2 * single_step_syscall.c - single-steps various x86 syscalls
3 * Copyright (c) 2014-2015 Andrew Lutomirski
5 * This program is free software; you can redistribute it and/or modify
6 * it under the terms and conditions of the GNU General Public License,
7 * version 2, as published by the Free Software Foundation.
9 * This program is distributed in the hope it will be useful, but
10 * WITHOUT ANY WARRANTY; without even the implied warranty of
11 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
12 * General Public License for more details.
14 * This is a very simple series of tests that makes system calls with
15 * the TF flag set. This exercises some nasty kernel code in the
16 * SYSENTER case: SYSENTER does not clear TF, so SYSENTER with TF set
17 * immediately issues #DB from CPL 0. This requires special handling in
26 #include <sys/syscall.h>
32 #include <sys/signal.h>
33 #include <sys/ucontext.h>
39 #include <sys/ptrace.h>
42 static void sethandler(int sig
, void (*handler
)(int, siginfo_t
*, void *),
46 memset(&sa
, 0, sizeof(sa
));
47 sa
.sa_sigaction
= handler
;
48 sa
.sa_flags
= SA_SIGINFO
| flags
;
49 sigemptyset(&sa
.sa_mask
);
50 if (sigaction(sig
, &sa
, 0))
54 static volatile sig_atomic_t sig_traps
;
57 # define REG_IP REG_RIP
59 # define INT80_CLOBBERS "r8", "r9", "r10", "r11"
61 # define REG_IP REG_EIP
63 # define INT80_CLOBBERS
66 static unsigned long get_eflags(void)
69 asm volatile ("pushf" WIDTH
"\n\tpop" WIDTH
" %0" : "=rm" (eflags
));
73 static void set_eflags(unsigned long eflags
)
75 asm volatile ("push" WIDTH
" %0\n\tpopf" WIDTH
76 : : "rm" (eflags
) : "flags");
79 #define X86_EFLAGS_TF (1UL << 8)
81 static void sigtrap(int sig
, siginfo_t
*info
, void *ctx_void
)
83 ucontext_t
*ctx
= (ucontext_t
*)ctx_void
;
85 if (get_eflags() & X86_EFLAGS_TF
) {
86 set_eflags(get_eflags() & ~X86_EFLAGS_TF
);
87 printf("[WARN]\tSIGTRAP handler had TF set\n");
93 if (sig_traps
== 10000 || sig_traps
== 10001) {
94 printf("[WARN]\tHit %d SIGTRAPs with si_addr 0x%lx, ip 0x%lx\n",
96 (unsigned long)info
->si_addr
,
97 (unsigned long)ctx
->uc_mcontext
.gregs
[REG_IP
]);
101 static void check_result(void)
103 unsigned long new_eflags
= get_eflags();
104 set_eflags(new_eflags
& ~X86_EFLAGS_TF
);
107 printf("[FAIL]\tNo SIGTRAP\n");
111 if (!(new_eflags
& X86_EFLAGS_TF
)) {
112 printf("[FAIL]\tTF was cleared\n");
116 printf("[OK]\tSurvived with TF set and %d traps\n", (int)sig_traps
);
126 sethandler(SIGTRAP
, sigtrap
, 0);
128 printf("[RUN]\tSet TF and check nop\n");
129 set_eflags(get_eflags() | X86_EFLAGS_TF
);
130 asm volatile ("nop");
134 printf("[RUN]\tSet TF and check syscall-less opportunistic sysret\n");
135 set_eflags(get_eflags() | X86_EFLAGS_TF
);
136 extern unsigned char post_nop
[];
137 asm volatile ("pushf" WIDTH
"\n\t"
138 "pop" WIDTH
" %%r11\n\t"
141 : : "c" (post_nop
) : "r11");
145 printf("[RUN]\tSet TF and check int80\n");
146 set_eflags(get_eflags() | X86_EFLAGS_TF
);
147 asm volatile ("int $0x80" : "=a" (tmp
) : "a" (SYS_getpid
)
153 * This test is particularly interesting if fast syscalls use
154 * SYSENTER: it triggers a nasty design flaw in SYSENTER.
155 * Specifically, SYSENTER does not clear TF, so either SYSENTER
156 * or the next instruction traps at CPL0. (Of course, Intel
157 * mostly forgot to document exactly what happens here.) So we
158 * get a CPL0 fault with usergs (on 64-bit kernels) and possibly
159 * no stack. The only sane way the kernel can possibly handle
160 * it is to clear TF on return from the #DB handler, but this
161 * happens way too early to set TF in the saved pt_regs, so the
162 * kernel has to do something clever to avoid losing track of
165 * Needless to say, we've had bugs in this area.
167 syscall(SYS_getpid
); /* Force symbol binding without TF set. */
168 printf("[RUN]\tSet TF and check a fast syscall\n");
169 set_eflags(get_eflags() | X86_EFLAGS_TF
);
173 /* Now make sure that another fast syscall doesn't set TF again. */
174 printf("[RUN]\tFast syscall with TF cleared\n");
175 fflush(stdout
); /* Force a syscall */
176 if (get_eflags() & X86_EFLAGS_TF
) {
177 printf("[FAIL]\tTF is now set\n");
181 printf("[FAIL]\tGot SIGTRAP\n");
184 printf("[OK]\tNothing unexpected happened\n");