causing a reboot from user space

Question

This program , written for Gnu Assembler on an x86 linux system is supposed to cause a triple fault and then reboot.

.text
.global _start
_start:
# write our string to stdout

    movl    $len,%edx   # third argument: message length
    movl    $msg,%ecx   # second argument: pointer to message to write
    movl    $1,%ebx     # first argument: file handle (stdout)
    movl    $4,%eax     # system call number (sys_write)
    int $0x80       # call kernel
# Triple Fault -- reboot
    movq    $1, %rsp    # Load the stack pointer with a one
    pushq    %rax       # Push the A register, should cause a triple fault.

# and exit

    movl    $0,%ebx     # first argument: exit code
    movl    $1,%eax     # system call number (sys_exit)
    int $0x80       # call kernel

.data                   # section declaration

msg:
    .ascii  "Will reboot by triple fault!\n"    # our dear string
    len = . - msg           # length of our dear string

It causes a segmentation fault instead. Is it possible to get this to work from user mode, If run as root?

Answer 1

The Linux kernel doesn't allow userland to do such things that could affect other users. As root, you MIGHT be able to do something like that, but the kernel might still prevent such direct control; after all, a root process is still a userland process, but one that has unrestricted access to the kernel's system calls.

A more correct/UNIXy approach is to perform this kind of action in the kernel, and expose an interface that userland processes can use to invoke it. Then your code will be executed in the context of the kernel, and have full access to hardware/system features that users shouldn't normally have access to.

Answer 2

CPU faults like this are handled by kernel-mode interrupt handlers. Kernel code is good, and if a userland fault happens (like dividing by zero, or accessing invalid memory), the first interrupt handler should handle it correctly. Anything else is a bug in the kernel - if there is a fault in an interrupt handler, basically the only sane thing to do is dump registers and stack, and drop to a debugger (like OpenBSD does) or HCF so that the panic message can be written down. Triple faults exist because, by that point, your code just ain't working.

TL;DR: For this to work, you have to find a bug in the fault-handling code in Linux.

You might be able to do this in a kernel module that intentionally wrecks interrupt handlers, but you're also very likely to crash the system. It's not the same effect as shutdown -r now!

Answer 3

On Linux, you can use the reboot system call:

#include <unistd.h>
#include <sys/reboot.h>

int main(void) {
    return reboot(LINUX_REBOOT_CMD_RESTART);
}

Answer 4

If you really need assembler (?!), this used to work from root (with nasm, I think):

BITS    32
    mov eax, 88
    mov ebx, 0xfee1dead
    mov ecx, 85072278
    mov edx, 0x01234567
    int  0x80