1 /*
2  * single_step_syscall.c - single-steps various x86 syscalls
3  * Copyright (c) 2014-2015 Andrew Lutomirski
4  *
5  * This program is free software; you can redistribute it and/or modify
6  * it under the terms and conditions of the GNU General Public License,
7  * version 2, as published by the Free Software Foundation.
8  *
9  * This program is distributed in the hope it will be useful, but
10  * WITHOUT ANY WARRANTY; without even the implied warranty of
11  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
12  * General Public License for more details.
13  *
14  * This is a very simple series of tests that makes system calls with
15  * the TF flag set.  This exercises some nasty kernel code in the
16  * SYSENTER case: SYSENTER does not clear TF, so SYSENTER with TF set
17  * immediately issues #DB from CPL 0.  This requires special handling in
18  * the kernel.
19  */
20 
21 #define _GNU_SOURCE
22 
23 #include <sys/time.h>
24 #include <time.h>
25 #include <stdlib.h>
26 #include <sys/syscall.h>
27 #include <unistd.h>
28 #include <stdio.h>
29 #include <string.h>
30 #include <inttypes.h>
31 #include <sys/mman.h>
32 #include <sys/signal.h>
33 #include <sys/ucontext.h>
34 #include <asm/ldt.h>
35 #include <err.h>
36 #include <setjmp.h>
37 #include <stddef.h>
38 #include <stdbool.h>
39 #include <sys/ptrace.h>
40 #include <sys/user.h>
41 
42 static void sethandler(int sig, void (*handler)(int, siginfo_t *, void *),
43 		       int flags)
44 {
45 	struct sigaction sa;
46 	memset(&sa, 0, sizeof(sa));
47 	sa.sa_sigaction = handler;
48 	sa.sa_flags = SA_SIGINFO | flags;
49 	sigemptyset(&sa.sa_mask);
50 	if (sigaction(sig, &sa, 0))
51 		err(1, "sigaction");
52 }
53 
54 static volatile sig_atomic_t sig_traps;
55 
56 #ifdef __x86_64__
57 # define REG_IP REG_RIP
58 # define WIDTH "q"
59 # define INT80_CLOBBERS "r8", "r9", "r10", "r11"
60 #else
61 # define REG_IP REG_EIP
62 # define WIDTH "l"
63 # define INT80_CLOBBERS
64 #endif
65 
66 static unsigned long get_eflags(void)
67 {
68 	unsigned long eflags;
69 	asm volatile ("pushf" WIDTH "\n\tpop" WIDTH " %0" : "=rm" (eflags));
70 	return eflags;
71 }
72 
73 static void set_eflags(unsigned long eflags)
74 {
75 	asm volatile ("push" WIDTH " %0\n\tpopf" WIDTH
76 		      : : "rm" (eflags) : "flags");
77 }
78 
79 #define X86_EFLAGS_TF (1UL << 8)
80 
81 static void sigtrap(int sig, siginfo_t *info, void *ctx_void)
82 {
83 	ucontext_t *ctx = (ucontext_t*)ctx_void;
84 
85 	if (get_eflags() & X86_EFLAGS_TF) {
86 		set_eflags(get_eflags() & ~X86_EFLAGS_TF);
87 		printf("[WARN]\tSIGTRAP handler had TF set\n");
88 		_exit(1);
89 	}
90 
91 	sig_traps++;
92 
93 	if (sig_traps == 10000 || sig_traps == 10001) {
94 		printf("[WARN]\tHit %d SIGTRAPs with si_addr 0x%lx, ip 0x%lx\n",
95 		       (int)sig_traps,
96 		       (unsigned long)info->si_addr,
97 		       (unsigned long)ctx->uc_mcontext.gregs[REG_IP]);
98 	}
99 }
100 
101 static void check_result(void)
102 {
103 	unsigned long new_eflags = get_eflags();
104 	set_eflags(new_eflags & ~X86_EFLAGS_TF);
105 
106 	if (!sig_traps) {
107 		printf("[FAIL]\tNo SIGTRAP\n");
108 		exit(1);
109 	}
110 
111 	if (!(new_eflags & X86_EFLAGS_TF)) {
112 		printf("[FAIL]\tTF was cleared\n");
113 		exit(1);
114 	}
115 
116 	printf("[OK]\tSurvived with TF set and %d traps\n", (int)sig_traps);
117 	sig_traps = 0;
118 }
119 
120 int main()
121 {
122 #ifdef CAN_BUILD_32
123 	int tmp;
124 #endif
125 
126 	sethandler(SIGTRAP, sigtrap, 0);
127 
128 	printf("[RUN]\tSet TF and check nop\n");
129 	set_eflags(get_eflags() | X86_EFLAGS_TF);
130 	asm volatile ("nop");
131 	check_result();
132 
133 #ifdef __x86_64__
134 	printf("[RUN]\tSet TF and check syscall-less opportunistic sysret\n");
135 	set_eflags(get_eflags() | X86_EFLAGS_TF);
136 	extern unsigned char post_nop[];
137 	asm volatile ("pushf" WIDTH "\n\t"
138 		      "pop" WIDTH " %%r11\n\t"
139 		      "nop\n\t"
140 		      "post_nop:"
141 		      : : "c" (post_nop) : "r11");
142 	check_result();
143 #endif
144 #ifdef CAN_BUILD_32
145 	printf("[RUN]\tSet TF and check int80\n");
146 	set_eflags(get_eflags() | X86_EFLAGS_TF);
147 	asm volatile ("int $0x80" : "=a" (tmp) : "a" (SYS_getpid)
148 			: INT80_CLOBBERS);
149 	check_result();
150 #endif
151 
152 	/*
153 	 * This test is particularly interesting if fast syscalls use
154 	 * SYSENTER: it triggers a nasty design flaw in SYSENTER.
155 	 * Specifically, SYSENTER does not clear TF, so either SYSENTER
156 	 * or the next instruction traps at CPL0.  (Of course, Intel
157 	 * mostly forgot to document exactly what happens here.)  So we
158 	 * get a CPL0 fault with usergs (on 64-bit kernels) and possibly
159 	 * no stack.  The only sane way the kernel can possibly handle
160 	 * it is to clear TF on return from the #DB handler, but this
161 	 * happens way too early to set TF in the saved pt_regs, so the
162 	 * kernel has to do something clever to avoid losing track of
163 	 * the TF bit.
164 	 *
165 	 * Needless to say, we've had bugs in this area.
166 	 */
167 	syscall(SYS_getpid);  /* Force symbol binding without TF set. */
168 	printf("[RUN]\tSet TF and check a fast syscall\n");
169 	set_eflags(get_eflags() | X86_EFLAGS_TF);
170 	syscall(SYS_getpid);
171 	check_result();
172 
173 	/* Now make sure that another fast syscall doesn't set TF again. */
174 	printf("[RUN]\tFast syscall with TF cleared\n");
175 	fflush(stdout);  /* Force a syscall */
176 	if (get_eflags() & X86_EFLAGS_TF) {
177 		printf("[FAIL]\tTF is now set\n");
178 		exit(1);
179 	}
180 	if (sig_traps) {
181 		printf("[FAIL]\tGot SIGTRAP\n");
182 		exit(1);
183 	}
184 	printf("[OK]\tNothing unexpected happened\n");
185 
186 	return 0;
187 }
188