401 lines · c
1// SPDX-License-Identifier: GPL-2.0-only2/*3 * 32-bit syscall ABI conformance test.4 *5 * Copyright (c) 2015 Denys Vlasenko6 */7/*8 * Can be built statically:9 * gcc -Os -Wall -static -m32 test_syscall_vdso.c thunks_32.S10 */11#undef _GNU_SOURCE12#define _GNU_SOURCE 113#undef __USE_GNU14#define __USE_GNU 115#include <unistd.h>16#include <stdlib.h>17#include <string.h>18#include <stdio.h>19#include <signal.h>20#include <sys/types.h>21#include <sys/select.h>22#include <sys/time.h>23#include <elf.h>24#include <sys/ptrace.h>25#include <sys/wait.h>26 27#if !defined(__i386__)28int main(int argc, char **argv, char **envp)29{30 printf("[SKIP]\tNot a 32-bit x86 userspace\n");31 return 0;32}33#else34 35long syscall_addr;36long get_syscall(char **envp)37{38 Elf32_auxv_t *auxv;39 while (*envp++ != NULL)40 continue;41 for (auxv = (void *)envp; auxv->a_type != AT_NULL; auxv++)42 if (auxv->a_type == AT_SYSINFO)43 return auxv->a_un.a_val;44 printf("[WARN]\tAT_SYSINFO not supplied\n");45 return 0;46}47 48asm (49 " .pushsection .text\n"50 " .global int80\n"51 "int80:\n"52 " int $0x80\n"53 " ret\n"54 " .popsection\n"55);56extern char int80;57 58struct regs64 {59 uint64_t rax, rbx, rcx, rdx;60 uint64_t rsi, rdi, rbp, rsp;61 uint64_t r8, r9, r10, r11;62 uint64_t r12, r13, r14, r15;63};64struct regs64 regs64;65int kernel_is_64bit;66 67asm (68 " .pushsection .text\n"69 " .code64\n"70 "get_regs64:\n"71 " push %rax\n"72 " mov $regs64, %eax\n"73 " pop 0*8(%rax)\n"74 " movq %rbx, 1*8(%rax)\n"75 " movq %rcx, 2*8(%rax)\n"76 " movq %rdx, 3*8(%rax)\n"77 " movq %rsi, 4*8(%rax)\n"78 " movq %rdi, 5*8(%rax)\n"79 " movq %rbp, 6*8(%rax)\n"80 " movq %rsp, 7*8(%rax)\n"81 " movq %r8, 8*8(%rax)\n"82 " movq %r9, 9*8(%rax)\n"83 " movq %r10, 10*8(%rax)\n"84 " movq %r11, 11*8(%rax)\n"85 " movq %r12, 12*8(%rax)\n"86 " movq %r13, 13*8(%rax)\n"87 " movq %r14, 14*8(%rax)\n"88 " movq %r15, 15*8(%rax)\n"89 " ret\n"90 "poison_regs64:\n"91 " movq $0x7f7f7f7f, %r8\n"92 " shl $32, %r8\n"93 " orq $0x7f7f7f7f, %r8\n"94 " movq %r8, %r9\n"95 " incq %r9\n"96 " movq %r9, %r10\n"97 " incq %r10\n"98 " movq %r10, %r11\n"99 " incq %r11\n"100 " movq %r11, %r12\n"101 " incq %r12\n"102 " movq %r12, %r13\n"103 " incq %r13\n"104 " movq %r13, %r14\n"105 " incq %r14\n"106 " movq %r14, %r15\n"107 " incq %r15\n"108 " ret\n"109 " .code32\n"110 " .popsection\n"111);112extern void get_regs64(void);113extern void poison_regs64(void);114extern unsigned long call64_from_32(void (*function)(void));115void print_regs64(void)116{117 if (!kernel_is_64bit)118 return;119 printf("ax:%016llx bx:%016llx cx:%016llx dx:%016llx\n", regs64.rax, regs64.rbx, regs64.rcx, regs64.rdx);120 printf("si:%016llx di:%016llx bp:%016llx sp:%016llx\n", regs64.rsi, regs64.rdi, regs64.rbp, regs64.rsp);121 printf(" 8:%016llx 9:%016llx 10:%016llx 11:%016llx\n", regs64.r8 , regs64.r9 , regs64.r10, regs64.r11);122 printf("12:%016llx 13:%016llx 14:%016llx 15:%016llx\n", regs64.r12, regs64.r13, regs64.r14, regs64.r15);123}124 125int check_regs64(void)126{127 int err = 0;128 int num = 8;129 uint64_t *r64 = ®s64.r8;130 uint64_t expected = 0x7f7f7f7f7f7f7f7fULL;131 132 if (!kernel_is_64bit)133 return 0;134 135 do {136 if (*r64 == expected++)137 continue; /* register did not change */138 if (syscall_addr != (long)&int80) {139 /*140 * Non-INT80 syscall entrypoints are allowed to clobber R8+ regs:141 * either clear them to 0, or for R11, load EFLAGS.142 */143 if (*r64 == 0)144 continue;145 if (num == 11) {146 printf("[NOTE]\tR11 has changed:%016llx - assuming clobbered by SYSRET insn\n", *r64);147 continue;148 }149 } else {150 /*151 * INT80 syscall entrypoint can be used by152 * 64-bit programs too, unlike SYSCALL/SYSENTER.153 * Therefore it must preserve R12+154 * (they are callee-saved registers in 64-bit C ABI).155 *156 * Starting in Linux 4.17 (and any kernel that157 * backports the change), R8..11 are preserved.158 * Historically (and probably unintentionally), they159 * were clobbered or zeroed.160 */161 }162 printf("[FAIL]\tR%d has changed:%016llx\n", num, *r64);163 err++;164 } while (r64++, ++num < 16);165 166 if (!err)167 printf("[OK]\tR8..R15 did not leak kernel data\n");168 return err;169}170 171int nfds;172fd_set rfds;173fd_set wfds;174fd_set efds;175struct timespec timeout;176sigset_t sigmask;177struct {178 sigset_t *sp;179 int sz;180} sigmask_desc;181 182void prep_args()183{184 nfds = 42;185 FD_ZERO(&rfds);186 FD_ZERO(&wfds);187 FD_ZERO(&efds);188 FD_SET(0, &rfds);189 FD_SET(1, &wfds);190 FD_SET(2, &efds);191 timeout.tv_sec = 0;192 timeout.tv_nsec = 123;193 sigemptyset(&sigmask);194 sigaddset(&sigmask, SIGINT);195 sigaddset(&sigmask, SIGUSR2);196 sigaddset(&sigmask, SIGRTMAX);197 sigmask_desc.sp = &sigmask;198 sigmask_desc.sz = 8; /* bytes */199}200 201static void print_flags(const char *name, unsigned long r)202{203 static const char *bitarray[] = {204 "\n" ,"c\n" ,/* Carry Flag */205 "0 " ,"1 " ,/* Bit 1 - always on */206 "" ,"p " ,/* Parity Flag */207 "0 " ,"3? " ,208 "" ,"a " ,/* Auxiliary carry Flag */209 "0 " ,"5? " ,210 "" ,"z " ,/* Zero Flag */211 "" ,"s " ,/* Sign Flag */212 "" ,"t " ,/* Trap Flag */213 "" ,"i " ,/* Interrupt Flag */214 "" ,"d " ,/* Direction Flag */215 "" ,"o " ,/* Overflow Flag */216 "0 " ,"1 " ,/* I/O Privilege Level (2 bits) */217 "0" ,"1" ,/* I/O Privilege Level (2 bits) */218 "" ,"n " ,/* Nested Task */219 "0 " ,"15? ",220 "" ,"r " ,/* Resume Flag */221 "" ,"v " ,/* Virtual Mode */222 "" ,"ac " ,/* Alignment Check/Access Control */223 "" ,"vif ",/* Virtual Interrupt Flag */224 "" ,"vip ",/* Virtual Interrupt Pending */225 "" ,"id " ,/* CPUID detection */226 NULL227 };228 const char **bitstr;229 int bit;230 231 printf("%s=%016lx ", name, r);232 bitstr = bitarray + 42;233 bit = 21;234 if ((r >> 22) != 0)235 printf("(extra bits are set) ");236 do {237 if (bitstr[(r >> bit) & 1][0])238 fputs(bitstr[(r >> bit) & 1], stdout);239 bitstr -= 2;240 bit--;241 } while (bit >= 0);242}243 244int run_syscall(void)245{246 long flags, bad_arg;247 248 prep_args();249 250 if (kernel_is_64bit)251 call64_from_32(poison_regs64);252 /*print_regs64();*/253 254 asm("\n"255 /* Try 6-arg syscall: pselect. It should return quickly */256 " push %%ebp\n"257 " mov $308, %%eax\n" /* PSELECT */258 " mov nfds, %%ebx\n" /* ebx arg1 */259 " mov $rfds, %%ecx\n" /* ecx arg2 */260 " mov $wfds, %%edx\n" /* edx arg3 */261 " mov $efds, %%esi\n" /* esi arg4 */262 " mov $timeout, %%edi\n" /* edi arg5 */263 " mov $sigmask_desc, %%ebp\n" /* %ebp arg6 */264 " push $0x200ed7\n" /* set almost all flags */265 " popf\n" /* except TF, IOPL, NT, RF, VM, AC, VIF, VIP */266 " call *syscall_addr\n"267 /* Check that registers are not clobbered */268 " pushf\n"269 " pop %%eax\n"270 " cld\n"271 " cmp nfds, %%ebx\n" /* ebx arg1 */272 " mov $1, %%ebx\n"273 " jne 1f\n"274 " cmp $rfds, %%ecx\n" /* ecx arg2 */275 " mov $2, %%ebx\n"276 " jne 1f\n"277 " cmp $wfds, %%edx\n" /* edx arg3 */278 " mov $3, %%ebx\n"279 " jne 1f\n"280 " cmp $efds, %%esi\n" /* esi arg4 */281 " mov $4, %%ebx\n"282 " jne 1f\n"283 " cmp $timeout, %%edi\n" /* edi arg5 */284 " mov $5, %%ebx\n"285 " jne 1f\n"286 " cmpl $sigmask_desc, %%ebp\n" /* %ebp arg6 */287 " mov $6, %%ebx\n"288 " jne 1f\n"289 " mov $0, %%ebx\n"290 "1:\n"291 " pop %%ebp\n"292 : "=a" (flags), "=b" (bad_arg)293 :294 : "cx", "dx", "si", "di"295 );296 297 if (kernel_is_64bit) {298 memset(®s64, 0x77, sizeof(regs64));299 call64_from_32(get_regs64);300 /*print_regs64();*/301 }302 303 /*304 * On paravirt kernels, flags are not preserved across syscalls.305 * Thus, we do not consider it a bug if some are changed.306 * We just show ones which do.307 */308 if ((0x200ed7 ^ flags) != 0) {309 print_flags("[WARN]\tFlags before", 0x200ed7);310 print_flags("[WARN]\tFlags after", flags);311 print_flags("[WARN]\tFlags change", (0x200ed7 ^ flags));312 }313 314 if (bad_arg) {315 printf("[FAIL]\targ#%ld clobbered\n", bad_arg);316 return 1;317 }318 printf("[OK]\tArguments are preserved across syscall\n");319 320 return check_regs64();321}322 323int run_syscall_twice()324{325 int exitcode = 0;326 long sv;327 328 if (syscall_addr) {329 printf("[RUN]\tExecuting 6-argument 32-bit syscall via VDSO\n");330 exitcode = run_syscall();331 }332 sv = syscall_addr;333 syscall_addr = (long)&int80;334 printf("[RUN]\tExecuting 6-argument 32-bit syscall via INT 80\n");335 exitcode += run_syscall();336 syscall_addr = sv;337 return exitcode;338}339 340void ptrace_me()341{342 pid_t pid;343 344 fflush(NULL);345 pid = fork();346 if (pid < 0)347 exit(1);348 if (pid == 0) {349 /* child */350 if (ptrace(PTRACE_TRACEME, 0L, 0L, 0L) != 0)351 exit(0);352 raise(SIGSTOP);353 return;354 }355 /* parent */356 printf("[RUN]\tRunning tests under ptrace\n");357 while (1) {358 int status;359 pid = waitpid(-1, &status, __WALL);360 if (WIFEXITED(status))361 exit(WEXITSTATUS(status));362 if (WIFSIGNALED(status))363 exit(WTERMSIG(status));364 if (pid <= 0 || !WIFSTOPPED(status)) /* paranoia */365 exit(255);366 /*367 * Note: we do not inject sig = WSTOPSIG(status).368 * We probably should, but careful: do not inject SIGTRAP369 * generated by syscall entry/exit stops.370 * That kills the child.371 */372 ptrace(PTRACE_SYSCALL, pid, 0L, 0L /*sig*/);373 }374}375 376int main(int argc, char **argv, char **envp)377{378 int exitcode = 0;379 int cs;380 381 asm("\n"382 " movl %%cs, %%eax\n"383 : "=a" (cs)384 );385 kernel_is_64bit = (cs == 0x23);386 if (!kernel_is_64bit)387 printf("[NOTE]\tNot a 64-bit kernel, won't test R8..R15 leaks\n");388 389 /* This only works for non-static builds:390 * syscall_addr = dlsym(dlopen("linux-gate.so.1", RTLD_NOW), "__kernel_vsyscall");391 */392 syscall_addr = get_syscall(envp);393 394 exitcode += run_syscall_twice();395 ptrace_me();396 exitcode += run_syscall_twice();397 398 return exitcode;399}400#endif401