[PATCH v2] x86/asm/entry/32, selftests: Add test_syscall_vdso test

[PATCH v2] x86/asm/entry/32, selftests: Add test_syscall_vdso test

[Denys Vlasenko]

The test is fairly simplistic: it checks that all registers
are preserved across 32-bit syscall via VDSO.

Run-tested:

$ ./test_syscall_vdso_32
[RUN]	Executing 6-argument 32-bit syscall via VDSO
[Ok]	Arguments are preserved across syscall
[RUN]	Executing 6-argument 32-bit syscall via INT 80
[Ok]	Arguments are preserved across syscall
[RUN]	Running tests under ptrace
[RUN]	Executing 6-argument 32-bit syscall via VDSO
[Ok]	Arguments are preserved across syscall
[RUN]	Executing 6-argument 32-bit syscall via INT 80
[Ok]	Arguments are preserved across syscall

Signed-off-by: Denys Vlasenko <dvlasenk@redhat.com>
CC: Linus Torvalds <torvalds@linux-foundation.org>
CC: Steven Rostedt <rostedt@goodmis.org>
CC: Ingo Molnar <mingo@kernel.org>
CC: Borislav Petkov <bp@alien8.de>
CC: "H. Peter Anvin" <hpa@zytor.com>
CC: Andy Lutomirski <luto@amacapital.net>
CC: Oleg Nesterov <oleg@redhat.com>
CC: Frederic Weisbecker <fweisbec@gmail.com>
CC: Alexei Starovoitov <ast@plumgrid.com>
CC: Will Drewry <wad@chromium.org>
CC: Kees Cook <keescook@chromium.org>
CC: x86@kernel.org
CC: linux-kernel@vger.kernel.org
---
Changes in v2:
 does not fail if VDSO can't be found;
 tests INT 80 syscall method;
 tests syscalls under ptrace;
 switched to /* */ comments

 tools/testing/selftests/x86/Makefile            |   2 +-
 tools/testing/selftests/x86/test_syscall_vdso.c | 271 ++++++++++++++++++++++++
 2 files changed, 272 insertions(+), 1 deletion(-)
 create mode 100644 tools/testing/selftests/x86/test_syscall_vdso.c

diff --git a/tools/testing/selftests/x86/Makefile b/tools/testing/selftests/x86/Makefile
index caa60d5..84effa6 100644
--- a/tools/testing/selftests/x86/Makefile
+++ b/tools/testing/selftests/x86/Makefile
@@ -5,7 +5,7 @@ include ../lib.mk
 .PHONY: all all_32 all_64 warn_32bit_failure clean
 
 TARGETS_C_BOTHBITS := sigreturn single_step_syscall sysret_ss_attrs
-TARGETS_C_32BIT_ONLY := entry_from_vm86
+TARGETS_C_32BIT_ONLY := entry_from_vm86 test_syscall_vdso
 
 TARGETS_C_32BIT_ALL := $(TARGETS_C_BOTHBITS) $(TARGETS_C_32BIT_ONLY)
 BINARIES_32 := $(TARGETS_C_32BIT_ALL:%=%_32)
diff --git a/tools/testing/selftests/x86/test_syscall_vdso.c b/tools/testing/selftests/x86/test_syscall_vdso.c
new file mode 100644
index 0000000..7112e9d
--- /dev/null
+++ b/tools/testing/selftests/x86/test_syscall_vdso.c
@@ -0,0 +1,271 @@
+/*
+ * 32-bit syscall ABI conformance test.
+ *
+ * Copyright (c) 2015 Denys Vlasenko
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms and conditions of the GNU General Public License,
+ * version 2, as published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope it will be useful, but
+ * WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ * General Public License for more details.
+ */
+#undef _GNU_SOURCE
+#define _GNU_SOURCE 1
+#undef __USE_GNU
+#define __USE_GNU 1
+#include <unistd.h>
+#include <stdlib.h>
+#include <stdio.h>
+#include <signal.h>
+#include <sys/types.h>
+#include <sys/select.h>
+#include <sys/time.h>
+#include <elf.h>
+#include <sys/ptrace.h>
+#include <sys/wait.h>
+
+#if !defined(__i386__)
+int main(int argc, char **argv, char **envp)
+{
+	printf("[SKIP] Not a 32-bit x86\n");
+	return 0;
+}
+#else
+
+/*
+ * TODO: check r8..15 for info leaks.
+ */
+
+extern char int80;
+asm (
+	"	.pushsection .text\n"
+	"	.global	int80\n"
+	"int80:\n"
+	"	int	$0x80\n"
+	"	ret\n"
+	"	.popsection"
+);
+
+long syscall_addr;
+long get_syscall(char **envp)
+{
+	Elf32_auxv_t *auxv;
+	while (*envp++ != NULL)
+		continue;
+	for (auxv = (void *)envp; auxv->a_type != AT_NULL; auxv++)
+		if (auxv->a_type == AT_SYSINFO)
+			return auxv->a_un.a_val;
+	printf("[WARN]\tAT_SYSINFO not supplied\n");
+	return 0;
+}
+
+int nfds;
+fd_set rfds;
+fd_set wfds;
+fd_set efds;
+struct timespec timeout;
+sigset_t sigmask;
+struct {
+	sigset_t *sp;
+	int sz;
+} sigmask_desc;
+
+void prep_args()
+{
+	nfds = 42;
+	FD_ZERO(&rfds);
+	FD_ZERO(&wfds);
+	FD_ZERO(&efds);
+	FD_SET(0, &rfds);
+	FD_SET(1, &wfds);
+	FD_SET(2, &efds);
+	timeout.tv_sec = 0;
+	timeout.tv_nsec = 123;
+	sigemptyset(&sigmask);
+	sigaddset(&sigmask, SIGINT);
+	sigaddset(&sigmask, SIGUSR2);
+	sigaddset(&sigmask, SIGRTMAX);
+	sigmask_desc.sp = &sigmask;
+	sigmask_desc.sz = 8; /* bytes */
+}
+
+static void print_flags(const char *name, unsigned long r)
+{
+	static const char *bitarray[] = {
+	"\n" ,"c\n" ,/* Carry Flag */
+	"0 " ,"1 "  ,/* Bit 1 - always on */
+	""   ,"p "  ,/* Parity Flag */
+	"0 " ,"3? " ,
+	""   ,"a "  ,/* Auxiliary carry Flag */
+	"0 " ,"5? " ,
+	""   ,"z "  ,/* Zero Flag */
+	""   ,"s "  ,/* Sign Flag */
+	""   ,"t "  ,/* Trap Flag */
+	""   ,"i "  ,/* Interrupt Flag */
+	""   ,"d "  ,/* Direction Flag */
+	""   ,"o "  ,/* Overflow Flag */
+	"0 " ,"1 "  ,/* I/O Privilege Level (2 bits) */
+	"0"  ,"1"   ,/* I/O Privilege Level (2 bits) */
+	""   ,"n "  ,/* Nested Task */
+	"0 " ,"15? ",
+	""   ,"r "  ,/* Resume Flag */
+	""   ,"v "  ,/* Virtual Mode */
+	""   ,"ac " ,/* Alignment Check/Access Control */
+	""   ,"vif ",/* Virtual Interrupt Flag */
+	""   ,"vip ",/* Virtual Interrupt Pending */
+	""   ,"id " ,/* CPUID detection */
+	NULL
+	};
+	const char **bitstr;
+	int bit;
+
+	printf("%s=%016lx ", name, r);
+	bitstr = bitarray + 42;
+	bit = 21;
+	if ((r >> 22) != 0)
+		printf("(extra bits are set) ");
+	do {
+		if (bitstr[(r >> bit) & 1][0])
+			printf(bitstr[(r >> bit) & 1]);
+		bitstr -= 2;
+		bit--;
+	} while (bit >= 0);
+}
+
+int run_syscall(void)
+{
+	long flags, bad_arg;
+
+	prep_args();
+
+	asm("\n"
+	/* Try 6-arg syscall: pselect. It should return quickly */
+	"	push	%%ebp\n"
+	"	mov	$308, %%eax\n"     /* PSELECT */
+	"	mov	nfds, %%ebx\n"     /* ebx  arg1 */
+	"	mov	$rfds, %%ecx\n"    /* ecx  arg2 */
+	"	mov	$wfds, %%edx\n"    /* edx  arg3 */
+	"	mov	$efds, %%esi\n"    /* esi  arg4 */
+	"	mov	$timeout, %%edi\n" /* edi  arg5 */
+	"	mov	$sigmask_desc, %%ebp\n" /* %ebp arg6 */
+	"	push	$0x200ed7\n"      /* set almost all flags */
+	"	popf\n"		/* except TF, IOPL, NT, RF, VM, AC, VIF, VIP */
+	"	call	*syscall_addr\n"
+	/* Check that registers are not clobbered */
+	"	pushf\n"
+	"	pop	%%eax\n"
+	"	cld\n"
+	"	cmp	nfds, %%ebx\n"     /* ebx  arg1 */
+	"	mov	$1, %%ebx\n"
+	"	jne	1f\n"
+	"	cmp	$rfds, %%ecx\n"    /* ecx  arg2 */
+	"	mov	$2, %%ebx\n"
+	"	jne	1f\n"
+	"	cmp	$wfds, %%edx\n"    /* edx  arg3 */
+	"	mov	$3, %%ebx\n"
+	"	jne	1f\n"
+	"	cmp	$efds, %%esi\n"    /* esi  arg4 */
+	"	mov	$4, %%ebx\n"
+	"	jne	1f\n"
+	"	cmp	$timeout, %%edi\n" /* edi  arg5 */
+	"	mov	$5, %%ebx\n"
+	"	jne	1f\n"
+	"	cmpl	$sigmask_desc, %%ebp\n" /* %ebp arg6 */
+	"	mov	$6, %%ebx\n"
+	"	jne	1f\n"
+	"	mov	$0, %%ebx\n"
+	"1:\n"
+	"	pop	%%ebp\n"
+	: "=a" (flags), "=b" (bad_arg)
+	:
+	: "cx", "dx", "si", "di"
+	);
+
+	/*
+	 * On paravirt kernels, flags are not preserved across syscalls.
+	 * Thus, we do not consider it a bug if some are changed.
+	 * We just show ones which do.
+	 */
+	if ((0x200ed7 ^ flags) != 0) {
+		print_flags("[WARN]\tFlags before", 0x200ed7);
+		print_flags("[WARN]\tFlags  after", flags);
+		print_flags("[WARN]\tChanged", (0x200ed7 ^ flags));
+	}
+
+	if (bad_arg) {
+		printf("[FAIL]\targ#%ld clobbered\n", bad_arg);
+		return 1;
+	}
+	printf("[Ok]\tArguments are preserved across syscall\n");
+	return 0;
+}
+
+int run_syscall_twice()
+{
+	int exitcode = 0;
+	long sv;
+
+	if (syscall_addr) {
+		printf("[RUN]\tExecuting 6-argument 32-bit syscall via VDSO\n");
+		exitcode = run_syscall();
+	}
+	sv = syscall_addr;
+	syscall_addr = (long)&int80;
+	printf("[RUN]\tExecuting 6-argument 32-bit syscall via INT 80\n");
+	exitcode += run_syscall();
+	syscall_addr = sv;
+	return exitcode;
+}
+
+void ptrace_me()
+{
+	pid_t pid;
+
+	fflush(NULL);
+	pid = fork();
+	if (pid < 0)
+		exit(1);
+	if (pid == 0) {
+		/* child */
+		if (ptrace(PTRACE_TRACEME, 0L, 0L, 0L) != 0)
+			exit(0);
+		raise(SIGSTOP);
+		return;
+	}
+	/* parent */
+	printf("[RUN]\tRunning tests under ptrace\n");
+	while (1) {
+		int status;
+		pid = waitpid(-1, &status, __WALL);
+		if (pid < 0 || !WIFSTOPPED(status))
+			break;
+		/*
+		 * Note: we do not inject sig = WSTOPSIG(status).
+		 * We probably should, but careful: do not inject SIGTRAP
+		 * generated by syscall entry/exit stops.
+		 * That kills the child.
+		 */
+		ptrace(PTRACE_SYSCALL, pid, 0L, 0L /*sig*/);
+	}
+	exit(0);
+}
+
+int main(int argc, char **argv, char **envp)
+{
+	int exitcode = 0;
+
+	/* This only works for non-static builds:
+	 * syscall_addr = dlsym(dlopen("linux-gate.so.1", RTLD_NOW), "__kernel_vsyscall");
+	 */
+	syscall_addr = get_syscall(envp);
+
+	exitcode += run_syscall_twice();
+	ptrace_me();
+	exitcode += run_syscall_twice();
+
+	return 0;
+}
+#endif
-- 
1.8.1.4

Re: [PATCH v2] x86/asm/entry/32, selftests: Add test_syscall_vdso test

[Denys Vlasenko]

On 06/12/2015 05:29 PM, Denys Vlasenko wrote:
> +	exitcode += run_syscall_twice();
> +	ptrace_me();
> +	exitcode += run_syscall_twice();
> +
> +	return 0;
> +}

Er... that last line was supposed to be "return exitcode;"

Re: [PATCH v2] x86/asm/entry/32, selftests: Add test_syscall_vdso test

[Ingo Molnar]

* Denys Vlasenko <dvlasenk@redhat.com> wrote:

> The test is fairly simplistic: it checks that all registers
> are preserved across 32-bit syscall via VDSO.
> 
> Run-tested:
> 
> $ ./test_syscall_vdso_32
> [RUN]	Executing 6-argument 32-bit syscall via VDSO
> [Ok]	Arguments are preserved across syscall
> [RUN]	Executing 6-argument 32-bit syscall via INT 80
> [Ok]	Arguments are preserved across syscall
> [RUN]	Running tests under ptrace
> [RUN]	Executing 6-argument 32-bit syscall via VDSO
> [Ok]	Arguments are preserved across syscall
> [RUN]	Executing 6-argument 32-bit syscall via INT 80
> [Ok]	Arguments are preserved across syscall

Just curious: is there a kernel sha1 where this test would fail? Or did you try to 
provoke an information leak perhaps?

Thanks,

	Ingo

Re: [PATCH v2] x86/asm/entry/32, selftests: Add test_syscall_vdso test

[Denys Vlasenko]

On 06/13/2015 08:39 AM, Ingo Molnar wrote:
> 
> * Denys Vlasenko <dvlasenk@redhat.com> wrote:
> 
>> The test is fairly simplistic: it checks that all registers
>> are preserved across 32-bit syscall via VDSO.
>>
>> Run-tested:
>>
>> $ ./test_syscall_vdso_32
>> [RUN]	Executing 6-argument 32-bit syscall via VDSO
>> [Ok]	Arguments are preserved across syscall
>> [RUN]	Executing 6-argument 32-bit syscall via INT 80
>> [Ok]	Arguments are preserved across syscall
>> [RUN]	Running tests under ptrace
>> [RUN]	Executing 6-argument 32-bit syscall via VDSO
>> [Ok]	Arguments are preserved across syscall
>> [RUN]	Executing 6-argument 32-bit syscall via INT 80
>> [Ok]	Arguments are preserved across syscall
> 
> Just curious: is there a kernel sha1 where this test would fail? Or did you try to 
> provoke an information leak perhaps?

I did see failures, more than once, when testing my own patches.

I'm not aware of released kernels which are buggy wrt this test.

Re: [PATCH v2] x86/asm/entry/32, selftests: Add test_syscall_vdso test

[Ingo Molnar]

* Denys Vlasenko <dvlasenk@redhat.com> wrote:

> On 06/13/2015 08:39 AM, Ingo Molnar wrote:
> > 
> > * Denys Vlasenko <dvlasenk@redhat.com> wrote:
> > 
> >> The test is fairly simplistic: it checks that all registers
> >> are preserved across 32-bit syscall via VDSO.
> >>
> >> Run-tested:
> >>
> >> $ ./test_syscall_vdso_32
> >> [RUN]	Executing 6-argument 32-bit syscall via VDSO
> >> [Ok]	Arguments are preserved across syscall
> >> [RUN]	Executing 6-argument 32-bit syscall via INT 80
> >> [Ok]	Arguments are preserved across syscall
> >> [RUN]	Running tests under ptrace
> >> [RUN]	Executing 6-argument 32-bit syscall via VDSO
> >> [Ok]	Arguments are preserved across syscall
> >> [RUN]	Executing 6-argument 32-bit syscall via INT 80
> >> [Ok]	Arguments are preserved across syscall
> > 
> > Just curious: is there a kernel sha1 where this test would fail? Or did you try to 
> > provoke an information leak perhaps?
> 
> I did see failures, more than once, when testing my own patches.

Ok!

> I'm not aware of released kernels which are buggy wrt this test.

Great! :-)

Thanks,

	Ingo