[PATCH v8 27/28] selftests/x86: Add tests for User-Mode Instruction Prevention

From	Ricardo Neri <ricardo.neri-calderon@linux.intel.com>
Newsgroups	linux.kernel
Subject	[PATCH v8 27/28] selftests/x86: Add tests for User-Mode Instruction Prevention
Date	2017-08-19 02:40 +0200
Message-ID	<ufZXY-2C3-21@gated-at.bofh.it> (permalink)
References	<ufZOh-2z5-3@gated-at.bofh.it>
Organization	linux.* mail to news gateway

Show all headers | View raw

Certain user space programs that run on virtual-8086 mode may utilize
instructions protected by the User-Mode Instruction Prevention (UMIP)
security feature present in new Intel processors: SGDT, SIDT and SMSW. In
such a case, a general protection fault is issued if UMIP is enabled. When
such a fault happens, the kernel traps it and emulates the results of
these instructions with dummy values. The purpose of this new
test is to verify whether the impacted instructions can be executed
without causing such #GP. If no #GP exceptions occur, we expect to exit
virtual-8086 mode from INT3.

The instructions protected by UMIP are executed in representative use
cases:
 a) displacement-only memory addressing
 b) register-indirect memory addressing
 c) results stored directly in operands

Unfortunately, it is not possible to check the results against a set of
expected values because no emulation will occur in systems that do not
have the UMIP feature. Instead, results are printed for verification. A
simple verification is done to ensure that results of all tests are
identical.

Cc: Andy Lutomirski <luto@kernel.org>
Cc: Andrew Morton <akpm@linux-foundation.org>
Cc: Borislav Petkov <bp@suse.de>
Cc: Brian Gerst <brgerst@gmail.com>
Cc: Chen Yucong <slaoub@gmail.com>
Cc: Chris Metcalf <cmetcalf@mellanox.com>
Cc: Dave Hansen <dave.hansen@linux.intel.com>
Cc: Fenghua Yu <fenghua.yu@intel.com>
Cc: Huang Rui <ray.huang@amd.com>
Cc: Jiri Slaby <jslaby@suse.cz>
Cc: Jonathan Corbet <corbet@lwn.net>
Cc: Michael S. Tsirkin <mst@redhat.com>
Cc: Paul Gortmaker <paul.gortmaker@windriver.com>
Cc: Peter Zijlstra <peterz@infradead.org>
Cc: Ravi V. Shankar <ravi.v.shankar@intel.com>
Cc: Shuah Khan <shuah@kernel.org>
Cc: Vlastimil Babka <vbabka@suse.cz>
Signed-off-by: Ricardo Neri <ricardo.neri-calderon@linux.intel.com>
---
 tools/testing/selftests/x86/entry_from_vm86.c | 73 ++++++++++++++++++++++++++-
 1 file changed, 72 insertions(+), 1 deletion(-)

diff --git a/tools/testing/selftests/x86/entry_from_vm86.c b/tools/testing/selftests/x86/entry_from_vm86.c
index d075ea0e5ca1..130e8ad1db05 100644
--- a/tools/testing/selftests/x86/entry_from_vm86.c
+++ b/tools/testing/selftests/x86/entry_from_vm86.c
@@ -95,6 +95,22 @@ asm (
 	"int3\n\t"
 	"vmcode_int80:\n\t"
 	"int $0x80\n\t"
+	"vmcode_umip:\n\t"
+	/* addressing via displacements */
+	"smsw (2052)\n\t"
+	"sidt (2054)\n\t"
+	"sgdt (2060)\n\t"
+	/* addressing via registers */
+	"mov $2066, %bx\n\t"
+	"smsw (%bx)\n\t"
+	"mov $2068, %bx\n\t"
+	"sidt (%bx)\n\t"
+	"mov $2074, %bx\n\t"
+	"sgdt (%bx)\n\t"
+	/* register operands, only for smsw */
+	"smsw %ax\n\t"
+	"mov %ax, (2080)\n\t"
+	"int3\n\t"
 	".size vmcode, . - vmcode\n\t"
 	"end_vmcode:\n\t"
 	".code32\n\t"
@@ -103,7 +119,7 @@ asm (
 
 extern unsigned char vmcode[], end_vmcode[];
 extern unsigned char vmcode_bound[], vmcode_sysenter[], vmcode_syscall[],
-	vmcode_sti[], vmcode_int3[], vmcode_int80[];
+	vmcode_sti[], vmcode_int3[], vmcode_int80[], vmcode_umip[];
 
 /* Returns false if the test was skipped. */
 static bool do_test(struct vm86plus_struct *v86, unsigned long eip,
@@ -160,6 +176,58 @@ static bool do_test(struct vm86plus_struct *v86, unsigned long eip,
 	return true;
 }
 
+void do_umip_tests(struct vm86plus_struct *vm86, unsigned char *test_mem)
+{
+	struct table_desc {
+		unsigned short limit;
+		unsigned long base;
+	} __attribute__((packed));
+
+	/* Initialize variables with arbitrary values */
+	struct table_desc gdt1 = { .base = 0x3c3c3c3c, .limit = 0x9999 };
+	struct table_desc gdt2 = { .base = 0x1a1a1a1a, .limit = 0xaeae };
+	struct table_desc idt1 = { .base = 0x7b7b7b7b, .limit = 0xf1f1 };
+	struct table_desc idt2 = { .base = 0x89898989, .limit = 0x1313 };
+	unsigned short msw1 = 0x1414, msw2 = 0x2525, msw3 = 3737;
+
+	/* UMIP -- exit with INT3 unless kernel emulation did not trap #GP */
+	do_test(vm86, vmcode_umip - vmcode, VM86_TRAP, 3, "UMIP tests");
+
+	/* Results from displacement-only addressing */
+	msw1 = *(unsigned short *)(test_mem + 2052);
+	memcpy(&idt1, test_mem + 2054, sizeof(idt1));
+	memcpy(&gdt1, test_mem + 2060, sizeof(gdt1));
+
+	/* Results from register-indirect addressing */
+	msw2 = *(unsigned short *)(test_mem + 2066);
+	memcpy(&idt2, test_mem + 2068, sizeof(idt2));
+	memcpy(&gdt2, test_mem + 2074, sizeof(gdt2));
+
+	/* Results when using register operands */
+	msw3 = *(unsigned short *)(test_mem + 2080);
+
+	printf("[INFO]\tResult from SMSW:[0x%04x]\n", msw1);
+	printf("[INFO]\tResult from SIDT: limit[0x%04x]base[0x%08lx]\n",
+	       idt1.limit, idt1.base);
+	printf("[INFO]\tResult from SGDT: limit[0x%04x]base[0x%08lx]\n",
+	       gdt1.limit, gdt1.base);
+
+	if ((msw1 != msw2) || (msw1 != msw3))
+		printf("[FAIL]\tAll the results of SMSW should be the same.\n");
+	else
+		printf("[PASS]\tAll the results from SMSW are identical.\n");
+
+	if (memcmp(&gdt1, &gdt2, sizeof(gdt1)))
+		printf("[FAIL]\tAll the results of SGDT should be the same.\n");
+	else
+		printf("[PASS]\tAll the results from SGDT are identical.\n");
+
+	if (memcmp(&idt1, &idt2, sizeof(idt1)))
+		printf("[FAIL]\tAll the results of SIDT should be the same.\n");
+	else
+		printf("[PASS]\tAll the results from SIDT are identical.\n");
+}
+
 int main(void)
 {
 	struct vm86plus_struct v86;
@@ -218,6 +286,9 @@ int main(void)
 	v86.regs.eax = (unsigned int)-1;
 	do_test(&v86, vmcode_int80 - vmcode, VM86_INTx, 0x80, "int80");
 
+	/* UMIP -- should exit with INTx 0x80 unless UMIP was not disabled */
+	do_umip_tests(&v86, addr);
+
 	/* Execute a null pointer */
 	v86.regs.cs = 0;
 	v86.regs.ss = 0;
-- 
2.13.0

Thread

[PATCH v8 00/28] x86: Enable User-Mode Instruction Prevention Ricardo Neri <ricardo.neri-calderon@linux.intel.com> - 2017-08-19 02:30 +0200
  [PATCH v8 18/28] x86/insn-eval: Add support to resolve 32-bit address encodings Ricardo Neri <ricardo.neri-calderon@linux.intel.com> - 2017-08-19 02:30 +0200
  [PATCH v8 04/28] uprobes/x86: Use existing definitions for segment override prefixes Ricardo Neri <ricardo.neri-calderon@linux.intel.com> - 2017-08-19 02:30 +0200
  [PATCH v8 17/28] x86/insn-eval: Incorporate segment base in linear address computation Ricardo Neri <ricardo.neri-calderon@linux.intel.com> - 2017-08-19 02:30 +0200
  [PATCH v8 08/28] x86/mpx, x86/insn: Relocate insn util functions to a new insn-eval file Ricardo Neri <ricardo.neri-calderon@linux.intel.com> - 2017-08-19 02:30 +0200
  [PATCH v8 10/28] x86/insn-eval: Add a utility function to get register offsets Ricardo Neri <ricardo.neri-calderon@linux.intel.com> - 2017-08-19 02:30 +0200
  [PATCH v8 19/28] x86/insn-eval: Add wrapper function for 32 and 64-bit addresses Ricardo Neri <ricardo.neri-calderon@linux.intel.com> - 2017-08-19 02:40 +0200
  [PATCH v8 20/28] x86/insn-eval: Handle 32-bit address encodings in virtual-8086 mode Ricardo Neri <ricardo.neri-calderon@linux.intel.com> - 2017-08-19 02:40 +0200
  [PATCH v8 15/28] x86/insn-eval: Add function to get default params of code segment Ricardo Neri <ricardo.neri-calderon@linux.intel.com> - 2017-08-19 02:40 +0200
  [PATCH v8 05/28] x86/mpx: Use signed variables to compute effective addresses Ricardo Neri <ricardo.neri-calderon@linux.intel.com> - 2017-08-19 02:40 +0200
  [PATCH v8 16/28] x86/insn-eval: Indicate a 32-bit displacement if ModRM.mod is 0 and ModRM.rm is 101b Ricardo Neri <ricardo.neri-calderon@linux.intel.com> - 2017-08-19 02:40 +0200
  [PATCH v8 13/28] x86/insn-eval: Add utility function to get segment descriptor Ricardo Neri <ricardo.neri-calderon@linux.intel.com> - 2017-08-19 02:40 +0200
  [PATCH v8 03/28] ptrace,x86: Make user_64bit_mode() available to 32-bit builds Ricardo Neri <ricardo.neri-calderon@linux.intel.com> - 2017-08-19 02:40 +0200
  [PATCH v8 23/28] x86: Add emulation code for UMIP instructions Ricardo Neri <ricardo.neri-calderon@linux.intel.com> - 2017-08-19 02:40 +0200
  [PATCH v8 28/28] selftests/x86: Add tests for instruction str and sldt Ricardo Neri <ricardo.neri-calderon@linux.intel.com> - 2017-08-19 02:40 +0200
  [PATCH v8 21/28] x86/insn-eval: Add support to resolve 16-bit addressing encodings Ricardo Neri <ricardo.neri-calderon@linux.intel.com> - 2017-08-19 02:40 +0200
  [PATCH v8 12/28] x86/insn-eval: Add utility functions to get segment selector Ricardo Neri <ricardo.neri-calderon@linux.intel.com> - 2017-08-19 02:40 +0200
  [PATCH v8 01/28] x86/mm: Relocate page fault error codes to traps.h Ricardo Neri <ricardo.neri-calderon@linux.intel.com> - 2017-08-19 02:40 +0200
  [PATCH v8 27/28] selftests/x86: Add tests for User-Mode Instruction Prevention Ricardo Neri <ricardo.neri-calderon@linux.intel.com> - 2017-08-19 02:40 +0200
  [PATCH v8 24/28] x86/umip: Force a page fault when unable to copy emulated result to user Ricardo Neri <ricardo.neri-calderon@linux.intel.com> - 2017-08-19 02:40 +0200
  [PATCH v8 26/28] x86/traps: Fixup general protection faults caused by UMIP Ricardo Neri <ricardo.neri-calderon@linux.intel.com> - 2017-08-19 02:40 +0200
  [PATCH v8 07/28] x86/mpx: Do not use SIB.base if its value is 101b and ModRM.mod = 0 Ricardo Neri <ricardo.neri-calderon@linux.intel.com> - 2017-08-19 02:40 +0200
  [PATCH v8 22/28] x86/cpufeature: Add User-Mode Instruction Prevention definitions Ricardo Neri <ricardo.neri-calderon@linux.intel.com> - 2017-08-19 02:40 +0200
  [PATCH v8 06/28] x86/mpx: Do not use SIB.index if its value is 100b and ModRM.mod is not 11b Ricardo Neri <ricardo.neri-calderon@linux.intel.com> - 2017-08-19 02:40 +0200
  [PATCH v8 14/28] x86/insn-eval: Add utility functions to get segment descriptor base address and limit Ricardo Neri <ricardo.neri-calderon@linux.intel.com> - 2017-08-19 02:40 +0200
  [PATCH v8 25/28] x86: Enable User-Mode Instruction Prevention Ricardo Neri <ricardo.neri-calderon@linux.intel.com> - 2017-08-19 02:40 +0200
  [PATCH v8 09/28] x86/insn-eval: Do not BUG on invalid register type Ricardo Neri <ricardo.neri-calderon@linux.intel.com> - 2017-08-19 02:40 +0200

csiph-web