tools/testing/selftests/x86/syscall_arg_fault.c

   1 // SPDX-License-Identifier: GPL-2.0-only
   2 /*
   3  * syscall_arg_fault.c - tests faults 32-bit fast syscall stack args
   4  * Copyright (c) 2015 Andrew Lutomirski
   5  */
   6
   7 #define _GNU_SOURCE
   8
   9 #include <stdlib.h>
  10 #include <stdio.h>
  11 #include <string.h>
  12 #include <sys/signal.h>
  13 #include <sys/ucontext.h>
  14 #include <err.h>
  15 #include <setjmp.h>
  16 #include <errno.h>
  17
  18 #include "helpers.h"
  19
  20 /* Our sigaltstack scratch space. */
  21 static unsigned char altstack_data[SIGSTKSZ];
  22
  23 static void sethandler(int sig, void (*handler)(int, siginfo_t *, void *),
  24                        int flags)
  25 {
  26         struct sigaction sa;
  27         memset(&sa, 0, sizeof(sa));
  28         sa.sa_sigaction = handler;
  29         sa.sa_flags = SA_SIGINFO | flags;
  30         sigemptyset(&sa.sa_mask);
  31         if (sigaction(sig, &sa, 0))
  32                 err(1, "sigaction");
  33 }
  34
  35 static volatile sig_atomic_t sig_traps;
  36 static sigjmp_buf jmpbuf;
  37
  38 static volatile sig_atomic_t n_errs;
  39
  40 #ifdef __x86_64__
  41 #define REG_AX REG_RAX
  42 #define REG_IP REG_RIP
  43 #else
  44 #define REG_AX REG_EAX
  45 #define REG_IP REG_EIP
  46 #endif
  47
  48 static void sigsegv_or_sigbus(int sig, siginfo_t *info, void *ctx_void)
  49 {
  50         ucontext_t *ctx = (ucontext_t*)ctx_void;
  51         long ax = (long)ctx->uc_mcontext.gregs[REG_AX];
  52
  53         if (ax != -EFAULT && ax != -ENOSYS) {
  54                 printf("[FAIL]\tAX had the wrong value: 0x%lx\n",
  55                        (unsigned long)ax);
  56                 printf("\tIP = 0x%lx\n", (unsigned long)ctx->uc_mcontext.gregs[REG_IP]);
  57                 n_errs++;
  58         } else {
  59                 printf("[OK]\tSeems okay\n");
  60         }
  61
  62         siglongjmp(jmpbuf, 1);
  63 }
  64
  65 static volatile sig_atomic_t sigtrap_consecutive_syscalls;
  66
  67 static void sigtrap(int sig, siginfo_t *info, void *ctx_void)
  68 {
  69         /*
  70          * KVM has some bugs that can cause us to stop making progress.
  71          * detect them and complain, but don't infinite loop or fail the
  72          * test.
  73          */
  74
  75         ucontext_t *ctx = (ucontext_t*)ctx_void;
  76         unsigned short *ip = (unsigned short *)ctx->uc_mcontext.gregs[REG_IP];
  77
  78         if (*ip == 0x340f || *ip == 0x050f) {
  79                 /* The trap was on SYSCALL or SYSENTER */
  80                 sigtrap_consecutive_syscalls++;
  81                 if (sigtrap_consecutive_syscalls > 3) {
  82                         printf("[WARN]\tGot stuck single-stepping -- you probably have a KVM bug\n");
  83                         siglongjmp(jmpbuf, 1);
  84                 }
  85         } else {
  86                 sigtrap_consecutive_syscalls = 0;
  87         }
  88 }
  89
  90 static void sigill(int sig, siginfo_t *info, void *ctx_void)
  91 {
  92         ucontext_t *ctx = (ucontext_t*)ctx_void;
  93         unsigned short *ip = (unsigned short *)ctx->uc_mcontext.gregs[REG_IP];
  94
  95         if (*ip == 0x0b0f) {
  96                 /* one of the ud2 instructions faulted */
  97                 printf("[OK]\tSYSCALL returned normally\n");
  98         } else {
  99                 printf("[SKIP]\tIllegal instruction\n");
 100         }
 101         siglongjmp(jmpbuf, 1);
 102 }
 103
 104 int main()
 105 {
 106         stack_t stack = {
 107                 .ss_sp = altstack_data,
 108                 .ss_size = SIGSTKSZ,
 109         };
 110         if (sigaltstack(&stack, NULL) != 0)
 111                 err(1, "sigaltstack");
 112
 113         sethandler(SIGSEGV, sigsegv_or_sigbus, SA_ONSTACK);
 114         /*
 115          * The actual exception can vary.  On Atom CPUs, we get #SS
 116          * instead of #PF when the vDSO fails to access the stack when
 117          * ESP is too close to 2^32, and #SS causes SIGBUS.
 118          */
 119         sethandler(SIGBUS, sigsegv_or_sigbus, SA_ONSTACK);
 120         sethandler(SIGILL, sigill, SA_ONSTACK);
 121
 122         /*
 123          * Exercise another nasty special case.  The 32-bit SYSCALL
 124          * and SYSENTER instructions (even in compat mode) each
 125          * clobber one register.  A Linux system call has a syscall
 126          * number and six arguments, and the user stack pointer
 127          * needs to live in some register on return.  That means
 128          * that we need eight registers, but SYSCALL and SYSENTER
 129          * only preserve seven registers.  As a result, one argument
 130          * ends up on the stack.  The stack is user memory, which
 131          * means that the kernel can fail to read it.
 132          *
 133          * The 32-bit fast system calls don't have a defined ABI:
 134          * we're supposed to invoke them through the vDSO.  So we'll
 135          * fudge it: we set all regs to invalid pointer values and
 136          * invoke the entry instruction.  The return will fail no
 137          * matter what, and we completely lose our program state,
 138          * but we can fix it up with a signal handler.
 139          */
 140
 141         printf("[RUN]\tSYSENTER with invalid state\n");
 142         if (sigsetjmp(jmpbuf, 1) == 0) {
 143                 asm volatile (
 144                         "movl $-1, %%eax\n\t"
 145                         "movl $-1, %%ebx\n\t"
 146                         "movl $-1, %%ecx\n\t"
 147                         "movl $-1, %%edx\n\t"
 148                         "movl $-1, %%esi\n\t"
 149                         "movl $-1, %%edi\n\t"
 150                         "movl $-1, %%ebp\n\t"
 151                         "movl $-1, %%esp\n\t"
 152                         "sysenter"
 153                         : : : "memory", "flags");
 154         }
 155
 156         printf("[RUN]\tSYSCALL with invalid state\n");
 157         if (sigsetjmp(jmpbuf, 1) == 0) {
 158                 asm volatile (
 159                         "movl $-1, %%eax\n\t"
 160                         "movl $-1, %%ebx\n\t"
 161                         "movl $-1, %%ecx\n\t"
 162                         "movl $-1, %%edx\n\t"
 163                         "movl $-1, %%esi\n\t"
 164                         "movl $-1, %%edi\n\t"
 165                         "movl $-1, %%ebp\n\t"
 166                         "movl $-1, %%esp\n\t"
 167                         "syscall\n\t"
 168                         "ud2"           /* make sure we recover cleanly */
 169                         : : : "memory", "flags");
 170         }
 171
 172         printf("[RUN]\tSYSENTER with TF and invalid state\n");
 173         sethandler(SIGTRAP, sigtrap, SA_ONSTACK);
 174
 175         if (sigsetjmp(jmpbuf, 1) == 0) {
 176                 sigtrap_consecutive_syscalls = 0;
 177                 set_eflags(get_eflags() | X86_EFLAGS_TF);
 178                 asm volatile (
 179                         "movl $-1, %%eax\n\t"
 180                         "movl $-1, %%ebx\n\t"
 181                         "movl $-1, %%ecx\n\t"
 182                         "movl $-1, %%edx\n\t"
 183                         "movl $-1, %%esi\n\t"
 184                         "movl $-1, %%edi\n\t"
 185                         "movl $-1, %%ebp\n\t"
 186                         "movl $-1, %%esp\n\t"
 187                         "sysenter"
 188                         : : : "memory", "flags");
 189         }
 190         set_eflags(get_eflags() & ~X86_EFLAGS_TF);
 191
 192         printf("[RUN]\tSYSCALL with TF and invalid state\n");
 193         if (sigsetjmp(jmpbuf, 1) == 0) {
 194                 sigtrap_consecutive_syscalls = 0;
 195                 set_eflags(get_eflags() | X86_EFLAGS_TF);
 196                 asm volatile (
 197                         "movl $-1, %%eax\n\t"
 198                         "movl $-1, %%ebx\n\t"
 199                         "movl $-1, %%ecx\n\t"
 200                         "movl $-1, %%edx\n\t"
 201                         "movl $-1, %%esi\n\t"
 202                         "movl $-1, %%edi\n\t"
 203                         "movl $-1, %%ebp\n\t"
 204                         "movl $-1, %%esp\n\t"
 205                         "syscall\n\t"
 206                         "ud2"           /* make sure we recover cleanly */
 207                         : : : "memory", "flags");
 208         }
 209         set_eflags(get_eflags() & ~X86_EFLAGS_TF);
 210
 211 #ifdef __x86_64__
 212         printf("[RUN]\tSYSENTER with TF, invalid state, and GSBASE < 0\n");
 213
 214         if (sigsetjmp(jmpbuf, 1) == 0) {
 215                 sigtrap_consecutive_syscalls = 0;
 216
 217                 asm volatile ("wrgsbase %%rax\n\t"
 218                               :: "a" (0xffffffffffff0000UL));
 219
 220                 set_eflags(get_eflags() | X86_EFLAGS_TF);
 221                 asm volatile (
 222                         "movl $-1, %%eax\n\t"
 223                         "movl $-1, %%ebx\n\t"
 224                         "movl $-1, %%ecx\n\t"
 225                         "movl $-1, %%edx\n\t"
 226                         "movl $-1, %%esi\n\t"
 227                         "movl $-1, %%edi\n\t"
 228                         "movl $-1, %%ebp\n\t"
 229                         "movl $-1, %%esp\n\t"
 230                         "sysenter"
 231                         : : : "memory", "flags");
 232         }
 233         set_eflags(get_eflags() & ~X86_EFLAGS_TF);
 234 #endif
 235
 236         return 0;
 237 }