1// SPDX-License-Identifier: GPL-2.0-only
2/*
3 * syscall_arg_fault.c - tests faults 32-bit fast syscall stack args
4 * Copyright (c) 2015 Andrew Lutomirski
5 */
6
7#define _GNU_SOURCE
8
9#include <stdlib.h>
10#include <stdio.h>
11#include <string.h>
12#include <sys/signal.h>
13#include <sys/ucontext.h>
14#include <err.h>
15#include <setjmp.h>
16#include <errno.h>
17
18#include "helpers.h"
19
20/* Our sigaltstack scratch space. */
21static unsigned char altstack_data[SIGSTKSZ];
22
23static void sethandler(int sig, void (*handler)(int, siginfo_t *, void *),
24		       int flags)
25{
26	struct sigaction sa;
27	memset(&sa, 0, sizeof(sa));
28	sa.sa_sigaction = handler;
29	sa.sa_flags = SA_SIGINFO | flags;
30	sigemptyset(&sa.sa_mask);
31	if (sigaction(sig, &sa, 0))
32		err(1, "sigaction");
33}
34
35static volatile sig_atomic_t sig_traps;
36static sigjmp_buf jmpbuf;
37
38static volatile sig_atomic_t n_errs;
39
40#ifdef __x86_64__
41#define REG_AX REG_RAX
42#define REG_IP REG_RIP
43#else
44#define REG_AX REG_EAX
45#define REG_IP REG_EIP
46#endif
47
48static void sigsegv_or_sigbus(int sig, siginfo_t *info, void *ctx_void)
49{
50	ucontext_t *ctx = (ucontext_t*)ctx_void;
51	long ax = (long)ctx->uc_mcontext.gregs[REG_AX];
52
53	if (ax != -EFAULT && ax != -ENOSYS) {
54		printf("[FAIL]\tAX had the wrong value: 0x%lx\n",
55		       (unsigned long)ax);
56		printf("\tIP = 0x%lx\n", (unsigned long)ctx->uc_mcontext.gregs[REG_IP]);
57		n_errs++;
58	} else {
59		printf("[OK]\tSeems okay\n");
60	}
61
62	siglongjmp(jmpbuf, 1);
63}
64
65static volatile sig_atomic_t sigtrap_consecutive_syscalls;
66
67static void sigtrap(int sig, siginfo_t *info, void *ctx_void)
68{
69	/*
70	 * KVM has some bugs that can cause us to stop making progress.
71	 * detect them and complain, but don't infinite loop or fail the
72	 * test.
73	 */
74
75	ucontext_t *ctx = (ucontext_t*)ctx_void;
76	unsigned short *ip = (unsigned short *)ctx->uc_mcontext.gregs[REG_IP];
77
78	if (*ip == 0x340f || *ip == 0x050f) {
79		/* The trap was on SYSCALL or SYSENTER */
80		sigtrap_consecutive_syscalls++;
81		if (sigtrap_consecutive_syscalls > 3) {
82			printf("[WARN]\tGot stuck single-stepping -- you probably have a KVM bug\n");
83			siglongjmp(jmpbuf, 1);
84		}
85	} else {
86		sigtrap_consecutive_syscalls = 0;
87	}
88}
89
90static void sigill(int sig, siginfo_t *info, void *ctx_void)
91{
92	ucontext_t *ctx = (ucontext_t*)ctx_void;
93	unsigned short *ip = (unsigned short *)ctx->uc_mcontext.gregs[REG_IP];
94
95	if (*ip == 0x0b0f) {
96		/* one of the ud2 instructions faulted */
97		printf("[OK]\tSYSCALL returned normally\n");
98	} else {
99		printf("[SKIP]\tIllegal instruction\n");
100	}
101	siglongjmp(jmpbuf, 1);
102}
103
104int main()
105{
106	stack_t stack = {
107		.ss_sp = altstack_data,
108		.ss_size = SIGSTKSZ,
109	};
110	if (sigaltstack(&stack, NULL) != 0)
111		err(1, "sigaltstack");
112
113	sethandler(SIGSEGV, sigsegv_or_sigbus, SA_ONSTACK);
114	/*
115	 * The actual exception can vary.  On Atom CPUs, we get #SS
116	 * instead of #PF when the vDSO fails to access the stack when
117	 * ESP is too close to 2^32, and #SS causes SIGBUS.
118	 */
119	sethandler(SIGBUS, sigsegv_or_sigbus, SA_ONSTACK);
120	sethandler(SIGILL, sigill, SA_ONSTACK);
121
122	/*
123	 * Exercise another nasty special case.  The 32-bit SYSCALL
124	 * and SYSENTER instructions (even in compat mode) each
125	 * clobber one register.  A Linux system call has a syscall
126	 * number and six arguments, and the user stack pointer
127	 * needs to live in some register on return.  That means
128	 * that we need eight registers, but SYSCALL and SYSENTER
129	 * only preserve seven registers.  As a result, one argument
130	 * ends up on the stack.  The stack is user memory, which
131	 * means that the kernel can fail to read it.
132	 *
133	 * The 32-bit fast system calls don't have a defined ABI:
134	 * we're supposed to invoke them through the vDSO.  So we'll
135	 * fudge it: we set all regs to invalid pointer values and
136	 * invoke the entry instruction.  The return will fail no
137	 * matter what, and we completely lose our program state,
138	 * but we can fix it up with a signal handler.
139	 */
140
141	printf("[RUN]\tSYSENTER with invalid state\n");
142	if (sigsetjmp(jmpbuf, 1) == 0) {
143		asm volatile (
144			"movl $-1, %%eax\n\t"
145			"movl $-1, %%ebx\n\t"
146			"movl $-1, %%ecx\n\t"
147			"movl $-1, %%edx\n\t"
148			"movl $-1, %%esi\n\t"
149			"movl $-1, %%edi\n\t"
150			"movl $-1, %%ebp\n\t"
151			"movl $-1, %%esp\n\t"
152			"sysenter"
153			: : : "memory", "flags");
154	}
155
156	printf("[RUN]\tSYSCALL with invalid state\n");
157	if (sigsetjmp(jmpbuf, 1) == 0) {
158		asm volatile (
159			"movl $-1, %%eax\n\t"
160			"movl $-1, %%ebx\n\t"
161			"movl $-1, %%ecx\n\t"
162			"movl $-1, %%edx\n\t"
163			"movl $-1, %%esi\n\t"
164			"movl $-1, %%edi\n\t"
165			"movl $-1, %%ebp\n\t"
166			"movl $-1, %%esp\n\t"
167			"syscall\n\t"
168			"ud2"		/* make sure we recover cleanly */
169			: : : "memory", "flags");
170	}
171
172	printf("[RUN]\tSYSENTER with TF and invalid state\n");
173	sethandler(SIGTRAP, sigtrap, SA_ONSTACK);
174
175	if (sigsetjmp(jmpbuf, 1) == 0) {
176		sigtrap_consecutive_syscalls = 0;
177		set_eflags(get_eflags() | X86_EFLAGS_TF);
178		asm volatile (
179			"movl $-1, %%eax\n\t"
180			"movl $-1, %%ebx\n\t"
181			"movl $-1, %%ecx\n\t"
182			"movl $-1, %%edx\n\t"
183			"movl $-1, %%esi\n\t"
184			"movl $-1, %%edi\n\t"
185			"movl $-1, %%ebp\n\t"
186			"movl $-1, %%esp\n\t"
187			"sysenter"
188			: : : "memory", "flags");
189	}
190	set_eflags(get_eflags() & ~X86_EFLAGS_TF);
191
192	printf("[RUN]\tSYSCALL with TF and invalid state\n");
193	if (sigsetjmp(jmpbuf, 1) == 0) {
194		sigtrap_consecutive_syscalls = 0;
195		set_eflags(get_eflags() | X86_EFLAGS_TF);
196		asm volatile (
197			"movl $-1, %%eax\n\t"
198			"movl $-1, %%ebx\n\t"
199			"movl $-1, %%ecx\n\t"
200			"movl $-1, %%edx\n\t"
201			"movl $-1, %%esi\n\t"
202			"movl $-1, %%edi\n\t"
203			"movl $-1, %%ebp\n\t"
204			"movl $-1, %%esp\n\t"
205			"syscall\n\t"
206			"ud2"		/* make sure we recover cleanly */
207			: : : "memory", "flags");
208	}
209	set_eflags(get_eflags() & ~X86_EFLAGS_TF);
210
211#ifdef __x86_64__
212	printf("[RUN]\tSYSENTER with TF, invalid state, and GSBASE < 0\n");
213
214	if (sigsetjmp(jmpbuf, 1) == 0) {
215		sigtrap_consecutive_syscalls = 0;
216
217		asm volatile ("wrgsbase %%rax\n\t"
218			      :: "a" (0xffffffffffff0000UL));
219
220		set_eflags(get_eflags() | X86_EFLAGS_TF);
221		asm volatile (
222			"movl $-1, %%eax\n\t"
223			"movl $-1, %%ebx\n\t"
224			"movl $-1, %%ecx\n\t"
225			"movl $-1, %%edx\n\t"
226			"movl $-1, %%esi\n\t"
227			"movl $-1, %%edi\n\t"
228			"movl $-1, %%ebp\n\t"
229			"movl $-1, %%esp\n\t"
230			"sysenter"
231			: : : "memory", "flags");
232	}
233	set_eflags(get_eflags() & ~X86_EFLAGS_TF);
234#endif
235
236	return 0;
237}
238