2 * 32-bit syscall ABI conformance test.
4 * Copyright (c) 2015 Denys Vlasenko
6 * This program is free software; you can redistribute it and/or modify
7 * it under the terms and conditions of the GNU General Public License,
8 * version 2, as published by the Free Software Foundation.
10 * This program is distributed in the hope it will be useful, but
11 * WITHOUT ANY WARRANTY; without even the implied warranty of
12 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
13 * General Public License for more details.
16 * Can be built statically:
17 * gcc -Os -Wall -static -m32 test_syscall_vdso.c thunks_32.S
28 #include <sys/types.h>
29 #include <sys/select.h>
32 #include <sys/ptrace.h>
35 #if !defined(__i386__)
36 int main(int argc, char **argv, char **envp)
38 printf("[SKIP]\tNot a 32-bit x86 userspace\n");
44 long get_syscall(char **envp)
47 while (*envp++ != NULL)
49 for (auxv = (void *)envp; auxv->a_type != AT_NULL; auxv++)
50 if (auxv->a_type == AT_SYSINFO)
51 return auxv->a_un.a_val;
52 printf("[WARN]\tAT_SYSINFO not supplied\n");
57 " .pushsection .text\n"
67 uint64_t rax, rbx, rcx, rdx;
68 uint64_t rsi, rdi, rbp, rsp;
69 uint64_t r8, r9, r10, r11;
70 uint64_t r12, r13, r14, r15;
76 " .pushsection .text\n"
80 " mov $regs64, %eax\n"
82 " movq %rbx, 1*8(%rax)\n"
83 " movq %rcx, 2*8(%rax)\n"
84 " movq %rdx, 3*8(%rax)\n"
85 " movq %rsi, 4*8(%rax)\n"
86 " movq %rdi, 5*8(%rax)\n"
87 " movq %rbp, 6*8(%rax)\n"
88 " movq %rsp, 7*8(%rax)\n"
89 " movq %r8, 8*8(%rax)\n"
90 " movq %r9, 9*8(%rax)\n"
91 " movq %r10, 10*8(%rax)\n"
92 " movq %r11, 11*8(%rax)\n"
93 " movq %r12, 12*8(%rax)\n"
94 " movq %r13, 13*8(%rax)\n"
95 " movq %r14, 14*8(%rax)\n"
96 " movq %r15, 15*8(%rax)\n"
99 " movq $0x7f7f7f7f, %r8\n"
101 " orq $0x7f7f7f7f, %r8\n"
113 extern void get_regs64(void);
114 extern void poison_regs64(void);
115 extern unsigned long call64_from_32(void (*function)(void));
116 void print_regs64(void)
118 if (!kernel_is_64bit)
120 printf("ax:%016llx bx:%016llx cx:%016llx dx:%016llx\n", regs64.rax, regs64.rbx, regs64.rcx, regs64.rdx);
121 printf("si:%016llx di:%016llx bp:%016llx sp:%016llx\n", regs64.rsi, regs64.rdi, regs64.rbp, regs64.rsp);
122 printf(" 8:%016llx 9:%016llx 10:%016llx 11:%016llx\n", regs64.r8 , regs64.r9 , regs64.r10, regs64.r11);
123 printf("12:%016llx 13:%016llx 14:%016llx 15:%016llx\n", regs64.r12, regs64.r13, regs64.r14, regs64.r15);
126 int check_regs64(void)
130 uint64_t *r64 = ®s64.r8;
132 if (!kernel_is_64bit)
136 if (*r64 == 0x7f7f7f7f7f7f7f7fULL)
137 continue; /* register did not change */
138 if (syscall_addr != (long)&int80) {
140 * Non-INT80 syscall entrypoints are allowed to clobber R8+ regs:
141 * either clear them to 0, or for R11, load EFLAGS.
146 printf("[NOTE]\tR11 has changed:%016llx - assuming clobbered by SYSRET insn\n", *r64);
150 /* INT80 syscall entrypoint can be used by
151 * 64-bit programs too, unlike SYSCALL/SYSENTER.
152 * Therefore it must preserve R12+
153 * (they are callee-saved registers in 64-bit C ABI).
155 * This was probably historically not intended,
156 * but R8..11 are clobbered (cleared to 0).
157 * IOW: they are the only registers which aren't
158 * preserved across INT80 syscall.
160 if (*r64 == 0 && num <= 11)
163 printf("[FAIL]\tR%d has changed:%016llx\n", num, *r64);
165 } while (r64++, ++num < 16);
168 printf("[OK]\tR8..R15 did not leak kernel data\n");
176 struct timespec timeout;
193 timeout.tv_nsec = 123;
194 sigemptyset(&sigmask);
195 sigaddset(&sigmask, SIGINT);
196 sigaddset(&sigmask, SIGUSR2);
197 sigaddset(&sigmask, SIGRTMAX);
198 sigmask_desc.sp = &sigmask;
199 sigmask_desc.sz = 8; /* bytes */
202 static void print_flags(const char *name, unsigned long r)
204 static const char *bitarray[] = {
205 "\n" ,"c\n" ,/* Carry Flag */
206 "0 " ,"1 " ,/* Bit 1 - always on */
207 "" ,"p " ,/* Parity Flag */
209 "" ,"a " ,/* Auxiliary carry Flag */
211 "" ,"z " ,/* Zero Flag */
212 "" ,"s " ,/* Sign Flag */
213 "" ,"t " ,/* Trap Flag */
214 "" ,"i " ,/* Interrupt Flag */
215 "" ,"d " ,/* Direction Flag */
216 "" ,"o " ,/* Overflow Flag */
217 "0 " ,"1 " ,/* I/O Privilege Level (2 bits) */
218 "0" ,"1" ,/* I/O Privilege Level (2 bits) */
219 "" ,"n " ,/* Nested Task */
221 "" ,"r " ,/* Resume Flag */
222 "" ,"v " ,/* Virtual Mode */
223 "" ,"ac " ,/* Alignment Check/Access Control */
224 "" ,"vif ",/* Virtual Interrupt Flag */
225 "" ,"vip ",/* Virtual Interrupt Pending */
226 "" ,"id " ,/* CPUID detection */
232 printf("%s=%016lx ", name, r);
233 bitstr = bitarray + 42;
236 printf("(extra bits are set) ");
238 if (bitstr[(r >> bit) & 1][0])
239 fputs(bitstr[(r >> bit) & 1], stdout);
245 int run_syscall(void)
252 call64_from_32(poison_regs64);
256 /* Try 6-arg syscall: pselect. It should return quickly */
258 " mov $308, %%eax\n" /* PSELECT */
259 " mov nfds, %%ebx\n" /* ebx arg1 */
260 " mov $rfds, %%ecx\n" /* ecx arg2 */
261 " mov $wfds, %%edx\n" /* edx arg3 */
262 " mov $efds, %%esi\n" /* esi arg4 */
263 " mov $timeout, %%edi\n" /* edi arg5 */
264 " mov $sigmask_desc, %%ebp\n" /* %ebp arg6 */
265 " push $0x200ed7\n" /* set almost all flags */
266 " popf\n" /* except TF, IOPL, NT, RF, VM, AC, VIF, VIP */
267 " call *syscall_addr\n"
268 /* Check that registers are not clobbered */
272 " cmp nfds, %%ebx\n" /* ebx arg1 */
275 " cmp $rfds, %%ecx\n" /* ecx arg2 */
278 " cmp $wfds, %%edx\n" /* edx arg3 */
281 " cmp $efds, %%esi\n" /* esi arg4 */
284 " cmp $timeout, %%edi\n" /* edi arg5 */
287 " cmpl $sigmask_desc, %%ebp\n" /* %ebp arg6 */
293 : "=a" (flags), "=b" (bad_arg)
295 : "cx", "dx", "si", "di"
298 if (kernel_is_64bit) {
299 memset(®s64, 0x77, sizeof(regs64));
300 call64_from_32(get_regs64);
305 * On paravirt kernels, flags are not preserved across syscalls.
306 * Thus, we do not consider it a bug if some are changed.
307 * We just show ones which do.
309 if ((0x200ed7 ^ flags) != 0) {
310 print_flags("[WARN]\tFlags before", 0x200ed7);
311 print_flags("[WARN]\tFlags after", flags);
312 print_flags("[WARN]\tFlags change", (0x200ed7 ^ flags));
316 printf("[FAIL]\targ#%ld clobbered\n", bad_arg);
319 printf("[OK]\tArguments are preserved across syscall\n");
321 return check_regs64();
324 int run_syscall_twice()
330 printf("[RUN]\tExecuting 6-argument 32-bit syscall via VDSO\n");
331 exitcode = run_syscall();
334 syscall_addr = (long)&int80;
335 printf("[RUN]\tExecuting 6-argument 32-bit syscall via INT 80\n");
336 exitcode += run_syscall();
351 if (ptrace(PTRACE_TRACEME, 0L, 0L, 0L) != 0)
357 printf("[RUN]\tRunning tests under ptrace\n");
360 pid = waitpid(-1, &status, __WALL);
361 if (WIFEXITED(status))
362 exit(WEXITSTATUS(status));
363 if (WIFSIGNALED(status))
364 exit(WTERMSIG(status));
365 if (pid <= 0 || !WIFSTOPPED(status)) /* paranoia */
368 * Note: we do not inject sig = WSTOPSIG(status).
369 * We probably should, but careful: do not inject SIGTRAP
370 * generated by syscall entry/exit stops.
371 * That kills the child.
373 ptrace(PTRACE_SYSCALL, pid, 0L, 0L /*sig*/);
377 int main(int argc, char **argv, char **envp)
383 " movl %%cs, %%eax\n"
386 kernel_is_64bit = (cs == 0x23);
387 if (!kernel_is_64bit)
388 printf("[NOTE]\tNot a 64-bit kernel, won't test R8..R15 leaks\n");
390 /* This only works for non-static builds:
391 * syscall_addr = dlsym(dlopen("linux-gate.so.1", RTLD_NOW), "__kernel_vsyscall");
393 syscall_addr = get_syscall(envp);
395 exitcode += run_syscall_twice();
397 exitcode += run_syscall_twice();