2 * fsgsbase.c, an fsgsbase test
3 * Copyright (c) 2014-2016 Andy Lutomirski
12 #include <sys/syscall.h>
16 #include <asm/prctl.h>
17 #include <sys/prctl.h>
20 #include <sys/ucontext.h>
22 #include <linux/futex.h>
28 # error This test is 64-bit only
31 static volatile sig_atomic_t want_segv;
32 static volatile unsigned long segv_addr;
36 static void sethandler(int sig, void (*handler)(int, siginfo_t *, void *),
40 memset(&sa, 0, sizeof(sa));
41 sa.sa_sigaction = handler;
42 sa.sa_flags = SA_SIGINFO | flags;
43 sigemptyset(&sa.sa_mask);
44 if (sigaction(sig, &sa, 0))
48 static void clearhandler(int sig)
51 memset(&sa, 0, sizeof(sa));
52 sa.sa_handler = SIG_DFL;
53 sigemptyset(&sa.sa_mask);
54 if (sigaction(sig, &sa, 0))
58 static void sigsegv(int sig, siginfo_t *si, void *ctx_void)
60 ucontext_t *ctx = (ucontext_t*)ctx_void;
63 clearhandler(SIGSEGV);
64 return; /* Crash cleanly. */
68 segv_addr = (unsigned long)si->si_addr;
70 ctx->uc_mcontext.gregs[REG_RIP] += 4; /* Skip the faulting mov */
74 enum which_base { FS, GS };
76 static unsigned long read_base(enum which_base which)
80 * Unless we have FSGSBASE, there's no direct way to do this from
81 * user mode. We can get at it indirectly using signals, though.
88 /* Use a constant-length instruction here. */
89 asm volatile ("mov %%fs:(%%rcx), %%rax" : : "c" (offset) : "rax");
91 asm volatile ("mov %%gs:(%%rcx), %%rax" : : "c" (offset) : "rax");
94 return segv_addr + offset;
97 * If that didn't segfault, try the other end of the address space.
98 * Unless we get really unlucky and run into the vsyscall page, this
99 * is guaranteed to segfault.
102 offset = (ULONG_MAX >> 1) + 1;
104 asm volatile ("mov %%fs:(%%rcx), %%rax"
105 : : "c" (offset) : "rax");
107 asm volatile ("mov %%gs:(%%rcx), %%rax"
108 : : "c" (offset) : "rax");
111 return segv_addr + offset;
116 static void check_gs_value(unsigned long value)
121 printf("[RUN]\tARCH_SET_GS to 0x%lx\n", value);
122 if (syscall(SYS_arch_prctl, ARCH_SET_GS, value) != 0)
123 err(1, "ARCH_SET_GS");
125 asm volatile ("mov %%gs, %0" : "=rm" (sel));
126 base = read_base(GS);
128 printf("[OK]\tGSBASE was set as expected (selector 0x%hx)\n",
132 printf("[FAIL]\tGSBASE was not as expected: got 0x%lx (selector 0x%hx)\n",
136 if (syscall(SYS_arch_prctl, ARCH_GET_GS, &base) != 0)
137 err(1, "ARCH_GET_GS");
139 printf("[OK]\tARCH_GET_GS worked as expected (selector 0x%hx)\n",
143 printf("[FAIL]\tARCH_GET_GS was not as expected: got 0x%lx (selector 0x%hx)\n",
148 static void mov_0_gs(unsigned long initial_base, bool schedule)
150 unsigned long base, arch_base;
152 printf("[RUN]\tARCH_SET_GS to 0x%lx then mov 0 to %%gs%s\n", initial_base, schedule ? " and schedule " : "");
153 if (syscall(SYS_arch_prctl, ARCH_SET_GS, initial_base) != 0)
154 err(1, "ARCH_SET_GS");
159 asm volatile ("mov %0, %%gs" : : "rm" (0));
160 base = read_base(GS);
161 if (syscall(SYS_arch_prctl, ARCH_GET_GS, &arch_base) != 0)
162 err(1, "ARCH_GET_GS");
163 if (base == arch_base) {
164 printf("[OK]\tGSBASE is 0x%lx\n", base);
167 printf("[FAIL]\tGSBASE changed to 0x%lx but kernel reports 0x%lx\n", base, arch_base);
171 static volatile unsigned long remote_base;
172 static volatile bool remote_hard_zero;
173 static volatile unsigned int ftx;
176 * ARCH_SET_FS/GS(0) may or may not program a selector of zero. HARD_ZERO
177 * means to force the selector to zero to improve test coverage.
179 #define HARD_ZERO 0xa1fa5f343cb85fa4
181 static void do_remote_base()
183 unsigned long to_set = remote_base;
184 bool hard_zero = false;
185 if (to_set == HARD_ZERO) {
190 if (syscall(SYS_arch_prctl, ARCH_SET_GS, to_set) != 0)
191 err(1, "ARCH_SET_GS");
194 asm volatile ("mov %0, %%gs" : : "rm" ((unsigned short)0));
197 asm volatile ("mov %%gs, %0" : "=rm" (sel));
198 printf("\tother thread: ARCH_SET_GS(0x%lx)%s -- sel is 0x%hx\n",
199 to_set, hard_zero ? " and clear gs" : "", sel);
202 void do_unexpected_base(void)
205 * The goal here is to try to arrange for GS == 0, GSBASE !=
206 * 0, and for the the kernel the think that GSBASE == 0.
208 * To make the test as reliable as possible, this uses
209 * explicit descriptorss. (This is not the only way. This
210 * could use ARCH_SET_GS with a low, nonzero base, but the
211 * relevant side effect of ARCH_SET_GS could change.)
214 /* Step 1: tell the kernel that we have GSBASE == 0. */
215 if (syscall(SYS_arch_prctl, ARCH_SET_GS, 0) != 0)
216 err(1, "ARCH_SET_GS");
218 /* Step 2: change GSBASE without telling the kernel. */
219 struct user_desc desc = {
221 .base_addr = 0xBAADF00D,
224 .contents = 0, /* Data, grow-up */
227 .seg_not_present = 0,
230 if (syscall(SYS_modify_ldt, 1, &desc, sizeof(desc)) == 0) {
231 printf("\tother thread: using LDT slot 0\n");
232 asm volatile ("mov %0, %%gs" : : "rm" ((unsigned short)0x7));
234 /* No modify_ldt for us (configured out, perhaps) */
236 struct user_desc *low_desc = mmap(
238 PROT_READ | PROT_WRITE,
239 MAP_PRIVATE | MAP_ANONYMOUS | MAP_32BIT, -1, 0);
240 memcpy(low_desc, &desc, sizeof(desc));
242 low_desc->entry_number = -1;
244 /* 32-bit set_thread_area */
246 asm volatile ("int $0x80"
247 : "=a" (ret) : "a" (243), "b" (low_desc)
248 : "r8", "r9", "r10", "r11");
249 memcpy(&desc, low_desc, sizeof(desc));
250 munmap(low_desc, sizeof(desc));
253 printf("[NOTE]\tcould not create a segment -- test won't do anything\n");
256 printf("\tother thread: using GDT slot %d\n", desc.entry_number);
257 asm volatile ("mov %0, %%gs" : : "rm" ((unsigned short)((desc.entry_number << 3) | 0x3)));
261 * Step 3: set the selector back to zero. On AMD chips, this will
265 asm volatile ("mov %0, %%gs" : : "rm" ((unsigned short)0));
268 static void *threadproc(void *ctx)
272 syscall(SYS_futex, &ftx, FUTEX_WAIT, 0, NULL, NULL, 0);
279 do_unexpected_base();
281 errx(1, "helper thread got bad command");
284 syscall(SYS_futex, &ftx, FUTEX_WAKE, 0, NULL, NULL, 0);
288 static void set_gs_and_switch_to(unsigned long local,
289 unsigned short force_sel,
290 unsigned long remote)
293 unsigned short sel_pre_sched, sel_post_sched;
295 bool hard_zero = false;
296 if (local == HARD_ZERO) {
301 printf("[RUN]\tARCH_SET_GS(0x%lx)%s, then schedule to 0x%lx\n",
302 local, hard_zero ? " and clear gs" : "", remote);
304 printf("\tBefore schedule, set selector to 0x%hx\n", force_sel);
305 if (syscall(SYS_arch_prctl, ARCH_SET_GS, local) != 0)
306 err(1, "ARCH_SET_GS");
308 asm volatile ("mov %0, %%gs" : : "rm" ((unsigned short)0));
310 if (read_base(GS) != local) {
312 printf("[FAIL]\tGSBASE wasn't set as expected\n");
316 asm volatile ("mov %0, %%gs" : : "rm" (force_sel));
317 sel_pre_sched = force_sel;
318 local = read_base(GS);
321 * Signal delivery seems to mess up weird selectors. Put it
324 asm volatile ("mov %0, %%gs" : : "rm" (force_sel));
326 asm volatile ("mov %%gs, %0" : "=rm" (sel_pre_sched));
329 remote_base = remote;
331 syscall(SYS_futex, &ftx, FUTEX_WAKE, 0, NULL, NULL, 0);
333 syscall(SYS_futex, &ftx, FUTEX_WAIT, 1, NULL, NULL, 0);
335 asm volatile ("mov %%gs, %0" : "=rm" (sel_post_sched));
336 base = read_base(GS);
337 if (base == local && sel_pre_sched == sel_post_sched) {
338 printf("[OK]\tGS/BASE remained 0x%hx/0x%lx\n",
339 sel_pre_sched, local);
342 printf("[FAIL]\tGS/BASE changed from 0x%hx/0x%lx to 0x%hx/0x%lx\n",
343 sel_pre_sched, local, sel_post_sched, base);
347 static void test_unexpected_base(void)
351 printf("[RUN]\tARCH_SET_GS(0), clear gs, then manipulate GSBASE in a different thread\n");
352 if (syscall(SYS_arch_prctl, ARCH_SET_GS, 0) != 0)
353 err(1, "ARCH_SET_GS");
354 asm volatile ("mov %0, %%gs" : : "rm" ((unsigned short)0));
357 syscall(SYS_futex, &ftx, FUTEX_WAKE, 0, NULL, NULL, 0);
359 syscall(SYS_futex, &ftx, FUTEX_WAIT, 1, NULL, NULL, 0);
361 base = read_base(GS);
363 printf("[OK]\tGSBASE remained 0\n");
366 printf("[FAIL]\tGSBASE changed to 0x%lx\n", base);
374 sethandler(SIGSEGV, sigsegv, 0);
378 check_gs_value(0x200000000);
380 check_gs_value(0x200000000);
383 for (int sched = 0; sched < 2; sched++) {
384 mov_0_gs(0, !!sched);
385 mov_0_gs(1, !!sched);
386 mov_0_gs(0x200000000, !!sched);
389 /* Set up for multithreading. */
394 if (sched_setaffinity(0, sizeof(cpuset), &cpuset) != 0)
395 err(1, "sched_setaffinity to CPU 0"); /* should never fail */
397 if (pthread_create(&thread, 0, threadproc, 0) != 0)
398 err(1, "pthread_create");
400 static unsigned long bases_with_hard_zero[] = {
401 0, HARD_ZERO, 1, 0x200000000,
404 for (int local = 0; local < 4; local++) {
405 for (int remote = 0; remote < 4; remote++) {
406 for (unsigned short s = 0; s < 5; s++) {
407 unsigned short sel = s;
409 asm ("mov %%ss, %0" : "=rm" (sel));
410 set_gs_and_switch_to(
411 bases_with_hard_zero[local],
413 bases_with_hard_zero[remote]);
418 test_unexpected_base();
420 ftx = 3; /* Kill the thread. */
421 syscall(SYS_futex, &ftx, FUTEX_WAKE, 0, NULL, NULL, 0);
423 if (pthread_join(thread, NULL) != 0)
424 err(1, "pthread_join");
426 return nerrs == 0 ? 0 : 1;