1 | // SPDX-License-Identifier: GPL-2.0-only |
2 | /* |
3 | * fsgsbase.c, an fsgsbase test |
4 | * Copyright (c) 2014-2016 Andy Lutomirski |
5 | */ |
6 | |
7 | #define _GNU_SOURCE |
8 | #include <stdio.h> |
9 | #include <stdlib.h> |
10 | #include <stdbool.h> |
11 | #include <string.h> |
12 | #include <sys/syscall.h> |
13 | #include <unistd.h> |
14 | #include <err.h> |
15 | #include <sys/user.h> |
16 | #include <asm/prctl.h> |
17 | #include <sys/prctl.h> |
18 | #include <signal.h> |
19 | #include <limits.h> |
20 | #include <sys/ucontext.h> |
21 | #include <sched.h> |
22 | #include <linux/futex.h> |
23 | #include <pthread.h> |
24 | #include <asm/ldt.h> |
25 | #include <sys/mman.h> |
26 | #include <stddef.h> |
27 | #include <sys/ptrace.h> |
28 | #include <sys/wait.h> |
29 | #include <setjmp.h> |
30 | |
31 | #ifndef __x86_64__ |
32 | # error This test is 64-bit only |
33 | #endif |
34 | |
35 | static volatile sig_atomic_t want_segv; |
36 | static volatile unsigned long segv_addr; |
37 | |
38 | static unsigned short *shared_scratch; |
39 | |
40 | static int nerrs; |
41 | |
42 | static void sethandler(int sig, void (*handler)(int, siginfo_t *, void *), |
43 | int flags) |
44 | { |
45 | struct sigaction sa; |
46 | memset(&sa, 0, sizeof(sa)); |
47 | sa.sa_sigaction = handler; |
48 | sa.sa_flags = SA_SIGINFO | flags; |
49 | sigemptyset(&sa.sa_mask); |
50 | if (sigaction(sig, &sa, 0)) |
51 | err(1, "sigaction" ); |
52 | } |
53 | |
54 | static void clearhandler(int sig) |
55 | { |
56 | struct sigaction sa; |
57 | memset(&sa, 0, sizeof(sa)); |
58 | sa.sa_handler = SIG_DFL; |
59 | sigemptyset(&sa.sa_mask); |
60 | if (sigaction(sig, &sa, 0)) |
61 | err(1, "sigaction" ); |
62 | } |
63 | |
64 | static void sigsegv(int sig, siginfo_t *si, void *ctx_void) |
65 | { |
66 | ucontext_t *ctx = (ucontext_t*)ctx_void; |
67 | |
68 | if (!want_segv) { |
69 | clearhandler(SIGSEGV); |
70 | return; /* Crash cleanly. */ |
71 | } |
72 | |
73 | want_segv = false; |
74 | segv_addr = (unsigned long)si->si_addr; |
75 | |
76 | ctx->uc_mcontext.gregs[REG_RIP] += 4; /* Skip the faulting mov */ |
77 | |
78 | } |
79 | |
80 | static jmp_buf jmpbuf; |
81 | |
82 | static void sigill(int sig, siginfo_t *si, void *ctx_void) |
83 | { |
84 | siglongjmp(jmpbuf, 1); |
85 | } |
86 | |
87 | static bool have_fsgsbase; |
88 | |
89 | static inline unsigned long rdgsbase(void) |
90 | { |
91 | unsigned long gsbase; |
92 | |
93 | asm volatile("rdgsbase %0" : "=r" (gsbase) :: "memory" ); |
94 | |
95 | return gsbase; |
96 | } |
97 | |
98 | static inline unsigned long rdfsbase(void) |
99 | { |
100 | unsigned long fsbase; |
101 | |
102 | asm volatile("rdfsbase %0" : "=r" (fsbase) :: "memory" ); |
103 | |
104 | return fsbase; |
105 | } |
106 | |
107 | static inline void wrgsbase(unsigned long gsbase) |
108 | { |
109 | asm volatile("wrgsbase %0" :: "r" (gsbase) : "memory" ); |
110 | } |
111 | |
112 | static inline void wrfsbase(unsigned long fsbase) |
113 | { |
114 | asm volatile("wrfsbase %0" :: "r" (fsbase) : "memory" ); |
115 | } |
116 | |
117 | enum which_base { FS, GS }; |
118 | |
119 | static unsigned long read_base(enum which_base which) |
120 | { |
121 | unsigned long offset; |
122 | /* |
123 | * Unless we have FSGSBASE, there's no direct way to do this from |
124 | * user mode. We can get at it indirectly using signals, though. |
125 | */ |
126 | |
127 | want_segv = true; |
128 | |
129 | offset = 0; |
130 | if (which == FS) { |
131 | /* Use a constant-length instruction here. */ |
132 | asm volatile ("mov %%fs:(%%rcx), %%rax" : : "c" (offset) : "rax" ); |
133 | } else { |
134 | asm volatile ("mov %%gs:(%%rcx), %%rax" : : "c" (offset) : "rax" ); |
135 | } |
136 | if (!want_segv) |
137 | return segv_addr + offset; |
138 | |
139 | /* |
140 | * If that didn't segfault, try the other end of the address space. |
141 | * Unless we get really unlucky and run into the vsyscall page, this |
142 | * is guaranteed to segfault. |
143 | */ |
144 | |
145 | offset = (ULONG_MAX >> 1) + 1; |
146 | if (which == FS) { |
147 | asm volatile ("mov %%fs:(%%rcx), %%rax" |
148 | : : "c" (offset) : "rax" ); |
149 | } else { |
150 | asm volatile ("mov %%gs:(%%rcx), %%rax" |
151 | : : "c" (offset) : "rax" ); |
152 | } |
153 | if (!want_segv) |
154 | return segv_addr + offset; |
155 | |
156 | abort(); |
157 | } |
158 | |
159 | static void check_gs_value(unsigned long value) |
160 | { |
161 | unsigned long base; |
162 | unsigned short sel; |
163 | |
164 | printf("[RUN]\tARCH_SET_GS to 0x%lx\n" , value); |
165 | if (syscall(SYS_arch_prctl, ARCH_SET_GS, value) != 0) |
166 | err(1, "ARCH_SET_GS" ); |
167 | |
168 | asm volatile ("mov %%gs, %0" : "=rm" (sel)); |
169 | base = read_base(which: GS); |
170 | if (base == value) { |
171 | printf("[OK]\tGSBASE was set as expected (selector 0x%hx)\n" , |
172 | sel); |
173 | } else { |
174 | nerrs++; |
175 | printf("[FAIL]\tGSBASE was not as expected: got 0x%lx (selector 0x%hx)\n" , |
176 | base, sel); |
177 | } |
178 | |
179 | if (syscall(SYS_arch_prctl, ARCH_GET_GS, &base) != 0) |
180 | err(1, "ARCH_GET_GS" ); |
181 | if (base == value) { |
182 | printf("[OK]\tARCH_GET_GS worked as expected (selector 0x%hx)\n" , |
183 | sel); |
184 | } else { |
185 | nerrs++; |
186 | printf("[FAIL]\tARCH_GET_GS was not as expected: got 0x%lx (selector 0x%hx)\n" , |
187 | base, sel); |
188 | } |
189 | } |
190 | |
191 | static void mov_0_gs(unsigned long initial_base, bool schedule) |
192 | { |
193 | unsigned long base, arch_base; |
194 | |
195 | printf("[RUN]\tARCH_SET_GS to 0x%lx then mov 0 to %%gs%s\n" , initial_base, schedule ? " and schedule " : "" ); |
196 | if (syscall(SYS_arch_prctl, ARCH_SET_GS, initial_base) != 0) |
197 | err(1, "ARCH_SET_GS" ); |
198 | |
199 | if (schedule) |
200 | usleep(10); |
201 | |
202 | asm volatile ("mov %0, %%gs" : : "rm" (0)); |
203 | base = read_base(which: GS); |
204 | if (syscall(SYS_arch_prctl, ARCH_GET_GS, &arch_base) != 0) |
205 | err(1, "ARCH_GET_GS" ); |
206 | if (base == arch_base) { |
207 | printf("[OK]\tGSBASE is 0x%lx\n" , base); |
208 | } else { |
209 | nerrs++; |
210 | printf("[FAIL]\tGSBASE changed to 0x%lx but kernel reports 0x%lx\n" , base, arch_base); |
211 | } |
212 | } |
213 | |
214 | static volatile unsigned long remote_base; |
215 | static volatile bool remote_hard_zero; |
216 | static volatile unsigned int ftx; |
217 | |
218 | /* |
219 | * ARCH_SET_FS/GS(0) may or may not program a selector of zero. HARD_ZERO |
220 | * means to force the selector to zero to improve test coverage. |
221 | */ |
222 | #define HARD_ZERO 0xa1fa5f343cb85fa4 |
223 | |
224 | static void do_remote_base() |
225 | { |
226 | unsigned long to_set = remote_base; |
227 | bool hard_zero = false; |
228 | if (to_set == HARD_ZERO) { |
229 | to_set = 0; |
230 | hard_zero = true; |
231 | } |
232 | |
233 | if (syscall(SYS_arch_prctl, ARCH_SET_GS, to_set) != 0) |
234 | err(1, "ARCH_SET_GS" ); |
235 | |
236 | if (hard_zero) |
237 | asm volatile ("mov %0, %%gs" : : "rm" ((unsigned short)0)); |
238 | |
239 | unsigned short sel; |
240 | asm volatile ("mov %%gs, %0" : "=rm" (sel)); |
241 | printf("\tother thread: ARCH_SET_GS(0x%lx)%s -- sel is 0x%hx\n" , |
242 | to_set, hard_zero ? " and clear gs" : "" , sel); |
243 | } |
244 | |
245 | static __thread int set_thread_area_entry_number = -1; |
246 | |
247 | static unsigned short load_gs(void) |
248 | { |
249 | /* |
250 | * Sets GS != 0 and GSBASE != 0 but arranges for the kernel to think |
251 | * that GSBASE == 0 (i.e. thread.gsbase == 0). |
252 | */ |
253 | |
254 | /* Step 1: tell the kernel that we have GSBASE == 0. */ |
255 | if (syscall(SYS_arch_prctl, ARCH_SET_GS, 0) != 0) |
256 | err(1, "ARCH_SET_GS" ); |
257 | |
258 | /* Step 2: change GSBASE without telling the kernel. */ |
259 | struct user_desc desc = { |
260 | .entry_number = 0, |
261 | .base_addr = 0xBAADF00D, |
262 | .limit = 0xfffff, |
263 | .seg_32bit = 1, |
264 | .contents = 0, /* Data, grow-up */ |
265 | .read_exec_only = 0, |
266 | .limit_in_pages = 1, |
267 | .seg_not_present = 0, |
268 | .useable = 0 |
269 | }; |
270 | if (syscall(SYS_modify_ldt, 1, &desc, sizeof(desc)) == 0) { |
271 | printf("\tusing LDT slot 0\n" ); |
272 | asm volatile ("mov %0, %%gs" : : "rm" ((unsigned short)0x7)); |
273 | return 0x7; |
274 | } else { |
275 | /* No modify_ldt for us (configured out, perhaps) */ |
276 | |
277 | struct user_desc *low_desc = mmap( |
278 | NULL, sizeof(desc), |
279 | PROT_READ | PROT_WRITE, |
280 | MAP_PRIVATE | MAP_ANONYMOUS | MAP_32BIT, -1, 0); |
281 | memcpy(low_desc, &desc, sizeof(desc)); |
282 | |
283 | low_desc->entry_number = set_thread_area_entry_number; |
284 | |
285 | /* 32-bit set_thread_area */ |
286 | long ret; |
287 | asm volatile ("int $0x80" |
288 | : "=a" (ret), "+m" (*low_desc) |
289 | : "a" (243), "b" (low_desc) |
290 | : "r8" , "r9" , "r10" , "r11" ); |
291 | memcpy(&desc, low_desc, sizeof(desc)); |
292 | munmap(low_desc, sizeof(desc)); |
293 | |
294 | if (ret != 0) { |
295 | printf("[NOTE]\tcould not create a segment -- test won't do anything\n" ); |
296 | return 0; |
297 | } |
298 | printf("\tusing GDT slot %d\n" , desc.entry_number); |
299 | set_thread_area_entry_number = desc.entry_number; |
300 | |
301 | unsigned short gs = (unsigned short)((desc.entry_number << 3) | 0x3); |
302 | asm volatile ("mov %0, %%gs" : : "rm" (gs)); |
303 | return gs; |
304 | } |
305 | } |
306 | |
307 | void test_wrbase(unsigned short index, unsigned long base) |
308 | { |
309 | unsigned short newindex; |
310 | unsigned long newbase; |
311 | |
312 | printf("[RUN]\tGS = 0x%hx, GSBASE = 0x%lx\n" , index, base); |
313 | |
314 | asm volatile ("mov %0, %%gs" : : "rm" (index)); |
315 | wrgsbase(gsbase: base); |
316 | |
317 | remote_base = 0; |
318 | ftx = 1; |
319 | syscall(SYS_futex, &ftx, FUTEX_WAKE, 0, NULL, NULL, 0); |
320 | while (ftx != 0) |
321 | syscall(SYS_futex, &ftx, FUTEX_WAIT, 1, NULL, NULL, 0); |
322 | |
323 | asm volatile ("mov %%gs, %0" : "=rm" (newindex)); |
324 | newbase = rdgsbase(); |
325 | |
326 | if (newindex == index && newbase == base) { |
327 | printf("[OK]\tIndex and base were preserved\n" ); |
328 | } else { |
329 | printf("[FAIL]\tAfter switch, GS = 0x%hx and GSBASE = 0x%lx\n" , |
330 | newindex, newbase); |
331 | nerrs++; |
332 | } |
333 | } |
334 | |
335 | static void *threadproc(void *ctx) |
336 | { |
337 | while (1) { |
338 | while (ftx == 0) |
339 | syscall(SYS_futex, &ftx, FUTEX_WAIT, 0, NULL, NULL, 0); |
340 | if (ftx == 3) |
341 | return NULL; |
342 | |
343 | if (ftx == 1) { |
344 | do_remote_base(); |
345 | } else if (ftx == 2) { |
346 | /* |
347 | * On AMD chips, this causes GSBASE != 0, GS == 0, and |
348 | * thread.gsbase == 0. |
349 | */ |
350 | |
351 | load_gs(); |
352 | asm volatile ("mov %0, %%gs" : : "rm" ((unsigned short)0)); |
353 | } else { |
354 | errx(1, "helper thread got bad command" ); |
355 | } |
356 | |
357 | ftx = 0; |
358 | syscall(SYS_futex, &ftx, FUTEX_WAKE, 0, NULL, NULL, 0); |
359 | } |
360 | } |
361 | |
362 | static void set_gs_and_switch_to(unsigned long local, |
363 | unsigned short force_sel, |
364 | unsigned long remote) |
365 | { |
366 | unsigned long base; |
367 | unsigned short sel_pre_sched, sel_post_sched; |
368 | |
369 | bool hard_zero = false; |
370 | if (local == HARD_ZERO) { |
371 | hard_zero = true; |
372 | local = 0; |
373 | } |
374 | |
375 | printf("[RUN]\tARCH_SET_GS(0x%lx)%s, then schedule to 0x%lx\n" , |
376 | local, hard_zero ? " and clear gs" : "" , remote); |
377 | if (force_sel) |
378 | printf("\tBefore schedule, set selector to 0x%hx\n" , force_sel); |
379 | if (syscall(SYS_arch_prctl, ARCH_SET_GS, local) != 0) |
380 | err(1, "ARCH_SET_GS" ); |
381 | if (hard_zero) |
382 | asm volatile ("mov %0, %%gs" : : "rm" ((unsigned short)0)); |
383 | |
384 | if (read_base(which: GS) != local) { |
385 | nerrs++; |
386 | printf("[FAIL]\tGSBASE wasn't set as expected\n" ); |
387 | } |
388 | |
389 | if (force_sel) { |
390 | asm volatile ("mov %0, %%gs" : : "rm" (force_sel)); |
391 | sel_pre_sched = force_sel; |
392 | local = read_base(which: GS); |
393 | |
394 | /* |
395 | * Signal delivery is quite likely to change a selector |
396 | * of 1, 2, or 3 back to 0 due to IRET being defective. |
397 | */ |
398 | asm volatile ("mov %0, %%gs" : : "rm" (force_sel)); |
399 | } else { |
400 | asm volatile ("mov %%gs, %0" : "=rm" (sel_pre_sched)); |
401 | } |
402 | |
403 | remote_base = remote; |
404 | ftx = 1; |
405 | syscall(SYS_futex, &ftx, FUTEX_WAKE, 0, NULL, NULL, 0); |
406 | while (ftx != 0) |
407 | syscall(SYS_futex, &ftx, FUTEX_WAIT, 1, NULL, NULL, 0); |
408 | |
409 | asm volatile ("mov %%gs, %0" : "=rm" (sel_post_sched)); |
410 | base = read_base(which: GS); |
411 | if (base == local && sel_pre_sched == sel_post_sched) { |
412 | printf("[OK]\tGS/BASE remained 0x%hx/0x%lx\n" , |
413 | sel_pre_sched, local); |
414 | } else if (base == local && sel_pre_sched >= 1 && sel_pre_sched <= 3 && |
415 | sel_post_sched == 0) { |
416 | /* |
417 | * IRET is misdesigned and will squash selectors 1, 2, or 3 |
418 | * to zero. Don't fail the test just because this happened. |
419 | */ |
420 | printf("[OK]\tGS/BASE changed from 0x%hx/0x%lx to 0x%hx/0x%lx because IRET is defective\n" , |
421 | sel_pre_sched, local, sel_post_sched, base); |
422 | } else { |
423 | nerrs++; |
424 | printf("[FAIL]\tGS/BASE changed from 0x%hx/0x%lx to 0x%hx/0x%lx\n" , |
425 | sel_pre_sched, local, sel_post_sched, base); |
426 | } |
427 | } |
428 | |
429 | static void test_unexpected_base(void) |
430 | { |
431 | unsigned long base; |
432 | |
433 | printf("[RUN]\tARCH_SET_GS(0), clear gs, then manipulate GSBASE in a different thread\n" ); |
434 | if (syscall(SYS_arch_prctl, ARCH_SET_GS, 0) != 0) |
435 | err(1, "ARCH_SET_GS" ); |
436 | asm volatile ("mov %0, %%gs" : : "rm" ((unsigned short)0)); |
437 | |
438 | ftx = 2; |
439 | syscall(SYS_futex, &ftx, FUTEX_WAKE, 0, NULL, NULL, 0); |
440 | while (ftx != 0) |
441 | syscall(SYS_futex, &ftx, FUTEX_WAIT, 1, NULL, NULL, 0); |
442 | |
443 | base = read_base(which: GS); |
444 | if (base == 0) { |
445 | printf("[OK]\tGSBASE remained 0\n" ); |
446 | } else { |
447 | nerrs++; |
448 | printf("[FAIL]\tGSBASE changed to 0x%lx\n" , base); |
449 | } |
450 | } |
451 | |
452 | #define USER_REGS_OFFSET(r) offsetof(struct user_regs_struct, r) |
453 | |
454 | static void test_ptrace_write_gs_read_base(void) |
455 | { |
456 | int status; |
457 | pid_t child = fork(); |
458 | |
459 | if (child < 0) |
460 | err(1, "fork" ); |
461 | |
462 | if (child == 0) { |
463 | printf("[RUN]\tPTRACE_POKE GS, read GSBASE back\n" ); |
464 | |
465 | printf("[RUN]\tARCH_SET_GS to 1\n" ); |
466 | if (syscall(SYS_arch_prctl, ARCH_SET_GS, 1) != 0) |
467 | err(1, "ARCH_SET_GS" ); |
468 | |
469 | if (ptrace(PTRACE_TRACEME, 0, NULL, NULL) != 0) |
470 | err(1, "PTRACE_TRACEME" ); |
471 | |
472 | raise(SIGTRAP); |
473 | _exit(0); |
474 | } |
475 | |
476 | wait(&status); |
477 | |
478 | if (WSTOPSIG(status) == SIGTRAP) { |
479 | unsigned long base; |
480 | unsigned long gs_offset = USER_REGS_OFFSET(gs); |
481 | unsigned long base_offset = USER_REGS_OFFSET(gs_base); |
482 | |
483 | /* Read the initial base. It should be 1. */ |
484 | base = ptrace(PTRACE_PEEKUSER, child, base_offset, NULL); |
485 | if (base == 1) { |
486 | printf("[OK]\tGSBASE started at 1\n" ); |
487 | } else { |
488 | nerrs++; |
489 | printf("[FAIL]\tGSBASE started at 0x%lx\n" , base); |
490 | } |
491 | |
492 | printf("[RUN]\tSet GS = 0x7, read GSBASE\n" ); |
493 | |
494 | /* Poke an LDT selector into GS. */ |
495 | if (ptrace(PTRACE_POKEUSER, child, gs_offset, 0x7) != 0) |
496 | err(1, "PTRACE_POKEUSER" ); |
497 | |
498 | /* And read the base. */ |
499 | base = ptrace(PTRACE_PEEKUSER, child, base_offset, NULL); |
500 | |
501 | if (base == 0 || base == 1) { |
502 | printf("[OK]\tGSBASE reads as 0x%lx with invalid GS\n" , base); |
503 | } else { |
504 | nerrs++; |
505 | printf("[FAIL]\tGSBASE=0x%lx (should be 0 or 1)\n" , base); |
506 | } |
507 | } |
508 | |
509 | ptrace(PTRACE_CONT, child, NULL, NULL); |
510 | |
511 | wait(&status); |
512 | if (!WIFEXITED(status)) |
513 | printf("[WARN]\tChild didn't exit cleanly.\n" ); |
514 | } |
515 | |
516 | static void test_ptrace_write_gsbase(void) |
517 | { |
518 | int status; |
519 | pid_t child = fork(); |
520 | |
521 | if (child < 0) |
522 | err(1, "fork" ); |
523 | |
524 | if (child == 0) { |
525 | printf("[RUN]\tPTRACE_POKE(), write GSBASE from ptracer\n" ); |
526 | |
527 | *shared_scratch = load_gs(); |
528 | |
529 | if (ptrace(PTRACE_TRACEME, 0, NULL, NULL) != 0) |
530 | err(1, "PTRACE_TRACEME" ); |
531 | |
532 | raise(SIGTRAP); |
533 | _exit(0); |
534 | } |
535 | |
536 | wait(&status); |
537 | |
538 | if (WSTOPSIG(status) == SIGTRAP) { |
539 | unsigned long gs, base; |
540 | unsigned long gs_offset = USER_REGS_OFFSET(gs); |
541 | unsigned long base_offset = USER_REGS_OFFSET(gs_base); |
542 | |
543 | gs = ptrace(PTRACE_PEEKUSER, child, gs_offset, NULL); |
544 | |
545 | if (gs != *shared_scratch) { |
546 | nerrs++; |
547 | printf("[FAIL]\tGS is not prepared with nonzero\n" ); |
548 | goto END; |
549 | } |
550 | |
551 | if (ptrace(PTRACE_POKEUSER, child, base_offset, 0xFF) != 0) |
552 | err(1, "PTRACE_POKEUSER" ); |
553 | |
554 | gs = ptrace(PTRACE_PEEKUSER, child, gs_offset, NULL); |
555 | base = ptrace(PTRACE_PEEKUSER, child, base_offset, NULL); |
556 | |
557 | /* |
558 | * In a non-FSGSBASE system, the nonzero selector will load |
559 | * GSBASE (again). But what is tested here is whether the |
560 | * selector value is changed or not by the GSBASE write in |
561 | * a ptracer. |
562 | */ |
563 | if (gs != *shared_scratch) { |
564 | nerrs++; |
565 | printf("[FAIL]\tGS changed to %lx\n" , gs); |
566 | |
567 | /* |
568 | * On older kernels, poking a nonzero value into the |
569 | * base would zero the selector. On newer kernels, |
570 | * this behavior has changed -- poking the base |
571 | * changes only the base and, if FSGSBASE is not |
572 | * available, this may have no effect once the tracee |
573 | * is resumed. |
574 | */ |
575 | if (gs == 0) |
576 | printf("\tNote: this is expected behavior on older kernels.\n" ); |
577 | } else if (have_fsgsbase && (base != 0xFF)) { |
578 | nerrs++; |
579 | printf("[FAIL]\tGSBASE changed to %lx\n" , base); |
580 | } else { |
581 | printf("[OK]\tGS remained 0x%hx" , *shared_scratch); |
582 | if (have_fsgsbase) |
583 | printf(" and GSBASE changed to 0xFF" ); |
584 | printf("\n" ); |
585 | } |
586 | } |
587 | |
588 | END: |
589 | ptrace(PTRACE_CONT, child, NULL, NULL); |
590 | wait(&status); |
591 | if (!WIFEXITED(status)) |
592 | printf("[WARN]\tChild didn't exit cleanly.\n" ); |
593 | } |
594 | |
595 | int main() |
596 | { |
597 | pthread_t thread; |
598 | |
599 | shared_scratch = mmap(NULL, 4096, PROT_READ | PROT_WRITE, |
600 | MAP_ANONYMOUS | MAP_SHARED, -1, 0); |
601 | |
602 | /* Do these tests before we have an LDT. */ |
603 | test_ptrace_write_gs_read_base(); |
604 | |
605 | /* Probe FSGSBASE */ |
606 | sethandler(SIGILL, handler: sigill, flags: 0); |
607 | if (sigsetjmp(jmpbuf, 1) == 0) { |
608 | rdfsbase(); |
609 | have_fsgsbase = true; |
610 | printf("\tFSGSBASE instructions are enabled\n" ); |
611 | } else { |
612 | printf("\tFSGSBASE instructions are disabled\n" ); |
613 | } |
614 | clearhandler(SIGILL); |
615 | |
616 | sethandler(SIGSEGV, handler: sigsegv, flags: 0); |
617 | |
618 | check_gs_value(value: 0); |
619 | check_gs_value(value: 1); |
620 | check_gs_value(value: 0x200000000); |
621 | check_gs_value(value: 0); |
622 | check_gs_value(value: 0x200000000); |
623 | check_gs_value(value: 1); |
624 | |
625 | for (int sched = 0; sched < 2; sched++) { |
626 | mov_0_gs(initial_base: 0, schedule: !!sched); |
627 | mov_0_gs(initial_base: 1, schedule: !!sched); |
628 | mov_0_gs(initial_base: 0x200000000, schedule: !!sched); |
629 | } |
630 | |
631 | /* Set up for multithreading. */ |
632 | |
633 | cpu_set_t cpuset; |
634 | CPU_ZERO(&cpuset); |
635 | CPU_SET(0, &cpuset); |
636 | if (sched_setaffinity(0, sizeof(cpuset), &cpuset) != 0) |
637 | err(1, "sched_setaffinity to CPU 0" ); /* should never fail */ |
638 | |
639 | if (pthread_create(&thread, 0, threadproc, 0) != 0) |
640 | err(1, "pthread_create" ); |
641 | |
642 | static unsigned long bases_with_hard_zero[] = { |
643 | 0, HARD_ZERO, 1, 0x200000000, |
644 | }; |
645 | |
646 | for (int local = 0; local < 4; local++) { |
647 | for (int remote = 0; remote < 4; remote++) { |
648 | for (unsigned short s = 0; s < 5; s++) { |
649 | unsigned short sel = s; |
650 | if (s == 4) |
651 | asm ("mov %%ss, %0" : "=rm" (sel)); |
652 | set_gs_and_switch_to( |
653 | local: bases_with_hard_zero[local], |
654 | force_sel: sel, |
655 | remote: bases_with_hard_zero[remote]); |
656 | } |
657 | } |
658 | } |
659 | |
660 | test_unexpected_base(); |
661 | |
662 | if (have_fsgsbase) { |
663 | unsigned short ss; |
664 | |
665 | asm volatile ("mov %%ss, %0" : "=rm" (ss)); |
666 | |
667 | test_wrbase(index: 0, base: 0); |
668 | test_wrbase(index: 0, base: 1); |
669 | test_wrbase(index: 0, base: 0x200000000); |
670 | test_wrbase(index: 0, base: 0xffffffffffffffff); |
671 | test_wrbase(index: ss, base: 0); |
672 | test_wrbase(index: ss, base: 1); |
673 | test_wrbase(index: ss, base: 0x200000000); |
674 | test_wrbase(index: ss, base: 0xffffffffffffffff); |
675 | } |
676 | |
677 | ftx = 3; /* Kill the thread. */ |
678 | syscall(SYS_futex, &ftx, FUTEX_WAKE, 0, NULL, NULL, 0); |
679 | |
680 | if (pthread_join(thread, NULL) != 0) |
681 | err(1, "pthread_join" ); |
682 | |
683 | test_ptrace_write_gsbase(); |
684 | |
685 | return nerrs == 0 ? 0 : 1; |
686 | } |
687 | |