blob: c01dd89d908208e8a337c6aeca09c1effb754dd7 [file] [log] [blame]
#include "libcflat.h"
#include "x86/desc.h"
#include "x86/processor.h"
#include "x86/vm.h"
#include "x86/msr.h"
#include "vmalloc.h"
#include "alloc_page.h"
#include "fault_test.h"
static int cp_count;
static unsigned long invalid_offset = 0xffffffffffffff;
static u64 cet_shstk_func(void)
{
unsigned long *ret_addr, *ssp;
/* rdsspq %rax */
asm volatile (".byte 0xf3, 0x48, 0x0f, 0x1e, 0xc8" : "=a"(ssp));
asm("movq %%rbp,%0" : "=r"(ret_addr));
printf("The return-address in shadow-stack = 0x%lx, in normal stack = 0x%lx\n",
*ssp, *(ret_addr + 1));
/*
* In below line, it modifies the return address, it'll trigger #CP
* while function is returning. The error-code is 0x1, meaning it's
* caused by a near RET instruction, and the execution is terminated
* when HW detects the violation.
*/
printf("Try to temper the return-address, this causes #CP on returning...\n");
*(ret_addr + 1) = 0xdeaddead;
return 0;
}
static u64 cet_ibt_func(void)
{
/*
* In below assembly code, the first instruction at label 2 is not
* endbr64, it'll trigger #CP with error code 0x3, and the execution
* is terminated when HW detects the violation.
*/
printf("No endbr64 instruction at jmp target, this triggers #CP...\n");
asm volatile ("movq $2, %rcx\n"
"dec %rcx\n"
"leaq 2f(%rip), %rax\n"
"jmp *%rax \n"
"2:\n"
"dec %rcx\n");
return 0;
}
#define ENABLE_SHSTK_BIT 0x1
#define ENABLE_IBT_BIT 0x4
static void handle_cp(struct ex_regs *regs)
{
cp_count++;
printf("In #CP exception handler, error_code = 0x%lx\n",
regs->error_code);
/* Below jmp is expected to trigger #GP */
asm("jmpq *%0": :"m"(invalid_offset));
}
int main(int ac, char **av)
{
char *shstk_virt;
unsigned long shstk_phys;
unsigned long *ptep;
pteval_t pte = 0;
bool rvc;
cp_count = 0;
if (!this_cpu_has(X86_FEATURE_SHSTK)) {
printf("SHSTK not enabled\n");
return report_summary();
}
if (!this_cpu_has(X86_FEATURE_IBT)) {
printf("IBT not enabled\n");
return report_summary();
}
setup_vm();
handle_exception(21, handle_cp);
/* Allocate one page for shadow-stack. */
shstk_virt = alloc_vpage();
shstk_phys = (unsigned long)virt_to_phys(alloc_page());
/* Install the new page. */
pte = shstk_phys | PT_PRESENT_MASK | PT_WRITABLE_MASK | PT_USER_MASK;
install_pte(current_page_table(), 1, shstk_virt, pte, 0);
memset(shstk_virt, 0x0, PAGE_SIZE);
/* Mark it as shadow-stack page. */
ptep = get_pte_level(current_page_table(), shstk_virt, 1);
*ptep &= ~PT_WRITABLE_MASK;
*ptep |= PT_DIRTY_MASK;
/* Flush the paging cache. */
invlpg((void *)shstk_phys);
/* Enable shadow-stack protection */
wrmsr(MSR_IA32_U_CET, ENABLE_SHSTK_BIT);
/* Store shadow-stack pointer. */
wrmsr(MSR_IA32_PL3_SSP, (u64)(shstk_virt + 0x1000));
/* Enable CET master control bit in CR4. */
write_cr4(read_cr4() | X86_CR4_CET);
printf("Unit test for CET user mode...\n");
run_in_user((usermode_func)cet_shstk_func, GP_VECTOR, 0, 0, 0, 0, &rvc);
report(cp_count == 1, "Completed shadow-stack protection test successfully.");
cp_count = 0;
/* Enable indirect-branch tracking */
wrmsr(MSR_IA32_U_CET, ENABLE_IBT_BIT);
run_in_user((usermode_func)cet_ibt_func, GP_VECTOR, 0, 0, 0, 0, &rvc);
report(cp_count == 1, "Completed Indirect-branch tracking test successfully.");
write_cr4(read_cr4() & ~X86_CR4_CET);
wrmsr(MSR_IA32_U_CET, 0);
return report_summary();
}