1 // SPDX-License-Identifier: GPL-2.0-only 2 /* 3 * fsgsbase_restore.c, test ptrace vs fsgsbase 4 * Copyright (c) 2020 Andy Lutomirski 5 * 6 * This test case simulates a tracer redirecting tracee execution to 7 * a function and then restoring tracee state using PTRACE_GETREGS and 8 * PTRACE_SETREGS. This is similar to what gdb does when doing 9 * 'p func()'. The catch is that this test has the called function 10 * modify a segment register. This makes sure that ptrace correctly 11 * restores segment state when using PTRACE_SETREGS. 12 * 13 * This is not part of fsgsbase.c, because that test is 64-bit only. 14 */ 15 16 #define _GNU_SOURCE 17 #include <stdio.h> 18 #include <stdlib.h> 19 #include <stdbool.h> 20 #include <string.h> 21 #include <sys/syscall.h> 22 #include <unistd.h> 23 #include <err.h> 24 #include <sys/user.h> 25 #include <asm/prctl.h> 26 #include <sys/prctl.h> 27 #include <asm/ldt.h> 28 #include <sys/mman.h> 29 #include <stddef.h> 30 #include <sys/ptrace.h> 31 #include <sys/wait.h> 32 #include <stdint.h> 33 34 #define EXPECTED_VALUE 0x1337f00d 35 36 #ifdef __x86_64__ 37 # define SEG "%gs" 38 #else 39 # define SEG "%fs" 40 #endif 41 42 static unsigned int dereference_seg_base(void) 43 { 44 int ret; 45 asm volatile ("mov %" SEG ":(0), %0" : "=rm" (ret)); 46 return ret; 47 } 48 49 static void init_seg(void) 50 { 51 unsigned int *target = mmap( 52 NULL, sizeof(unsigned int), 53 PROT_READ | PROT_WRITE, 54 MAP_PRIVATE | MAP_ANONYMOUS | MAP_32BIT, -1, 0); 55 if (target == MAP_FAILED) 56 err(1, "mmap"); 57 58 *target = EXPECTED_VALUE; 59 60 printf("\tsegment base address = 0x%lx\n", (unsigned long)target); 61 62 struct user_desc desc = { 63 .entry_number = 0, 64 .base_addr = (unsigned int)(uintptr_t)target, 65 .limit = sizeof(unsigned int) - 1, 66 .seg_32bit = 1, 67 .contents = 0, /* Data, grow-up */ 68 .read_exec_only = 0, 69 .limit_in_pages = 0, 70 .seg_not_present = 0, 71 .useable = 0 72 }; 73 if (syscall(SYS_modify_ldt, 1, &desc, sizeof(desc)) == 0) { 74 printf("\tusing LDT slot 0\n"); 75 asm volatile ("mov %0, %" SEG :: "rm" ((unsigned short)0x7)); 76 } else { 77 /* No modify_ldt for us (configured out, perhaps) */ 78 79 struct user_desc *low_desc = mmap( 80 NULL, sizeof(desc), 81 PROT_READ | PROT_WRITE, 82 MAP_PRIVATE | MAP_ANONYMOUS | MAP_32BIT, -1, 0); 83 memcpy(low_desc, &desc, sizeof(desc)); 84 85 low_desc->entry_number = -1; 86 87 /* 32-bit set_thread_area */ 88 long ret; 89 asm volatile ("int $0x80" 90 : "=a" (ret), "+m" (*low_desc) 91 : "a" (243), "b" (low_desc) 92 #ifdef __x86_64__ 93 : "r8", "r9", "r10", "r11" 94 #endif 95 ); 96 memcpy(&desc, low_desc, sizeof(desc)); 97 munmap(low_desc, sizeof(desc)); 98 99 if (ret != 0) { 100 printf("[NOTE]\tcould not create a segment -- can't test anything\n"); 101 exit(0); 102 } 103 printf("\tusing GDT slot %d\n", desc.entry_number); 104 105 unsigned short sel = (unsigned short)((desc.entry_number << 3) | 0x3); 106 asm volatile ("mov %0, %" SEG :: "rm" (sel)); 107 } 108 } 109 110 static void tracee_zap_segment(void) 111 { 112 /* 113 * The tracer will redirect execution here. This is meant to 114 * work like gdb's 'p func()' feature. The tricky bit is that 115 * we modify a segment register in order to make sure that ptrace 116 * can correctly restore segment registers. 117 */ 118 printf("\tTracee: in tracee_zap_segment()\n"); 119 120 /* 121 * Write a nonzero selector with base zero to the segment register. 122 * Using a null selector would defeat the test on AMD pre-Zen2 123 * CPUs, as such CPUs don't clear the base when loading a null 124 * selector. 125 */ 126 unsigned short sel; 127 asm volatile ("mov %%ss, %0\n\t" 128 "mov %0, %" SEG 129 : "=rm" (sel)); 130 131 pid_t pid = getpid(), tid = syscall(SYS_gettid); 132 133 printf("\tTracee is going back to sleep\n"); 134 syscall(SYS_tgkill, pid, tid, SIGSTOP); 135 136 /* Should not get here. */ 137 while (true) { 138 printf("[FAIL]\tTracee hit unreachable code\n"); 139 pause(); 140 } 141 } 142 143 int main() 144 { 145 printf("\tSetting up a segment\n"); 146 init_seg(); 147 148 unsigned int val = dereference_seg_base(); 149 if (val != EXPECTED_VALUE) { 150 printf("[FAIL]\tseg[0] == %x; should be %x\n", val, EXPECTED_VALUE); 151 return 1; 152 } 153 printf("[OK]\tThe segment points to the right place.\n"); 154 155 pid_t chld = fork(); 156 if (chld < 0) 157 err(1, "fork"); 158 159 if (chld == 0) { 160 prctl(PR_SET_PDEATHSIG, SIGKILL, 0, 0, 0, 0); 161 162 if (ptrace(PTRACE_TRACEME, 0, 0, 0) != 0) 163 err(1, "PTRACE_TRACEME"); 164 165 pid_t pid = getpid(), tid = syscall(SYS_gettid); 166 167 printf("\tTracee will take a nap until signaled\n"); 168 syscall(SYS_tgkill, pid, tid, SIGSTOP); 169 170 printf("\tTracee was resumed. Will re-check segment.\n"); 171 172 val = dereference_seg_base(); 173 if (val != EXPECTED_VALUE) { 174 printf("[FAIL]\tseg[0] == %x; should be %x\n", val, EXPECTED_VALUE); 175 exit(1); 176 } 177 178 printf("[OK]\tThe segment points to the right place.\n"); 179 exit(0); 180 } 181 182 int status; 183 184 /* Wait for SIGSTOP. */ 185 if (waitpid(chld, &status, 0) != chld || !WIFSTOPPED(status)) 186 err(1, "waitpid"); 187 188 struct user_regs_struct regs; 189 190 if (ptrace(PTRACE_GETREGS, chld, NULL, ®s) != 0) 191 err(1, "PTRACE_GETREGS"); 192 193 #ifdef __x86_64__ 194 printf("\tChild GS=0x%lx, GSBASE=0x%lx\n", (unsigned long)regs.gs, (unsigned long)regs.gs_base); 195 #else 196 printf("\tChild FS=0x%lx\n", (unsigned long)regs.xfs); 197 #endif 198 199 struct user_regs_struct regs2 = regs; 200 #ifdef __x86_64__ 201 regs2.rip = (unsigned long)tracee_zap_segment; 202 regs2.rsp -= 128; /* Don't clobber the redzone. */ 203 #else 204 regs2.eip = (unsigned long)tracee_zap_segment; 205 #endif 206 207 printf("\tTracer: redirecting tracee to tracee_zap_segment()\n"); 208 if (ptrace(PTRACE_SETREGS, chld, NULL, ®s2) != 0) 209 err(1, "PTRACE_GETREGS"); 210 if (ptrace(PTRACE_CONT, chld, NULL, NULL) != 0) 211 err(1, "PTRACE_GETREGS"); 212 213 /* Wait for SIGSTOP. */ 214 if (waitpid(chld, &status, 0) != chld || !WIFSTOPPED(status)) 215 err(1, "waitpid"); 216 217 printf("\tTracer: restoring tracee state\n"); 218 if (ptrace(PTRACE_SETREGS, chld, NULL, ®s) != 0) 219 err(1, "PTRACE_GETREGS"); 220 if (ptrace(PTRACE_DETACH, chld, NULL, NULL) != 0) 221 err(1, "PTRACE_GETREGS"); 222 223 /* Wait for SIGSTOP. */ 224 if (waitpid(chld, &status, 0) != chld) 225 err(1, "waitpid"); 226 227 if (WIFSIGNALED(status)) { 228 printf("[FAIL]\tTracee crashed\n"); 229 return 1; 230 } 231 232 if (!WIFEXITED(status)) { 233 printf("[FAIL]\tTracee stopped for an unexpected reason: %d\n", status); 234 return 1; 235 } 236 237 int exitcode = WEXITSTATUS(status); 238 if (exitcode != 0) { 239 printf("[FAIL]\tTracee reported failure\n"); 240 return 1; 241 } 242 243 printf("[OK]\tAll is well.\n"); 244 return 0; 245 } 246