]> www.infradead.org Git - users/hch/misc.git/commit
selftest/x86/bugs: Add selftests for ITS
authorPawan Gupta <pawan.kumar.gupta@linux.intel.com>
Wed, 25 Dec 2024 00:09:28 +0000 (16:09 -0800)
committerDave Hansen <dave.hansen@linux.intel.com>
Fri, 9 May 2025 20:39:45 +0000 (13:39 -0700)
commit7a9b709e7cc5ce1ffb84ce07bf6d157e1de758df
tree08b68f79eca35f07bdceaf9331f7baaf75420415
parente52c1dc7455d32c8a55f9949d300e5e87d011fa6
selftest/x86/bugs: Add selftests for ITS

Below are the tests added for Indirect Target Selection (ITS):

- its_sysfs.py - Check if sysfs reflects the correct mitigation status for
  the mitigation selected via the kernel cmdline.

- its_permutations.py - tests mitigation selection with cmdline
  permutations with other bugs like spectre_v2 and retbleed.

- its_indirect_alignment.py - verifies that for addresses in
  .retpoline_sites section that belong to lower half of cacheline are
  patched to ITS-safe thunk. Typical output looks like below:

  Site 49: function symbol: __x64_sys_restart_syscall+0x1f <0xffffffffbb1509af>
  #     vmlinux: 0xffffffff813509af:    jmp     0xffffffff81f5a8e0
  #     kcore:   0xffffffffbb1509af:    jmpq    *%rax
  #     ITS thunk NOT expected for site 49
  #     PASSED: Found *%rax
  #
  Site 50: function symbol: __resched_curr+0xb0 <0xffffffffbb181910>
  #     vmlinux: 0xffffffff81381910:    jmp     0xffffffff81f5a8e0
  #     kcore:   0xffffffffbb181910:    jmp     0xffffffffc02000fc
  #     ITS thunk expected for site 50
  #     PASSED: Found 0xffffffffc02000fc -> jmpq *%rax <scattered-thunk?>

- its_ret_alignment.py - verifies that for addresses in .return_sites
  section that belong to lower half of cacheline are patched to
  its_return_thunk. Typical output looks like below:

  Site 97: function symbol: collect_event+0x48 <0xffffffffbb007f18>
  #     vmlinux: 0xffffffff81207f18:    jmp     0xffffffff81f5b500
  #     kcore:   0xffffffffbb007f18:    jmp     0xffffffffbbd5b560
  #     PASSED: Found jmp 0xffffffffbbd5b560 <its_return_thunk>
  #
  Site 98: function symbol: collect_event+0xa4 <0xffffffffbb007f74>
  #     vmlinux: 0xffffffff81207f74:    jmp     0xffffffff81f5b500
  #     kcore:   0xffffffffbb007f74:    retq
  #     PASSED: Found retq

Some of these tests have dependency on tools like virtme-ng[1] and drgn[2].
When the dependencies are not met, the test will be skipped.

[1] https://github.com/arighi/virtme-ng
[2] https://github.com/osandov/drgn

Co-developed-by: Tao Zhang <tao1.zhang@linux.intel.com>
Signed-off-by: Tao Zhang <tao1.zhang@linux.intel.com>
Signed-off-by: Pawan Gupta <pawan.kumar.gupta@linux.intel.com>
Signed-off-by: Dave Hansen <dave.hansen@linux.intel.com>
tools/testing/selftests/Makefile
tools/testing/selftests/x86/bugs/Makefile [new file with mode: 0644]
tools/testing/selftests/x86/bugs/common.py [new file with mode: 0755]
tools/testing/selftests/x86/bugs/its_indirect_alignment.py [new file with mode: 0755]
tools/testing/selftests/x86/bugs/its_permutations.py [new file with mode: 0755]
tools/testing/selftests/x86/bugs/its_ret_alignment.py [new file with mode: 0755]
tools/testing/selftests/x86/bugs/its_sysfs.py [new file with mode: 0755]