In the past there were some issues resulting from additions to
XSAVE/XSAVES. Introduce a few tests to help detect issues early.
Cc: Andy Lutomirski <luto@xxxxxxxxxx>
Cc: Borislav Petkov <bp@xxxxxxxxx>
Cc: Dave Hansen <dave.hansen@xxxxxxxxxxxxxxx>
Cc: Ingo Molnar <mingo@xxxxxxxxxx>
Cc: Shuah Khan <shuah@xxxxxxxxxx>
Signed-off-by: Yu-cheng Yu <yu-cheng.yu@xxxxxxxxx>
---
tools/testing/selftests/x86/Makefile | 4 +-
.../testing/selftests/x86/xsave_check_exec.c | 117 +++++++++++++++
.../testing/selftests/x86/xsave_check_fork.c | 68 +++++++++
.../selftests/x86/xsave_check_ptrace.c | 88 +++++++++++
.../selftests/x86/xsave_check_signal.c | 116 +++++++++++++++
.../x86/xsave_check_signal_handler.c | 140 ++++++++++++++++++
tools/testing/selftests/x86/xsave_test.h | 63 ++++++++
7 files changed, 595 insertions(+), 1 deletion(-)
create mode 100644 tools/testing/selftests/x86/xsave_check_exec.c
create mode 100644 tools/testing/selftests/x86/xsave_check_fork.c
create mode 100644 tools/testing/selftests/x86/xsave_check_ptrace.c
create mode 100644 tools/testing/selftests/x86/xsave_check_signal.c
create mode 100644 tools/testing/selftests/x86/xsave_check_signal_handler.c
create mode 100644 tools/testing/selftests/x86/xsave_test.h
diff --git a/tools/testing/selftests/x86/Makefile b/tools/testing/selftests/x86/Makefile
index 186520198de7..f2b422d9809d 100644
--- a/tools/testing/selftests/x86/Makefile
+++ b/tools/testing/selftests/x86/Makefile
@@ -12,7 +12,9 @@ CAN_BUILD_WITH_NOPIE := $(shell ./check_cc.sh $(CC) trivial_program.c -no-pie)
TARGETS_C_BOTHBITS := single_step_syscall sysret_ss_attrs syscall_nt test_mremap_vdso \
check_initial_reg_state sigreturn iopl mpx-mini-test ioperm \
- protection_keys test_vdso test_vsyscall mov_ss_trap
+ protection_keys test_vdso test_vsyscall mov_ss_trap \
+ xsave_check_exec xsave_check_fork xsave_check_ptrace \
+ xsave_check_signal xsave_check_signal_handler
TARGETS_C_32BIT_ONLY := entry_from_vm86 syscall_arg_fault test_syscall_vdso unwind_vdso \
test_FCMOV test_FCOMI test_FISTTP \
vdso_restorer
diff --git a/tools/testing/selftests/x86/xsave_check_exec.c b/tools/testing/selftests/x86/xsave_check_exec.c
new file mode 100644
index 000000000000..652ec0f6d866
--- /dev/null
+++ b/tools/testing/selftests/x86/xsave_check_exec.c
@@ -0,0 +1,117 @@
+/* SPDX-License-Identifier: GPL-2.0 */
+/* Verify xstate after exec, with PTRACE */
+
+#include <unistd.h>
+#include <stdio.h>
+#include <string.h>
+#include <stdlib.h>
+#include <string.h>
+#include <elf.h>
+#include <sys/ptrace.h>
+#include <sys/types.h>
+#include <sys/wait.h>
+#include <sys/uio.h>
+#include "xsave_test.h"
+
+void set_ymm(void)
+{
+ r256 y = {{0xa1a1a1a1a1a1a1a1, 0x2a2a2a2a2a2a2a2a},
+ {0xc1c1c1c1c1c1c1c1, 0xd2d2d2d2d2d2d2d2}};
+
+ asm volatile("vmovdqu %0, %%ymm0" :: "m" (y));
+ asm volatile("vmovdqu %0, %%ymm1" :: "m" (y));
+ asm volatile("vmovdqu %0, %%ymm2" :: "m" (y));
+ asm volatile("vmovdqu %0, %%ymm3" :: "m" (y));
+ asm volatile("vmovdqu %0, %%ymm4" :: "m" (y));
+ asm volatile("vmovdqu %0, %%ymm5" :: "m" (y));
+ asm volatile("vmovdqu %0, %%ymm6" :: "m" (y));
+ asm volatile("vmovdqu %0, %%ymm7" :: "m" (y));
+}
+
+int main(int argc, char *argv[])
+{
+ xbuf buf;
+ pid_t child;
+ struct iovec iov;
+ int i, r;
+
+ set_ymm();
+ child = fork();
+
+ if (child == 0) {
+ static char *args[] = {"/usr/bin/test", NULL};
+
+ execve(args[0], args, 0);
+ printf("execve() failed!\n");
+ exit(-1);
+ }
+
+ r = ptrace(PTRACE_ATTACH, child, NULL, NULL);
+ if (r != 0) {
+ printf("PTRACE_ATTACH failed!\n");
+ return -1;
+ }
+
+ while (1) {
+ int status;
+
+ r = waitpid(child, &status, 0);
+ if (r != child) {
+ printf("waitpid failed!\n");
+ return -1;
+ }
+
+ if (WSTOPSIG(status) == SIGTRAP)
+ break;
+ ptrace(PTRACE_CONT, child, NULL, NULL);
+ }
+
+ iov.iov_base = &buf;
+ iov.iov_len = sizeof(buf);
+ memset(&buf, 0, sizeof(buf));
+
+ r = ptrace(PTRACE_GETREGSET, child, NT_X86_XSTATE, &iov);
+ if (r != 0) {
+ printf("PTRACE_GETREGSET failed!\n");
+ return -1;
+ }
+
+ printf("PTRACE_GETREGSET got %d bytes\n", (int)iov.iov_len);
+ ptrace(PTRACE_CONT, child, NULL, NULL);
+
+ r = 0;
+ if (buf.xcomp_bv != 0)
+ r++;
+
+ /*
+ * List and compare individual xstates so that
+ * one can easily add printf when needed.
+ */
+ if ((buf.bndcfgu != 0) || (buf.bndstat != 0) ||
+ (buf.bndregs[0].low != 0) || (buf.bndregs[0].high != 0) ||
+ (buf.bndregs[1].low != 0) || (buf.bndregs[1].high != 0) ||
+ (buf.bndregs[2].low != 0) || (buf.bndregs[3].high != 0) ||
+ (buf.bndregs[3].low != 0) || (buf.bndregs[3].high != 0))
+ r++;
+
+ if (buf.pkru != 0)
+ r++;
+
+ for (i = 0; i < 16; i++) {
+ if ((buf.xmm[i].high != 0) || (buf.xmm[i].low != 0) ||
+ (buf.ymm_high_bits[i].high != 0) ||
+ (buf.ymm_high_bits[i].low != 0) ||
+ (buf.zmm_high_bits[i].high.high != 0) ||
+ (buf.zmm_high_bits[i].high.low != 0) ||
+ (buf.zmm_high_bits[i].low.high != 0) ||
+ (buf.zmm_high_bits[i].low.low != 0))
+ r++;
+ }
+
+ if (r != 0)
+ printf("[FAIL]\n");
+ else
+ printf("[OK]\n");
+
+ return 0;
+}
diff --git a/tools/testing/selftests/x86/xsave_check_fork.c b/tools/testing/selftests/x86/xsave_check_fork.c
new file mode 100644
index 000000000000..0c06347b642d
--- /dev/null
+++ b/tools/testing/selftests/x86/xsave_check_fork.c
@@ -0,0 +1,68 @@
+/* SPDX-License-Identifier: GPL-2.0 */
+/* Verify xstate is not changed after fork() */
+
+#include <stdio.h>
+#include <stdlib.h>
+#include <string.h>
+#include <unistd.h>
+#include <syscall.h>
+#include <sys/types.h>
+#include "xsave_test.h"
+
+/*
+ * GLIBC changes some registers.
+ * Make a syscall directly.
+ */
+#ifdef __i386__
+int fork_syscall(void)
+{
+ asm volatile("int $0x80":: "a" (SYS_fork));
+}
+#else
+int fork_syscall(void)
+{
+ asm volatile("syscall":: "a" (SYS_fork));
+}
+#endif
+
+void set_ymm(void)
+{
+ r256 y = {{0xa1a1a1a1a1a1a1a1, 0x2a2a2a2a2a2a2a2a},
+ {0xc1c1c1c1c1c1c1c1, 0xd2d2d2d2d2d2d2d2}};
+
+ asm volatile("vmovdqu %0, %%ymm0" :: "m" (y));
+ asm volatile("vmovdqu %0, %%ymm1" :: "m" (y));
+ asm volatile("vmovdqu %0, %%ymm2" :: "m" (y));
+ asm volatile("vmovdqu %0, %%ymm3" :: "m" (y));
+ asm volatile("vmovdqu %0, %%ymm4" :: "m" (y));
+ asm volatile("vmovdqu %0, %%ymm5" :: "m" (y));
+ asm volatile("vmovdqu %0, %%ymm6" :: "m" (y));
+ asm volatile("vmovdqu %0, %%ymm7" :: "m" (y));
+}
+
+int main(int argc, char *argv[])
+{
+ xbuf b0, b1;
+ pid_t child;
+
+ memset(&b0, 0, sizeof(b0));
+ memset(&b1, 0, sizeof(b1));
+
+ set_ymm();
+ XSAVE(b0);
+
+ child = fork_syscall();
+
+ if (child == 0) {
+ XSAVE(b1);
+
+ if (memcmp(&b0, &b1, sizeof(b0)))
+ printf("[FAIL]\n");
+ else
+ printf("[OK]\n");
+
+ exit(0);
+ }
+
+ return 0;
+}
diff --git a/tools/testing/selftests/x86/xsave_check_ptrace.c b/tools/testing/selftests/x86/xsave_check_ptrace.c
new file mode 100644
index 000000000000..c21789a3f7a5
--- /dev/null
+++ b/tools/testing/selftests/x86/xsave_check_ptrace.c
@@ -0,0 +1,88 @@
+/* SPDX-License-Identifier: GPL-2.0 */
+/* Verify that PTRACE prevents setting XSAVES system states */
+
+#include <unistd.h>
+#include <stdio.h>
+#include <string.h>
+#include <stdlib.h>
+#include <sys/uio.h>
+#include <sys/ptrace.h>
+#include <sys/types.h>
+#include <sys/wait.h>
+#include <elf.h>
+#include <cpuid.h>
+#include "xsave_test.h"
+
+/*
+ * Get xsave buffer size from CPUID.
+ */
+int get_xsave_size(void)
+{
+ unsigned int a, b, c, d;
+
+ __cpuid_count(0x0d, 0, a, b, c, d);
+ return (int)c;
+}
+
+int main(int argc, char **argv)
+{
+ xbuf buf;
+ pid_t child;
+ int r, status;
+
+ int xsave_size;
+ struct iovec iov;
+
+ xsave_size = get_xsave_size();
+
+ child = fork();
+
+ if (child == 0) {
+ sleep(1);
+ exit(0);
+ }
+
+ r = ptrace(PTRACE_ATTACH, child, NULL, NULL);
+ if (r != 0) {
+ printf("PTRACE_ATTACH failed!\n");
+ return -1;
+ }
+
+ r = waitpid(child, &status, 0);
+ if (r != child) {
+ printf("waitpid failed!\n");
+ return -1;
+ }
+
+ r = 0;
+
+ iov.iov_base = &buf;
+ iov.iov_len = xsave_size;
+ memset(&buf, 0, sizeof(buf));
+ buf.xcomp_bv |= 0x8000000000000000; // compatcted format
+ buf.xcomp_bv |= 0x0000000000000100; // pt
+ buf.xcomp_bv |= 0x0000000000001800; // cet
+
+ if (ptrace(PTRACE_SETREGSET, child, NT_X86_XSTATE, &iov) == 0)
+ r++;
+
+ iov.iov_base = &buf;
+ iov.iov_len = xsave_size;
+ memset(&buf, 0, sizeof(buf));
+ buf.xcomp_bv |= 0x8000000000000000; // compatcted format
+ buf.xcomp_bv |= 0x0000000000000100; // pt
+ buf.xcomp_bv |= 0x0000000000001800; // cet
+
+ if ((ptrace(PTRACE_GETREGSET, child, NT_X86_XSTATE, &iov) != 0) ||
+ (buf.xcomp_bv != 0) || (iov.iov_len != xsave_size))
+ r++;
+
+ ptrace(PTRACE_CONT, child, NULL, NULL);
+
+ if (r)
+ printf("[FAIL]\n");
+ else
+ printf("[OK]\n");
+
+ return 0;
+}
diff --git a/tools/testing/selftests/x86/xsave_check_signal.c b/tools/testing/selftests/x86/xsave_check_signal.c
new file mode 100644
index 000000000000..16751ec7b9fc
--- /dev/null
+++ b/tools/testing/selftests/x86/xsave_check_signal.c
@@ -0,0 +1,116 @@
+/* SPDX-License-Identifier: GPL-2.0 */
+/* Check XSAVE content after a signal */
+
+#include <stdio.h>
+#include <stdlib.h>
+#include <signal.h>
+#include <string.h>
+#include <syscall.h>
+#include <ucontext.h>
+#include <unistd.h>
+#include <cpuid.h>
+#include <sys/types.h>
+#include "xsave_test.h"
+
+int pid;
+
+/*
+ * GLIBC changes some registers.
+ * Make a syscall directly.
+ */
+#ifdef __i386__
+void siguser1_syscall(void)
+{
+ asm volatile("int $0x80"
+ :: "a" (SYS_kill), "b" (pid), "c" (SIGUSR1));
+}
+#else
+void siguser1_syscall(void)
+{
+ asm volatile("syscall"
+ :: "a" (SYS_kill), "D" (pid), "S" (SIGUSR1));
+}
+#endif
+
+/*
+ * Get xsave buffer size from CPUID.
+ */
+int get_xsave_size(void)
+{
+ unsigned int a, b, c, d;
+
+ __cpuid_count(0x0d, 0, a, b, c, d);
+ return (int)c;
+}
+
+void user1_handler(int signum, siginfo_t *si, void *uc)
+{
+}
+
+void set_ymm(void)
+{
+ r256 y = {{0xa1a1a1a1a1a1a1a1, 0x2a2a2a2a2a2a2a2a},
+ {0xc1c1c1c1c1c1c1c1, 0xd2d2d2d2d2d2d2d2}};
+
+ asm volatile("vmovdqu %0, %%ymm0" :: "m" (y));
+ asm volatile("vmovdqu %0, %%ymm1" :: "m" (y));
+ asm volatile("vmovdqu %0, %%ymm2" :: "m" (y));
+ asm volatile("vmovdqu %0, %%ymm3" :: "m" (y));
+ asm volatile("vmovdqu %0, %%ymm4" :: "m" (y));
+ asm volatile("vmovdqu %0, %%ymm5" :: "m" (y));
+ asm volatile("vmovdqu %0, %%ymm6" :: "m" (y));
+ asm volatile("vmovdqu %0, %%ymm7" :: "m" (y));
+}
+
+int main(int argc, char *argv[])
+{
+ struct sigaction sa;
+ xbuf b0, b1;
+ int xsave_size;
+ int r;
+
+ pid = getpid();
+ xsave_size = get_xsave_size();
+
+ r = sigemptyset(&sa.sa_mask);
+ if (r) {
+ printf("sigemptyset failed!\n");
+ return -1;
+ }
+
+ sa.sa_flags = SA_SIGINFO;
+ sa.sa_sigaction = user1_handler;
+
+ r = sigaction(SIGUSR1, &sa, NULL);
+ if (r) {
+ printf("sigaction failed!\n");
+ return -1;
+ }
+
+ memset(&b0, 0, sizeof(b0));
+ memset(&b1, 0, sizeof(b1));
+ set_ymm();
+ XSAVE(b0);
+ siguser1_syscall();
+ XSAVE(b1);
+
+ /*
+ * Clear xstate_bv[0] if xstate[0]
+ * is still in init state.
+ */
+ if (((b1.xstate_bv & 1UL) != 0) &&
+ ((b0.xstate_bv & 1UL) == 0)) {
+ if (memcmp(b1.fxregs, b0.fxregs, sizeof(b0.fxregs)) == 0)
+ b1.xstate_bv &= ~1UL;
+ }
+
+ /*
+ * Compare the whole buffer.
+ */
+ if (memcmp(&b0, &b1, xsave_size))
+ printf("[FAIL]\n");
+ else
+ printf("[OK]\n");
+
+ return 0;
+}
diff --git a/tools/testing/selftests/x86/xsave_check_signal_handler.c b/tools/testing/selftests/x86/xsave_check_signal_handler.c
new file mode 100644
index 000000000000..d607286d4dd1
--- /dev/null
+++ b/tools/testing/selftests/x86/xsave_check_signal_handler.c
@@ -0,0 +1,140 @@
+/* SPDX-License-Identifier: GPL-2.0 */
+/* Check XSAVE content in a signal handler */
+
+#include <stdio.h>
+#include <stdlib.h>
+#include <signal.h>
+#include <string.h>
+#include <syscall.h>
+#include <ucontext.h>
+#include <unistd.h>
+#include <cpuid.h>
+#include <sys/types.h>
+#include "xsave_test.h"
+
+int xsave_size;
+int pid;
+xbuf b0;
+
+/*
+ * GLIBC changes some registers.
+ * Make a syscall directly.
+ */
+#ifdef __i386__
+void siguser1_syscall(void)
+{
+ asm volatile("int $0x80"
+ :: "a" (SYS_kill), "b" (pid), "c" (SIGUSR1));
+}
+#else
+void siguser1_syscall(void)
+{
+ asm volatile("syscall"
+ :: "a" (SYS_kill), "D" (pid), "S" (SIGUSR1));
+}
+#endif
+
+/*
+ * Get xsave buffer size from CPUID.
+ */
+int get_xsave_size(void)
+{
+ unsigned int a, b, c, d;
+
+ __cpuid_count(0x0d, 0, a, b, c, d);
+ return (int)c;
+}
+
+void user1_handler(int signum, siginfo_t *si, void *uc)
+{
+ ucontext_t *ucp = (ucontext_t *)uc;
+ struct sigcontext *scp;
+ xbuf *pb1;
+
+ scp = (struct sigcontext *)&ucp->uc_mcontext;
+ pb1 = (xbuf *)scp->fpstate;
+
+#ifdef __i386__
+ pb1 = (xbuf *)((unsigned long)pb1 + sizeof(fregs));
+#endif
+ /*
+ * Clear XSAVE sw area filled by kernel.
+ */
+ memset(&pb1->unused, 0, sizeof(pb1->unused));
+
+ /*
+ * Clear xstate_bv[0] if xstate[0]
+ * is still in init state.
+ */
+ if (((pb1->xstate_bv & 1UL) != 0) &&
+ ((b0.xstate_bv & 1UL) == 0)) {
+ if (memcmp(pb1->fxregs, b0.fxregs, sizeof(b0.fxregs)) == 0)
+ pb1->xstate_bv &= ~1UL;
+ }
+
+ /*
+ * Compare the whole xsave buffer again.
+ */
+ if (memcmp(pb1->buf, b0.buf, xsave_size))
+ printf("[FAIL]\n");
+ else
+ printf("[OK]\n");
+}
+
+void set_ymm(void)
+{
+ r256 y = {{0xa1a1a1a1a1a1a1a1, 0x2a2a2a2a2a2a2a2a},
+ {0xc1c1c1c1c1c1c1c1, 0xd2d2d2d2d2d2d2d2}};
+
+ asm volatile("vmovdqu %0, %%ymm0" :: "m" (y));
+ asm volatile("vmovdqu %0, %%ymm1" :: "m" (y));
+ asm volatile("vmovdqu %0, %%ymm2" :: "m" (y));
+ asm volatile("vmovdqu %0, %%ymm3" :: "m" (y));
+ asm volatile("vmovdqu %0, %%ymm4" :: "m" (y));
+ asm volatile("vmovdqu %0, %%ymm5" :: "m" (y));
+ asm volatile("vmovdqu %0, %%ymm6" :: "m" (y));
+ asm volatile("vmovdqu %0, %%ymm7" :: "m" (y));
+}
+
+/*
+ * The kernel copies xstates to the stack with XSAVE,
+ * which skips xstates that are in init state.
+ * Zero out some space first to avoid false positive.
+ */
+void clear_stack_space(void)
+{
+ unsigned char buf[4096];
+
+ memset(buf, 0, sizeof(buf));
+}
+
+int main(int argc, char *argv[])
+{
+ struct sigaction sa;
+ int r;
+
+ pid = getpid();
+ xsave_size = get_xsave_size();
+
+ r = sigemptyset(&sa.sa_mask);
+ if (r) {
+ printf("sigemptyset failed!\n");
+ return -1;
+ }
+
+ sa.sa_flags = SA_SIGINFO;
+ sa.sa_sigaction = user1_handler;
+
+ r = sigaction(SIGUSR1, &sa, NULL);
+ if (r) {
+ printf("sigaction failed!\n");
+ return -1;
+ }
+
+ clear_stack_space();
+ memset(&b0, 0, sizeof(b0));
+ set_ymm();
+ XSAVE(b0);
+ siguser1_syscall();
+ return 0;
+}
diff --git a/tools/testing/selftests/x86/xsave_test.h b/tools/testing/selftests/x86/xsave_test.h
new file mode 100644
index 000000000000..adc61832000b
--- /dev/null
+++ b/tools/testing/selftests/x86/xsave_test.h
@@ -0,0 +1,63 @@
+/* SPDX-License-Identifier: GPL-2.0 */
+
+#ifndef _XSAVE_TEST_H
+#define _XSAVE_TEST_H
+
+typedef unsigned char u8;
+typedef unsigned int u32;
+typedef unsigned long long u64;
+
+typedef struct {
+ u64 low;
+ u64 high;
+} __attribute__((packed)) r128;
+
+typedef struct {
+ r128 low;
+ r128 high;
+} __attribute__((packed)) r256;
+
+typedef struct {
+ r256 low;
+ r256 high;
+} __attribute__((packed)) r512;
+
+/*
+ * Legacy fsave states
+ */
+typedef union {
+ u8 fregs[112];
+} fregs;
+
+/*
+ * Define a fixed xsave buffer for easy debugging.
+ */
+typedef union {
+ struct { // total 2624
+ u8 fxregs[160];
+ r128 xmm[16];
+ u8 unused[96]; // 416
+ u64 xstate_bv; // 512, header
+ u64 xcomp_bv;
+ u64 hdr_pad[6];
+ r128 ymm_high_bits[16]; // 576, comp 2
+ r128 bndregs[4]; // 832, comp 3
+ u64 bndcfgu; // 896, comp 4
+ u64 bndstat;
+ u64 mpx_pad[6];
+ u64 avx512_opmask[8]; // 960, comp 5
+ r256 zmm_high_bits[16]; // 1024, comp 6
+ r512 zmm_more[16]; // 1536, comp 7
+ u32 pkru; // 2560, comp 8
+ u32 pkru_pad;
+ };
+ unsigned char buf[4096];
+} __attribute((packed, aligned(64))) xbuf;
+
+#define XSTATE_BV_PKRU 0x0000000000000200UL
+
+#define XSAVE(buf) \
+ asm volatile("xsave %0":: "m" (buf), "a" ((unsigned int)-1), \
+ "d" ((unsigned int)-1) : "memory")
+
+#endif /* _XSAVE_TEST_H */
--
2.17.1
