x86: add testcases for RODATA and NX protections/attributes

Latest update; I now have 4 NX tests, but 2 fail so they're #if 0'd.
I also cleaned up the NX test code quite a bit, and got rid of the ugly
exception table sorting stuff.

From: Arjan van de Ven <arjan@linux.intel.com>

This patch adds testcases for the CONFIG_DEBUG_RODATA configuration option
as well as the NX CPU feature/mappings. Both testcases can move to tests/
once that patch gets merged into mainline.
(I'm half considering moving the rodata test into mm/init.c but I'll
wait with that until init.c is unified)

As part of this I had to fix a not-quite-right alignment in the vmlinux.lds.h
for the RODATA sections, which lead to 1 page less being marked read only.

Signed-off-by: Arjan van de Ven <arjan@linux.intel.com>
Signed-off-by: Ingo Molnar <mingo@elte.hu>
Signed-off-by: Thomas Gleixner <tglx@linutronix.de>

6 files changed, 276 insertions, 0 deletions

diff --git a/arch/x86/kernel/test_nx.c b/arch/x86/kernel/test_nx.c
new file mode 100644
index 000000000000..6d7ef11e7975
--- /dev/null
+++ b/arch/x86/kernel/test_nx.c
@@ -0,0 +1,176 @@
+/*
+ * test_nx.c: functional test for NX functionality
+ *
+ * (C) Copyright 2008 Intel Corporation
+ * Author: Arjan van de Ven <arjan@linux.intel.com>
+ *
+ * This program is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU General Public License
+ * as published by the Free Software Foundation; version 2
+ * of the License.
+ */
+#include <linux/module.h>
+#include <linux/sort.h>
+#include <asm/uaccess.h>
+
+extern int rodata_test_data;
+
+/*
+ * This file checks 4 things:
+ * 1) Check if the stack is not executable
+ * 2) Check if kmalloc memory is not executable
+ * 3) Check if the .rodata section is not executable
+ * 4) Check if the .data section of a module is not executable
+ *
+ * To do this, the test code tries to execute memory in stack/kmalloc/etc,
+ * and then checks if the expected trap happens.
+ *
+ * Sadly, this implies having a dynamic exception handling table entry.
+ * ... which can be done (and will make Rusty cry)... but it can only
+ * be done in a stand-alone module with only 1 entry total.
+ * (otherwise we'd have to sort and that's just too messy)
+ */
+
+
+
+/*
+ * We want to set up an exception handling point on our stack,
+ * which means a variable value. This function is rather dirty
+ * and walks the exception table of the module, looking for a magic
+ * marker and replaces it with a specific function.
+ */
+static void fudze_exception_table(void *marker, void *new)
+{
+        struct module *mod = THIS_MODULE;
+        struct exception_table_entry *extable;
+
+        /*
+         * Note: This module has only 1 exception table entry,
+         * so searching and sorting is not needed. If that changes,
+         * this would be the place to search and re-sort the exception
+         * table.
+         */
+        if (mod->num_exentries > 1) {
+                printk(KERN_ERR "test_nx: too many exception table entries!\n");
+                printk(KERN_ERR "test_nx: test results are not reliable.\n");
+                return;
+        }
+        extable = (struct exception_table_entry *)mod->extable;
+        extable[0].insn = (unsigned long)new;
+}
+
+
+/*
+ * exception tables get their symbols translated so we need
+ * to use a fake function to put in there, which we can then
+ * replace at runtime.
+ */
+void foo_label(void);
+
+/*
+ * returns 0 for not-executable, negative for executable
+ *
+ * Note: we cannot allow this function to be inlined, because
+ * that would give us more than 1 exception table entry.
+ * This in turn would break the assumptions above.
+ */
+static noinline int test_address(void *address)
+{
+        unsigned long result;
+
+        /* Set up an exception table entry for our address */
+        fudze_exception_table(&foo_label, address);
+        result = 1;
+        asm volatile(
+                "foo_label:\n"
+                "0:     call *%[fake_code]\n"
+                "1:\n"
+                ".section .fixup,\"ax\"\n"
+                "2:     mov %[zero], %[rslt]\n"
+                "       ret\n"
+                ".previous\n"
+                ".section __ex_table,\"a\"\n"
+                "       .align 8\n"
+                "       .quad 0b\n"
+                "       .quad 2b\n"
+                ".previous\n"
+                : [rslt] "=r" (result)
+                : [fake_code] "r" (address), [zero] "r" (0UL), "0" (result)
+        );
+        /* change the exception table back for the next round */
+        fudze_exception_table(address, &foo_label);
+
+        if (result)
+                return -ENODEV;
+        return 0;
+}
+
+static unsigned char test_data = 0xC3; /* 0xC3 is the opcode for "ret" */
+
+static int test_NX(void)
+{
+        int ret = 0;
+        /* 0xC3 is the opcode for "ret" */
+        char stackcode[] = {0xC3, 0x90, 0 };
+        char *heap;
+
+        test_data = 0xC3;
+
+        printk(KERN_INFO "Testing NX protection\n");
+
+        /* Test 1: check if the stack is not executable */
+        if (test_address(&stackcode)) {
+                printk(KERN_ERR "test_nx: stack was executable\n");
+                ret = -ENODEV;
+        }
+
+
+        /* Test 2: Check if the heap is executable */
+        heap = kmalloc(64, GFP_KERNEL);
+        if (!heap)
+                return -ENOMEM;
+        heap[0] = 0xC3; /* opcode for "ret" */
+
+        if (test_address(heap)) {
+                printk(KERN_ERR "test_nx: heap was executable\n");
+                ret = -ENODEV;
+        }
+        kfree(heap);
+
+        /*
+         * The following 2 tests currently fail, this needs to get fixed
+         * Until then, don't run them to avoid too many people getting scared
+         * by the error message
+         */
+#if 0
+
+#ifdef CONFIG_DEBUG_RODATA
+        /* Test 3: Check if the .rodata section is executable */
+        if (rodata_test_data != 0xC3) {
+                printk(KERN_ERR "test_nx: .rodata marker has invalid value\n");
+                ret = -ENODEV;
+        } else if (test_address(&rodata_test_data)) {
+                printk(KERN_ERR "test_nx: .rodata section is executable\n");
+                ret = -ENODEV;
+        }
+#endif
+
+        /* Test 4: Check if the .data section of a module is executable */
+        if (test_address(&test_data)) {
+                printk(KERN_ERR "test_nx: .data section is executable\n");
+                ret = -ENODEV;
+        }
+
+#endif
+        return 0;
+}
+
+static void test_exit(void)
+{
+}
+
+module_init(test_NX);
+module_exit(test_exit);
+MODULE_LICENSE("GPL");
+MODULE_DESCRIPTION("Testcase for the NX infrastructure");
+MODULE_AUTHOR("Arjan van de Ven <arjan@linux.intel.com>");
diff --git a/arch/x86/kernel/test_rodata.c b/arch/x86/kernel/test_rodata.c
new file mode 100644
index 000000000000..4c163772000e
--- /dev/null
+++ b/arch/x86/kernel/test_rodata.c
@@ -0,0 +1,86 @@
+/*
+ * test_rodata.c: functional test for mark_rodata_ro function
+ *
+ * (C) Copyright 2008 Intel Corporation
+ * Author: Arjan van de Ven <arjan@linux.intel.com>
+ *
+ * This program is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU General Public License
+ * as published by the Free Software Foundation; version 2
+ * of the License.
+ */
+#include <linux/module.h>
+#include <asm/sections.h>
+extern int rodata_test_data;
+
+int rodata_test(void)
+{
+        unsigned long result;
+        unsigned long start, end;
+
+        /* test 1: read the value */
+        /* If this test fails, some previous testrun has clobbered the state */
+        if (!rodata_test_data) {
+                printk(KERN_ERR "rodata_test: test 1 fails (start data)\n");
+                return -ENODEV;
+        }
+
+        /* test 2: write to the variable; this should fault */
+        /*
+         * If this test fails, we managed to overwrite the data
+         *
+         * This is written in assembly to be able to catch the
+         * exception that is supposed to happen in the correct
+         * case
+         */
+
+        result = 1;
+        asm volatile(
+                "0:     mov %[zero],(%[rodata_test])\n"
+                "       mov %[zero], %[rslt]\n"
+                "1:\n"
+                ".section .fixup,\"ax\"\n"
+                "2:     jmp 1b\n"
+                ".previous\n"
+                ".section __ex_table,\"a\"\n"
+                "       .align 16\n"
+#ifdef CONFIG_X86_32
+                "       .long 0b,2b\n"
+#else
+                "       .quad 0b,2b\n"
+#endif
+                ".previous"
+                : [rslt] "=r" (result)
+                : [rodata_test] "r" (&rodata_test_data), [zero] "r" (0UL)
+        );
+
+
+        if (!result) {
+                printk(KERN_ERR "rodata_test: test data was not read only\n");
+                return -ENODEV;
+        }
+
+        /* test 3: check the value hasn't changed */
+        /* If this test fails, we managed to overwrite the data */
+        if (!rodata_test_data) {
+                printk(KERN_ERR "rodata_test: Test 3 failes (end data)\n");
+                return -ENODEV;
+        }
+        /* test 4: check if the rodata section is 4Kb aligned */
+        start = (unsigned long)__start_rodata;
+        end = (unsigned long)__end_rodata;
+        if (start & (PAGE_SIZE - 1)) {
+                printk(KERN_ERR "rodata_test: .rodata is not 4k aligned\n");
+                return -ENODEV;
+        }
+        if (end & (PAGE_SIZE - 1)) {
+                printk(KERN_ERR "rodata_test: .rodata end is not 4k aligned\n");
+                return -ENODEV;
+        }
+
+        return 0;
+}
+
+MODULE_LICENSE("GPL");
+MODULE_DESCRIPTION("Testcase for the DEBUG_RODATA infrastructure");
+MODULE_AUTHOR("Arjan van de Ven <arjan@linux.intel.com>");
diff --git a/arch/x86/mm/init_32.c b/arch/x86/mm/init_32.c
index 4d1156545194..a72737c05747 100644
--- a/arch/x86/mm/init_32.c
+++ b/arch/x86/mm/init_32.c
@@ -736,6 +736,8 @@ static int noinline do_test_wp_bit(void)
 }
 
 #ifdef CONFIG_DEBUG_RODATA
+const int rodata_test_data = 0xC3;
+EXPORT_SYMBOL_GPL(rodata_test_data);
 
 void mark_rodata_ro(void)
 {
@@ -765,6 +767,7 @@ void mark_rodata_ro(void)
         set_pages_ro(virt_to_page(start), size >> PAGE_SHIFT);
         printk("Write protecting the kernel read-only data: %luk\n",
                size >> 10);
+        rodata_test();
 
 #ifdef CONFIG_CPA_DEBUG
         printk("Testing CPA: undo %lx-%lx\n", start, start + size);
diff --git a/arch/x86/mm/init_64.c b/arch/x86/mm/init_64.c
index f97ace7a55e5..50d29f5da02b 100644
--- a/arch/x86/mm/init_64.c
+++ b/arch/x86/mm/init_64.c
@@ -573,6 +573,7 @@ void free_init_pages(char *what, unsigned long begin, unsigned long end)
                 set_memory_rw(begin, (end - begin)/PAGE_SIZE);
                 set_memory_np(begin, (end - begin)/PAGE_SIZE);
                 set_memory_nx(begin, (end - begin)/PAGE_SIZE);
+                rodata_test();
         }
 #endif
 }
@@ -585,6 +586,8 @@ void free_initmem(void)
 }
 
 #ifdef CONFIG_DEBUG_RODATA
+const int rodata_test_data = 0xC3;
+EXPORT_SYMBOL_GPL(rodata_test_data);
 
 void mark_rodata_ro(void)
 {
diff --git a/include/asm-generic/vmlinux.lds.h b/include/asm-generic/vmlinux.lds.h
index 76df771be585..f784d2f34149 100644
--- a/include/asm-generic/vmlinux.lds.h
+++ b/include/asm-generic/vmlinux.lds.h
@@ -184,6 +184,7 @@
                 VMLINUX_SYMBOL(__start___param) = .;                    \
                 *(__param)                                              \
                 VMLINUX_SYMBOL(__stop___param) = .;                     \
+                . = ALIGN((align));                                     \
                 VMLINUX_SYMBOL(__end_rodata) = .;                       \
         }                                                               \
         . = ALIGN((align));
diff --git a/include/asm-x86/cacheflush.h b/include/asm-x86/cacheflush.h
index 157da0206ccc..3e74aff90809 100644
--- a/include/asm-x86/cacheflush.h
+++ b/include/asm-x86/cacheflush.h
@@ -47,5 +47,12 @@ void clflush_cache_range(void *addr, int size);
 #ifdef CONFIG_DEBUG_RODATA
 void mark_rodata_ro(void);
 #endif
+#ifdef CONFIG_DEBUG_RODATA_TEST
+void rodata_test(void);
+#else
+static inline void rodata_test(void)
+{
+}
+#endif
 
 #endif