| .. | .. |
|---|
| 1 | +// SPDX-License-Identifier: GPL-2.0-only |
|---|
| 1 | 2 | /* |
|---|
| 2 | 3 | * syscall_nt.c - checks syscalls with NT set |
|---|
| 3 | 4 | * Copyright (c) 2014-2015 Andrew Lutomirski |
|---|
| 4 | | - * |
|---|
| 5 | | - * This program is free software; you can redistribute it and/or modify |
|---|
| 6 | | - * it under the terms and conditions of the GNU General Public License, |
|---|
| 7 | | - * version 2, as published by the Free Software Foundation. |
|---|
| 8 | | - * |
|---|
| 9 | | - * This program is distributed in the hope it will be useful, but |
|---|
| 10 | | - * WITHOUT ANY WARRANTY; without even the implied warranty of |
|---|
| 11 | | - * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU |
|---|
| 12 | | - * General Public License for more details. |
|---|
| 13 | 5 | * |
|---|
| 14 | 6 | * Some obscure user-space code requires the ability to make system calls |
|---|
| 15 | 7 | * with FLAGS.NT set. Make sure it works. |
|---|
| .. | .. |
|---|
| 21 | 13 | #include <signal.h> |
|---|
| 22 | 14 | #include <err.h> |
|---|
| 23 | 15 | #include <sys/syscall.h> |
|---|
| 24 | | -#include <asm/processor-flags.h> |
|---|
| 25 | 16 | |
|---|
| 26 | | -#ifdef __x86_64__ |
|---|
| 27 | | -# define WIDTH "q" |
|---|
| 28 | | -#else |
|---|
| 29 | | -# define WIDTH "l" |
|---|
| 30 | | -#endif |
|---|
| 17 | +#include "helpers.h" |
|---|
| 31 | 18 | |
|---|
| 32 | 19 | static unsigned int nerrs; |
|---|
| 33 | | - |
|---|
| 34 | | -static unsigned long get_eflags(void) |
|---|
| 35 | | -{ |
|---|
| 36 | | - unsigned long eflags; |
|---|
| 37 | | - asm volatile ("pushf" WIDTH "\n\tpop" WIDTH " %0" : "=rm" (eflags)); |
|---|
| 38 | | - return eflags; |
|---|
| 39 | | -} |
|---|
| 40 | | - |
|---|
| 41 | | -static void set_eflags(unsigned long eflags) |
|---|
| 42 | | -{ |
|---|
| 43 | | - asm volatile ("push" WIDTH " %0\n\tpopf" WIDTH |
|---|
| 44 | | - : : "rm" (eflags) : "flags"); |
|---|
| 45 | | -} |
|---|
| 46 | 20 | |
|---|
| 47 | 21 | static void sethandler(int sig, void (*handler)(int, siginfo_t *, void *), |
|---|
| 48 | 22 | int flags) |
|---|
| .. | .. |
|---|
| 82 | 56 | printf("[RUN]\tSet NT and issue a syscall\n"); |
|---|
| 83 | 57 | do_it(X86_EFLAGS_NT); |
|---|
| 84 | 58 | |
|---|
| 59 | + printf("[RUN]\tSet AC and issue a syscall\n"); |
|---|
| 60 | + do_it(X86_EFLAGS_AC); |
|---|
| 61 | + |
|---|
| 62 | + printf("[RUN]\tSet NT|AC and issue a syscall\n"); |
|---|
| 63 | + do_it(X86_EFLAGS_NT | X86_EFLAGS_AC); |
|---|
| 64 | + |
|---|
| 85 | 65 | /* |
|---|
| 86 | 66 | * Now try it again with TF set -- TF forces returns via IRET in all |
|---|
| 87 | 67 | * cases except non-ptregs-using 64-bit full fast path syscalls. |
|---|
| .. | .. |
|---|
| 89 | 69 | |
|---|
| 90 | 70 | sethandler(SIGTRAP, sigtrap, 0); |
|---|
| 91 | 71 | |
|---|
| 72 | + printf("[RUN]\tSet TF and issue a syscall\n"); |
|---|
| 73 | + do_it(X86_EFLAGS_TF); |
|---|
| 74 | + |
|---|
| 92 | 75 | printf("[RUN]\tSet NT|TF and issue a syscall\n"); |
|---|
| 93 | 76 | do_it(X86_EFLAGS_NT | X86_EFLAGS_TF); |
|---|
| 94 | 77 | |
|---|
| 78 | + printf("[RUN]\tSet AC|TF and issue a syscall\n"); |
|---|
| 79 | + do_it(X86_EFLAGS_AC | X86_EFLAGS_TF); |
|---|
| 80 | + |
|---|
| 81 | + printf("[RUN]\tSet NT|AC|TF and issue a syscall\n"); |
|---|
| 82 | + do_it(X86_EFLAGS_NT | X86_EFLAGS_AC | X86_EFLAGS_TF); |
|---|
| 83 | + |
|---|
| 84 | + /* |
|---|
| 85 | + * Now try DF. This is evil and it's plausible that we will crash |
|---|
| 86 | + * glibc, but glibc would have to do something rather surprising |
|---|
| 87 | + * for this to happen. |
|---|
| 88 | + */ |
|---|
| 89 | + printf("[RUN]\tSet DF and issue a syscall\n"); |
|---|
| 90 | + do_it(X86_EFLAGS_DF); |
|---|
| 91 | + |
|---|
| 92 | + printf("[RUN]\tSet TF|DF and issue a syscall\n"); |
|---|
| 93 | + do_it(X86_EFLAGS_TF | X86_EFLAGS_DF); |
|---|
| 94 | + |
|---|
| 95 | 95 | return nerrs == 0 ? 0 : 1; |
|---|
| 96 | 96 | } |
|---|