path: root/test/syscalls/linux/exceptions.cc

// Copyright 2018 The gVisor Authors.
//
// Licensed under the Apache License, Version 2.0 (the "License");
// you may not use this file except in compliance with the License.
// You may obtain a copy of the License at
//
//     http://www.apache.org/licenses/LICENSE-2.0
//
// Unless required by applicable law or agreed to in writing, software
// distributed under the License is distributed on an "AS IS" BASIS,
// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
// See the License for the specific language governing permissions and
// limitations under the License.

#include <signal.h>

#include "gtest/gtest.h"
#include "test/util/logging.h"
#include "test/util/platform_util.h"
#include "test/util/signal_util.h"
#include "test/util/test_util.h"

namespace gvisor {
namespace testing {

#if defined(__x86_64__)
// Default value for the x87 FPU control word. See Intel SDM Vol 1, Ch 8.1.5
// "x87 FPU Control Word".
constexpr uint16_t kX87ControlWordDefault = 0x37f;

// Mask for the divide-by-zero exception.
constexpr uint16_t kX87ControlWordDiv0Mask = 1 << 2;

// Default value for the SSE control register (MXCSR). See Intel SDM Vol 1, Ch
// 11.6.4 "Initialization of SSE/SSE3 Extensions".
constexpr uint32_t kMXCSRDefault = 0x1f80;

// Mask for the divide-by-zero exception.
constexpr uint32_t kMXCSRDiv0Mask = 1 << 9;

// Flag for a pending divide-by-zero exception.
constexpr uint32_t kMXCSRDiv0Flag = 1 << 2;

void inline Halt() { asm("hlt\r\n"); }

void inline SetAlignmentCheck() {
  asm("subq $128, %%rsp\r\n"  // Avoid potential red zone clobber
      "pushf\r\n"
      "pop %%rax\r\n"
      "or $0x40000, %%rax\r\n"
      "push %%rax\r\n"
      "popf\r\n"
      "addq $128, %%rsp\r\n"
      :
      :
      : "ax");
}

void inline ClearAlignmentCheck() {
  asm("subq $128, %%rsp\r\n"  // Avoid potential red zone clobber
      "pushf\r\n"
      "pop %%rax\r\n"
      "mov $0x40000, %%rbx\r\n"
      "not %%rbx\r\n"
      "and %%rbx, %%rax\r\n"
      "push %%rax\r\n"
      "popf\r\n"
      "addq $128, %%rsp\r\n"
      :
      :
      : "ax", "bx");
}

void inline Int3Normal() { asm(".byte 0xcd, 0x03\r\n"); }

void inline Int3Compact() { asm(".byte 0xcc\r\n"); }

void InIOHelper(int width, int value) {
  EXPECT_EXIT(
      {
        switch (width) {
          case 1:
            asm volatile("inb %%dx, %%al" ::"d"(value) : "%eax");
            break;
          case 2:
            asm volatile("inw %%dx, %%ax" ::"d"(value) : "%eax");
            break;
          case 4:
            asm volatile("inl %%dx, %%eax" ::"d"(value) : "%eax");
            break;
          default:
            FAIL() << "invalid input width, only 1, 2 or 4 is allowed";
        }
      },
      ::testing::KilledBySignal(SIGSEGV), "");
}
#elif defined(__aarch64__)
void inline Halt() { asm("hlt #0\r\n"); }
#endif

TEST(ExceptionTest, Halt) {
  // In order to prevent the regular handler from messing with things (and
  // perhaps refaulting until some other signal occurs), we reset the handler to
  // the default action here and ensure that it dies correctly.
  struct sigaction sa = {};
  sa.sa_handler = SIG_DFL;
  auto const cleanup = ASSERT_NO_ERRNO_AND_VALUE(ScopedSigaction(SIGSEGV, sa));

#if defined(__x86_64__)
  EXPECT_EXIT(Halt(), ::testing::KilledBySignal(SIGSEGV), "");
#elif defined(__aarch64__)
  EXPECT_EXIT(Halt(), ::testing::KilledBySignal(SIGILL), "");
#endif
}

#if defined(__x86_64__)
TEST(ExceptionTest, DivideByZero) {
  // See above.
  struct sigaction sa = {};
  sa.sa_handler = SIG_DFL;
  auto const cleanup = ASSERT_NO_ERRNO_AND_VALUE(ScopedSigaction(SIGFPE, sa));

  EXPECT_EXIT(
      {
        uint32_t remainder;
        uint32_t quotient;
        uint32_t divisor = 0;
        uint64_t value = 1;
        asm("divl 0(%2)\r\n"
            : "=d"(remainder), "=a"(quotient)
            : "r"(&divisor), "d"(value >> 32), "a"(value));
        TEST_CHECK(quotient > 0);  // Force dependency.
      },
      ::testing::KilledBySignal(SIGFPE), "");
}

// By default, x87 exceptions are masked and simply return a default value.
TEST(ExceptionTest, X87DivideByZeroMasked) {
  int32_t quotient;
  int32_t value = 1;
  int32_t divisor = 0;
  asm("fildl %[value]\r\n"
      "fidivl %[divisor]\r\n"
      "fistpl %[quotient]\r\n"
      : [ quotient ] "=m"(quotient)
      : [ value ] "m"(value), [ divisor ] "m"(divisor));

  EXPECT_EQ(quotient, INT32_MIN);
}

// When unmasked, division by zero raises SIGFPE.
TEST(ExceptionTest, X87DivideByZeroUnmasked) {
  // See above.
  struct sigaction sa = {};
  sa.sa_handler = SIG_DFL;
  auto const cleanup = ASSERT_NO_ERRNO_AND_VALUE(ScopedSigaction(SIGFPE, sa));

  EXPECT_EXIT(
      {
        // Clear the divide by zero exception mask.
        constexpr uint16_t kControlWord =
            kX87ControlWordDefault & ~kX87ControlWordDiv0Mask;

        int32_t quotient;
        int32_t value = 1;
        int32_t divisor = 0;
        asm volatile(
            "fldcw %[cw]\r\n"
            "fildl %[value]\r\n"
            "fidivl %[divisor]\r\n"
            "fistpl %[quotient]\r\n"
            : [ quotient ] "=m"(quotient)
            : [ cw ] "m"(kControlWord), [ value ] "m"(value),
              [ divisor ] "m"(divisor));
      },
      ::testing::KilledBySignal(SIGFPE), "");
}

// Pending exceptions in the x87 status register are not clobbered by syscalls.
TEST(ExceptionTest, X87StatusClobber) {
  // See above.
  struct sigaction sa = {};
  sa.sa_handler = SIG_DFL;
  auto const cleanup = ASSERT_NO_ERRNO_AND_VALUE(ScopedSigaction(SIGFPE, sa));

  EXPECT_EXIT(
      {
        // Clear the divide by zero exception mask.
        constexpr uint16_t kControlWord =
            kX87ControlWordDefault & ~kX87ControlWordDiv0Mask;

        int32_t quotient;
        int32_t value = 1;
        int32_t divisor = 0;
        asm volatile(
            "fildl %[value]\r\n"
            "fidivl %[divisor]\r\n"
            // Exception is masked, so it does not occur here.
            "fistpl %[quotient]\r\n"

            // SYS_getpid placed in rax by constraint.
            "syscall\r\n"

            // Unmask exception. The syscall didn't clobber the pending
            // exception, so now it can be raised.
            //
            // N.B. "a floating-point exception will be generated upon execution
            // of the *next* floating-point instruction".
            "fldcw %[cw]\r\n"
            "fwait\r\n"
            : [ quotient ] "=m"(quotient)
            : [ value ] "m"(value), [ divisor ] "m"(divisor), "a"(SYS_getpid),
              [ cw ] "m"(kControlWord)
            : "rcx", "r11");
      },
      ::testing::KilledBySignal(SIGFPE), "");
}

// By default, SSE exceptions are masked and simply return a default value.
TEST(ExceptionTest, SSEDivideByZeroMasked) {
  uint32_t status;
  int32_t quotient;
  int32_t value = 1;
  int32_t divisor = 0;
  asm("cvtsi2ssl %[value], %%xmm0\r\n"
      "cvtsi2ssl %[divisor], %%xmm1\r\n"
      "divss %%xmm1, %%xmm0\r\n"
      "cvtss2sil %%xmm0, %[quotient]\r\n"
      : [ quotient ] "=r"(quotient), [ status ] "=r"(status)
      : [ value ] "r"(value), [ divisor ] "r"(divisor)
      : "xmm0", "xmm1");

  EXPECT_EQ(quotient, INT32_MIN);
}

// When unmasked, division by zero raises SIGFPE.
TEST(ExceptionTest, SSEDivideByZeroUnmasked) {
  // See above.
  struct sigaction sa = {};
  sa.sa_handler = SIG_DFL;
  auto const cleanup = ASSERT_NO_ERRNO_AND_VALUE(ScopedSigaction(SIGFPE, sa));

  EXPECT_EXIT(
      {
        // Clear the divide by zero exception mask.
        constexpr uint32_t kMXCSR = kMXCSRDefault & ~kMXCSRDiv0Mask;

        int32_t quotient;
        int32_t value = 1;
        int32_t divisor = 0;
        asm volatile(
            "ldmxcsr %[mxcsr]\r\n"
            "cvtsi2ssl %[value], %%xmm0\r\n"
            "cvtsi2ssl %[divisor], %%xmm1\r\n"
            "divss %%xmm1, %%xmm0\r\n"
            "cvtss2sil %%xmm0, %[quotient]\r\n"
            : [ quotient ] "=r"(quotient)
            : [ mxcsr ] "m"(kMXCSR), [ value ] "r"(value),
              [ divisor ] "r"(divisor)
            : "xmm0", "xmm1");
      },
      ::testing::KilledBySignal(SIGFPE), "");
}

// Pending exceptions in the SSE status register are not clobbered by syscalls.
TEST(ExceptionTest, SSEStatusClobber) {
  uint32_t mxcsr;
  int32_t quotient;
  int32_t value = 1;
  int32_t divisor = 0;
  asm("cvtsi2ssl %[value], %%xmm0\r\n"
      "cvtsi2ssl %[divisor], %%xmm1\r\n"
      "divss %%xmm1, %%xmm0\r\n"
      // Exception is masked, so it does not occur here.
      "cvtss2sil %%xmm0, %[quotient]\r\n"

      // SYS_getpid placed in rax by constraint.
      "syscall\r\n"

      // Intel SDM Vol 1, Ch 10.2.3.1 "SIMD Floating-Point Mask and Flag Bits":
      // "If LDMXCSR or FXRSTOR clears a mask bit and sets the corresponding
      // exception flag bit, a SIMD floating-point exception will not be
      // generated as a result of this change. The unmasked exception will be
      // generated only upon the execution of the next SSE/SSE2/SSE3 instruction
      // that detects the unmasked exception condition."
      //
      // Though ambiguous, empirical evidence indicates that this means that
      // exception flags set in the status register will never cause an
      // exception to be raised; only a new exception condition will do so.
      //
      // Thus here we just check for the flag itself rather than trying to raise
      // the exception.
      "stmxcsr %[mxcsr]\r\n"
      : [ quotient ] "=r"(quotient), [ mxcsr ] "+m"(mxcsr)
      : [ value ] "r"(value), [ divisor ] "r"(divisor), "a"(SYS_getpid)
      : "xmm0", "xmm1", "rcx", "r11");

  EXPECT_TRUE(mxcsr & kMXCSRDiv0Flag);
}

TEST(ExceptionTest, IOAccessFault) {
  // See above.
  struct sigaction sa = {};
  sa.sa_handler = SIG_DFL;
  auto const cleanup = ASSERT_NO_ERRNO_AND_VALUE(ScopedSigaction(SIGSEGV, sa));

  InIOHelper(1, 0x0);
  InIOHelper(2, 0x7);
  InIOHelper(4, 0x6);
  InIOHelper(1, 0xffff);
  InIOHelper(2, 0xffff);
  InIOHelper(4, 0xfffd);
}

TEST(ExceptionTest, Alignment) {
  SetAlignmentCheck();
  ClearAlignmentCheck();
}

TEST(ExceptionTest, AlignmentHalt) {
  // See above.
  struct sigaction sa = {};
  sa.sa_handler = SIG_DFL;
  auto const cleanup = ASSERT_NO_ERRNO_AND_VALUE(ScopedSigaction(SIGSEGV, sa));

  // Reported upstream. We need to ensure that bad flags are cleared even in
  // fault paths. Set the alignment flag and then generate an exception.
  EXPECT_EXIT(
      {
        SetAlignmentCheck();
        Halt();
      },
      ::testing::KilledBySignal(SIGSEGV), "");
}

TEST(ExceptionTest, AlignmentCheck) {
  SKIP_IF(PlatformSupportAlignmentCheck() != PlatformSupport::Allowed);

  // See above.
  struct sigaction sa = {};
  sa.sa_handler = SIG_DFL;
  auto const cleanup = ASSERT_NO_ERRNO_AND_VALUE(ScopedSigaction(SIGBUS, sa));

  EXPECT_EXIT(
      {
        char array[16];
        SetAlignmentCheck();
        for (int i = 0; i < 8; i++) {
          // At least 7/8 offsets will be unaligned here.
          uint64_t* ptr = reinterpret_cast<uint64_t*>(&array[i]);
          asm("mov %0, 0(%0)\r\n" : : "r"(ptr) : "ax");
        }
      },
      ::testing::KilledBySignal(SIGBUS), "");
}

TEST(ExceptionTest, Int3Normal) {
  // See above.
  struct sigaction sa = {};
  sa.sa_handler = SIG_DFL;
  auto const cleanup = ASSERT_NO_ERRNO_AND_VALUE(ScopedSigaction(SIGTRAP, sa));

  EXPECT_EXIT(Int3Normal(), ::testing::KilledBySignal(SIGTRAP), "");
}

TEST(ExceptionTest, Int3Compact) {
  // See above.
  struct sigaction sa = {};
  sa.sa_handler = SIG_DFL;
  auto const cleanup = ASSERT_NO_ERRNO_AND_VALUE(ScopedSigaction(SIGTRAP, sa));

  EXPECT_EXIT(Int3Compact(), ::testing::KilledBySignal(SIGTRAP), "");
}
#endif

}  // namespace testing
}  // namespace gvisor