1 // SPDX-License-Identifier: GPL-2.0-only
2 /*
3 * fsgsbase.c, an fsgsbase test
4 * Copyright (c) 2014-2016 Andy Lutomirski
5 */
6
7 #define _GNU_SOURCE
8 #include <stdio.h>
9 #include <stdlib.h>
10 #include <stdbool.h>
11 #include <string.h>
12 #include <sys/syscall.h>
13 #include <unistd.h>
14 #include <err.h>
15 #include <sys/user.h>
16 #include <asm/prctl.h>
17 #include <sys/prctl.h>
18 #include <signal.h>
19 #include <limits.h>
20 #include <sys/ucontext.h>
21 #include <sched.h>
22 #include <linux/futex.h>
23 #include <pthread.h>
24 #include <asm/ldt.h>
25 #include <sys/mman.h>
26 #include <stddef.h>
27 #include <sys/ptrace.h>
28 #include <sys/wait.h>
29 #include <setjmp.h>
30
31 #ifndef __x86_64__
32 # error This test is 64-bit only
33 #endif
34
35 static volatile sig_atomic_t want_segv;
36 static volatile unsigned long segv_addr;
37
38 static unsigned short *shared_scratch;
39
40 static int nerrs;
41
sethandler(int sig,void (* handler)(int,siginfo_t *,void *),int flags)42 static void sethandler(int sig, void (*handler)(int, siginfo_t *, void *),
43 int flags)
44 {
45 struct sigaction sa;
46 memset(&sa, 0, sizeof(sa));
47 sa.sa_sigaction = handler;
48 sa.sa_flags = SA_SIGINFO | flags;
49 sigemptyset(&sa.sa_mask);
50 if (sigaction(sig, &sa, 0))
51 err(1, "sigaction");
52 }
53
clearhandler(int sig)54 static void clearhandler(int sig)
55 {
56 struct sigaction sa;
57 memset(&sa, 0, sizeof(sa));
58 sa.sa_handler = SIG_DFL;
59 sigemptyset(&sa.sa_mask);
60 if (sigaction(sig, &sa, 0))
61 err(1, "sigaction");
62 }
63
sigsegv(int sig,siginfo_t * si,void * ctx_void)64 static void sigsegv(int sig, siginfo_t *si, void *ctx_void)
65 {
66 ucontext_t *ctx = (ucontext_t*)ctx_void;
67
68 if (!want_segv) {
69 clearhandler(SIGSEGV);
70 return; /* Crash cleanly. */
71 }
72
73 want_segv = false;
74 segv_addr = (unsigned long)si->si_addr;
75
76 ctx->uc_mcontext.gregs[REG_RIP] += 4; /* Skip the faulting mov */
77
78 }
79
80 static jmp_buf jmpbuf;
81
sigill(int sig,siginfo_t * si,void * ctx_void)82 static void sigill(int sig, siginfo_t *si, void *ctx_void)
83 {
84 siglongjmp(jmpbuf, 1);
85 }
86
87 static bool have_fsgsbase;
88
rdgsbase(void)89 static inline unsigned long rdgsbase(void)
90 {
91 unsigned long gsbase;
92
93 asm volatile("rdgsbase %0" : "=r" (gsbase) :: "memory");
94
95 return gsbase;
96 }
97
rdfsbase(void)98 static inline unsigned long rdfsbase(void)
99 {
100 unsigned long fsbase;
101
102 asm volatile("rdfsbase %0" : "=r" (fsbase) :: "memory");
103
104 return fsbase;
105 }
106
wrgsbase(unsigned long gsbase)107 static inline void wrgsbase(unsigned long gsbase)
108 {
109 asm volatile("wrgsbase %0" :: "r" (gsbase) : "memory");
110 }
111
wrfsbase(unsigned long fsbase)112 static inline void wrfsbase(unsigned long fsbase)
113 {
114 asm volatile("wrfsbase %0" :: "r" (fsbase) : "memory");
115 }
116
117 enum which_base { FS, GS };
118
read_base(enum which_base which)119 static unsigned long read_base(enum which_base which)
120 {
121 unsigned long offset;
122 /*
123 * Unless we have FSGSBASE, there's no direct way to do this from
124 * user mode. We can get at it indirectly using signals, though.
125 */
126
127 want_segv = true;
128
129 offset = 0;
130 if (which == FS) {
131 /* Use a constant-length instruction here. */
132 asm volatile ("mov %%fs:(%%rcx), %%rax" : : "c" (offset) : "rax");
133 } else {
134 asm volatile ("mov %%gs:(%%rcx), %%rax" : : "c" (offset) : "rax");
135 }
136 if (!want_segv)
137 return segv_addr + offset;
138
139 /*
140 * If that didn't segfault, try the other end of the address space.
141 * Unless we get really unlucky and run into the vsyscall page, this
142 * is guaranteed to segfault.
143 */
144
145 offset = (ULONG_MAX >> 1) + 1;
146 if (which == FS) {
147 asm volatile ("mov %%fs:(%%rcx), %%rax"
148 : : "c" (offset) : "rax");
149 } else {
150 asm volatile ("mov %%gs:(%%rcx), %%rax"
151 : : "c" (offset) : "rax");
152 }
153 if (!want_segv)
154 return segv_addr + offset;
155
156 abort();
157 }
158
check_gs_value(unsigned long value)159 static void check_gs_value(unsigned long value)
160 {
161 unsigned long base;
162 unsigned short sel;
163
164 printf("[RUN]\tARCH_SET_GS to 0x%lx\n", value);
165 if (syscall(SYS_arch_prctl, ARCH_SET_GS, value) != 0)
166 err(1, "ARCH_SET_GS");
167
168 asm volatile ("mov %%gs, %0" : "=rm" (sel));
169 base = read_base(GS);
170 if (base == value) {
171 printf("[OK]\tGSBASE was set as expected (selector 0x%hx)\n",
172 sel);
173 } else {
174 nerrs++;
175 printf("[FAIL]\tGSBASE was not as expected: got 0x%lx (selector 0x%hx)\n",
176 base, sel);
177 }
178
179 if (syscall(SYS_arch_prctl, ARCH_GET_GS, &base) != 0)
180 err(1, "ARCH_GET_GS");
181 if (base == value) {
182 printf("[OK]\tARCH_GET_GS worked as expected (selector 0x%hx)\n",
183 sel);
184 } else {
185 nerrs++;
186 printf("[FAIL]\tARCH_GET_GS was not as expected: got 0x%lx (selector 0x%hx)\n",
187 base, sel);
188 }
189 }
190
mov_0_gs(unsigned long initial_base,bool schedule)191 static void mov_0_gs(unsigned long initial_base, bool schedule)
192 {
193 unsigned long base, arch_base;
194
195 printf("[RUN]\tARCH_SET_GS to 0x%lx then mov 0 to %%gs%s\n", initial_base, schedule ? " and schedule " : "");
196 if (syscall(SYS_arch_prctl, ARCH_SET_GS, initial_base) != 0)
197 err(1, "ARCH_SET_GS");
198
199 if (schedule)
200 usleep(10);
201
202 asm volatile ("mov %0, %%gs" : : "rm" (0));
203 base = read_base(GS);
204 if (syscall(SYS_arch_prctl, ARCH_GET_GS, &arch_base) != 0)
205 err(1, "ARCH_GET_GS");
206 if (base == arch_base) {
207 printf("[OK]\tGSBASE is 0x%lx\n", base);
208 } else {
209 nerrs++;
210 printf("[FAIL]\tGSBASE changed to 0x%lx but kernel reports 0x%lx\n", base, arch_base);
211 }
212 }
213
214 static volatile unsigned long remote_base;
215 static volatile bool remote_hard_zero;
216 static volatile unsigned int ftx;
217
218 /*
219 * ARCH_SET_FS/GS(0) may or may not program a selector of zero. HARD_ZERO
220 * means to force the selector to zero to improve test coverage.
221 */
222 #define HARD_ZERO 0xa1fa5f343cb85fa4
223
do_remote_base()224 static void do_remote_base()
225 {
226 unsigned long to_set = remote_base;
227 bool hard_zero = false;
228 if (to_set == HARD_ZERO) {
229 to_set = 0;
230 hard_zero = true;
231 }
232
233 if (syscall(SYS_arch_prctl, ARCH_SET_GS, to_set) != 0)
234 err(1, "ARCH_SET_GS");
235
236 if (hard_zero)
237 asm volatile ("mov %0, %%gs" : : "rm" ((unsigned short)0));
238
239 unsigned short sel;
240 asm volatile ("mov %%gs, %0" : "=rm" (sel));
241 printf("\tother thread: ARCH_SET_GS(0x%lx)%s -- sel is 0x%hx\n",
242 to_set, hard_zero ? " and clear gs" : "", sel);
243 }
244
245 static __thread int set_thread_area_entry_number = -1;
246
load_gs(void)247 static unsigned short load_gs(void)
248 {
249 /*
250 * Sets GS != 0 and GSBASE != 0 but arranges for the kernel to think
251 * that GSBASE == 0 (i.e. thread.gsbase == 0).
252 */
253
254 /* Step 1: tell the kernel that we have GSBASE == 0. */
255 if (syscall(SYS_arch_prctl, ARCH_SET_GS, 0) != 0)
256 err(1, "ARCH_SET_GS");
257
258 /* Step 2: change GSBASE without telling the kernel. */
259 struct user_desc desc = {
260 .entry_number = 0,
261 .base_addr = 0xBAADF00D,
262 .limit = 0xfffff,
263 .seg_32bit = 1,
264 .contents = 0, /* Data, grow-up */
265 .read_exec_only = 0,
266 .limit_in_pages = 1,
267 .seg_not_present = 0,
268 .useable = 0
269 };
270 if (syscall(SYS_modify_ldt, 1, &desc, sizeof(desc)) == 0) {
271 printf("\tusing LDT slot 0\n");
272 asm volatile ("mov %0, %%gs" : : "rm" ((unsigned short)0x7));
273 return 0x7;
274 } else {
275 /* No modify_ldt for us (configured out, perhaps) */
276
277 struct user_desc *low_desc = mmap(
278 NULL, sizeof(desc),
279 PROT_READ | PROT_WRITE,
280 MAP_PRIVATE | MAP_ANONYMOUS | MAP_32BIT, -1, 0);
281 memcpy(low_desc, &desc, sizeof(desc));
282
283 low_desc->entry_number = set_thread_area_entry_number;
284
285 /* 32-bit set_thread_area */
286 long ret;
287 asm volatile ("int $0x80"
288 : "=a" (ret), "+m" (*low_desc)
289 : "a" (243), "b" (low_desc)
290 : "r8", "r9", "r10", "r11");
291 memcpy(&desc, low_desc, sizeof(desc));
292 munmap(low_desc, sizeof(desc));
293
294 if (ret != 0) {
295 printf("[NOTE]\tcould not create a segment -- test won't do anything\n");
296 return 0;
297 }
298 printf("\tusing GDT slot %d\n", desc.entry_number);
299 set_thread_area_entry_number = desc.entry_number;
300
301 unsigned short gs = (unsigned short)((desc.entry_number << 3) | 0x3);
302 asm volatile ("mov %0, %%gs" : : "rm" (gs));
303 return gs;
304 }
305 }
306
test_wrbase(unsigned short index,unsigned long base)307 void test_wrbase(unsigned short index, unsigned long base)
308 {
309 unsigned short newindex;
310 unsigned long newbase;
311
312 printf("[RUN]\tGS = 0x%hx, GSBASE = 0x%lx\n", index, base);
313
314 asm volatile ("mov %0, %%gs" : : "rm" (index));
315 wrgsbase(base);
316
317 remote_base = 0;
318 ftx = 1;
319 syscall(SYS_futex, &ftx, FUTEX_WAKE, 0, NULL, NULL, 0);
320 while (ftx != 0)
321 syscall(SYS_futex, &ftx, FUTEX_WAIT, 1, NULL, NULL, 0);
322
323 asm volatile ("mov %%gs, %0" : "=rm" (newindex));
324 newbase = rdgsbase();
325
326 if (newindex == index && newbase == base) {
327 printf("[OK]\tIndex and base were preserved\n");
328 } else {
329 printf("[FAIL]\tAfter switch, GS = 0x%hx and GSBASE = 0x%lx\n",
330 newindex, newbase);
331 nerrs++;
332 }
333 }
334
threadproc(void * ctx)335 static void *threadproc(void *ctx)
336 {
337 while (1) {
338 while (ftx == 0)
339 syscall(SYS_futex, &ftx, FUTEX_WAIT, 0, NULL, NULL, 0);
340 if (ftx == 3)
341 return NULL;
342
343 if (ftx == 1) {
344 do_remote_base();
345 } else if (ftx == 2) {
346 /*
347 * On AMD chips, this causes GSBASE != 0, GS == 0, and
348 * thread.gsbase == 0.
349 */
350
351 load_gs();
352 asm volatile ("mov %0, %%gs" : : "rm" ((unsigned short)0));
353 } else {
354 errx(1, "helper thread got bad command");
355 }
356
357 ftx = 0;
358 syscall(SYS_futex, &ftx, FUTEX_WAKE, 0, NULL, NULL, 0);
359 }
360 }
361
set_gs_and_switch_to(unsigned long local,unsigned short force_sel,unsigned long remote)362 static void set_gs_and_switch_to(unsigned long local,
363 unsigned short force_sel,
364 unsigned long remote)
365 {
366 unsigned long base;
367 unsigned short sel_pre_sched, sel_post_sched;
368
369 bool hard_zero = false;
370 if (local == HARD_ZERO) {
371 hard_zero = true;
372 local = 0;
373 }
374
375 printf("[RUN]\tARCH_SET_GS(0x%lx)%s, then schedule to 0x%lx\n",
376 local, hard_zero ? " and clear gs" : "", remote);
377 if (force_sel)
378 printf("\tBefore schedule, set selector to 0x%hx\n", force_sel);
379 if (syscall(SYS_arch_prctl, ARCH_SET_GS, local) != 0)
380 err(1, "ARCH_SET_GS");
381 if (hard_zero)
382 asm volatile ("mov %0, %%gs" : : "rm" ((unsigned short)0));
383
384 if (read_base(GS) != local) {
385 nerrs++;
386 printf("[FAIL]\tGSBASE wasn't set as expected\n");
387 }
388
389 if (force_sel) {
390 asm volatile ("mov %0, %%gs" : : "rm" (force_sel));
391 sel_pre_sched = force_sel;
392 local = read_base(GS);
393
394 /*
395 * Signal delivery seems to mess up weird selectors. Put it
396 * back.
397 */
398 asm volatile ("mov %0, %%gs" : : "rm" (force_sel));
399 } else {
400 asm volatile ("mov %%gs, %0" : "=rm" (sel_pre_sched));
401 }
402
403 remote_base = remote;
404 ftx = 1;
405 syscall(SYS_futex, &ftx, FUTEX_WAKE, 0, NULL, NULL, 0);
406 while (ftx != 0)
407 syscall(SYS_futex, &ftx, FUTEX_WAIT, 1, NULL, NULL, 0);
408
409 asm volatile ("mov %%gs, %0" : "=rm" (sel_post_sched));
410 base = read_base(GS);
411 if (base == local && sel_pre_sched == sel_post_sched) {
412 printf("[OK]\tGS/BASE remained 0x%hx/0x%lx\n",
413 sel_pre_sched, local);
414 } else {
415 nerrs++;
416 printf("[FAIL]\tGS/BASE changed from 0x%hx/0x%lx to 0x%hx/0x%lx\n",
417 sel_pre_sched, local, sel_post_sched, base);
418 }
419 }
420
test_unexpected_base(void)421 static void test_unexpected_base(void)
422 {
423 unsigned long base;
424
425 printf("[RUN]\tARCH_SET_GS(0), clear gs, then manipulate GSBASE in a different thread\n");
426 if (syscall(SYS_arch_prctl, ARCH_SET_GS, 0) != 0)
427 err(1, "ARCH_SET_GS");
428 asm volatile ("mov %0, %%gs" : : "rm" ((unsigned short)0));
429
430 ftx = 2;
431 syscall(SYS_futex, &ftx, FUTEX_WAKE, 0, NULL, NULL, 0);
432 while (ftx != 0)
433 syscall(SYS_futex, &ftx, FUTEX_WAIT, 1, NULL, NULL, 0);
434
435 base = read_base(GS);
436 if (base == 0) {
437 printf("[OK]\tGSBASE remained 0\n");
438 } else {
439 nerrs++;
440 printf("[FAIL]\tGSBASE changed to 0x%lx\n", base);
441 }
442 }
443
444 #define USER_REGS_OFFSET(r) offsetof(struct user_regs_struct, r)
445
test_ptrace_write_gs_read_base(void)446 static void test_ptrace_write_gs_read_base(void)
447 {
448 int status;
449 pid_t child = fork();
450
451 if (child < 0)
452 err(1, "fork");
453
454 if (child == 0) {
455 printf("[RUN]\tPTRACE_POKE GS, read GSBASE back\n");
456
457 printf("[RUN]\tARCH_SET_GS to 1\n");
458 if (syscall(SYS_arch_prctl, ARCH_SET_GS, 1) != 0)
459 err(1, "ARCH_SET_GS");
460
461 if (ptrace(PTRACE_TRACEME, 0, NULL, NULL) != 0)
462 err(1, "PTRACE_TRACEME");
463
464 raise(SIGTRAP);
465 _exit(0);
466 }
467
468 wait(&status);
469
470 if (WSTOPSIG(status) == SIGTRAP) {
471 unsigned long base;
472 unsigned long gs_offset = USER_REGS_OFFSET(gs);
473 unsigned long base_offset = USER_REGS_OFFSET(gs_base);
474
475 /* Read the initial base. It should be 1. */
476 base = ptrace(PTRACE_PEEKUSER, child, base_offset, NULL);
477 if (base == 1) {
478 printf("[OK]\tGSBASE started at 1\n");
479 } else {
480 nerrs++;
481 printf("[FAIL]\tGSBASE started at 0x%lx\n", base);
482 }
483
484 printf("[RUN]\tSet GS = 0x7, read GSBASE\n");
485
486 /* Poke an LDT selector into GS. */
487 if (ptrace(PTRACE_POKEUSER, child, gs_offset, 0x7) != 0)
488 err(1, "PTRACE_POKEUSER");
489
490 /* And read the base. */
491 base = ptrace(PTRACE_PEEKUSER, child, base_offset, NULL);
492
493 if (base == 0 || base == 1) {
494 printf("[OK]\tGSBASE reads as 0x%lx with invalid GS\n", base);
495 } else {
496 nerrs++;
497 printf("[FAIL]\tGSBASE=0x%lx (should be 0 or 1)\n", base);
498 }
499 }
500
501 ptrace(PTRACE_CONT, child, NULL, NULL);
502
503 wait(&status);
504 if (!WIFEXITED(status))
505 printf("[WARN]\tChild didn't exit cleanly.\n");
506 }
507
test_ptrace_write_gsbase(void)508 static void test_ptrace_write_gsbase(void)
509 {
510 int status;
511 pid_t child = fork();
512
513 if (child < 0)
514 err(1, "fork");
515
516 if (child == 0) {
517 printf("[RUN]\tPTRACE_POKE(), write GSBASE from ptracer\n");
518
519 *shared_scratch = load_gs();
520
521 if (ptrace(PTRACE_TRACEME, 0, NULL, NULL) != 0)
522 err(1, "PTRACE_TRACEME");
523
524 raise(SIGTRAP);
525 _exit(0);
526 }
527
528 wait(&status);
529
530 if (WSTOPSIG(status) == SIGTRAP) {
531 unsigned long gs, base;
532 unsigned long gs_offset = USER_REGS_OFFSET(gs);
533 unsigned long base_offset = USER_REGS_OFFSET(gs_base);
534
535 gs = ptrace(PTRACE_PEEKUSER, child, gs_offset, NULL);
536
537 if (gs != *shared_scratch) {
538 nerrs++;
539 printf("[FAIL]\tGS is not prepared with nonzero\n");
540 goto END;
541 }
542
543 if (ptrace(PTRACE_POKEUSER, child, base_offset, 0xFF) != 0)
544 err(1, "PTRACE_POKEUSER");
545
546 gs = ptrace(PTRACE_PEEKUSER, child, gs_offset, NULL);
547 base = ptrace(PTRACE_PEEKUSER, child, base_offset, NULL);
548
549 /*
550 * In a non-FSGSBASE system, the nonzero selector will load
551 * GSBASE (again). But what is tested here is whether the
552 * selector value is changed or not by the GSBASE write in
553 * a ptracer.
554 */
555 if (gs != *shared_scratch) {
556 nerrs++;
557 printf("[FAIL]\tGS changed to %lx\n", gs);
558
559 /*
560 * On older kernels, poking a nonzero value into the
561 * base would zero the selector. On newer kernels,
562 * this behavior has changed -- poking the base
563 * changes only the base and, if FSGSBASE is not
564 * available, this may have no effect once the tracee
565 * is resumed.
566 */
567 if (gs == 0)
568 printf("\tNote: this is expected behavior on older kernels.\n");
569 } else if (have_fsgsbase && (base != 0xFF)) {
570 nerrs++;
571 printf("[FAIL]\tGSBASE changed to %lx\n", base);
572 } else {
573 printf("[OK]\tGS remained 0x%hx", *shared_scratch);
574 if (have_fsgsbase)
575 printf(" and GSBASE changed to 0xFF");
576 printf("\n");
577 }
578 }
579
580 END:
581 ptrace(PTRACE_CONT, child, NULL, NULL);
582 wait(&status);
583 if (!WIFEXITED(status))
584 printf("[WARN]\tChild didn't exit cleanly.\n");
585 }
586
main()587 int main()
588 {
589 pthread_t thread;
590
591 shared_scratch = mmap(NULL, 4096, PROT_READ | PROT_WRITE,
592 MAP_ANONYMOUS | MAP_SHARED, -1, 0);
593
594 /* Do these tests before we have an LDT. */
595 test_ptrace_write_gs_read_base();
596
597 /* Probe FSGSBASE */
598 sethandler(SIGILL, sigill, 0);
599 if (sigsetjmp(jmpbuf, 1) == 0) {
600 rdfsbase();
601 have_fsgsbase = true;
602 printf("\tFSGSBASE instructions are enabled\n");
603 } else {
604 printf("\tFSGSBASE instructions are disabled\n");
605 }
606 clearhandler(SIGILL);
607
608 sethandler(SIGSEGV, sigsegv, 0);
609
610 check_gs_value(0);
611 check_gs_value(1);
612 check_gs_value(0x200000000);
613 check_gs_value(0);
614 check_gs_value(0x200000000);
615 check_gs_value(1);
616
617 for (int sched = 0; sched < 2; sched++) {
618 mov_0_gs(0, !!sched);
619 mov_0_gs(1, !!sched);
620 mov_0_gs(0x200000000, !!sched);
621 }
622
623 /* Set up for multithreading. */
624
625 cpu_set_t cpuset;
626 CPU_ZERO(&cpuset);
627 CPU_SET(0, &cpuset);
628 if (sched_setaffinity(0, sizeof(cpuset), &cpuset) != 0)
629 err(1, "sched_setaffinity to CPU 0"); /* should never fail */
630
631 if (pthread_create(&thread, 0, threadproc, 0) != 0)
632 err(1, "pthread_create");
633
634 static unsigned long bases_with_hard_zero[] = {
635 0, HARD_ZERO, 1, 0x200000000,
636 };
637
638 for (int local = 0; local < 4; local++) {
639 for (int remote = 0; remote < 4; remote++) {
640 for (unsigned short s = 0; s < 5; s++) {
641 unsigned short sel = s;
642 if (s == 4)
643 asm ("mov %%ss, %0" : "=rm" (sel));
644 set_gs_and_switch_to(
645 bases_with_hard_zero[local],
646 sel,
647 bases_with_hard_zero[remote]);
648 }
649 }
650 }
651
652 test_unexpected_base();
653
654 if (have_fsgsbase) {
655 unsigned short ss;
656
657 asm volatile ("mov %%ss, %0" : "=rm" (ss));
658
659 test_wrbase(0, 0);
660 test_wrbase(0, 1);
661 test_wrbase(0, 0x200000000);
662 test_wrbase(0, 0xffffffffffffffff);
663 test_wrbase(ss, 0);
664 test_wrbase(ss, 1);
665 test_wrbase(ss, 0x200000000);
666 test_wrbase(ss, 0xffffffffffffffff);
667 }
668
669 ftx = 3; /* Kill the thread. */
670 syscall(SYS_futex, &ftx, FUTEX_WAKE, 0, NULL, NULL, 0);
671
672 if (pthread_join(thread, NULL) != 0)
673 err(1, "pthread_join");
674
675 test_ptrace_write_gsbase();
676
677 return nerrs == 0 ? 0 : 1;
678 }
679