projects/linux·blob master · refs

220 lines · 5.7 KiB

1// SPDX-License-Identifier: GPL-2.0-only
2/*
3 * single_step_syscall.c - single-steps various x86 syscalls
4 * Copyright (c) 2014-2015 Andrew Lutomirski
5 *
6 * This is a very simple series of tests that makes system calls with
7 * the TF flag set. This exercises some nasty kernel code in the
8 * SYSENTER case: SYSENTER does not clear TF, so SYSENTER with TF set
9 * immediately issues #DB from CPL 0. This requires special handling in
10 * the kernel.
11 */
12
13#define _GNU_SOURCE
14
15#include <sys/time.h>
16#include <time.h>
17#include <stdlib.h>
18#include <sys/syscall.h>
19#include <unistd.h>
20#include <stdio.h>
21#include <string.h>
22#include <inttypes.h>
23#include <sys/mman.h>
24#include <sys/signal.h>
25#include <sys/ucontext.h>
26#include <asm/ldt.h>
27#include <err.h>
28#include <setjmp.h>
29#include <stddef.h>
30#include <stdbool.h>
31#include <sys/ptrace.h>
32#include <sys/user.h>
33
34#include "helpers.h"
35
36static volatile sig_atomic_t sig_traps, sig_eflags;
37sigjmp_buf jmpbuf;
38
39#ifdef __x86_64__
40# define REG_IP REG_RIP
41# define WIDTH "q"
42# define INT80_CLOBBERS "r8", "r9", "r10", "r11"
43#else
44# define REG_IP REG_EIP
45# define WIDTH "l"
46# define INT80_CLOBBERS
47#endif
48
49static void sigtrap(int sig, siginfo_t *info, void *ctx_void)
50{
51 ucontext_t *ctx = (ucontext_t*)ctx_void;
52
53 if (get_eflags() & X86_EFLAGS_TF) {
54 set_eflags(get_eflags() & ~X86_EFLAGS_TF);
55 printf("[WARN]\tSIGTRAP handler had TF set\n");
56 _exit(1);
57 }
58
59 sig_traps++;
60
61 if (sig_traps == 10000 || sig_traps == 10001) {
62 printf("[WARN]\tHit %d SIGTRAPs with si_addr 0x%lx, ip 0x%lx\n",
63 (int)sig_traps,
64 (unsigned long)info->si_addr,
65 (unsigned long)ctx->uc_mcontext.gregs[REG_IP]);
66 }
67}
68
69static char const * const signames[] = {
70 [SIGSEGV] = "SIGSEGV",
71 [SIGBUS] = "SIBGUS",
72 [SIGTRAP] = "SIGTRAP",
73 [SIGILL] = "SIGILL",
74};
75
76static void print_and_longjmp(int sig, siginfo_t *si, void *ctx_void)
77{
78 ucontext_t *ctx = ctx_void;
79
80 printf("\tGot %s with RIP=%lx, TF=%ld\n", signames[sig],
81 (unsigned long)ctx->uc_mcontext.gregs[REG_IP],
82 (unsigned long)ctx->uc_mcontext.gregs[REG_EFL] & X86_EFLAGS_TF);
83
84 sig_eflags = (unsigned long)ctx->uc_mcontext.gregs[REG_EFL];
85 siglongjmp(jmpbuf, 1);
86}
87
88static void check_result(void)
89{
90 unsigned long new_eflags = get_eflags();
91 set_eflags(new_eflags & ~X86_EFLAGS_TF);
92
93 if (!sig_traps) {
94 printf("[FAIL]\tNo SIGTRAP\n");
95 exit(1);
96 }
97
98 if (!(new_eflags & X86_EFLAGS_TF)) {
99 printf("[FAIL]\tTF was cleared\n");
100 exit(1);
101 }
102
103 printf("[OK]\tSurvived with TF set and %d traps\n", (int)sig_traps);
104 sig_traps = 0;
105}
106
107static void fast_syscall_no_tf(void)
108{
109 sig_traps = 0;
110 printf("[RUN]\tFast syscall with TF cleared\n");
111 fflush(stdout); /* Force a syscall */
112 if (get_eflags() & X86_EFLAGS_TF) {
113 printf("[FAIL]\tTF is now set\n");
114 exit(1);
115 }
116 if (sig_traps) {
117 printf("[FAIL]\tGot SIGTRAP\n");
118 exit(1);
119 }
120 printf("[OK]\tNothing unexpected happened\n");
121}
122
123int main()
124{
125#ifdef CAN_BUILD_32
126 int tmp;
127#endif
128
129 sethandler(SIGTRAP, sigtrap, 0);
130
131 printf("[RUN]\tSet TF and check nop\n");
132 set_eflags(get_eflags() | X86_EFLAGS_TF);
133 asm volatile ("nop");
134 check_result();
135
136#ifdef __x86_64__
137 printf("[RUN]\tSet TF and check syscall-less opportunistic sysret\n");
138 set_eflags(get_eflags() | X86_EFLAGS_TF);
139 extern unsigned char post_nop[];
140 asm volatile ("pushf" WIDTH "\n\t"
141 "pop" WIDTH " %%r11\n\t"
142 "nop\n\t"
143 "post_nop:"
144 : : "c" (post_nop) : "r11");
145 check_result();
146#endif
147#ifdef CAN_BUILD_32
148 printf("[RUN]\tSet TF and check int80\n");
149 set_eflags(get_eflags() | X86_EFLAGS_TF);
150 asm volatile ("int $0x80" : "=a" (tmp) : "a" (SYS_getpid)
151 : INT80_CLOBBERS);
152 check_result();
153#endif
154
155 /*
156 * This test is particularly interesting if fast syscalls use
157 * SYSENTER: it triggers a nasty design flaw in SYSENTER.
158 * Specifically, SYSENTER does not clear TF, so either SYSENTER
159 * or the next instruction traps at CPL0. (Of course, Intel
160 * mostly forgot to document exactly what happens here.) So we
161 * get a CPL0 fault with usergs (on 64-bit kernels) and possibly
162 * no stack. The only sane way the kernel can possibly handle
163 * it is to clear TF on return from the #DB handler, but this
164 * happens way too early to set TF in the saved pt_regs, so the
165 * kernel has to do something clever to avoid losing track of
166 * the TF bit.
167 *
168 * Needless to say, we've had bugs in this area.
169 */
170 syscall(SYS_getpid); /* Force symbol binding without TF set. */
171 printf("[RUN]\tSet TF and check a fast syscall\n");
172 set_eflags(get_eflags() | X86_EFLAGS_TF);
173 syscall(SYS_getpid);
174 check_result();
175
176 /* Now make sure that another fast syscall doesn't set TF again. */
177 fast_syscall_no_tf();
178
179 /*
180 * And do a forced SYSENTER to make sure that this works even if
181 * fast syscalls don't use SYSENTER.
182 *
183 * Invoking SYSENTER directly breaks all the rules. Just handle
184 * the SIGSEGV.
185 */
186 if (sigsetjmp(jmpbuf, 1) == 0) {
187 unsigned long nr = SYS_getpid;
188 printf("[RUN]\tSet TF and check SYSENTER\n");
189 stack_t stack = {
190 .ss_sp = malloc(sizeof(char) * SIGSTKSZ),
191 .ss_size = SIGSTKSZ,
192 };
193 if (sigaltstack(&stack, NULL) != 0)
194 err(1, "sigaltstack");
195 sethandler(SIGSEGV, print_and_longjmp,
196 SA_RESETHAND | SA_ONSTACK);
197 sethandler(SIGILL, print_and_longjmp, SA_RESETHAND);
198 set_eflags(get_eflags() | X86_EFLAGS_TF);
199 free(stack.ss_sp);
200 /* Clear EBP first to make sure we segfault cleanly. */
201 asm volatile ("xorl %%ebp, %%ebp; SYSENTER" : "+a" (nr) :: "flags", "rcx"
202#ifdef __x86_64__
203 , "r11"
204#endif
205 );
206
207 /* We're unreachable here. SYSENTER forgets RIP. */
208 }
209 clearhandler(SIGSEGV);
210 clearhandler(SIGILL);
211 if (!(sig_eflags & X86_EFLAGS_TF)) {
212 printf("[FAIL]\tTF was cleared\n");
213 exit(1);
214 }
215
216 /* Now make sure that another fast syscall doesn't set TF again. */
217 fast_syscall_no_tf();
218
219 return 0;
220}