~ [ source navigation ] ~ [ diff markup ] ~ [ identifier search ] ~

TOMOYO Linux Cross Reference
Linux/tools/testing/selftests/x86/sysret_rip.c

Version: ~ [ linux-5.4-rc3 ] ~ [ linux-5.3.6 ] ~ [ linux-5.2.21 ] ~ [ linux-5.1.21 ] ~ [ linux-5.0.21 ] ~ [ linux-4.20.17 ] ~ [ linux-4.19.79 ] ~ [ linux-4.18.20 ] ~ [ linux-4.17.19 ] ~ [ linux-4.16.18 ] ~ [ linux-4.15.18 ] ~ [ linux-4.14.149 ] ~ [ linux-4.13.16 ] ~ [ linux-4.12.14 ] ~ [ linux-4.11.12 ] ~ [ linux-4.10.17 ] ~ [ linux-4.9.196 ] ~ [ linux-4.8.17 ] ~ [ linux-4.7.10 ] ~ [ linux-4.6.7 ] ~ [ linux-4.5.7 ] ~ [ linux-4.4.196 ] ~ [ linux-4.3.6 ] ~ [ linux-4.2.8 ] ~ [ linux-4.1.52 ] ~ [ linux-4.0.9 ] ~ [ linux-3.19.8 ] ~ [ linux-3.18.140 ] ~ [ linux-3.17.8 ] ~ [ linux-3.16.75 ] ~ [ linux-3.15.10 ] ~ [ linux-3.14.79 ] ~ [ linux-3.13.11 ] ~ [ linux-3.12.74 ] ~ [ linux-3.11.10 ] ~ [ linux-3.10.108 ] ~ [ linux-3.9.11 ] ~ [ linux-3.8.13 ] ~ [ linux-3.7.10 ] ~ [ linux-3.6.11 ] ~ [ linux-3.5.7 ] ~ [ linux-3.4.113 ] ~ [ linux-3.3.8 ] ~ [ linux-3.2.102 ] ~ [ linux-3.1.10 ] ~ [ linux-3.0.101 ] ~ [ linux-2.6.32.71 ] ~ [ linux-2.6.0 ] ~ [ linux-2.4.37.11 ] ~ [ unix-v6-master ] ~ [ ccs-tools-1.8.5 ] ~ [ policy-sample ] ~
Architecture: ~ [ i386 ] ~ [ alpha ] ~ [ m68k ] ~ [ mips ] ~ [ ppc ] ~ [ sparc ] ~ [ sparc64 ] ~

  1 /*
  2  * sigreturn.c - tests that x86 avoids Intel SYSRET pitfalls
  3  * Copyright (c) 2014-2016 Andrew Lutomirski
  4  *
  5  * This program is free software; you can redistribute it and/or modify
  6  * it under the terms and conditions of the GNU General Public License,
  7  * version 2, as published by the Free Software Foundation.
  8  *
  9  * This program is distributed in the hope it will be useful, but
 10  * WITHOUT ANY WARRANTY; without even the implied warranty of
 11  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
 12  * General Public License for more details.
 13  */
 14 
 15 #define _GNU_SOURCE
 16 
 17 #include <stdlib.h>
 18 #include <unistd.h>
 19 #include <stdio.h>
 20 #include <string.h>
 21 #include <inttypes.h>
 22 #include <sys/signal.h>
 23 #include <sys/ucontext.h>
 24 #include <sys/syscall.h>
 25 #include <err.h>
 26 #include <stddef.h>
 27 #include <stdbool.h>
 28 #include <setjmp.h>
 29 #include <sys/user.h>
 30 #include <sys/mman.h>
 31 #include <assert.h>
 32 
 33 
 34 asm (
 35         ".pushsection \".text\", \"ax\"\n\t"
 36         ".balign 4096\n\t"
 37         "test_page: .globl test_page\n\t"
 38         ".fill 4094,1,0xcc\n\t"
 39         "test_syscall_insn:\n\t"
 40         "syscall\n\t"
 41         ".ifne . - test_page - 4096\n\t"
 42         ".error \"test page is not one page long\"\n\t"
 43         ".endif\n\t"
 44         ".popsection"
 45     );
 46 
 47 extern const char test_page[];
 48 static void const *current_test_page_addr = test_page;
 49 
 50 static void sethandler(int sig, void (*handler)(int, siginfo_t *, void *),
 51                        int flags)
 52 {
 53         struct sigaction sa;
 54         memset(&sa, 0, sizeof(sa));
 55         sa.sa_sigaction = handler;
 56         sa.sa_flags = SA_SIGINFO | flags;
 57         sigemptyset(&sa.sa_mask);
 58         if (sigaction(sig, &sa, 0))
 59                 err(1, "sigaction");
 60 }
 61 
 62 static void clearhandler(int sig)
 63 {
 64         struct sigaction sa;
 65         memset(&sa, 0, sizeof(sa));
 66         sa.sa_handler = SIG_DFL;
 67         sigemptyset(&sa.sa_mask);
 68         if (sigaction(sig, &sa, 0))
 69                 err(1, "sigaction");
 70 }
 71 
 72 /* State used by our signal handlers. */
 73 static gregset_t initial_regs;
 74 
 75 static volatile unsigned long rip;
 76 
 77 static void sigsegv_for_sigreturn_test(int sig, siginfo_t *info, void *ctx_void)
 78 {
 79         ucontext_t *ctx = (ucontext_t*)ctx_void;
 80 
 81         if (rip != ctx->uc_mcontext.gregs[REG_RIP]) {
 82                 printf("[FAIL]\tRequested RIP=0x%lx but got RIP=0x%lx\n",
 83                        rip, (unsigned long)ctx->uc_mcontext.gregs[REG_RIP]);
 84                 fflush(stdout);
 85                 _exit(1);
 86         }
 87 
 88         memcpy(&ctx->uc_mcontext.gregs, &initial_regs, sizeof(gregset_t));
 89 
 90         printf("[OK]\tGot SIGSEGV at RIP=0x%lx\n", rip);
 91 }
 92 
 93 static void sigusr1(int sig, siginfo_t *info, void *ctx_void)
 94 {
 95         ucontext_t *ctx = (ucontext_t*)ctx_void;
 96 
 97         memcpy(&initial_regs, &ctx->uc_mcontext.gregs, sizeof(gregset_t));
 98 
 99         /* Set IP and CX to match so that SYSRET can happen. */
100         ctx->uc_mcontext.gregs[REG_RIP] = rip;
101         ctx->uc_mcontext.gregs[REG_RCX] = rip;
102 
103         /* R11 and EFLAGS should already match. */
104         assert(ctx->uc_mcontext.gregs[REG_EFL] ==
105                ctx->uc_mcontext.gregs[REG_R11]);
106 
107         sethandler(SIGSEGV, sigsegv_for_sigreturn_test, SA_RESETHAND);
108 
109         return;
110 }
111 
112 static void test_sigreturn_to(unsigned long ip)
113 {
114         rip = ip;
115         printf("[RUN]\tsigreturn to 0x%lx\n", ip);
116         raise(SIGUSR1);
117 }
118 
119 static jmp_buf jmpbuf;
120 
121 static void sigsegv_for_fallthrough(int sig, siginfo_t *info, void *ctx_void)
122 {
123         ucontext_t *ctx = (ucontext_t*)ctx_void;
124 
125         if (rip != ctx->uc_mcontext.gregs[REG_RIP]) {
126                 printf("[FAIL]\tExpected SIGSEGV at 0x%lx but got RIP=0x%lx\n",
127                        rip, (unsigned long)ctx->uc_mcontext.gregs[REG_RIP]);
128                 fflush(stdout);
129                 _exit(1);
130         }
131 
132         siglongjmp(jmpbuf, 1);
133 }
134 
135 static void test_syscall_fallthrough_to(unsigned long ip)
136 {
137         void *new_address = (void *)(ip - 4096);
138         void *ret;
139 
140         printf("[RUN]\tTrying a SYSCALL that falls through to 0x%lx\n", ip);
141 
142         ret = mremap((void *)current_test_page_addr, 4096, 4096,
143                      MREMAP_MAYMOVE | MREMAP_FIXED, new_address);
144         if (ret == MAP_FAILED) {
145                 if (ip <= (1UL << 47) - PAGE_SIZE) {
146                         err(1, "mremap to %p", new_address);
147                 } else {
148                         printf("[OK]\tmremap to %p failed\n", new_address);
149                         return;
150                 }
151         }
152 
153         if (ret != new_address)
154                 errx(1, "mremap malfunctioned: asked for %p but got %p\n",
155                      new_address, ret);
156 
157         current_test_page_addr = new_address;
158         rip = ip;
159 
160         if (sigsetjmp(jmpbuf, 1) == 0) {
161                 asm volatile ("call *%[syscall_insn]" :: "a" (SYS_getpid),
162                               [syscall_insn] "rm" (ip - 2));
163                 errx(1, "[FAIL]\tSyscall trampoline returned");
164         }
165 
166         printf("[OK]\tWe survived\n");
167 }
168 
169 int main()
170 {
171         /*
172          * When the kernel returns from a slow-path syscall, it will
173          * detect whether SYSRET is appropriate.  If it incorrectly
174          * thinks that SYSRET is appropriate when RIP is noncanonical,
175          * it'll crash on Intel CPUs.
176          */
177         sethandler(SIGUSR1, sigusr1, 0);
178         for (int i = 47; i < 64; i++)
179                 test_sigreturn_to(1UL<<i);
180 
181         clearhandler(SIGUSR1);
182 
183         sethandler(SIGSEGV, sigsegv_for_fallthrough, 0);
184 
185         /* One extra test to check that we didn't screw up the mremap logic. */
186         test_syscall_fallthrough_to((1UL << 47) - 2*PAGE_SIZE);
187 
188         /* These are the interesting cases. */
189         for (int i = 47; i < 64; i++) {
190                 test_syscall_fallthrough_to((1UL<<i) - PAGE_SIZE);
191                 test_syscall_fallthrough_to(1UL<<i);
192         }
193 
194         return 0;
195 }
196 

~ [ source navigation ] ~ [ diff markup ] ~ [ identifier search ] ~

kernel.org | git.kernel.org | LWN.net | Project Home | Wiki (Japanese) | Wiki (English) | SVN repository | Mail admin

Linux® is a registered trademark of Linus Torvalds in the United States and other countries.
TOMOYO® is a registered trademark of NTT DATA CORPORATION.

osdn.jp