| .. | .. |
|---|
| 1 | +// SPDX-License-Identifier: GPL-2.0-only |
|---|
| 1 | 2 | /* |
|---|
| 2 | 3 | * single_step_syscall.c - single-steps various x86 syscalls |
|---|
| 3 | 4 | * Copyright (c) 2014-2015 Andrew Lutomirski |
|---|
| 4 | | - * |
|---|
| 5 | | - * This program is free software; you can redistribute it and/or modify |
|---|
| 6 | | - * it under the terms and conditions of the GNU General Public License, |
|---|
| 7 | | - * version 2, as published by the Free Software Foundation. |
|---|
| 8 | | - * |
|---|
| 9 | | - * This program is distributed in the hope it will be useful, but |
|---|
| 10 | | - * WITHOUT ANY WARRANTY; without even the implied warranty of |
|---|
| 11 | | - * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU |
|---|
| 12 | | - * General Public License for more details. |
|---|
| 13 | 5 | * |
|---|
| 14 | 6 | * This is a very simple series of tests that makes system calls with |
|---|
| 15 | 7 | * the TF flag set. This exercises some nasty kernel code in the |
|---|
| .. | .. |
|---|
| 39 | 31 | #include <sys/ptrace.h> |
|---|
| 40 | 32 | #include <sys/user.h> |
|---|
| 41 | 33 | |
|---|
| 34 | +#include "helpers.h" |
|---|
| 35 | + |
|---|
| 42 | 36 | static void sethandler(int sig, void (*handler)(int, siginfo_t *, void *), |
|---|
| 43 | 37 | int flags) |
|---|
| 44 | 38 | { |
|---|
| .. | .. |
|---|
| 51 | 45 | err(1, "sigaction"); |
|---|
| 52 | 46 | } |
|---|
| 53 | 47 | |
|---|
| 54 | | -static volatile sig_atomic_t sig_traps; |
|---|
| 48 | +static void clearhandler(int sig) |
|---|
| 49 | +{ |
|---|
| 50 | + struct sigaction sa; |
|---|
| 51 | + memset(&sa, 0, sizeof(sa)); |
|---|
| 52 | + sa.sa_handler = SIG_DFL; |
|---|
| 53 | + sigemptyset(&sa.sa_mask); |
|---|
| 54 | + if (sigaction(sig, &sa, 0)) |
|---|
| 55 | + err(1, "sigaction"); |
|---|
| 56 | +} |
|---|
| 57 | + |
|---|
| 58 | +static volatile sig_atomic_t sig_traps, sig_eflags; |
|---|
| 59 | +sigjmp_buf jmpbuf; |
|---|
| 60 | +static unsigned char altstack_data[SIGSTKSZ]; |
|---|
| 55 | 61 | |
|---|
| 56 | 62 | #ifdef __x86_64__ |
|---|
| 57 | 63 | # define REG_IP REG_RIP |
|---|
| .. | .. |
|---|
| 62 | 68 | # define WIDTH "l" |
|---|
| 63 | 69 | # define INT80_CLOBBERS |
|---|
| 64 | 70 | #endif |
|---|
| 65 | | - |
|---|
| 66 | | -static unsigned long get_eflags(void) |
|---|
| 67 | | -{ |
|---|
| 68 | | - unsigned long eflags; |
|---|
| 69 | | - asm volatile ("pushf" WIDTH "\n\tpop" WIDTH " %0" : "=rm" (eflags)); |
|---|
| 70 | | - return eflags; |
|---|
| 71 | | -} |
|---|
| 72 | | - |
|---|
| 73 | | -static void set_eflags(unsigned long eflags) |
|---|
| 74 | | -{ |
|---|
| 75 | | - asm volatile ("push" WIDTH " %0\n\tpopf" WIDTH |
|---|
| 76 | | - : : "rm" (eflags) : "flags"); |
|---|
| 77 | | -} |
|---|
| 78 | | - |
|---|
| 79 | | -#define X86_EFLAGS_TF (1UL << 8) |
|---|
| 80 | 71 | |
|---|
| 81 | 72 | static void sigtrap(int sig, siginfo_t *info, void *ctx_void) |
|---|
| 82 | 73 | { |
|---|
| .. | .. |
|---|
| 98 | 89 | } |
|---|
| 99 | 90 | } |
|---|
| 100 | 91 | |
|---|
| 92 | +static char const * const signames[] = { |
|---|
| 93 | + [SIGSEGV] = "SIGSEGV", |
|---|
| 94 | + [SIGBUS] = "SIBGUS", |
|---|
| 95 | + [SIGTRAP] = "SIGTRAP", |
|---|
| 96 | + [SIGILL] = "SIGILL", |
|---|
| 97 | +}; |
|---|
| 98 | + |
|---|
| 99 | +static void print_and_longjmp(int sig, siginfo_t *si, void *ctx_void) |
|---|
| 100 | +{ |
|---|
| 101 | + ucontext_t *ctx = ctx_void; |
|---|
| 102 | + |
|---|
| 103 | + printf("\tGot %s with RIP=%lx, TF=%ld\n", signames[sig], |
|---|
| 104 | + (unsigned long)ctx->uc_mcontext.gregs[REG_IP], |
|---|
| 105 | + (unsigned long)ctx->uc_mcontext.gregs[REG_EFL] & X86_EFLAGS_TF); |
|---|
| 106 | + |
|---|
| 107 | + sig_eflags = (unsigned long)ctx->uc_mcontext.gregs[REG_EFL]; |
|---|
| 108 | + siglongjmp(jmpbuf, 1); |
|---|
| 109 | +} |
|---|
| 110 | + |
|---|
| 101 | 111 | static void check_result(void) |
|---|
| 102 | 112 | { |
|---|
| 103 | 113 | unsigned long new_eflags = get_eflags(); |
|---|
| .. | .. |
|---|
| 115 | 125 | |
|---|
| 116 | 126 | printf("[OK]\tSurvived with TF set and %d traps\n", (int)sig_traps); |
|---|
| 117 | 127 | sig_traps = 0; |
|---|
| 128 | +} |
|---|
| 129 | + |
|---|
| 130 | +static void fast_syscall_no_tf(void) |
|---|
| 131 | +{ |
|---|
| 132 | + sig_traps = 0; |
|---|
| 133 | + printf("[RUN]\tFast syscall with TF cleared\n"); |
|---|
| 134 | + fflush(stdout); /* Force a syscall */ |
|---|
| 135 | + if (get_eflags() & X86_EFLAGS_TF) { |
|---|
| 136 | + printf("[FAIL]\tTF is now set\n"); |
|---|
| 137 | + exit(1); |
|---|
| 138 | + } |
|---|
| 139 | + if (sig_traps) { |
|---|
| 140 | + printf("[FAIL]\tGot SIGTRAP\n"); |
|---|
| 141 | + exit(1); |
|---|
| 142 | + } |
|---|
| 143 | + printf("[OK]\tNothing unexpected happened\n"); |
|---|
| 118 | 144 | } |
|---|
| 119 | 145 | |
|---|
| 120 | 146 | int main() |
|---|
| .. | .. |
|---|
| 171 | 197 | check_result(); |
|---|
| 172 | 198 | |
|---|
| 173 | 199 | /* Now make sure that another fast syscall doesn't set TF again. */ |
|---|
| 174 | | - printf("[RUN]\tFast syscall with TF cleared\n"); |
|---|
| 175 | | - fflush(stdout); /* Force a syscall */ |
|---|
| 176 | | - if (get_eflags() & X86_EFLAGS_TF) { |
|---|
| 177 | | - printf("[FAIL]\tTF is now set\n"); |
|---|
| 200 | + fast_syscall_no_tf(); |
|---|
| 201 | + |
|---|
| 202 | + /* |
|---|
| 203 | + * And do a forced SYSENTER to make sure that this works even if |
|---|
| 204 | + * fast syscalls don't use SYSENTER. |
|---|
| 205 | + * |
|---|
| 206 | + * Invoking SYSENTER directly breaks all the rules. Just handle |
|---|
| 207 | + * the SIGSEGV. |
|---|
| 208 | + */ |
|---|
| 209 | + if (sigsetjmp(jmpbuf, 1) == 0) { |
|---|
| 210 | + unsigned long nr = SYS_getpid; |
|---|
| 211 | + printf("[RUN]\tSet TF and check SYSENTER\n"); |
|---|
| 212 | + stack_t stack = { |
|---|
| 213 | + .ss_sp = altstack_data, |
|---|
| 214 | + .ss_size = SIGSTKSZ, |
|---|
| 215 | + }; |
|---|
| 216 | + if (sigaltstack(&stack, NULL) != 0) |
|---|
| 217 | + err(1, "sigaltstack"); |
|---|
| 218 | + sethandler(SIGSEGV, print_and_longjmp, |
|---|
| 219 | + SA_RESETHAND | SA_ONSTACK); |
|---|
| 220 | + sethandler(SIGILL, print_and_longjmp, SA_RESETHAND); |
|---|
| 221 | + set_eflags(get_eflags() | X86_EFLAGS_TF); |
|---|
| 222 | + /* Clear EBP first to make sure we segfault cleanly. */ |
|---|
| 223 | + asm volatile ("xorl %%ebp, %%ebp; SYSENTER" : "+a" (nr) :: "flags", "rcx" |
|---|
| 224 | +#ifdef __x86_64__ |
|---|
| 225 | + , "r11" |
|---|
| 226 | +#endif |
|---|
| 227 | + ); |
|---|
| 228 | + |
|---|
| 229 | + /* We're unreachable here. SYSENTER forgets RIP. */ |
|---|
| 230 | + } |
|---|
| 231 | + clearhandler(SIGSEGV); |
|---|
| 232 | + clearhandler(SIGILL); |
|---|
| 233 | + if (!(sig_eflags & X86_EFLAGS_TF)) { |
|---|
| 234 | + printf("[FAIL]\tTF was cleared\n"); |
|---|
| 178 | 235 | exit(1); |
|---|
| 179 | 236 | } |
|---|
| 180 | | - if (sig_traps) { |
|---|
| 181 | | - printf("[FAIL]\tGot SIGTRAP\n"); |
|---|
| 182 | | - exit(1); |
|---|
| 183 | | - } |
|---|
| 184 | | - printf("[OK]\tNothing unexpected happened\n"); |
|---|
| 237 | + |
|---|
| 238 | + /* Now make sure that another fast syscall doesn't set TF again. */ |
|---|
| 239 | + fast_syscall_no_tf(); |
|---|
| 185 | 240 | |
|---|
| 186 | 241 | return 0; |
|---|
| 187 | 242 | } |
|---|