selftests/x86: Add a test for ptrace syscall restart and arg modification

This tests assumptions about how fast syscall works wrt pt_regs
and, in particular, what happens if IP is decremented by 2
during a syscall.

Signed-off-by: Andy Lutomirski <luto@kernel.org>
Cc: Andy Lutomirski <luto@amacapital.net>
Cc: Borislav Petkov <bp@alien8.de>
Cc: Brian Gerst <brgerst@gmail.com>
Cc: Denys Vlasenko <dvlasenk@redhat.com>
Cc: H. Peter Anvin <hpa@zytor.com>
Cc: Linus Torvalds <torvalds@linux-foundation.org>
Cc: Peter Zijlstra <peterz@infradead.org>
Cc: Shuah Khan <shuahkh@osg.samsung.com>
Cc: Thomas Gleixner <tglx@linutronix.de>
Cc: linux-kernel@vger.kernel.org
Link: http://lkml.kernel.org/r/1c44dbfe59000ba135bbf35ccc5d2433a0b31618.1444091584.git.luto@kernel.org
Signed-off-by: Ingo Molnar <mingo@kernel.org>

diff --git a/tools/testing/selftests/x86/Makefile b/tools/testing/selftests/x86/Makefile
index 75413529f4a241b651f7138bdb41a7cc7f5760b8..389701f599406bffa76980d98f27a0cb913ac1d5 100644 (file)
--- a/tools/testing/selftests/x86/Makefile
+++ b/tools/testing/selftests/x86/Makefile
@@ -4,7 +4,7 @@ include ../lib.mk
 
 .PHONY: all all_32 all_64 warn_32bit_failure clean
 
-TARGETS_C_BOTHBITS := single_step_syscall sysret_ss_attrs ldt_gdt syscall_nt
+TARGETS_C_BOTHBITS := single_step_syscall sysret_ss_attrs ldt_gdt syscall_nt ptrace_syscall
 TARGETS_C_32BIT_ONLY := entry_from_vm86 syscall_arg_fault sigreturn test_syscall_vdso unwind_vdso
 
 TARGETS_C_32BIT_ALL := $(TARGETS_C_BOTHBITS) $(TARGETS_C_32BIT_ONLY)
@@ -60,4 +60,5 @@ endif
 
 # Some tests have additional dependencies.
 sysret_ss_attrs_64: thunks.S
+ptrace_syscall_32: raw_syscall_helper_32.S
 test_syscall_vdso_32: thunks_32.S

diff --git a/tools/testing/selftests/x86/ptrace_syscall.c b/tools/testing/selftests/x86/ptrace_syscall.c
new file mode 100644 (file)
index 0000000..5105b49
--- /dev/null
+++ b/tools/testing/selftests/x86/ptrace_syscall.c
@@ -0,0 +1,294 @@
+#define _GNU_SOURCE
+
+#include <sys/ptrace.h>
+#include <sys/types.h>
+#include <sys/wait.h>
+#include <sys/syscall.h>
+#include <sys/user.h>
+#include <unistd.h>
+#include <errno.h>
+#include <stddef.h>
+#include <stdio.h>
+#include <err.h>
+#include <string.h>
+#include <asm/ptrace-abi.h>
+#include <sys/auxv.h>
+
+/* Bitness-agnostic defines for user_regs_struct fields. */
+#ifdef __x86_64__
+# define user_syscall_nr       orig_rax
+# define user_arg0             rdi
+# define user_arg1             rsi
+# define user_arg2             rdx
+# define user_arg3             r10
+# define user_arg4             r8
+# define user_arg5             r9
+# define user_ip               rip
+# define user_ax               rax
+#else
+# define user_syscall_nr       orig_eax
+# define user_arg0             ebx
+# define user_arg1             ecx
+# define user_arg2             edx
+# define user_arg3             esi
+# define user_arg4             edi
+# define user_arg5             ebp
+# define user_ip               eip
+# define user_ax               eax
+#endif
+
+static int nerrs = 0;
+
+struct syscall_args32 {
+       uint32_t nr, arg0, arg1, arg2, arg3, arg4, arg5;
+};
+
+#ifdef __i386__
+extern void sys32_helper(struct syscall_args32 *, void *);
+extern void int80_and_ret(void);
+#endif
+
+/*
+ * Helper to invoke int80 with controlled regs and capture the final regs.
+ */
+static void do_full_int80(struct syscall_args32 *args)
+{
+#ifdef __x86_64__
+       register unsigned long bp asm("bp") = args->arg5;
+       asm volatile ("int $0x80"
+                     : "+a" (args->nr),
+                       "+b" (args->arg0), "+c" (args->arg1), "+d" (args->arg2),
+                       "+S" (args->arg3), "+D" (args->arg4), "+r" (bp));
+       args->arg5 = bp;
+#else
+       sys32_helper(args, int80_and_ret);
+#endif
+}
+
+#ifdef __i386__
+static void (*vsyscall32)(void);
+
+/*
+ * Nasty helper to invoke AT_SYSINFO (i.e. __kernel_vsyscall) with
+ * controlled regs and capture the final regs.  This is so nasty that it
+ * crashes my copy of gdb :)
+ */
+static void do_full_vsyscall32(struct syscall_args32 *args)
+{
+       sys32_helper(args, vsyscall32);
+}
+#endif
+
+static siginfo_t wait_trap(pid_t chld)
+{
+       siginfo_t si;
+       if (waitid(P_PID, chld, &si, WEXITED|WSTOPPED) != 0)
+               err(1, "waitid");
+       if (si.si_pid != chld)
+               errx(1, "got unexpected pid in event\n");
+       if (si.si_code != CLD_TRAPPED)
+               errx(1, "got unexpected event type %d\n", si.si_code);
+       return si;
+}
+
+static void sethandler(int sig, void (*handler)(int, siginfo_t *, void *),
+                      int flags)
+{
+       struct sigaction sa;
+       memset(&sa, 0, sizeof(sa));
+       sa.sa_sigaction = handler;
+       sa.sa_flags = SA_SIGINFO | flags;
+       sigemptyset(&sa.sa_mask);
+       if (sigaction(sig, &sa, 0))
+               err(1, "sigaction");
+}
+
+static void clearhandler(int sig)
+{
+       struct sigaction sa;
+       memset(&sa, 0, sizeof(sa));
+       sa.sa_handler = SIG_DFL;
+       sigemptyset(&sa.sa_mask);
+       if (sigaction(sig, &sa, 0))
+               err(1, "sigaction");
+}
+
+#ifdef __x86_64__
+# define REG_BP REG_RBP
+#else
+# define REG_BP REG_EBP
+#endif
+
+static void empty_handler(int sig, siginfo_t *si, void *ctx_void)
+{
+}
+
+static void test_sys32_regs(void (*do_syscall)(struct syscall_args32 *))
+{
+       struct syscall_args32 args = {
+               .nr = 224,      /* gettid */
+               .arg0 = 10, .arg1 = 11, .arg2 = 12,
+               .arg3 = 13, .arg4 = 14, .arg5 = 15,
+       };
+
+       do_syscall(&args);
+
+       if (args.nr != getpid() ||
+           args.arg0 != 10 || args.arg1 != 11 || args.arg2 != 12 ||
+           args.arg3 != 13 || args.arg4 != 14 || args.arg5 != 15) {
+               printf("[FAIL]\tgetpid() failed to preseve regs\n");
+               nerrs++;
+       } else {
+               printf("[OK]\tgetpid() preserves regs\n");
+       }
+
+       sethandler(SIGUSR1, empty_handler, 0);
+
+       args.nr = 37;   /* kill */
+       args.arg0 = getpid();
+       args.arg1 = SIGUSR1;
+       do_syscall(&args);
+       if (args.nr != 0 ||
+           args.arg0 != getpid() || args.arg1 != SIGUSR1 || args.arg2 != 12 ||
+           args.arg3 != 13 || args.arg4 != 14 || args.arg5 != 15) {
+               printf("[FAIL]\tkill(getpid(), SIGUSR1) failed to preseve regs\n");
+               nerrs++;
+       } else {
+               printf("[OK]\tkill(getpid(), SIGUSR1) preserves regs\n");
+       }
+       clearhandler(SIGUSR1);
+}
+
+static void test_ptrace_syscall_restart(void)
+{
+       printf("[RUN]\tptrace-induced syscall restart\n");
+       pid_t chld = fork();
+       if (chld < 0)
+               err(1, "fork");
+
+       if (chld == 0) {
+               if (ptrace(PTRACE_TRACEME, 0, 0, 0) != 0)
+                       err(1, "PTRACE_TRACEME");
+
+               printf("\tChild will make one syscall\n");
+               raise(SIGSTOP);
+
+               syscall(SYS_gettid, 10, 11, 12, 13, 14, 15);
+               _exit(0);
+       }
+
+       int status;
+
+       /* Wait for SIGSTOP. */
+       if (waitpid(chld, &status, 0) != chld || !WIFSTOPPED(status))
+               err(1, "waitpid");
+
+       struct user_regs_struct regs;
+
+       printf("[RUN]\tSYSEMU\n");
+       if (ptrace(PTRACE_SYSEMU, chld, 0, 0) != 0)
+               err(1, "PTRACE_SYSCALL");
+       wait_trap(chld);
+
+       if (ptrace(PTRACE_GETREGS, chld, 0, &regs) != 0)
+               err(1, "PTRACE_GETREGS");
+
+       if (regs.user_syscall_nr != SYS_gettid ||
+           regs.user_arg0 != 10 || regs.user_arg1 != 11 ||
+           regs.user_arg2 != 12 || regs.user_arg3 != 13 ||
+           regs.user_arg4 != 14 || regs.user_arg5 != 15) {
+               printf("[FAIL]\tInitial args are wrong (nr=%lu, args=%lu %lu %lu %lu %lu %lu)\n", (unsigned long)regs.user_syscall_nr, (unsigned long)regs.user_arg0, (unsigned long)regs.user_arg1, (unsigned long)regs.user_arg2, (unsigned long)regs.user_arg3, (unsigned long)regs.user_arg4, (unsigned long)regs.user_arg5);
+               nerrs++;
+       } else {
+               printf("[OK]\tInitial nr and args are correct\n");
+       }
+
+       printf("[RUN]\tRestart the syscall (ip = 0x%lx)\n",
+              (unsigned long)regs.user_ip);
+
+       /*
+        * This does exactly what it appears to do if syscall is int80 or
+        * SYSCALL64.  For SYSCALL32 or SYSENTER, though, this is highly
+        * magical.  It needs to work so that ptrace and syscall restart
+        * work as expected.
+        */
+       regs.user_ax = regs.user_syscall_nr;
+       regs.user_ip -= 2;
+       if (ptrace(PTRACE_SETREGS, chld, 0, &regs) != 0)
+               err(1, "PTRACE_SETREGS");
+
+       if (ptrace(PTRACE_SYSEMU, chld, 0, 0) != 0)
+               err(1, "PTRACE_SYSCALL");
+       wait_trap(chld);
+
+       if (ptrace(PTRACE_GETREGS, chld, 0, &regs) != 0)
+               err(1, "PTRACE_GETREGS");
+
+       if (regs.user_syscall_nr != SYS_gettid ||
+           regs.user_arg0 != 10 || regs.user_arg1 != 11 ||
+           regs.user_arg2 != 12 || regs.user_arg3 != 13 ||
+           regs.user_arg4 != 14 || regs.user_arg5 != 15) {
+               printf("[FAIL]\tRestart nr or args are wrong (nr=%lu, args=%lu %lu %lu %lu %lu %lu)\n", (unsigned long)regs.user_syscall_nr, (unsigned long)regs.user_arg0, (unsigned long)regs.user_arg1, (unsigned long)regs.user_arg2, (unsigned long)regs.user_arg3, (unsigned long)regs.user_arg4, (unsigned long)regs.user_arg5);
+               nerrs++;
+       } else {
+               printf("[OK]\tRestarted nr and args are correct\n");
+       }
+
+       printf("[RUN]\tChange nr and args and restart the syscall (ip = 0x%lx)\n",
+              (unsigned long)regs.user_ip);
+
+       regs.user_ax = SYS_getpid;
+       regs.user_arg0 = 20;
+       regs.user_arg1 = 21;
+       regs.user_arg2 = 22;
+       regs.user_arg3 = 23;
+       regs.user_arg4 = 24;
+       regs.user_arg5 = 25;
+       regs.user_ip -= 2;
+
+       if (ptrace(PTRACE_SETREGS, chld, 0, &regs) != 0)
+               err(1, "PTRACE_SETREGS");
+
+       if (ptrace(PTRACE_SYSEMU, chld, 0, 0) != 0)
+               err(1, "PTRACE_SYSCALL");
+       wait_trap(chld);
+
+       if (ptrace(PTRACE_GETREGS, chld, 0, &regs) != 0)
+               err(1, "PTRACE_GETREGS");
+
+       if (regs.user_syscall_nr != SYS_getpid ||
+           regs.user_arg0 != 20 || regs.user_arg1 != 21 || regs.user_arg2 != 22 ||
+           regs.user_arg3 != 23 || regs.user_arg4 != 24 || regs.user_arg5 != 25) {
+               printf("[FAIL]\tRestart nr or args are wrong (nr=%lu, args=%lu %lu %lu %lu %lu %lu)\n", (unsigned long)regs.user_syscall_nr, (unsigned long)regs.user_arg0, (unsigned long)regs.user_arg1, (unsigned long)regs.user_arg2, (unsigned long)regs.user_arg3, (unsigned long)regs.user_arg4, (unsigned long)regs.user_arg5);
+               nerrs++;
+       } else {
+               printf("[OK]\tReplacement nr and args are correct\n");
+       }
+
+       if (ptrace(PTRACE_CONT, chld, 0, 0) != 0)
+               err(1, "PTRACE_CONT");
+       if (waitpid(chld, &status, 0) != chld)
+               err(1, "waitpid");
+       if (!WIFEXITED(status) || WEXITSTATUS(status) != 0) {
+               printf("[FAIL]\tChild failed\n");
+               nerrs++;
+       } else {
+               printf("[OK]\tChild exited cleanly\n");
+       }
+}
+
+int main()
+{
+       printf("[RUN]\tCheck int80 return regs\n");
+       test_sys32_regs(do_full_int80);
+
+#if defined(__i386__) && (!defined(__GLIBC__) || __GLIBC__ > 2 || __GLIBC_MINOR__ >= 16)
+       vsyscall32 = (void *)getauxval(AT_SYSINFO);
+       printf("[RUN]\tCheck AT_SYSINFO return regs\n");
+       test_sys32_regs(do_full_vsyscall32);
+#endif
+
+       test_ptrace_syscall_restart();
+
+       return 0;
+}

diff --git a/tools/testing/selftests/x86/raw_syscall_helper_32.S b/tools/testing/selftests/x86/raw_syscall_helper_32.S
new file mode 100644 (file)
index 0000000..534e71e
--- /dev/null
+++ b/tools/testing/selftests/x86/raw_syscall_helper_32.S
@@ -0,0 +1,46 @@
+.global sys32_helper
+sys32_helper:
+       /* Args: syscall_args_32*, function pointer */
+       pushl   %ebp
+       pushl   %ebx
+       pushl   %esi
+       pushl   %edi
+       movl    5*4(%esp), %eax /* pointer to args struct */
+
+       movl    1*4(%eax), %ebx
+       movl    2*4(%eax), %ecx
+       movl    3*4(%eax), %edx
+       movl    4*4(%eax), %esi
+       movl    5*4(%eax), %edi
+       movl    6*4(%eax), %ebp
+       movl    0*4(%eax), %eax
+
+       call    *(6*4)(%esp)    /* Do the syscall */
+
+       /* Now we need to recover without losing any reg values */
+       pushl   %eax
+       movl    6*4(%esp), %eax
+       popl    0*4(%eax)
+       movl    %ebx, 1*4(%eax)
+       movl    %ecx, 2*4(%eax)
+       movl    %edx, 3*4(%eax)
+       movl    %esi, 4*4(%eax)
+       movl    %edi, 5*4(%eax)
+       movl    %ebp, 6*4(%eax)
+
+       popl    %edi
+       popl    %esi
+       popl    %ebx
+       popl    %ebp
+       ret
+
+       .type sys32_helper, @function
+       .size sys32_helper, .-sys32_helper
+
+.global int80_and_ret
+int80_and_ret:
+       int     $0x80
+       ret
+
+       .type int80_and_ret, @function
+       .size int80_and_ret, .-int80_and_ret