2 * test_nx.c: functional test for NX functionality
4 * (C) Copyright 2008 Intel Corporation
5 * Author: Arjan van de Ven <arjan@linux.intel.com>
7 * This program is free software; you can redistribute it and/or
8 * modify it under the terms of the GNU General Public License
9 * as published by the Free Software Foundation; version 2
12 #include <linux/module.h>
13 #include <linux/sort.h>
14 #include <asm/uaccess.h>
16 extern int rodata_test_data;
19 * This file checks 4 things:
20 * 1) Check if the stack is not executable
21 * 2) Check if kmalloc memory is not executable
22 * 3) Check if the .rodata section is not executable
23 * 4) Check if the .data section of a module is not executable
25 * To do this, the test code tries to execute memory in stack/kmalloc/etc,
26 * and then checks if the expected trap happens.
28 * Sadly, this implies having a dynamic exception handling table entry.
29 * ... which can be done (and will make Rusty cry)... but it can only
30 * be done in a stand-alone module with only 1 entry total.
31 * (otherwise we'd have to sort and that's just too messy)
37 * We want to set up an exception handling point on our stack,
38 * which means a variable value. This function is rather dirty
39 * and walks the exception table of the module, looking for a magic
40 * marker and replaces it with a specific function.
42 static void fudze_exception_table(void *marker, void *new)
44 struct module *mod = THIS_MODULE;
45 struct exception_table_entry *extable;
48 * Note: This module has only 1 exception table entry,
49 * so searching and sorting is not needed. If that changes,
50 * this would be the place to search and re-sort the exception
53 if (mod->num_exentries > 1) {
54 printk(KERN_ERR "test_nx: too many exception table entries!\n");
55 printk(KERN_ERR "test_nx: test results are not reliable.\n");
58 extable = (struct exception_table_entry *)mod->extable;
59 extable[0].insn = (unsigned long)new;
64 * exception tables get their symbols translated so we need
65 * to use a fake function to put in there, which we can then
71 * returns 0 for not-executable, negative for executable
73 * Note: we cannot allow this function to be inlined, because
74 * that would give us more than 1 exception table entry.
75 * This in turn would break the assumptions above.
77 static noinline int test_address(void *address)
81 /* Set up an exception table entry for our address */
82 fudze_exception_table(&foo_label, address);
86 "0: call *%[fake_code]\n"
88 ".section .fixup,\"ax\"\n"
89 "2: mov %[zero], %[rslt]\n"
92 ".section __ex_table,\"a\"\n"
102 : [rslt] "=r" (result)
103 : [fake_code] "r" (address), [zero] "r" (0UL), "0" (result)
105 /* change the exception table back for the next round */
106 fudze_exception_table(address, &foo_label);
113 static unsigned char test_data = 0xC3; /* 0xC3 is the opcode for "ret" */
115 static int test_NX(void)
118 /* 0xC3 is the opcode for "ret" */
119 char stackcode[] = {0xC3, 0x90, 0 };
124 printk(KERN_INFO "Testing NX protection\n");
126 /* Test 1: check if the stack is not executable */
127 if (test_address(&stackcode)) {
128 printk(KERN_ERR "test_nx: stack was executable\n");
133 /* Test 2: Check if the heap is executable */
134 heap = kmalloc(64, GFP_KERNEL);
137 heap[0] = 0xC3; /* opcode for "ret" */
139 if (test_address(heap)) {
140 printk(KERN_ERR "test_nx: heap was executable\n");
146 * The following 2 tests currently fail, this needs to get fixed
147 * Until then, don't run them to avoid too many people getting scared
148 * by the error message
152 #ifdef CONFIG_DEBUG_RODATA
153 /* Test 3: Check if the .rodata section is executable */
154 if (rodata_test_data != 0xC3) {
155 printk(KERN_ERR "test_nx: .rodata marker has invalid value\n");
157 } else if (test_address(&rodata_test_data)) {
158 printk(KERN_ERR "test_nx: .rodata section is executable\n");
163 /* Test 4: Check if the .data section of a module is executable */
164 if (test_address(&test_data)) {
165 printk(KERN_ERR "test_nx: .data section is executable\n");
173 static void test_exit(void)
177 module_init(test_NX);
178 module_exit(test_exit);
179 MODULE_LICENSE("GPL");
180 MODULE_DESCRIPTION("Testcase for the NX infrastructure");
181 MODULE_AUTHOR("Arjan van de Ven <arjan@linux.intel.com>");