1 // SPDX-License-Identifier: GPL-2.0-only
3 * 32-bit syscall ABI conformance test.
5 * Copyright (c) 2015 Denys Vlasenko
8 * Can be built statically:
9 * gcc -Os -Wall -static -m32 test_syscall_vdso.c thunks_32.S
20 #include <sys/types.h>
21 #include <sys/select.h>
24 #include <sys/ptrace.h>
27 #if !defined(__i386__)
28 int main(int argc
, char **argv
, char **envp
)
30 printf("[SKIP]\tNot a 32-bit x86 userspace\n");
36 long get_syscall(char **envp
)
39 while (*envp
++ != NULL
)
41 for (auxv
= (void *)envp
; auxv
->a_type
!= AT_NULL
; auxv
++)
42 if (auxv
->a_type
== AT_SYSINFO
)
43 return auxv
->a_un
.a_val
;
44 printf("[WARN]\tAT_SYSINFO not supplied\n");
49 " .pushsection .text\n"
59 uint64_t rax
, rbx
, rcx
, rdx
;
60 uint64_t rsi
, rdi
, rbp
, rsp
;
61 uint64_t r8
, r9
, r10
, r11
;
62 uint64_t r12
, r13
, r14
, r15
;
68 " .pushsection .text\n"
72 " mov $regs64, %eax\n"
74 " movq %rbx, 1*8(%rax)\n"
75 " movq %rcx, 2*8(%rax)\n"
76 " movq %rdx, 3*8(%rax)\n"
77 " movq %rsi, 4*8(%rax)\n"
78 " movq %rdi, 5*8(%rax)\n"
79 " movq %rbp, 6*8(%rax)\n"
80 " movq %rsp, 7*8(%rax)\n"
81 " movq %r8, 8*8(%rax)\n"
82 " movq %r9, 9*8(%rax)\n"
83 " movq %r10, 10*8(%rax)\n"
84 " movq %r11, 11*8(%rax)\n"
85 " movq %r12, 12*8(%rax)\n"
86 " movq %r13, 13*8(%rax)\n"
87 " movq %r14, 14*8(%rax)\n"
88 " movq %r15, 15*8(%rax)\n"
91 " movq $0x7f7f7f7f, %r8\n"
93 " orq $0x7f7f7f7f, %r8\n"
112 extern void get_regs64(void);
113 extern void poison_regs64(void);
114 extern unsigned long call64_from_32(void (*function
)(void));
115 void print_regs64(void)
117 if (!kernel_is_64bit
)
119 printf("ax:%016llx bx:%016llx cx:%016llx dx:%016llx\n", regs64
.rax
, regs64
.rbx
, regs64
.rcx
, regs64
.rdx
);
120 printf("si:%016llx di:%016llx bp:%016llx sp:%016llx\n", regs64
.rsi
, regs64
.rdi
, regs64
.rbp
, regs64
.rsp
);
121 printf(" 8:%016llx 9:%016llx 10:%016llx 11:%016llx\n", regs64
.r8
, regs64
.r9
, regs64
.r10
, regs64
.r11
);
122 printf("12:%016llx 13:%016llx 14:%016llx 15:%016llx\n", regs64
.r12
, regs64
.r13
, regs64
.r14
, regs64
.r15
);
125 int check_regs64(void)
129 uint64_t *r64
= ®s64
.r8
;
130 uint64_t expected
= 0x7f7f7f7f7f7f7f7fULL
;
132 if (!kernel_is_64bit
)
136 if (*r64
== expected
++)
137 continue; /* register did not change */
138 if (syscall_addr
!= (long)&int80
) {
140 * Non-INT80 syscall entrypoints are allowed to clobber R8+ regs:
141 * either clear them to 0, or for R11, load EFLAGS.
146 printf("[NOTE]\tR11 has changed:%016llx - assuming clobbered by SYSRET insn\n", *r64
);
151 * INT80 syscall entrypoint can be used by
152 * 64-bit programs too, unlike SYSCALL/SYSENTER.
153 * Therefore it must preserve R12+
154 * (they are callee-saved registers in 64-bit C ABI).
156 * Starting in Linux 4.17 (and any kernel that
157 * backports the change), R8..11 are preserved.
158 * Historically (and probably unintentionally), they
159 * were clobbered or zeroed.
162 printf("[FAIL]\tR%d has changed:%016llx\n", num
, *r64
);
164 } while (r64
++, ++num
< 16);
167 printf("[OK]\tR8..R15 did not leak kernel data\n");
175 struct timespec timeout
;
192 timeout
.tv_nsec
= 123;
193 sigemptyset(&sigmask
);
194 sigaddset(&sigmask
, SIGINT
);
195 sigaddset(&sigmask
, SIGUSR2
);
196 sigaddset(&sigmask
, SIGRTMAX
);
197 sigmask_desc
.sp
= &sigmask
;
198 sigmask_desc
.sz
= 8; /* bytes */
201 static void print_flags(const char *name
, unsigned long r
)
203 static const char *bitarray
[] = {
204 "\n" ,"c\n" ,/* Carry Flag */
205 "0 " ,"1 " ,/* Bit 1 - always on */
206 "" ,"p " ,/* Parity Flag */
208 "" ,"a " ,/* Auxiliary carry Flag */
210 "" ,"z " ,/* Zero Flag */
211 "" ,"s " ,/* Sign Flag */
212 "" ,"t " ,/* Trap Flag */
213 "" ,"i " ,/* Interrupt Flag */
214 "" ,"d " ,/* Direction Flag */
215 "" ,"o " ,/* Overflow Flag */
216 "0 " ,"1 " ,/* I/O Privilege Level (2 bits) */
217 "0" ,"1" ,/* I/O Privilege Level (2 bits) */
218 "" ,"n " ,/* Nested Task */
220 "" ,"r " ,/* Resume Flag */
221 "" ,"v " ,/* Virtual Mode */
222 "" ,"ac " ,/* Alignment Check/Access Control */
223 "" ,"vif ",/* Virtual Interrupt Flag */
224 "" ,"vip ",/* Virtual Interrupt Pending */
225 "" ,"id " ,/* CPUID detection */
231 printf("%s=%016lx ", name
, r
);
232 bitstr
= bitarray
+ 42;
235 printf("(extra bits are set) ");
237 if (bitstr
[(r
>> bit
) & 1][0])
238 fputs(bitstr
[(r
>> bit
) & 1], stdout
);
244 int run_syscall(void)
251 call64_from_32(poison_regs64
);
255 /* Try 6-arg syscall: pselect. It should return quickly */
257 " mov $308, %%eax\n" /* PSELECT */
258 " mov nfds, %%ebx\n" /* ebx arg1 */
259 " mov $rfds, %%ecx\n" /* ecx arg2 */
260 " mov $wfds, %%edx\n" /* edx arg3 */
261 " mov $efds, %%esi\n" /* esi arg4 */
262 " mov $timeout, %%edi\n" /* edi arg5 */
263 " mov $sigmask_desc, %%ebp\n" /* %ebp arg6 */
264 " push $0x200ed7\n" /* set almost all flags */
265 " popf\n" /* except TF, IOPL, NT, RF, VM, AC, VIF, VIP */
266 " call *syscall_addr\n"
267 /* Check that registers are not clobbered */
271 " cmp nfds, %%ebx\n" /* ebx arg1 */
274 " cmp $rfds, %%ecx\n" /* ecx arg2 */
277 " cmp $wfds, %%edx\n" /* edx arg3 */
280 " cmp $efds, %%esi\n" /* esi arg4 */
283 " cmp $timeout, %%edi\n" /* edi arg5 */
286 " cmpl $sigmask_desc, %%ebp\n" /* %ebp arg6 */
292 : "=a" (flags
), "=b" (bad_arg
)
294 : "cx", "dx", "si", "di"
297 if (kernel_is_64bit
) {
298 memset(®s64
, 0x77, sizeof(regs64
));
299 call64_from_32(get_regs64
);
304 * On paravirt kernels, flags are not preserved across syscalls.
305 * Thus, we do not consider it a bug if some are changed.
306 * We just show ones which do.
308 if ((0x200ed7 ^ flags
) != 0) {
309 print_flags("[WARN]\tFlags before", 0x200ed7);
310 print_flags("[WARN]\tFlags after", flags
);
311 print_flags("[WARN]\tFlags change", (0x200ed7 ^ flags
));
315 printf("[FAIL]\targ#%ld clobbered\n", bad_arg
);
318 printf("[OK]\tArguments are preserved across syscall\n");
320 return check_regs64();
323 int run_syscall_twice()
329 printf("[RUN]\tExecuting 6-argument 32-bit syscall via VDSO\n");
330 exitcode
= run_syscall();
333 syscall_addr
= (long)&int80
;
334 printf("[RUN]\tExecuting 6-argument 32-bit syscall via INT 80\n");
335 exitcode
+= run_syscall();
350 if (ptrace(PTRACE_TRACEME
, 0L, 0L, 0L) != 0)
356 printf("[RUN]\tRunning tests under ptrace\n");
359 pid
= waitpid(-1, &status
, __WALL
);
360 if (WIFEXITED(status
))
361 exit(WEXITSTATUS(status
));
362 if (WIFSIGNALED(status
))
363 exit(WTERMSIG(status
));
364 if (pid
<= 0 || !WIFSTOPPED(status
)) /* paranoia */
367 * Note: we do not inject sig = WSTOPSIG(status).
368 * We probably should, but careful: do not inject SIGTRAP
369 * generated by syscall entry/exit stops.
370 * That kills the child.
372 ptrace(PTRACE_SYSCALL
, pid
, 0L, 0L /*sig*/);
376 int main(int argc
, char **argv
, char **envp
)
382 " movl %%cs, %%eax\n"
385 kernel_is_64bit
= (cs
== 0x23);
386 if (!kernel_is_64bit
)
387 printf("[NOTE]\tNot a 64-bit kernel, won't test R8..R15 leaks\n");
389 /* This only works for non-static builds:
390 * syscall_addr = dlsym(dlopen("linux-gate.so.1", RTLD_NOW), "__kernel_vsyscall");
392 syscall_addr
= get_syscall(envp
);
394 exitcode
+= run_syscall_twice();
396 exitcode
+= run_syscall_twice();