1 // SPDX-License-Identifier: GPL-2.0-only
2 /*
3  * single_step_syscall.c - single-steps various x86 syscalls
4  * Copyright (c) 2014-2015 Andrew Lutomirski
5  *
6  * This is a very simple series of tests that makes system calls with
7  * the TF flag set.  This exercises some nasty kernel code in the
8  * SYSENTER case: SYSENTER does not clear TF, so SYSENTER with TF set
9  * immediately issues #DB from CPL 0.  This requires special handling in
10  * the kernel.
11  */
12 
13 #define _GNU_SOURCE
14 
15 #include <sys/time.h>
16 #include <time.h>
17 #include <stdlib.h>
18 #include <sys/syscall.h>
19 #include <unistd.h>
20 #include <stdio.h>
21 #include <string.h>
22 #include <inttypes.h>
23 #include <sys/mman.h>
24 #include <sys/signal.h>
25 #include <sys/ucontext.h>
26 #include <asm/ldt.h>
27 #include <err.h>
28 #include <setjmp.h>
29 #include <stddef.h>
30 #include <stdbool.h>
31 #include <sys/ptrace.h>
32 #include <sys/user.h>
33 
34 #include "helpers.h"
35 
36 static volatile sig_atomic_t sig_traps, sig_eflags;
37 sigjmp_buf jmpbuf;
38 
39 #ifdef __x86_64__
40 # define REG_IP REG_RIP
41 # define WIDTH "q"
42 # define INT80_CLOBBERS "r8", "r9", "r10", "r11"
43 #else
44 # define REG_IP REG_EIP
45 # define WIDTH "l"
46 # define INT80_CLOBBERS
47 #endif
48 
sigtrap(int sig,siginfo_t * info,void * ctx_void)49 static void sigtrap(int sig, siginfo_t *info, void *ctx_void)
50 {
51 	ucontext_t *ctx = (ucontext_t*)ctx_void;
52 
53 	if (get_eflags() & X86_EFLAGS_TF) {
54 		set_eflags(get_eflags() & ~X86_EFLAGS_TF);
55 		printf("[WARN]\tSIGTRAP handler had TF set\n");
56 		_exit(1);
57 	}
58 
59 	sig_traps++;
60 
61 	if (sig_traps == 10000 || sig_traps == 10001) {
62 		printf("[WARN]\tHit %d SIGTRAPs with si_addr 0x%lx, ip 0x%lx\n",
63 		       (int)sig_traps,
64 		       (unsigned long)info->si_addr,
65 		       (unsigned long)ctx->uc_mcontext.gregs[REG_IP]);
66 	}
67 }
68 
69 static char const * const signames[] = {
70 	[SIGSEGV] = "SIGSEGV",
71 	[SIGBUS] = "SIBGUS",
72 	[SIGTRAP] = "SIGTRAP",
73 	[SIGILL] = "SIGILL",
74 };
75 
print_and_longjmp(int sig,siginfo_t * si,void * ctx_void)76 static void print_and_longjmp(int sig, siginfo_t *si, void *ctx_void)
77 {
78 	ucontext_t *ctx = ctx_void;
79 
80 	printf("\tGot %s with RIP=%lx, TF=%ld\n", signames[sig],
81 	       (unsigned long)ctx->uc_mcontext.gregs[REG_IP],
82 	       (unsigned long)ctx->uc_mcontext.gregs[REG_EFL] & X86_EFLAGS_TF);
83 
84 	sig_eflags = (unsigned long)ctx->uc_mcontext.gregs[REG_EFL];
85 	siglongjmp(jmpbuf, 1);
86 }
87 
check_result(void)88 static void check_result(void)
89 {
90 	unsigned long new_eflags = get_eflags();
91 	set_eflags(new_eflags & ~X86_EFLAGS_TF);
92 
93 	if (!sig_traps) {
94 		printf("[FAIL]\tNo SIGTRAP\n");
95 		exit(1);
96 	}
97 
98 	if (!(new_eflags & X86_EFLAGS_TF)) {
99 		printf("[FAIL]\tTF was cleared\n");
100 		exit(1);
101 	}
102 
103 	printf("[OK]\tSurvived with TF set and %d traps\n", (int)sig_traps);
104 	sig_traps = 0;
105 }
106 
fast_syscall_no_tf(void)107 static void fast_syscall_no_tf(void)
108 {
109 	sig_traps = 0;
110 	printf("[RUN]\tFast syscall with TF cleared\n");
111 	fflush(stdout);  /* Force a syscall */
112 	if (get_eflags() & X86_EFLAGS_TF) {
113 		printf("[FAIL]\tTF is now set\n");
114 		exit(1);
115 	}
116 	if (sig_traps) {
117 		printf("[FAIL]\tGot SIGTRAP\n");
118 		exit(1);
119 	}
120 	printf("[OK]\tNothing unexpected happened\n");
121 }
122 
main()123 int main()
124 {
125 #ifdef CAN_BUILD_32
126 	int tmp;
127 #endif
128 
129 	sethandler(SIGTRAP, sigtrap, 0);
130 
131 	printf("[RUN]\tSet TF and check nop\n");
132 	set_eflags(get_eflags() | X86_EFLAGS_TF);
133 	asm volatile ("nop");
134 	check_result();
135 
136 #ifdef __x86_64__
137 	printf("[RUN]\tSet TF and check syscall-less opportunistic sysret\n");
138 	set_eflags(get_eflags() | X86_EFLAGS_TF);
139 	extern unsigned char post_nop[];
140 	asm volatile ("pushf" WIDTH "\n\t"
141 		      "pop" WIDTH " %%r11\n\t"
142 		      "nop\n\t"
143 		      "post_nop:"
144 		      : : "c" (post_nop) : "r11");
145 	check_result();
146 #endif
147 #ifdef CAN_BUILD_32
148 	printf("[RUN]\tSet TF and check int80\n");
149 	set_eflags(get_eflags() | X86_EFLAGS_TF);
150 	asm volatile ("int $0x80" : "=a" (tmp) : "a" (SYS_getpid)
151 			: INT80_CLOBBERS);
152 	check_result();
153 #endif
154 
155 	/*
156 	 * This test is particularly interesting if fast syscalls use
157 	 * SYSENTER: it triggers a nasty design flaw in SYSENTER.
158 	 * Specifically, SYSENTER does not clear TF, so either SYSENTER
159 	 * or the next instruction traps at CPL0.  (Of course, Intel
160 	 * mostly forgot to document exactly what happens here.)  So we
161 	 * get a CPL0 fault with usergs (on 64-bit kernels) and possibly
162 	 * no stack.  The only sane way the kernel can possibly handle
163 	 * it is to clear TF on return from the #DB handler, but this
164 	 * happens way too early to set TF in the saved pt_regs, so the
165 	 * kernel has to do something clever to avoid losing track of
166 	 * the TF bit.
167 	 *
168 	 * Needless to say, we've had bugs in this area.
169 	 */
170 	syscall(SYS_getpid);  /* Force symbol binding without TF set. */
171 	printf("[RUN]\tSet TF and check a fast syscall\n");
172 	set_eflags(get_eflags() | X86_EFLAGS_TF);
173 	syscall(SYS_getpid);
174 	check_result();
175 
176 	/* Now make sure that another fast syscall doesn't set TF again. */
177 	fast_syscall_no_tf();
178 
179 	/*
180 	 * And do a forced SYSENTER to make sure that this works even if
181 	 * fast syscalls don't use SYSENTER.
182 	 *
183 	 * Invoking SYSENTER directly breaks all the rules.  Just handle
184 	 * the SIGSEGV.
185 	 */
186 	if (sigsetjmp(jmpbuf, 1) == 0) {
187 		unsigned long nr = SYS_getpid;
188 		printf("[RUN]\tSet TF and check SYSENTER\n");
189 		stack_t stack = {
190 			.ss_sp = malloc(sizeof(char) * SIGSTKSZ),
191 			.ss_size = SIGSTKSZ,
192 		};
193 		if (sigaltstack(&stack, NULL) != 0)
194 			err(1, "sigaltstack");
195 		sethandler(SIGSEGV, print_and_longjmp,
196 			   SA_RESETHAND | SA_ONSTACK);
197 		sethandler(SIGILL, print_and_longjmp, SA_RESETHAND);
198 		set_eflags(get_eflags() | X86_EFLAGS_TF);
199 		free(stack.ss_sp);
200 		/* Clear EBP first to make sure we segfault cleanly. */
201 		asm volatile ("xorl %%ebp, %%ebp; SYSENTER" : "+a" (nr) :: "flags", "rcx"
202 #ifdef __x86_64__
203 				, "r11"
204 #endif
205 			);
206 
207 		/* We're unreachable here.  SYSENTER forgets RIP. */
208 	}
209 	clearhandler(SIGSEGV);
210 	clearhandler(SIGILL);
211 	if (!(sig_eflags & X86_EFLAGS_TF)) {
212 		printf("[FAIL]\tTF was cleared\n");
213 		exit(1);
214 	}
215 
216 	/* Now make sure that another fast syscall doesn't set TF again. */
217 	fast_syscall_no_tf();
218 
219 	return 0;
220 }
221