1 // SPDX-License-Identifier: GPL-2.0-only
3 * single_step_syscall.c - single-steps various x86 syscalls
4 * Copyright (c) 2014-2015 Andrew Lutomirski
6 * This is a very simple series of tests that makes system calls with
7 * the TF flag set. This exercises some nasty kernel code in the
8 * SYSENTER case: SYSENTER does not clear TF, so SYSENTER with TF set
9 * immediately issues #DB from CPL 0. This requires special handling in
18 #include <sys/syscall.h>
24 #include <sys/signal.h>
25 #include <sys/ucontext.h>
31 #include <sys/ptrace.h>
34 static void sethandler(int sig, void (*handler)(int, siginfo_t *, void *),
38 memset(&sa, 0, sizeof(sa));
39 sa.sa_sigaction = handler;
40 sa.sa_flags = SA_SIGINFO | flags;
41 sigemptyset(&sa.sa_mask);
42 if (sigaction(sig, &sa, 0))
46 static volatile sig_atomic_t sig_traps;
49 # define REG_IP REG_RIP
51 # define INT80_CLOBBERS "r8", "r9", "r10", "r11"
53 # define REG_IP REG_EIP
55 # define INT80_CLOBBERS
58 static unsigned long get_eflags(void)
61 asm volatile ("pushf" WIDTH "\n\tpop" WIDTH " %0" : "=rm" (eflags));
65 static void set_eflags(unsigned long eflags)
67 asm volatile ("push" WIDTH " %0\n\tpopf" WIDTH
68 : : "rm" (eflags) : "flags");
71 #define X86_EFLAGS_TF (1UL << 8)
73 static void sigtrap(int sig, siginfo_t *info, void *ctx_void)
75 ucontext_t *ctx = (ucontext_t*)ctx_void;
77 if (get_eflags() & X86_EFLAGS_TF) {
78 set_eflags(get_eflags() & ~X86_EFLAGS_TF);
79 printf("[WARN]\tSIGTRAP handler had TF set\n");
85 if (sig_traps == 10000 || sig_traps == 10001) {
86 printf("[WARN]\tHit %d SIGTRAPs with si_addr 0x%lx, ip 0x%lx\n",
88 (unsigned long)info->si_addr,
89 (unsigned long)ctx->uc_mcontext.gregs[REG_IP]);
93 static void check_result(void)
95 unsigned long new_eflags = get_eflags();
96 set_eflags(new_eflags & ~X86_EFLAGS_TF);
99 printf("[FAIL]\tNo SIGTRAP\n");
103 if (!(new_eflags & X86_EFLAGS_TF)) {
104 printf("[FAIL]\tTF was cleared\n");
108 printf("[OK]\tSurvived with TF set and %d traps\n", (int)sig_traps);
118 sethandler(SIGTRAP, sigtrap, 0);
120 printf("[RUN]\tSet TF and check nop\n");
121 set_eflags(get_eflags() | X86_EFLAGS_TF);
122 asm volatile ("nop");
126 printf("[RUN]\tSet TF and check syscall-less opportunistic sysret\n");
127 set_eflags(get_eflags() | X86_EFLAGS_TF);
128 extern unsigned char post_nop[];
129 asm volatile ("pushf" WIDTH "\n\t"
130 "pop" WIDTH " %%r11\n\t"
133 : : "c" (post_nop) : "r11");
137 printf("[RUN]\tSet TF and check int80\n");
138 set_eflags(get_eflags() | X86_EFLAGS_TF);
139 asm volatile ("int $0x80" : "=a" (tmp) : "a" (SYS_getpid)
145 * This test is particularly interesting if fast syscalls use
146 * SYSENTER: it triggers a nasty design flaw in SYSENTER.
147 * Specifically, SYSENTER does not clear TF, so either SYSENTER
148 * or the next instruction traps at CPL0. (Of course, Intel
149 * mostly forgot to document exactly what happens here.) So we
150 * get a CPL0 fault with usergs (on 64-bit kernels) and possibly
151 * no stack. The only sane way the kernel can possibly handle
152 * it is to clear TF on return from the #DB handler, but this
153 * happens way too early to set TF in the saved pt_regs, so the
154 * kernel has to do something clever to avoid losing track of
157 * Needless to say, we've had bugs in this area.
159 syscall(SYS_getpid); /* Force symbol binding without TF set. */
160 printf("[RUN]\tSet TF and check a fast syscall\n");
161 set_eflags(get_eflags() | X86_EFLAGS_TF);
165 /* Now make sure that another fast syscall doesn't set TF again. */
166 printf("[RUN]\tFast syscall with TF cleared\n");
167 fflush(stdout); /* Force a syscall */
168 if (get_eflags() & X86_EFLAGS_TF) {
169 printf("[FAIL]\tTF is now set\n");
173 printf("[FAIL]\tGot SIGTRAP\n");
176 printf("[OK]\tNothing unexpected happened\n");