[PATCH] new x86 personality detection
Denys Vlasenko
dvlasenk at redhat.com
Mon Feb 11 12:46:15 UTC 2013
On 02/11/2013 12:45 PM, Denys Vlasenko wrote:
> This patch implements a (hopefully) correct way to check for
> syscall bitness on x86.
>
> I tested it to work when stracing normal 32-bit binaries,
> can't test the above example till this evening.
> But it should work too (famous last words?).
>
> Please review.
Looks like we had a bug on X32:
if (check_errno && is_negated_errno(x86_64_regs.rax)) {
If we build in X32 environment, above we check only lower 32 bits of rax
- because is_negated_errno() takes _long_ parameter, which is 32-bit
on X32. Therefore e.g. llseek returning a valid offset of 0xfffffffe
will be mishandled as returning errno 2.
The updated patch also includes fix for this bug.
--
vda
diff -d -urpN strace.4/syscall.c strace.5/syscall.c
--- strace.4/syscall.c 2013-02-11 11:24:31.536160334 +0100
+++ strace.5/syscall.c 2013-02-11 13:31:41.149979432 +0100
@@ -65,6 +65,13 @@
# include <asm/rse.h>
#endif
+#if defined(X86_64) || defined(X32)
+# include <linux/ptrace.h>
+# include <asm/ptrace.h>
+# include <sys/uio.h>
+# include <elf.h>
+#endif
+
#if defined(AARCH64)
# include <asm/ptrace.h>
# include <sys/uio.h>
@@ -657,12 +664,39 @@ is_restart_error(struct tcb *tcp)
struct pt_regs i386_regs;
#elif defined(X86_64) || defined(X32)
/*
- * On 32 bits, pt_regs and user_regs_struct are the same,
- * but on 64 bits, user_regs_struct has six more fields:
+ * On i386, pt_regs and user_regs_struct are the same,
+ * but on 64 bit x86, user_regs_struct has six more fields:
* fs_base, gs_base, ds, es, fs, gs.
* PTRACE_GETREGS fills them too, so struct pt_regs would overflow.
*/
-static struct user_regs_struct x86_64_regs;
+struct i386_user_regs_struct {
+ uint32_t ebx;
+ uint32_t ecx;
+ uint32_t edx;
+ uint32_t esi;
+ uint32_t edi;
+ uint32_t ebp;
+ uint32_t eax;
+ uint32_t xds;
+ uint32_t xes;
+ uint32_t xfs;
+ uint32_t xgs;
+ uint32_t orig_eax;
+ uint32_t eip;
+ uint32_t xcs;
+ uint32_t eflags;
+ uint32_t esp;
+ uint32_t xss;
+};
+static union {
+ struct user_regs_struct x86_64_r;
+ struct i386_user_regs_struct i386_r;
+} x86_regs_union;
+# define x86_64_regs x86_regs_union.x86_64_r
+# define i386_regs x86_regs_union.i386_r
+static struct iovec x86_io = {
+ .iov_base = &x86_regs_union
+};
#elif defined(IA64)
long ia32 = 0; /* not static */
static long ia64_r8, ia64_r10;
@@ -738,7 +772,16 @@ printcall(struct tcb *tcp)
tprintf("[%016lx] ", psw);
# endif
#elif defined(X86_64) || defined(X32)
- tprintf("[%016lx] ", (unsigned long) x86_64_regs.rip);
+ if (x86_io.iov_len == sizeof(i386_regs)) {
+ tprintf("[%08x] ", (unsigned) i386_regs.eip);
+ } else {
+# if defined(X86_64)
+ tprintf("[%016lx] ", (unsigned long) x86_64_regs.rip);
+# elif defined(X32)
+ /* Note: this truncates 64-bit rip to 32 bits */
+ tprintf("[%08lx] ", (unsigned long) x86_64_regs.rip);
+# endif
+ }
#elif defined(IA64)
long ip;
@@ -859,7 +902,9 @@ void get_regs(pid_t pid)
# elif defined(I386)
get_regs_error = ptrace(PTRACE_GETREGS, pid, NULL, (long) &i386_regs);
# elif defined(X86_64) || defined(X32)
- get_regs_error = ptrace(PTRACE_GETREGS, pid, NULL, (long) &x86_64_regs);
+ /*x86_io.iov_base = &x86_regs_union; - already is */
+ x86_io.iov_len = sizeof(x86_regs_union);
+ get_regs_error = ptrace(PTRACE_GETREGSET, pid, NT_PRSTATUS, (long) &x86_io);
# elif defined(ARM)
get_regs_error = ptrace(PTRACE_GETREGS, pid, NULL, (void *)&arm_regs);
# elif defined(AARCH64)
@@ -1015,14 +1060,34 @@ get_scno(struct tcb *tcp)
# define __X32_SYSCALL_BIT 0x40000000
# endif
int currpers;
- scno = x86_64_regs.orig_rax;
-
- /* Check CS register value. On x86-64 linux it is:
- * 0x33 for long mode (64 bit)
- * 0x23 for compatibility mode (32 bit)
- * Check DS register value. On x86-64 linux it is:
- * 0x2b for x32 mode (x86-64 in 32 bit)
+# if 1
+ /* GETREGSET of NT_PRSTATUS tells us regset size,
+ * which unambiguously detects i386.
+ *
+ * Linux kernel distinguishes x86-64 and x32 processes
+ * solely by looking at __X32_SYSCALL_BIT:
+ * arch/x86/include/asm/compat.h::is_x32_task():
+ * if (task_pt_regs(current)->orig_ax & __X32_SYSCALL_BIT)
+ * return true;
+ */
+ if (x86_io.iov_len == sizeof(i386_regs)) {
+ scno = i386_regs.orig_eax;
+ currpers = 1;
+ } else {
+ scno = x86_64_regs.orig_rax;
+ currpers = 0;
+ if (scno & __X32_SYSCALL_BIT) {
+ scno -= __X32_SYSCALL_BIT;
+ currpers = 2;
+ }
+ }
+# elif 0
+ /* On x86-64 linux:
+ * cs = 0x33 for long mode (64 bit)
+ * cs = 0x23 for compatibility mode (32 bit)
+ * ds = 0x2b for x32 mode (x86-64 in 32 bit)
*/
+ scno = x86_64_regs.orig_rax;
switch (x86_64_regs.cs) {
case 0x23: currpers = 1; break;
case 0x33:
@@ -1039,7 +1104,7 @@ get_scno(struct tcb *tcp)
currpers = current_personality;
break;
}
-# if 0
+# elif 0
/* This version analyzes the opcode of a syscall instruction.
* (int 0x80 on i386 vs. syscall on x86-64)
* It works, but is too complicated.
@@ -1363,9 +1428,14 @@ syscall_fixup_on_sysenter(struct tcb *tc
}
#elif defined(X86_64) || defined(X32)
{
- long rax = x86_64_regs.rax;
- if (current_personality == 1)
- rax = (int)rax; /* sign extend from 32 bits */
+ long rax;
+ if (x86_io.iov_len == sizeof(i386_regs)) {
+ /* Sign extend from 32 bits */
+ rax = (int32_t)i386_regs.eax;
+ } else {
+ /* Note: in X32 build, this truncates 64 to 32 bits */
+ rax = x86_64_regs.rax;
+ }
if (rax != -ENOSYS) {
if (debug_flag)
fprintf(stderr, "not a syscall entry (rax = %ld)\n", rax);
@@ -1659,7 +1729,8 @@ get_syscall_args(struct tcb *tcp)
#elif defined(X86_64) || defined(X32)
(void)i;
(void)nargs;
- if (current_personality != 1) { /* x86-64 or x32 ABI */
+ if (x86_io.iov_len != sizeof(i386_regs)) {
+ /* x86-64 or x32 ABI */
tcp->u_arg[0] = x86_64_regs.rdi;
tcp->u_arg[1] = x86_64_regs.rsi;
tcp->u_arg[2] = x86_64_regs.rdx;
@@ -1674,14 +1745,15 @@ get_syscall_args(struct tcb *tcp)
tcp->ext_arg[4] = x86_64_regs.r8;
tcp->ext_arg[5] = x86_64_regs.r9;
# endif
- } else { /* i386 ABI */
- /* Sign-extend lower 32 bits */
- tcp->u_arg[0] = (long)(int)x86_64_regs.rbx;
- tcp->u_arg[1] = (long)(int)x86_64_regs.rcx;
- tcp->u_arg[2] = (long)(int)x86_64_regs.rdx;
- tcp->u_arg[3] = (long)(int)x86_64_regs.rsi;
- tcp->u_arg[4] = (long)(int)x86_64_regs.rdi;
- tcp->u_arg[5] = (long)(int)x86_64_regs.rbp;
+ } else {
+ /* i386 ABI */
+ /* Sign-extend from 32 bits */
+ tcp->u_arg[0] = (long)(int32_t)i386_regs.ebx;
+ tcp->u_arg[1] = (long)(int32_t)i386_regs.ecx;
+ tcp->u_arg[2] = (long)(int32_t)i386_regs.edx;
+ tcp->u_arg[3] = (long)(int32_t)i386_regs.esi;
+ tcp->u_arg[4] = (long)(int32_t)i386_regs.edi;
+ tcp->u_arg[5] = (long)(int32_t)i386_regs.ebp;
}
#elif defined(MICROBLAZE)
for (i = 0; i < nargs; ++i)
@@ -1946,6 +2018,21 @@ is_negated_errno(unsigned long int val)
return val > max;
}
+#if defined(X32)
+static inline int
+is_negated_errno_ll(unsigned long long val)
+{
+ unsigned long long max = -(long long) nerrnos;
+#if SUPPORTED_PERSONALITIES > 1
+ if (current_wordsize < sizeof(val)) {
+ val = (unsigned int) val;
+ max = (unsigned int) max;
+ }
+#endif
+ return val > max;
+}
+#endif
+
/* Returns:
* 1: ok, continue in trace_syscall_exiting().
* -1: error, trace_syscall_exiting() should print error indicator
@@ -1976,16 +2063,40 @@ get_error(struct tcb *tcp)
else {
tcp->u_rval = i386_regs.eax;
}
-#elif defined(X86_64) || defined(X32)
- if (check_errno && is_negated_errno(x86_64_regs.rax)) {
+#elif defined(X86_64)
+ long rax;
+ if (x86_io.iov_len == sizeof(i386_regs)) {
+ /* Sign extend from 32 bits */
+ rax = (int32_t)i386_regs.eax;
+ } else {
+ rax = x86_64_regs.rax;
+ }
+ if (check_errno && is_negated_errno(rax)) {
tcp->u_rval = -1;
- u_error = -x86_64_regs.rax;
+ u_error = -rax;
}
else {
- tcp->u_rval = x86_64_regs.rax;
-# if defined(X32)
- tcp->u_lrval = x86_64_regs.rax;
-# endif
+ tcp->u_rval = rax;
+ }
+#elif defined(X32)
+ /* In X32, return value is 64-bit (llseek uses one).
+ * Using merely "long rax" would not work.
+ */
+ long long rax;
+ if (x86_io.iov_len == sizeof(i386_regs)) {
+ /* Sign extend from 32 bits */
+ rax = (int32_t)i386_regs.eax;
+ } else {
+ rax = x86_64_regs.rax;
+ }
+ /* Careful: is_negated_errno() works only on longs */
+ if (check_errno && is_negated_errno_ll(rax)) {
+ tcp->u_rval = -1;
+ u_error = -rax;
+ }
+ else {
+ tcp->u_rval = rax; /* truncating */
+ tcp->u_lrval = rax;
}
#elif defined(IA64)
if (ia32) {
More information about the Strace-devel
mailing list