1 /*
2 * ldt_gdt.c - Test cases for LDT and GDT access
3 * Copyright (c) 2015 Andrew Lutomirski
4 */
5
6 #define _GNU_SOURCE
7 #include <err.h>
8 #include <stdio.h>
9 #include <stdint.h>
10 #include <signal.h>
11 #include <setjmp.h>
12 #include <stdlib.h>
13 #include <string.h>
14 #include <errno.h>
15 #include <unistd.h>
16 #include <sys/syscall.h>
17 #include <asm/ldt.h>
18 #include <sys/types.h>
19 #include <sys/wait.h>
20 #include <stdbool.h>
21 #include <pthread.h>
22 #include <sched.h>
23 #include <linux/futex.h>
24 #include <sys/mman.h>
25 #include <asm/prctl.h>
26 #include <sys/prctl.h>
27
28 #define AR_ACCESSED (1<<8)
29
30 #define AR_TYPE_RODATA (0 * (1<<9))
31 #define AR_TYPE_RWDATA (1 * (1<<9))
32 #define AR_TYPE_RODATA_EXPDOWN (2 * (1<<9))
33 #define AR_TYPE_RWDATA_EXPDOWN (3 * (1<<9))
34 #define AR_TYPE_XOCODE (4 * (1<<9))
35 #define AR_TYPE_XRCODE (5 * (1<<9))
36 #define AR_TYPE_XOCODE_CONF (6 * (1<<9))
37 #define AR_TYPE_XRCODE_CONF (7 * (1<<9))
38
39 #define AR_DPL3 (3 * (1<<13))
40
41 #define AR_S (1 << 12)
42 #define AR_P (1 << 15)
43 #define AR_AVL (1 << 20)
44 #define AR_L (1 << 21)
45 #define AR_DB (1 << 22)
46 #define AR_G (1 << 23)
47
48 #ifdef __x86_64__
49 # define INT80_CLOBBERS "r8", "r9", "r10", "r11"
50 #else
51 # define INT80_CLOBBERS
52 #endif
53
54 static int nerrs;
55
56 /* Points to an array of 1024 ints, each holding its own index. */
57 static const unsigned int *counter_page;
58 static struct user_desc *low_user_desc;
59 static struct user_desc *low_user_desc_clear; /* Use to delete GDT entry */
60 static int gdt_entry_num;
61
check_invalid_segment(uint16_t index,int ldt)62 static void check_invalid_segment(uint16_t index, int ldt)
63 {
64 uint32_t has_limit = 0, has_ar = 0, limit, ar;
65 uint32_t selector = (index << 3) | (ldt << 2) | 3;
66
67 asm ("lsl %[selector], %[limit]\n\t"
68 "jnz 1f\n\t"
69 "movl $1, %[has_limit]\n\t"
70 "1:"
71 : [limit] "=r" (limit), [has_limit] "+rm" (has_limit)
72 : [selector] "r" (selector));
73 asm ("larl %[selector], %[ar]\n\t"
74 "jnz 1f\n\t"
75 "movl $1, %[has_ar]\n\t"
76 "1:"
77 : [ar] "=r" (ar), [has_ar] "+rm" (has_ar)
78 : [selector] "r" (selector));
79
80 if (has_limit || has_ar) {
81 printf("[FAIL]\t%s entry %hu is valid but should be invalid\n",
82 (ldt ? "LDT" : "GDT"), index);
83 nerrs++;
84 } else {
85 printf("[OK]\t%s entry %hu is invalid\n",
86 (ldt ? "LDT" : "GDT"), index);
87 }
88 }
89
check_valid_segment(uint16_t index,int ldt,uint32_t expected_ar,uint32_t expected_limit,bool verbose)90 static void check_valid_segment(uint16_t index, int ldt,
91 uint32_t expected_ar, uint32_t expected_limit,
92 bool verbose)
93 {
94 uint32_t has_limit = 0, has_ar = 0, limit, ar;
95 uint32_t selector = (index << 3) | (ldt << 2) | 3;
96
97 asm ("lsl %[selector], %[limit]\n\t"
98 "jnz 1f\n\t"
99 "movl $1, %[has_limit]\n\t"
100 "1:"
101 : [limit] "=r" (limit), [has_limit] "+rm" (has_limit)
102 : [selector] "r" (selector));
103 asm ("larl %[selector], %[ar]\n\t"
104 "jnz 1f\n\t"
105 "movl $1, %[has_ar]\n\t"
106 "1:"
107 : [ar] "=r" (ar), [has_ar] "+rm" (has_ar)
108 : [selector] "r" (selector));
109
110 if (!has_limit || !has_ar) {
111 printf("[FAIL]\t%s entry %hu is invalid but should be valid\n",
112 (ldt ? "LDT" : "GDT"), index);
113 nerrs++;
114 return;
115 }
116
117 if (ar != expected_ar) {
118 printf("[FAIL]\t%s entry %hu has AR 0x%08X but expected 0x%08X\n",
119 (ldt ? "LDT" : "GDT"), index, ar, expected_ar);
120 nerrs++;
121 } else if (limit != expected_limit) {
122 printf("[FAIL]\t%s entry %hu has limit 0x%08X but expected 0x%08X\n",
123 (ldt ? "LDT" : "GDT"), index, limit, expected_limit);
124 nerrs++;
125 } else if (verbose) {
126 printf("[OK]\t%s entry %hu has AR 0x%08X and limit 0x%08X\n",
127 (ldt ? "LDT" : "GDT"), index, ar, limit);
128 }
129 }
130
install_valid_mode(const struct user_desc * desc,uint32_t ar,bool oldmode)131 static bool install_valid_mode(const struct user_desc *desc, uint32_t ar,
132 bool oldmode)
133 {
134 int ret = syscall(SYS_modify_ldt, oldmode ? 1 : 0x11,
135 desc, sizeof(*desc));
136 if (ret < -1)
137 errno = -ret;
138 if (ret == 0) {
139 uint32_t limit = desc->limit;
140 if (desc->limit_in_pages)
141 limit = (limit << 12) + 4095;
142 check_valid_segment(desc->entry_number, 1, ar, limit, true);
143 return true;
144 } else if (errno == ENOSYS) {
145 printf("[OK]\tmodify_ldt returned -ENOSYS\n");
146 return false;
147 } else {
148 if (desc->seg_32bit) {
149 printf("[FAIL]\tUnexpected modify_ldt failure %d\n",
150 errno);
151 nerrs++;
152 return false;
153 } else {
154 printf("[OK]\tmodify_ldt rejected 16 bit segment\n");
155 return false;
156 }
157 }
158 }
159
install_valid(const struct user_desc * desc,uint32_t ar)160 static bool install_valid(const struct user_desc *desc, uint32_t ar)
161 {
162 return install_valid_mode(desc, ar, false);
163 }
164
install_invalid(const struct user_desc * desc,bool oldmode)165 static void install_invalid(const struct user_desc *desc, bool oldmode)
166 {
167 int ret = syscall(SYS_modify_ldt, oldmode ? 1 : 0x11,
168 desc, sizeof(*desc));
169 if (ret < -1)
170 errno = -ret;
171 if (ret == 0) {
172 check_invalid_segment(desc->entry_number, 1);
173 } else if (errno == ENOSYS) {
174 printf("[OK]\tmodify_ldt returned -ENOSYS\n");
175 } else {
176 if (desc->seg_32bit) {
177 printf("[FAIL]\tUnexpected modify_ldt failure %d\n",
178 errno);
179 nerrs++;
180 } else {
181 printf("[OK]\tmodify_ldt rejected 16 bit segment\n");
182 }
183 }
184 }
185
safe_modify_ldt(int func,struct user_desc * ptr,unsigned long bytecount)186 static int safe_modify_ldt(int func, struct user_desc *ptr,
187 unsigned long bytecount)
188 {
189 int ret = syscall(SYS_modify_ldt, 0x11, ptr, bytecount);
190 if (ret < -1)
191 errno = -ret;
192 return ret;
193 }
194
fail_install(struct user_desc * desc)195 static void fail_install(struct user_desc *desc)
196 {
197 if (safe_modify_ldt(0x11, desc, sizeof(*desc)) == 0) {
198 printf("[FAIL]\tmodify_ldt accepted a bad descriptor\n");
199 nerrs++;
200 } else if (errno == ENOSYS) {
201 printf("[OK]\tmodify_ldt returned -ENOSYS\n");
202 } else {
203 printf("[OK]\tmodify_ldt failure %d\n", errno);
204 }
205 }
206
do_simple_tests(void)207 static void do_simple_tests(void)
208 {
209 struct user_desc desc = {
210 .entry_number = 0,
211 .base_addr = 0,
212 .limit = 10,
213 .seg_32bit = 1,
214 .contents = 2, /* Code, not conforming */
215 .read_exec_only = 0,
216 .limit_in_pages = 0,
217 .seg_not_present = 0,
218 .useable = 0
219 };
220 install_valid(&desc, AR_DPL3 | AR_TYPE_XRCODE | AR_S | AR_P | AR_DB);
221
222 desc.limit_in_pages = 1;
223 install_valid(&desc, AR_DPL3 | AR_TYPE_XRCODE |
224 AR_S | AR_P | AR_DB | AR_G);
225
226 check_invalid_segment(1, 1);
227
228 desc.entry_number = 2;
229 install_valid(&desc, AR_DPL3 | AR_TYPE_XRCODE |
230 AR_S | AR_P | AR_DB | AR_G);
231
232 check_invalid_segment(1, 1);
233
234 desc.base_addr = 0xf0000000;
235 install_valid(&desc, AR_DPL3 | AR_TYPE_XRCODE |
236 AR_S | AR_P | AR_DB | AR_G);
237
238 desc.useable = 1;
239 install_valid(&desc, AR_DPL3 | AR_TYPE_XRCODE |
240 AR_S | AR_P | AR_DB | AR_G | AR_AVL);
241
242 desc.seg_not_present = 1;
243 install_valid(&desc, AR_DPL3 | AR_TYPE_XRCODE |
244 AR_S | AR_DB | AR_G | AR_AVL);
245
246 desc.seg_32bit = 0;
247 install_valid(&desc, AR_DPL3 | AR_TYPE_XRCODE |
248 AR_S | AR_G | AR_AVL);
249
250 desc.seg_32bit = 1;
251 desc.contents = 0;
252 install_valid(&desc, AR_DPL3 | AR_TYPE_RWDATA |
253 AR_S | AR_DB | AR_G | AR_AVL);
254
255 desc.read_exec_only = 1;
256 install_valid(&desc, AR_DPL3 | AR_TYPE_RODATA |
257 AR_S | AR_DB | AR_G | AR_AVL);
258
259 desc.contents = 1;
260 install_valid(&desc, AR_DPL3 | AR_TYPE_RODATA_EXPDOWN |
261 AR_S | AR_DB | AR_G | AR_AVL);
262
263 desc.read_exec_only = 0;
264 desc.limit_in_pages = 0;
265 install_valid(&desc, AR_DPL3 | AR_TYPE_RWDATA_EXPDOWN |
266 AR_S | AR_DB | AR_AVL);
267
268 desc.contents = 3;
269 install_valid(&desc, AR_DPL3 | AR_TYPE_XRCODE_CONF |
270 AR_S | AR_DB | AR_AVL);
271
272 desc.read_exec_only = 1;
273 install_valid(&desc, AR_DPL3 | AR_TYPE_XOCODE_CONF |
274 AR_S | AR_DB | AR_AVL);
275
276 desc.read_exec_only = 0;
277 desc.contents = 2;
278 install_valid(&desc, AR_DPL3 | AR_TYPE_XRCODE |
279 AR_S | AR_DB | AR_AVL);
280
281 desc.read_exec_only = 1;
282
283 #ifdef __x86_64__
284 desc.lm = 1;
285 install_valid(&desc, AR_DPL3 | AR_TYPE_XOCODE |
286 AR_S | AR_DB | AR_AVL);
287 desc.lm = 0;
288 #endif
289
290 bool entry1_okay = install_valid(&desc, AR_DPL3 | AR_TYPE_XOCODE |
291 AR_S | AR_DB | AR_AVL);
292
293 if (entry1_okay) {
294 printf("[RUN]\tTest fork\n");
295 pid_t child = fork();
296 if (child == 0) {
297 nerrs = 0;
298 check_valid_segment(desc.entry_number, 1,
299 AR_DPL3 | AR_TYPE_XOCODE |
300 AR_S | AR_DB | AR_AVL, desc.limit,
301 true);
302 check_invalid_segment(1, 1);
303 exit(nerrs ? 1 : 0);
304 } else {
305 int status;
306 if (waitpid(child, &status, 0) != child ||
307 !WIFEXITED(status)) {
308 printf("[FAIL]\tChild died\n");
309 nerrs++;
310 } else if (WEXITSTATUS(status) != 0) {
311 printf("[FAIL]\tChild failed\n");
312 nerrs++;
313 } else {
314 printf("[OK]\tChild succeeded\n");
315 }
316 }
317
318 printf("[RUN]\tTest size\n");
319 int i;
320 for (i = 0; i < 8192; i++) {
321 desc.entry_number = i;
322 desc.limit = i;
323 if (safe_modify_ldt(0x11, &desc, sizeof(desc)) != 0) {
324 printf("[FAIL]\tFailed to install entry %d\n", i);
325 nerrs++;
326 break;
327 }
328 }
329 for (int j = 0; j < i; j++) {
330 check_valid_segment(j, 1, AR_DPL3 | AR_TYPE_XOCODE |
331 AR_S | AR_DB | AR_AVL, j, false);
332 }
333 printf("[DONE]\tSize test\n");
334 } else {
335 printf("[SKIP]\tSkipping fork and size tests because we have no LDT\n");
336 }
337
338 /* Test entry_number too high. */
339 desc.entry_number = 8192;
340 fail_install(&desc);
341
342 /* Test deletion and actions mistakeable for deletion. */
343 memset(&desc, 0, sizeof(desc));
344 install_valid(&desc, AR_DPL3 | AR_TYPE_RWDATA | AR_S | AR_P);
345
346 desc.seg_not_present = 1;
347 install_valid(&desc, AR_DPL3 | AR_TYPE_RWDATA | AR_S);
348
349 desc.seg_not_present = 0;
350 desc.read_exec_only = 1;
351 install_valid(&desc, AR_DPL3 | AR_TYPE_RODATA | AR_S | AR_P);
352
353 desc.read_exec_only = 0;
354 desc.seg_not_present = 1;
355 install_valid(&desc, AR_DPL3 | AR_TYPE_RWDATA | AR_S);
356
357 desc.read_exec_only = 1;
358 desc.limit = 1;
359 install_valid(&desc, AR_DPL3 | AR_TYPE_RODATA | AR_S);
360
361 desc.limit = 0;
362 desc.base_addr = 1;
363 install_valid(&desc, AR_DPL3 | AR_TYPE_RODATA | AR_S);
364
365 desc.base_addr = 0;
366 install_invalid(&desc, false);
367
368 desc.seg_not_present = 0;
369 desc.read_exec_only = 0;
370 desc.seg_32bit = 1;
371 install_valid(&desc, AR_DPL3 | AR_TYPE_RWDATA | AR_S | AR_P | AR_DB);
372 install_invalid(&desc, true);
373 }
374
375 /*
376 * 0: thread is idle
377 * 1: thread armed
378 * 2: thread should clear LDT entry 0
379 * 3: thread should exit
380 */
381 static volatile unsigned int ftx;
382
threadproc(void * ctx)383 static void *threadproc(void *ctx)
384 {
385 cpu_set_t cpuset;
386 CPU_ZERO(&cpuset);
387 CPU_SET(1, &cpuset);
388 if (sched_setaffinity(0, sizeof(cpuset), &cpuset) != 0)
389 err(1, "sched_setaffinity to CPU 1"); /* should never fail */
390
391 while (1) {
392 syscall(SYS_futex, &ftx, FUTEX_WAIT, 0, NULL, NULL, 0);
393 while (ftx != 2) {
394 if (ftx >= 3)
395 return NULL;
396 }
397
398 /* clear LDT entry 0 */
399 const struct user_desc desc = {};
400 if (syscall(SYS_modify_ldt, 1, &desc, sizeof(desc)) != 0)
401 err(1, "modify_ldt");
402
403 /* If ftx == 2, set it to zero. If ftx == 100, quit. */
404 unsigned int x = -2;
405 asm volatile ("lock xaddl %[x], %[ftx]" :
406 [x] "+r" (x), [ftx] "+m" (ftx));
407 if (x != 2)
408 return NULL;
409 }
410 }
411
sethandler(int sig,void (* handler)(int,siginfo_t *,void *),int flags)412 static void sethandler(int sig, void (*handler)(int, siginfo_t *, void *),
413 int flags)
414 {
415 struct sigaction sa;
416 memset(&sa, 0, sizeof(sa));
417 sa.sa_sigaction = handler;
418 sa.sa_flags = SA_SIGINFO | flags;
419 sigemptyset(&sa.sa_mask);
420 if (sigaction(sig, &sa, 0))
421 err(1, "sigaction");
422
423 }
424
425 static jmp_buf jmpbuf;
426
sigsegv(int sig,siginfo_t * info,void * ctx_void)427 static void sigsegv(int sig, siginfo_t *info, void *ctx_void)
428 {
429 siglongjmp(jmpbuf, 1);
430 }
431
do_multicpu_tests(void)432 static void do_multicpu_tests(void)
433 {
434 cpu_set_t cpuset;
435 pthread_t thread;
436 int failures = 0, iters = 5, i;
437 unsigned short orig_ss;
438
439 CPU_ZERO(&cpuset);
440 CPU_SET(1, &cpuset);
441 if (sched_setaffinity(0, sizeof(cpuset), &cpuset) != 0) {
442 printf("[SKIP]\tCannot set affinity to CPU 1\n");
443 return;
444 }
445
446 CPU_ZERO(&cpuset);
447 CPU_SET(0, &cpuset);
448 if (sched_setaffinity(0, sizeof(cpuset), &cpuset) != 0) {
449 printf("[SKIP]\tCannot set affinity to CPU 0\n");
450 return;
451 }
452
453 sethandler(SIGSEGV, sigsegv, 0);
454 #ifdef __i386__
455 /* True 32-bit kernels send SIGILL instead of SIGSEGV on IRET faults. */
456 sethandler(SIGILL, sigsegv, 0);
457 #endif
458
459 printf("[RUN]\tCross-CPU LDT invalidation\n");
460
461 if (pthread_create(&thread, 0, threadproc, 0) != 0)
462 err(1, "pthread_create");
463
464 asm volatile ("mov %%ss, %0" : "=rm" (orig_ss));
465
466 for (i = 0; i < 5; i++) {
467 if (sigsetjmp(jmpbuf, 1) != 0)
468 continue;
469
470 /* Make sure the thread is ready after the last test. */
471 while (ftx != 0)
472 ;
473
474 struct user_desc desc = {
475 .entry_number = 0,
476 .base_addr = 0,
477 .limit = 0xfffff,
478 .seg_32bit = 1,
479 .contents = 0, /* Data */
480 .read_exec_only = 0,
481 .limit_in_pages = 1,
482 .seg_not_present = 0,
483 .useable = 0
484 };
485
486 if (safe_modify_ldt(0x11, &desc, sizeof(desc)) != 0) {
487 if (errno != ENOSYS)
488 err(1, "modify_ldt");
489 printf("[SKIP]\tmodify_ldt unavailable\n");
490 break;
491 }
492
493 /* Arm the thread. */
494 ftx = 1;
495 syscall(SYS_futex, &ftx, FUTEX_WAKE, 0, NULL, NULL, 0);
496
497 asm volatile ("mov %0, %%ss" : : "r" (0x7));
498
499 /* Go! */
500 ftx = 2;
501
502 while (ftx != 0)
503 ;
504
505 /*
506 * On success, modify_ldt will segfault us synchronously,
507 * and we'll escape via siglongjmp.
508 */
509
510 failures++;
511 asm volatile ("mov %0, %%ss" : : "rm" (orig_ss));
512 };
513
514 ftx = 100; /* Kill the thread. */
515 syscall(SYS_futex, &ftx, FUTEX_WAKE, 0, NULL, NULL, 0);
516
517 if (pthread_join(thread, NULL) != 0)
518 err(1, "pthread_join");
519
520 if (failures) {
521 printf("[FAIL]\t%d of %d iterations failed\n", failures, iters);
522 nerrs++;
523 } else {
524 printf("[OK]\tAll %d iterations succeeded\n", iters);
525 }
526 }
527
finish_exec_test(void)528 static int finish_exec_test(void)
529 {
530 /*
531 * In a sensible world, this would be check_invalid_segment(0, 1);
532 * For better or for worse, though, the LDT is inherited across exec.
533 * We can probably change this safely, but for now we test it.
534 */
535 check_valid_segment(0, 1,
536 AR_DPL3 | AR_TYPE_XRCODE | AR_S | AR_P | AR_DB,
537 42, true);
538
539 return nerrs ? 1 : 0;
540 }
541
do_exec_test(void)542 static void do_exec_test(void)
543 {
544 printf("[RUN]\tTest exec\n");
545
546 struct user_desc desc = {
547 .entry_number = 0,
548 .base_addr = 0,
549 .limit = 42,
550 .seg_32bit = 1,
551 .contents = 2, /* Code, not conforming */
552 .read_exec_only = 0,
553 .limit_in_pages = 0,
554 .seg_not_present = 0,
555 .useable = 0
556 };
557 install_valid(&desc, AR_DPL3 | AR_TYPE_XRCODE | AR_S | AR_P | AR_DB);
558
559 pid_t child = fork();
560 if (child == 0) {
561 execl("/proc/self/exe", "ldt_gdt_test_exec", NULL);
562 printf("[FAIL]\tCould not exec self\n");
563 exit(1); /* exec failed */
564 } else {
565 int status;
566 if (waitpid(child, &status, 0) != child ||
567 !WIFEXITED(status)) {
568 printf("[FAIL]\tChild died\n");
569 nerrs++;
570 } else if (WEXITSTATUS(status) != 0) {
571 printf("[FAIL]\tChild failed\n");
572 nerrs++;
573 } else {
574 printf("[OK]\tChild succeeded\n");
575 }
576 }
577 }
578
setup_counter_page(void)579 static void setup_counter_page(void)
580 {
581 unsigned int *page = mmap(NULL, 4096, PROT_READ | PROT_WRITE,
582 MAP_ANONYMOUS | MAP_PRIVATE | MAP_32BIT, -1, 0);
583 if (page == MAP_FAILED)
584 err(1, "mmap");
585
586 for (int i = 0; i < 1024; i++)
587 page[i] = i;
588 counter_page = page;
589 }
590
invoke_set_thread_area(void)591 static int invoke_set_thread_area(void)
592 {
593 int ret;
594 asm volatile ("int $0x80"
595 : "=a" (ret), "+m" (low_user_desc) :
596 "a" (243), "b" (low_user_desc)
597 : INT80_CLOBBERS);
598 return ret;
599 }
600
setup_low_user_desc(void)601 static void setup_low_user_desc(void)
602 {
603 low_user_desc = mmap(NULL, 2 * sizeof(struct user_desc),
604 PROT_READ | PROT_WRITE,
605 MAP_ANONYMOUS | MAP_PRIVATE | MAP_32BIT, -1, 0);
606 if (low_user_desc == MAP_FAILED)
607 err(1, "mmap");
608
609 low_user_desc->entry_number = -1;
610 low_user_desc->base_addr = (unsigned long)&counter_page[1];
611 low_user_desc->limit = 0xfffff;
612 low_user_desc->seg_32bit = 1;
613 low_user_desc->contents = 0; /* Data, grow-up*/
614 low_user_desc->read_exec_only = 0;
615 low_user_desc->limit_in_pages = 1;
616 low_user_desc->seg_not_present = 0;
617 low_user_desc->useable = 0;
618
619 if (invoke_set_thread_area() == 0) {
620 gdt_entry_num = low_user_desc->entry_number;
621 printf("[NOTE]\tset_thread_area is available; will use GDT index %d\n", gdt_entry_num);
622 } else {
623 printf("[NOTE]\tset_thread_area is unavailable\n");
624 }
625
626 low_user_desc_clear = low_user_desc + 1;
627 low_user_desc_clear->entry_number = gdt_entry_num;
628 low_user_desc_clear->read_exec_only = 1;
629 low_user_desc_clear->seg_not_present = 1;
630 }
631
test_gdt_invalidation(void)632 static void test_gdt_invalidation(void)
633 {
634 if (!gdt_entry_num)
635 return; /* 64-bit only system -- we can't use set_thread_area */
636
637 unsigned short prev_sel;
638 unsigned short sel;
639 unsigned int eax;
640 const char *result;
641 #ifdef __x86_64__
642 unsigned long saved_base;
643 unsigned long new_base;
644 #endif
645
646 /* Test DS */
647 invoke_set_thread_area();
648 eax = 243;
649 sel = (gdt_entry_num << 3) | 3;
650 asm volatile ("movw %%ds, %[prev_sel]\n\t"
651 "movw %[sel], %%ds\n\t"
652 #ifdef __i386__
653 "pushl %%ebx\n\t"
654 #endif
655 "movl %[arg1], %%ebx\n\t"
656 "int $0x80\n\t" /* Should invalidate ds */
657 #ifdef __i386__
658 "popl %%ebx\n\t"
659 #endif
660 "movw %%ds, %[sel]\n\t"
661 "movw %[prev_sel], %%ds"
662 : [prev_sel] "=&r" (prev_sel), [sel] "+r" (sel),
663 "+a" (eax)
664 : "m" (low_user_desc_clear),
665 [arg1] "r" ((unsigned int)(unsigned long)low_user_desc_clear)
666 : INT80_CLOBBERS);
667
668 if (sel != 0) {
669 result = "FAIL";
670 nerrs++;
671 } else {
672 result = "OK";
673 }
674 printf("[%s]\tInvalidate DS with set_thread_area: new DS = 0x%hx\n",
675 result, sel);
676
677 /* Test ES */
678 invoke_set_thread_area();
679 eax = 243;
680 sel = (gdt_entry_num << 3) | 3;
681 asm volatile ("movw %%es, %[prev_sel]\n\t"
682 "movw %[sel], %%es\n\t"
683 #ifdef __i386__
684 "pushl %%ebx\n\t"
685 #endif
686 "movl %[arg1], %%ebx\n\t"
687 "int $0x80\n\t" /* Should invalidate es */
688 #ifdef __i386__
689 "popl %%ebx\n\t"
690 #endif
691 "movw %%es, %[sel]\n\t"
692 "movw %[prev_sel], %%es"
693 : [prev_sel] "=&r" (prev_sel), [sel] "+r" (sel),
694 "+a" (eax)
695 : "m" (low_user_desc_clear),
696 [arg1] "r" ((unsigned int)(unsigned long)low_user_desc_clear)
697 : INT80_CLOBBERS);
698
699 if (sel != 0) {
700 result = "FAIL";
701 nerrs++;
702 } else {
703 result = "OK";
704 }
705 printf("[%s]\tInvalidate ES with set_thread_area: new ES = 0x%hx\n",
706 result, sel);
707
708 /* Test FS */
709 invoke_set_thread_area();
710 eax = 243;
711 sel = (gdt_entry_num << 3) | 3;
712 #ifdef __x86_64__
713 syscall(SYS_arch_prctl, ARCH_GET_FS, &saved_base);
714 #endif
715 asm volatile ("movw %%fs, %[prev_sel]\n\t"
716 "movw %[sel], %%fs\n\t"
717 #ifdef __i386__
718 "pushl %%ebx\n\t"
719 #endif
720 "movl %[arg1], %%ebx\n\t"
721 "int $0x80\n\t" /* Should invalidate fs */
722 #ifdef __i386__
723 "popl %%ebx\n\t"
724 #endif
725 "movw %%fs, %[sel]\n\t"
726 : [prev_sel] "=&r" (prev_sel), [sel] "+r" (sel),
727 "+a" (eax)
728 : "m" (low_user_desc_clear),
729 [arg1] "r" ((unsigned int)(unsigned long)low_user_desc_clear)
730 : INT80_CLOBBERS);
731
732 #ifdef __x86_64__
733 syscall(SYS_arch_prctl, ARCH_GET_FS, &new_base);
734 #endif
735
736 /* Restore FS/BASE for glibc */
737 asm volatile ("movw %[prev_sel], %%fs" : : [prev_sel] "rm" (prev_sel));
738 #ifdef __x86_64__
739 if (saved_base)
740 syscall(SYS_arch_prctl, ARCH_SET_FS, saved_base);
741 #endif
742
743 if (sel != 0) {
744 result = "FAIL";
745 nerrs++;
746 } else {
747 result = "OK";
748 }
749 printf("[%s]\tInvalidate FS with set_thread_area: new FS = 0x%hx\n",
750 result, sel);
751
752 #ifdef __x86_64__
753 if (sel == 0 && new_base != 0) {
754 nerrs++;
755 printf("[FAIL]\tNew FSBASE was 0x%lx\n", new_base);
756 } else {
757 printf("[OK]\tNew FSBASE was zero\n");
758 }
759 #endif
760
761 /* Test GS */
762 invoke_set_thread_area();
763 eax = 243;
764 sel = (gdt_entry_num << 3) | 3;
765 #ifdef __x86_64__
766 syscall(SYS_arch_prctl, ARCH_GET_GS, &saved_base);
767 #endif
768 asm volatile ("movw %%gs, %[prev_sel]\n\t"
769 "movw %[sel], %%gs\n\t"
770 #ifdef __i386__
771 "pushl %%ebx\n\t"
772 #endif
773 "movl %[arg1], %%ebx\n\t"
774 "int $0x80\n\t" /* Should invalidate gs */
775 #ifdef __i386__
776 "popl %%ebx\n\t"
777 #endif
778 "movw %%gs, %[sel]\n\t"
779 : [prev_sel] "=&r" (prev_sel), [sel] "+r" (sel),
780 "+a" (eax)
781 : "m" (low_user_desc_clear),
782 [arg1] "r" ((unsigned int)(unsigned long)low_user_desc_clear)
783 : INT80_CLOBBERS);
784
785 #ifdef __x86_64__
786 syscall(SYS_arch_prctl, ARCH_GET_GS, &new_base);
787 #endif
788
789 /* Restore GS/BASE for glibc */
790 asm volatile ("movw %[prev_sel], %%gs" : : [prev_sel] "rm" (prev_sel));
791 #ifdef __x86_64__
792 if (saved_base)
793 syscall(SYS_arch_prctl, ARCH_SET_GS, saved_base);
794 #endif
795
796 if (sel != 0) {
797 result = "FAIL";
798 nerrs++;
799 } else {
800 result = "OK";
801 }
802 printf("[%s]\tInvalidate GS with set_thread_area: new GS = 0x%hx\n",
803 result, sel);
804
805 #ifdef __x86_64__
806 if (sel == 0 && new_base != 0) {
807 nerrs++;
808 printf("[FAIL]\tNew GSBASE was 0x%lx\n", new_base);
809 } else {
810 printf("[OK]\tNew GSBASE was zero\n");
811 }
812 #endif
813 }
814
main(int argc,char ** argv)815 int main(int argc, char **argv)
816 {
817 if (argc == 1 && !strcmp(argv[0], "ldt_gdt_test_exec"))
818 return finish_exec_test();
819
820 setup_counter_page();
821 setup_low_user_desc();
822
823 do_simple_tests();
824
825 do_multicpu_tests();
826
827 do_exec_test();
828
829 test_gdt_invalidation();
830
831 return nerrs ? 1 : 0;
832 }
833