1 | // SPDX-License-Identifier: GPL-2.0 |
2 | /* |
3 | * ldt_gdt.c - Test cases for LDT and GDT access |
4 | * Copyright (c) 2015 Andrew Lutomirski |
5 | */ |
6 | |
7 | #define _GNU_SOURCE |
8 | #include <err.h> |
9 | #include <stdio.h> |
10 | #include <stdint.h> |
11 | #include <signal.h> |
12 | #include <setjmp.h> |
13 | #include <stdlib.h> |
14 | #include <string.h> |
15 | #include <errno.h> |
16 | #include <unistd.h> |
17 | #include <sys/syscall.h> |
18 | #include <asm/ldt.h> |
19 | #include <sys/types.h> |
20 | #include <sys/wait.h> |
21 | #include <stdbool.h> |
22 | #include <pthread.h> |
23 | #include <sched.h> |
24 | #include <linux/futex.h> |
25 | #include <sys/mman.h> |
26 | #include <asm/prctl.h> |
27 | #include <sys/prctl.h> |
28 | |
29 | #define AR_ACCESSED (1<<8) |
30 | |
31 | #define AR_TYPE_RODATA (0 * (1<<9)) |
32 | #define AR_TYPE_RWDATA (1 * (1<<9)) |
33 | #define AR_TYPE_RODATA_EXPDOWN (2 * (1<<9)) |
34 | #define AR_TYPE_RWDATA_EXPDOWN (3 * (1<<9)) |
35 | #define AR_TYPE_XOCODE (4 * (1<<9)) |
36 | #define AR_TYPE_XRCODE (5 * (1<<9)) |
37 | #define AR_TYPE_XOCODE_CONF (6 * (1<<9)) |
38 | #define AR_TYPE_XRCODE_CONF (7 * (1<<9)) |
39 | |
40 | #define AR_DPL3 (3 * (1<<13)) |
41 | |
42 | #define AR_S (1 << 12) |
43 | #define AR_P (1 << 15) |
44 | #define AR_AVL (1 << 20) |
45 | #define AR_L (1 << 21) |
46 | #define AR_DB (1 << 22) |
47 | #define AR_G (1 << 23) |
48 | |
49 | #ifdef __x86_64__ |
50 | # define INT80_CLOBBERS "r8", "r9", "r10", "r11" |
51 | #else |
52 | # define INT80_CLOBBERS |
53 | #endif |
54 | |
55 | static int nerrs; |
56 | |
57 | /* Points to an array of 1024 ints, each holding its own index. */ |
58 | static const unsigned int *counter_page; |
59 | static struct user_desc *low_user_desc; |
60 | static struct user_desc *low_user_desc_clear; /* Use to delete GDT entry */ |
61 | static int gdt_entry_num; |
62 | |
63 | static void check_invalid_segment(uint16_t index, int ldt) |
64 | { |
65 | uint32_t has_limit = 0, has_ar = 0, limit, ar; |
66 | uint32_t selector = (index << 3) | (ldt << 2) | 3; |
67 | |
68 | asm ("lsl %[selector], %[limit]\n\t" |
69 | "jnz 1f\n\t" |
70 | "movl $1, %[has_limit]\n\t" |
71 | "1:" |
72 | : [limit] "=r" (limit), [has_limit] "+rm" (has_limit) |
73 | : [selector] "r" (selector)); |
74 | asm ("larl %[selector], %[ar]\n\t" |
75 | "jnz 1f\n\t" |
76 | "movl $1, %[has_ar]\n\t" |
77 | "1:" |
78 | : [ar] "=r" (ar), [has_ar] "+rm" (has_ar) |
79 | : [selector] "r" (selector)); |
80 | |
81 | if (has_limit || has_ar) { |
82 | printf("[FAIL]\t%s entry %hu is valid but should be invalid\n" , |
83 | (ldt ? "LDT" : "GDT" ), index); |
84 | nerrs++; |
85 | } else { |
86 | printf("[OK]\t%s entry %hu is invalid\n" , |
87 | (ldt ? "LDT" : "GDT" ), index); |
88 | } |
89 | } |
90 | |
91 | static void check_valid_segment(uint16_t index, int ldt, |
92 | uint32_t expected_ar, uint32_t expected_limit, |
93 | bool verbose) |
94 | { |
95 | uint32_t has_limit = 0, has_ar = 0, limit, ar; |
96 | uint32_t selector = (index << 3) | (ldt << 2) | 3; |
97 | |
98 | asm ("lsl %[selector], %[limit]\n\t" |
99 | "jnz 1f\n\t" |
100 | "movl $1, %[has_limit]\n\t" |
101 | "1:" |
102 | : [limit] "=r" (limit), [has_limit] "+rm" (has_limit) |
103 | : [selector] "r" (selector)); |
104 | asm ("larl %[selector], %[ar]\n\t" |
105 | "jnz 1f\n\t" |
106 | "movl $1, %[has_ar]\n\t" |
107 | "1:" |
108 | : [ar] "=r" (ar), [has_ar] "+rm" (has_ar) |
109 | : [selector] "r" (selector)); |
110 | |
111 | if (!has_limit || !has_ar) { |
112 | printf("[FAIL]\t%s entry %hu is invalid but should be valid\n" , |
113 | (ldt ? "LDT" : "GDT" ), index); |
114 | nerrs++; |
115 | return; |
116 | } |
117 | |
118 | /* The SDM says "bits 19:16 are undefined". Thanks. */ |
119 | ar &= ~0xF0000; |
120 | |
121 | /* |
122 | * NB: Different Linux versions do different things with the |
123 | * accessed bit in set_thread_area(). |
124 | */ |
125 | if (ar != expected_ar && ar != (expected_ar | AR_ACCESSED)) { |
126 | printf("[FAIL]\t%s entry %hu has AR 0x%08X but expected 0x%08X\n" , |
127 | (ldt ? "LDT" : "GDT" ), index, ar, expected_ar); |
128 | nerrs++; |
129 | } else if (limit != expected_limit) { |
130 | printf("[FAIL]\t%s entry %hu has limit 0x%08X but expected 0x%08X\n" , |
131 | (ldt ? "LDT" : "GDT" ), index, limit, expected_limit); |
132 | nerrs++; |
133 | } else if (verbose) { |
134 | printf("[OK]\t%s entry %hu has AR 0x%08X and limit 0x%08X\n" , |
135 | (ldt ? "LDT" : "GDT" ), index, ar, limit); |
136 | } |
137 | } |
138 | |
139 | static bool install_valid_mode(const struct user_desc *d, uint32_t ar, |
140 | bool oldmode, bool ldt) |
141 | { |
142 | struct user_desc desc = *d; |
143 | int ret; |
144 | |
145 | if (!ldt) { |
146 | #ifndef __i386__ |
147 | /* No point testing set_thread_area in a 64-bit build */ |
148 | return false; |
149 | #endif |
150 | if (!gdt_entry_num) |
151 | return false; |
152 | desc.entry_number = gdt_entry_num; |
153 | |
154 | ret = syscall(SYS_set_thread_area, &desc); |
155 | } else { |
156 | ret = syscall(SYS_modify_ldt, oldmode ? 1 : 0x11, |
157 | &desc, sizeof(desc)); |
158 | |
159 | if (ret < -1) |
160 | errno = -ret; |
161 | |
162 | if (ret != 0 && errno == ENOSYS) { |
163 | printf("[OK]\tmodify_ldt returned -ENOSYS\n" ); |
164 | return false; |
165 | } |
166 | } |
167 | |
168 | if (ret == 0) { |
169 | uint32_t limit = desc.limit; |
170 | if (desc.limit_in_pages) |
171 | limit = (limit << 12) + 4095; |
172 | check_valid_segment(index: desc.entry_number, ldt, expected_ar: ar, expected_limit: limit, verbose: true); |
173 | return true; |
174 | } else { |
175 | if (desc.seg_32bit) { |
176 | printf("[FAIL]\tUnexpected %s failure %d\n" , |
177 | ldt ? "modify_ldt" : "set_thread_area" , |
178 | errno); |
179 | nerrs++; |
180 | return false; |
181 | } else { |
182 | printf("[OK]\t%s rejected 16 bit segment\n" , |
183 | ldt ? "modify_ldt" : "set_thread_area" ); |
184 | return false; |
185 | } |
186 | } |
187 | } |
188 | |
189 | static bool install_valid(const struct user_desc *desc, uint32_t ar) |
190 | { |
191 | bool ret = install_valid_mode(d: desc, ar, oldmode: false, ldt: true); |
192 | |
193 | if (desc->contents <= 1 && desc->seg_32bit && |
194 | !desc->seg_not_present) { |
195 | /* Should work in the GDT, too. */ |
196 | install_valid_mode(d: desc, ar, oldmode: false, ldt: false); |
197 | } |
198 | |
199 | return ret; |
200 | } |
201 | |
202 | static void install_invalid(const struct user_desc *desc, bool oldmode) |
203 | { |
204 | int ret = syscall(SYS_modify_ldt, oldmode ? 1 : 0x11, |
205 | desc, sizeof(*desc)); |
206 | if (ret < -1) |
207 | errno = -ret; |
208 | if (ret == 0) { |
209 | check_invalid_segment(index: desc->entry_number, ldt: 1); |
210 | } else if (errno == ENOSYS) { |
211 | printf("[OK]\tmodify_ldt returned -ENOSYS\n" ); |
212 | } else { |
213 | if (desc->seg_32bit) { |
214 | printf("[FAIL]\tUnexpected modify_ldt failure %d\n" , |
215 | errno); |
216 | nerrs++; |
217 | } else { |
218 | printf("[OK]\tmodify_ldt rejected 16 bit segment\n" ); |
219 | } |
220 | } |
221 | } |
222 | |
223 | static int safe_modify_ldt(int func, struct user_desc *ptr, |
224 | unsigned long bytecount) |
225 | { |
226 | int ret = syscall(SYS_modify_ldt, 0x11, ptr, bytecount); |
227 | if (ret < -1) |
228 | errno = -ret; |
229 | return ret; |
230 | } |
231 | |
232 | static void fail_install(struct user_desc *desc) |
233 | { |
234 | if (safe_modify_ldt(func: 0x11, ptr: desc, bytecount: sizeof(*desc)) == 0) { |
235 | printf("[FAIL]\tmodify_ldt accepted a bad descriptor\n" ); |
236 | nerrs++; |
237 | } else if (errno == ENOSYS) { |
238 | printf("[OK]\tmodify_ldt returned -ENOSYS\n" ); |
239 | } else { |
240 | printf("[OK]\tmodify_ldt failure %d\n" , errno); |
241 | } |
242 | } |
243 | |
244 | static void do_simple_tests(void) |
245 | { |
246 | struct user_desc desc = { |
247 | .entry_number = 0, |
248 | .base_addr = 0, |
249 | .limit = 10, |
250 | .seg_32bit = 1, |
251 | .contents = 2, /* Code, not conforming */ |
252 | .read_exec_only = 0, |
253 | .limit_in_pages = 0, |
254 | .seg_not_present = 0, |
255 | .useable = 0 |
256 | }; |
257 | install_valid(desc: &desc, AR_DPL3 | AR_TYPE_XRCODE | AR_S | AR_P | AR_DB); |
258 | |
259 | desc.limit_in_pages = 1; |
260 | install_valid(desc: &desc, AR_DPL3 | AR_TYPE_XRCODE | |
261 | AR_S | AR_P | AR_DB | AR_G); |
262 | |
263 | check_invalid_segment(index: 1, ldt: 1); |
264 | |
265 | desc.entry_number = 2; |
266 | install_valid(desc: &desc, AR_DPL3 | AR_TYPE_XRCODE | |
267 | AR_S | AR_P | AR_DB | AR_G); |
268 | |
269 | check_invalid_segment(index: 1, ldt: 1); |
270 | |
271 | desc.base_addr = 0xf0000000; |
272 | install_valid(desc: &desc, AR_DPL3 | AR_TYPE_XRCODE | |
273 | AR_S | AR_P | AR_DB | AR_G); |
274 | |
275 | desc.useable = 1; |
276 | install_valid(desc: &desc, AR_DPL3 | AR_TYPE_XRCODE | |
277 | AR_S | AR_P | AR_DB | AR_G | AR_AVL); |
278 | |
279 | desc.seg_not_present = 1; |
280 | install_valid(desc: &desc, AR_DPL3 | AR_TYPE_XRCODE | |
281 | AR_S | AR_DB | AR_G | AR_AVL); |
282 | |
283 | desc.seg_32bit = 0; |
284 | install_valid(desc: &desc, AR_DPL3 | AR_TYPE_XRCODE | |
285 | AR_S | AR_G | AR_AVL); |
286 | |
287 | desc.seg_32bit = 1; |
288 | desc.contents = 0; |
289 | install_valid(desc: &desc, AR_DPL3 | AR_TYPE_RWDATA | |
290 | AR_S | AR_DB | AR_G | AR_AVL); |
291 | |
292 | desc.read_exec_only = 1; |
293 | install_valid(desc: &desc, AR_DPL3 | AR_TYPE_RODATA | |
294 | AR_S | AR_DB | AR_G | AR_AVL); |
295 | |
296 | desc.contents = 1; |
297 | install_valid(desc: &desc, AR_DPL3 | AR_TYPE_RODATA_EXPDOWN | |
298 | AR_S | AR_DB | AR_G | AR_AVL); |
299 | |
300 | desc.read_exec_only = 0; |
301 | desc.limit_in_pages = 0; |
302 | install_valid(desc: &desc, AR_DPL3 | AR_TYPE_RWDATA_EXPDOWN | |
303 | AR_S | AR_DB | AR_AVL); |
304 | |
305 | desc.contents = 3; |
306 | install_valid(desc: &desc, AR_DPL3 | AR_TYPE_XRCODE_CONF | |
307 | AR_S | AR_DB | AR_AVL); |
308 | |
309 | desc.read_exec_only = 1; |
310 | install_valid(desc: &desc, AR_DPL3 | AR_TYPE_XOCODE_CONF | |
311 | AR_S | AR_DB | AR_AVL); |
312 | |
313 | desc.read_exec_only = 0; |
314 | desc.contents = 2; |
315 | install_valid(desc: &desc, AR_DPL3 | AR_TYPE_XRCODE | |
316 | AR_S | AR_DB | AR_AVL); |
317 | |
318 | desc.read_exec_only = 1; |
319 | |
320 | #ifdef __x86_64__ |
321 | desc.lm = 1; |
322 | install_valid(desc: &desc, AR_DPL3 | AR_TYPE_XOCODE | |
323 | AR_S | AR_DB | AR_AVL); |
324 | desc.lm = 0; |
325 | #endif |
326 | |
327 | bool entry1_okay = install_valid(desc: &desc, AR_DPL3 | AR_TYPE_XOCODE | |
328 | AR_S | AR_DB | AR_AVL); |
329 | |
330 | if (entry1_okay) { |
331 | printf("[RUN]\tTest fork\n" ); |
332 | pid_t child = fork(); |
333 | if (child == 0) { |
334 | nerrs = 0; |
335 | check_valid_segment(index: desc.entry_number, ldt: 1, |
336 | AR_DPL3 | AR_TYPE_XOCODE | |
337 | AR_S | AR_DB | AR_AVL, expected_limit: desc.limit, |
338 | verbose: true); |
339 | check_invalid_segment(index: 1, ldt: 1); |
340 | exit(nerrs ? 1 : 0); |
341 | } else { |
342 | int status; |
343 | if (waitpid(child, &status, 0) != child || |
344 | !WIFEXITED(status)) { |
345 | printf("[FAIL]\tChild died\n" ); |
346 | nerrs++; |
347 | } else if (WEXITSTATUS(status) != 0) { |
348 | printf("[FAIL]\tChild failed\n" ); |
349 | nerrs++; |
350 | } else { |
351 | printf("[OK]\tChild succeeded\n" ); |
352 | } |
353 | } |
354 | |
355 | printf("[RUN]\tTest size\n" ); |
356 | int i; |
357 | for (i = 0; i < 8192; i++) { |
358 | desc.entry_number = i; |
359 | desc.limit = i; |
360 | if (safe_modify_ldt(func: 0x11, ptr: &desc, bytecount: sizeof(desc)) != 0) { |
361 | printf("[FAIL]\tFailed to install entry %d\n" , i); |
362 | nerrs++; |
363 | break; |
364 | } |
365 | } |
366 | for (int j = 0; j < i; j++) { |
367 | check_valid_segment(index: j, ldt: 1, AR_DPL3 | AR_TYPE_XOCODE | |
368 | AR_S | AR_DB | AR_AVL, expected_limit: j, verbose: false); |
369 | } |
370 | printf("[DONE]\tSize test\n" ); |
371 | } else { |
372 | printf("[SKIP]\tSkipping fork and size tests because we have no LDT\n" ); |
373 | } |
374 | |
375 | /* Test entry_number too high. */ |
376 | desc.entry_number = 8192; |
377 | fail_install(desc: &desc); |
378 | |
379 | /* Test deletion and actions mistakeable for deletion. */ |
380 | memset(&desc, 0, sizeof(desc)); |
381 | install_valid(desc: &desc, AR_DPL3 | AR_TYPE_RWDATA | AR_S | AR_P); |
382 | |
383 | desc.seg_not_present = 1; |
384 | install_valid(desc: &desc, AR_DPL3 | AR_TYPE_RWDATA | AR_S); |
385 | |
386 | desc.seg_not_present = 0; |
387 | desc.read_exec_only = 1; |
388 | install_valid(desc: &desc, AR_DPL3 | AR_TYPE_RODATA | AR_S | AR_P); |
389 | |
390 | desc.read_exec_only = 0; |
391 | desc.seg_not_present = 1; |
392 | install_valid(desc: &desc, AR_DPL3 | AR_TYPE_RWDATA | AR_S); |
393 | |
394 | desc.read_exec_only = 1; |
395 | desc.limit = 1; |
396 | install_valid(desc: &desc, AR_DPL3 | AR_TYPE_RODATA | AR_S); |
397 | |
398 | desc.limit = 0; |
399 | desc.base_addr = 1; |
400 | install_valid(desc: &desc, AR_DPL3 | AR_TYPE_RODATA | AR_S); |
401 | |
402 | desc.base_addr = 0; |
403 | install_invalid(desc: &desc, oldmode: false); |
404 | |
405 | desc.seg_not_present = 0; |
406 | desc.seg_32bit = 1; |
407 | desc.read_exec_only = 0; |
408 | desc.limit = 0xfffff; |
409 | |
410 | install_valid(desc: &desc, AR_DPL3 | AR_TYPE_RWDATA | AR_S | AR_P | AR_DB); |
411 | |
412 | desc.limit_in_pages = 1; |
413 | |
414 | install_valid(desc: &desc, AR_DPL3 | AR_TYPE_RWDATA | AR_S | AR_P | AR_DB | AR_G); |
415 | desc.read_exec_only = 1; |
416 | install_valid(desc: &desc, AR_DPL3 | AR_TYPE_RODATA | AR_S | AR_P | AR_DB | AR_G); |
417 | desc.contents = 1; |
418 | desc.read_exec_only = 0; |
419 | install_valid(desc: &desc, AR_DPL3 | AR_TYPE_RWDATA_EXPDOWN | AR_S | AR_P | AR_DB | AR_G); |
420 | desc.read_exec_only = 1; |
421 | install_valid(desc: &desc, AR_DPL3 | AR_TYPE_RODATA_EXPDOWN | AR_S | AR_P | AR_DB | AR_G); |
422 | |
423 | desc.limit = 0; |
424 | install_invalid(desc: &desc, oldmode: true); |
425 | } |
426 | |
427 | /* |
428 | * 0: thread is idle |
429 | * 1: thread armed |
430 | * 2: thread should clear LDT entry 0 |
431 | * 3: thread should exit |
432 | */ |
433 | static volatile unsigned int ftx; |
434 | |
435 | static void *threadproc(void *ctx) |
436 | { |
437 | cpu_set_t cpuset; |
438 | CPU_ZERO(&cpuset); |
439 | CPU_SET(1, &cpuset); |
440 | if (sched_setaffinity(0, sizeof(cpuset), &cpuset) != 0) |
441 | err(1, "sched_setaffinity to CPU 1" ); /* should never fail */ |
442 | |
443 | while (1) { |
444 | syscall(SYS_futex, &ftx, FUTEX_WAIT, 0, NULL, NULL, 0); |
445 | while (ftx != 2) { |
446 | if (ftx >= 3) |
447 | return NULL; |
448 | } |
449 | |
450 | /* clear LDT entry 0 */ |
451 | const struct user_desc desc = {}; |
452 | if (syscall(SYS_modify_ldt, 1, &desc, sizeof(desc)) != 0) |
453 | err(1, "modify_ldt" ); |
454 | |
455 | /* If ftx == 2, set it to zero. If ftx == 100, quit. */ |
456 | unsigned int x = -2; |
457 | asm volatile ("lock xaddl %[x], %[ftx]" : |
458 | [x] "+r" (x), [ftx] "+m" (ftx)); |
459 | if (x != 2) |
460 | return NULL; |
461 | } |
462 | } |
463 | |
464 | #ifdef __i386__ |
465 | |
466 | #ifndef SA_RESTORE |
467 | #define SA_RESTORER 0x04000000 |
468 | #endif |
469 | |
470 | /* |
471 | * The UAPI header calls this 'struct sigaction', which conflicts with |
472 | * glibc. Sigh. |
473 | */ |
474 | struct fake_ksigaction { |
475 | void *handler; /* the real type is nasty */ |
476 | unsigned long sa_flags; |
477 | void (*sa_restorer)(void); |
478 | unsigned char sigset[8]; |
479 | }; |
480 | |
481 | static void fix_sa_restorer(int sig) |
482 | { |
483 | struct fake_ksigaction ksa; |
484 | |
485 | if (syscall(SYS_rt_sigaction, sig, NULL, &ksa, 8) == 0) { |
486 | /* |
487 | * glibc has a nasty bug: it sometimes writes garbage to |
488 | * sa_restorer. This interacts quite badly with anything |
489 | * that fiddles with SS because it can trigger legacy |
490 | * stack switching. Patch it up. See: |
491 | * |
492 | * https://sourceware.org/bugzilla/show_bug.cgi?id=21269 |
493 | */ |
494 | if (!(ksa.sa_flags & SA_RESTORER) && ksa.sa_restorer) { |
495 | ksa.sa_restorer = NULL; |
496 | if (syscall(SYS_rt_sigaction, sig, &ksa, NULL, |
497 | sizeof(ksa.sigset)) != 0) |
498 | err(1, "rt_sigaction" ); |
499 | } |
500 | } |
501 | } |
502 | #else |
503 | static void fix_sa_restorer(int sig) |
504 | { |
505 | /* 64-bit glibc works fine. */ |
506 | } |
507 | #endif |
508 | |
509 | static void sethandler(int sig, void (*handler)(int, siginfo_t *, void *), |
510 | int flags) |
511 | { |
512 | struct sigaction sa; |
513 | memset(&sa, 0, sizeof(sa)); |
514 | sa.sa_sigaction = handler; |
515 | sa.sa_flags = SA_SIGINFO | flags; |
516 | sigemptyset(&sa.sa_mask); |
517 | if (sigaction(sig, &sa, 0)) |
518 | err(1, "sigaction" ); |
519 | |
520 | fix_sa_restorer(sig); |
521 | } |
522 | |
523 | static jmp_buf jmpbuf; |
524 | |
525 | static void sigsegv(int sig, siginfo_t *info, void *ctx_void) |
526 | { |
527 | siglongjmp(jmpbuf, 1); |
528 | } |
529 | |
530 | static void do_multicpu_tests(void) |
531 | { |
532 | cpu_set_t cpuset; |
533 | pthread_t thread; |
534 | int failures = 0, iters = 5, i; |
535 | unsigned short orig_ss; |
536 | |
537 | CPU_ZERO(&cpuset); |
538 | CPU_SET(1, &cpuset); |
539 | if (sched_setaffinity(0, sizeof(cpuset), &cpuset) != 0) { |
540 | printf("[SKIP]\tCannot set affinity to CPU 1\n" ); |
541 | return; |
542 | } |
543 | |
544 | CPU_ZERO(&cpuset); |
545 | CPU_SET(0, &cpuset); |
546 | if (sched_setaffinity(0, sizeof(cpuset), &cpuset) != 0) { |
547 | printf("[SKIP]\tCannot set affinity to CPU 0\n" ); |
548 | return; |
549 | } |
550 | |
551 | sethandler(SIGSEGV, handler: sigsegv, flags: 0); |
552 | #ifdef __i386__ |
553 | /* True 32-bit kernels send SIGILL instead of SIGSEGV on IRET faults. */ |
554 | sethandler(SIGILL, sigsegv, 0); |
555 | #endif |
556 | |
557 | printf("[RUN]\tCross-CPU LDT invalidation\n" ); |
558 | |
559 | if (pthread_create(&thread, 0, threadproc, 0) != 0) |
560 | err(1, "pthread_create" ); |
561 | |
562 | asm volatile ("mov %%ss, %0" : "=rm" (orig_ss)); |
563 | |
564 | for (i = 0; i < 5; i++) { |
565 | if (sigsetjmp(jmpbuf, 1) != 0) |
566 | continue; |
567 | |
568 | /* Make sure the thread is ready after the last test. */ |
569 | while (ftx != 0) |
570 | ; |
571 | |
572 | struct user_desc desc = { |
573 | .entry_number = 0, |
574 | .base_addr = 0, |
575 | .limit = 0xfffff, |
576 | .seg_32bit = 1, |
577 | .contents = 0, /* Data */ |
578 | .read_exec_only = 0, |
579 | .limit_in_pages = 1, |
580 | .seg_not_present = 0, |
581 | .useable = 0 |
582 | }; |
583 | |
584 | if (safe_modify_ldt(func: 0x11, ptr: &desc, bytecount: sizeof(desc)) != 0) { |
585 | if (errno != ENOSYS) |
586 | err(1, "modify_ldt" ); |
587 | printf("[SKIP]\tmodify_ldt unavailable\n" ); |
588 | break; |
589 | } |
590 | |
591 | /* Arm the thread. */ |
592 | ftx = 1; |
593 | syscall(SYS_futex, &ftx, FUTEX_WAKE, 0, NULL, NULL, 0); |
594 | |
595 | asm volatile ("mov %0, %%ss" : : "r" (0x7)); |
596 | |
597 | /* Go! */ |
598 | ftx = 2; |
599 | |
600 | while (ftx != 0) |
601 | ; |
602 | |
603 | /* |
604 | * On success, modify_ldt will segfault us synchronously, |
605 | * and we'll escape via siglongjmp. |
606 | */ |
607 | |
608 | failures++; |
609 | asm volatile ("mov %0, %%ss" : : "rm" (orig_ss)); |
610 | } |
611 | |
612 | ftx = 100; /* Kill the thread. */ |
613 | syscall(SYS_futex, &ftx, FUTEX_WAKE, 0, NULL, NULL, 0); |
614 | |
615 | if (pthread_join(thread, NULL) != 0) |
616 | err(1, "pthread_join" ); |
617 | |
618 | if (failures) { |
619 | printf("[FAIL]\t%d of %d iterations failed\n" , failures, iters); |
620 | nerrs++; |
621 | } else { |
622 | printf("[OK]\tAll %d iterations succeeded\n" , iters); |
623 | } |
624 | } |
625 | |
626 | static int finish_exec_test(void) |
627 | { |
628 | /* |
629 | * Older kernel versions did inherit the LDT on exec() which is |
630 | * wrong because exec() starts from a clean state. |
631 | */ |
632 | check_invalid_segment(index: 0, ldt: 1); |
633 | |
634 | return nerrs ? 1 : 0; |
635 | } |
636 | |
637 | static void do_exec_test(void) |
638 | { |
639 | printf("[RUN]\tTest exec\n" ); |
640 | |
641 | struct user_desc desc = { |
642 | .entry_number = 0, |
643 | .base_addr = 0, |
644 | .limit = 42, |
645 | .seg_32bit = 1, |
646 | .contents = 2, /* Code, not conforming */ |
647 | .read_exec_only = 0, |
648 | .limit_in_pages = 0, |
649 | .seg_not_present = 0, |
650 | .useable = 0 |
651 | }; |
652 | install_valid(desc: &desc, AR_DPL3 | AR_TYPE_XRCODE | AR_S | AR_P | AR_DB); |
653 | |
654 | pid_t child = fork(); |
655 | if (child == 0) { |
656 | execl("/proc/self/exe" , "ldt_gdt_test_exec" , NULL); |
657 | printf("[FAIL]\tCould not exec self\n" ); |
658 | exit(1); /* exec failed */ |
659 | } else { |
660 | int status; |
661 | if (waitpid(child, &status, 0) != child || |
662 | !WIFEXITED(status)) { |
663 | printf("[FAIL]\tChild died\n" ); |
664 | nerrs++; |
665 | } else if (WEXITSTATUS(status) != 0) { |
666 | printf("[FAIL]\tChild failed\n" ); |
667 | nerrs++; |
668 | } else { |
669 | printf("[OK]\tChild succeeded\n" ); |
670 | } |
671 | } |
672 | } |
673 | |
674 | static void setup_counter_page(void) |
675 | { |
676 | unsigned int *page = mmap(NULL, 4096, PROT_READ | PROT_WRITE, |
677 | MAP_ANONYMOUS | MAP_PRIVATE | MAP_32BIT, -1, 0); |
678 | if (page == MAP_FAILED) |
679 | err(1, "mmap" ); |
680 | |
681 | for (int i = 0; i < 1024; i++) |
682 | page[i] = i; |
683 | counter_page = page; |
684 | } |
685 | |
686 | static int invoke_set_thread_area(void) |
687 | { |
688 | int ret; |
689 | asm volatile ("int $0x80" |
690 | : "=a" (ret), "+m" (low_user_desc) : |
691 | "a" (243), "b" (low_user_desc) |
692 | : INT80_CLOBBERS); |
693 | return ret; |
694 | } |
695 | |
696 | static void setup_low_user_desc(void) |
697 | { |
698 | low_user_desc = mmap(NULL, 2 * sizeof(struct user_desc), |
699 | PROT_READ | PROT_WRITE, |
700 | MAP_ANONYMOUS | MAP_PRIVATE | MAP_32BIT, -1, 0); |
701 | if (low_user_desc == MAP_FAILED) |
702 | err(1, "mmap" ); |
703 | |
704 | low_user_desc->entry_number = -1; |
705 | low_user_desc->base_addr = (unsigned long)&counter_page[1]; |
706 | low_user_desc->limit = 0xfffff; |
707 | low_user_desc->seg_32bit = 1; |
708 | low_user_desc->contents = 0; /* Data, grow-up*/ |
709 | low_user_desc->read_exec_only = 0; |
710 | low_user_desc->limit_in_pages = 1; |
711 | low_user_desc->seg_not_present = 0; |
712 | low_user_desc->useable = 0; |
713 | |
714 | if (invoke_set_thread_area() == 0) { |
715 | gdt_entry_num = low_user_desc->entry_number; |
716 | printf("[NOTE]\tset_thread_area is available; will use GDT index %d\n" , gdt_entry_num); |
717 | } else { |
718 | printf("[NOTE]\tset_thread_area is unavailable\n" ); |
719 | } |
720 | |
721 | low_user_desc_clear = low_user_desc + 1; |
722 | low_user_desc_clear->entry_number = gdt_entry_num; |
723 | low_user_desc_clear->read_exec_only = 1; |
724 | low_user_desc_clear->seg_not_present = 1; |
725 | } |
726 | |
727 | static void test_gdt_invalidation(void) |
728 | { |
729 | if (!gdt_entry_num) |
730 | return; /* 64-bit only system -- we can't use set_thread_area */ |
731 | |
732 | unsigned short prev_sel; |
733 | unsigned short sel; |
734 | unsigned int eax; |
735 | const char *result; |
736 | #ifdef __x86_64__ |
737 | unsigned long saved_base; |
738 | unsigned long new_base; |
739 | #endif |
740 | |
741 | /* Test DS */ |
742 | invoke_set_thread_area(); |
743 | eax = 243; |
744 | sel = (gdt_entry_num << 3) | 3; |
745 | asm volatile ("movw %%ds, %[prev_sel]\n\t" |
746 | "movw %[sel], %%ds\n\t" |
747 | #ifdef __i386__ |
748 | "pushl %%ebx\n\t" |
749 | #endif |
750 | "movl %[arg1], %%ebx\n\t" |
751 | "int $0x80\n\t" /* Should invalidate ds */ |
752 | #ifdef __i386__ |
753 | "popl %%ebx\n\t" |
754 | #endif |
755 | "movw %%ds, %[sel]\n\t" |
756 | "movw %[prev_sel], %%ds" |
757 | : [prev_sel] "=&r" (prev_sel), [sel] "+r" (sel), |
758 | "+a" (eax) |
759 | : "m" (low_user_desc_clear), |
760 | [arg1] "r" ((unsigned int)(unsigned long)low_user_desc_clear) |
761 | : INT80_CLOBBERS); |
762 | |
763 | if (sel != 0) { |
764 | result = "FAIL" ; |
765 | nerrs++; |
766 | } else { |
767 | result = "OK" ; |
768 | } |
769 | printf("[%s]\tInvalidate DS with set_thread_area: new DS = 0x%hx\n" , |
770 | result, sel); |
771 | |
772 | /* Test ES */ |
773 | invoke_set_thread_area(); |
774 | eax = 243; |
775 | sel = (gdt_entry_num << 3) | 3; |
776 | asm volatile ("movw %%es, %[prev_sel]\n\t" |
777 | "movw %[sel], %%es\n\t" |
778 | #ifdef __i386__ |
779 | "pushl %%ebx\n\t" |
780 | #endif |
781 | "movl %[arg1], %%ebx\n\t" |
782 | "int $0x80\n\t" /* Should invalidate es */ |
783 | #ifdef __i386__ |
784 | "popl %%ebx\n\t" |
785 | #endif |
786 | "movw %%es, %[sel]\n\t" |
787 | "movw %[prev_sel], %%es" |
788 | : [prev_sel] "=&r" (prev_sel), [sel] "+r" (sel), |
789 | "+a" (eax) |
790 | : "m" (low_user_desc_clear), |
791 | [arg1] "r" ((unsigned int)(unsigned long)low_user_desc_clear) |
792 | : INT80_CLOBBERS); |
793 | |
794 | if (sel != 0) { |
795 | result = "FAIL" ; |
796 | nerrs++; |
797 | } else { |
798 | result = "OK" ; |
799 | } |
800 | printf("[%s]\tInvalidate ES with set_thread_area: new ES = 0x%hx\n" , |
801 | result, sel); |
802 | |
803 | /* Test FS */ |
804 | invoke_set_thread_area(); |
805 | eax = 243; |
806 | sel = (gdt_entry_num << 3) | 3; |
807 | #ifdef __x86_64__ |
808 | syscall(SYS_arch_prctl, ARCH_GET_FS, &saved_base); |
809 | #endif |
810 | asm volatile ("movw %%fs, %[prev_sel]\n\t" |
811 | "movw %[sel], %%fs\n\t" |
812 | #ifdef __i386__ |
813 | "pushl %%ebx\n\t" |
814 | #endif |
815 | "movl %[arg1], %%ebx\n\t" |
816 | "int $0x80\n\t" /* Should invalidate fs */ |
817 | #ifdef __i386__ |
818 | "popl %%ebx\n\t" |
819 | #endif |
820 | "movw %%fs, %[sel]\n\t" |
821 | : [prev_sel] "=&r" (prev_sel), [sel] "+r" (sel), |
822 | "+a" (eax) |
823 | : "m" (low_user_desc_clear), |
824 | [arg1] "r" ((unsigned int)(unsigned long)low_user_desc_clear) |
825 | : INT80_CLOBBERS); |
826 | |
827 | #ifdef __x86_64__ |
828 | syscall(SYS_arch_prctl, ARCH_GET_FS, &new_base); |
829 | #endif |
830 | |
831 | /* Restore FS/BASE for glibc */ |
832 | asm volatile ("movw %[prev_sel], %%fs" : : [prev_sel] "rm" (prev_sel)); |
833 | #ifdef __x86_64__ |
834 | if (saved_base) |
835 | syscall(SYS_arch_prctl, ARCH_SET_FS, saved_base); |
836 | #endif |
837 | |
838 | if (sel != 0) { |
839 | result = "FAIL" ; |
840 | nerrs++; |
841 | } else { |
842 | result = "OK" ; |
843 | } |
844 | printf("[%s]\tInvalidate FS with set_thread_area: new FS = 0x%hx\n" , |
845 | result, sel); |
846 | |
847 | #ifdef __x86_64__ |
848 | if (sel == 0 && new_base != 0) { |
849 | nerrs++; |
850 | printf("[FAIL]\tNew FSBASE was 0x%lx\n" , new_base); |
851 | } else { |
852 | printf("[OK]\tNew FSBASE was zero\n" ); |
853 | } |
854 | #endif |
855 | |
856 | /* Test GS */ |
857 | invoke_set_thread_area(); |
858 | eax = 243; |
859 | sel = (gdt_entry_num << 3) | 3; |
860 | #ifdef __x86_64__ |
861 | syscall(SYS_arch_prctl, ARCH_GET_GS, &saved_base); |
862 | #endif |
863 | asm volatile ("movw %%gs, %[prev_sel]\n\t" |
864 | "movw %[sel], %%gs\n\t" |
865 | #ifdef __i386__ |
866 | "pushl %%ebx\n\t" |
867 | #endif |
868 | "movl %[arg1], %%ebx\n\t" |
869 | "int $0x80\n\t" /* Should invalidate gs */ |
870 | #ifdef __i386__ |
871 | "popl %%ebx\n\t" |
872 | #endif |
873 | "movw %%gs, %[sel]\n\t" |
874 | : [prev_sel] "=&r" (prev_sel), [sel] "+r" (sel), |
875 | "+a" (eax) |
876 | : "m" (low_user_desc_clear), |
877 | [arg1] "r" ((unsigned int)(unsigned long)low_user_desc_clear) |
878 | : INT80_CLOBBERS); |
879 | |
880 | #ifdef __x86_64__ |
881 | syscall(SYS_arch_prctl, ARCH_GET_GS, &new_base); |
882 | #endif |
883 | |
884 | /* Restore GS/BASE for glibc */ |
885 | asm volatile ("movw %[prev_sel], %%gs" : : [prev_sel] "rm" (prev_sel)); |
886 | #ifdef __x86_64__ |
887 | if (saved_base) |
888 | syscall(SYS_arch_prctl, ARCH_SET_GS, saved_base); |
889 | #endif |
890 | |
891 | if (sel != 0) { |
892 | result = "FAIL" ; |
893 | nerrs++; |
894 | } else { |
895 | result = "OK" ; |
896 | } |
897 | printf("[%s]\tInvalidate GS with set_thread_area: new GS = 0x%hx\n" , |
898 | result, sel); |
899 | |
900 | #ifdef __x86_64__ |
901 | if (sel == 0 && new_base != 0) { |
902 | nerrs++; |
903 | printf("[FAIL]\tNew GSBASE was 0x%lx\n" , new_base); |
904 | } else { |
905 | printf("[OK]\tNew GSBASE was zero\n" ); |
906 | } |
907 | #endif |
908 | } |
909 | |
910 | int main(int argc, char **argv) |
911 | { |
912 | if (argc == 1 && !strcmp(argv[0], "ldt_gdt_test_exec" )) |
913 | return finish_exec_test(); |
914 | |
915 | setup_counter_page(); |
916 | setup_low_user_desc(); |
917 | |
918 | do_simple_tests(); |
919 | |
920 | do_multicpu_tests(); |
921 | |
922 | do_exec_test(); |
923 | |
924 | test_gdt_invalidation(); |
925 | |
926 | return nerrs ? 1 : 0; |
927 | } |
928 | |