243 lines · c
1// SPDX-License-Identifier: GPL-2.0-only2/*3 * single_step_syscall.c - single-steps various x86 syscalls4 * Copyright (c) 2014-2015 Andrew Lutomirski5 *6 * This is a very simple series of tests that makes system calls with7 * the TF flag set. This exercises some nasty kernel code in the8 * SYSENTER case: SYSENTER does not clear TF, so SYSENTER with TF set9 * immediately issues #DB from CPL 0. This requires special handling in10 * the kernel.11 */12 13#define _GNU_SOURCE14 15#include <sys/time.h>16#include <time.h>17#include <stdlib.h>18#include <sys/syscall.h>19#include <unistd.h>20#include <stdio.h>21#include <string.h>22#include <inttypes.h>23#include <sys/mman.h>24#include <sys/signal.h>25#include <sys/ucontext.h>26#include <asm/ldt.h>27#include <err.h>28#include <setjmp.h>29#include <stddef.h>30#include <stdbool.h>31#include <sys/ptrace.h>32#include <sys/user.h>33 34#include "helpers.h"35 36static void sethandler(int sig, void (*handler)(int, siginfo_t *, void *),37 int flags)38{39 struct sigaction sa;40 memset(&sa, 0, sizeof(sa));41 sa.sa_sigaction = handler;42 sa.sa_flags = SA_SIGINFO | flags;43 sigemptyset(&sa.sa_mask);44 if (sigaction(sig, &sa, 0))45 err(1, "sigaction");46}47 48static void clearhandler(int sig)49{50 struct sigaction sa;51 memset(&sa, 0, sizeof(sa));52 sa.sa_handler = SIG_DFL;53 sigemptyset(&sa.sa_mask);54 if (sigaction(sig, &sa, 0))55 err(1, "sigaction");56}57 58static volatile sig_atomic_t sig_traps, sig_eflags;59sigjmp_buf jmpbuf;60 61#ifdef __x86_64__62# define REG_IP REG_RIP63# define WIDTH "q"64# define INT80_CLOBBERS "r8", "r9", "r10", "r11"65#else66# define REG_IP REG_EIP67# define WIDTH "l"68# define INT80_CLOBBERS69#endif70 71static void sigtrap(int sig, siginfo_t *info, void *ctx_void)72{73 ucontext_t *ctx = (ucontext_t*)ctx_void;74 75 if (get_eflags() & X86_EFLAGS_TF) {76 set_eflags(get_eflags() & ~X86_EFLAGS_TF);77 printf("[WARN]\tSIGTRAP handler had TF set\n");78 _exit(1);79 }80 81 sig_traps++;82 83 if (sig_traps == 10000 || sig_traps == 10001) {84 printf("[WARN]\tHit %d SIGTRAPs with si_addr 0x%lx, ip 0x%lx\n",85 (int)sig_traps,86 (unsigned long)info->si_addr,87 (unsigned long)ctx->uc_mcontext.gregs[REG_IP]);88 }89}90 91static char const * const signames[] = {92 [SIGSEGV] = "SIGSEGV",93 [SIGBUS] = "SIBGUS",94 [SIGTRAP] = "SIGTRAP",95 [SIGILL] = "SIGILL",96};97 98static void print_and_longjmp(int sig, siginfo_t *si, void *ctx_void)99{100 ucontext_t *ctx = ctx_void;101 102 printf("\tGot %s with RIP=%lx, TF=%ld\n", signames[sig],103 (unsigned long)ctx->uc_mcontext.gregs[REG_IP],104 (unsigned long)ctx->uc_mcontext.gregs[REG_EFL] & X86_EFLAGS_TF);105 106 sig_eflags = (unsigned long)ctx->uc_mcontext.gregs[REG_EFL];107 siglongjmp(jmpbuf, 1);108}109 110static void check_result(void)111{112 unsigned long new_eflags = get_eflags();113 set_eflags(new_eflags & ~X86_EFLAGS_TF);114 115 if (!sig_traps) {116 printf("[FAIL]\tNo SIGTRAP\n");117 exit(1);118 }119 120 if (!(new_eflags & X86_EFLAGS_TF)) {121 printf("[FAIL]\tTF was cleared\n");122 exit(1);123 }124 125 printf("[OK]\tSurvived with TF set and %d traps\n", (int)sig_traps);126 sig_traps = 0;127}128 129static void fast_syscall_no_tf(void)130{131 sig_traps = 0;132 printf("[RUN]\tFast syscall with TF cleared\n");133 fflush(stdout); /* Force a syscall */134 if (get_eflags() & X86_EFLAGS_TF) {135 printf("[FAIL]\tTF is now set\n");136 exit(1);137 }138 if (sig_traps) {139 printf("[FAIL]\tGot SIGTRAP\n");140 exit(1);141 }142 printf("[OK]\tNothing unexpected happened\n");143}144 145int main()146{147#ifdef CAN_BUILD_32148 int tmp;149#endif150 151 sethandler(SIGTRAP, sigtrap, 0);152 153 printf("[RUN]\tSet TF and check nop\n");154 set_eflags(get_eflags() | X86_EFLAGS_TF);155 asm volatile ("nop");156 check_result();157 158#ifdef __x86_64__159 printf("[RUN]\tSet TF and check syscall-less opportunistic sysret\n");160 set_eflags(get_eflags() | X86_EFLAGS_TF);161 extern unsigned char post_nop[];162 asm volatile ("pushf" WIDTH "\n\t"163 "pop" WIDTH " %%r11\n\t"164 "nop\n\t"165 "post_nop:"166 : : "c" (post_nop) : "r11");167 check_result();168#endif169#ifdef CAN_BUILD_32170 printf("[RUN]\tSet TF and check int80\n");171 set_eflags(get_eflags() | X86_EFLAGS_TF);172 asm volatile ("int $0x80" : "=a" (tmp) : "a" (SYS_getpid)173 : INT80_CLOBBERS);174 check_result();175#endif176 177 /*178 * This test is particularly interesting if fast syscalls use179 * SYSENTER: it triggers a nasty design flaw in SYSENTER.180 * Specifically, SYSENTER does not clear TF, so either SYSENTER181 * or the next instruction traps at CPL0. (Of course, Intel182 * mostly forgot to document exactly what happens here.) So we183 * get a CPL0 fault with usergs (on 64-bit kernels) and possibly184 * no stack. The only sane way the kernel can possibly handle185 * it is to clear TF on return from the #DB handler, but this186 * happens way too early to set TF in the saved pt_regs, so the187 * kernel has to do something clever to avoid losing track of188 * the TF bit.189 *190 * Needless to say, we've had bugs in this area.191 */192 syscall(SYS_getpid); /* Force symbol binding without TF set. */193 printf("[RUN]\tSet TF and check a fast syscall\n");194 set_eflags(get_eflags() | X86_EFLAGS_TF);195 syscall(SYS_getpid);196 check_result();197 198 /* Now make sure that another fast syscall doesn't set TF again. */199 fast_syscall_no_tf();200 201 /*202 * And do a forced SYSENTER to make sure that this works even if203 * fast syscalls don't use SYSENTER.204 *205 * Invoking SYSENTER directly breaks all the rules. Just handle206 * the SIGSEGV.207 */208 if (sigsetjmp(jmpbuf, 1) == 0) {209 unsigned long nr = SYS_getpid;210 printf("[RUN]\tSet TF and check SYSENTER\n");211 stack_t stack = {212 .ss_sp = malloc(sizeof(char) * SIGSTKSZ),213 .ss_size = SIGSTKSZ,214 };215 if (sigaltstack(&stack, NULL) != 0)216 err(1, "sigaltstack");217 sethandler(SIGSEGV, print_and_longjmp,218 SA_RESETHAND | SA_ONSTACK);219 sethandler(SIGILL, print_and_longjmp, SA_RESETHAND);220 set_eflags(get_eflags() | X86_EFLAGS_TF);221 free(stack.ss_sp);222 /* Clear EBP first to make sure we segfault cleanly. */223 asm volatile ("xorl %%ebp, %%ebp; SYSENTER" : "+a" (nr) :: "flags", "rcx"224#ifdef __x86_64__225 , "r11"226#endif227 );228 229 /* We're unreachable here. SYSENTER forgets RIP. */230 }231 clearhandler(SIGSEGV);232 clearhandler(SIGILL);233 if (!(sig_eflags & X86_EFLAGS_TF)) {234 printf("[FAIL]\tTF was cleared\n");235 exit(1);236 }237 238 /* Now make sure that another fast syscall doesn't set TF again. */239 fast_syscall_no_tf();240 241 return 0;242}243