lkml.org 
[lkml]   [2015]   [Apr]   [10]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
/
From
Date
SubjectTIF_SINGLESTEP bug?
Hi all-

AFAICS there are several things wrong with our magical do_debug
handling of single-stepping through the kernel. They boil down to two
issues:

1. do_debug seems to be overly permissive in terms of what faults in
kernel space it thinks are okay. This isn't obviously a problem
except that it obfuscates what's going on. AFAICT the *only*
acceptable case is TF set on sysenter. All the mentions of syscalls
are garbage -- both int80 and syscall clear TF.

2. I think this is wrong:

set_tsk_thread_flag(tsk, TIF_SINGLESTEP);
regs->flags &= ~X86_EFLAGS_TF;

TIF_SINGLESTEP doesn't mean "set TF in this sysenter's saved flags and
then clear TIF_SINGLESTEP". It means something complicated.

The upshot AFAICT is that the attached program blows up if you build
it with -m32 and run it on an Intel machine.

Help? The best option I see is to add a new ti flag that tells the
syscall entry hook to clear that flag and set TF in regs->flags. But
I don't understand ptrace or kgdb very well.

--Andy

--
Andy Lutomirski
AMA Capital Management, LLC
#define _GNU_SOURCE

#include <sys/time.h>
#include <time.h>
#include <stdlib.h>
#include <sys/syscall.h>
#include <unistd.h>
#include <stdio.h>
#include <string.h>
#include <inttypes.h>
#include <sys/mman.h>
#include <sys/signal.h>
#include <sys/ucontext.h>
#include <asm/ldt.h>
#include <err.h>
#include <setjmp.h>
#include <stddef.h>
#include <stdbool.h>
#include <sys/ptrace.h>
#include <sys/user.h>

static void sethandler(int sig, void (*handler)(int, siginfo_t *, void *),
int flags)
{
struct sigaction sa;
memset(&sa, 0, sizeof(sa));
sa.sa_sigaction = handler;
sa.sa_flags = SA_SIGINFO | flags;
sigemptyset(&sa.sa_mask);
if (sigaction(sig, &sa, 0))
err(1, "sigaction");
}

static volatile sig_atomic_t sig_traps;

#ifdef __x86_64__
# define REG_IP REG_RIP
# define WIDTH "q"
#else
# define REG_IP REG_EIP
# define WIDTH "l"
#endif

static unsigned long get_eflags(void)
{
unsigned long eflags;
asm volatile ("pushf" WIDTH "\n\tpop" WIDTH " %0" : "=rm" (eflags));
return eflags;
}

static void set_eflags(unsigned long eflags)
{
asm volatile ("push" WIDTH " %0\n\tpopf" WIDTH
: : "rm" (eflags) : "flags");
}

#define X86_EFLAGS_TF (1UL << 8)

static void sigtrap(int sig, siginfo_t *info, void *ctx_void)
{
ucontext_t *ctx = (ucontext_t*)ctx_void;

if (get_eflags() & X86_EFLAGS_TF) {
set_eflags(get_eflags() & ~X86_EFLAGS_TF);
printf("[WARN]\tSIGTRAP handler had TF set\n");
_exit(1);
}

sig_traps++;

if (sig_traps == 10000 || sig_traps == 10001) {
printf("[WARN]\tHit %d SIGTRAPs with si_addr 0x%lx, ip 0x%lx\n",
(int)sig_traps,
(unsigned long)info->si_addr,
(unsigned long)ctx->uc_mcontext.gregs[REG_IP]);
}
}

static void check_result(void)
{
unsigned long new_eflags = get_eflags();
set_eflags(new_eflags & ~X86_EFLAGS_TF);

if (!sig_traps) {
printf("[FAIL]\tNo SIGTRAP\n");
exit(1);
}

if (!(new_eflags & X86_EFLAGS_TF)) {
printf("[FAIL]\tTF was cleared\n");
exit(1);
}

printf("[OK]\tSurvived with TF set and %d traps\n", (int)sig_traps);
sig_traps = 0;
}

int main()
{
int tmp;

sethandler(SIGTRAP, sigtrap, 0);

printf("[RUN]\tSet TF and check nop\n");
set_eflags(get_eflags() | X86_EFLAGS_TF);
asm volatile ("nop");
check_result();

#ifdef __x86_64__
printf("[RUN]\tSet TF and check syscall-less opportunistic sysret\n");
set_eflags(get_eflags() | X86_EFLAGS_TF);
extern unsigned char post_nop[];
asm volatile ("pushf" WIDTH "\n\t"
"pop" WIDTH " %%r11\n\t"
"nop\n\t"
"post_nop:"
: : "c" (post_nop) : "r11");
check_result();
#endif

printf("[RUN]\tSet TF and check int80\n");
set_eflags(get_eflags() | X86_EFLAGS_TF);
asm volatile ("int $0x80" : "=a" (tmp) : "a" (SYS_getpid));
check_result();

syscall(SYS_getpid); /* Force symbol binding without TF set. */
printf("[RUN]\tSet TF and check a fast syscall\n");
set_eflags(get_eflags() | X86_EFLAGS_TF);
syscall(SYS_getpid);
check_result();

return 0;
}
\
 
 \ /
  Last update: 2015-04-11 00:01    [W:0.050 / U:10.848 seconds]
©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site