/* * This tests that when a new thread is created, untrusted code is * entered with well-defined register state. None of the registers * should come from uninitialised values. */ void TestInitialRegsAtThreadEntry(void) { char *stack_top = g_stack + sizeof(g_stack); uintptr_t aligned_stack_top = ((uintptr_t) stack_top & ~NACL_STACK_ALIGN_MASK) - NACL_STACK_PAD_BELOW_ALIGN; /* * We do not care about TLS for this test, but sel_ldr rejects a * zero tls argument, so use an arbitrary non-zero value. */ char *tls = (char *) 0x1000; g_stack_in_use = 1; int rc = NACL_SYSCALL(thread_create)((void *) (uintptr_t) ThreadFuncWrapper, stack_top, tls, 0); assert(rc == 0); /* Spin until the thread exits. */ while (g_stack_in_use) { sched_yield(); } ANNOTATE_CONDVAR_WAIT(&g_stack_in_use); struct NaClSignalContext actual_regs = g_initial_thread_regs; struct NaClSignalContext expected_regs; /* By default, we expect registers to be initialised to zero. */ memset(&expected_regs, 0, sizeof(expected_regs)); expected_regs.prog_ctr = (uintptr_t) ThreadFuncWrapper; expected_regs.stack_ptr = aligned_stack_top; RegsApplySandboxConstraints(&expected_regs); SetNaClSwitchExpectations(&expected_regs); #if defined(__x86_64__) /* NaCl happens to initialise %rbp to be the same as %rsp. */ expected_regs.rbp = expected_regs.stack_ptr; #endif RegsAssertEqual(&actual_regs, &expected_regs); }
/* Set registers to known values and enter a NaCl syscall. */ static void SyscallRegisterSetterThread(struct SuspendTestShm *test_shm) { struct NaClSignalContext call_regs; char stack[0x10000]; RegsFillTestValues(&call_regs, /* seed= */ 0); call_regs.stack_ptr = (uintptr_t) stack + sizeof(stack); call_regs.prog_ctr = (uintptr_t) ContinueAfterSyscall; RegsApplySandboxConstraints(&call_regs); /* * call_regs are the registers we set on entry to the syscall. * expected_regs are the registers that should be reported by * NaClAppThreadGetSuspendedRegisters(). Since not all registers * are saved when entering a syscall, expected_regs will be the same * as call_regs but with various registers zeroed out. */ test_shm->expected_regs = call_regs; RegsUnsetNonCalleeSavedRegisters(&test_shm->expected_regs); uintptr_t syscall_addr = (uintptr_t) NACL_SYSCALL(test_syscall_1); if (!setjmp(return_jmp_buf)) { #if defined(__i386__) test_shm->expected_regs.stack_ptr -= 4; /* Account for argument */ call_regs.eax = syscall_addr; call_regs.ecx = (uintptr_t) test_shm; /* Scratch register */ ASM_WITH_REGS( &call_regs, "push %%ecx\n" /* Push syscall argument */ "push $ContinueAfterSyscall\n" /* Push return address */ "nacljmp %%eax\n"); #elif defined(__x86_64__) call_regs.rax = syscall_addr; call_regs.rdi = (uintptr_t) test_shm; /* Set syscall argument */ ASM_WITH_REGS( &call_regs, "push $ContinueAfterSyscall\n" /* Push return address */ "nacljmp %%eax, %%r15\n"); #elif defined(__arm__) call_regs.r0 = (uintptr_t) test_shm; /* Set syscall argument */ call_regs.r1 = syscall_addr; /* Scratch register */ call_regs.lr = (uintptr_t) ContinueAfterSyscall; ASM_WITH_REGS( &call_regs, "bic r1, r1, #0xf000000f\n" "bx r1\n"); #elif defined(__mips__) call_regs.a0 = (uintptr_t) test_shm; /* Set syscall argument */ call_regs.t9 = syscall_addr; /* Scratch register */ call_regs.return_addr = (uintptr_t) ContinueAfterSyscall; ASM_WITH_REGS( &call_regs, "and $t9, $t9, $t6\n" "jr $t9\n" "nop\n"); #else # error Unsupported architecture #endif assert(!"Should not reach here"); } }
/* This tests a NaCl syscall that takes no arguments. */ void TestSyscall(uintptr_t syscall_addr) { struct NaClSignalContext call_regs; char stack[0x10000]; RegsFillTestValues(&call_regs, /* seed= */ 0); call_regs.stack_ptr = (uintptr_t) stack + sizeof(stack); call_regs.prog_ctr = (uintptr_t) ContinueAfterSyscall; RegsApplySandboxConstraints(&call_regs); g_expected_regs = call_regs; RegsUnsetNonCalleeSavedRegisters(&g_expected_regs); SetNaClSwitchExpectations(&g_expected_regs); if (!setjmp(g_return_jmp_buf)) { #if defined(__i386__) call_regs.eax = syscall_addr; ASM_WITH_REGS( &call_regs, "push $ContinueAfterSyscall\n" /* Push return address */ "nacljmp %%eax\n"); #elif defined(__x86_64__) /* * This fast path syscall happens to preserve various registers, * but that is obviously not guaranteed by the ABI. */ if (syscall_addr == (uintptr_t) NACL_SYSCALL(tls_get) || syscall_addr == (uintptr_t) NACL_SYSCALL(second_tls_get)) { /* Undo some effects of RegsUnsetNonCalleeSavedRegisters(). */ g_expected_regs.rsi = call_regs.rsi; g_expected_regs.rdi = call_regs.rdi; g_expected_regs.r8 = call_regs.r8; g_expected_regs.r9 = call_regs.r9; g_expected_regs.r10 = call_regs.r10; /* * The current implementation clobbers %rcx with the * non-%r15-extended return address. */ g_expected_regs.rcx = (uint32_t) g_expected_regs.prog_ctr; } call_regs.rax = syscall_addr; ASM_WITH_REGS( &call_regs, "push $ContinueAfterSyscall\n" /* Push return address */ "nacljmp %%eax, %%r15\n"); #elif defined(__arm__) call_regs.r1 = syscall_addr; /* Scratch register */ call_regs.lr = (uintptr_t) ContinueAfterSyscall; /* Return address */ ASM_WITH_REGS( &call_regs, "bic r1, r1, #0xf000000f\n" "bx r1\n"); #else # error Unsupported architecture #endif assert(!"Should not reach here"); } }
static void RegisterSetterThread(struct SuspendTestShm *test_shm) { struct NaClSignalContext *regs = &test_shm->expected_regs; char stack[0x10000]; RegsFillTestValues(regs); regs->stack_ptr = (uintptr_t) stack + sizeof(stack); regs->prog_ctr = (uintptr_t) spin_instruction; RegsApplySandboxConstraints(regs); thread_test_shm = test_shm; /* * Set registers to known test values and then spin. We do not * block by entering a NaCl syscall because that would disturb the * register state. */ test_shm->continue_after_suspension_func = (uintptr_t) ContinueAfterSuspension; assert(offsetof(struct SuspendTestShm, var) == 0); #if defined(__i386__) regs->eax = (uintptr_t) test_shm; ASM_WITH_REGS( regs, /* Align to ensure no NOPs are inserted in the code that follows. */ ".p2align 5\n" /* Set "test_shm->var = test_shm" to indicate that we are ready. */ "movl %%eax, (%%eax)\n" "spin_instruction:\n" "jmp spin_instruction\n"); #elif defined(__x86_64__) regs->rax = (uintptr_t) test_shm; ASM_WITH_REGS( regs, /* Align to ensure no NOPs are inserted in the code that follows. */ ".p2align 5\n" /* Set "test_shm->var = test_shm" to indicate that we are ready. */ "movl %%eax, %%nacl:(%%r15, %%rax)\n" "spin_instruction:\n" "jmp spin_instruction\n"); #elif defined(__arm__) regs->r0 = (uintptr_t) test_shm; ASM_WITH_REGS( regs, /* Align to ensure no NOPs are inserted in the code that follows. */ ".p2align 4\n" /* Set "test_shm->var = test_shm" to indicate that we are ready. */ "bic r0, r0, #0xc0000000\n" "str r0, [r0]\n" "spin_instruction:\n" "b spin_instruction\n"); #else # error Unsupported architecture #endif assert(!"Should not reach here"); }
int main(int argc, char **argv) { if (argc != 2) { fprintf(stderr, "Expected 1 argument: <memory-address>\n"); return 1; } char *end; struct NaClSignalContext *expected_regs = (struct NaClSignalContext *) strtoul(argv[1], &end, 0); assert(*end == '\0'); struct NaClSignalContext call_regs; char stack[0x10000]; RegsFillTestValues(&call_regs); call_regs.stack_ptr = (uintptr_t) stack + sizeof(stack); call_regs.prog_ctr = (uintptr_t) SyscallReturnAddress; RegsApplySandboxConstraints(&call_regs); RegsUnsetNonCalleeSavedRegisters(&call_regs); uintptr_t syscall_addr = NACL_SYSCALL_ADDR(NACL_sys_test_syscall_1); #if defined(__i386__) call_regs.esi = syscall_addr; *expected_regs = call_regs; ASM_WITH_REGS( &call_regs, "SyscallLoop:\n" "naclcall %%esi\n" "SyscallReturnAddress:\n" "jmp SyscallLoop\n"); #elif defined(__x86_64__) call_regs.r12 = syscall_addr; *expected_regs = call_regs; ASM_WITH_REGS( &call_regs, "SyscallLoop:\n" /* Call via a temporary register so as not to modify %r12. */ "mov %%r12d, %%eax\n" "naclcall %%eax, %%r15\n" "SyscallReturnAddress:\n" "jmp SyscallLoop\n"); #else # error Unsupported architecture #endif }
void test_stack_alignment(void) { char stack[0x1000]; int offset; for (offset = 0; offset < 64; offset++) { RegsFillTestValues(&g_regs); g_regs.stack_ptr = (uintptr_t) stack + sizeof(stack) - offset; RegsApplySandboxConstraints(&g_regs); if (!setjmp(g_jmp_buf)) { #if defined(__i386__) || defined(__x86_64__) ASM_WITH_REGS(&g_regs, "jmp CheckStackAlignmentEntry"); #elif defined(__arm__) ASM_WITH_REGS(&g_regs, "b CheckStackAlignmentEntry"); #else # error Unsupported architecture #endif } } }
/* * Set registers to known values and call a NaCl syscall in an * infinite loop. This is used for testing that the same register * state is reported while the thread is in untrusted code or inside * the syscall. */ static void SyscallRegisterSetterLoopThread(struct SuspendTestShm *test_shm) { struct NaClSignalContext *regs = &test_shm->expected_regs; char stack[0x10000]; RegsFillTestValues(regs, /* seed= */ 0); regs->stack_ptr = (uintptr_t) stack + sizeof(stack); regs->prog_ctr = (uintptr_t) SyscallReturnAddress; RegsApplySandboxConstraints(regs); RegsUnsetNonCalleeSavedRegisters(regs); uintptr_t syscall_addr = NACL_SYSCALL_ADDR(NACL_sys_test_syscall_2); #if defined(__i386__) regs->esi = syscall_addr; #elif defined(__x86_64__) regs->r12 = syscall_addr; #elif defined(__arm__) regs->r4 = syscall_addr; #elif defined(__mips__) regs->s0 = syscall_addr; #else # error Unsupported architecture #endif JUMP_WITH_REGS(regs, SyscallReturnAddress); }
int main(int argc, char **argv) { if (argc != 2) { fprintf(stderr, "Expected 1 argument: <memory-address>\n"); return 1; } char *end; struct RegsTestShm *test_shm = (struct RegsTestShm *) strtoul(argv[1], &end, 0); assert(*end == '\0'); test_shm->regs_should_match = &g_regs_should_match; struct NaClSignalContext call_regs; char stack[0x10000]; int call_count = 0; for (call_count = 0; ; call_count++) { uintptr_t syscall_addr; /* * Test fast-path TLS syscalls. We shoe-horn these in after the * first call to test_syscall_1 has enabled single-stepping. */ if (call_count == 1) { syscall_addr = NACL_SYSCALL_ADDR(NACL_sys_tls_get); } else if (call_count == 2) { syscall_addr = NACL_SYSCALL_ADDR(NACL_sys_second_tls_get); } else { syscall_addr = NACL_SYSCALL_ADDR(NACL_sys_test_syscall_1); } /* * Use different expected register values for each call. * Otherwise, the test could accidentally pass because the * stack_ptr reported during the entry to a syscall can happen to * match the stack_ptr saved by the previous syscall. */ RegsFillTestValues(&call_regs, /* seed= */ call_count); #if defined(__i386__) call_regs.esi = syscall_addr; #elif defined(__x86_64__) call_regs.r12 = syscall_addr; #elif defined(__arm__) call_regs.r4 = syscall_addr; call_regs.r5 = (uintptr_t) &g_regs_should_match; call_regs.r6 = 1; call_regs.r7 = 0; #elif defined(__mips__) call_regs.s0 = syscall_addr; call_regs.s1 = (uintptr_t) &g_regs_should_match; call_regs.s2 = 1; #else # error Unsupported architecture #endif call_regs.prog_ctr = (uintptr_t) (call_count % 2 == 0 ? SyscallReturnAddress1 : SyscallReturnAddress2); call_regs.stack_ptr = (uintptr_t) stack + sizeof(stack) - (call_count % 2) * 0x100; RegsApplySandboxConstraints(&call_regs); RegsUnsetNonCalleeSavedRegisters(&call_regs); test_shm->expected_regs = call_regs; if (!setjmp(g_jmp_buf)) { if (call_count % 2 == 0) { JUMP_WITH_REGS(&call_regs, SyscallCaller1); } else { JUMP_WITH_REGS(&call_regs, SyscallCaller2); } } } }