1 // SPDX-License-Identifier: GPL-2.0 2 /* 3 * ldt_gdt.c - Test cases for LDT and GDT access 4 * Copyright (c) 2015 Andrew Lutomirski 5 */ 6 7 #define _GNU_SOURCE 8 #include <err.h> 9 #include <stdio.h> 10 #include <stdint.h> 11 #include <signal.h> 12 #include <setjmp.h> 13 #include <stdlib.h> 14 #include <string.h> 15 #include <errno.h> 16 #include <unistd.h> 17 #include <sys/syscall.h> 18 #include <asm/ldt.h> 19 #include <sys/types.h> 20 #include <sys/wait.h> 21 #include <stdbool.h> 22 #include <pthread.h> 23 #include <sched.h> 24 #include <linux/futex.h> 25 #include <sys/mman.h> 26 #include <asm/prctl.h> 27 #include <sys/prctl.h> 28 29 #define AR_ACCESSED (1<<8) 30 31 #define AR_TYPE_RODATA (0 * (1<<9)) 32 #define AR_TYPE_RWDATA (1 * (1<<9)) 33 #define AR_TYPE_RODATA_EXPDOWN (2 * (1<<9)) 34 #define AR_TYPE_RWDATA_EXPDOWN (3 * (1<<9)) 35 #define AR_TYPE_XOCODE (4 * (1<<9)) 36 #define AR_TYPE_XRCODE (5 * (1<<9)) 37 #define AR_TYPE_XOCODE_CONF (6 * (1<<9)) 38 #define AR_TYPE_XRCODE_CONF (7 * (1<<9)) 39 40 #define AR_DPL3 (3 * (1<<13)) 41 42 #define AR_S (1 << 12) 43 #define AR_P (1 << 15) 44 #define AR_AVL (1 << 20) 45 #define AR_L (1 << 21) 46 #define AR_DB (1 << 22) 47 #define AR_G (1 << 23) 48 49 #ifdef __x86_64__ 50 # define INT80_CLOBBERS "r8", "r9", "r10", "r11" 51 #else 52 # define INT80_CLOBBERS 53 #endif 54 55 static int nerrs; 56 57 /* Points to an array of 1024 ints, each holding its own index. */ 58 static const unsigned int *counter_page; 59 static struct user_desc *low_user_desc; 60 static struct user_desc *low_user_desc_clear; /* Use to delete GDT entry */ 61 static int gdt_entry_num; 62 63 static void check_invalid_segment(uint16_t index, int ldt) 64 { 65 uint32_t has_limit = 0, has_ar = 0, limit, ar; 66 uint32_t selector = (index << 3) | (ldt << 2) | 3; 67 68 asm ("lsl %[selector], %[limit]\n\t" 69 "jnz 1f\n\t" 70 "movl $1, %[has_limit]\n\t" 71 "1:" 72 : [limit] "=r" (limit), [has_limit] "+rm" (has_limit) 73 : [selector] "r" (selector)); 74 asm ("larl %[selector], %[ar]\n\t" 75 "jnz 1f\n\t" 76 "movl $1, %[has_ar]\n\t" 77 "1:" 78 : [ar] "=r" (ar), [has_ar] "+rm" (has_ar) 79 : [selector] "r" (selector)); 80 81 if (has_limit || has_ar) { 82 printf("[FAIL]\t%s entry %hu is valid but should be invalid\n", 83 (ldt ? "LDT" : "GDT"), index); 84 nerrs++; 85 } else { 86 printf("[OK]\t%s entry %hu is invalid\n", 87 (ldt ? "LDT" : "GDT"), index); 88 } 89 } 90 91 static void check_valid_segment(uint16_t index, int ldt, 92 uint32_t expected_ar, uint32_t expected_limit, 93 bool verbose) 94 { 95 uint32_t has_limit = 0, has_ar = 0, limit, ar; 96 uint32_t selector = (index << 3) | (ldt << 2) | 3; 97 98 asm ("lsl %[selector], %[limit]\n\t" 99 "jnz 1f\n\t" 100 "movl $1, %[has_limit]\n\t" 101 "1:" 102 : [limit] "=r" (limit), [has_limit] "+rm" (has_limit) 103 : [selector] "r" (selector)); 104 asm ("larl %[selector], %[ar]\n\t" 105 "jnz 1f\n\t" 106 "movl $1, %[has_ar]\n\t" 107 "1:" 108 : [ar] "=r" (ar), [has_ar] "+rm" (has_ar) 109 : [selector] "r" (selector)); 110 111 if (!has_limit || !has_ar) { 112 printf("[FAIL]\t%s entry %hu is invalid but should be valid\n", 113 (ldt ? "LDT" : "GDT"), index); 114 nerrs++; 115 return; 116 } 117 118 /* The SDM says "bits 19:16 are undefined". Thanks. */ 119 ar &= ~0xF0000; 120 121 /* 122 * NB: Different Linux versions do different things with the 123 * accessed bit in set_thread_area(). 124 */ 125 if (ar != expected_ar && ar != (expected_ar | AR_ACCESSED)) { 126 printf("[FAIL]\t%s entry %hu has AR 0x%08X but expected 0x%08X\n", 127 (ldt ? "LDT" : "GDT"), index, ar, expected_ar); 128 nerrs++; 129 } else if (limit != expected_limit) { 130 printf("[FAIL]\t%s entry %hu has limit 0x%08X but expected 0x%08X\n", 131 (ldt ? "LDT" : "GDT"), index, limit, expected_limit); 132 nerrs++; 133 } else if (verbose) { 134 printf("[OK]\t%s entry %hu has AR 0x%08X and limit 0x%08X\n", 135 (ldt ? "LDT" : "GDT"), index, ar, limit); 136 } 137 } 138 139 static bool install_valid_mode(const struct user_desc *d, uint32_t ar, 140 bool oldmode, bool ldt) 141 { 142 struct user_desc desc = *d; 143 int ret; 144 145 if (!ldt) { 146 #ifndef __i386__ 147 /* No point testing set_thread_area in a 64-bit build */ 148 return false; 149 #endif 150 if (!gdt_entry_num) 151 return false; 152 desc.entry_number = gdt_entry_num; 153 154 ret = syscall(SYS_set_thread_area, &desc); 155 } else { 156 ret = syscall(SYS_modify_ldt, oldmode ? 1 : 0x11, 157 &desc, sizeof(desc)); 158 159 if (ret < -1) 160 errno = -ret; 161 162 if (ret != 0 && errno == ENOSYS) { 163 printf("[OK]\tmodify_ldt returned -ENOSYS\n"); 164 return false; 165 } 166 } 167 168 if (ret == 0) { 169 uint32_t limit = desc.limit; 170 if (desc.limit_in_pages) 171 limit = (limit << 12) + 4095; 172 check_valid_segment(desc.entry_number, ldt, ar, limit, true); 173 return true; 174 } else { 175 if (desc.seg_32bit) { 176 printf("[FAIL]\tUnexpected %s failure %d\n", 177 ldt ? "modify_ldt" : "set_thread_area", 178 errno); 179 nerrs++; 180 return false; 181 } else { 182 printf("[OK]\t%s rejected 16 bit segment\n", 183 ldt ? "modify_ldt" : "set_thread_area"); 184 return false; 185 } 186 } 187 } 188 189 static bool install_valid(const struct user_desc *desc, uint32_t ar) 190 { 191 bool ret = install_valid_mode(desc, ar, false, true); 192 193 if (desc->contents <= 1 && desc->seg_32bit && 194 !desc->seg_not_present) { 195 /* Should work in the GDT, too. */ 196 install_valid_mode(desc, ar, false, false); 197 } 198 199 return ret; 200 } 201 202 static void install_invalid(const struct user_desc *desc, bool oldmode) 203 { 204 int ret = syscall(SYS_modify_ldt, oldmode ? 1 : 0x11, 205 desc, sizeof(*desc)); 206 if (ret < -1) 207 errno = -ret; 208 if (ret == 0) { 209 check_invalid_segment(desc->entry_number, 1); 210 } else if (errno == ENOSYS) { 211 printf("[OK]\tmodify_ldt returned -ENOSYS\n"); 212 } else { 213 if (desc->seg_32bit) { 214 printf("[FAIL]\tUnexpected modify_ldt failure %d\n", 215 errno); 216 nerrs++; 217 } else { 218 printf("[OK]\tmodify_ldt rejected 16 bit segment\n"); 219 } 220 } 221 } 222 223 static int safe_modify_ldt(int func, struct user_desc *ptr, 224 unsigned long bytecount) 225 { 226 int ret = syscall(SYS_modify_ldt, 0x11, ptr, bytecount); 227 if (ret < -1) 228 errno = -ret; 229 return ret; 230 } 231 232 static void fail_install(struct user_desc *desc) 233 { 234 if (safe_modify_ldt(0x11, desc, sizeof(*desc)) == 0) { 235 printf("[FAIL]\tmodify_ldt accepted a bad descriptor\n"); 236 nerrs++; 237 } else if (errno == ENOSYS) { 238 printf("[OK]\tmodify_ldt returned -ENOSYS\n"); 239 } else { 240 printf("[OK]\tmodify_ldt failure %d\n", errno); 241 } 242 } 243 244 static void do_simple_tests(void) 245 { 246 struct user_desc desc = { 247 .entry_number = 0, 248 .base_addr = 0, 249 .limit = 10, 250 .seg_32bit = 1, 251 .contents = 2, /* Code, not conforming */ 252 .read_exec_only = 0, 253 .limit_in_pages = 0, 254 .seg_not_present = 0, 255 .useable = 0 256 }; 257 install_valid(&desc, AR_DPL3 | AR_TYPE_XRCODE | AR_S | AR_P | AR_DB); 258 259 desc.limit_in_pages = 1; 260 install_valid(&desc, AR_DPL3 | AR_TYPE_XRCODE | 261 AR_S | AR_P | AR_DB | AR_G); 262 263 check_invalid_segment(1, 1); 264 265 desc.entry_number = 2; 266 install_valid(&desc, AR_DPL3 | AR_TYPE_XRCODE | 267 AR_S | AR_P | AR_DB | AR_G); 268 269 check_invalid_segment(1, 1); 270 271 desc.base_addr = 0xf0000000; 272 install_valid(&desc, AR_DPL3 | AR_TYPE_XRCODE | 273 AR_S | AR_P | AR_DB | AR_G); 274 275 desc.useable = 1; 276 install_valid(&desc, AR_DPL3 | AR_TYPE_XRCODE | 277 AR_S | AR_P | AR_DB | AR_G | AR_AVL); 278 279 desc.seg_not_present = 1; 280 install_valid(&desc, AR_DPL3 | AR_TYPE_XRCODE | 281 AR_S | AR_DB | AR_G | AR_AVL); 282 283 desc.seg_32bit = 0; 284 install_valid(&desc, AR_DPL3 | AR_TYPE_XRCODE | 285 AR_S | AR_G | AR_AVL); 286 287 desc.seg_32bit = 1; 288 desc.contents = 0; 289 install_valid(&desc, AR_DPL3 | AR_TYPE_RWDATA | 290 AR_S | AR_DB | AR_G | AR_AVL); 291 292 desc.read_exec_only = 1; 293 install_valid(&desc, AR_DPL3 | AR_TYPE_RODATA | 294 AR_S | AR_DB | AR_G | AR_AVL); 295 296 desc.contents = 1; 297 install_valid(&desc, AR_DPL3 | AR_TYPE_RODATA_EXPDOWN | 298 AR_S | AR_DB | AR_G | AR_AVL); 299 300 desc.read_exec_only = 0; 301 desc.limit_in_pages = 0; 302 install_valid(&desc, AR_DPL3 | AR_TYPE_RWDATA_EXPDOWN | 303 AR_S | AR_DB | AR_AVL); 304 305 desc.contents = 3; 306 install_valid(&desc, AR_DPL3 | AR_TYPE_XRCODE_CONF | 307 AR_S | AR_DB | AR_AVL); 308 309 desc.read_exec_only = 1; 310 install_valid(&desc, AR_DPL3 | AR_TYPE_XOCODE_CONF | 311 AR_S | AR_DB | AR_AVL); 312 313 desc.read_exec_only = 0; 314 desc.contents = 2; 315 install_valid(&desc, AR_DPL3 | AR_TYPE_XRCODE | 316 AR_S | AR_DB | AR_AVL); 317 318 desc.read_exec_only = 1; 319 320 #ifdef __x86_64__ 321 desc.lm = 1; 322 install_valid(&desc, AR_DPL3 | AR_TYPE_XOCODE | 323 AR_S | AR_DB | AR_AVL); 324 desc.lm = 0; 325 #endif 326 327 bool entry1_okay = install_valid(&desc, AR_DPL3 | AR_TYPE_XOCODE | 328 AR_S | AR_DB | AR_AVL); 329 330 if (entry1_okay) { 331 printf("[RUN]\tTest fork\n"); 332 pid_t child = fork(); 333 if (child == 0) { 334 nerrs = 0; 335 check_valid_segment(desc.entry_number, 1, 336 AR_DPL3 | AR_TYPE_XOCODE | 337 AR_S | AR_DB | AR_AVL, desc.limit, 338 true); 339 check_invalid_segment(1, 1); 340 exit(nerrs ? 1 : 0); 341 } else { 342 int status; 343 if (waitpid(child, &status, 0) != child || 344 !WIFEXITED(status)) { 345 printf("[FAIL]\tChild died\n"); 346 nerrs++; 347 } else if (WEXITSTATUS(status) != 0) { 348 printf("[FAIL]\tChild failed\n"); 349 nerrs++; 350 } else { 351 printf("[OK]\tChild succeeded\n"); 352 } 353 } 354 355 printf("[RUN]\tTest size\n"); 356 int i; 357 for (i = 0; i < 8192; i++) { 358 desc.entry_number = i; 359 desc.limit = i; 360 if (safe_modify_ldt(0x11, &desc, sizeof(desc)) != 0) { 361 printf("[FAIL]\tFailed to install entry %d\n", i); 362 nerrs++; 363 break; 364 } 365 } 366 for (int j = 0; j < i; j++) { 367 check_valid_segment(j, 1, AR_DPL3 | AR_TYPE_XOCODE | 368 AR_S | AR_DB | AR_AVL, j, false); 369 } 370 printf("[DONE]\tSize test\n"); 371 } else { 372 printf("[SKIP]\tSkipping fork and size tests because we have no LDT\n"); 373 } 374 375 /* Test entry_number too high. */ 376 desc.entry_number = 8192; 377 fail_install(&desc); 378 379 /* Test deletion and actions mistakeable for deletion. */ 380 memset(&desc, 0, sizeof(desc)); 381 install_valid(&desc, AR_DPL3 | AR_TYPE_RWDATA | AR_S | AR_P); 382 383 desc.seg_not_present = 1; 384 install_valid(&desc, AR_DPL3 | AR_TYPE_RWDATA | AR_S); 385 386 desc.seg_not_present = 0; 387 desc.read_exec_only = 1; 388 install_valid(&desc, AR_DPL3 | AR_TYPE_RODATA | AR_S | AR_P); 389 390 desc.read_exec_only = 0; 391 desc.seg_not_present = 1; 392 install_valid(&desc, AR_DPL3 | AR_TYPE_RWDATA | AR_S); 393 394 desc.read_exec_only = 1; 395 desc.limit = 1; 396 install_valid(&desc, AR_DPL3 | AR_TYPE_RODATA | AR_S); 397 398 desc.limit = 0; 399 desc.base_addr = 1; 400 install_valid(&desc, AR_DPL3 | AR_TYPE_RODATA | AR_S); 401 402 desc.base_addr = 0; 403 install_invalid(&desc, false); 404 405 desc.seg_not_present = 0; 406 desc.seg_32bit = 1; 407 desc.read_exec_only = 0; 408 desc.limit = 0xfffff; 409 410 install_valid(&desc, AR_DPL3 | AR_TYPE_RWDATA | AR_S | AR_P | AR_DB); 411 412 desc.limit_in_pages = 1; 413 414 install_valid(&desc, AR_DPL3 | AR_TYPE_RWDATA | AR_S | AR_P | AR_DB | AR_G); 415 desc.read_exec_only = 1; 416 install_valid(&desc, AR_DPL3 | AR_TYPE_RODATA | AR_S | AR_P | AR_DB | AR_G); 417 desc.contents = 1; 418 desc.read_exec_only = 0; 419 install_valid(&desc, AR_DPL3 | AR_TYPE_RWDATA_EXPDOWN | AR_S | AR_P | AR_DB | AR_G); 420 desc.read_exec_only = 1; 421 install_valid(&desc, AR_DPL3 | AR_TYPE_RODATA_EXPDOWN | AR_S | AR_P | AR_DB | AR_G); 422 423 desc.limit = 0; 424 install_invalid(&desc, true); 425 } 426 427 /* 428 * 0: thread is idle 429 * 1: thread armed 430 * 2: thread should clear LDT entry 0 431 * 3: thread should exit 432 */ 433 static volatile unsigned int ftx; 434 435 static void *threadproc(void *ctx) 436 { 437 cpu_set_t cpuset; 438 CPU_ZERO(&cpuset); 439 CPU_SET(1, &cpuset); 440 if (sched_setaffinity(0, sizeof(cpuset), &cpuset) != 0) 441 err(1, "sched_setaffinity to CPU 1"); /* should never fail */ 442 443 while (1) { 444 syscall(SYS_futex, &ftx, FUTEX_WAIT, 0, NULL, NULL, 0); 445 while (ftx != 2) { 446 if (ftx >= 3) 447 return NULL; 448 } 449 450 /* clear LDT entry 0 */ 451 const struct user_desc desc = {}; 452 if (syscall(SYS_modify_ldt, 1, &desc, sizeof(desc)) != 0) 453 err(1, "modify_ldt"); 454 455 /* If ftx == 2, set it to zero. If ftx == 100, quit. */ 456 unsigned int x = -2; 457 asm volatile ("lock xaddl %[x], %[ftx]" : 458 [x] "+r" (x), [ftx] "+m" (ftx)); 459 if (x != 2) 460 return NULL; 461 } 462 } 463 464 #ifdef __i386__ 465 466 #ifndef SA_RESTORE 467 #define SA_RESTORER 0x04000000 468 #endif 469 470 /* 471 * The UAPI header calls this 'struct sigaction', which conflicts with 472 * glibc. Sigh. 473 */ 474 struct fake_ksigaction { 475 void *handler; /* the real type is nasty */ 476 unsigned long sa_flags; 477 void (*sa_restorer)(void); 478 unsigned char sigset[8]; 479 }; 480 481 static void fix_sa_restorer(int sig) 482 { 483 struct fake_ksigaction ksa; 484 485 if (syscall(SYS_rt_sigaction, sig, NULL, &ksa, 8) == 0) { 486 /* 487 * glibc has a nasty bug: it sometimes writes garbage to 488 * sa_restorer. This interacts quite badly with anything 489 * that fiddles with SS because it can trigger legacy 490 * stack switching. Patch it up. See: 491 * 492 * https://sourceware.org/bugzilla/show_bug.cgi?id=21269 493 */ 494 if (!(ksa.sa_flags & SA_RESTORER) && ksa.sa_restorer) { 495 ksa.sa_restorer = NULL; 496 if (syscall(SYS_rt_sigaction, sig, &ksa, NULL, 497 sizeof(ksa.sigset)) != 0) 498 err(1, "rt_sigaction"); 499 } 500 } 501 } 502 #else 503 static void fix_sa_restorer(int sig) 504 { 505 /* 64-bit glibc works fine. */ 506 } 507 #endif 508 509 static void sethandler(int sig, void (*handler)(int, siginfo_t *, void *), 510 int flags) 511 { 512 struct sigaction sa; 513 memset(&sa, 0, sizeof(sa)); 514 sa.sa_sigaction = handler; 515 sa.sa_flags = SA_SIGINFO | flags; 516 sigemptyset(&sa.sa_mask); 517 if (sigaction(sig, &sa, 0)) 518 err(1, "sigaction"); 519 520 fix_sa_restorer(sig); 521 } 522 523 static jmp_buf jmpbuf; 524 525 static void sigsegv(int sig, siginfo_t *info, void *ctx_void) 526 { 527 siglongjmp(jmpbuf, 1); 528 } 529 530 static void do_multicpu_tests(void) 531 { 532 cpu_set_t cpuset; 533 pthread_t thread; 534 int failures = 0, iters = 5, i; 535 unsigned short orig_ss; 536 537 CPU_ZERO(&cpuset); 538 CPU_SET(1, &cpuset); 539 if (sched_setaffinity(0, sizeof(cpuset), &cpuset) != 0) { 540 printf("[SKIP]\tCannot set affinity to CPU 1\n"); 541 return; 542 } 543 544 CPU_ZERO(&cpuset); 545 CPU_SET(0, &cpuset); 546 if (sched_setaffinity(0, sizeof(cpuset), &cpuset) != 0) { 547 printf("[SKIP]\tCannot set affinity to CPU 0\n"); 548 return; 549 } 550 551 sethandler(SIGSEGV, sigsegv, 0); 552 #ifdef __i386__ 553 /* True 32-bit kernels send SIGILL instead of SIGSEGV on IRET faults. */ 554 sethandler(SIGILL, sigsegv, 0); 555 #endif 556 557 printf("[RUN]\tCross-CPU LDT invalidation\n"); 558 559 if (pthread_create(&thread, 0, threadproc, 0) != 0) 560 err(1, "pthread_create"); 561 562 asm volatile ("mov %%ss, %0" : "=rm" (orig_ss)); 563 564 for (i = 0; i < 5; i++) { 565 if (sigsetjmp(jmpbuf, 1) != 0) 566 continue; 567 568 /* Make sure the thread is ready after the last test. */ 569 while (ftx != 0) 570 ; 571 572 struct user_desc desc = { 573 .entry_number = 0, 574 .base_addr = 0, 575 .limit = 0xfffff, 576 .seg_32bit = 1, 577 .contents = 0, /* Data */ 578 .read_exec_only = 0, 579 .limit_in_pages = 1, 580 .seg_not_present = 0, 581 .useable = 0 582 }; 583 584 if (safe_modify_ldt(0x11, &desc, sizeof(desc)) != 0) { 585 if (errno != ENOSYS) 586 err(1, "modify_ldt"); 587 printf("[SKIP]\tmodify_ldt unavailable\n"); 588 break; 589 } 590 591 /* Arm the thread. */ 592 ftx = 1; 593 syscall(SYS_futex, &ftx, FUTEX_WAKE, 0, NULL, NULL, 0); 594 595 asm volatile ("mov %0, %%ss" : : "r" (0x7)); 596 597 /* Go! */ 598 ftx = 2; 599 600 while (ftx != 0) 601 ; 602 603 /* 604 * On success, modify_ldt will segfault us synchronously, 605 * and we'll escape via siglongjmp. 606 */ 607 608 failures++; 609 asm volatile ("mov %0, %%ss" : : "rm" (orig_ss)); 610 }; 611 612 ftx = 100; /* Kill the thread. */ 613 syscall(SYS_futex, &ftx, FUTEX_WAKE, 0, NULL, NULL, 0); 614 615 if (pthread_join(thread, NULL) != 0) 616 err(1, "pthread_join"); 617 618 if (failures) { 619 printf("[FAIL]\t%d of %d iterations failed\n", failures, iters); 620 nerrs++; 621 } else { 622 printf("[OK]\tAll %d iterations succeeded\n", iters); 623 } 624 } 625 626 static int finish_exec_test(void) 627 { 628 /* 629 * Older kernel versions did inherit the LDT on exec() which is 630 * wrong because exec() starts from a clean state. 631 */ 632 check_invalid_segment(0, 1); 633 634 return nerrs ? 1 : 0; 635 } 636 637 static void do_exec_test(void) 638 { 639 printf("[RUN]\tTest exec\n"); 640 641 struct user_desc desc = { 642 .entry_number = 0, 643 .base_addr = 0, 644 .limit = 42, 645 .seg_32bit = 1, 646 .contents = 2, /* Code, not conforming */ 647 .read_exec_only = 0, 648 .limit_in_pages = 0, 649 .seg_not_present = 0, 650 .useable = 0 651 }; 652 install_valid(&desc, AR_DPL3 | AR_TYPE_XRCODE | AR_S | AR_P | AR_DB); 653 654 pid_t child = fork(); 655 if (child == 0) { 656 execl("/proc/self/exe", "ldt_gdt_test_exec", NULL); 657 printf("[FAIL]\tCould not exec self\n"); 658 exit(1); /* exec failed */ 659 } else { 660 int status; 661 if (waitpid(child, &status, 0) != child || 662 !WIFEXITED(status)) { 663 printf("[FAIL]\tChild died\n"); 664 nerrs++; 665 } else if (WEXITSTATUS(status) != 0) { 666 printf("[FAIL]\tChild failed\n"); 667 nerrs++; 668 } else { 669 printf("[OK]\tChild succeeded\n"); 670 } 671 } 672 } 673 674 static void setup_counter_page(void) 675 { 676 unsigned int *page = mmap(NULL, 4096, PROT_READ | PROT_WRITE, 677 MAP_ANONYMOUS | MAP_PRIVATE | MAP_32BIT, -1, 0); 678 if (page == MAP_FAILED) 679 err(1, "mmap"); 680 681 for (int i = 0; i < 1024; i++) 682 page[i] = i; 683 counter_page = page; 684 } 685 686 static int invoke_set_thread_area(void) 687 { 688 int ret; 689 asm volatile ("int $0x80" 690 : "=a" (ret), "+m" (low_user_desc) : 691 "a" (243), "b" (low_user_desc) 692 : INT80_CLOBBERS); 693 return ret; 694 } 695 696 static void setup_low_user_desc(void) 697 { 698 low_user_desc = mmap(NULL, 2 * sizeof(struct user_desc), 699 PROT_READ | PROT_WRITE, 700 MAP_ANONYMOUS | MAP_PRIVATE | MAP_32BIT, -1, 0); 701 if (low_user_desc == MAP_FAILED) 702 err(1, "mmap"); 703 704 low_user_desc->entry_number = -1; 705 low_user_desc->base_addr = (unsigned long)&counter_page[1]; 706 low_user_desc->limit = 0xfffff; 707 low_user_desc->seg_32bit = 1; 708 low_user_desc->contents = 0; /* Data, grow-up*/ 709 low_user_desc->read_exec_only = 0; 710 low_user_desc->limit_in_pages = 1; 711 low_user_desc->seg_not_present = 0; 712 low_user_desc->useable = 0; 713 714 if (invoke_set_thread_area() == 0) { 715 gdt_entry_num = low_user_desc->entry_number; 716 printf("[NOTE]\tset_thread_area is available; will use GDT index %d\n", gdt_entry_num); 717 } else { 718 printf("[NOTE]\tset_thread_area is unavailable\n"); 719 } 720 721 low_user_desc_clear = low_user_desc + 1; 722 low_user_desc_clear->entry_number = gdt_entry_num; 723 low_user_desc_clear->read_exec_only = 1; 724 low_user_desc_clear->seg_not_present = 1; 725 } 726 727 static void test_gdt_invalidation(void) 728 { 729 if (!gdt_entry_num) 730 return; /* 64-bit only system -- we can't use set_thread_area */ 731 732 unsigned short prev_sel; 733 unsigned short sel; 734 unsigned int eax; 735 const char *result; 736 #ifdef __x86_64__ 737 unsigned long saved_base; 738 unsigned long new_base; 739 #endif 740 741 /* Test DS */ 742 invoke_set_thread_area(); 743 eax = 243; 744 sel = (gdt_entry_num << 3) | 3; 745 asm volatile ("movw %%ds, %[prev_sel]\n\t" 746 "movw %[sel], %%ds\n\t" 747 #ifdef __i386__ 748 "pushl %%ebx\n\t" 749 #endif 750 "movl %[arg1], %%ebx\n\t" 751 "int $0x80\n\t" /* Should invalidate ds */ 752 #ifdef __i386__ 753 "popl %%ebx\n\t" 754 #endif 755 "movw %%ds, %[sel]\n\t" 756 "movw %[prev_sel], %%ds" 757 : [prev_sel] "=&r" (prev_sel), [sel] "+r" (sel), 758 "+a" (eax) 759 : "m" (low_user_desc_clear), 760 [arg1] "r" ((unsigned int)(unsigned long)low_user_desc_clear) 761 : INT80_CLOBBERS); 762 763 if (sel != 0) { 764 result = "FAIL"; 765 nerrs++; 766 } else { 767 result = "OK"; 768 } 769 printf("[%s]\tInvalidate DS with set_thread_area: new DS = 0x%hx\n", 770 result, sel); 771 772 /* Test ES */ 773 invoke_set_thread_area(); 774 eax = 243; 775 sel = (gdt_entry_num << 3) | 3; 776 asm volatile ("movw %%es, %[prev_sel]\n\t" 777 "movw %[sel], %%es\n\t" 778 #ifdef __i386__ 779 "pushl %%ebx\n\t" 780 #endif 781 "movl %[arg1], %%ebx\n\t" 782 "int $0x80\n\t" /* Should invalidate es */ 783 #ifdef __i386__ 784 "popl %%ebx\n\t" 785 #endif 786 "movw %%es, %[sel]\n\t" 787 "movw %[prev_sel], %%es" 788 : [prev_sel] "=&r" (prev_sel), [sel] "+r" (sel), 789 "+a" (eax) 790 : "m" (low_user_desc_clear), 791 [arg1] "r" ((unsigned int)(unsigned long)low_user_desc_clear) 792 : INT80_CLOBBERS); 793 794 if (sel != 0) { 795 result = "FAIL"; 796 nerrs++; 797 } else { 798 result = "OK"; 799 } 800 printf("[%s]\tInvalidate ES with set_thread_area: new ES = 0x%hx\n", 801 result, sel); 802 803 /* Test FS */ 804 invoke_set_thread_area(); 805 eax = 243; 806 sel = (gdt_entry_num << 3) | 3; 807 #ifdef __x86_64__ 808 syscall(SYS_arch_prctl, ARCH_GET_FS, &saved_base); 809 #endif 810 asm volatile ("movw %%fs, %[prev_sel]\n\t" 811 "movw %[sel], %%fs\n\t" 812 #ifdef __i386__ 813 "pushl %%ebx\n\t" 814 #endif 815 "movl %[arg1], %%ebx\n\t" 816 "int $0x80\n\t" /* Should invalidate fs */ 817 #ifdef __i386__ 818 "popl %%ebx\n\t" 819 #endif 820 "movw %%fs, %[sel]\n\t" 821 : [prev_sel] "=&r" (prev_sel), [sel] "+r" (sel), 822 "+a" (eax) 823 : "m" (low_user_desc_clear), 824 [arg1] "r" ((unsigned int)(unsigned long)low_user_desc_clear) 825 : INT80_CLOBBERS); 826 827 #ifdef __x86_64__ 828 syscall(SYS_arch_prctl, ARCH_GET_FS, &new_base); 829 #endif 830 831 /* Restore FS/BASE for glibc */ 832 asm volatile ("movw %[prev_sel], %%fs" : : [prev_sel] "rm" (prev_sel)); 833 #ifdef __x86_64__ 834 if (saved_base) 835 syscall(SYS_arch_prctl, ARCH_SET_FS, saved_base); 836 #endif 837 838 if (sel != 0) { 839 result = "FAIL"; 840 nerrs++; 841 } else { 842 result = "OK"; 843 } 844 printf("[%s]\tInvalidate FS with set_thread_area: new FS = 0x%hx\n", 845 result, sel); 846 847 #ifdef __x86_64__ 848 if (sel == 0 && new_base != 0) { 849 nerrs++; 850 printf("[FAIL]\tNew FSBASE was 0x%lx\n", new_base); 851 } else { 852 printf("[OK]\tNew FSBASE was zero\n"); 853 } 854 #endif 855 856 /* Test GS */ 857 invoke_set_thread_area(); 858 eax = 243; 859 sel = (gdt_entry_num << 3) | 3; 860 #ifdef __x86_64__ 861 syscall(SYS_arch_prctl, ARCH_GET_GS, &saved_base); 862 #endif 863 asm volatile ("movw %%gs, %[prev_sel]\n\t" 864 "movw %[sel], %%gs\n\t" 865 #ifdef __i386__ 866 "pushl %%ebx\n\t" 867 #endif 868 "movl %[arg1], %%ebx\n\t" 869 "int $0x80\n\t" /* Should invalidate gs */ 870 #ifdef __i386__ 871 "popl %%ebx\n\t" 872 #endif 873 "movw %%gs, %[sel]\n\t" 874 : [prev_sel] "=&r" (prev_sel), [sel] "+r" (sel), 875 "+a" (eax) 876 : "m" (low_user_desc_clear), 877 [arg1] "r" ((unsigned int)(unsigned long)low_user_desc_clear) 878 : INT80_CLOBBERS); 879 880 #ifdef __x86_64__ 881 syscall(SYS_arch_prctl, ARCH_GET_GS, &new_base); 882 #endif 883 884 /* Restore GS/BASE for glibc */ 885 asm volatile ("movw %[prev_sel], %%gs" : : [prev_sel] "rm" (prev_sel)); 886 #ifdef __x86_64__ 887 if (saved_base) 888 syscall(SYS_arch_prctl, ARCH_SET_GS, saved_base); 889 #endif 890 891 if (sel != 0) { 892 result = "FAIL"; 893 nerrs++; 894 } else { 895 result = "OK"; 896 } 897 printf("[%s]\tInvalidate GS with set_thread_area: new GS = 0x%hx\n", 898 result, sel); 899 900 #ifdef __x86_64__ 901 if (sel == 0 && new_base != 0) { 902 nerrs++; 903 printf("[FAIL]\tNew GSBASE was 0x%lx\n", new_base); 904 } else { 905 printf("[OK]\tNew GSBASE was zero\n"); 906 } 907 #endif 908 } 909 910 int main(int argc, char **argv) 911 { 912 if (argc == 1 && !strcmp(argv[0], "ldt_gdt_test_exec")) 913 return finish_exec_test(); 914 915 setup_counter_page(); 916 setup_low_user_desc(); 917 918 do_simple_tests(); 919 920 do_multicpu_tests(); 921 922 do_exec_test(); 923 924 test_gdt_invalidation(); 925 926 return nerrs ? 1 : 0; 927 } 928
