1 // SPDX-License-Identifier: GPL-2.0-only 2 /* 3 * fsgsbase.c, an fsgsbase test 4 * Copyright (c) 2014-2016 Andy Lutomirski 5 */ 6 7 #define _GNU_SOURCE 8 #include <stdio.h> 9 #include <stdlib.h> 10 #include <stdbool.h> 11 #include <string.h> 12 #include <sys/syscall.h> 13 #include <unistd.h> 14 #include <err.h> 15 #include <sys/user.h> 16 #include <asm/prctl.h> 17 #include <sys/prctl.h> 18 #include <signal.h> 19 #include <limits.h> 20 #include <sys/ucontext.h> 21 #include <sched.h> 22 #include <linux/futex.h> 23 #include <pthread.h> 24 #include <asm/ldt.h> 25 #include <sys/mman.h> 26 #include <stddef.h> 27 #include <sys/ptrace.h> 28 #include <sys/wait.h> 29 #include <setjmp.h> 30 31 #ifndef __x86_64__ 32 # error This test is 64-bit only 33 #endif 34 35 static volatile sig_atomic_t want_segv; 36 static volatile unsigned long segv_addr; 37 38 static int nerrs; 39 40 static void sethandler(int sig, void (*handler)(int, siginfo_t *, void *), 41 int flags) 42 { 43 struct sigaction sa; 44 memset(&sa, 0, sizeof(sa)); 45 sa.sa_sigaction = handler; 46 sa.sa_flags = SA_SIGINFO | flags; 47 sigemptyset(&sa.sa_mask); 48 if (sigaction(sig, &sa, 0)) 49 err(1, "sigaction"); 50 } 51 52 static void clearhandler(int sig) 53 { 54 struct sigaction sa; 55 memset(&sa, 0, sizeof(sa)); 56 sa.sa_handler = SIG_DFL; 57 sigemptyset(&sa.sa_mask); 58 if (sigaction(sig, &sa, 0)) 59 err(1, "sigaction"); 60 } 61 62 static void sigsegv(int sig, siginfo_t *si, void *ctx_void) 63 { 64 ucontext_t *ctx = (ucontext_t*)ctx_void; 65 66 if (!want_segv) { 67 clearhandler(SIGSEGV); 68 return; /* Crash cleanly. */ 69 } 70 71 want_segv = false; 72 segv_addr = (unsigned long)si->si_addr; 73 74 ctx->uc_mcontext.gregs[REG_RIP] += 4; /* Skip the faulting mov */ 75 76 } 77 78 static jmp_buf jmpbuf; 79 80 static void sigill(int sig, siginfo_t *si, void *ctx_void) 81 { 82 siglongjmp(jmpbuf, 1); 83 } 84 85 static bool have_fsgsbase; 86 87 static inline unsigned long rdgsbase(void) 88 { 89 unsigned long gsbase; 90 91 asm volatile("rdgsbase %0" : "=r" (gsbase) :: "memory"); 92 93 return gsbase; 94 } 95 96 static inline unsigned long rdfsbase(void) 97 { 98 unsigned long fsbase; 99 100 asm volatile("rdfsbase %0" : "=r" (fsbase) :: "memory"); 101 102 return fsbase; 103 } 104 105 static inline void wrgsbase(unsigned long gsbase) 106 { 107 asm volatile("wrgsbase %0" :: "r" (gsbase) : "memory"); 108 } 109 110 static inline void wrfsbase(unsigned long fsbase) 111 { 112 asm volatile("wrfsbase %0" :: "r" (fsbase) : "memory"); 113 } 114 115 enum which_base { FS, GS }; 116 117 static unsigned long read_base(enum which_base which) 118 { 119 unsigned long offset; 120 /* 121 * Unless we have FSGSBASE, there's no direct way to do this from 122 * user mode. We can get at it indirectly using signals, though. 123 */ 124 125 want_segv = true; 126 127 offset = 0; 128 if (which == FS) { 129 /* Use a constant-length instruction here. */ 130 asm volatile ("mov %%fs:(%%rcx), %%rax" : : "c" (offset) : "rax"); 131 } else { 132 asm volatile ("mov %%gs:(%%rcx), %%rax" : : "c" (offset) : "rax"); 133 } 134 if (!want_segv) 135 return segv_addr + offset; 136 137 /* 138 * If that didn't segfault, try the other end of the address space. 139 * Unless we get really unlucky and run into the vsyscall page, this 140 * is guaranteed to segfault. 141 */ 142 143 offset = (ULONG_MAX >> 1) + 1; 144 if (which == FS) { 145 asm volatile ("mov %%fs:(%%rcx), %%rax" 146 : : "c" (offset) : "rax"); 147 } else { 148 asm volatile ("mov %%gs:(%%rcx), %%rax" 149 : : "c" (offset) : "rax"); 150 } 151 if (!want_segv) 152 return segv_addr + offset; 153 154 abort(); 155 } 156 157 static void check_gs_value(unsigned long value) 158 { 159 unsigned long base; 160 unsigned short sel; 161 162 printf("[RUN]\tARCH_SET_GS to 0x%lx\n", value); 163 if (syscall(SYS_arch_prctl, ARCH_SET_GS, value) != 0) 164 err(1, "ARCH_SET_GS"); 165 166 asm volatile ("mov %%gs, %0" : "=rm" (sel)); 167 base = read_base(GS); 168 if (base == value) { 169 printf("[OK]\tGSBASE was set as expected (selector 0x%hx)\n", 170 sel); 171 } else { 172 nerrs++; 173 printf("[FAIL]\tGSBASE was not as expected: got 0x%lx (selector 0x%hx)\n", 174 base, sel); 175 } 176 177 if (syscall(SYS_arch_prctl, ARCH_GET_GS, &base) != 0) 178 err(1, "ARCH_GET_GS"); 179 if (base == value) { 180 printf("[OK]\tARCH_GET_GS worked as expected (selector 0x%hx)\n", 181 sel); 182 } else { 183 nerrs++; 184 printf("[FAIL]\tARCH_GET_GS was not as expected: got 0x%lx (selector 0x%hx)\n", 185 base, sel); 186 } 187 } 188 189 static void mov_0_gs(unsigned long initial_base, bool schedule) 190 { 191 unsigned long base, arch_base; 192 193 printf("[RUN]\tARCH_SET_GS to 0x%lx then mov 0 to %%gs%s\n", initial_base, schedule ? " and schedule " : ""); 194 if (syscall(SYS_arch_prctl, ARCH_SET_GS, initial_base) != 0) 195 err(1, "ARCH_SET_GS"); 196 197 if (schedule) 198 usleep(10); 199 200 asm volatile ("mov %0, %%gs" : : "rm" (0)); 201 base = read_base(GS); 202 if (syscall(SYS_arch_prctl, ARCH_GET_GS, &arch_base) != 0) 203 err(1, "ARCH_GET_GS"); 204 if (base == arch_base) { 205 printf("[OK]\tGSBASE is 0x%lx\n", base); 206 } else { 207 nerrs++; 208 printf("[FAIL]\tGSBASE changed to 0x%lx but kernel reports 0x%lx\n", base, arch_base); 209 } 210 } 211 212 static volatile unsigned long remote_base; 213 static volatile bool remote_hard_zero; 214 static volatile unsigned int ftx; 215 216 /* 217 * ARCH_SET_FS/GS(0) may or may not program a selector of zero. HARD_ZERO 218 * means to force the selector to zero to improve test coverage. 219 */ 220 #define HARD_ZERO 0xa1fa5f343cb85fa4 221 222 static void do_remote_base() 223 { 224 unsigned long to_set = remote_base; 225 bool hard_zero = false; 226 if (to_set == HARD_ZERO) { 227 to_set = 0; 228 hard_zero = true; 229 } 230 231 if (syscall(SYS_arch_prctl, ARCH_SET_GS, to_set) != 0) 232 err(1, "ARCH_SET_GS"); 233 234 if (hard_zero) 235 asm volatile ("mov %0, %%gs" : : "rm" ((unsigned short)0)); 236 237 unsigned short sel; 238 asm volatile ("mov %%gs, %0" : "=rm" (sel)); 239 printf("\tother thread: ARCH_SET_GS(0x%lx)%s -- sel is 0x%hx\n", 240 to_set, hard_zero ? " and clear gs" : "", sel); 241 } 242 243 static __thread int set_thread_area_entry_number = -1; 244 245 static void do_unexpected_base(void) 246 { 247 /* 248 * The goal here is to try to arrange for GS == 0, GSBASE != 249 * 0, and for the the kernel the think that GSBASE == 0. 250 * 251 * To make the test as reliable as possible, this uses 252 * explicit descriptors. (This is not the only way. This 253 * could use ARCH_SET_GS with a low, nonzero base, but the 254 * relevant side effect of ARCH_SET_GS could change.) 255 */ 256 257 /* Step 1: tell the kernel that we have GSBASE == 0. */ 258 if (syscall(SYS_arch_prctl, ARCH_SET_GS, 0) != 0) 259 err(1, "ARCH_SET_GS"); 260 261 /* Step 2: change GSBASE without telling the kernel. */ 262 struct user_desc desc = { 263 .entry_number = 0, 264 .base_addr = 0xBAADF00D, 265 .limit = 0xfffff, 266 .seg_32bit = 1, 267 .contents = 0, /* Data, grow-up */ 268 .read_exec_only = 0, 269 .limit_in_pages = 1, 270 .seg_not_present = 0, 271 .useable = 0 272 }; 273 if (syscall(SYS_modify_ldt, 1, &desc, sizeof(desc)) == 0) { 274 printf("\tother thread: using LDT slot 0\n"); 275 asm volatile ("mov %0, %%gs" : : "rm" ((unsigned short)0x7)); 276 } else { 277 /* No modify_ldt for us (configured out, perhaps) */ 278 279 struct user_desc *low_desc = mmap( 280 NULL, sizeof(desc), 281 PROT_READ | PROT_WRITE, 282 MAP_PRIVATE | MAP_ANONYMOUS | MAP_32BIT, -1, 0); 283 memcpy(low_desc, &desc, sizeof(desc)); 284 285 low_desc->entry_number = set_thread_area_entry_number; 286 287 /* 32-bit set_thread_area */ 288 long ret; 289 asm volatile ("int $0x80" 290 : "=a" (ret) : "a" (243), "b" (low_desc) 291 : "r8", "r9", "r10", "r11"); 292 memcpy(&desc, low_desc, sizeof(desc)); 293 munmap(low_desc, sizeof(desc)); 294 295 if (ret != 0) { 296 printf("[NOTE]\tcould not create a segment -- test won't do anything\n"); 297 return; 298 } 299 printf("\tother thread: using GDT slot %d\n", desc.entry_number); 300 set_thread_area_entry_number = desc.entry_number; 301 302 asm volatile ("mov %0, %%gs" : : "rm" ((unsigned short)((desc.entry_number << 3) | 0x3))); 303 } 304 305 /* 306 * Step 3: set the selector back to zero. On AMD chips, this will 307 * preserve GSBASE. 308 */ 309 310 asm volatile ("mov %0, %%gs" : : "rm" ((unsigned short)0)); 311 } 312 313 void test_wrbase(unsigned short index, unsigned long base) 314 { 315 unsigned short newindex; 316 unsigned long newbase; 317 318 printf("[RUN]\tGS = 0x%hx, GSBASE = 0x%lx\n", index, base); 319 320 asm volatile ("mov %0, %%gs" : : "rm" (index)); 321 wrgsbase(base); 322 323 remote_base = 0; 324 ftx = 1; 325 syscall(SYS_futex, &ftx, FUTEX_WAKE, 0, NULL, NULL, 0); 326 while (ftx != 0) 327 syscall(SYS_futex, &ftx, FUTEX_WAIT, 1, NULL, NULL, 0); 328 329 asm volatile ("mov %%gs, %0" : "=rm" (newindex)); 330 newbase = rdgsbase(); 331 332 if (newindex == index && newbase == base) { 333 printf("[OK]\tIndex and base were preserved\n"); 334 } else { 335 printf("[FAIL]\tAfter switch, GS = 0x%hx and GSBASE = 0x%lx\n", 336 newindex, newbase); 337 nerrs++; 338 } 339 } 340 341 static void *threadproc(void *ctx) 342 { 343 while (1) { 344 while (ftx == 0) 345 syscall(SYS_futex, &ftx, FUTEX_WAIT, 0, NULL, NULL, 0); 346 if (ftx == 3) 347 return NULL; 348 349 if (ftx == 1) 350 do_remote_base(); 351 else if (ftx == 2) 352 do_unexpected_base(); 353 else 354 errx(1, "helper thread got bad command"); 355 356 ftx = 0; 357 syscall(SYS_futex, &ftx, FUTEX_WAKE, 0, NULL, NULL, 0); 358 } 359 } 360 361 static void set_gs_and_switch_to(unsigned long local, 362 unsigned short force_sel, 363 unsigned long remote) 364 { 365 unsigned long base; 366 unsigned short sel_pre_sched, sel_post_sched; 367 368 bool hard_zero = false; 369 if (local == HARD_ZERO) { 370 hard_zero = true; 371 local = 0; 372 } 373 374 printf("[RUN]\tARCH_SET_GS(0x%lx)%s, then schedule to 0x%lx\n", 375 local, hard_zero ? " and clear gs" : "", remote); 376 if (force_sel) 377 printf("\tBefore schedule, set selector to 0x%hx\n", force_sel); 378 if (syscall(SYS_arch_prctl, ARCH_SET_GS, local) != 0) 379 err(1, "ARCH_SET_GS"); 380 if (hard_zero) 381 asm volatile ("mov %0, %%gs" : : "rm" ((unsigned short)0)); 382 383 if (read_base(GS) != local) { 384 nerrs++; 385 printf("[FAIL]\tGSBASE wasn't set as expected\n"); 386 } 387 388 if (force_sel) { 389 asm volatile ("mov %0, %%gs" : : "rm" (force_sel)); 390 sel_pre_sched = force_sel; 391 local = read_base(GS); 392 393 /* 394 * Signal delivery seems to mess up weird selectors. Put it 395 * back. 396 */ 397 asm volatile ("mov %0, %%gs" : : "rm" (force_sel)); 398 } else { 399 asm volatile ("mov %%gs, %0" : "=rm" (sel_pre_sched)); 400 } 401 402 remote_base = remote; 403 ftx = 1; 404 syscall(SYS_futex, &ftx, FUTEX_WAKE, 0, NULL, NULL, 0); 405 while (ftx != 0) 406 syscall(SYS_futex, &ftx, FUTEX_WAIT, 1, NULL, NULL, 0); 407 408 asm volatile ("mov %%gs, %0" : "=rm" (sel_post_sched)); 409 base = read_base(GS); 410 if (base == local && sel_pre_sched == sel_post_sched) { 411 printf("[OK]\tGS/BASE remained 0x%hx/0x%lx\n", 412 sel_pre_sched, local); 413 } else { 414 nerrs++; 415 printf("[FAIL]\tGS/BASE changed from 0x%hx/0x%lx to 0x%hx/0x%lx\n", 416 sel_pre_sched, local, sel_post_sched, base); 417 } 418 } 419 420 static void test_unexpected_base(void) 421 { 422 unsigned long base; 423 424 printf("[RUN]\tARCH_SET_GS(0), clear gs, then manipulate GSBASE in a different thread\n"); 425 if (syscall(SYS_arch_prctl, ARCH_SET_GS, 0) != 0) 426 err(1, "ARCH_SET_GS"); 427 asm volatile ("mov %0, %%gs" : : "rm" ((unsigned short)0)); 428 429 ftx = 2; 430 syscall(SYS_futex, &ftx, FUTEX_WAKE, 0, NULL, NULL, 0); 431 while (ftx != 0) 432 syscall(SYS_futex, &ftx, FUTEX_WAIT, 1, NULL, NULL, 0); 433 434 base = read_base(GS); 435 if (base == 0) { 436 printf("[OK]\tGSBASE remained 0\n"); 437 } else { 438 nerrs++; 439 printf("[FAIL]\tGSBASE changed to 0x%lx\n", base); 440 } 441 } 442 443 #define USER_REGS_OFFSET(r) offsetof(struct user_regs_struct, r) 444 445 static void test_ptrace_write_gsbase(void) 446 { 447 int status; 448 pid_t child = fork(); 449 450 if (child < 0) 451 err(1, "fork"); 452 453 if (child == 0) { 454 printf("[RUN]\tPTRACE_POKE(), write GSBASE from ptracer\n"); 455 456 /* 457 * Use the LDT setup and fetch the GSBASE from the LDT 458 * by switching to the (nonzero) selector (again) 459 */ 460 do_unexpected_base(); 461 asm volatile ("mov %0, %%gs" : : "rm" ((unsigned short)0x7)); 462 463 if (ptrace(PTRACE_TRACEME, 0, NULL, NULL) != 0) 464 err(1, "PTRACE_TRACEME"); 465 466 raise(SIGTRAP); 467 _exit(0); 468 } 469 470 wait(&status); 471 472 if (WSTOPSIG(status) == SIGTRAP) { 473 unsigned long gs, base; 474 unsigned long gs_offset = USER_REGS_OFFSET(gs); 475 unsigned long base_offset = USER_REGS_OFFSET(gs_base); 476 477 gs = ptrace(PTRACE_PEEKUSER, child, gs_offset, NULL); 478 479 if (gs != 0x7) { 480 nerrs++; 481 printf("[FAIL]\tGS is not prepared with nonzero\n"); 482 goto END; 483 } 484 485 if (ptrace(PTRACE_POKEUSER, child, base_offset, 0xFF) != 0) 486 err(1, "PTRACE_POKEUSER"); 487 488 gs = ptrace(PTRACE_PEEKUSER, child, gs_offset, NULL); 489 base = ptrace(PTRACE_PEEKUSER, child, base_offset, NULL); 490 491 /* 492 * In a non-FSGSBASE system, the nonzero selector will load 493 * GSBASE (again). But what is tested here is whether the 494 * selector value is changed or not by the GSBASE write in 495 * a ptracer. 496 */ 497 if (gs != 0x7) { 498 nerrs++; 499 printf("[FAIL]\tGS changed to %lx\n", gs); 500 } else if (have_fsgsbase && (base != 0xFF)) { 501 nerrs++; 502 printf("[FAIL]\tGSBASE changed to %lx\n", base); 503 } else { 504 printf("[OK]\tGS remained 0x7 %s"); 505 if (have_fsgsbase) 506 printf("and GSBASE changed to 0xFF"); 507 printf("\n"); 508 } 509 } 510 511 END: 512 ptrace(PTRACE_CONT, child, NULL, NULL); 513 } 514 515 int main() 516 { 517 pthread_t thread; 518 519 /* Probe FSGSBASE */ 520 sethandler(SIGILL, sigill, 0); 521 if (sigsetjmp(jmpbuf, 1) == 0) { 522 rdfsbase(); 523 have_fsgsbase = true; 524 printf("\tFSGSBASE instructions are enabled\n"); 525 } else { 526 printf("\tFSGSBASE instructions are disabled\n"); 527 } 528 clearhandler(SIGILL); 529 530 sethandler(SIGSEGV, sigsegv, 0); 531 532 check_gs_value(0); 533 check_gs_value(1); 534 check_gs_value(0x200000000); 535 check_gs_value(0); 536 check_gs_value(0x200000000); 537 check_gs_value(1); 538 539 for (int sched = 0; sched < 2; sched++) { 540 mov_0_gs(0, !!sched); 541 mov_0_gs(1, !!sched); 542 mov_0_gs(0x200000000, !!sched); 543 } 544 545 /* Set up for multithreading. */ 546 547 cpu_set_t cpuset; 548 CPU_ZERO(&cpuset); 549 CPU_SET(0, &cpuset); 550 if (sched_setaffinity(0, sizeof(cpuset), &cpuset) != 0) 551 err(1, "sched_setaffinity to CPU 0"); /* should never fail */ 552 553 if (pthread_create(&thread, 0, threadproc, 0) != 0) 554 err(1, "pthread_create"); 555 556 static unsigned long bases_with_hard_zero[] = { 557 0, HARD_ZERO, 1, 0x200000000, 558 }; 559 560 for (int local = 0; local < 4; local++) { 561 for (int remote = 0; remote < 4; remote++) { 562 for (unsigned short s = 0; s < 5; s++) { 563 unsigned short sel = s; 564 if (s == 4) 565 asm ("mov %%ss, %0" : "=rm" (sel)); 566 set_gs_and_switch_to( 567 bases_with_hard_zero[local], 568 sel, 569 bases_with_hard_zero[remote]); 570 } 571 } 572 } 573 574 test_unexpected_base(); 575 576 if (have_fsgsbase) { 577 unsigned short ss; 578 579 asm volatile ("mov %%ss, %0" : "=rm" (ss)); 580 581 test_wrbase(0, 0); 582 test_wrbase(0, 1); 583 test_wrbase(0, 0x200000000); 584 test_wrbase(0, 0xffffffffffffffff); 585 test_wrbase(ss, 0); 586 test_wrbase(ss, 1); 587 test_wrbase(ss, 0x200000000); 588 test_wrbase(ss, 0xffffffffffffffff); 589 } 590 591 ftx = 3; /* Kill the thread. */ 592 syscall(SYS_futex, &ftx, FUTEX_WAKE, 0, NULL, NULL, 0); 593 594 if (pthread_join(thread, NULL) != 0) 595 err(1, "pthread_join"); 596 597 test_ptrace_write_gsbase(); 598 599 return nerrs == 0 ? 0 : 1; 600 } 601