Commit 04235c00 authored by Andy Lutomirski's avatar Andy Lutomirski Committed by Ingo Molnar
Browse files

selftests/x86: Add a test for ptrace syscall restart and arg modification 



This tests assumptions about how fast syscall works wrt pt_regs
and, in particular, what happens if IP is decremented by 2
during a syscall.

Signed-off-by: default avatarAndy Lutomirski <luto@kernel.org>
Cc: Andy Lutomirski <luto@amacapital.net>
Cc: Borislav Petkov <bp@alien8.de>
Cc: Brian Gerst <brgerst@gmail.com>
Cc: Denys Vlasenko <dvlasenk@redhat.com>
Cc: H. Peter Anvin <hpa@zytor.com>
Cc: Linus Torvalds <torvalds@linux-foundation.org>
Cc: Peter Zijlstra <peterz@infradead.org>
Cc: Shuah Khan <shuahkh@osg.samsung.com>
Cc: Thomas Gleixner <tglx@linutronix.de>
Cc: linux-kernel@vger.kernel.org
Link: http://lkml.kernel.org/r/1c44dbfe59000ba135bbf35ccc5d2433a0b31618.1444091584.git.luto@kernel.org


Signed-off-by: default avatarIngo Molnar <mingo@kernel.org>
parent 3b56aae3

tools/testing/selftests/x86/Makefile

+2 −1
Original line number Diff line number Diff line
@@ -4,7 +4,7 @@ include ../lib.mk 


.PHONY: all all_32 all_64 warn_32bit_failure clean



TARGETS_C_BOTHBITS := single_step_syscall sysret_ss_attrs ldt_gdt syscall_nt

TARGETS_C_BOTHBITS := single_step_syscall sysret_ss_attrs ldt_gdt syscall_nt ptrace_syscall

TARGETS_C_32BIT_ONLY := entry_from_vm86 syscall_arg_fault sigreturn test_syscall_vdso unwind_vdso



TARGETS_C_32BIT_ALL := $(TARGETS_C_BOTHBITS) $(TARGETS_C_32BIT_ONLY)
@@ -60,4 +60,5 @@ endif 


# Some tests have additional dependencies.

sysret_ss_attrs_64: thunks.S

ptrace_syscall_32: raw_syscall_helper_32.S

test_syscall_vdso_32: thunks_32.S

tools/testing/selftests/x86/ptrace_syscall.c

0 → 100644
+294 −0
Original line number Diff line number Diff line 
#define _GNU_SOURCE



#include <sys/ptrace.h>

#include <sys/types.h>

#include <sys/wait.h>

#include <sys/syscall.h>

#include <sys/user.h>

#include <unistd.h>

#include <errno.h>

#include <stddef.h>

#include <stdio.h>

#include <err.h>

#include <string.h>

#include <asm/ptrace-abi.h>

#include <sys/auxv.h>



/* Bitness-agnostic defines for user_regs_struct fields. */

#ifdef __x86_64__

# define user_syscall_nr	orig_rax

# define user_arg0		rdi

# define user_arg1		rsi

# define user_arg2		rdx

# define user_arg3		r10

# define user_arg4		r8

# define user_arg5		r9

# define user_ip		rip

# define user_ax		rax

#else

# define user_syscall_nr	orig_eax

# define user_arg0		ebx

# define user_arg1		ecx

# define user_arg2		edx

# define user_arg3		esi

# define user_arg4		edi

# define user_arg5		ebp

# define user_ip		eip

# define user_ax		eax

#endif



static int nerrs = 0;



struct syscall_args32 {

	uint32_t nr, arg0, arg1, arg2, arg3, arg4, arg5;

};



#ifdef __i386__

extern void sys32_helper(struct syscall_args32 *, void *);

extern void int80_and_ret(void);

#endif



/*

 * Helper to invoke int80 with controlled regs and capture the final regs.

 */

static void do_full_int80(struct syscall_args32 *args)

{

#ifdef __x86_64__

	register unsigned long bp asm("bp") = args->arg5;

	asm volatile ("int $0x80"

		      : "+a" (args->nr),

			"+b" (args->arg0), "+c" (args->arg1), "+d" (args->arg2),

			"+S" (args->arg3), "+D" (args->arg4), "+r" (bp));

	args->arg5 = bp;

#else

	sys32_helper(args, int80_and_ret);

#endif

}



#ifdef __i386__

static void (*vsyscall32)(void);



/*

 * Nasty helper to invoke AT_SYSINFO (i.e. __kernel_vsyscall) with

 * controlled regs and capture the final regs.  This is so nasty that it

 * crashes my copy of gdb :)

 */

static void do_full_vsyscall32(struct syscall_args32 *args)

{

	sys32_helper(args, vsyscall32);

}

#endif



static siginfo_t wait_trap(pid_t chld)

{

	siginfo_t si;

	if (waitid(P_PID, chld, &si, WEXITED|WSTOPPED) != 0)

		err(1, "waitid");

	if (si.si_pid != chld)

		errx(1, "got unexpected pid in event\n");

	if (si.si_code != CLD_TRAPPED)

		errx(1, "got unexpected event type %d\n", si.si_code);

	return si;

}



static void sethandler(int sig, void (*handler)(int, siginfo_t *, void *),

		       int flags)

{

	struct sigaction sa;

	memset(&sa, 0, sizeof(sa));

	sa.sa_sigaction = handler;

	sa.sa_flags = SA_SIGINFO | flags;

	sigemptyset(&sa.sa_mask);

	if (sigaction(sig, &sa, 0))

		err(1, "sigaction");

}



static void clearhandler(int sig)

{

	struct sigaction sa;

	memset(&sa, 0, sizeof(sa));

	sa.sa_handler = SIG_DFL;

	sigemptyset(&sa.sa_mask);

	if (sigaction(sig, &sa, 0))

		err(1, "sigaction");

}



#ifdef __x86_64__

# define REG_BP REG_RBP

#else

# define REG_BP REG_EBP

#endif



static void empty_handler(int sig, siginfo_t *si, void *ctx_void)

{

}



static void test_sys32_regs(void (*do_syscall)(struct syscall_args32 *))

{

	struct syscall_args32 args = {

		.nr = 224,	/* gettid */

		.arg0 = 10, .arg1 = 11, .arg2 = 12,

		.arg3 = 13, .arg4 = 14, .arg5 = 15,

	};



	do_syscall(&args);



	if (args.nr != getpid() ||

	    args.arg0 != 10 || args.arg1 != 11 || args.arg2 != 12 ||

	    args.arg3 != 13 || args.arg4 != 14 || args.arg5 != 15) {

		printf("[FAIL]\tgetpid() failed to preseve regs\n");

		nerrs++;

	} else {

		printf("[OK]\tgetpid() preserves regs\n");

	}



	sethandler(SIGUSR1, empty_handler, 0);



	args.nr = 37;	/* kill */

	args.arg0 = getpid();

	args.arg1 = SIGUSR1;

	do_syscall(&args);

	if (args.nr != 0 ||

	    args.arg0 != getpid() || args.arg1 != SIGUSR1 || args.arg2 != 12 ||

	    args.arg3 != 13 || args.arg4 != 14 || args.arg5 != 15) {

		printf("[FAIL]\tkill(getpid(), SIGUSR1) failed to preseve regs\n");

		nerrs++;

	} else {

		printf("[OK]\tkill(getpid(), SIGUSR1) preserves regs\n");

	}

	clearhandler(SIGUSR1);

}



static void test_ptrace_syscall_restart(void)

{

	printf("[RUN]\tptrace-induced syscall restart\n");

	pid_t chld = fork();

	if (chld < 0)

		err(1, "fork");



	if (chld == 0) {

		if (ptrace(PTRACE_TRACEME, 0, 0, 0) != 0)

			err(1, "PTRACE_TRACEME");



		printf("\tChild will make one syscall\n");

		raise(SIGSTOP);



		syscall(SYS_gettid, 10, 11, 12, 13, 14, 15);

		_exit(0);

	}



	int status;



	/* Wait for SIGSTOP. */

	if (waitpid(chld, &status, 0) != chld || !WIFSTOPPED(status))

		err(1, "waitpid");



	struct user_regs_struct regs;



	printf("[RUN]\tSYSEMU\n");

	if (ptrace(PTRACE_SYSEMU, chld, 0, 0) != 0)

		err(1, "PTRACE_SYSCALL");

	wait_trap(chld);



	if (ptrace(PTRACE_GETREGS, chld, 0, &regs) != 0)

		err(1, "PTRACE_GETREGS");



	if (regs.user_syscall_nr != SYS_gettid ||

	    regs.user_arg0 != 10 || regs.user_arg1 != 11 ||

	    regs.user_arg2 != 12 || regs.user_arg3 != 13 ||

	    regs.user_arg4 != 14 || regs.user_arg5 != 15) {

		printf("[FAIL]\tInitial args are wrong (nr=%lu, args=%lu %lu %lu %lu %lu %lu)\n", (unsigned long)regs.user_syscall_nr, (unsigned long)regs.user_arg0, (unsigned long)regs.user_arg1, (unsigned long)regs.user_arg2, (unsigned long)regs.user_arg3, (unsigned long)regs.user_arg4, (unsigned long)regs.user_arg5);

		nerrs++;

	} else {

		printf("[OK]\tInitial nr and args are correct\n");

	}



	printf("[RUN]\tRestart the syscall (ip = 0x%lx)\n",

	       (unsigned long)regs.user_ip);



	/*

	 * This does exactly what it appears to do if syscall is int80 or

	 * SYSCALL64.  For SYSCALL32 or SYSENTER, though, this is highly

	 * magical.  It needs to work so that ptrace and syscall restart

	 * work as expected.

	 */

	regs.user_ax = regs.user_syscall_nr;

	regs.user_ip -= 2;

	if (ptrace(PTRACE_SETREGS, chld, 0, &regs) != 0)

		err(1, "PTRACE_SETREGS");



	if (ptrace(PTRACE_SYSEMU, chld, 0, 0) != 0)

		err(1, "PTRACE_SYSCALL");

	wait_trap(chld);



	if (ptrace(PTRACE_GETREGS, chld, 0, &regs) != 0)

		err(1, "PTRACE_GETREGS");



	if (regs.user_syscall_nr != SYS_gettid ||

	    regs.user_arg0 != 10 || regs.user_arg1 != 11 ||

	    regs.user_arg2 != 12 || regs.user_arg3 != 13 ||

	    regs.user_arg4 != 14 || regs.user_arg5 != 15) {

		printf("[FAIL]\tRestart nr or args are wrong (nr=%lu, args=%lu %lu %lu %lu %lu %lu)\n", (unsigned long)regs.user_syscall_nr, (unsigned long)regs.user_arg0, (unsigned long)regs.user_arg1, (unsigned long)regs.user_arg2, (unsigned long)regs.user_arg3, (unsigned long)regs.user_arg4, (unsigned long)regs.user_arg5);

		nerrs++;

	} else {

		printf("[OK]\tRestarted nr and args are correct\n");

	}



	printf("[RUN]\tChange nr and args and restart the syscall (ip = 0x%lx)\n",

	       (unsigned long)regs.user_ip);



	regs.user_ax = SYS_getpid;

	regs.user_arg0 = 20;

	regs.user_arg1 = 21;

	regs.user_arg2 = 22;

	regs.user_arg3 = 23;

	regs.user_arg4 = 24;

	regs.user_arg5 = 25;

	regs.user_ip -= 2;



	if (ptrace(PTRACE_SETREGS, chld, 0, &regs) != 0)

		err(1, "PTRACE_SETREGS");



	if (ptrace(PTRACE_SYSEMU, chld, 0, 0) != 0)

		err(1, "PTRACE_SYSCALL");

	wait_trap(chld);



	if (ptrace(PTRACE_GETREGS, chld, 0, &regs) != 0)

		err(1, "PTRACE_GETREGS");



	if (regs.user_syscall_nr != SYS_getpid ||

	    regs.user_arg0 != 20 || regs.user_arg1 != 21 || regs.user_arg2 != 22 ||

	    regs.user_arg3 != 23 || regs.user_arg4 != 24 || regs.user_arg5 != 25) {

		printf("[FAIL]\tRestart nr or args are wrong (nr=%lu, args=%lu %lu %lu %lu %lu %lu)\n", (unsigned long)regs.user_syscall_nr, (unsigned long)regs.user_arg0, (unsigned long)regs.user_arg1, (unsigned long)regs.user_arg2, (unsigned long)regs.user_arg3, (unsigned long)regs.user_arg4, (unsigned long)regs.user_arg5);

		nerrs++;

	} else {

		printf("[OK]\tReplacement nr and args are correct\n");

	}



	if (ptrace(PTRACE_CONT, chld, 0, 0) != 0)

		err(1, "PTRACE_CONT");

	if (waitpid(chld, &status, 0) != chld)

		err(1, "waitpid");

	if (!WIFEXITED(status) || WEXITSTATUS(status) != 0) {

		printf("[FAIL]\tChild failed\n");

		nerrs++;

	} else {

		printf("[OK]\tChild exited cleanly\n");

	}

}



int main()

{

	printf("[RUN]\tCheck int80 return regs\n");

	test_sys32_regs(do_full_int80);



#if defined(__i386__) && (!defined(__GLIBC__) || __GLIBC__ > 2 || __GLIBC_MINOR__ >= 16)

	vsyscall32 = (void *)getauxval(AT_SYSINFO);

	printf("[RUN]\tCheck AT_SYSINFO return regs\n");

	test_sys32_regs(do_full_vsyscall32);

#endif



	test_ptrace_syscall_restart();



	return 0;

}

tools/testing/selftests/x86/raw_syscall_helper_32.S

0 → 100644
+46 −0
Original line number Diff line number Diff line 
.global sys32_helper

sys32_helper:

	/* Args: syscall_args_32*, function pointer */

	pushl	%ebp

	pushl	%ebx

	pushl	%esi

	pushl	%edi

	movl	5*4(%esp), %eax	/* pointer to args struct */



	movl	1*4(%eax), %ebx

	movl	2*4(%eax), %ecx

	movl	3*4(%eax), %edx

	movl	4*4(%eax), %esi

	movl	5*4(%eax), %edi

	movl	6*4(%eax), %ebp

	movl	0*4(%eax), %eax



	call	*(6*4)(%esp)	/* Do the syscall */



	/* Now we need to recover without losing any reg values */

	pushl	%eax

	movl	6*4(%esp), %eax

	popl	0*4(%eax)

	movl	%ebx, 1*4(%eax)

	movl	%ecx, 2*4(%eax)

	movl	%edx, 3*4(%eax)

	movl	%esi, 4*4(%eax)

	movl	%edi, 5*4(%eax)

	movl	%ebp, 6*4(%eax)



	popl	%edi

	popl	%esi

	popl	%ebx

	popl	%ebp

	ret



	.type sys32_helper, @function

	.size sys32_helper, .-sys32_helper



.global int80_and_ret

int80_and_ret:

	int	$0x80

	ret



	.type int80_and_ret, @function

	.size int80_and_ret, .-int80_and_ret

CRA Git | Maintained and supported by SUSTech CRA and CCSE