selftests/x86/single_step_syscall.c

0001 // SPDX-License-Identifier: GPL-2.0-only
0002 /*
0003  * single_step_syscall.c - single-steps various x86 syscalls
0004  * Copyright (c) 2014-2015 Andrew Lutomirski
0005  *
0006  * This is a very simple series of tests that makes system calls with
0007  * the TF flag set.  This exercises some nasty kernel code in the
0008  * SYSENTER case: SYSENTER does not clear TF, so SYSENTER with TF set
0009  * immediately issues #DB from CPL 0.  This requires special handling in
0010  * the kernel.
0011  */
0012
0013 #define _GNU_SOURCE
0014
0015 #include <sys/time.h>
0016 #include <time.h>
0017 #include <stdlib.h>
0018 #include <sys/syscall.h>
0019 #include <unistd.h>
0020 #include <stdio.h>
0021 #include <string.h>
0022 #include <inttypes.h>
0023 #include <sys/mman.h>
0024 #include <sys/signal.h>
0025 #include <sys/ucontext.h>
0026 #include <asm/ldt.h>
0027 #include <err.h>
0028 #include <setjmp.h>
0029 #include <stddef.h>
0030 #include <stdbool.h>
0031 #include <sys/ptrace.h>
0032 #include <sys/user.h>
0033
0034 #include "helpers.h"
0035
0036 static void sethandler(int sig, void (*handler)(int, siginfo_t *, void *),
0037                int flags)
0038 {
0039     struct sigaction sa;
0040     memset(&sa, 0, sizeof(sa));
0041     sa.sa_sigaction = handler;
0042     sa.sa_flags = SA_SIGINFO | flags;
0043     sigemptyset(&sa.sa_mask);
0044     if (sigaction(sig, &sa, 0))
0045         err(1, "sigaction");
0046 }
0047
0048 static void clearhandler(int sig)
0049 {
0050     struct sigaction sa;
0051     memset(&sa, 0, sizeof(sa));
0052     sa.sa_handler = SIG_DFL;
0053     sigemptyset(&sa.sa_mask);
0054     if (sigaction(sig, &sa, 0))
0055         err(1, "sigaction");
0056 }
0057
0058 static volatile sig_atomic_t sig_traps, sig_eflags;
0059 sigjmp_buf jmpbuf;
0060
0061 #ifdef __x86_64__
0062 # define REG_IP REG_RIP
0063 # define WIDTH "q"
0064 # define INT80_CLOBBERS "r8", "r9", "r10", "r11"
0065 #else
0066 # define REG_IP REG_EIP
0067 # define WIDTH "l"
0068 # define INT80_CLOBBERS
0069 #endif
0070
0071 static void sigtrap(int sig, siginfo_t *info, void *ctx_void)
0072 {
0073     ucontext_t *ctx = (ucontext_t*)ctx_void;
0074
0075     if (get_eflags() & X86_EFLAGS_TF) {
0076         set_eflags(get_eflags() & ~X86_EFLAGS_TF);
0077         printf("[WARN]\tSIGTRAP handler had TF set\n");
0078         _exit(1);
0079     }
0080
0081     sig_traps++;
0082
0083     if (sig_traps == 10000 || sig_traps == 10001) {
0084         printf("[WARN]\tHit %d SIGTRAPs with si_addr 0x%lx, ip 0x%lx\n",
0085                (int)sig_traps,
0086                (unsigned long)info->si_addr,
0087                (unsigned long)ctx->uc_mcontext.gregs[REG_IP]);
0088     }
0089 }
0090
0091 static char const * const signames[] = {
0092     [SIGSEGV] = "SIGSEGV",
0093     [SIGBUS] = "SIBGUS",
0094     [SIGTRAP] = "SIGTRAP",
0095     [SIGILL] = "SIGILL",
0096 };
0097
0098 static void print_and_longjmp(int sig, siginfo_t *si, void *ctx_void)
0099 {
0100     ucontext_t *ctx = ctx_void;
0101
0102     printf("\tGot %s with RIP=%lx, TF=%ld\n", signames[sig],
0103            (unsigned long)ctx->uc_mcontext.gregs[REG_IP],
0104            (unsigned long)ctx->uc_mcontext.gregs[REG_EFL] & X86_EFLAGS_TF);
0105
0106     sig_eflags = (unsigned long)ctx->uc_mcontext.gregs[REG_EFL];
0107     siglongjmp(jmpbuf, 1);
0108 }
0109
0110 static void check_result(void)
0111 {
0112     unsigned long new_eflags = get_eflags();
0113     set_eflags(new_eflags & ~X86_EFLAGS_TF);
0114
0115     if (!sig_traps) {
0116         printf("[FAIL]\tNo SIGTRAP\n");
0117         exit(1);
0118     }
0119
0120     if (!(new_eflags & X86_EFLAGS_TF)) {
0121         printf("[FAIL]\tTF was cleared\n");
0122         exit(1);
0123     }
0124
0125     printf("[OK]\tSurvived with TF set and %d traps\n", (int)sig_traps);
0126     sig_traps = 0;
0127 }
0128
0129 static void fast_syscall_no_tf(void)
0130 {
0131     sig_traps = 0;
0132     printf("[RUN]\tFast syscall with TF cleared\n");
0133     fflush(stdout);  /* Force a syscall */
0134     if (get_eflags() & X86_EFLAGS_TF) {
0135         printf("[FAIL]\tTF is now set\n");
0136         exit(1);
0137     }
0138     if (sig_traps) {
0139         printf("[FAIL]\tGot SIGTRAP\n");
0140         exit(1);
0141     }
0142     printf("[OK]\tNothing unexpected happened\n");
0143 }
0144
0145 int main()
0146 {
0147 #ifdef CAN_BUILD_32
0148     int tmp;
0149 #endif
0150
0151     sethandler(SIGTRAP, sigtrap, 0);
0152
0153     printf("[RUN]\tSet TF and check nop\n");
0154     set_eflags(get_eflags() | X86_EFLAGS_TF);
0155     asm volatile ("nop");
0156     check_result();
0157
0158 #ifdef __x86_64__
0159     printf("[RUN]\tSet TF and check syscall-less opportunistic sysret\n");
0160     set_eflags(get_eflags() | X86_EFLAGS_TF);
0161     extern unsigned char post_nop[];
0162     asm volatile ("pushf" WIDTH "\n\t"
0163               "pop" WIDTH " %%r11\n\t"
0164               "nop\n\t"
0165               "post_nop:"
0166               : : "c" (post_nop) : "r11");
0167     check_result();
0168 #endif
0169 #ifdef CAN_BUILD_32
0170     printf("[RUN]\tSet TF and check int80\n");
0171     set_eflags(get_eflags() | X86_EFLAGS_TF);
0172     asm volatile ("int $0x80" : "=a" (tmp) : "a" (SYS_getpid)
0173             : INT80_CLOBBERS);
0174     check_result();
0175 #endif
0176
0177     /*
0178      * This test is particularly interesting if fast syscalls use
0179      * SYSENTER: it triggers a nasty design flaw in SYSENTER.
0180      * Specifically, SYSENTER does not clear TF, so either SYSENTER
0181      * or the next instruction traps at CPL0.  (Of course, Intel
0182      * mostly forgot to document exactly what happens here.)  So we
0183      * get a CPL0 fault with usergs (on 64-bit kernels) and possibly
0184      * no stack.  The only sane way the kernel can possibly handle
0185      * it is to clear TF on return from the #DB handler, but this
0186      * happens way too early to set TF in the saved pt_regs, so the
0187      * kernel has to do something clever to avoid losing track of
0188      * the TF bit.
0189      *
0190      * Needless to say, we've had bugs in this area.
0191      */
0192     syscall(SYS_getpid);  /* Force symbol binding without TF set. */
0193     printf("[RUN]\tSet TF and check a fast syscall\n");
0194     set_eflags(get_eflags() | X86_EFLAGS_TF);
0195     syscall(SYS_getpid);
0196     check_result();
0197
0198     /* Now make sure that another fast syscall doesn't set TF again. */
0199     fast_syscall_no_tf();
0200
0201     /*
0202      * And do a forced SYSENTER to make sure that this works even if
0203      * fast syscalls don't use SYSENTER.
0204      *
0205      * Invoking SYSENTER directly breaks all the rules.  Just handle
0206      * the SIGSEGV.
0207      */
0208     if (sigsetjmp(jmpbuf, 1) == 0) {
0209         unsigned long nr = SYS_getpid;
0210         printf("[RUN]\tSet TF and check SYSENTER\n");
0211         stack_t stack = {
0212             .ss_sp = malloc(sizeof(char) * SIGSTKSZ),
0213             .ss_size = SIGSTKSZ,
0214         };
0215         if (sigaltstack(&stack, NULL) != 0)
0216             err(1, "sigaltstack");
0217         sethandler(SIGSEGV, print_and_longjmp,
0218                SA_RESETHAND | SA_ONSTACK);
0219         sethandler(SIGILL, print_and_longjmp, SA_RESETHAND);
0220         set_eflags(get_eflags() | X86_EFLAGS_TF);
0221         free(stack.ss_sp);
0222         /* Clear EBP first to make sure we segfault cleanly. */
0223         asm volatile ("xorl %%ebp, %%ebp; SYSENTER" : "+a" (nr) :: "flags", "rcx"
0224 #ifdef __x86_64__
0225                 , "r11"
0226 #endif
0227             );
0228
0229         /* We're unreachable here.  SYSENTER forgets RIP. */
0230     }
0231     clearhandler(SIGSEGV);
0232     clearhandler(SIGILL);
0233     if (!(sig_eflags & X86_EFLAGS_TF)) {
0234         printf("[FAIL]\tTF was cleared\n");
0235         exit(1);
0236     }
0237
0238     /* Now make sure that another fast syscall doesn't set TF again. */
0239     fast_syscall_no_tf();
0240
0241     return 0;
0242 }