1 /* 2 * fsgsbase.c, an fsgsbase test 3 * Copyright (c) 2014-2016 Andy Lutomirski 4 * GPL v2 5 */ 6 7 #define _GNU_SOURCE 8 #include <stdio.h> 9 #include <stdlib.h> 10 #include <stdbool.h> 11 #include <string.h> 12 #include <sys/syscall.h> 13 #include <unistd.h> 14 #include <err.h> 15 #include <sys/user.h> 16 #include <asm/prctl.h> 17 #include <sys/prctl.h> 18 #include <signal.h> 19 #include <limits.h> 20 #include <sys/ucontext.h> 21 #include <sched.h> 22 #include <linux/futex.h> 23 #include <pthread.h> 24 #include <asm/ldt.h> 25 #include <sys/mman.h> 26 27 #ifndef __x86_64__ 28 # error This test is 64-bit only 29 #endif 30 31 static volatile sig_atomic_t want_segv; 32 static volatile unsigned long segv_addr; 33 34 static int nerrs; 35 36 static void sethandler(int sig, void (*handler)(int, siginfo_t *, void *), 37 int flags) 38 { 39 struct sigaction sa; 40 memset(&sa, 0, sizeof(sa)); 41 sa.sa_sigaction = handler; 42 sa.sa_flags = SA_SIGINFO | flags; 43 sigemptyset(&sa.sa_mask); 44 if (sigaction(sig, &sa, 0)) 45 err(1, "sigaction"); 46 } 47 48 static void clearhandler(int sig) 49 { 50 struct sigaction sa; 51 memset(&sa, 0, sizeof(sa)); 52 sa.sa_handler = SIG_DFL; 53 sigemptyset(&sa.sa_mask); 54 if (sigaction(sig, &sa, 0)) 55 err(1, "sigaction"); 56 } 57 58 static void sigsegv(int sig, siginfo_t *si, void *ctx_void) 59 { 60 ucontext_t *ctx = (ucontext_t*)ctx_void; 61 62 if (!want_segv) { 63 clearhandler(SIGSEGV); 64 return; /* Crash cleanly. */ 65 } 66 67 want_segv = false; 68 segv_addr = (unsigned long)si->si_addr; 69 70 ctx->uc_mcontext.gregs[REG_RIP] += 4; /* Skip the faulting mov */ 71 72 } 73 74 enum which_base { FS, GS }; 75 76 static unsigned long read_base(enum which_base which) 77 { 78 unsigned long offset; 79 /* 80 * Unless we have FSGSBASE, there's no direct way to do this from 81 * user mode. We can get at it indirectly using signals, though. 82 */ 83 84 want_segv = true; 85 86 offset = 0; 87 if (which == FS) { 88 /* Use a constant-length instruction here. */ 89 asm volatile ("mov %%fs:(%%rcx), %%rax" : : "c" (offset) : "rax"); 90 } else { 91 asm volatile ("mov %%gs:(%%rcx), %%rax" : : "c" (offset) : "rax"); 92 } 93 if (!want_segv) 94 return segv_addr + offset; 95 96 /* 97 * If that didn't segfault, try the other end of the address space. 98 * Unless we get really unlucky and run into the vsyscall page, this 99 * is guaranteed to segfault. 100 */ 101 102 offset = (ULONG_MAX >> 1) + 1; 103 if (which == FS) { 104 asm volatile ("mov %%fs:(%%rcx), %%rax" 105 : : "c" (offset) : "rax"); 106 } else { 107 asm volatile ("mov %%gs:(%%rcx), %%rax" 108 : : "c" (offset) : "rax"); 109 } 110 if (!want_segv) 111 return segv_addr + offset; 112 113 abort(); 114 } 115 116 static void check_gs_value(unsigned long value) 117 { 118 unsigned long base; 119 unsigned short sel; 120 121 printf("[RUN]\tARCH_SET_GS to 0x%lx\n", value); 122 if (syscall(SYS_arch_prctl, ARCH_SET_GS, value) != 0) 123 err(1, "ARCH_SET_GS"); 124 125 asm volatile ("mov %%gs, %0" : "=rm" (sel)); 126 base = read_base(GS); 127 if (base == value) { 128 printf("[OK]\tGSBASE was set as expected (selector 0x%hx)\n", 129 sel); 130 } else { 131 nerrs++; 132 printf("[FAIL]\tGSBASE was not as expected: got 0x%lx (selector 0x%hx)\n", 133 base, sel); 134 } 135 136 if (syscall(SYS_arch_prctl, ARCH_GET_GS, &base) != 0) 137 err(1, "ARCH_GET_GS"); 138 if (base == value) { 139 printf("[OK]\tARCH_GET_GS worked as expected (selector 0x%hx)\n", 140 sel); 141 } else { 142 nerrs++; 143 printf("[FAIL]\tARCH_GET_GS was not as expected: got 0x%lx (selector 0x%hx)\n", 144 base, sel); 145 } 146 } 147 148 static void mov_0_gs(unsigned long initial_base, bool schedule) 149 { 150 unsigned long base, arch_base; 151 152 printf("[RUN]\tARCH_SET_GS to 0x%lx then mov 0 to %%gs%s\n", initial_base, schedule ? " and schedule " : ""); 153 if (syscall(SYS_arch_prctl, ARCH_SET_GS, initial_base) != 0) 154 err(1, "ARCH_SET_GS"); 155 156 if (schedule) 157 usleep(10); 158 159 asm volatile ("mov %0, %%gs" : : "rm" (0)); 160 base = read_base(GS); 161 if (syscall(SYS_arch_prctl, ARCH_GET_GS, &arch_base) != 0) 162 err(1, "ARCH_GET_GS"); 163 if (base == arch_base) { 164 printf("[OK]\tGSBASE is 0x%lx\n", base); 165 } else { 166 nerrs++; 167 printf("[FAIL]\tGSBASE changed to 0x%lx but kernel reports 0x%lx\n", base, arch_base); 168 } 169 } 170 171 static volatile unsigned long remote_base; 172 static volatile bool remote_hard_zero; 173 static volatile unsigned int ftx; 174 175 /* 176 * ARCH_SET_FS/GS(0) may or may not program a selector of zero. HARD_ZERO 177 * means to force the selector to zero to improve test coverage. 178 */ 179 #define HARD_ZERO 0xa1fa5f343cb85fa4 180 181 static void do_remote_base() 182 { 183 unsigned long to_set = remote_base; 184 bool hard_zero = false; 185 if (to_set == HARD_ZERO) { 186 to_set = 0; 187 hard_zero = true; 188 } 189 190 if (syscall(SYS_arch_prctl, ARCH_SET_GS, to_set) != 0) 191 err(1, "ARCH_SET_GS"); 192 193 if (hard_zero) 194 asm volatile ("mov %0, %%gs" : : "rm" ((unsigned short)0)); 195 196 unsigned short sel; 197 asm volatile ("mov %%gs, %0" : "=rm" (sel)); 198 printf("\tother thread: ARCH_SET_GS(0x%lx)%s -- sel is 0x%hx\n", 199 to_set, hard_zero ? " and clear gs" : "", sel); 200 } 201 202 void do_unexpected_base(void) 203 { 204 /* 205 * The goal here is to try to arrange for GS == 0, GSBASE != 206 * 0, and for the the kernel the think that GSBASE == 0. 207 * 208 * To make the test as reliable as possible, this uses 209 * explicit descriptorss. (This is not the only way. This 210 * could use ARCH_SET_GS with a low, nonzero base, but the 211 * relevant side effect of ARCH_SET_GS could change.) 212 */ 213 214 /* Step 1: tell the kernel that we have GSBASE == 0. */ 215 if (syscall(SYS_arch_prctl, ARCH_SET_GS, 0) != 0) 216 err(1, "ARCH_SET_GS"); 217 218 /* Step 2: change GSBASE without telling the kernel. */ 219 struct user_desc desc = { 220 .entry_number = 0, 221 .base_addr = 0xBAADF00D, 222 .limit = 0xfffff, 223 .seg_32bit = 1, 224 .contents = 0, /* Data, grow-up */ 225 .read_exec_only = 0, 226 .limit_in_pages = 1, 227 .seg_not_present = 0, 228 .useable = 0 229 }; 230 if (syscall(SYS_modify_ldt, 1, &desc, sizeof(desc)) == 0) { 231 printf("\tother thread: using LDT slot 0\n"); 232 asm volatile ("mov %0, %%gs" : : "rm" ((unsigned short)0x7)); 233 } else { 234 /* No modify_ldt for us (configured out, perhaps) */ 235 236 struct user_desc *low_desc = mmap( 237 NULL, sizeof(desc), 238 PROT_READ | PROT_WRITE, 239 MAP_PRIVATE | MAP_ANONYMOUS | MAP_32BIT, -1, 0); 240 memcpy(low_desc, &desc, sizeof(desc)); 241 242 low_desc->entry_number = -1; 243 244 /* 32-bit set_thread_area */ 245 long ret; 246 asm volatile ("int $0x80" 247 : "=a" (ret) : "a" (243), "b" (low_desc) 248 : "r8", "r9", "r10", "r11"); 249 memcpy(&desc, low_desc, sizeof(desc)); 250 munmap(low_desc, sizeof(desc)); 251 252 if (ret != 0) { 253 printf("[NOTE]\tcould not create a segment -- test won't do anything\n"); 254 return; 255 } 256 printf("\tother thread: using GDT slot %d\n", desc.entry_number); 257 asm volatile ("mov %0, %%gs" : : "rm" ((unsigned short)((desc.entry_number << 3) | 0x3))); 258 } 259 260 /* 261 * Step 3: set the selector back to zero. On AMD chips, this will 262 * preserve GSBASE. 263 */ 264 265 asm volatile ("mov %0, %%gs" : : "rm" ((unsigned short)0)); 266 } 267 268 static void *threadproc(void *ctx) 269 { 270 while (1) { 271 while (ftx == 0) 272 syscall(SYS_futex, &ftx, FUTEX_WAIT, 0, NULL, NULL, 0); 273 if (ftx == 3) 274 return NULL; 275 276 if (ftx == 1) 277 do_remote_base(); 278 else if (ftx == 2) 279 do_unexpected_base(); 280 else 281 errx(1, "helper thread got bad command"); 282 283 ftx = 0; 284 syscall(SYS_futex, &ftx, FUTEX_WAKE, 0, NULL, NULL, 0); 285 } 286 } 287 288 static void set_gs_and_switch_to(unsigned long local, 289 unsigned short force_sel, 290 unsigned long remote) 291 { 292 unsigned long base; 293 unsigned short sel_pre_sched, sel_post_sched; 294 295 bool hard_zero = false; 296 if (local == HARD_ZERO) { 297 hard_zero = true; 298 local = 0; 299 } 300 301 printf("[RUN]\tARCH_SET_GS(0x%lx)%s, then schedule to 0x%lx\n", 302 local, hard_zero ? " and clear gs" : "", remote); 303 if (force_sel) 304 printf("\tBefore schedule, set selector to 0x%hx\n", force_sel); 305 if (syscall(SYS_arch_prctl, ARCH_SET_GS, local) != 0) 306 err(1, "ARCH_SET_GS"); 307 if (hard_zero) 308 asm volatile ("mov %0, %%gs" : : "rm" ((unsigned short)0)); 309 310 if (read_base(GS) != local) { 311 nerrs++; 312 printf("[FAIL]\tGSBASE wasn't set as expected\n"); 313 } 314 315 if (force_sel) { 316 asm volatile ("mov %0, %%gs" : : "rm" (force_sel)); 317 sel_pre_sched = force_sel; 318 local = read_base(GS); 319 320 /* 321 * Signal delivery seems to mess up weird selectors. Put it 322 * back. 323 */ 324 asm volatile ("mov %0, %%gs" : : "rm" (force_sel)); 325 } else { 326 asm volatile ("mov %%gs, %0" : "=rm" (sel_pre_sched)); 327 } 328 329 remote_base = remote; 330 ftx = 1; 331 syscall(SYS_futex, &ftx, FUTEX_WAKE, 0, NULL, NULL, 0); 332 while (ftx != 0) 333 syscall(SYS_futex, &ftx, FUTEX_WAIT, 1, NULL, NULL, 0); 334 335 asm volatile ("mov %%gs, %0" : "=rm" (sel_post_sched)); 336 base = read_base(GS); 337 if (base == local && sel_pre_sched == sel_post_sched) { 338 printf("[OK]\tGS/BASE remained 0x%hx/0x%lx\n", 339 sel_pre_sched, local); 340 } else { 341 nerrs++; 342 printf("[FAIL]\tGS/BASE changed from 0x%hx/0x%lx to 0x%hx/0x%lx\n", 343 sel_pre_sched, local, sel_post_sched, base); 344 } 345 } 346 347 static void test_unexpected_base(void) 348 { 349 unsigned long base; 350 351 printf("[RUN]\tARCH_SET_GS(0), clear gs, then manipulate GSBASE in a different thread\n"); 352 if (syscall(SYS_arch_prctl, ARCH_SET_GS, 0) != 0) 353 err(1, "ARCH_SET_GS"); 354 asm volatile ("mov %0, %%gs" : : "rm" ((unsigned short)0)); 355 356 ftx = 2; 357 syscall(SYS_futex, &ftx, FUTEX_WAKE, 0, NULL, NULL, 0); 358 while (ftx != 0) 359 syscall(SYS_futex, &ftx, FUTEX_WAIT, 1, NULL, NULL, 0); 360 361 base = read_base(GS); 362 if (base == 0) { 363 printf("[OK]\tGSBASE remained 0\n"); 364 } else { 365 nerrs++; 366 printf("[FAIL]\tGSBASE changed to 0x%lx\n", base); 367 } 368 } 369 370 int main() 371 { 372 pthread_t thread; 373 374 sethandler(SIGSEGV, sigsegv, 0); 375 376 check_gs_value(0); 377 check_gs_value(1); 378 check_gs_value(0x200000000); 379 check_gs_value(0); 380 check_gs_value(0x200000000); 381 check_gs_value(1); 382 383 for (int sched = 0; sched < 2; sched++) { 384 mov_0_gs(0, !!sched); 385 mov_0_gs(1, !!sched); 386 mov_0_gs(0x200000000, !!sched); 387 } 388 389 /* Set up for multithreading. */ 390 391 cpu_set_t cpuset; 392 CPU_ZERO(&cpuset); 393 CPU_SET(0, &cpuset); 394 if (sched_setaffinity(0, sizeof(cpuset), &cpuset) != 0) 395 err(1, "sched_setaffinity to CPU 0"); /* should never fail */ 396 397 if (pthread_create(&thread, 0, threadproc, 0) != 0) 398 err(1, "pthread_create"); 399 400 static unsigned long bases_with_hard_zero[] = { 401 0, HARD_ZERO, 1, 0x200000000, 402 }; 403 404 for (int local = 0; local < 4; local++) { 405 for (int remote = 0; remote < 4; remote++) { 406 for (unsigned short s = 0; s < 5; s++) { 407 unsigned short sel = s; 408 if (s == 4) 409 asm ("mov %%ss, %0" : "=rm" (sel)); 410 set_gs_and_switch_to( 411 bases_with_hard_zero[local], 412 sel, 413 bases_with_hard_zero[remote]); 414 } 415 } 416 } 417 418 test_unexpected_base(); 419 420 ftx = 3; /* Kill the thread. */ 421 syscall(SYS_futex, &ftx, FUTEX_WAKE, 0, NULL, NULL, 0); 422 423 if (pthread_join(thread, NULL) != 0) 424 err(1, "pthread_join"); 425 426 return nerrs == 0 ? 0 : 1; 427 } 428
