1 // SPDX-License-Identifier: GPL-2.0 2 #define _GNU_SOURCE 3 4 #include <sys/ptrace.h> 5 #include <sys/types.h> 6 #include <sys/wait.h> 7 #include <sys/syscall.h> 8 #include <sys/user.h> 9 #include <unistd.h> 10 #include <errno.h> 11 #include <stddef.h> 12 #include <stdio.h> 13 #include <err.h> 14 #include <string.h> 15 #include <asm/ptrace-abi.h> 16 #include <sys/auxv.h> 17 18 #include "helpers.h" 19 20 /* Bitness-agnostic defines for user_regs_struct fields. */ 21 #ifdef __x86_64__ 22 # define user_syscall_nr orig_rax 23 # define user_arg0 rdi 24 # define user_arg1 rsi 25 # define user_arg2 rdx 26 # define user_arg3 r10 27 # define user_arg4 r8 28 # define user_arg5 r9 29 # define user_ip rip 30 # define user_ax rax 31 #else 32 # define user_syscall_nr orig_eax 33 # define user_arg0 ebx 34 # define user_arg1 ecx 35 # define user_arg2 edx 36 # define user_arg3 esi 37 # define user_arg4 edi 38 # define user_arg5 ebp 39 # define user_ip eip 40 # define user_ax eax 41 #endif 42 43 static int nerrs = 0; 44 45 struct syscall_args32 { 46 uint32_t nr, arg0, arg1, arg2, arg3, arg4, arg5; 47 }; 48 49 #ifdef __i386__ 50 extern void sys32_helper(struct syscall_args32 *, void *); 51 extern void int80_and_ret(void); 52 #endif 53 54 /* 55 * Helper to invoke int80 with controlled regs and capture the final regs. 56 */ 57 static void do_full_int80(struct syscall_args32 *args) 58 { 59 #ifdef __x86_64__ 60 register unsigned long bp asm("bp") = args->arg5; 61 asm volatile ("int $0x80" 62 : "+a" (args->nr), 63 "+b" (args->arg0), "+c" (args->arg1), "+d" (args->arg2), 64 "+S" (args->arg3), "+D" (args->arg4), "+r" (bp) 65 : : "r8", "r9", "r10", "r11"); 66 args->arg5 = bp; 67 #else 68 sys32_helper(args, int80_and_ret); 69 #endif 70 } 71 72 #ifdef __i386__ 73 static void (*vsyscall32)(void); 74 75 /* 76 * Nasty helper to invoke AT_SYSINFO (i.e. __kernel_vsyscall) with 77 * controlled regs and capture the final regs. This is so nasty that it 78 * crashes my copy of gdb :) 79 */ 80 static void do_full_vsyscall32(struct syscall_args32 *args) 81 { 82 sys32_helper(args, vsyscall32); 83 } 84 #endif 85 86 static siginfo_t wait_trap(pid_t chld) 87 { 88 siginfo_t si; 89 if (waitid(P_PID, chld, &si, WEXITED|WSTOPPED) != 0) 90 err(1, "waitid"); 91 if (si.si_pid != chld) 92 errx(1, "got unexpected pid in event\n"); 93 if (si.si_code != CLD_TRAPPED) 94 errx(1, "got unexpected event type %d\n", si.si_code); 95 return si; 96 } 97 98 static void setsigign(int sig, int flags) 99 { 100 struct sigaction sa; 101 memset(&sa, 0, sizeof(sa)); 102 sa.sa_sigaction = (void *)SIG_IGN; 103 sa.sa_flags = flags; 104 sigemptyset(&sa.sa_mask); 105 if (sigaction(sig, &sa, 0)) 106 err(1, "sigaction"); 107 } 108 109 #ifdef __x86_64__ 110 # define REG_BP REG_RBP 111 #else 112 # define REG_BP REG_EBP 113 #endif 114 115 static void empty_handler(int sig, siginfo_t *si, void *ctx_void) 116 { 117 } 118 119 static void test_sys32_regs(void (*do_syscall)(struct syscall_args32 *)) 120 { 121 struct syscall_args32 args = { 122 .nr = 224, /* gettid */ 123 .arg0 = 10, .arg1 = 11, .arg2 = 12, 124 .arg3 = 13, .arg4 = 14, .arg5 = 15, 125 }; 126 127 do_syscall(&args); 128 129 if (args.nr != getpid() || 130 args.arg0 != 10 || args.arg1 != 11 || args.arg2 != 12 || 131 args.arg3 != 13 || args.arg4 != 14 || args.arg5 != 15) { 132 printf("[FAIL]\tgetpid() failed to preserve regs\n"); 133 nerrs++; 134 } else { 135 printf("[OK]\tgetpid() preserves regs\n"); 136 } 137 138 sethandler(SIGUSR1, empty_handler, 0); 139 140 args.nr = 37; /* kill */ 141 args.arg0 = getpid(); 142 args.arg1 = SIGUSR1; 143 do_syscall(&args); 144 if (args.nr != 0 || 145 args.arg0 != getpid() || args.arg1 != SIGUSR1 || args.arg2 != 12 || 146 args.arg3 != 13 || args.arg4 != 14 || args.arg5 != 15) { 147 printf("[FAIL]\tkill(getpid(), SIGUSR1) failed to preserve regs\n"); 148 nerrs++; 149 } else { 150 printf("[OK]\tkill(getpid(), SIGUSR1) preserves regs\n"); 151 } 152 clearhandler(SIGUSR1); 153 } 154 155 static void test_ptrace_syscall_restart(void) 156 { 157 printf("[RUN]\tptrace-induced syscall restart\n"); 158 pid_t chld = fork(); 159 if (chld < 0) 160 err(1, "fork"); 161 162 if (chld == 0) { 163 if (ptrace(PTRACE_TRACEME, 0, 0, 0) != 0) 164 err(1, "PTRACE_TRACEME"); 165 166 pid_t pid = getpid(), tid = syscall(SYS_gettid); 167 168 printf("\tChild will make one syscall\n"); 169 syscall(SYS_tgkill, pid, tid, SIGSTOP); 170 171 syscall(SYS_gettid, 10, 11, 12, 13, 14, 15); 172 _exit(0); 173 } 174 175 int status; 176 177 /* Wait for SIGSTOP. */ 178 if (waitpid(chld, &status, 0) != chld || !WIFSTOPPED(status)) 179 err(1, "waitpid"); 180 181 struct user_regs_struct regs; 182 183 printf("[RUN]\tSYSEMU\n"); 184 if (ptrace(PTRACE_SYSEMU, chld, 0, 0) != 0) 185 err(1, "PTRACE_SYSEMU"); 186 wait_trap(chld); 187 188 if (ptrace(PTRACE_GETREGS, chld, 0, ®s) != 0) 189 err(1, "PTRACE_GETREGS"); 190 191 if (regs.user_syscall_nr != SYS_gettid || 192 regs.user_arg0 != 10 || regs.user_arg1 != 11 || 193 regs.user_arg2 != 12 || regs.user_arg3 != 13 || 194 regs.user_arg4 != 14 || regs.user_arg5 != 15) { 195 printf("[FAIL]\tInitial args are wrong (nr=%lu, args=%lu %lu %lu %lu %lu %lu)\n", (unsigned long)regs.user_syscall_nr, (unsigned long)regs.user_arg0, (unsigned long)regs.user_arg1, (unsigned long)regs.user_arg2, (unsigned long)regs.user_arg3, (unsigned long)regs.user_arg4, (unsigned long)regs.user_arg5); 196 nerrs++; 197 } else { 198 printf("[OK]\tInitial nr and args are correct\n"); 199 } 200 201 printf("[RUN]\tRestart the syscall (ip = 0x%lx)\n", 202 (unsigned long)regs.user_ip); 203 204 /* 205 * This does exactly what it appears to do if syscall is int80 or 206 * SYSCALL64. For SYSCALL32 or SYSENTER, though, this is highly 207 * magical. It needs to work so that ptrace and syscall restart 208 * work as expected. 209 */ 210 regs.user_ax = regs.user_syscall_nr; 211 regs.user_ip -= 2; 212 if (ptrace(PTRACE_SETREGS, chld, 0, ®s) != 0) 213 err(1, "PTRACE_SETREGS"); 214 215 if (ptrace(PTRACE_SYSEMU, chld, 0, 0) != 0) 216 err(1, "PTRACE_SYSEMU"); 217 wait_trap(chld); 218 219 if (ptrace(PTRACE_GETREGS, chld, 0, ®s) != 0) 220 err(1, "PTRACE_GETREGS"); 221 222 if (regs.user_syscall_nr != SYS_gettid || 223 regs.user_arg0 != 10 || regs.user_arg1 != 11 || 224 regs.user_arg2 != 12 || regs.user_arg3 != 13 || 225 regs.user_arg4 != 14 || regs.user_arg5 != 15) { 226 printf("[FAIL]\tRestart nr or args are wrong (nr=%lu, args=%lu %lu %lu %lu %lu %lu)\n", (unsigned long)regs.user_syscall_nr, (unsigned long)regs.user_arg0, (unsigned long)regs.user_arg1, (unsigned long)regs.user_arg2, (unsigned long)regs.user_arg3, (unsigned long)regs.user_arg4, (unsigned long)regs.user_arg5); 227 nerrs++; 228 } else { 229 printf("[OK]\tRestarted nr and args are correct\n"); 230 } 231 232 printf("[RUN]\tChange nr and args and restart the syscall (ip = 0x%lx)\n", 233 (unsigned long)regs.user_ip); 234 235 regs.user_ax = SYS_getpid; 236 regs.user_arg0 = 20; 237 regs.user_arg1 = 21; 238 regs.user_arg2 = 22; 239 regs.user_arg3 = 23; 240 regs.user_arg4 = 24; 241 regs.user_arg5 = 25; 242 regs.user_ip -= 2; 243 244 if (ptrace(PTRACE_SETREGS, chld, 0, ®s) != 0) 245 err(1, "PTRACE_SETREGS"); 246 247 if (ptrace(PTRACE_SYSEMU, chld, 0, 0) != 0) 248 err(1, "PTRACE_SYSEMU"); 249 wait_trap(chld); 250 251 if (ptrace(PTRACE_GETREGS, chld, 0, ®s) != 0) 252 err(1, "PTRACE_GETREGS"); 253 254 if (regs.user_syscall_nr != SYS_getpid || 255 regs.user_arg0 != 20 || regs.user_arg1 != 21 || regs.user_arg2 != 22 || 256 regs.user_arg3 != 23 || regs.user_arg4 != 24 || regs.user_arg5 != 25) { 257 printf("[FAIL]\tRestart nr or args are wrong (nr=%lu, args=%lu %lu %lu %lu %lu %lu)\n", (unsigned long)regs.user_syscall_nr, (unsigned long)regs.user_arg0, (unsigned long)regs.user_arg1, (unsigned long)regs.user_arg2, (unsigned long)regs.user_arg3, (unsigned long)regs.user_arg4, (unsigned long)regs.user_arg5); 258 nerrs++; 259 } else { 260 printf("[OK]\tReplacement nr and args are correct\n"); 261 } 262 263 if (ptrace(PTRACE_CONT, chld, 0, 0) != 0) 264 err(1, "PTRACE_CONT"); 265 if (waitpid(chld, &status, 0) != chld) 266 err(1, "waitpid"); 267 if (!WIFEXITED(status) || WEXITSTATUS(status) != 0) { 268 printf("[FAIL]\tChild failed\n"); 269 nerrs++; 270 } else { 271 printf("[OK]\tChild exited cleanly\n"); 272 } 273 } 274 275 static void test_restart_under_ptrace(void) 276 { 277 printf("[RUN]\tkernel syscall restart under ptrace\n"); 278 pid_t chld = fork(); 279 if (chld < 0) 280 err(1, "fork"); 281 282 if (chld == 0) { 283 if (ptrace(PTRACE_TRACEME, 0, 0, 0) != 0) 284 err(1, "PTRACE_TRACEME"); 285 286 pid_t pid = getpid(), tid = syscall(SYS_gettid); 287 288 printf("\tChild will take a nap until signaled\n"); 289 setsigign(SIGUSR1, SA_RESTART); 290 syscall(SYS_tgkill, pid, tid, SIGSTOP); 291 292 syscall(SYS_pause, 0, 0, 0, 0, 0, 0); 293 _exit(0); 294 } 295 296 int status; 297 298 /* Wait for SIGSTOP. */ 299 if (waitpid(chld, &status, 0) != chld || !WIFSTOPPED(status)) 300 err(1, "waitpid"); 301 302 struct user_regs_struct regs; 303 304 printf("[RUN]\tSYSCALL\n"); 305 if (ptrace(PTRACE_SYSCALL, chld, 0, 0) != 0) 306 err(1, "PTRACE_SYSCALL"); 307 wait_trap(chld); 308 309 /* We should be stopped at pause(2) entry. */ 310 311 if (ptrace(PTRACE_GETREGS, chld, 0, ®s) != 0) 312 err(1, "PTRACE_GETREGS"); 313 314 if (regs.user_syscall_nr != SYS_pause || 315 regs.user_arg0 != 0 || regs.user_arg1 != 0 || 316 regs.user_arg2 != 0 || regs.user_arg3 != 0 || 317 regs.user_arg4 != 0 || regs.user_arg5 != 0) { 318 printf("[FAIL]\tInitial args are wrong (nr=%lu, args=%lu %lu %lu %lu %lu %lu)\n", (unsigned long)regs.user_syscall_nr, (unsigned long)regs.user_arg0, (unsigned long)regs.user_arg1, (unsigned long)regs.user_arg2, (unsigned long)regs.user_arg3, (unsigned long)regs.user_arg4, (unsigned long)regs.user_arg5); 319 nerrs++; 320 } else { 321 printf("[OK]\tInitial nr and args are correct\n"); 322 } 323 324 /* Interrupt it. */ 325 kill(chld, SIGUSR1); 326 327 /* Advance. We should be stopped at exit. */ 328 printf("[RUN]\tSYSCALL\n"); 329 if (ptrace(PTRACE_SYSCALL, chld, 0, 0) != 0) 330 err(1, "PTRACE_SYSCALL"); 331 wait_trap(chld); 332 333 if (ptrace(PTRACE_GETREGS, chld, 0, ®s) != 0) 334 err(1, "PTRACE_GETREGS"); 335 336 if (regs.user_syscall_nr != SYS_pause || 337 regs.user_arg0 != 0 || regs.user_arg1 != 0 || 338 regs.user_arg2 != 0 || regs.user_arg3 != 0 || 339 regs.user_arg4 != 0 || regs.user_arg5 != 0) { 340 printf("[FAIL]\tArgs after SIGUSR1 are wrong (nr=%lu, args=%lu %lu %lu %lu %lu %lu)\n", (unsigned long)regs.user_syscall_nr, (unsigned long)regs.user_arg0, (unsigned long)regs.user_arg1, (unsigned long)regs.user_arg2, (unsigned long)regs.user_arg3, (unsigned long)regs.user_arg4, (unsigned long)regs.user_arg5); 341 nerrs++; 342 } else { 343 printf("[OK]\tArgs after SIGUSR1 are correct (ax = %ld)\n", 344 (long)regs.user_ax); 345 } 346 347 /* Poke the regs back in. This must not break anything. */ 348 if (ptrace(PTRACE_SETREGS, chld, 0, ®s) != 0) 349 err(1, "PTRACE_SETREGS"); 350 351 /* Catch the (ignored) SIGUSR1. */ 352 if (ptrace(PTRACE_CONT, chld, 0, 0) != 0) 353 err(1, "PTRACE_CONT"); 354 if (waitpid(chld, &status, 0) != chld) 355 err(1, "waitpid"); 356 if (!WIFSTOPPED(status)) { 357 printf("[FAIL]\tChild was stopped for SIGUSR1 (status = 0x%x)\n", status); 358 nerrs++; 359 } else { 360 printf("[OK]\tChild got SIGUSR1\n"); 361 } 362 363 /* The next event should be pause(2) again. */ 364 printf("[RUN]\tStep again\n"); 365 if (ptrace(PTRACE_SYSCALL, chld, 0, 0) != 0) 366 err(1, "PTRACE_SYSCALL"); 367 wait_trap(chld); 368 369 /* We should be stopped at pause(2) entry. */ 370 371 if (ptrace(PTRACE_GETREGS, chld, 0, ®s) != 0) 372 err(1, "PTRACE_GETREGS"); 373 374 if (regs.user_syscall_nr != SYS_pause || 375 regs.user_arg0 != 0 || regs.user_arg1 != 0 || 376 regs.user_arg2 != 0 || regs.user_arg3 != 0 || 377 regs.user_arg4 != 0 || regs.user_arg5 != 0) { 378 printf("[FAIL]\tpause did not restart (nr=%lu, args=%lu %lu %lu %lu %lu %lu)\n", (unsigned long)regs.user_syscall_nr, (unsigned long)regs.user_arg0, (unsigned long)regs.user_arg1, (unsigned long)regs.user_arg2, (unsigned long)regs.user_arg3, (unsigned long)regs.user_arg4, (unsigned long)regs.user_arg5); 379 nerrs++; 380 } else { 381 printf("[OK]\tpause(2) restarted correctly\n"); 382 } 383 384 /* Kill it. */ 385 kill(chld, SIGKILL); 386 if (waitpid(chld, &status, 0) != chld) 387 err(1, "waitpid"); 388 } 389 390 int main() 391 { 392 printf("[RUN]\tCheck int80 return regs\n"); 393 test_sys32_regs(do_full_int80); 394 395 #if defined(__i386__) && (!defined(__GLIBC__) || __GLIBC__ > 2 || __GLIBC_MINOR__ >= 16) 396 vsyscall32 = (void *)getauxval(AT_SYSINFO); 397 if (vsyscall32) { 398 printf("[RUN]\tCheck AT_SYSINFO return regs\n"); 399 test_sys32_regs(do_full_vsyscall32); 400 } else { 401 printf("[SKIP]\tAT_SYSINFO is not available\n"); 402 } 403 #endif 404 405 test_ptrace_syscall_restart(); 406 407 test_restart_under_ptrace(); 408 409 return 0; 410 } 411