Commit | Line | Data |
---|---|---|
c25be94f DV |
1 | /* |
2 | * 32-bit syscall ABI conformance test. | |
3 | * | |
4 | * Copyright (c) 2015 Denys Vlasenko | |
5 | * | |
6 | * This program is free software; you can redistribute it and/or modify | |
7 | * it under the terms and conditions of the GNU General Public License, | |
8 | * version 2, as published by the Free Software Foundation. | |
9 | * | |
10 | * This program is distributed in the hope it will be useful, but | |
11 | * WITHOUT ANY WARRANTY; without even the implied warranty of | |
12 | * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU | |
13 | * General Public License for more details. | |
14 | */ | |
15 | /* | |
16 | * Can be built statically: | |
17 | * gcc -Os -Wall -static -m32 test_syscall_vdso.c thunks_32.S | |
18 | */ | |
19 | #undef _GNU_SOURCE | |
20 | #define _GNU_SOURCE 1 | |
21 | #undef __USE_GNU | |
22 | #define __USE_GNU 1 | |
23 | #include <unistd.h> | |
24 | #include <stdlib.h> | |
25 | #include <string.h> | |
26 | #include <stdio.h> | |
27 | #include <signal.h> | |
28 | #include <sys/types.h> | |
29 | #include <sys/select.h> | |
30 | #include <sys/time.h> | |
31 | #include <elf.h> | |
32 | #include <sys/ptrace.h> | |
33 | #include <sys/wait.h> | |
34 | ||
35 | #if !defined(__i386__) | |
36 | int main(int argc, char **argv, char **envp) | |
37 | { | |
38 | printf("[SKIP]\tNot a 32-bit x86 userspace\n"); | |
39 | return 0; | |
40 | } | |
41 | #else | |
42 | ||
43 | long syscall_addr; | |
44 | long get_syscall(char **envp) | |
45 | { | |
46 | Elf32_auxv_t *auxv; | |
47 | while (*envp++ != NULL) | |
48 | continue; | |
49 | for (auxv = (void *)envp; auxv->a_type != AT_NULL; auxv++) | |
50 | if (auxv->a_type == AT_SYSINFO) | |
51 | return auxv->a_un.a_val; | |
52 | printf("[WARN]\tAT_SYSINFO not supplied\n"); | |
53 | return 0; | |
54 | } | |
55 | ||
56 | asm ( | |
57 | " .pushsection .text\n" | |
58 | " .global int80\n" | |
59 | "int80:\n" | |
60 | " int $0x80\n" | |
61 | " ret\n" | |
62 | " .popsection\n" | |
63 | ); | |
64 | extern char int80; | |
65 | ||
66 | struct regs64 { | |
67 | uint64_t rax, rbx, rcx, rdx; | |
68 | uint64_t rsi, rdi, rbp, rsp; | |
69 | uint64_t r8, r9, r10, r11; | |
70 | uint64_t r12, r13, r14, r15; | |
71 | }; | |
72 | struct regs64 regs64; | |
73 | int kernel_is_64bit; | |
74 | ||
75 | asm ( | |
76 | " .pushsection .text\n" | |
77 | " .code64\n" | |
78 | "get_regs64:\n" | |
79 | " push %rax\n" | |
80 | " mov $regs64, %eax\n" | |
81 | " pop 0*8(%rax)\n" | |
82 | " movq %rbx, 1*8(%rax)\n" | |
83 | " movq %rcx, 2*8(%rax)\n" | |
84 | " movq %rdx, 3*8(%rax)\n" | |
85 | " movq %rsi, 4*8(%rax)\n" | |
86 | " movq %rdi, 5*8(%rax)\n" | |
87 | " movq %rbp, 6*8(%rax)\n" | |
88 | " movq %rsp, 7*8(%rax)\n" | |
89 | " movq %r8, 8*8(%rax)\n" | |
90 | " movq %r9, 9*8(%rax)\n" | |
91 | " movq %r10, 10*8(%rax)\n" | |
92 | " movq %r11, 11*8(%rax)\n" | |
93 | " movq %r12, 12*8(%rax)\n" | |
94 | " movq %r13, 13*8(%rax)\n" | |
95 | " movq %r14, 14*8(%rax)\n" | |
96 | " movq %r15, 15*8(%rax)\n" | |
97 | " ret\n" | |
98 | "poison_regs64:\n" | |
99 | " movq $0x7f7f7f7f, %r8\n" | |
100 | " shl $32, %r8\n" | |
101 | " orq $0x7f7f7f7f, %r8\n" | |
102 | " movq %r8, %r9\n" | |
103 | " movq %r8, %r10\n" | |
104 | " movq %r8, %r11\n" | |
105 | " movq %r8, %r12\n" | |
106 | " movq %r8, %r13\n" | |
107 | " movq %r8, %r14\n" | |
108 | " movq %r8, %r15\n" | |
109 | " ret\n" | |
110 | " .code32\n" | |
111 | " .popsection\n" | |
112 | ); | |
113 | extern void get_regs64(void); | |
114 | extern void poison_regs64(void); | |
115 | extern unsigned long call64_from_32(void (*function)(void)); | |
116 | void print_regs64(void) | |
117 | { | |
118 | if (!kernel_is_64bit) | |
119 | return; | |
120 | printf("ax:%016llx bx:%016llx cx:%016llx dx:%016llx\n", regs64.rax, regs64.rbx, regs64.rcx, regs64.rdx); | |
121 | printf("si:%016llx di:%016llx bp:%016llx sp:%016llx\n", regs64.rsi, regs64.rdi, regs64.rbp, regs64.rsp); | |
122 | printf(" 8:%016llx 9:%016llx 10:%016llx 11:%016llx\n", regs64.r8 , regs64.r9 , regs64.r10, regs64.r11); | |
123 | printf("12:%016llx 13:%016llx 14:%016llx 15:%016llx\n", regs64.r12, regs64.r13, regs64.r14, regs64.r15); | |
124 | } | |
125 | ||
126 | int check_regs64(void) | |
127 | { | |
128 | int err = 0; | |
129 | int num = 8; | |
130 | uint64_t *r64 = ®s64.r8; | |
131 | ||
132 | if (!kernel_is_64bit) | |
133 | return 0; | |
134 | ||
135 | do { | |
136 | if (*r64 == 0x7f7f7f7f7f7f7f7fULL) | |
137 | continue; /* register did not change */ | |
138 | if (syscall_addr != (long)&int80) { | |
139 | /* | |
140 | * Non-INT80 syscall entrypoints are allowed to clobber R8+ regs: | |
141 | * either clear them to 0, or for R11, load EFLAGS. | |
142 | */ | |
143 | if (*r64 == 0) | |
144 | continue; | |
145 | if (num == 11) { | |
146 | printf("[NOTE]\tR11 has changed:%016llx - assuming clobbered by SYSRET insn\n", *r64); | |
147 | continue; | |
148 | } | |
149 | } else { | |
150 | /* INT80 syscall entrypoint can be used by | |
151 | * 64-bit programs too, unlike SYSCALL/SYSENTER. | |
152 | * Therefore it must preserve R12+ | |
153 | * (they are callee-saved registers in 64-bit C ABI). | |
154 | * | |
155 | * This was probably historically not intended, | |
156 | * but R8..11 are clobbered (cleared to 0). | |
157 | * IOW: they are the only registers which aren't | |
158 | * preserved across INT80 syscall. | |
159 | */ | |
160 | if (*r64 == 0 && num <= 11) | |
161 | continue; | |
162 | } | |
163 | printf("[FAIL]\tR%d has changed:%016llx\n", num, *r64); | |
164 | err++; | |
165 | } while (r64++, ++num < 16); | |
166 | ||
167 | if (!err) | |
168 | printf("[OK]\tR8..R15 did not leak kernel data\n"); | |
169 | return err; | |
170 | } | |
171 | ||
172 | int nfds; | |
173 | fd_set rfds; | |
174 | fd_set wfds; | |
175 | fd_set efds; | |
176 | struct timespec timeout; | |
177 | sigset_t sigmask; | |
178 | struct { | |
179 | sigset_t *sp; | |
180 | int sz; | |
181 | } sigmask_desc; | |
182 | ||
183 | void prep_args() | |
184 | { | |
185 | nfds = 42; | |
186 | FD_ZERO(&rfds); | |
187 | FD_ZERO(&wfds); | |
188 | FD_ZERO(&efds); | |
189 | FD_SET(0, &rfds); | |
190 | FD_SET(1, &wfds); | |
191 | FD_SET(2, &efds); | |
192 | timeout.tv_sec = 0; | |
193 | timeout.tv_nsec = 123; | |
194 | sigemptyset(&sigmask); | |
195 | sigaddset(&sigmask, SIGINT); | |
196 | sigaddset(&sigmask, SIGUSR2); | |
197 | sigaddset(&sigmask, SIGRTMAX); | |
198 | sigmask_desc.sp = &sigmask; | |
199 | sigmask_desc.sz = 8; /* bytes */ | |
200 | } | |
201 | ||
202 | static void print_flags(const char *name, unsigned long r) | |
203 | { | |
204 | static const char *bitarray[] = { | |
205 | "\n" ,"c\n" ,/* Carry Flag */ | |
206 | "0 " ,"1 " ,/* Bit 1 - always on */ | |
207 | "" ,"p " ,/* Parity Flag */ | |
208 | "0 " ,"3? " , | |
209 | "" ,"a " ,/* Auxiliary carry Flag */ | |
210 | "0 " ,"5? " , | |
211 | "" ,"z " ,/* Zero Flag */ | |
212 | "" ,"s " ,/* Sign Flag */ | |
213 | "" ,"t " ,/* Trap Flag */ | |
214 | "" ,"i " ,/* Interrupt Flag */ | |
215 | "" ,"d " ,/* Direction Flag */ | |
216 | "" ,"o " ,/* Overflow Flag */ | |
217 | "0 " ,"1 " ,/* I/O Privilege Level (2 bits) */ | |
218 | "0" ,"1" ,/* I/O Privilege Level (2 bits) */ | |
219 | "" ,"n " ,/* Nested Task */ | |
220 | "0 " ,"15? ", | |
221 | "" ,"r " ,/* Resume Flag */ | |
222 | "" ,"v " ,/* Virtual Mode */ | |
223 | "" ,"ac " ,/* Alignment Check/Access Control */ | |
224 | "" ,"vif ",/* Virtual Interrupt Flag */ | |
225 | "" ,"vip ",/* Virtual Interrupt Pending */ | |
226 | "" ,"id " ,/* CPUID detection */ | |
227 | NULL | |
228 | }; | |
229 | const char **bitstr; | |
230 | int bit; | |
231 | ||
232 | printf("%s=%016lx ", name, r); | |
233 | bitstr = bitarray + 42; | |
234 | bit = 21; | |
235 | if ((r >> 22) != 0) | |
236 | printf("(extra bits are set) "); | |
237 | do { | |
238 | if (bitstr[(r >> bit) & 1][0]) | |
239 | fputs(bitstr[(r >> bit) & 1], stdout); | |
240 | bitstr -= 2; | |
241 | bit--; | |
242 | } while (bit >= 0); | |
243 | } | |
244 | ||
245 | int run_syscall(void) | |
246 | { | |
247 | long flags, bad_arg; | |
248 | ||
249 | prep_args(); | |
250 | ||
251 | if (kernel_is_64bit) | |
252 | call64_from_32(poison_regs64); | |
253 | /*print_regs64();*/ | |
254 | ||
255 | asm("\n" | |
256 | /* Try 6-arg syscall: pselect. It should return quickly */ | |
257 | " push %%ebp\n" | |
258 | " mov $308, %%eax\n" /* PSELECT */ | |
259 | " mov nfds, %%ebx\n" /* ebx arg1 */ | |
260 | " mov $rfds, %%ecx\n" /* ecx arg2 */ | |
261 | " mov $wfds, %%edx\n" /* edx arg3 */ | |
262 | " mov $efds, %%esi\n" /* esi arg4 */ | |
263 | " mov $timeout, %%edi\n" /* edi arg5 */ | |
264 | " mov $sigmask_desc, %%ebp\n" /* %ebp arg6 */ | |
265 | " push $0x200ed7\n" /* set almost all flags */ | |
266 | " popf\n" /* except TF, IOPL, NT, RF, VM, AC, VIF, VIP */ | |
267 | " call *syscall_addr\n" | |
268 | /* Check that registers are not clobbered */ | |
269 | " pushf\n" | |
270 | " pop %%eax\n" | |
271 | " cld\n" | |
272 | " cmp nfds, %%ebx\n" /* ebx arg1 */ | |
273 | " mov $1, %%ebx\n" | |
274 | " jne 1f\n" | |
275 | " cmp $rfds, %%ecx\n" /* ecx arg2 */ | |
276 | " mov $2, %%ebx\n" | |
277 | " jne 1f\n" | |
278 | " cmp $wfds, %%edx\n" /* edx arg3 */ | |
279 | " mov $3, %%ebx\n" | |
280 | " jne 1f\n" | |
281 | " cmp $efds, %%esi\n" /* esi arg4 */ | |
282 | " mov $4, %%ebx\n" | |
283 | " jne 1f\n" | |
284 | " cmp $timeout, %%edi\n" /* edi arg5 */ | |
285 | " mov $5, %%ebx\n" | |
286 | " jne 1f\n" | |
287 | " cmpl $sigmask_desc, %%ebp\n" /* %ebp arg6 */ | |
288 | " mov $6, %%ebx\n" | |
289 | " jne 1f\n" | |
290 | " mov $0, %%ebx\n" | |
291 | "1:\n" | |
292 | " pop %%ebp\n" | |
293 | : "=a" (flags), "=b" (bad_arg) | |
294 | : | |
295 | : "cx", "dx", "si", "di" | |
296 | ); | |
297 | ||
298 | if (kernel_is_64bit) { | |
299 | memset(®s64, 0x77, sizeof(regs64)); | |
300 | call64_from_32(get_regs64); | |
301 | /*print_regs64();*/ | |
302 | } | |
303 | ||
304 | /* | |
305 | * On paravirt kernels, flags are not preserved across syscalls. | |
306 | * Thus, we do not consider it a bug if some are changed. | |
307 | * We just show ones which do. | |
308 | */ | |
309 | if ((0x200ed7 ^ flags) != 0) { | |
310 | print_flags("[WARN]\tFlags before", 0x200ed7); | |
311 | print_flags("[WARN]\tFlags after", flags); | |
312 | print_flags("[WARN]\tFlags change", (0x200ed7 ^ flags)); | |
313 | } | |
314 | ||
315 | if (bad_arg) { | |
316 | printf("[FAIL]\targ#%ld clobbered\n", bad_arg); | |
317 | return 1; | |
318 | } | |
319 | printf("[OK]\tArguments are preserved across syscall\n"); | |
320 | ||
321 | return check_regs64(); | |
322 | } | |
323 | ||
324 | int run_syscall_twice() | |
325 | { | |
326 | int exitcode = 0; | |
327 | long sv; | |
328 | ||
329 | if (syscall_addr) { | |
330 | printf("[RUN]\tExecuting 6-argument 32-bit syscall via VDSO\n"); | |
331 | exitcode = run_syscall(); | |
332 | } | |
333 | sv = syscall_addr; | |
334 | syscall_addr = (long)&int80; | |
335 | printf("[RUN]\tExecuting 6-argument 32-bit syscall via INT 80\n"); | |
336 | exitcode += run_syscall(); | |
337 | syscall_addr = sv; | |
338 | return exitcode; | |
339 | } | |
340 | ||
341 | void ptrace_me() | |
342 | { | |
343 | pid_t pid; | |
344 | ||
345 | fflush(NULL); | |
346 | pid = fork(); | |
347 | if (pid < 0) | |
348 | exit(1); | |
349 | if (pid == 0) { | |
350 | /* child */ | |
351 | if (ptrace(PTRACE_TRACEME, 0L, 0L, 0L) != 0) | |
352 | exit(0); | |
353 | raise(SIGSTOP); | |
354 | return; | |
355 | } | |
356 | /* parent */ | |
357 | printf("[RUN]\tRunning tests under ptrace\n"); | |
358 | while (1) { | |
359 | int status; | |
360 | pid = waitpid(-1, &status, __WALL); | |
361 | if (WIFEXITED(status)) | |
362 | exit(WEXITSTATUS(status)); | |
363 | if (WIFSIGNALED(status)) | |
364 | exit(WTERMSIG(status)); | |
365 | if (pid <= 0 || !WIFSTOPPED(status)) /* paranoia */ | |
366 | exit(255); | |
367 | /* | |
368 | * Note: we do not inject sig = WSTOPSIG(status). | |
369 | * We probably should, but careful: do not inject SIGTRAP | |
370 | * generated by syscall entry/exit stops. | |
371 | * That kills the child. | |
372 | */ | |
373 | ptrace(PTRACE_SYSCALL, pid, 0L, 0L /*sig*/); | |
374 | } | |
375 | } | |
376 | ||
377 | int main(int argc, char **argv, char **envp) | |
378 | { | |
379 | int exitcode = 0; | |
380 | int cs; | |
381 | ||
382 | asm("\n" | |
383 | " movl %%cs, %%eax\n" | |
384 | : "=a" (cs) | |
385 | ); | |
386 | kernel_is_64bit = (cs == 0x23); | |
387 | if (!kernel_is_64bit) | |
388 | printf("[NOTE]\tNot a 64-bit kernel, won't test R8..R15 leaks\n"); | |
389 | ||
390 | /* This only works for non-static builds: | |
391 | * syscall_addr = dlsym(dlopen("linux-gate.so.1", RTLD_NOW), "__kernel_vsyscall"); | |
392 | */ | |
393 | syscall_addr = get_syscall(envp); | |
394 | ||
395 | exitcode += run_syscall_twice(); | |
396 | ptrace_me(); | |
397 | exitcode += run_syscall_twice(); | |
398 | ||
399 | return exitcode; | |
400 | } | |
401 | #endif |