LXR linux/tools/testing/selftests/x86/corrupt_xstate

   1// SPDX-License-Identifier: GPL-2.0-only
   2/*
   3 * Corrupt the XSTATE header in a signal frame
   4 *
   5 * Based on analysis and a test case from Thomas Gleixner.
   6 */
   7
   8#define _GNU_SOURCE
   9
  10#include <stdlib.h>
  11#include <stdio.h>
  12#include <string.h>
  13#include <sched.h>
  14#include <signal.h>
  15#include <err.h>
  16#include <unistd.h>
  17#include <stdint.h>
  18#include <sys/wait.h>
  19
  20static inline void __cpuid(unsigned int *eax, unsigned int *ebx,
  21                           unsigned int *ecx, unsigned int *edx)
  22{
  23        asm volatile(
  24                "cpuid;"
  25                : "=a" (*eax),
  26                  "=b" (*ebx),
  27                  "=c" (*ecx),
  28                  "=d" (*edx)
  29                : "0" (*eax), "2" (*ecx));
  30}
  31
  32static inline int xsave_enabled(void)
  33{
  34        unsigned int eax, ebx, ecx, edx;
  35
  36        eax = 0x1;
  37        ecx = 0x0;
  38        __cpuid(&eax, &ebx, &ecx, &edx);
  39
  40        /* Is CR4.OSXSAVE enabled ? */
  41        return ecx & (1U << 27);
  42}
  43
  44static void sethandler(int sig, void (*handler)(int, siginfo_t *, void *),
  45                       int flags)
  46{
  47        struct sigaction sa;
  48
  49        memset(&sa, 0, sizeof(sa));
  50        sa.sa_sigaction = handler;
  51        sa.sa_flags = SA_SIGINFO | flags;
  52        sigemptyset(&sa.sa_mask);
  53        if (sigaction(sig, &sa, 0))
  54                err(1, "sigaction");
  55}
  56
  57static void sigusr1(int sig, siginfo_t *info, void *uc_void)
  58{
  59        ucontext_t *uc = uc_void;
  60        uint8_t *fpstate = (uint8_t *)uc->uc_mcontext.fpregs;
  61        uint64_t *xfeatures = (uint64_t *)(fpstate + 512);
  62
  63        printf("\tWreck XSTATE header\n");
  64        /* Wreck the first reserved bytes in the header */
  65        *(xfeatures + 2) = 0xfffffff;
  66}
  67
  68static void sigsegv(int sig, siginfo_t *info, void *uc_void)
  69{
  70        printf("\tGot SIGSEGV\n");
  71}
  72
  73int main(void)
  74{
  75        cpu_set_t set;
  76
  77        sethandler(SIGUSR1, sigusr1, 0);
  78        sethandler(SIGSEGV, sigsegv, 0);
  79
  80        if (!xsave_enabled()) {
  81                printf("[SKIP] CR4.OSXSAVE disabled.\n");
  82                return 0;
  83        }
  84
  85        CPU_ZERO(&set);
  86        CPU_SET(0, &set);
  87
  88        /*
  89         * Enforce that the child runs on the same CPU
  90         * which in turn forces a schedule.
  91         */
  92        sched_setaffinity(getpid(), sizeof(set), &set);
  93
  94        printf("[RUN]\tSend ourselves a signal\n");
  95        raise(SIGUSR1);
  96
  97        printf("[OK]\tBack from the signal.  Now schedule.\n");
  98        pid_t child = fork();
  99        if (child < 0)
 100                err(1, "fork");
 101        if (child == 0)
 102                return 0;
 103        if (child)
 104                waitpid(child, NULL, 0);
 105        printf("[OK]\tBack in the main thread.\n");
 106
 107        /*
 108         * We could try to confirm that extended state is still preserved
 109         * when we schedule.  For now, the only indication of failure is
 110         * a warning in the kernel logs.
 111         */
 112
 113        return 0;
 114}
 115