1 // SPDX-License-Identifier: GPL-2.0-only
2 /*
3 * fsgsbase.c, an fsgsbase test
4 * Copyright (c) 2014-2016 Andy Lutomirski
5 */
6
7 #define _GNU_SOURCE
8 #include <stdio.h>
9 #include <stdlib.h>
10 #include <stdbool.h>
11 #include <string.h>
12 #include <sys/syscall.h>
13 #include <unistd.h>
14 #include <err.h>
15 #include <sys/user.h>
16 #include <asm/prctl.h>
17 #include <sys/prctl.h>
18 #include <signal.h>
19 #include <limits.h>
20 #include <sys/ucontext.h>
21 #include <sched.h>
22 #include <linux/futex.h>
23 #include <pthread.h>
24 #include <asm/ldt.h>
25 #include <sys/mman.h>
26 #include <stddef.h>
27 #include <sys/ptrace.h>
28 #include <sys/wait.h>
29 #include <setjmp.h>
30
31 #ifndef __x86_64__
32 # error This test is 64-bit only
33 #endif
34
35 static volatile sig_atomic_t want_segv;
36 static volatile unsigned long segv_addr;
37
38 static unsigned short *shared_scratch;
39
40 static int nerrs;
41
sethandler(int sig,void (* handler)(int,siginfo_t *,void *),int flags)42 static void sethandler(int sig, void (*handler)(int, siginfo_t *, void *),
43 int flags)
44 {
45 struct sigaction sa;
46 memset(&sa, 0, sizeof(sa));
47 sa.sa_sigaction = handler;
48 sa.sa_flags = SA_SIGINFO | flags;
49 sigemptyset(&sa.sa_mask);
50 if (sigaction(sig, &sa, 0))
51 err(1, "sigaction");
52 }
53
clearhandler(int sig)54 static void clearhandler(int sig)
55 {
56 struct sigaction sa;
57 memset(&sa, 0, sizeof(sa));
58 sa.sa_handler = SIG_DFL;
59 sigemptyset(&sa.sa_mask);
60 if (sigaction(sig, &sa, 0))
61 err(1, "sigaction");
62 }
63
sigsegv(int sig,siginfo_t * si,void * ctx_void)64 static void sigsegv(int sig, siginfo_t *si, void *ctx_void)
65 {
66 ucontext_t *ctx = (ucontext_t*)ctx_void;
67
68 if (!want_segv) {
69 clearhandler(SIGSEGV);
70 return; /* Crash cleanly. */
71 }
72
73 want_segv = false;
74 segv_addr = (unsigned long)si->si_addr;
75
76 ctx->uc_mcontext.gregs[REG_RIP] += 4; /* Skip the faulting mov */
77
78 }
79
80 static jmp_buf jmpbuf;
81
sigill(int sig,siginfo_t * si,void * ctx_void)82 static void sigill(int sig, siginfo_t *si, void *ctx_void)
83 {
84 siglongjmp(jmpbuf, 1);
85 }
86
87 static bool have_fsgsbase;
88
rdgsbase(void)89 static inline unsigned long rdgsbase(void)
90 {
91 unsigned long gsbase;
92
93 asm volatile("rdgsbase %0" : "=r" (gsbase) :: "memory");
94
95 return gsbase;
96 }
97
rdfsbase(void)98 static inline unsigned long rdfsbase(void)
99 {
100 unsigned long fsbase;
101
102 asm volatile("rdfsbase %0" : "=r" (fsbase) :: "memory");
103
104 return fsbase;
105 }
106
wrgsbase(unsigned long gsbase)107 static inline void wrgsbase(unsigned long gsbase)
108 {
109 asm volatile("wrgsbase %0" :: "r" (gsbase) : "memory");
110 }
111
wrfsbase(unsigned long fsbase)112 static inline void wrfsbase(unsigned long fsbase)
113 {
114 asm volatile("wrfsbase %0" :: "r" (fsbase) : "memory");
115 }
116
117 enum which_base { FS, GS };
118
read_base(enum which_base which)119 static unsigned long read_base(enum which_base which)
120 {
121 unsigned long offset;
122 /*
123 * Unless we have FSGSBASE, there's no direct way to do this from
124 * user mode. We can get at it indirectly using signals, though.
125 */
126
127 want_segv = true;
128
129 offset = 0;
130 if (which == FS) {
131 /* Use a constant-length instruction here. */
132 asm volatile ("mov %%fs:(%%rcx), %%rax" : : "c" (offset) : "rax");
133 } else {
134 asm volatile ("mov %%gs:(%%rcx), %%rax" : : "c" (offset) : "rax");
135 }
136 if (!want_segv)
137 return segv_addr + offset;
138
139 /*
140 * If that didn't segfault, try the other end of the address space.
141 * Unless we get really unlucky and run into the vsyscall page, this
142 * is guaranteed to segfault.
143 */
144
145 offset = (ULONG_MAX >> 1) + 1;
146 if (which == FS) {
147 asm volatile ("mov %%fs:(%%rcx), %%rax"
148 : : "c" (offset) : "rax");
149 } else {
150 asm volatile ("mov %%gs:(%%rcx), %%rax"
151 : : "c" (offset) : "rax");
152 }
153 if (!want_segv)
154 return segv_addr + offset;
155
156 abort();
157 }
158
check_gs_value(unsigned long value)159 static void check_gs_value(unsigned long value)
160 {
161 unsigned long base;
162 unsigned short sel;
163
164 printf("[RUN]\tARCH_SET_GS to 0x%lx\n", value);
165 if (syscall(SYS_arch_prctl, ARCH_SET_GS, value) != 0)
166 err(1, "ARCH_SET_GS");
167
168 asm volatile ("mov %%gs, %0" : "=rm" (sel));
169 base = read_base(GS);
170 if (base == value) {
171 printf("[OK]\tGSBASE was set as expected (selector 0x%hx)\n",
172 sel);
173 } else {
174 nerrs++;
175 printf("[FAIL]\tGSBASE was not as expected: got 0x%lx (selector 0x%hx)\n",
176 base, sel);
177 }
178
179 if (syscall(SYS_arch_prctl, ARCH_GET_GS, &base) != 0)
180 err(1, "ARCH_GET_GS");
181 if (base == value) {
182 printf("[OK]\tARCH_GET_GS worked as expected (selector 0x%hx)\n",
183 sel);
184 } else {
185 nerrs++;
186 printf("[FAIL]\tARCH_GET_GS was not as expected: got 0x%lx (selector 0x%hx)\n",
187 base, sel);
188 }
189 }
190
mov_0_gs(unsigned long initial_base,bool schedule)191 static void mov_0_gs(unsigned long initial_base, bool schedule)
192 {
193 unsigned long base, arch_base;
194
195 printf("[RUN]\tARCH_SET_GS to 0x%lx then mov 0 to %%gs%s\n", initial_base, schedule ? " and schedule " : "");
196 if (syscall(SYS_arch_prctl, ARCH_SET_GS, initial_base) != 0)
197 err(1, "ARCH_SET_GS");
198
199 if (schedule)
200 usleep(10);
201
202 asm volatile ("mov %0, %%gs" : : "rm" (0));
203 base = read_base(GS);
204 if (syscall(SYS_arch_prctl, ARCH_GET_GS, &arch_base) != 0)
205 err(1, "ARCH_GET_GS");
206 if (base == arch_base) {
207 printf("[OK]\tGSBASE is 0x%lx\n", base);
208 } else {
209 nerrs++;
210 printf("[FAIL]\tGSBASE changed to 0x%lx but kernel reports 0x%lx\n", base, arch_base);
211 }
212 }
213
214 static volatile unsigned long remote_base;
215 static volatile bool remote_hard_zero;
216 static volatile unsigned int ftx;
217
218 /*
219 * ARCH_SET_FS/GS(0) may or may not program a selector of zero. HARD_ZERO
220 * means to force the selector to zero to improve test coverage.
221 */
222 #define HARD_ZERO 0xa1fa5f343cb85fa4
223
do_remote_base()224 static void do_remote_base()
225 {
226 unsigned long to_set = remote_base;
227 bool hard_zero = false;
228 if (to_set == HARD_ZERO) {
229 to_set = 0;
230 hard_zero = true;
231 }
232
233 if (syscall(SYS_arch_prctl, ARCH_SET_GS, to_set) != 0)
234 err(1, "ARCH_SET_GS");
235
236 if (hard_zero)
237 asm volatile ("mov %0, %%gs" : : "rm" ((unsigned short)0));
238
239 unsigned short sel;
240 asm volatile ("mov %%gs, %0" : "=rm" (sel));
241 printf("\tother thread: ARCH_SET_GS(0x%lx)%s -- sel is 0x%hx\n",
242 to_set, hard_zero ? " and clear gs" : "", sel);
243 }
244
245 static __thread int set_thread_area_entry_number = -1;
246
load_gs(void)247 static unsigned short load_gs(void)
248 {
249 /*
250 * Sets GS != 0 and GSBASE != 0 but arranges for the kernel to think
251 * that GSBASE == 0 (i.e. thread.gsbase == 0).
252 */
253
254 /* Step 1: tell the kernel that we have GSBASE == 0. */
255 if (syscall(SYS_arch_prctl, ARCH_SET_GS, 0) != 0)
256 err(1, "ARCH_SET_GS");
257
258 /* Step 2: change GSBASE without telling the kernel. */
259 struct user_desc desc = {
260 .entry_number = 0,
261 .base_addr = 0xBAADF00D,
262 .limit = 0xfffff,
263 .seg_32bit = 1,
264 .contents = 0, /* Data, grow-up */
265 .read_exec_only = 0,
266 .limit_in_pages = 1,
267 .seg_not_present = 0,
268 .useable = 0
269 };
270 if (syscall(SYS_modify_ldt, 1, &desc, sizeof(desc)) == 0) {
271 printf("\tusing LDT slot 0\n");
272 asm volatile ("mov %0, %%gs" : : "rm" ((unsigned short)0x7));
273 return 0x7;
274 } else {
275 /* No modify_ldt for us (configured out, perhaps) */
276
277 struct user_desc *low_desc = mmap(
278 NULL, sizeof(desc),
279 PROT_READ | PROT_WRITE,
280 MAP_PRIVATE | MAP_ANONYMOUS | MAP_32BIT, -1, 0);
281 memcpy(low_desc, &desc, sizeof(desc));
282
283 low_desc->entry_number = set_thread_area_entry_number;
284
285 /* 32-bit set_thread_area */
286 long ret;
287 asm volatile ("int $0x80"
288 : "=a" (ret), "+m" (*low_desc)
289 : "a" (243), "b" (low_desc)
290 : "r8", "r9", "r10", "r11");
291 memcpy(&desc, low_desc, sizeof(desc));
292 munmap(low_desc, sizeof(desc));
293
294 if (ret != 0) {
295 printf("[NOTE]\tcould not create a segment -- test won't do anything\n");
296 return 0;
297 }
298 printf("\tusing GDT slot %d\n", desc.entry_number);
299 set_thread_area_entry_number = desc.entry_number;
300
301 unsigned short gs = (unsigned short)((desc.entry_number << 3) | 0x3);
302 asm volatile ("mov %0, %%gs" : : "rm" (gs));
303 return gs;
304 }
305 }
306
test_wrbase(unsigned short index,unsigned long base)307 void test_wrbase(unsigned short index, unsigned long base)
308 {
309 unsigned short newindex;
310 unsigned long newbase;
311
312 printf("[RUN]\tGS = 0x%hx, GSBASE = 0x%lx\n", index, base);
313
314 asm volatile ("mov %0, %%gs" : : "rm" (index));
315 wrgsbase(base);
316
317 remote_base = 0;
318 ftx = 1;
319 syscall(SYS_futex, &ftx, FUTEX_WAKE, 0, NULL, NULL, 0);
320 while (ftx != 0)
321 syscall(SYS_futex, &ftx, FUTEX_WAIT, 1, NULL, NULL, 0);
322
323 asm volatile ("mov %%gs, %0" : "=rm" (newindex));
324 newbase = rdgsbase();
325
326 if (newindex == index && newbase == base) {
327 printf("[OK]\tIndex and base were preserved\n");
328 } else {
329 printf("[FAIL]\tAfter switch, GS = 0x%hx and GSBASE = 0x%lx\n",
330 newindex, newbase);
331 nerrs++;
332 }
333 }
334
threadproc(void * ctx)335 static void *threadproc(void *ctx)
336 {
337 while (1) {
338 while (ftx == 0)
339 syscall(SYS_futex, &ftx, FUTEX_WAIT, 0, NULL, NULL, 0);
340 if (ftx == 3)
341 return NULL;
342
343 if (ftx == 1) {
344 do_remote_base();
345 } else if (ftx == 2) {
346 /*
347 * On AMD chips, this causes GSBASE != 0, GS == 0, and
348 * thread.gsbase == 0.
349 */
350
351 load_gs();
352 asm volatile ("mov %0, %%gs" : : "rm" ((unsigned short)0));
353 } else {
354 errx(1, "helper thread got bad command");
355 }
356
357 ftx = 0;
358 syscall(SYS_futex, &ftx, FUTEX_WAKE, 0, NULL, NULL, 0);
359 }
360 }
361
set_gs_and_switch_to(unsigned long local,unsigned short force_sel,unsigned long remote)362 static void set_gs_and_switch_to(unsigned long local,
363 unsigned short force_sel,
364 unsigned long remote)
365 {
366 unsigned long base;
367 unsigned short sel_pre_sched, sel_post_sched;
368
369 bool hard_zero = false;
370 if (local == HARD_ZERO) {
371 hard_zero = true;
372 local = 0;
373 }
374
375 printf("[RUN]\tARCH_SET_GS(0x%lx)%s, then schedule to 0x%lx\n",
376 local, hard_zero ? " and clear gs" : "", remote);
377 if (force_sel)
378 printf("\tBefore schedule, set selector to 0x%hx\n", force_sel);
379 if (syscall(SYS_arch_prctl, ARCH_SET_GS, local) != 0)
380 err(1, "ARCH_SET_GS");
381 if (hard_zero)
382 asm volatile ("mov %0, %%gs" : : "rm" ((unsigned short)0));
383
384 if (read_base(GS) != local) {
385 nerrs++;
386 printf("[FAIL]\tGSBASE wasn't set as expected\n");
387 }
388
389 if (force_sel) {
390 asm volatile ("mov %0, %%gs" : : "rm" (force_sel));
391 sel_pre_sched = force_sel;
392 local = read_base(GS);
393
394 /*
395 * Signal delivery is quite likely to change a selector
396 * of 1, 2, or 3 back to 0 due to IRET being defective.
397 */
398 asm volatile ("mov %0, %%gs" : : "rm" (force_sel));
399 } else {
400 asm volatile ("mov %%gs, %0" : "=rm" (sel_pre_sched));
401 }
402
403 remote_base = remote;
404 ftx = 1;
405 syscall(SYS_futex, &ftx, FUTEX_WAKE, 0, NULL, NULL, 0);
406 while (ftx != 0)
407 syscall(SYS_futex, &ftx, FUTEX_WAIT, 1, NULL, NULL, 0);
408
409 asm volatile ("mov %%gs, %0" : "=rm" (sel_post_sched));
410 base = read_base(GS);
411 if (base == local && sel_pre_sched == sel_post_sched) {
412 printf("[OK]\tGS/BASE remained 0x%hx/0x%lx\n",
413 sel_pre_sched, local);
414 } else if (base == local && sel_pre_sched >= 1 && sel_pre_sched <= 3 &&
415 sel_post_sched == 0) {
416 /*
417 * IRET is misdesigned and will squash selectors 1, 2, or 3
418 * to zero. Don't fail the test just because this happened.
419 */
420 printf("[OK]\tGS/BASE changed from 0x%hx/0x%lx to 0x%hx/0x%lx because IRET is defective\n",
421 sel_pre_sched, local, sel_post_sched, base);
422 } else {
423 nerrs++;
424 printf("[FAIL]\tGS/BASE changed from 0x%hx/0x%lx to 0x%hx/0x%lx\n",
425 sel_pre_sched, local, sel_post_sched, base);
426 }
427 }
428
test_unexpected_base(void)429 static void test_unexpected_base(void)
430 {
431 unsigned long base;
432
433 printf("[RUN]\tARCH_SET_GS(0), clear gs, then manipulate GSBASE in a different thread\n");
434 if (syscall(SYS_arch_prctl, ARCH_SET_GS, 0) != 0)
435 err(1, "ARCH_SET_GS");
436 asm volatile ("mov %0, %%gs" : : "rm" ((unsigned short)0));
437
438 ftx = 2;
439 syscall(SYS_futex, &ftx, FUTEX_WAKE, 0, NULL, NULL, 0);
440 while (ftx != 0)
441 syscall(SYS_futex, &ftx, FUTEX_WAIT, 1, NULL, NULL, 0);
442
443 base = read_base(GS);
444 if (base == 0) {
445 printf("[OK]\tGSBASE remained 0\n");
446 } else {
447 nerrs++;
448 printf("[FAIL]\tGSBASE changed to 0x%lx\n", base);
449 }
450 }
451
452 #define USER_REGS_OFFSET(r) offsetof(struct user_regs_struct, r)
453
test_ptrace_write_gs_read_base(void)454 static void test_ptrace_write_gs_read_base(void)
455 {
456 int status;
457 pid_t child = fork();
458
459 if (child < 0)
460 err(1, "fork");
461
462 if (child == 0) {
463 printf("[RUN]\tPTRACE_POKE GS, read GSBASE back\n");
464
465 printf("[RUN]\tARCH_SET_GS to 1\n");
466 if (syscall(SYS_arch_prctl, ARCH_SET_GS, 1) != 0)
467 err(1, "ARCH_SET_GS");
468
469 if (ptrace(PTRACE_TRACEME, 0, NULL, NULL) != 0)
470 err(1, "PTRACE_TRACEME");
471
472 raise(SIGTRAP);
473 _exit(0);
474 }
475
476 wait(&status);
477
478 if (WSTOPSIG(status) == SIGTRAP) {
479 unsigned long base;
480 unsigned long gs_offset = USER_REGS_OFFSET(gs);
481 unsigned long base_offset = USER_REGS_OFFSET(gs_base);
482
483 /* Read the initial base. It should be 1. */
484 base = ptrace(PTRACE_PEEKUSER, child, base_offset, NULL);
485 if (base == 1) {
486 printf("[OK]\tGSBASE started at 1\n");
487 } else {
488 nerrs++;
489 printf("[FAIL]\tGSBASE started at 0x%lx\n", base);
490 }
491
492 printf("[RUN]\tSet GS = 0x7, read GSBASE\n");
493
494 /* Poke an LDT selector into GS. */
495 if (ptrace(PTRACE_POKEUSER, child, gs_offset, 0x7) != 0)
496 err(1, "PTRACE_POKEUSER");
497
498 /* And read the base. */
499 base = ptrace(PTRACE_PEEKUSER, child, base_offset, NULL);
500
501 if (base == 0 || base == 1) {
502 printf("[OK]\tGSBASE reads as 0x%lx with invalid GS\n", base);
503 } else {
504 nerrs++;
505 printf("[FAIL]\tGSBASE=0x%lx (should be 0 or 1)\n", base);
506 }
507 }
508
509 ptrace(PTRACE_CONT, child, NULL, NULL);
510
511 wait(&status);
512 if (!WIFEXITED(status))
513 printf("[WARN]\tChild didn't exit cleanly.\n");
514 }
515
test_ptrace_write_gsbase(void)516 static void test_ptrace_write_gsbase(void)
517 {
518 int status;
519 pid_t child = fork();
520
521 if (child < 0)
522 err(1, "fork");
523
524 if (child == 0) {
525 printf("[RUN]\tPTRACE_POKE(), write GSBASE from ptracer\n");
526
527 *shared_scratch = load_gs();
528
529 if (ptrace(PTRACE_TRACEME, 0, NULL, NULL) != 0)
530 err(1, "PTRACE_TRACEME");
531
532 raise(SIGTRAP);
533 _exit(0);
534 }
535
536 wait(&status);
537
538 if (WSTOPSIG(status) == SIGTRAP) {
539 unsigned long gs, base;
540 unsigned long gs_offset = USER_REGS_OFFSET(gs);
541 unsigned long base_offset = USER_REGS_OFFSET(gs_base);
542
543 gs = ptrace(PTRACE_PEEKUSER, child, gs_offset, NULL);
544
545 if (gs != *shared_scratch) {
546 nerrs++;
547 printf("[FAIL]\tGS is not prepared with nonzero\n");
548 goto END;
549 }
550
551 if (ptrace(PTRACE_POKEUSER, child, base_offset, 0xFF) != 0)
552 err(1, "PTRACE_POKEUSER");
553
554 gs = ptrace(PTRACE_PEEKUSER, child, gs_offset, NULL);
555 base = ptrace(PTRACE_PEEKUSER, child, base_offset, NULL);
556
557 /*
558 * In a non-FSGSBASE system, the nonzero selector will load
559 * GSBASE (again). But what is tested here is whether the
560 * selector value is changed or not by the GSBASE write in
561 * a ptracer.
562 */
563 if (gs != *shared_scratch) {
564 nerrs++;
565 printf("[FAIL]\tGS changed to %lx\n", gs);
566
567 /*
568 * On older kernels, poking a nonzero value into the
569 * base would zero the selector. On newer kernels,
570 * this behavior has changed -- poking the base
571 * changes only the base and, if FSGSBASE is not
572 * available, this may have no effect once the tracee
573 * is resumed.
574 */
575 if (gs == 0)
576 printf("\tNote: this is expected behavior on older kernels.\n");
577 } else if (have_fsgsbase && (base != 0xFF)) {
578 nerrs++;
579 printf("[FAIL]\tGSBASE changed to %lx\n", base);
580 } else {
581 printf("[OK]\tGS remained 0x%hx", *shared_scratch);
582 if (have_fsgsbase)
583 printf(" and GSBASE changed to 0xFF");
584 printf("\n");
585 }
586 }
587
588 END:
589 ptrace(PTRACE_CONT, child, NULL, NULL);
590 wait(&status);
591 if (!WIFEXITED(status))
592 printf("[WARN]\tChild didn't exit cleanly.\n");
593 }
594
main()595 int main()
596 {
597 pthread_t thread;
598
599 shared_scratch = mmap(NULL, 4096, PROT_READ | PROT_WRITE,
600 MAP_ANONYMOUS | MAP_SHARED, -1, 0);
601
602 /* Do these tests before we have an LDT. */
603 test_ptrace_write_gs_read_base();
604
605 /* Probe FSGSBASE */
606 sethandler(SIGILL, sigill, 0);
607 if (sigsetjmp(jmpbuf, 1) == 0) {
608 rdfsbase();
609 have_fsgsbase = true;
610 printf("\tFSGSBASE instructions are enabled\n");
611 } else {
612 printf("\tFSGSBASE instructions are disabled\n");
613 }
614 clearhandler(SIGILL);
615
616 sethandler(SIGSEGV, sigsegv, 0);
617
618 check_gs_value(0);
619 check_gs_value(1);
620 check_gs_value(0x200000000);
621 check_gs_value(0);
622 check_gs_value(0x200000000);
623 check_gs_value(1);
624
625 for (int sched = 0; sched < 2; sched++) {
626 mov_0_gs(0, !!sched);
627 mov_0_gs(1, !!sched);
628 mov_0_gs(0x200000000, !!sched);
629 }
630
631 /* Set up for multithreading. */
632
633 cpu_set_t cpuset;
634 CPU_ZERO(&cpuset);
635 CPU_SET(0, &cpuset);
636 if (sched_setaffinity(0, sizeof(cpuset), &cpuset) != 0)
637 err(1, "sched_setaffinity to CPU 0"); /* should never fail */
638
639 if (pthread_create(&thread, 0, threadproc, 0) != 0)
640 err(1, "pthread_create");
641
642 static unsigned long bases_with_hard_zero[] = {
643 0, HARD_ZERO, 1, 0x200000000,
644 };
645
646 for (int local = 0; local < 4; local++) {
647 for (int remote = 0; remote < 4; remote++) {
648 for (unsigned short s = 0; s < 5; s++) {
649 unsigned short sel = s;
650 if (s == 4)
651 asm ("mov %%ss, %0" : "=rm" (sel));
652 set_gs_and_switch_to(
653 bases_with_hard_zero[local],
654 sel,
655 bases_with_hard_zero[remote]);
656 }
657 }
658 }
659
660 test_unexpected_base();
661
662 if (have_fsgsbase) {
663 unsigned short ss;
664
665 asm volatile ("mov %%ss, %0" : "=rm" (ss));
666
667 test_wrbase(0, 0);
668 test_wrbase(0, 1);
669 test_wrbase(0, 0x200000000);
670 test_wrbase(0, 0xffffffffffffffff);
671 test_wrbase(ss, 0);
672 test_wrbase(ss, 1);
673 test_wrbase(ss, 0x200000000);
674 test_wrbase(ss, 0xffffffffffffffff);
675 }
676
677 ftx = 3; /* Kill the thread. */
678 syscall(SYS_futex, &ftx, FUTEX_WAKE, 0, NULL, NULL, 0);
679
680 if (pthread_join(thread, NULL) != 0)
681 err(1, "pthread_join");
682
683 test_ptrace_write_gsbase();
684
685 return nerrs == 0 ? 0 : 1;
686 }
687