selftests/x86/test_vsyscall.c

0001 /* SPDX-License-Identifier: GPL-2.0 */
0002
0003 #define _GNU_SOURCE
0004
0005 #include <stdio.h>
0006 #include <sys/time.h>
0007 #include <time.h>
0008 #include <stdlib.h>
0009 #include <sys/syscall.h>
0010 #include <unistd.h>
0011 #include <dlfcn.h>
0012 #include <string.h>
0013 #include <inttypes.h>
0014 #include <signal.h>
0015 #include <sys/ucontext.h>
0016 #include <errno.h>
0017 #include <err.h>
0018 #include <sched.h>
0019 #include <stdbool.h>
0020 #include <setjmp.h>
0021 #include <sys/uio.h>
0022
0023 #include "helpers.h"
0024
0025 #ifdef __x86_64__
0026 # define VSYS(x) (x)
0027 #else
0028 # define VSYS(x) 0
0029 #endif
0030
0031 #ifndef SYS_getcpu
0032 # ifdef __x86_64__
0033 #  define SYS_getcpu 309
0034 # else
0035 #  define SYS_getcpu 318
0036 # endif
0037 #endif
0038
0039 /* max length of lines in /proc/self/maps - anything longer is skipped here */
0040 #define MAPS_LINE_LEN 128
0041
0042 static void sethandler(int sig, void (*handler)(int, siginfo_t *, void *),
0043                int flags)
0044 {
0045     struct sigaction sa;
0046     memset(&sa, 0, sizeof(sa));
0047     sa.sa_sigaction = handler;
0048     sa.sa_flags = SA_SIGINFO | flags;
0049     sigemptyset(&sa.sa_mask);
0050     if (sigaction(sig, &sa, 0))
0051         err(1, "sigaction");
0052 }
0053
0054 /* vsyscalls and vDSO */
0055 bool vsyscall_map_r = false, vsyscall_map_x = false;
0056
0057 typedef long (*gtod_t)(struct timeval *tv, struct timezone *tz);
0058 const gtod_t vgtod = (gtod_t)VSYS(0xffffffffff600000);
0059 gtod_t vdso_gtod;
0060
0061 typedef int (*vgettime_t)(clockid_t, struct timespec *);
0062 vgettime_t vdso_gettime;
0063
0064 typedef long (*time_func_t)(time_t *t);
0065 const time_func_t vtime = (time_func_t)VSYS(0xffffffffff600400);
0066 time_func_t vdso_time;
0067
0068 typedef long (*getcpu_t)(unsigned *, unsigned *, void *);
0069 const getcpu_t vgetcpu = (getcpu_t)VSYS(0xffffffffff600800);
0070 getcpu_t vdso_getcpu;
0071
0072 static void init_vdso(void)
0073 {
0074     void *vdso = dlopen("linux-vdso.so.1", RTLD_LAZY | RTLD_LOCAL | RTLD_NOLOAD);
0075     if (!vdso)
0076         vdso = dlopen("linux-gate.so.1", RTLD_LAZY | RTLD_LOCAL | RTLD_NOLOAD);
0077     if (!vdso) {
0078         printf("[WARN]\tfailed to find vDSO\n");
0079         return;
0080     }
0081
0082     vdso_gtod = (gtod_t)dlsym(vdso, "__vdso_gettimeofday");
0083     if (!vdso_gtod)
0084         printf("[WARN]\tfailed to find gettimeofday in vDSO\n");
0085
0086     vdso_gettime = (vgettime_t)dlsym(vdso, "__vdso_clock_gettime");
0087     if (!vdso_gettime)
0088         printf("[WARN]\tfailed to find clock_gettime in vDSO\n");
0089
0090     vdso_time = (time_func_t)dlsym(vdso, "__vdso_time");
0091     if (!vdso_time)
0092         printf("[WARN]\tfailed to find time in vDSO\n");
0093
0094     vdso_getcpu = (getcpu_t)dlsym(vdso, "__vdso_getcpu");
0095     if (!vdso_getcpu) {
0096         /* getcpu() was never wired up in the 32-bit vDSO. */
0097         printf("[%s]\tfailed to find getcpu in vDSO\n",
0098                sizeof(long) == 8 ? "WARN" : "NOTE");
0099     }
0100 }
0101
0102 static int init_vsys(void)
0103 {
0104 #ifdef __x86_64__
0105     int nerrs = 0;
0106     FILE *maps;
0107     char line[MAPS_LINE_LEN];
0108     bool found = false;
0109
0110     maps = fopen("/proc/self/maps", "r");
0111     if (!maps) {
0112         printf("[WARN]\tCould not open /proc/self/maps -- assuming vsyscall is r-x\n");
0113         vsyscall_map_r = true;
0114         return 0;
0115     }
0116
0117     while (fgets(line, MAPS_LINE_LEN, maps)) {
0118         char r, x;
0119         void *start, *end;
0120         char name[MAPS_LINE_LEN];
0121
0122         /* sscanf() is safe here as strlen(name) >= strlen(line) */
0123         if (sscanf(line, "%p-%p %c-%cp %*x %*x:%*x %*u %s",
0124                &start, &end, &r, &x, name) != 5)
0125             continue;
0126
0127         if (strcmp(name, "[vsyscall]"))
0128             continue;
0129
0130         printf("\tvsyscall map: %s", line);
0131
0132         if (start != (void *)0xffffffffff600000 ||
0133             end != (void *)0xffffffffff601000) {
0134             printf("[FAIL]\taddress range is nonsense\n");
0135             nerrs++;
0136         }
0137
0138         printf("\tvsyscall permissions are %c-%c\n", r, x);
0139         vsyscall_map_r = (r == 'r');
0140         vsyscall_map_x = (x == 'x');
0141
0142         found = true;
0143         break;
0144     }
0145
0146     fclose(maps);
0147
0148     if (!found) {
0149         printf("\tno vsyscall map in /proc/self/maps\n");
0150         vsyscall_map_r = false;
0151         vsyscall_map_x = false;
0152     }
0153
0154     return nerrs;
0155 #else
0156     return 0;
0157 #endif
0158 }
0159
0160 /* syscalls */
0161 static inline long sys_gtod(struct timeval *tv, struct timezone *tz)
0162 {
0163     return syscall(SYS_gettimeofday, tv, tz);
0164 }
0165
0166 static inline int sys_clock_gettime(clockid_t id, struct timespec *ts)
0167 {
0168     return syscall(SYS_clock_gettime, id, ts);
0169 }
0170
0171 static inline long sys_time(time_t *t)
0172 {
0173     return syscall(SYS_time, t);
0174 }
0175
0176 static inline long sys_getcpu(unsigned * cpu, unsigned * node,
0177                   void* cache)
0178 {
0179     return syscall(SYS_getcpu, cpu, node, cache);
0180 }
0181
0182 static jmp_buf jmpbuf;
0183 static volatile unsigned long segv_err;
0184
0185 static void sigsegv(int sig, siginfo_t *info, void *ctx_void)
0186 {
0187     ucontext_t *ctx = (ucontext_t *)ctx_void;
0188
0189     segv_err =  ctx->uc_mcontext.gregs[REG_ERR];
0190     siglongjmp(jmpbuf, 1);
0191 }
0192
0193 static double tv_diff(const struct timeval *a, const struct timeval *b)
0194 {
0195     return (double)(a->tv_sec - b->tv_sec) +
0196         (double)((int)a->tv_usec - (int)b->tv_usec) * 1e-6;
0197 }
0198
0199 static int check_gtod(const struct timeval *tv_sys1,
0200               const struct timeval *tv_sys2,
0201               const struct timezone *tz_sys,
0202               const char *which,
0203               const struct timeval *tv_other,
0204               const struct timezone *tz_other)
0205 {
0206     int nerrs = 0;
0207     double d1, d2;
0208
0209     if (tz_other && (tz_sys->tz_minuteswest != tz_other->tz_minuteswest || tz_sys->tz_dsttime != tz_other->tz_dsttime)) {
0210         printf("[FAIL] %s tz mismatch\n", which);
0211         nerrs++;
0212     }
0213
0214     d1 = tv_diff(tv_other, tv_sys1);
0215     d2 = tv_diff(tv_sys2, tv_other);
0216     printf("\t%s time offsets: %lf %lf\n", which, d1, d2);
0217
0218     if (d1 < 0 || d2 < 0) {
0219         printf("[FAIL]\t%s time was inconsistent with the syscall\n", which);
0220         nerrs++;
0221     } else {
0222         printf("[OK]\t%s gettimeofday()'s timeval was okay\n", which);
0223     }
0224
0225     return nerrs;
0226 }
0227
0228 static int test_gtod(void)
0229 {
0230     struct timeval tv_sys1, tv_sys2, tv_vdso, tv_vsys;
0231     struct timezone tz_sys, tz_vdso, tz_vsys;
0232     long ret_vdso = -1;
0233     long ret_vsys = -1;
0234     int nerrs = 0;
0235
0236     printf("[RUN]\ttest gettimeofday()\n");
0237
0238     if (sys_gtod(&tv_sys1, &tz_sys) != 0)
0239         err(1, "syscall gettimeofday");
0240     if (vdso_gtod)
0241         ret_vdso = vdso_gtod(&tv_vdso, &tz_vdso);
0242     if (vsyscall_map_x)
0243         ret_vsys = vgtod(&tv_vsys, &tz_vsys);
0244     if (sys_gtod(&tv_sys2, &tz_sys) != 0)
0245         err(1, "syscall gettimeofday");
0246
0247     if (vdso_gtod) {
0248         if (ret_vdso == 0) {
0249             nerrs += check_gtod(&tv_sys1, &tv_sys2, &tz_sys, "vDSO", &tv_vdso, &tz_vdso);
0250         } else {
0251             printf("[FAIL]\tvDSO gettimeofday() failed: %ld\n", ret_vdso);
0252             nerrs++;
0253         }
0254     }
0255
0256     if (vsyscall_map_x) {
0257         if (ret_vsys == 0) {
0258             nerrs += check_gtod(&tv_sys1, &tv_sys2, &tz_sys, "vsyscall", &tv_vsys, &tz_vsys);
0259         } else {
0260             printf("[FAIL]\tvsys gettimeofday() failed: %ld\n", ret_vsys);
0261             nerrs++;
0262         }
0263     }
0264
0265     return nerrs;
0266 }
0267
0268 static int test_time(void) {
0269     int nerrs = 0;
0270
0271     printf("[RUN]\ttest time()\n");
0272     long t_sys1, t_sys2, t_vdso = 0, t_vsys = 0;
0273     long t2_sys1 = -1, t2_sys2 = -1, t2_vdso = -1, t2_vsys = -1;
0274     t_sys1 = sys_time(&t2_sys1);
0275     if (vdso_time)
0276         t_vdso = vdso_time(&t2_vdso);
0277     if (vsyscall_map_x)
0278         t_vsys = vtime(&t2_vsys);
0279     t_sys2 = sys_time(&t2_sys2);
0280     if (t_sys1 < 0 || t_sys1 != t2_sys1 || t_sys2 < 0 || t_sys2 != t2_sys2) {
0281         printf("[FAIL]\tsyscall failed (ret1:%ld output1:%ld ret2:%ld output2:%ld)\n", t_sys1, t2_sys1, t_sys2, t2_sys2);
0282         nerrs++;
0283         return nerrs;
0284     }
0285
0286     if (vdso_time) {
0287         if (t_vdso < 0 || t_vdso != t2_vdso) {
0288             printf("[FAIL]\tvDSO failed (ret:%ld output:%ld)\n", t_vdso, t2_vdso);
0289             nerrs++;
0290         } else if (t_vdso < t_sys1 || t_vdso > t_sys2) {
0291             printf("[FAIL]\tvDSO returned the wrong time (%ld %ld %ld)\n", t_sys1, t_vdso, t_sys2);
0292             nerrs++;
0293         } else {
0294             printf("[OK]\tvDSO time() is okay\n");
0295         }
0296     }
0297
0298     if (vsyscall_map_x) {
0299         if (t_vsys < 0 || t_vsys != t2_vsys) {
0300             printf("[FAIL]\tvsyscall failed (ret:%ld output:%ld)\n", t_vsys, t2_vsys);
0301             nerrs++;
0302         } else if (t_vsys < t_sys1 || t_vsys > t_sys2) {
0303             printf("[FAIL]\tvsyscall returned the wrong time (%ld %ld %ld)\n", t_sys1, t_vsys, t_sys2);
0304             nerrs++;
0305         } else {
0306             printf("[OK]\tvsyscall time() is okay\n");
0307         }
0308     }
0309
0310     return nerrs;
0311 }
0312
0313 static int test_getcpu(int cpu)
0314 {
0315     int nerrs = 0;
0316     long ret_sys, ret_vdso = -1, ret_vsys = -1;
0317
0318     printf("[RUN]\tgetcpu() on CPU %d\n", cpu);
0319
0320     cpu_set_t cpuset;
0321     CPU_ZERO(&cpuset);
0322     CPU_SET(cpu, &cpuset);
0323     if (sched_setaffinity(0, sizeof(cpuset), &cpuset) != 0) {
0324         printf("[SKIP]\tfailed to force CPU %d\n", cpu);
0325         return nerrs;
0326     }
0327
0328     unsigned cpu_sys, cpu_vdso, cpu_vsys, node_sys, node_vdso, node_vsys;
0329     unsigned node = 0;
0330     bool have_node = false;
0331     ret_sys = sys_getcpu(&cpu_sys, &node_sys, 0);
0332     if (vdso_getcpu)
0333         ret_vdso = vdso_getcpu(&cpu_vdso, &node_vdso, 0);
0334     if (vsyscall_map_x)
0335         ret_vsys = vgetcpu(&cpu_vsys, &node_vsys, 0);
0336
0337     if (ret_sys == 0) {
0338         if (cpu_sys != cpu) {
0339             printf("[FAIL]\tsyscall reported CPU %hu but should be %d\n", cpu_sys, cpu);
0340             nerrs++;
0341         }
0342
0343         have_node = true;
0344         node = node_sys;
0345     }
0346
0347     if (vdso_getcpu) {
0348         if (ret_vdso) {
0349             printf("[FAIL]\tvDSO getcpu() failed\n");
0350             nerrs++;
0351         } else {
0352             if (!have_node) {
0353                 have_node = true;
0354                 node = node_vdso;
0355             }
0356
0357             if (cpu_vdso != cpu) {
0358                 printf("[FAIL]\tvDSO reported CPU %hu but should be %d\n", cpu_vdso, cpu);
0359                 nerrs++;
0360             } else {
0361                 printf("[OK]\tvDSO reported correct CPU\n");
0362             }
0363
0364             if (node_vdso != node) {
0365                 printf("[FAIL]\tvDSO reported node %hu but should be %hu\n", node_vdso, node);
0366                 nerrs++;
0367             } else {
0368                 printf("[OK]\tvDSO reported correct node\n");
0369             }
0370         }
0371     }
0372
0373     if (vsyscall_map_x) {
0374         if (ret_vsys) {
0375             printf("[FAIL]\tvsyscall getcpu() failed\n");
0376             nerrs++;
0377         } else {
0378             if (!have_node) {
0379                 have_node = true;
0380                 node = node_vsys;
0381             }
0382
0383             if (cpu_vsys != cpu) {
0384                 printf("[FAIL]\tvsyscall reported CPU %hu but should be %d\n", cpu_vsys, cpu);
0385                 nerrs++;
0386             } else {
0387                 printf("[OK]\tvsyscall reported correct CPU\n");
0388             }
0389
0390             if (node_vsys != node) {
0391                 printf("[FAIL]\tvsyscall reported node %hu but should be %hu\n", node_vsys, node);
0392                 nerrs++;
0393             } else {
0394                 printf("[OK]\tvsyscall reported correct node\n");
0395             }
0396         }
0397     }
0398
0399     return nerrs;
0400 }
0401
0402 static int test_vsys_r(void)
0403 {
0404 #ifdef __x86_64__
0405     printf("[RUN]\tChecking read access to the vsyscall page\n");
0406     bool can_read;
0407     if (sigsetjmp(jmpbuf, 1) == 0) {
0408         *(volatile int *)0xffffffffff600000;
0409         can_read = true;
0410     } else {
0411         can_read = false;
0412     }
0413
0414     if (can_read && !vsyscall_map_r) {
0415         printf("[FAIL]\tWe have read access, but we shouldn't\n");
0416         return 1;
0417     } else if (!can_read && vsyscall_map_r) {
0418         printf("[FAIL]\tWe don't have read access, but we should\n");
0419         return 1;
0420     } else if (can_read) {
0421         printf("[OK]\tWe have read access\n");
0422     } else {
0423         printf("[OK]\tWe do not have read access: #PF(0x%lx)\n",
0424                segv_err);
0425     }
0426 #endif
0427
0428     return 0;
0429 }
0430
0431 static int test_vsys_x(void)
0432 {
0433 #ifdef __x86_64__
0434     if (vsyscall_map_x) {
0435         /* We already tested this adequately. */
0436         return 0;
0437     }
0438
0439     printf("[RUN]\tMake sure that vsyscalls really page fault\n");
0440
0441     bool can_exec;
0442     if (sigsetjmp(jmpbuf, 1) == 0) {
0443         vgtod(NULL, NULL);
0444         can_exec = true;
0445     } else {
0446         can_exec = false;
0447     }
0448
0449     if (can_exec) {
0450         printf("[FAIL]\tExecuting the vsyscall did not page fault\n");
0451         return 1;
0452     } else if (segv_err & (1 << 4)) { /* INSTR */
0453         printf("[OK]\tExecuting the vsyscall page failed: #PF(0x%lx)\n",
0454                segv_err);
0455     } else {
0456         printf("[FAIL]\tExecution failed with the wrong error: #PF(0x%lx)\n",
0457                segv_err);
0458         return 1;
0459     }
0460 #endif
0461
0462     return 0;
0463 }
0464
0465 /*
0466  * Debuggers expect ptrace() to be able to peek at the vsyscall page.
0467  * Use process_vm_readv() as a proxy for ptrace() to test this.  We
0468  * want it to work in the vsyscall=emulate case and to fail in the
0469  * vsyscall=xonly case.
0470  *
0471  * It's worth noting that this ABI is a bit nutty.  write(2) can't
0472  * read from the vsyscall page on any kernel version or mode.  The
0473  * fact that ptrace() ever worked was a nice courtesy of old kernels,
0474  * but the code to support it is fairly gross.
0475  */
0476 static int test_process_vm_readv(void)
0477 {
0478 #ifdef __x86_64__
0479     char buf[4096];
0480     struct iovec local, remote;
0481     int ret;
0482
0483     printf("[RUN]\tprocess_vm_readv() from vsyscall page\n");
0484
0485     local.iov_base = buf;
0486     local.iov_len = 4096;
0487     remote.iov_base = (void *)0xffffffffff600000;
0488     remote.iov_len = 4096;
0489     ret = process_vm_readv(getpid(), &local, 1, &remote, 1, 0);
0490     if (ret != 4096) {
0491         /*
0492          * We expect process_vm_readv() to work if and only if the
0493          * vsyscall page is readable.
0494          */
0495         printf("[%s]\tprocess_vm_readv() failed (ret = %d, errno = %d)\n", vsyscall_map_r ? "FAIL" : "OK", ret, errno);
0496         return vsyscall_map_r ? 1 : 0;
0497     }
0498
0499     if (vsyscall_map_r) {
0500         if (!memcmp(buf, remote.iov_base, sizeof(buf))) {
0501             printf("[OK]\tIt worked and read correct data\n");
0502         } else {
0503             printf("[FAIL]\tIt worked but returned incorrect data\n");
0504             return 1;
0505         }
0506     } else {
0507         printf("[FAIL]\tprocess_rm_readv() succeeded, but it should have failed in this configuration\n");
0508         return 1;
0509     }
0510 #endif
0511
0512     return 0;
0513 }
0514
0515 #ifdef __x86_64__
0516 static volatile sig_atomic_t num_vsyscall_traps;
0517
0518 static void sigtrap(int sig, siginfo_t *info, void *ctx_void)
0519 {
0520     ucontext_t *ctx = (ucontext_t *)ctx_void;
0521     unsigned long ip = ctx->uc_mcontext.gregs[REG_RIP];
0522
0523     if (((ip ^ 0xffffffffff600000UL) & ~0xfffUL) == 0)
0524         num_vsyscall_traps++;
0525 }
0526
0527 static int test_emulation(void)
0528 {
0529     time_t tmp;
0530     bool is_native;
0531
0532     if (!vsyscall_map_x)
0533         return 0;
0534
0535     printf("[RUN]\tchecking that vsyscalls are emulated\n");
0536     sethandler(SIGTRAP, sigtrap, 0);
0537     set_eflags(get_eflags() | X86_EFLAGS_TF);
0538     vtime(&tmp);
0539     set_eflags(get_eflags() & ~X86_EFLAGS_TF);
0540
0541     /*
0542      * If vsyscalls are emulated, we expect a single trap in the
0543      * vsyscall page -- the call instruction will trap with RIP
0544      * pointing to the entry point before emulation takes over.
0545      * In native mode, we expect two traps, since whatever code
0546      * the vsyscall page contains will be more than just a ret
0547      * instruction.
0548      */
0549     is_native = (num_vsyscall_traps > 1);
0550
0551     printf("[%s]\tvsyscalls are %s (%d instructions in vsyscall page)\n",
0552            (is_native ? "FAIL" : "OK"),
0553            (is_native ? "native" : "emulated"),
0554            (int)num_vsyscall_traps);
0555
0556     return is_native;
0557 }
0558 #endif
0559
0560 int main(int argc, char **argv)
0561 {
0562     int nerrs = 0;
0563
0564     init_vdso();
0565     nerrs += init_vsys();
0566
0567     nerrs += test_gtod();
0568     nerrs += test_time();
0569     nerrs += test_getcpu(0);
0570     nerrs += test_getcpu(1);
0571
0572     sethandler(SIGSEGV, sigsegv, 0);
0573     nerrs += test_vsys_r();
0574     nerrs += test_vsys_x();
0575
0576     nerrs += test_process_vm_readv();
0577
0578 #ifdef __x86_64__
0579     nerrs += test_emulation();
0580 #endif
0581
0582     return nerrs ? 1 : 0;
0583 }