+ } while (memcmp(tx1, tx2, bufsize) == 0);
|
|
+
|
|
+ qtest_bufwrite(ahci->parent->qts, ptr1, tx1, bufsize);
|
|
+ qtest_bufwrite(ahci->parent->qts, ptr2, tx2, bufsize);
|
|
+
|
|
+ /* Write to beginning of disk to check it wasn't overwritten later. */
|
|
+ ahci_guest_io(ahci, port, CMD_WRITE_DMA_EXT, ptr1, bufsize, offset1);
|
|
+
|
|
+ /* Issue asynchronously to get a pending callback during reset. */
|
|
+ cmd = ahci_command_create(CMD_WRITE_DMA_EXT);
|
|
+ ahci_command_adjust(cmd, offset2, ptr2, bufsize, 0);
|
|
+ ahci_command_commit(ahci, cmd, port);
|
|
+ ahci_command_issue_async(ahci, cmd);
|
|
+
|
|
+ ahci_set(ahci, AHCI_GHC, AHCI_GHC_HR);
|
|
+
|
|
+ ahci_command_free(cmd);
|
|
+
|
|
+ /* Wait for throttled write to finish. */
|
|
+ sleep(1);
|
|
+
|
|
+ /* Start again. */
|
|
+ ahci_clean_mem(ahci);
|
|
+ ahci_pci_enable(ahci);
|
|
+ ahci_hba_enable(ahci);
|
|
+ port = ahci_port_select(ahci);
|
|
+ ahci_port_clear(ahci, port);
|
|
+
|
|
+ /* Read and verify. */
|
|
+ ahci_guest_io(ahci, port, CMD_READ_DMA_EXT, ptr1, bufsize, offset1);
|
|
+ qtest_bufread(ahci->parent->qts, ptr1, rx1, bufsize);
|
|
+ g_assert_cmphex(memcmp(tx1, rx1, bufsize), ==, 0);
|
|
+
|
|
+ ahci_guest_io(ahci, port, CMD_READ_DMA_EXT, ptr2, bufsize, offset2);
|
|
+ qtest_bufread(ahci->parent->qts, ptr2, rx2, bufsize);
|
|
+ g_assert_cmphex(memcmp(tx2, rx2, bufsize), ==, 0);
|
|
+
|
|
+ ahci_free(ahci, ptr1);
|
|
+ ahci_free(ahci, ptr2);
|
|
+
|
|
+ ahci_clean_mem(ahci);
|
|
+
|
|
+ ahci_shutdown(ahci);
|
|
+}
|
|
+
|
|
static void test_ncq_simple(void)
|
|
{
|
|
AHCIQState *ahci;
|
|
@@ -1929,7 +2012,8 @@ int main(int argc, char **argv)
|
|
qtest_add_func("/ahci/migrate/dma/halted", test_migrate_halted_dma);
|
|
|
|
qtest_add_func("/ahci/max", test_max);
|
|
- qtest_add_func("/ahci/reset", test_reset);
|
|
+ qtest_add_func("/ahci/reset/simple", test_reset);
|
|
+ qtest_add_func("/ahci/reset/pending_callback", test_reset_pending_callback);
|
|
|
|
qtest_add_func("/ahci/io/ncq/simple", test_ncq_simple);
|
|
qtest_add_func("/ahci/migrate/ncq/simple", test_migrate_ncq);
|
|
--
|
|
2.41.0
|
|
|