Re: [PATCH v2] selftests/x86: Add a selftest for SYSRET to noncanonical addresses

["Kirill A. Shutemov" <kirill@shutemov.name>]

On Mon, Dec 26, 2016 at 07:20:50PM -0800, Andy Lutomirski wrote:
> SYSRET to a noncanonical address will blow up on Intel CPUs.  Linux
> needs to prevent this from happening in two major cases, and the
> criteria will become more complicated when support for larger virtual
> address spaces is added.
> 
> A fast-path SYSCALL will fallthrough to the following instruction
> using SYSRET without any particular checking.  To prevent fallthrough
> to a noncanonical address, Linux prevents the highest canonical page
> from being mapped.  This test case checks a variety of possible maximum
> addresses to make sure that either we can't map code there or that
> SYSCALL fallthrough works.
> 
> A slow-path system call can return anywhere.  Linux needs to make sure
> that, if the return address is non-canonical, it won't use SYSRET.
> This test cases causes sigreturn() to return to a variety of addresses
> (with RCX == RIP) and makes sure that nothing explodes.
> 
> Some of this code comes from Kirill Shutemov.
> 
> Changes from v1:
>  - Get rid of some extra parentheses.
>  - Test more corner cases.
>  - Get rid of some duplicate '0x' printout.
> 
> Cc: "Kirill A. Shutemov" <kirill.shutemov@linux.intel.com>
> Signed-off-by: Andy Lutomirski <luto@kernel.org>

Acked-by: Kirill A. Shutemov <kirill.shutemov@linux.intel.com>

Output with 5-level paging enabled:

[RUN]   sigreturn to 0x800000000000
[OK]    Got SIGSEGV at RIP=0x800000000000
[RUN]   sigreturn to 0x1000000000000
[OK]    Got SIGSEGV at RIP=0x1000000000000
[RUN]   sigreturn to 0x2000000000000
[OK]    Got SIGSEGV at RIP=0x2000000000000
[RUN]   sigreturn to 0x4000000000000
[OK]    Got SIGSEGV at RIP=0x4000000000000
[RUN]   sigreturn to 0x8000000000000
[OK]    Got SIGSEGV at RIP=0x8000000000000
[RUN]   sigreturn to 0x10000000000000
[OK]    Got SIGSEGV at RIP=0x10000000000000
[RUN]   sigreturn to 0x20000000000000
[OK]    Got SIGSEGV at RIP=0x20000000000000
[RUN]   sigreturn to 0x40000000000000
[OK]    Got SIGSEGV at RIP=0x40000000000000
[RUN]   sigreturn to 0x80000000000000
[OK]    Got SIGSEGV at RIP=0x80000000000000
[RUN]   sigreturn to 0x100000000000000
[OK]    Got SIGSEGV at RIP=0x100000000000000
[RUN]   sigreturn to 0x200000000000000
[OK]    Got SIGSEGV at RIP=0x200000000000000
[RUN]   sigreturn to 0x400000000000000
[OK]    Got SIGSEGV at RIP=0x400000000000000
[RUN]   sigreturn to 0x800000000000000
[OK]    Got SIGSEGV at RIP=0x800000000000000
[RUN]   sigreturn to 0x1000000000000000
[OK]    Got SIGSEGV at RIP=0x1000000000000000
[RUN]   sigreturn to 0x2000000000000000
[OK]    Got SIGSEGV at RIP=0x2000000000000000
[RUN]   sigreturn to 0x4000000000000000
[OK]    Got SIGSEGV at RIP=0x4000000000000000
[RUN]   sigreturn to 0x8000000000000000
[OK]    Got SIGSEGV at RIP=0x8000000000000000
[RUN]   Trying a SYSCALL that falls through to 0x7fffffffe000
[OK]    We survived
[RUN]   Trying a SYSCALL that falls through to 0x7ffffffff000
[OK]    We survived
[RUN]   Trying a SYSCALL that falls through to 0x800000000000
[OK]    We survived
[RUN]   Trying a SYSCALL that falls through to 0xfffffffff000
[OK]    We survived
[RUN]   Trying a SYSCALL that falls through to 0x1000000000000
[OK]    We survived
[RUN]   Trying a SYSCALL that falls through to 0x1fffffffff000
[OK]    We survived
[RUN]   Trying a SYSCALL that falls through to 0x2000000000000
[OK]    We survived
[RUN]   Trying a SYSCALL that falls through to 0x3fffffffff000
[OK]    We survived
[RUN]   Trying a SYSCALL that falls through to 0x4000000000000
[OK]    We survived
[RUN]   Trying a SYSCALL that falls through to 0x7fffffffff000
[OK]    We survived
[RUN]   Trying a SYSCALL that falls through to 0x8000000000000
[OK]    We survived
[RUN]   Trying a SYSCALL that falls through to 0xffffffffff000
[OK]    We survived
[RUN]   Trying a SYSCALL that falls through to 0x10000000000000
[OK]    We survived
[RUN]   Trying a SYSCALL that falls through to 0x1ffffffffff000
[OK]    We survived
[RUN]   Trying a SYSCALL that falls through to 0x20000000000000
[OK]    We survived
[RUN]   Trying a SYSCALL that falls through to 0x3ffffffffff000
[OK]    We survived
[RUN]   Trying a SYSCALL that falls through to 0x40000000000000
[OK]    We survived
[RUN]   Trying a SYSCALL that falls through to 0x7ffffffffff000
[OK]    We survived
[RUN]   Trying a SYSCALL that falls through to 0x80000000000000
[OK]    We survived
[RUN]   Trying a SYSCALL that falls through to 0xfffffffffff000
[OK]    We survived
[RUN]   Trying a SYSCALL that falls through to 0x100000000000000
[OK]    mremap to 0xfffffffffff000 failed
[RUN]   Trying a SYSCALL that falls through to 0x1fffffffffff000
[OK]    mremap to 0x1ffffffffffe000 failed
[RUN]   Trying a SYSCALL that falls through to 0x200000000000000
[OK]    mremap to 0x1fffffffffff000 failed
[RUN]   Trying a SYSCALL that falls through to 0x3fffffffffff000
[OK]    mremap to 0x3ffffffffffe000 failed
[RUN]   Trying a SYSCALL that falls through to 0x400000000000000
[OK]    mremap to 0x3fffffffffff000 failed
[RUN]   Trying a SYSCALL that falls through to 0x7fffffffffff000
[OK]    mremap to 0x7ffffffffffe000 failed
[RUN]   Trying a SYSCALL that falls through to 0x800000000000000
[OK]    mremap to 0x7fffffffffff000 failed
[RUN]   Trying a SYSCALL that falls through to 0xffffffffffff000
[OK]    mremap to 0xfffffffffffe000 failed
[RUN]   Trying a SYSCALL that falls through to 0x1000000000000000
[OK]    mremap to 0xffffffffffff000 failed
[RUN]   Trying a SYSCALL that falls through to 0x1ffffffffffff000
[OK]    mremap to 0x1fffffffffffe000 failed
[RUN]   Trying a SYSCALL that falls through to 0x2000000000000000
[OK]    mremap to 0x1ffffffffffff000 failed
[RUN]   Trying a SYSCALL that falls through to 0x3ffffffffffff000
[OK]    mremap to 0x3fffffffffffe000 failed
[RUN]   Trying a SYSCALL that falls through to 0x4000000000000000
[OK]    mremap to 0x3ffffffffffff000 failed
[RUN]   Trying a SYSCALL that falls through to 0x7ffffffffffff000
[OK]    mremap to 0x7fffffffffffe000 failed
[RUN]   Trying a SYSCALL that falls through to 0x8000000000000000
[OK]    mremap to 0x7ffffffffffff000 failed

-- 
 Kirill A. Shutemov