| .. | .. |
|---|
| 1 | +// SPDX-License-Identifier: GPL-2.0-only |
|---|
| 1 | 2 | /* |
|---|
| 2 | 3 | * syscall_arg_fault.c - tests faults 32-bit fast syscall stack args |
|---|
| 3 | 4 | * Copyright (c) 2015 Andrew Lutomirski |
|---|
| 4 | | - * |
|---|
| 5 | | - * This program is free software; you can redistribute it and/or modify |
|---|
| 6 | | - * it under the terms and conditions of the GNU General Public License, |
|---|
| 7 | | - * version 2, as published by the Free Software Foundation. |
|---|
| 8 | | - * |
|---|
| 9 | | - * This program is distributed in the hope it will be useful, but |
|---|
| 10 | | - * WITHOUT ANY WARRANTY; without even the implied warranty of |
|---|
| 11 | | - * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU |
|---|
| 12 | | - * General Public License for more details. |
|---|
| 13 | 5 | */ |
|---|
| 14 | 6 | |
|---|
| 15 | 7 | #define _GNU_SOURCE |
|---|
| .. | .. |
|---|
| 22 | 14 | #include <err.h> |
|---|
| 23 | 15 | #include <setjmp.h> |
|---|
| 24 | 16 | #include <errno.h> |
|---|
| 17 | + |
|---|
| 18 | +#include "helpers.h" |
|---|
| 25 | 19 | |
|---|
| 26 | 20 | /* Our sigaltstack scratch space. */ |
|---|
| 27 | 21 | static unsigned char altstack_data[SIGSTKSZ]; |
|---|
| .. | .. |
|---|
| 43 | 37 | |
|---|
| 44 | 38 | static volatile sig_atomic_t n_errs; |
|---|
| 45 | 39 | |
|---|
| 46 | | -static void sigsegv(int sig, siginfo_t *info, void *ctx_void) |
|---|
| 40 | +#ifdef __x86_64__ |
|---|
| 41 | +#define REG_AX REG_RAX |
|---|
| 42 | +#define REG_IP REG_RIP |
|---|
| 43 | +#else |
|---|
| 44 | +#define REG_AX REG_EAX |
|---|
| 45 | +#define REG_IP REG_EIP |
|---|
| 46 | +#endif |
|---|
| 47 | + |
|---|
| 48 | +static void sigsegv_or_sigbus(int sig, siginfo_t *info, void *ctx_void) |
|---|
| 47 | 49 | { |
|---|
| 48 | 50 | ucontext_t *ctx = (ucontext_t*)ctx_void; |
|---|
| 51 | + long ax = (long)ctx->uc_mcontext.gregs[REG_AX]; |
|---|
| 49 | 52 | |
|---|
| 50 | | - if (ctx->uc_mcontext.gregs[REG_EAX] != -EFAULT) { |
|---|
| 51 | | - printf("[FAIL]\tAX had the wrong value: 0x%x\n", |
|---|
| 52 | | - ctx->uc_mcontext.gregs[REG_EAX]); |
|---|
| 53 | + if (ax != -EFAULT && ax != -ENOSYS) { |
|---|
| 54 | + printf("[FAIL]\tAX had the wrong value: 0x%lx\n", |
|---|
| 55 | + (unsigned long)ax); |
|---|
| 56 | + printf("\tIP = 0x%lx\n", (unsigned long)ctx->uc_mcontext.gregs[REG_IP]); |
|---|
| 53 | 57 | n_errs++; |
|---|
| 54 | 58 | } else { |
|---|
| 55 | 59 | printf("[OK]\tSeems okay\n"); |
|---|
| .. | .. |
|---|
| 58 | 62 | siglongjmp(jmpbuf, 1); |
|---|
| 59 | 63 | } |
|---|
| 60 | 64 | |
|---|
| 65 | +static volatile sig_atomic_t sigtrap_consecutive_syscalls; |
|---|
| 66 | + |
|---|
| 67 | +static void sigtrap(int sig, siginfo_t *info, void *ctx_void) |
|---|
| 68 | +{ |
|---|
| 69 | + /* |
|---|
| 70 | + * KVM has some bugs that can cause us to stop making progress. |
|---|
| 71 | + * detect them and complain, but don't infinite loop or fail the |
|---|
| 72 | + * test. |
|---|
| 73 | + */ |
|---|
| 74 | + |
|---|
| 75 | + ucontext_t *ctx = (ucontext_t*)ctx_void; |
|---|
| 76 | + unsigned short *ip = (unsigned short *)ctx->uc_mcontext.gregs[REG_IP]; |
|---|
| 77 | + |
|---|
| 78 | + if (*ip == 0x340f || *ip == 0x050f) { |
|---|
| 79 | + /* The trap was on SYSCALL or SYSENTER */ |
|---|
| 80 | + sigtrap_consecutive_syscalls++; |
|---|
| 81 | + if (sigtrap_consecutive_syscalls > 3) { |
|---|
| 82 | + printf("[WARN]\tGot stuck single-stepping -- you probably have a KVM bug\n"); |
|---|
| 83 | + siglongjmp(jmpbuf, 1); |
|---|
| 84 | + } |
|---|
| 85 | + } else { |
|---|
| 86 | + sigtrap_consecutive_syscalls = 0; |
|---|
| 87 | + } |
|---|
| 88 | +} |
|---|
| 89 | + |
|---|
| 61 | 90 | static void sigill(int sig, siginfo_t *info, void *ctx_void) |
|---|
| 62 | 91 | { |
|---|
| 63 | | - printf("[SKIP]\tIllegal instruction\n"); |
|---|
| 92 | + ucontext_t *ctx = (ucontext_t*)ctx_void; |
|---|
| 93 | + unsigned short *ip = (unsigned short *)ctx->uc_mcontext.gregs[REG_IP]; |
|---|
| 94 | + |
|---|
| 95 | + if (*ip == 0x0b0f) { |
|---|
| 96 | + /* one of the ud2 instructions faulted */ |
|---|
| 97 | + printf("[OK]\tSYSCALL returned normally\n"); |
|---|
| 98 | + } else { |
|---|
| 99 | + printf("[SKIP]\tIllegal instruction\n"); |
|---|
| 100 | + } |
|---|
| 64 | 101 | siglongjmp(jmpbuf, 1); |
|---|
| 65 | 102 | } |
|---|
| 66 | 103 | |
|---|
| .. | .. |
|---|
| 73 | 110 | if (sigaltstack(&stack, NULL) != 0) |
|---|
| 74 | 111 | err(1, "sigaltstack"); |
|---|
| 75 | 112 | |
|---|
| 76 | | - sethandler(SIGSEGV, sigsegv, SA_ONSTACK); |
|---|
| 113 | + sethandler(SIGSEGV, sigsegv_or_sigbus, SA_ONSTACK); |
|---|
| 114 | + /* |
|---|
| 115 | + * The actual exception can vary. On Atom CPUs, we get #SS |
|---|
| 116 | + * instead of #PF when the vDSO fails to access the stack when |
|---|
| 117 | + * ESP is too close to 2^32, and #SS causes SIGBUS. |
|---|
| 118 | + */ |
|---|
| 119 | + sethandler(SIGBUS, sigsegv_or_sigbus, SA_ONSTACK); |
|---|
| 77 | 120 | sethandler(SIGILL, sigill, SA_ONSTACK); |
|---|
| 78 | 121 | |
|---|
| 79 | 122 | /* |
|---|
| .. | .. |
|---|
| 122 | 165 | "movl $-1, %%ebp\n\t" |
|---|
| 123 | 166 | "movl $-1, %%esp\n\t" |
|---|
| 124 | 167 | "syscall\n\t" |
|---|
| 125 | | - "pushl $0" /* make sure we segfault cleanly */ |
|---|
| 168 | + "ud2" /* make sure we recover cleanly */ |
|---|
| 126 | 169 | : : : "memory", "flags"); |
|---|
| 127 | 170 | } |
|---|
| 128 | 171 | |
|---|
| 172 | + printf("[RUN]\tSYSENTER with TF and invalid state\n"); |
|---|
| 173 | + sethandler(SIGTRAP, sigtrap, SA_ONSTACK); |
|---|
| 174 | + |
|---|
| 175 | + if (sigsetjmp(jmpbuf, 1) == 0) { |
|---|
| 176 | + sigtrap_consecutive_syscalls = 0; |
|---|
| 177 | + set_eflags(get_eflags() | X86_EFLAGS_TF); |
|---|
| 178 | + asm volatile ( |
|---|
| 179 | + "movl $-1, %%eax\n\t" |
|---|
| 180 | + "movl $-1, %%ebx\n\t" |
|---|
| 181 | + "movl $-1, %%ecx\n\t" |
|---|
| 182 | + "movl $-1, %%edx\n\t" |
|---|
| 183 | + "movl $-1, %%esi\n\t" |
|---|
| 184 | + "movl $-1, %%edi\n\t" |
|---|
| 185 | + "movl $-1, %%ebp\n\t" |
|---|
| 186 | + "movl $-1, %%esp\n\t" |
|---|
| 187 | + "sysenter" |
|---|
| 188 | + : : : "memory", "flags"); |
|---|
| 189 | + } |
|---|
| 190 | + set_eflags(get_eflags() & ~X86_EFLAGS_TF); |
|---|
| 191 | + |
|---|
| 192 | + printf("[RUN]\tSYSCALL with TF and invalid state\n"); |
|---|
| 193 | + if (sigsetjmp(jmpbuf, 1) == 0) { |
|---|
| 194 | + sigtrap_consecutive_syscalls = 0; |
|---|
| 195 | + set_eflags(get_eflags() | X86_EFLAGS_TF); |
|---|
| 196 | + asm volatile ( |
|---|
| 197 | + "movl $-1, %%eax\n\t" |
|---|
| 198 | + "movl $-1, %%ebx\n\t" |
|---|
| 199 | + "movl $-1, %%ecx\n\t" |
|---|
| 200 | + "movl $-1, %%edx\n\t" |
|---|
| 201 | + "movl $-1, %%esi\n\t" |
|---|
| 202 | + "movl $-1, %%edi\n\t" |
|---|
| 203 | + "movl $-1, %%ebp\n\t" |
|---|
| 204 | + "movl $-1, %%esp\n\t" |
|---|
| 205 | + "syscall\n\t" |
|---|
| 206 | + "ud2" /* make sure we recover cleanly */ |
|---|
| 207 | + : : : "memory", "flags"); |
|---|
| 208 | + } |
|---|
| 209 | + set_eflags(get_eflags() & ~X86_EFLAGS_TF); |
|---|
| 210 | + |
|---|
| 211 | +#ifdef __x86_64__ |
|---|
| 212 | + printf("[RUN]\tSYSENTER with TF, invalid state, and GSBASE < 0\n"); |
|---|
| 213 | + |
|---|
| 214 | + if (sigsetjmp(jmpbuf, 1) == 0) { |
|---|
| 215 | + sigtrap_consecutive_syscalls = 0; |
|---|
| 216 | + |
|---|
| 217 | + asm volatile ("wrgsbase %%rax\n\t" |
|---|
| 218 | + :: "a" (0xffffffffffff0000UL)); |
|---|
| 219 | + |
|---|
| 220 | + set_eflags(get_eflags() | X86_EFLAGS_TF); |
|---|
| 221 | + asm volatile ( |
|---|
| 222 | + "movl $-1, %%eax\n\t" |
|---|
| 223 | + "movl $-1, %%ebx\n\t" |
|---|
| 224 | + "movl $-1, %%ecx\n\t" |
|---|
| 225 | + "movl $-1, %%edx\n\t" |
|---|
| 226 | + "movl $-1, %%esi\n\t" |
|---|
| 227 | + "movl $-1, %%edi\n\t" |
|---|
| 228 | + "movl $-1, %%ebp\n\t" |
|---|
| 229 | + "movl $-1, %%esp\n\t" |
|---|
| 230 | + "sysenter" |
|---|
| 231 | + : : : "memory", "flags"); |
|---|
| 232 | + } |
|---|
| 233 | + set_eflags(get_eflags() & ~X86_EFLAGS_TF); |
|---|
| 234 | +#endif |
|---|
| 235 | + |
|---|
| 129 | 236 | return 0; |
|---|
| 130 | 237 | } |
|---|