From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from galois.linutronix.de (Galois.linutronix.de [193.142.43.55]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id BFCF63B585F; Fri, 3 Jul 2026 09:55:50 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=193.142.43.55 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1783072558; cv=none; b=JEESU42SCLZCZBsAWrqqrgj5QHj5G+IPG76qe1Uvn9BgGBlFHoVwptfHLcZSaTdpsUBojyaK9k+Sdvh3v9tSHKRzbR9Jv2VLVaoz/E+1fFxiXCppLpHF4cJ61FbhTFXxyS2egp6S37ThZ8L4pzD+nIN4MBRtzp4KCUj48wjc/ak= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1783072558; c=relaxed/simple; bh=vsBUePtrtxRg0Zcc7XsI2uTb7sl9+dcnAPnJnEhj3wQ=; h=Date:From:To:Subject:Cc:In-Reply-To:References:MIME-Version: Message-ID:Content-Type; b=CyLJKm7Tb7A2jCafSAUx6sDsF3lQ2DY9fCiv4Xp+5a3O4AVyOacUbV/vX0o38yYr9X7Dz6TkwjyMmel2M41N+p5c688WsQshA60K9zqGL20q02Ho9qbTLTjPdJmwVVnhaHP23U37yjQ3Fpg+2rvyKhTEOyweGWtplDDsBKMCgXM= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=linutronix.de; spf=pass smtp.mailfrom=linutronix.de; dkim=pass (2048-bit key) header.d=linutronix.de header.i=@linutronix.de header.b=Eiqce6CE; dkim=permerror (0-bit key) header.d=linutronix.de header.i=@linutronix.de header.b=NOznvLof; arc=none smtp.client-ip=193.142.43.55 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=linutronix.de Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=linutronix.de Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=linutronix.de header.i=@linutronix.de header.b="Eiqce6CE"; dkim=permerror (0-bit key) header.d=linutronix.de header.i=@linutronix.de header.b="NOznvLof" Date: Fri, 03 Jul 2026 09:55:44 -0000 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=linutronix.de; s=2020; t=1783072546; h=from:from:sender:sender:reply-to:reply-to:subject:subject:date:date: message-id:message-id:to:to:cc:cc:mime-version:mime-version: content-type:content-type: content-transfer-encoding:content-transfer-encoding: in-reply-to:in-reply-to:references:references; bh=1YWtXpScxLDvLLdNLEdPGqP1yAs0MhFRt1p7kz/+1gs=; b=Eiqce6CENo/WFhiUYjbFln1R/h7WqsX0ojG3oVKhYUfHwrREviKMV8gqgae80hsTB912uv w/9ZDWBvrmisW+eXvpjox+r6Ara4ag/LuqHy/fw4pgHL7wV8zdgdvKUd8V4lS0TCCZuiCC KRXyfxZyCuLy/MHtDno6u55lyHjXgv51PyCD69IqgrwK8TCEzW3cMkCj8p4tKOIRFWLHTX KSHqLaSvR4Nw9Q5EXJw2AacYXeMhe3Rbeh8Z3YdR7gz6GMhZUh2IZ/8uRPJOWZ21OqQrUf P9EpOBhiPgTadLdDawQCweDhrEP1x9oAFmx2KCj3lYSQRb135r9Hc/MqV7V4jA== DKIM-Signature: v=1; a=ed25519-sha256; c=relaxed/relaxed; d=linutronix.de; s=2020e; t=1783072546; h=from:from:sender:sender:reply-to:reply-to:subject:subject:date:date: message-id:message-id:to:to:cc:cc:mime-version:mime-version: content-type:content-type: content-transfer-encoding:content-transfer-encoding: in-reply-to:in-reply-to:references:references; bh=1YWtXpScxLDvLLdNLEdPGqP1yAs0MhFRt1p7kz/+1gs=; b=NOznvLofnR/L9kWmfFAy6Flodr5e9InDqNT/9bduME/U83d8STDI5ag1KWJj3fNPgfT/Pf oZ4j+aMH0IEdpSAA== From: "tip-bot2 for David Windsor" Sender: tip-bot2@linutronix.de Reply-to: linux-kernel@vger.kernel.org To: linux-tip-commits@vger.kernel.org Subject: [tip: perf/urgent] selftests/x86: Add shadow stack uprobe CALL test Cc: David Windsor , "Peter Zijlstra (Intel)" , x86@kernel.org, linux-kernel@vger.kernel.org In-Reply-To: References: Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Message-ID: <178307254471.3843924.8913710955489569718.tip-bot2@tip-bot2> Robot-ID: Robot-Unsubscribe: Contact to get blacklisted from these emails Precedence: bulk Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: quoted-printable The following commit has been merged into the perf/urgent branch of tip: Commit-ID: 5166973b20784b4627c7a657d546963d8c6e9b5a Gitweb: https://git.kernel.org/tip/5166973b20784b4627c7a657d546963d8c6= e9b5a Author: David Windsor AuthorDate: Mon, 29 Jun 2026 20:13:34 -04:00 Committer: Peter Zijlstra CommitterDate: Thu, 02 Jul 2026 13:21:49 +02:00 selftests/x86: Add shadow stack uprobe CALL test Add coverage for entry uprobes installed on CALL instructions while user shadow stack is enabled. The test puts an entry uprobe on a helper whose first instruction is a relative CALL, then verifies that the call/return sequence completes without SIGSEGV. This catches regressions where x86 uprobe CALL emulation updates the regular user stack but leaves the CET shadow stack stale. Signed-off-by: David Windsor Signed-off-by: Peter Zijlstra (Intel) Link: https://patch.msgid.link/b957039191118c5eba97d01d80c494b859f115a6.17827= 77969.git.dwindsor@gmail.com --- tools/testing/selftests/x86/test_shadow_stack.c | 86 ++++++++++++++++- 1 file changed, 86 insertions(+) diff --git a/tools/testing/selftests/x86/test_shadow_stack.c b/tools/testing/= selftests/x86/test_shadow_stack.c index 21af54d..3d6ca33 100644 --- a/tools/testing/selftests/x86/test_shadow_stack.c +++ b/tools/testing/selftests/x86/test_shadow_stack.c @@ -873,6 +873,86 @@ out: return err; } =20 +/* Keep the CALL first so the function address is exactly the probed CALL. */ +extern void uprobe_call_trigger(void); +asm (".pushsection .text\n" + ".global uprobe_call_target\n" + ".type uprobe_call_target, @function\n" + "uprobe_call_target:\n" + " ret\n" + ".size uprobe_call_target, .-uprobe_call_target\n" + + ".global uprobe_call_trigger\n" + ".type uprobe_call_trigger, @function\n" + "uprobe_call_trigger:\n" + " call uprobe_call_target\n" + " ret\n" + ".size uprobe_call_trigger, .-uprobe_call_trigger\n" + ".popsection\n" +); + +/* If CALL emulation misses the shadow stack update, this exits via SIGSEGV.= */ +static int test_uprobe_call(void) +{ + const size_t attr_sz =3D sizeof(struct perf_event_attr); + const char *file =3D "/proc/self/exe"; + int fd =3D -1, type, err =3D 1; + struct perf_event_attr attr; + struct sigaction sa =3D {}; + ssize_t offset; + + type =3D determine_uprobe_perf_type(); + if (type < 0) { + if (type =3D=3D -ENOENT) + printf("[SKIP]\tUprobe on CALL test, uprobes are not available\n"); + return 0; + } + + offset =3D get_uprobe_offset(uprobe_call_trigger); + if (offset < 0) + return 1; + + sa.sa_sigaction =3D segv_gp_handler; + sa.sa_flags =3D SA_SIGINFO; + if (sigaction(SIGSEGV, &sa, NULL)) + return 1; + + /* Setup entry uprobe through perf event interface. */ + memset(&attr, 0, attr_sz); + attr.size =3D attr_sz; + attr.type =3D type; + attr.config =3D 0; + attr.config1 =3D (__u64)(unsigned long)file; + attr.config2 =3D offset; + + fd =3D syscall(__NR_perf_event_open, &attr, 0 /* pid */, -1 /* cpu */, + -1 /* group_fd */, PERF_FLAG_FD_CLOEXEC); + if (fd < 0) + goto out; + + if (sigsetjmp(jmp_buffer, 1)) + goto out; + + if (ARCH_PRCTL(ARCH_SHSTK_ENABLE, ARCH_SHSTK_SHSTK)) + goto out; + + /* + * This either segfaults and goes through sigsetjmp above + * or succeeds and we're good. + */ + uprobe_call_trigger(); + + printf("[OK]\tUprobe on CALL test\n"); + err =3D 0; + +out: + ARCH_PRCTL(ARCH_SHSTK_DISABLE, ARCH_SHSTK_SHSTK); + signal(SIGSEGV, SIG_DFL); + if (fd >=3D 0) + close(fd); + return err; +} + void segv_handler_ptrace(int signum, siginfo_t *si, void *uc) { /* The SSP adjustment caused a segfault. */ @@ -1071,6 +1151,12 @@ int main(int argc, char *argv[]) goto out; } =20 + if (test_uprobe_call()) { + ret =3D 1; + printf("[FAIL]\tuprobe on CALL test\n"); + goto out; + } + return ret; =20 out: