2022-07-12 15:23:01

by Alexey Dobriyan

[permalink] [raw]
Subject: [PATCH] proc: fix test for "vsyscall=xonly" boot option

Booting with vsyscall=xonly results in the "--xp" vsyscall VMA:

ffffffffff600000-ffffffffff601000 --xp ... [vsyscall]\n

Test does read from fixed vsyscall address to determine if kernel
supports vsyscall page but it doesn't work with vsyscall=xonly
because, well, vsyscall page is execute only.

Fix test by trying to execute from the first byte of the page
(which contains gettimeofday() stub). This should work because vsyscall
entry points themselves have stable addresses by design.

Alexey, avoiding parsing .config, /proc/config.gz and
/proc/cmdline at all costs.

Signed-off-by: Alexey Dobriyan <[email protected]>
---

I'm not sure who reported what, so please add tested-by and
reported-by lines.

tools/testing/selftests/proc/proc-pid-vm.c | 75 ++++++++++++++++++++++++++---
1 file changed, 68 insertions(+), 7 deletions(-)

--- a/tools/testing/selftests/proc/proc-pid-vm.c
+++ b/tools/testing/selftests/proc/proc-pid-vm.c
@@ -211,10 +211,19 @@ static int make_exe(const uint8_t *payload, size_t len)
}
#endif

-static bool g_vsyscall = false;
+/*
+ * 0: vsyscall VMA doesn't exist vsyscall=none
+ * 1: vsyscall VMA is r-xp vsyscall=emulate
+ * 2: vsyscall VMA is --xp vsyscall=xonly
+ */
+static int g_vsyscall;
+static const char *str_vsyscall;

-static const char str_vsyscall[] =
+static const char str_vsyscall_0[] = "";
+static const char str_vsyscall_1[] =
"ffffffffff600000-ffffffffff601000 r-xp 00000000 00:00 0 [vsyscall]\n";
+static const char str_vsyscall_2[] =
+"ffffffffff600000-ffffffffff601000 --xp 00000000 00:00 0 [vsyscall]\n";

#ifdef __x86_64__
static void sigaction_SIGSEGV(int _, siginfo_t *__, void *___)
@@ -223,13 +232,47 @@ static void sigaction_SIGSEGV(int _, siginfo_t *__, void *___)
}

/*
- * vsyscall page can't be unmapped, probe it with memory load.
+ * vsyscall page can't be unmapped, probe it directly.
*/
static void vsyscall(void)
{
pid_t pid;
int wstatus;

+ pid = fork();
+ if (pid < 0) {
+ fprintf(stderr, "fork, errno %d\n", errno);
+ exit(1);
+ }
+ if (pid == 0) {
+ struct rlimit rlim = {0, 0};
+ (void)setrlimit(RLIMIT_CORE, &rlim);
+
+ /* Hide "segfault at ffffffffff600000" messages. */
+ struct sigaction act;
+ memset(&act, 0, sizeof(struct sigaction));
+ act.sa_flags = SA_SIGINFO;
+ act.sa_sigaction = sigaction_SIGSEGV;
+ (void)sigaction(SIGSEGV, &act, NULL);
+
+ /* gettimeofday(NULL, NULL); */
+ asm volatile (
+ "call %P0"
+ :
+ : "i" (0xffffffffff600000), "D" (NULL), "S" (NULL)
+ : "rax"
+ );
+ exit(0);
+ }
+ waitpid(pid, &wstatus, 0);
+ if (WIFEXITED(wstatus) && WEXITSTATUS(wstatus) == 0) {
+ /* vsyscall page exists and is executable. */
+ } else {
+ /* vsyscall page doesn't exist. */
+ g_vsyscall = 0;
+ return;
+ }
+
pid = fork();
if (pid < 0) {
fprintf(stderr, "fork, errno %d\n", errno);
@@ -251,8 +294,13 @@ static void vsyscall(void)
}
waitpid(pid, &wstatus, 0);
if (WIFEXITED(wstatus) && WEXITSTATUS(wstatus) == 0) {
- g_vsyscall = true;
+ /* vsyscall page is readable and executable. */
+ g_vsyscall = 1;
+ return;
}
+
+ /* vsyscall page is executable but unreadable. */
+ g_vsyscall = 2;
}

int main(void)
@@ -261,6 +309,19 @@ int main(void)
int exec_fd;

vsyscall();
+ switch (g_vsyscall) {
+ case 0:
+ str_vsyscall = str_vsyscall_0;
+ break;
+ case 1:
+ str_vsyscall = str_vsyscall_1;
+ break;
+ case 2:
+ str_vsyscall = str_vsyscall_2;
+ break;
+ default:
+ abort();
+ }

atexit(ate);

@@ -314,7 +375,7 @@ int main(void)

/* Test /proc/$PID/maps */
{
- const size_t len = strlen(buf0) + (g_vsyscall ? strlen(str_vsyscall) : 0);
+ const size_t len = strlen(buf0) + strlen(str_vsyscall);
char buf[256];
ssize_t rv;
int fd;
@@ -327,7 +388,7 @@ int main(void)
rv = read(fd, buf, sizeof(buf));
assert(rv == len);
assert(memcmp(buf, buf0, strlen(buf0)) == 0);
- if (g_vsyscall) {
+ if (g_vsyscall > 0) {
assert(memcmp(buf + strlen(buf0), str_vsyscall, strlen(str_vsyscall)) == 0);
}
}
@@ -374,7 +435,7 @@ int main(void)
assert(memmem(buf, rv, S[i], strlen(S[i])));
}

- if (g_vsyscall) {
+ if (g_vsyscall > 0) {
assert(memmem(buf, rv, str_vsyscall, strlen(str_vsyscall)));
}
}


2022-07-12 15:40:22

by Alexey Dobriyan

[permalink] [raw]
Subject: [PATCH v2] proc: fix test for "vsyscall=xonly" boot option

Booting with vsyscall=xonly results in the following vsyscall VMA:

ffffffffff600000-ffffffffff601000 --xp ... [vsyscall]\n

Test does read from fixed vsyscall address to determine if kernel
supports vsyscall page but it doesn't work because, well, vsyscall
page is execute only.

Fix test by trying to execute from the first byte of the page which
contains gettimeofday() stub. This should work because vsyscall
entry points have stable addresses by design.

Alexey, avoiding parsing .config, /proc/config.gz and
/proc/cmdline at all costs.

Signed-off-by: Alexey Dobriyan <[email protected]>
---

v2: add rcx, r11 clobbers, how could I forget

I'm not sure who reported what, so please add tested-by and
reported-by lines.


tools/testing/selftests/proc/proc-pid-vm.c | 75 ++++++++++++++++++++++++++---
1 file changed, 68 insertions(+), 7 deletions(-)

--- a/tools/testing/selftests/proc/proc-pid-vm.c
+++ b/tools/testing/selftests/proc/proc-pid-vm.c
@@ -211,10 +211,19 @@ static int make_exe(const uint8_t *payload, size_t len)
}
#endif

-static bool g_vsyscall = false;
+/*
+ * 0: vsyscall VMA doesn't exist vsyscall=none
+ * 1: vsyscall VMA is r-xp vsyscall=emulate
+ * 2: vsyscall VMA is --xp vsyscall=xonly
+ */
+static int g_vsyscall;
+static const char *str_vsyscall;

-static const char str_vsyscall[] =
+static const char str_vsyscall_0[] = "";
+static const char str_vsyscall_1[] =
"ffffffffff600000-ffffffffff601000 r-xp 00000000 00:00 0 [vsyscall]\n";
+static const char str_vsyscall_2[] =
+"ffffffffff600000-ffffffffff601000 --xp 00000000 00:00 0 [vsyscall]\n";

#ifdef __x86_64__
static void sigaction_SIGSEGV(int _, siginfo_t *__, void *___)
@@ -223,13 +232,47 @@ static void sigaction_SIGSEGV(int _, siginfo_t *__, void *___)
}

/*
- * vsyscall page can't be unmapped, probe it with memory load.
+ * vsyscall page can't be unmapped, probe it directly.
*/
static void vsyscall(void)
{
pid_t pid;
int wstatus;

+ pid = fork();
+ if (pid < 0) {
+ fprintf(stderr, "fork, errno %d\n", errno);
+ exit(1);
+ }
+ if (pid == 0) {
+ struct rlimit rlim = {0, 0};
+ (void)setrlimit(RLIMIT_CORE, &rlim);
+
+ /* Hide "segfault at ffffffffff600000" messages. */
+ struct sigaction act;
+ memset(&act, 0, sizeof(struct sigaction));
+ act.sa_flags = SA_SIGINFO;
+ act.sa_sigaction = sigaction_SIGSEGV;
+ (void)sigaction(SIGSEGV, &act, NULL);
+
+ /* gettimeofday(NULL, NULL); */
+ asm volatile (
+ "call %P0"
+ :
+ : "i" (0xffffffffff600000), "D" (NULL), "S" (NULL)
+ : "rax", "rcx", "r11"
+ );
+ exit(0);
+ }
+ waitpid(pid, &wstatus, 0);
+ if (WIFEXITED(wstatus) && WEXITSTATUS(wstatus) == 0) {
+ /* vsyscall page exists and is executable. */
+ } else {
+ /* vsyscall page doesn't exist. */
+ g_vsyscall = 0;
+ return;
+ }
+
pid = fork();
if (pid < 0) {
fprintf(stderr, "fork, errno %d\n", errno);
@@ -251,8 +294,13 @@ static void vsyscall(void)
}
waitpid(pid, &wstatus, 0);
if (WIFEXITED(wstatus) && WEXITSTATUS(wstatus) == 0) {
- g_vsyscall = true;
+ /* vsyscall page is readable and executable. */
+ g_vsyscall = 1;
+ return;
}
+
+ /* vsyscall page is executable but unreadable. */
+ g_vsyscall = 2;
}

int main(void)
@@ -261,6 +309,19 @@ int main(void)
int exec_fd;

vsyscall();
+ switch (g_vsyscall) {
+ case 0:
+ str_vsyscall = str_vsyscall_0;
+ break;
+ case 1:
+ str_vsyscall = str_vsyscall_1;
+ break;
+ case 2:
+ str_vsyscall = str_vsyscall_2;
+ break;
+ default:
+ abort();
+ }

atexit(ate);

@@ -314,7 +375,7 @@ int main(void)

/* Test /proc/$PID/maps */
{
- const size_t len = strlen(buf0) + (g_vsyscall ? strlen(str_vsyscall) : 0);
+ const size_t len = strlen(buf0) + strlen(str_vsyscall);
char buf[256];
ssize_t rv;
int fd;
@@ -327,7 +388,7 @@ int main(void)
rv = read(fd, buf, sizeof(buf));
assert(rv == len);
assert(memcmp(buf, buf0, strlen(buf0)) == 0);
- if (g_vsyscall) {
+ if (g_vsyscall > 0) {
assert(memcmp(buf + strlen(buf0), str_vsyscall, strlen(str_vsyscall)) == 0);
}
}
@@ -374,7 +435,7 @@ int main(void)
assert(memmem(buf, rv, S[i], strlen(S[i])));
}

- if (g_vsyscall) {
+ if (g_vsyscall > 0) {
assert(memmem(buf, rv, str_vsyscall, strlen(str_vsyscall)));
}
}

2022-07-14 14:10:21

by Brian Foster

[permalink] [raw]
Subject: Re: [PATCH v2] proc: fix test for "vsyscall=xonly" boot option

On Tue, Jul 12, 2022 at 05:51:45PM +0300, Alexey Dobriyan wrote:
> Booting with vsyscall=xonly results in the following vsyscall VMA:
>
> ffffffffff600000-ffffffffff601000 --xp ... [vsyscall]\n
>
> Test does read from fixed vsyscall address to determine if kernel
> supports vsyscall page but it doesn't work because, well, vsyscall
> page is execute only.
>
> Fix test by trying to execute from the first byte of the page which
> contains gettimeofday() stub. This should work because vsyscall
> entry points have stable addresses by design.
>
> Alexey, avoiding parsing .config, /proc/config.gz and
> /proc/cmdline at all costs.
>
> Signed-off-by: Alexey Dobriyan <[email protected]>
> ---

Hi Alexey,

I had run into this failure when testing something unrelated, so thanks
for the fix. It passes in my test env. That said, some of code
duplication stood out to me when I took a closer look. Not a huge deal
for a selftest, but any thoughts on any of the following cleanups on top
of your diff..? It still passes my quick tests and cuts the patch in
half or so..

Brian

--- 8< ---

diff --git a/tools/testing/selftests/proc/proc-pid-vm.c b/tools/testing/selftests/proc/proc-pid-vm.c
index e5962f4794f5..d4dca92d60f3 100644
--- a/tools/testing/selftests/proc/proc-pid-vm.c
+++ b/tools/testing/selftests/proc/proc-pid-vm.c
@@ -212,32 +212,35 @@ static int make_exe(const uint8_t *payload, size_t len)
#endif

/*
- * 0: vsyscall VMA doesn't exist vsyscall=none
- * 1: vsyscall VMA is r-xp vsyscall=emulate
+ * vsyscall probe return codes:
+ *
+ * 0: vsyscall VMA is r-xp vsyscall=emulate
+ * 1: vsyscall VMA doesn't exist vsyscall=none
* 2: vsyscall VMA is --xp vsyscall=xonly
*/
-static int g_vsyscall;
+static volatile int g_vsyscall;
static const char *str_vsyscall;

-static const char str_vsyscall_0[] = "";
-static const char str_vsyscall_1[] =
-"ffffffffff600000-ffffffffff601000 r-xp 00000000 00:00 0 [vsyscall]\n";
-static const char str_vsyscall_2[] =
-"ffffffffff600000-ffffffffff601000 --xp 00000000 00:00 0 [vsyscall]\n";
+static const char *str_vsyscall_arr[] = {
+"ffffffffff600000-ffffffffff601000 r-xp 00000000 00:00 0 [vsyscall]\n",
+"",
+"ffffffffff600000-ffffffffff601000 --xp 00000000 00:00 0 [vsyscall]\n"
+};

#ifdef __x86_64__
static void sigaction_SIGSEGV(int _, siginfo_t *__, void *___)
{
- _exit(1);
+ _exit(g_vsyscall);
}

/*
* vsyscall page can't be unmapped, probe it directly.
*/
-static void vsyscall(void)
+static bool vsyscall(void)
{
pid_t pid;
int wstatus;
+ bool ret = false;

pid = fork();
if (pid < 0) {
@@ -256,72 +259,34 @@ static void vsyscall(void)
(void)sigaction(SIGSEGV, &act, NULL);

/* gettimeofday(NULL, NULL); */
+ g_vsyscall = 1;
asm volatile (
"call %P0"
:
: "i" (0xffffffffff600000), "D" (NULL), "S" (NULL)
: "rax", "rcx", "r11"
);
- exit(0);
- }
- waitpid(pid, &wstatus, 0);
- if (WIFEXITED(wstatus) && WEXITSTATUS(wstatus) == 0) {
- /* vsyscall page exists and is executable. */
- } else {
- /* vsyscall page doesn't exist. */
- g_vsyscall = 0;
- return;
- }
-
- pid = fork();
- if (pid < 0) {
- fprintf(stderr, "fork, errno %d\n", errno);
- exit(1);
- }
- if (pid == 0) {
- struct rlimit rlim = {0, 0};
- (void)setrlimit(RLIMIT_CORE, &rlim);
-
- /* Hide "segfault at ffffffffff600000" messages. */
- struct sigaction act;
- memset(&act, 0, sizeof(struct sigaction));
- act.sa_flags = SA_SIGINFO;
- act.sa_sigaction = sigaction_SIGSEGV;
- (void)sigaction(SIGSEGV, &act, NULL);

+ g_vsyscall = 2;
*(volatile int *)0xffffffffff600000UL;
exit(0);
}
waitpid(pid, &wstatus, 0);
- if (WIFEXITED(wstatus) && WEXITSTATUS(wstatus) == 0) {
- /* vsyscall page is readable and executable. */
- g_vsyscall = 1;
- return;
+ if (WIFEXITED(wstatus)) {
+ g_vsyscall = WEXITSTATUS(wstatus);
+ ret = g_vsyscall != 1;
}
-
- /* vsyscall page is executable but unreadable. */
- g_vsyscall = 2;
+ str_vsyscall = str_vsyscall_arr[g_vsyscall];
+ return ret;
}

int main(void)
{
int pipefd[2];
int exec_fd;
+ bool have_vsyscall;

- vsyscall();
- switch (g_vsyscall) {
- case 0:
- str_vsyscall = str_vsyscall_0;
- break;
- case 1:
- str_vsyscall = str_vsyscall_1;
- break;
- case 2:
- str_vsyscall = str_vsyscall_2;
- break;
- default:
- abort();
- }
+ have_vsyscall = vsyscall();

atexit(ate);

@@ -388,7 +353,7 @@ int main(void)
rv = read(fd, buf, sizeof(buf));
assert(rv == len);
assert(memcmp(buf, buf0, strlen(buf0)) == 0);
- if (g_vsyscall > 0) {
+ if (have_vsyscall) {
assert(memcmp(buf + strlen(buf0), str_vsyscall, strlen(str_vsyscall)) == 0);
}
}
@@ -435,7 +400,7 @@ int main(void)
assert(memmem(buf, rv, S[i], strlen(S[i])));
}

- if (g_vsyscall > 0) {
+ if (have_vsyscall) {
assert(memmem(buf, rv, str_vsyscall, strlen(str_vsyscall)));
}
}