• Home
  • Line#
  • Scopes#
  • Navigate#
  • Raw
  • Download
1 // SPDX-License-Identifier: GPL-2.0-only
2 /*
3  * single_step_syscall.c - single-steps various x86 syscalls
4  * Copyright (c) 2014-2015 Andrew Lutomirski
5  *
6  * This is a very simple series of tests that makes system calls with
7  * the TF flag set.  This exercises some nasty kernel code in the
8  * SYSENTER case: SYSENTER does not clear TF, so SYSENTER with TF set
9  * immediately issues #DB from CPL 0.  This requires special handling in
10  * the kernel.
11  */
12 
13 #define _GNU_SOURCE
14 
15 #include <sys/time.h>
16 #include <time.h>
17 #include <stdlib.h>
18 #include <sys/syscall.h>
19 #include <unistd.h>
20 #include <stdio.h>
21 #include <string.h>
22 #include <inttypes.h>
23 #include <sys/mman.h>
24 #include <sys/signal.h>
25 #include <sys/ucontext.h>
26 #include <asm/ldt.h>
27 #include <err.h>
28 #include <setjmp.h>
29 #include <stddef.h>
30 #include <stdbool.h>
31 #include <sys/ptrace.h>
32 #include <sys/user.h>
33 
34 #include "helpers.h"
35 
sethandler(int sig,void (* handler)(int,siginfo_t *,void *),int flags)36 static void sethandler(int sig, void (*handler)(int, siginfo_t *, void *),
37 		       int flags)
38 {
39 	struct sigaction sa;
40 	memset(&sa, 0, sizeof(sa));
41 	sa.sa_sigaction = handler;
42 	sa.sa_flags = SA_SIGINFO | flags;
43 	sigemptyset(&sa.sa_mask);
44 	if (sigaction(sig, &sa, 0))
45 		err(1, "sigaction");
46 }
47 
clearhandler(int sig)48 static void clearhandler(int sig)
49 {
50 	struct sigaction sa;
51 	memset(&sa, 0, sizeof(sa));
52 	sa.sa_handler = SIG_DFL;
53 	sigemptyset(&sa.sa_mask);
54 	if (sigaction(sig, &sa, 0))
55 		err(1, "sigaction");
56 }
57 
58 static volatile sig_atomic_t sig_traps, sig_eflags;
59 sigjmp_buf jmpbuf;
60 static unsigned char altstack_data[SIGSTKSZ];
61 
62 #ifdef __x86_64__
63 # define REG_IP REG_RIP
64 # define WIDTH "q"
65 # define INT80_CLOBBERS "r8", "r9", "r10", "r11"
66 #else
67 # define REG_IP REG_EIP
68 # define WIDTH "l"
69 # define INT80_CLOBBERS
70 #endif
71 
sigtrap(int sig,siginfo_t * info,void * ctx_void)72 static void sigtrap(int sig, siginfo_t *info, void *ctx_void)
73 {
74 	ucontext_t *ctx = (ucontext_t*)ctx_void;
75 
76 	if (get_eflags() & X86_EFLAGS_TF) {
77 		set_eflags(get_eflags() & ~X86_EFLAGS_TF);
78 		printf("[WARN]\tSIGTRAP handler had TF set\n");
79 		_exit(1);
80 	}
81 
82 	sig_traps++;
83 
84 	if (sig_traps == 10000 || sig_traps == 10001) {
85 		printf("[WARN]\tHit %d SIGTRAPs with si_addr 0x%lx, ip 0x%lx\n",
86 		       (int)sig_traps,
87 		       (unsigned long)info->si_addr,
88 		       (unsigned long)ctx->uc_mcontext.gregs[REG_IP]);
89 	}
90 }
91 
92 static char const * const signames[] = {
93 	[SIGSEGV] = "SIGSEGV",
94 	[SIGBUS] = "SIBGUS",
95 	[SIGTRAP] = "SIGTRAP",
96 	[SIGILL] = "SIGILL",
97 };
98 
print_and_longjmp(int sig,siginfo_t * si,void * ctx_void)99 static void print_and_longjmp(int sig, siginfo_t *si, void *ctx_void)
100 {
101 	ucontext_t *ctx = ctx_void;
102 
103 	printf("\tGot %s with RIP=%lx, TF=%ld\n", signames[sig],
104 	       (unsigned long)ctx->uc_mcontext.gregs[REG_IP],
105 	       (unsigned long)ctx->uc_mcontext.gregs[REG_EFL] & X86_EFLAGS_TF);
106 
107 	sig_eflags = (unsigned long)ctx->uc_mcontext.gregs[REG_EFL];
108 	siglongjmp(jmpbuf, 1);
109 }
110 
check_result(void)111 static void check_result(void)
112 {
113 	unsigned long new_eflags = get_eflags();
114 	set_eflags(new_eflags & ~X86_EFLAGS_TF);
115 
116 	if (!sig_traps) {
117 		printf("[FAIL]\tNo SIGTRAP\n");
118 		exit(1);
119 	}
120 
121 	if (!(new_eflags & X86_EFLAGS_TF)) {
122 		printf("[FAIL]\tTF was cleared\n");
123 		exit(1);
124 	}
125 
126 	printf("[OK]\tSurvived with TF set and %d traps\n", (int)sig_traps);
127 	sig_traps = 0;
128 }
129 
fast_syscall_no_tf(void)130 static void fast_syscall_no_tf(void)
131 {
132 	sig_traps = 0;
133 	printf("[RUN]\tFast syscall with TF cleared\n");
134 	fflush(stdout);  /* Force a syscall */
135 	if (get_eflags() & X86_EFLAGS_TF) {
136 		printf("[FAIL]\tTF is now set\n");
137 		exit(1);
138 	}
139 	if (sig_traps) {
140 		printf("[FAIL]\tGot SIGTRAP\n");
141 		exit(1);
142 	}
143 	printf("[OK]\tNothing unexpected happened\n");
144 }
145 
main()146 int main()
147 {
148 #ifdef CAN_BUILD_32
149 	int tmp;
150 #endif
151 
152 	sethandler(SIGTRAP, sigtrap, 0);
153 
154 	printf("[RUN]\tSet TF and check nop\n");
155 	set_eflags(get_eflags() | X86_EFLAGS_TF);
156 	asm volatile ("nop");
157 	check_result();
158 
159 #ifdef __x86_64__
160 	printf("[RUN]\tSet TF and check syscall-less opportunistic sysret\n");
161 	set_eflags(get_eflags() | X86_EFLAGS_TF);
162 	extern unsigned char post_nop[];
163 	asm volatile ("pushf" WIDTH "\n\t"
164 		      "pop" WIDTH " %%r11\n\t"
165 		      "nop\n\t"
166 		      "post_nop:"
167 		      : : "c" (post_nop) : "r11");
168 	check_result();
169 #endif
170 #ifdef CAN_BUILD_32
171 	printf("[RUN]\tSet TF and check int80\n");
172 	set_eflags(get_eflags() | X86_EFLAGS_TF);
173 	asm volatile ("int $0x80" : "=a" (tmp) : "a" (SYS_getpid)
174 			: INT80_CLOBBERS);
175 	check_result();
176 #endif
177 
178 	/*
179 	 * This test is particularly interesting if fast syscalls use
180 	 * SYSENTER: it triggers a nasty design flaw in SYSENTER.
181 	 * Specifically, SYSENTER does not clear TF, so either SYSENTER
182 	 * or the next instruction traps at CPL0.  (Of course, Intel
183 	 * mostly forgot to document exactly what happens here.)  So we
184 	 * get a CPL0 fault with usergs (on 64-bit kernels) and possibly
185 	 * no stack.  The only sane way the kernel can possibly handle
186 	 * it is to clear TF on return from the #DB handler, but this
187 	 * happens way too early to set TF in the saved pt_regs, so the
188 	 * kernel has to do something clever to avoid losing track of
189 	 * the TF bit.
190 	 *
191 	 * Needless to say, we've had bugs in this area.
192 	 */
193 	syscall(SYS_getpid);  /* Force symbol binding without TF set. */
194 	printf("[RUN]\tSet TF and check a fast syscall\n");
195 	set_eflags(get_eflags() | X86_EFLAGS_TF);
196 	syscall(SYS_getpid);
197 	check_result();
198 
199 	/* Now make sure that another fast syscall doesn't set TF again. */
200 	fast_syscall_no_tf();
201 
202 	/*
203 	 * And do a forced SYSENTER to make sure that this works even if
204 	 * fast syscalls don't use SYSENTER.
205 	 *
206 	 * Invoking SYSENTER directly breaks all the rules.  Just handle
207 	 * the SIGSEGV.
208 	 */
209 	if (sigsetjmp(jmpbuf, 1) == 0) {
210 		unsigned long nr = SYS_getpid;
211 		printf("[RUN]\tSet TF and check SYSENTER\n");
212 		stack_t stack = {
213 			.ss_sp = altstack_data,
214 			.ss_size = SIGSTKSZ,
215 		};
216 		if (sigaltstack(&stack, NULL) != 0)
217 			err(1, "sigaltstack");
218 		sethandler(SIGSEGV, print_and_longjmp,
219 			   SA_RESETHAND | SA_ONSTACK);
220 		sethandler(SIGILL, print_and_longjmp, SA_RESETHAND);
221 		set_eflags(get_eflags() | X86_EFLAGS_TF);
222 		/* Clear EBP first to make sure we segfault cleanly. */
223 		asm volatile ("xorl %%ebp, %%ebp; SYSENTER" : "+a" (nr) :: "flags", "rcx"
224 #ifdef __x86_64__
225 				, "r11"
226 #endif
227 			);
228 
229 		/* We're unreachable here.  SYSENTER forgets RIP. */
230 	}
231 	clearhandler(SIGSEGV);
232 	clearhandler(SIGILL);
233 	if (!(sig_eflags & X86_EFLAGS_TF)) {
234 		printf("[FAIL]\tTF was cleared\n");
235 		exit(1);
236 	}
237 
238 	/* Now make sure that another fast syscall doesn't set TF again. */
239 	fast_syscall_no_tf();
240 
241 	return 0;
242 }
243