1 // SPDX-License-Identifier: GPL-2.0-only
2 /*
3  * fsgsbase.c, an fsgsbase test
4  * Copyright (c) 2014-2016 Andy Lutomirski
5  */
6 
7 #define _GNU_SOURCE
8 #include <stdio.h>
9 #include <stdlib.h>
10 #include <stdbool.h>
11 #include <string.h>
12 #include <sys/syscall.h>
13 #include <unistd.h>
14 #include <err.h>
15 #include <sys/user.h>
16 #include <asm/prctl.h>
17 #include <sys/prctl.h>
18 #include <signal.h>
19 #include <limits.h>
20 #include <sys/ucontext.h>
21 #include <sched.h>
22 #include <linux/futex.h>
23 #include <pthread.h>
24 #include <asm/ldt.h>
25 #include <sys/mman.h>
26 #include <stddef.h>
27 #include <sys/ptrace.h>
28 #include <sys/wait.h>
29 #include <setjmp.h>
30 
31 #ifndef __x86_64__
32 # error This test is 64-bit only
33 #endif
34 
35 static volatile sig_atomic_t want_segv;
36 static volatile unsigned long segv_addr;
37 
38 static unsigned short *shared_scratch;
39 
40 static int nerrs;
41 
sethandler(int sig,void (* handler)(int,siginfo_t *,void *),int flags)42 static void sethandler(int sig, void (*handler)(int, siginfo_t *, void *),
43 		       int flags)
44 {
45 	struct sigaction sa;
46 	memset(&sa, 0, sizeof(sa));
47 	sa.sa_sigaction = handler;
48 	sa.sa_flags = SA_SIGINFO | flags;
49 	sigemptyset(&sa.sa_mask);
50 	if (sigaction(sig, &sa, 0))
51 		err(1, "sigaction");
52 }
53 
clearhandler(int sig)54 static void clearhandler(int sig)
55 {
56 	struct sigaction sa;
57 	memset(&sa, 0, sizeof(sa));
58 	sa.sa_handler = SIG_DFL;
59 	sigemptyset(&sa.sa_mask);
60 	if (sigaction(sig, &sa, 0))
61 		err(1, "sigaction");
62 }
63 
sigsegv(int sig,siginfo_t * si,void * ctx_void)64 static void sigsegv(int sig, siginfo_t *si, void *ctx_void)
65 {
66 	ucontext_t *ctx = (ucontext_t*)ctx_void;
67 
68 	if (!want_segv) {
69 		clearhandler(SIGSEGV);
70 		return;  /* Crash cleanly. */
71 	}
72 
73 	want_segv = false;
74 	segv_addr = (unsigned long)si->si_addr;
75 
76 	ctx->uc_mcontext.gregs[REG_RIP] += 4;	/* Skip the faulting mov */
77 
78 }
79 
80 static jmp_buf jmpbuf;
81 
sigill(int sig,siginfo_t * si,void * ctx_void)82 static void sigill(int sig, siginfo_t *si, void *ctx_void)
83 {
84 	siglongjmp(jmpbuf, 1);
85 }
86 
87 static bool have_fsgsbase;
88 
rdgsbase(void)89 static inline unsigned long rdgsbase(void)
90 {
91 	unsigned long gsbase;
92 
93 	asm volatile("rdgsbase %0" : "=r" (gsbase) :: "memory");
94 
95 	return gsbase;
96 }
97 
rdfsbase(void)98 static inline unsigned long rdfsbase(void)
99 {
100 	unsigned long fsbase;
101 
102 	asm volatile("rdfsbase %0" : "=r" (fsbase) :: "memory");
103 
104 	return fsbase;
105 }
106 
wrgsbase(unsigned long gsbase)107 static inline void wrgsbase(unsigned long gsbase)
108 {
109 	asm volatile("wrgsbase %0" :: "r" (gsbase) : "memory");
110 }
111 
wrfsbase(unsigned long fsbase)112 static inline void wrfsbase(unsigned long fsbase)
113 {
114 	asm volatile("wrfsbase %0" :: "r" (fsbase) : "memory");
115 }
116 
117 enum which_base { FS, GS };
118 
read_base(enum which_base which)119 static unsigned long read_base(enum which_base which)
120 {
121 	unsigned long offset;
122 	/*
123 	 * Unless we have FSGSBASE, there's no direct way to do this from
124 	 * user mode.  We can get at it indirectly using signals, though.
125 	 */
126 
127 	want_segv = true;
128 
129 	offset = 0;
130 	if (which == FS) {
131 		/* Use a constant-length instruction here. */
132 		asm volatile ("mov %%fs:(%%rcx), %%rax" : : "c" (offset) : "rax");
133 	} else {
134 		asm volatile ("mov %%gs:(%%rcx), %%rax" : : "c" (offset) : "rax");
135 	}
136 	if (!want_segv)
137 		return segv_addr + offset;
138 
139 	/*
140 	 * If that didn't segfault, try the other end of the address space.
141 	 * Unless we get really unlucky and run into the vsyscall page, this
142 	 * is guaranteed to segfault.
143 	 */
144 
145 	offset = (ULONG_MAX >> 1) + 1;
146 	if (which == FS) {
147 		asm volatile ("mov %%fs:(%%rcx), %%rax"
148 			      : : "c" (offset) : "rax");
149 	} else {
150 		asm volatile ("mov %%gs:(%%rcx), %%rax"
151 			      : : "c" (offset) : "rax");
152 	}
153 	if (!want_segv)
154 		return segv_addr + offset;
155 
156 	abort();
157 }
158 
check_gs_value(unsigned long value)159 static void check_gs_value(unsigned long value)
160 {
161 	unsigned long base;
162 	unsigned short sel;
163 
164 	printf("[RUN]\tARCH_SET_GS to 0x%lx\n", value);
165 	if (syscall(SYS_arch_prctl, ARCH_SET_GS, value) != 0)
166 		err(1, "ARCH_SET_GS");
167 
168 	asm volatile ("mov %%gs, %0" : "=rm" (sel));
169 	base = read_base(GS);
170 	if (base == value) {
171 		printf("[OK]\tGSBASE was set as expected (selector 0x%hx)\n",
172 		       sel);
173 	} else {
174 		nerrs++;
175 		printf("[FAIL]\tGSBASE was not as expected: got 0x%lx (selector 0x%hx)\n",
176 		       base, sel);
177 	}
178 
179 	if (syscall(SYS_arch_prctl, ARCH_GET_GS, &base) != 0)
180 		err(1, "ARCH_GET_GS");
181 	if (base == value) {
182 		printf("[OK]\tARCH_GET_GS worked as expected (selector 0x%hx)\n",
183 		       sel);
184 	} else {
185 		nerrs++;
186 		printf("[FAIL]\tARCH_GET_GS was not as expected: got 0x%lx (selector 0x%hx)\n",
187 		       base, sel);
188 	}
189 }
190 
mov_0_gs(unsigned long initial_base,bool schedule)191 static void mov_0_gs(unsigned long initial_base, bool schedule)
192 {
193 	unsigned long base, arch_base;
194 
195 	printf("[RUN]\tARCH_SET_GS to 0x%lx then mov 0 to %%gs%s\n", initial_base, schedule ? " and schedule " : "");
196 	if (syscall(SYS_arch_prctl, ARCH_SET_GS, initial_base) != 0)
197 		err(1, "ARCH_SET_GS");
198 
199 	if (schedule)
200 		usleep(10);
201 
202 	asm volatile ("mov %0, %%gs" : : "rm" (0));
203 	base = read_base(GS);
204 	if (syscall(SYS_arch_prctl, ARCH_GET_GS, &arch_base) != 0)
205 		err(1, "ARCH_GET_GS");
206 	if (base == arch_base) {
207 		printf("[OK]\tGSBASE is 0x%lx\n", base);
208 	} else {
209 		nerrs++;
210 		printf("[FAIL]\tGSBASE changed to 0x%lx but kernel reports 0x%lx\n", base, arch_base);
211 	}
212 }
213 
214 static volatile unsigned long remote_base;
215 static volatile bool remote_hard_zero;
216 static volatile unsigned int ftx;
217 
218 /*
219  * ARCH_SET_FS/GS(0) may or may not program a selector of zero.  HARD_ZERO
220  * means to force the selector to zero to improve test coverage.
221  */
222 #define HARD_ZERO 0xa1fa5f343cb85fa4
223 
do_remote_base()224 static void do_remote_base()
225 {
226 	unsigned long to_set = remote_base;
227 	bool hard_zero = false;
228 	if (to_set == HARD_ZERO) {
229 		to_set = 0;
230 		hard_zero = true;
231 	}
232 
233 	if (syscall(SYS_arch_prctl, ARCH_SET_GS, to_set) != 0)
234 		err(1, "ARCH_SET_GS");
235 
236 	if (hard_zero)
237 		asm volatile ("mov %0, %%gs" : : "rm" ((unsigned short)0));
238 
239 	unsigned short sel;
240 	asm volatile ("mov %%gs, %0" : "=rm" (sel));
241 	printf("\tother thread: ARCH_SET_GS(0x%lx)%s -- sel is 0x%hx\n",
242 	       to_set, hard_zero ? " and clear gs" : "", sel);
243 }
244 
245 static __thread int set_thread_area_entry_number = -1;
246 
load_gs(void)247 static unsigned short load_gs(void)
248 {
249 	/*
250 	 * Sets GS != 0 and GSBASE != 0 but arranges for the kernel to think
251 	 * that GSBASE == 0 (i.e. thread.gsbase == 0).
252 	 */
253 
254 	/* Step 1: tell the kernel that we have GSBASE == 0. */
255 	if (syscall(SYS_arch_prctl, ARCH_SET_GS, 0) != 0)
256 		err(1, "ARCH_SET_GS");
257 
258 	/* Step 2: change GSBASE without telling the kernel. */
259 	struct user_desc desc = {
260 		.entry_number    = 0,
261 		.base_addr       = 0xBAADF00D,
262 		.limit           = 0xfffff,
263 		.seg_32bit       = 1,
264 		.contents        = 0, /* Data, grow-up */
265 		.read_exec_only  = 0,
266 		.limit_in_pages  = 1,
267 		.seg_not_present = 0,
268 		.useable         = 0
269 	};
270 	if (syscall(SYS_modify_ldt, 1, &desc, sizeof(desc)) == 0) {
271 		printf("\tusing LDT slot 0\n");
272 		asm volatile ("mov %0, %%gs" : : "rm" ((unsigned short)0x7));
273 		return 0x7;
274 	} else {
275 		/* No modify_ldt for us (configured out, perhaps) */
276 
277 		struct user_desc *low_desc = mmap(
278 			NULL, sizeof(desc),
279 			PROT_READ | PROT_WRITE,
280 			MAP_PRIVATE | MAP_ANONYMOUS | MAP_32BIT, -1, 0);
281 		memcpy(low_desc, &desc, sizeof(desc));
282 
283 		low_desc->entry_number = set_thread_area_entry_number;
284 
285 		/* 32-bit set_thread_area */
286 		long ret;
287 		asm volatile ("int $0x80"
288 			      : "=a" (ret), "+m" (*low_desc)
289 			      : "a" (243), "b" (low_desc)
290 			      : "r8", "r9", "r10", "r11");
291 		memcpy(&desc, low_desc, sizeof(desc));
292 		munmap(low_desc, sizeof(desc));
293 
294 		if (ret != 0) {
295 			printf("[NOTE]\tcould not create a segment -- test won't do anything\n");
296 			return 0;
297 		}
298 		printf("\tusing GDT slot %d\n", desc.entry_number);
299 		set_thread_area_entry_number = desc.entry_number;
300 
301 		unsigned short gs = (unsigned short)((desc.entry_number << 3) | 0x3);
302 		asm volatile ("mov %0, %%gs" : : "rm" (gs));
303 		return gs;
304 	}
305 }
306 
test_wrbase(unsigned short index,unsigned long base)307 void test_wrbase(unsigned short index, unsigned long base)
308 {
309 	unsigned short newindex;
310 	unsigned long newbase;
311 
312 	printf("[RUN]\tGS = 0x%hx, GSBASE = 0x%lx\n", index, base);
313 
314 	asm volatile ("mov %0, %%gs" : : "rm" (index));
315 	wrgsbase(base);
316 
317 	remote_base = 0;
318 	ftx = 1;
319 	syscall(SYS_futex, &ftx, FUTEX_WAKE, 0, NULL, NULL, 0);
320 	while (ftx != 0)
321 		syscall(SYS_futex, &ftx, FUTEX_WAIT, 1, NULL, NULL, 0);
322 
323 	asm volatile ("mov %%gs, %0" : "=rm" (newindex));
324 	newbase = rdgsbase();
325 
326 	if (newindex == index && newbase == base) {
327 		printf("[OK]\tIndex and base were preserved\n");
328 	} else {
329 		printf("[FAIL]\tAfter switch, GS = 0x%hx and GSBASE = 0x%lx\n",
330 		       newindex, newbase);
331 		nerrs++;
332 	}
333 }
334 
threadproc(void * ctx)335 static void *threadproc(void *ctx)
336 {
337 	while (1) {
338 		while (ftx == 0)
339 			syscall(SYS_futex, &ftx, FUTEX_WAIT, 0, NULL, NULL, 0);
340 		if (ftx == 3)
341 			return NULL;
342 
343 		if (ftx == 1) {
344 			do_remote_base();
345 		} else if (ftx == 2) {
346 			/*
347 			 * On AMD chips, this causes GSBASE != 0, GS == 0, and
348 			 * thread.gsbase == 0.
349 			 */
350 
351 			load_gs();
352 			asm volatile ("mov %0, %%gs" : : "rm" ((unsigned short)0));
353 		} else {
354 			errx(1, "helper thread got bad command");
355 		}
356 
357 		ftx = 0;
358 		syscall(SYS_futex, &ftx, FUTEX_WAKE, 0, NULL, NULL, 0);
359 	}
360 }
361 
set_gs_and_switch_to(unsigned long local,unsigned short force_sel,unsigned long remote)362 static void set_gs_and_switch_to(unsigned long local,
363 				 unsigned short force_sel,
364 				 unsigned long remote)
365 {
366 	unsigned long base;
367 	unsigned short sel_pre_sched, sel_post_sched;
368 
369 	bool hard_zero = false;
370 	if (local == HARD_ZERO) {
371 		hard_zero = true;
372 		local = 0;
373 	}
374 
375 	printf("[RUN]\tARCH_SET_GS(0x%lx)%s, then schedule to 0x%lx\n",
376 	       local, hard_zero ? " and clear gs" : "", remote);
377 	if (force_sel)
378 		printf("\tBefore schedule, set selector to 0x%hx\n", force_sel);
379 	if (syscall(SYS_arch_prctl, ARCH_SET_GS, local) != 0)
380 		err(1, "ARCH_SET_GS");
381 	if (hard_zero)
382 		asm volatile ("mov %0, %%gs" : : "rm" ((unsigned short)0));
383 
384 	if (read_base(GS) != local) {
385 		nerrs++;
386 		printf("[FAIL]\tGSBASE wasn't set as expected\n");
387 	}
388 
389 	if (force_sel) {
390 		asm volatile ("mov %0, %%gs" : : "rm" (force_sel));
391 		sel_pre_sched = force_sel;
392 		local = read_base(GS);
393 
394 		/*
395 		 * Signal delivery is quite likely to change a selector
396 		 * of 1, 2, or 3 back to 0 due to IRET being defective.
397 		 */
398 		asm volatile ("mov %0, %%gs" : : "rm" (force_sel));
399 	} else {
400 		asm volatile ("mov %%gs, %0" : "=rm" (sel_pre_sched));
401 	}
402 
403 	remote_base = remote;
404 	ftx = 1;
405 	syscall(SYS_futex, &ftx, FUTEX_WAKE, 0, NULL, NULL, 0);
406 	while (ftx != 0)
407 		syscall(SYS_futex, &ftx, FUTEX_WAIT, 1, NULL, NULL, 0);
408 
409 	asm volatile ("mov %%gs, %0" : "=rm" (sel_post_sched));
410 	base = read_base(GS);
411 	if (base == local && sel_pre_sched == sel_post_sched) {
412 		printf("[OK]\tGS/BASE remained 0x%hx/0x%lx\n",
413 		       sel_pre_sched, local);
414 	} else if (base == local && sel_pre_sched >= 1 && sel_pre_sched <= 3 &&
415 		   sel_post_sched == 0) {
416 		/*
417 		 * IRET is misdesigned and will squash selectors 1, 2, or 3
418 		 * to zero.  Don't fail the test just because this happened.
419 		 */
420 		printf("[OK]\tGS/BASE changed from 0x%hx/0x%lx to 0x%hx/0x%lx because IRET is defective\n",
421 		       sel_pre_sched, local, sel_post_sched, base);
422 	} else {
423 		nerrs++;
424 		printf("[FAIL]\tGS/BASE changed from 0x%hx/0x%lx to 0x%hx/0x%lx\n",
425 		       sel_pre_sched, local, sel_post_sched, base);
426 	}
427 }
428 
test_unexpected_base(void)429 static void test_unexpected_base(void)
430 {
431 	unsigned long base;
432 
433 	printf("[RUN]\tARCH_SET_GS(0), clear gs, then manipulate GSBASE in a different thread\n");
434 	if (syscall(SYS_arch_prctl, ARCH_SET_GS, 0) != 0)
435 		err(1, "ARCH_SET_GS");
436 	asm volatile ("mov %0, %%gs" : : "rm" ((unsigned short)0));
437 
438 	ftx = 2;
439 	syscall(SYS_futex, &ftx, FUTEX_WAKE, 0, NULL, NULL, 0);
440 	while (ftx != 0)
441 		syscall(SYS_futex, &ftx, FUTEX_WAIT, 1, NULL, NULL, 0);
442 
443 	base = read_base(GS);
444 	if (base == 0) {
445 		printf("[OK]\tGSBASE remained 0\n");
446 	} else {
447 		nerrs++;
448 		printf("[FAIL]\tGSBASE changed to 0x%lx\n", base);
449 	}
450 }
451 
452 #define USER_REGS_OFFSET(r) offsetof(struct user_regs_struct, r)
453 
test_ptrace_write_gs_read_base(void)454 static void test_ptrace_write_gs_read_base(void)
455 {
456 	int status;
457 	pid_t child = fork();
458 
459 	if (child < 0)
460 		err(1, "fork");
461 
462 	if (child == 0) {
463 		printf("[RUN]\tPTRACE_POKE GS, read GSBASE back\n");
464 
465 		printf("[RUN]\tARCH_SET_GS to 1\n");
466 		if (syscall(SYS_arch_prctl, ARCH_SET_GS, 1) != 0)
467 			err(1, "ARCH_SET_GS");
468 
469 		if (ptrace(PTRACE_TRACEME, 0, NULL, NULL) != 0)
470 			err(1, "PTRACE_TRACEME");
471 
472 		raise(SIGTRAP);
473 		_exit(0);
474 	}
475 
476 	wait(&status);
477 
478 	if (WSTOPSIG(status) == SIGTRAP) {
479 		unsigned long base;
480 		unsigned long gs_offset = USER_REGS_OFFSET(gs);
481 		unsigned long base_offset = USER_REGS_OFFSET(gs_base);
482 
483 		/* Read the initial base.  It should be 1. */
484 		base = ptrace(PTRACE_PEEKUSER, child, base_offset, NULL);
485 		if (base == 1) {
486 			printf("[OK]\tGSBASE started at 1\n");
487 		} else {
488 			nerrs++;
489 			printf("[FAIL]\tGSBASE started at 0x%lx\n", base);
490 		}
491 
492 		printf("[RUN]\tSet GS = 0x7, read GSBASE\n");
493 
494 		/* Poke an LDT selector into GS. */
495 		if (ptrace(PTRACE_POKEUSER, child, gs_offset, 0x7) != 0)
496 			err(1, "PTRACE_POKEUSER");
497 
498 		/* And read the base. */
499 		base = ptrace(PTRACE_PEEKUSER, child, base_offset, NULL);
500 
501 		if (base == 0 || base == 1) {
502 			printf("[OK]\tGSBASE reads as 0x%lx with invalid GS\n", base);
503 		} else {
504 			nerrs++;
505 			printf("[FAIL]\tGSBASE=0x%lx (should be 0 or 1)\n", base);
506 		}
507 	}
508 
509 	ptrace(PTRACE_CONT, child, NULL, NULL);
510 
511 	wait(&status);
512 	if (!WIFEXITED(status))
513 		printf("[WARN]\tChild didn't exit cleanly.\n");
514 }
515 
test_ptrace_write_gsbase(void)516 static void test_ptrace_write_gsbase(void)
517 {
518 	int status;
519 	pid_t child = fork();
520 
521 	if (child < 0)
522 		err(1, "fork");
523 
524 	if (child == 0) {
525 		printf("[RUN]\tPTRACE_POKE(), write GSBASE from ptracer\n");
526 
527 		*shared_scratch = load_gs();
528 
529 		if (ptrace(PTRACE_TRACEME, 0, NULL, NULL) != 0)
530 			err(1, "PTRACE_TRACEME");
531 
532 		raise(SIGTRAP);
533 		_exit(0);
534 	}
535 
536 	wait(&status);
537 
538 	if (WSTOPSIG(status) == SIGTRAP) {
539 		unsigned long gs, base;
540 		unsigned long gs_offset = USER_REGS_OFFSET(gs);
541 		unsigned long base_offset = USER_REGS_OFFSET(gs_base);
542 
543 		gs = ptrace(PTRACE_PEEKUSER, child, gs_offset, NULL);
544 
545 		if (gs != *shared_scratch) {
546 			nerrs++;
547 			printf("[FAIL]\tGS is not prepared with nonzero\n");
548 			goto END;
549 		}
550 
551 		if (ptrace(PTRACE_POKEUSER, child, base_offset, 0xFF) != 0)
552 			err(1, "PTRACE_POKEUSER");
553 
554 		gs = ptrace(PTRACE_PEEKUSER, child, gs_offset, NULL);
555 		base = ptrace(PTRACE_PEEKUSER, child, base_offset, NULL);
556 
557 		/*
558 		 * In a non-FSGSBASE system, the nonzero selector will load
559 		 * GSBASE (again). But what is tested here is whether the
560 		 * selector value is changed or not by the GSBASE write in
561 		 * a ptracer.
562 		 */
563 		if (gs != *shared_scratch) {
564 			nerrs++;
565 			printf("[FAIL]\tGS changed to %lx\n", gs);
566 
567 			/*
568 			 * On older kernels, poking a nonzero value into the
569 			 * base would zero the selector.  On newer kernels,
570 			 * this behavior has changed -- poking the base
571 			 * changes only the base and, if FSGSBASE is not
572 			 * available, this may have no effect once the tracee
573 			 * is resumed.
574 			 */
575 			if (gs == 0)
576 				printf("\tNote: this is expected behavior on older kernels.\n");
577 		} else if (have_fsgsbase && (base != 0xFF)) {
578 			nerrs++;
579 			printf("[FAIL]\tGSBASE changed to %lx\n", base);
580 		} else {
581 			printf("[OK]\tGS remained 0x%hx", *shared_scratch);
582 			if (have_fsgsbase)
583 				printf(" and GSBASE changed to 0xFF");
584 			printf("\n");
585 		}
586 	}
587 
588 END:
589 	ptrace(PTRACE_CONT, child, NULL, NULL);
590 	wait(&status);
591 	if (!WIFEXITED(status))
592 		printf("[WARN]\tChild didn't exit cleanly.\n");
593 }
594 
main()595 int main()
596 {
597 	pthread_t thread;
598 
599 	shared_scratch = mmap(NULL, 4096, PROT_READ | PROT_WRITE,
600 			      MAP_ANONYMOUS | MAP_SHARED, -1, 0);
601 
602 	/* Do these tests before we have an LDT. */
603 	test_ptrace_write_gs_read_base();
604 
605 	/* Probe FSGSBASE */
606 	sethandler(SIGILL, sigill, 0);
607 	if (sigsetjmp(jmpbuf, 1) == 0) {
608 		rdfsbase();
609 		have_fsgsbase = true;
610 		printf("\tFSGSBASE instructions are enabled\n");
611 	} else {
612 		printf("\tFSGSBASE instructions are disabled\n");
613 	}
614 	clearhandler(SIGILL);
615 
616 	sethandler(SIGSEGV, sigsegv, 0);
617 
618 	check_gs_value(0);
619 	check_gs_value(1);
620 	check_gs_value(0x200000000);
621 	check_gs_value(0);
622 	check_gs_value(0x200000000);
623 	check_gs_value(1);
624 
625 	for (int sched = 0; sched < 2; sched++) {
626 		mov_0_gs(0, !!sched);
627 		mov_0_gs(1, !!sched);
628 		mov_0_gs(0x200000000, !!sched);
629 	}
630 
631 	/* Set up for multithreading. */
632 
633 	cpu_set_t cpuset;
634 	CPU_ZERO(&cpuset);
635 	CPU_SET(0, &cpuset);
636 	if (sched_setaffinity(0, sizeof(cpuset), &cpuset) != 0)
637 		err(1, "sched_setaffinity to CPU 0");	/* should never fail */
638 
639 	if (pthread_create(&thread, 0, threadproc, 0) != 0)
640 		err(1, "pthread_create");
641 
642 	static unsigned long bases_with_hard_zero[] = {
643 		0, HARD_ZERO, 1, 0x200000000,
644 	};
645 
646 	for (int local = 0; local < 4; local++) {
647 		for (int remote = 0; remote < 4; remote++) {
648 			for (unsigned short s = 0; s < 5; s++) {
649 				unsigned short sel = s;
650 				if (s == 4)
651 					asm ("mov %%ss, %0" : "=rm" (sel));
652 				set_gs_and_switch_to(
653 					bases_with_hard_zero[local],
654 					sel,
655 					bases_with_hard_zero[remote]);
656 			}
657 		}
658 	}
659 
660 	test_unexpected_base();
661 
662 	if (have_fsgsbase) {
663 		unsigned short ss;
664 
665 		asm volatile ("mov %%ss, %0" : "=rm" (ss));
666 
667 		test_wrbase(0, 0);
668 		test_wrbase(0, 1);
669 		test_wrbase(0, 0x200000000);
670 		test_wrbase(0, 0xffffffffffffffff);
671 		test_wrbase(ss, 0);
672 		test_wrbase(ss, 1);
673 		test_wrbase(ss, 0x200000000);
674 		test_wrbase(ss, 0xffffffffffffffff);
675 	}
676 
677 	ftx = 3;  /* Kill the thread. */
678 	syscall(SYS_futex, &ftx, FUTEX_WAKE, 0, NULL, NULL, 0);
679 
680 	if (pthread_join(thread, NULL) != 0)
681 		err(1, "pthread_join");
682 
683 	test_ptrace_write_gsbase();
684 
685 	return nerrs == 0 ? 0 : 1;
686 }
687