#define _GNU_SOURCE #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include static void sethandler(int sig, void (*handler)(int, siginfo_t *, void *), int flags) { struct sigaction sa; memset(&sa, 0, sizeof(sa)); sa.sa_sigaction = handler; sa.sa_flags = SA_SIGINFO | flags; sigemptyset(&sa.sa_mask); if (sigaction(sig, &sa, 0)) err(1, "sigaction"); } static volatile sig_atomic_t sig_traps; #ifdef __x86_64__ # define REG_IP REG_RIP # define WIDTH "q" #else # define REG_IP REG_EIP # define WIDTH "l" #endif static unsigned long get_eflags(void) { unsigned long eflags; asm volatile ("pushf" WIDTH "\n\tpop" WIDTH " %0" : "=rm" (eflags)); return eflags; } static void set_eflags(unsigned long eflags) { asm volatile ("push" WIDTH " %0\n\tpopf" WIDTH : : "rm" (eflags) : "flags"); } #define X86_EFLAGS_TF (1UL << 8) static void sigtrap(int sig, siginfo_t *info, void *ctx_void) { ucontext_t *ctx = (ucontext_t*)ctx_void; if (get_eflags() & X86_EFLAGS_TF) { set_eflags(get_eflags() & ~X86_EFLAGS_TF); printf("[WARN]\tSIGTRAP handler had TF set\n"); _exit(1); } sig_traps++; if (sig_traps == 10000 || sig_traps == 10001) { printf("[WARN]\tHit %d SIGTRAPs with si_addr 0x%lx, ip 0x%lx\n", (int)sig_traps, (unsigned long)info->si_addr, (unsigned long)ctx->uc_mcontext.gregs[REG_IP]); } } static void check_result(void) { unsigned long new_eflags = get_eflags(); set_eflags(new_eflags & ~X86_EFLAGS_TF); if (!sig_traps) { printf("[FAIL]\tNo SIGTRAP\n"); exit(1); } if (!(new_eflags & X86_EFLAGS_TF)) { printf("[FAIL]\tTF was cleared\n"); exit(1); } printf("[OK]\tSurvived with TF set and %d traps\n", (int)sig_traps); sig_traps = 0; } int main() { int tmp; sethandler(SIGTRAP, sigtrap, 0); printf("[RUN]\tSet TF and check nop\n"); set_eflags(get_eflags() | X86_EFLAGS_TF); asm volatile ("nop"); check_result(); #ifdef __x86_64__ printf("[RUN]\tSet TF and check syscall-less opportunistic sysret\n"); set_eflags(get_eflags() | X86_EFLAGS_TF); extern unsigned char post_nop[]; asm volatile ("pushf" WIDTH "\n\t" "pop" WIDTH " %%r11\n\t" "nop\n\t" "post_nop:" : : "c" (post_nop) : "r11"); check_result(); #endif printf("[RUN]\tSet TF and check int80\n"); set_eflags(get_eflags() | X86_EFLAGS_TF); asm volatile ("int $0x80" : "=a" (tmp) : "a" (SYS_getpid)); check_result(); syscall(SYS_getpid); /* Force symbol binding without TF set. */ printf("[RUN]\tSet TF and check a fast syscall\n"); set_eflags(get_eflags() | X86_EFLAGS_TF); syscall(SYS_getpid); check_result(); return 0; }