1 // SPDX-License-Identifier: GPL-2.0-only 2 /* 3 * fsgsbase.c, an fsgsbase test 4 * Copyright (c) 2014-2016 Andy Lutomirski 5 */ 6 7 #define _GNU_SOURCE 8 #include <stdio.h> 9 #include <stdlib.h> 10 #include <stdbool.h> 11 #include <string.h> 12 #include <sys/syscall.h> 13 #include <unistd.h> 14 #include <err.h> 15 #include <sys/user.h> 16 #include <asm/prctl.h> 17 #include <sys/prctl.h> 18 #include <signal.h> 19 #include <limits.h> 20 #include <sys/ucontext.h> 21 #include <sched.h> 22 #include <linux/futex.h> 23 #include <pthread.h> 24 #include <asm/ldt.h> 25 #include <sys/mman.h> 26 #include <stddef.h> 27 #include <sys/ptrace.h> 28 #include <sys/wait.h> 29 #include <setjmp.h> 30 31 #ifndef __x86_64__ 32 # error This test is 64-bit only 33 #endif 34 35 static volatile sig_atomic_t want_segv; 36 static volatile unsigned long segv_addr; 37 38 static unsigned short *shared_scratch; 39 40 static int nerrs; 41 42 static void sethandler(int sig, void (*handler)(int, siginfo_t *, void *), 43 int flags) 44 { 45 struct sigaction sa; 46 memset(&sa, 0, sizeof(sa)); 47 sa.sa_sigaction = handler; 48 sa.sa_flags = SA_SIGINFO | flags; 49 sigemptyset(&sa.sa_mask); 50 if (sigaction(sig, &sa, 0)) 51 err(1, "sigaction"); 52 } 53 54 static void clearhandler(int sig) 55 { 56 struct sigaction sa; 57 memset(&sa, 0, sizeof(sa)); 58 sa.sa_handler = SIG_DFL; 59 sigemptyset(&sa.sa_mask); 60 if (sigaction(sig, &sa, 0)) 61 err(1, "sigaction"); 62 } 63 64 static void sigsegv(int sig, siginfo_t *si, void *ctx_void) 65 { 66 ucontext_t *ctx = (ucontext_t*)ctx_void; 67 68 if (!want_segv) { 69 clearhandler(SIGSEGV); 70 return; /* Crash cleanly. */ 71 } 72 73 want_segv = false; 74 segv_addr = (unsigned long)si->si_addr; 75 76 ctx->uc_mcontext.gregs[REG_RIP] += 4; /* Skip the faulting mov */ 77 78 } 79 80 static jmp_buf jmpbuf; 81 82 static void sigill(int sig, siginfo_t *si, void *ctx_void) 83 { 84 siglongjmp(jmpbuf, 1); 85 } 86 87 static bool have_fsgsbase; 88 89 static inline unsigned long rdgsbase(void) 90 { 91 unsigned long gsbase; 92 93 asm volatile("rdgsbase %0" : "=r" (gsbase) :: "memory"); 94 95 return gsbase; 96 } 97 98 static inline unsigned long rdfsbase(void) 99 { 100 unsigned long fsbase; 101 102 asm volatile("rdfsbase %0" : "=r" (fsbase) :: "memory"); 103 104 return fsbase; 105 } 106 107 static inline void wrgsbase(unsigned long gsbase) 108 { 109 asm volatile("wrgsbase %0" :: "r" (gsbase) : "memory"); 110 } 111 112 static inline void wrfsbase(unsigned long fsbase) 113 { 114 asm volatile("wrfsbase %0" :: "r" (fsbase) : "memory"); 115 } 116 117 enum which_base { FS, GS }; 118 119 static unsigned long read_base(enum which_base which) 120 { 121 unsigned long offset; 122 /* 123 * Unless we have FSGSBASE, there's no direct way to do this from 124 * user mode. We can get at it indirectly using signals, though. 125 */ 126 127 want_segv = true; 128 129 offset = 0; 130 if (which == FS) { 131 /* Use a constant-length instruction here. */ 132 asm volatile ("mov %%fs:(%%rcx), %%rax" : : "c" (offset) : "rax"); 133 } else { 134 asm volatile ("mov %%gs:(%%rcx), %%rax" : : "c" (offset) : "rax"); 135 } 136 if (!want_segv) 137 return segv_addr + offset; 138 139 /* 140 * If that didn't segfault, try the other end of the address space. 141 * Unless we get really unlucky and run into the vsyscall page, this 142 * is guaranteed to segfault. 143 */ 144 145 offset = (ULONG_MAX >> 1) + 1; 146 if (which == FS) { 147 asm volatile ("mov %%fs:(%%rcx), %%rax" 148 : : "c" (offset) : "rax"); 149 } else { 150 asm volatile ("mov %%gs:(%%rcx), %%rax" 151 : : "c" (offset) : "rax"); 152 } 153 if (!want_segv) 154 return segv_addr + offset; 155 156 abort(); 157 } 158 159 static void check_gs_value(unsigned long value) 160 { 161 unsigned long base; 162 unsigned short sel; 163 164 printf("[RUN]\tARCH_SET_GS to 0x%lx\n", value); 165 if (syscall(SYS_arch_prctl, ARCH_SET_GS, value) != 0) 166 err(1, "ARCH_SET_GS"); 167 168 asm volatile ("mov %%gs, %0" : "=rm" (sel)); 169 base = read_base(GS); 170 if (base == value) { 171 printf("[OK]\tGSBASE was set as expected (selector 0x%hx)\n", 172 sel); 173 } else { 174 nerrs++; 175 printf("[FAIL]\tGSBASE was not as expected: got 0x%lx (selector 0x%hx)\n", 176 base, sel); 177 } 178 179 if (syscall(SYS_arch_prctl, ARCH_GET_GS, &base) != 0) 180 err(1, "ARCH_GET_GS"); 181 if (base == value) { 182 printf("[OK]\tARCH_GET_GS worked as expected (selector 0x%hx)\n", 183 sel); 184 } else { 185 nerrs++; 186 printf("[FAIL]\tARCH_GET_GS was not as expected: got 0x%lx (selector 0x%hx)\n", 187 base, sel); 188 } 189 } 190 191 static void mov_0_gs(unsigned long initial_base, bool schedule) 192 { 193 unsigned long base, arch_base; 194 195 printf("[RUN]\tARCH_SET_GS to 0x%lx then mov 0 to %%gs%s\n", initial_base, schedule ? " and schedule " : ""); 196 if (syscall(SYS_arch_prctl, ARCH_SET_GS, initial_base) != 0) 197 err(1, "ARCH_SET_GS"); 198 199 if (schedule) 200 usleep(10); 201 202 asm volatile ("mov %0, %%gs" : : "rm" (0)); 203 base = read_base(GS); 204 if (syscall(SYS_arch_prctl, ARCH_GET_GS, &arch_base) != 0) 205 err(1, "ARCH_GET_GS"); 206 if (base == arch_base) { 207 printf("[OK]\tGSBASE is 0x%lx\n", base); 208 } else { 209 nerrs++; 210 printf("[FAIL]\tGSBASE changed to 0x%lx but kernel reports 0x%lx\n", base, arch_base); 211 } 212 } 213 214 static volatile unsigned long remote_base; 215 static volatile bool remote_hard_zero; 216 static volatile unsigned int ftx; 217 218 /* 219 * ARCH_SET_FS/GS(0) may or may not program a selector of zero. HARD_ZERO 220 * means to force the selector to zero to improve test coverage. 221 */ 222 #define HARD_ZERO 0xa1fa5f343cb85fa4 223 224 static void do_remote_base() 225 { 226 unsigned long to_set = remote_base; 227 bool hard_zero = false; 228 if (to_set == HARD_ZERO) { 229 to_set = 0; 230 hard_zero = true; 231 } 232 233 if (syscall(SYS_arch_prctl, ARCH_SET_GS, to_set) != 0) 234 err(1, "ARCH_SET_GS"); 235 236 if (hard_zero) 237 asm volatile ("mov %0, %%gs" : : "rm" ((unsigned short)0)); 238 239 unsigned short sel; 240 asm volatile ("mov %%gs, %0" : "=rm" (sel)); 241 printf("\tother thread: ARCH_SET_GS(0x%lx)%s -- sel is 0x%hx\n", 242 to_set, hard_zero ? " and clear gs" : "", sel); 243 } 244 245 static __thread int set_thread_area_entry_number = -1; 246 247 static unsigned short load_gs(void) 248 { 249 /* 250 * Sets GS != 0 and GSBASE != 0 but arranges for the kernel to think 251 * that GSBASE == 0 (i.e. thread.gsbase == 0). 252 */ 253 254 /* Step 1: tell the kernel that we have GSBASE == 0. */ 255 if (syscall(SYS_arch_prctl, ARCH_SET_GS, 0) != 0) 256 err(1, "ARCH_SET_GS"); 257 258 /* Step 2: change GSBASE without telling the kernel. */ 259 struct user_desc desc = { 260 .entry_number = 0, 261 .base_addr = 0xBAADF00D, 262 .limit = 0xfffff, 263 .seg_32bit = 1, 264 .contents = 0, /* Data, grow-up */ 265 .read_exec_only = 0, 266 .limit_in_pages = 1, 267 .seg_not_present = 0, 268 .useable = 0 269 }; 270 if (syscall(SYS_modify_ldt, 1, &desc, sizeof(desc)) == 0) { 271 printf("\tusing LDT slot 0\n"); 272 asm volatile ("mov %0, %%gs" : : "rm" ((unsigned short)0x7)); 273 return 0x7; 274 } else { 275 /* No modify_ldt for us (configured out, perhaps) */ 276 277 struct user_desc *low_desc = mmap( 278 NULL, sizeof(desc), 279 PROT_READ | PROT_WRITE, 280 MAP_PRIVATE | MAP_ANONYMOUS | MAP_32BIT, -1, 0); 281 memcpy(low_desc, &desc, sizeof(desc)); 282 283 low_desc->entry_number = set_thread_area_entry_number; 284 285 /* 32-bit set_thread_area */ 286 long ret; 287 asm volatile ("int $0x80" 288 : "=a" (ret), "+m" (*low_desc) 289 : "a" (243), "b" (low_desc) 290 : "r8", "r9", "r10", "r11"); 291 memcpy(&desc, low_desc, sizeof(desc)); 292 munmap(low_desc, sizeof(desc)); 293 294 if (ret != 0) { 295 printf("[NOTE]\tcould not create a segment -- test won't do anything\n"); 296 return 0; 297 } 298 printf("\tusing GDT slot %d\n", desc.entry_number); 299 set_thread_area_entry_number = desc.entry_number; 300 301 unsigned short gs = (unsigned short)((desc.entry_number << 3) | 0x3); 302 asm volatile ("mov %0, %%gs" : : "rm" (gs)); 303 return gs; 304 } 305 } 306 307 void test_wrbase(unsigned short index, unsigned long base) 308 { 309 unsigned short newindex; 310 unsigned long newbase; 311 312 printf("[RUN]\tGS = 0x%hx, GSBASE = 0x%lx\n", index, base); 313 314 asm volatile ("mov %0, %%gs" : : "rm" (index)); 315 wrgsbase(base); 316 317 remote_base = 0; 318 ftx = 1; 319 syscall(SYS_futex, &ftx, FUTEX_WAKE, 0, NULL, NULL, 0); 320 while (ftx != 0) 321 syscall(SYS_futex, &ftx, FUTEX_WAIT, 1, NULL, NULL, 0); 322 323 asm volatile ("mov %%gs, %0" : "=rm" (newindex)); 324 newbase = rdgsbase(); 325 326 if (newindex == index && newbase == base) { 327 printf("[OK]\tIndex and base were preserved\n"); 328 } else { 329 printf("[FAIL]\tAfter switch, GS = 0x%hx and GSBASE = 0x%lx\n", 330 newindex, newbase); 331 nerrs++; 332 } 333 } 334 335 static void *threadproc(void *ctx) 336 { 337 while (1) { 338 while (ftx == 0) 339 syscall(SYS_futex, &ftx, FUTEX_WAIT, 0, NULL, NULL, 0); 340 if (ftx == 3) 341 return NULL; 342 343 if (ftx == 1) { 344 do_remote_base(); 345 } else if (ftx == 2) { 346 /* 347 * On AMD chips, this causes GSBASE != 0, GS == 0, and 348 * thread.gsbase == 0. 349 */ 350 351 load_gs(); 352 asm volatile ("mov %0, %%gs" : : "rm" ((unsigned short)0)); 353 } else { 354 errx(1, "helper thread got bad command"); 355 } 356 357 ftx = 0; 358 syscall(SYS_futex, &ftx, FUTEX_WAKE, 0, NULL, NULL, 0); 359 } 360 } 361 362 static void set_gs_and_switch_to(unsigned long local, 363 unsigned short force_sel, 364 unsigned long remote) 365 { 366 unsigned long base; 367 unsigned short sel_pre_sched, sel_post_sched; 368 369 bool hard_zero = false; 370 if (local == HARD_ZERO) { 371 hard_zero = true; 372 local = 0; 373 } 374 375 printf("[RUN]\tARCH_SET_GS(0x%lx)%s, then schedule to 0x%lx\n", 376 local, hard_zero ? " and clear gs" : "", remote); 377 if (force_sel) 378 printf("\tBefore schedule, set selector to 0x%hx\n", force_sel); 379 if (syscall(SYS_arch_prctl, ARCH_SET_GS, local) != 0) 380 err(1, "ARCH_SET_GS"); 381 if (hard_zero) 382 asm volatile ("mov %0, %%gs" : : "rm" ((unsigned short)0)); 383 384 if (read_base(GS) != local) { 385 nerrs++; 386 printf("[FAIL]\tGSBASE wasn't set as expected\n"); 387 } 388 389 if (force_sel) { 390 asm volatile ("mov %0, %%gs" : : "rm" (force_sel)); 391 sel_pre_sched = force_sel; 392 local = read_base(GS); 393 394 /* 395 * Signal delivery is quite likely to change a selector 396 * of 1, 2, or 3 back to 0 due to IRET being defective. 397 */ 398 asm volatile ("mov %0, %%gs" : : "rm" (force_sel)); 399 } else { 400 asm volatile ("mov %%gs, %0" : "=rm" (sel_pre_sched)); 401 } 402 403 remote_base = remote; 404 ftx = 1; 405 syscall(SYS_futex, &ftx, FUTEX_WAKE, 0, NULL, NULL, 0); 406 while (ftx != 0) 407 syscall(SYS_futex, &ftx, FUTEX_WAIT, 1, NULL, NULL, 0); 408 409 asm volatile ("mov %%gs, %0" : "=rm" (sel_post_sched)); 410 base = read_base(GS); 411 if (base == local && sel_pre_sched == sel_post_sched) { 412 printf("[OK]\tGS/BASE remained 0x%hx/0x%lx\n", 413 sel_pre_sched, local); 414 } else if (base == local && sel_pre_sched >= 1 && sel_pre_sched <= 3 && 415 sel_post_sched == 0) { 416 /* 417 * IRET is misdesigned and will squash selectors 1, 2, or 3 418 * to zero. Don't fail the test just because this happened. 419 */ 420 printf("[OK]\tGS/BASE changed from 0x%hx/0x%lx to 0x%hx/0x%lx because IRET is defective\n", 421 sel_pre_sched, local, sel_post_sched, base); 422 } else { 423 nerrs++; 424 printf("[FAIL]\tGS/BASE changed from 0x%hx/0x%lx to 0x%hx/0x%lx\n", 425 sel_pre_sched, local, sel_post_sched, base); 426 } 427 } 428 429 static void test_unexpected_base(void) 430 { 431 unsigned long base; 432 433 printf("[RUN]\tARCH_SET_GS(0), clear gs, then manipulate GSBASE in a different thread\n"); 434 if (syscall(SYS_arch_prctl, ARCH_SET_GS, 0) != 0) 435 err(1, "ARCH_SET_GS"); 436 asm volatile ("mov %0, %%gs" : : "rm" ((unsigned short)0)); 437 438 ftx = 2; 439 syscall(SYS_futex, &ftx, FUTEX_WAKE, 0, NULL, NULL, 0); 440 while (ftx != 0) 441 syscall(SYS_futex, &ftx, FUTEX_WAIT, 1, NULL, NULL, 0); 442 443 base = read_base(GS); 444 if (base == 0) { 445 printf("[OK]\tGSBASE remained 0\n"); 446 } else { 447 nerrs++; 448 printf("[FAIL]\tGSBASE changed to 0x%lx\n", base); 449 } 450 } 451 452 #define USER_REGS_OFFSET(r) offsetof(struct user_regs_struct, r) 453 454 static void test_ptrace_write_gs_read_base(void) 455 { 456 int status; 457 pid_t child = fork(); 458 459 if (child < 0) 460 err(1, "fork"); 461 462 if (child == 0) { 463 printf("[RUN]\tPTRACE_POKE GS, read GSBASE back\n"); 464 465 printf("[RUN]\tARCH_SET_GS to 1\n"); 466 if (syscall(SYS_arch_prctl, ARCH_SET_GS, 1) != 0) 467 err(1, "ARCH_SET_GS"); 468 469 if (ptrace(PTRACE_TRACEME, 0, NULL, NULL) != 0) 470 err(1, "PTRACE_TRACEME"); 471 472 raise(SIGTRAP); 473 _exit(0); 474 } 475 476 wait(&status); 477 478 if (WSTOPSIG(status) == SIGTRAP) { 479 unsigned long base; 480 unsigned long gs_offset = USER_REGS_OFFSET(gs); 481 unsigned long base_offset = USER_REGS_OFFSET(gs_base); 482 483 /* Read the initial base. It should be 1. */ 484 base = ptrace(PTRACE_PEEKUSER, child, base_offset, NULL); 485 if (base == 1) { 486 printf("[OK]\tGSBASE started at 1\n"); 487 } else { 488 nerrs++; 489 printf("[FAIL]\tGSBASE started at 0x%lx\n", base); 490 } 491 492 printf("[RUN]\tSet GS = 0x7, read GSBASE\n"); 493 494 /* Poke an LDT selector into GS. */ 495 if (ptrace(PTRACE_POKEUSER, child, gs_offset, 0x7) != 0) 496 err(1, "PTRACE_POKEUSER"); 497 498 /* And read the base. */ 499 base = ptrace(PTRACE_PEEKUSER, child, base_offset, NULL); 500 501 if (base == 0 || base == 1) { 502 printf("[OK]\tGSBASE reads as 0x%lx with invalid GS\n", base); 503 } else { 504 nerrs++; 505 printf("[FAIL]\tGSBASE=0x%lx (should be 0 or 1)\n", base); 506 } 507 } 508 509 ptrace(PTRACE_CONT, child, NULL, NULL); 510 511 wait(&status); 512 if (!WIFEXITED(status)) 513 printf("[WARN]\tChild didn't exit cleanly.\n"); 514 } 515 516 static void test_ptrace_write_gsbase(void) 517 { 518 int status; 519 pid_t child = fork(); 520 521 if (child < 0) 522 err(1, "fork"); 523 524 if (child == 0) { 525 printf("[RUN]\tPTRACE_POKE(), write GSBASE from ptracer\n"); 526 527 *shared_scratch = load_gs(); 528 529 if (ptrace(PTRACE_TRACEME, 0, NULL, NULL) != 0) 530 err(1, "PTRACE_TRACEME"); 531 532 raise(SIGTRAP); 533 _exit(0); 534 } 535 536 wait(&status); 537 538 if (WSTOPSIG(status) == SIGTRAP) { 539 unsigned long gs, base; 540 unsigned long gs_offset = USER_REGS_OFFSET(gs); 541 unsigned long base_offset = USER_REGS_OFFSET(gs_base); 542 543 gs = ptrace(PTRACE_PEEKUSER, child, gs_offset, NULL); 544 545 if (gs != *shared_scratch) { 546 nerrs++; 547 printf("[FAIL]\tGS is not prepared with nonzero\n"); 548 goto END; 549 } 550 551 if (ptrace(PTRACE_POKEUSER, child, base_offset, 0xFF) != 0) 552 err(1, "PTRACE_POKEUSER"); 553 554 gs = ptrace(PTRACE_PEEKUSER, child, gs_offset, NULL); 555 base = ptrace(PTRACE_PEEKUSER, child, base_offset, NULL); 556 557 /* 558 * In a non-FSGSBASE system, the nonzero selector will load 559 * GSBASE (again). But what is tested here is whether the 560 * selector value is changed or not by the GSBASE write in 561 * a ptracer. 562 */ 563 if (gs != *shared_scratch) { 564 nerrs++; 565 printf("[FAIL]\tGS changed to %lx\n", gs); 566 567 /* 568 * On older kernels, poking a nonzero value into the 569 * base would zero the selector. On newer kernels, 570 * this behavior has changed -- poking the base 571 * changes only the base and, if FSGSBASE is not 572 * available, this may have no effect once the tracee 573 * is resumed. 574 */ 575 if (gs == 0) 576 printf("\tNote: this is expected behavior on older kernels.\n"); 577 } else if (have_fsgsbase && (base != 0xFF)) { 578 nerrs++; 579 printf("[FAIL]\tGSBASE changed to %lx\n", base); 580 } else { 581 printf("[OK]\tGS remained 0x%hx", *shared_scratch); 582 if (have_fsgsbase) 583 printf(" and GSBASE changed to 0xFF"); 584 printf("\n"); 585 } 586 } 587 588 END: 589 ptrace(PTRACE_CONT, child, NULL, NULL); 590 wait(&status); 591 if (!WIFEXITED(status)) 592 printf("[WARN]\tChild didn't exit cleanly.\n"); 593 } 594 595 int main() 596 { 597 pthread_t thread; 598 599 shared_scratch = mmap(NULL, 4096, PROT_READ | PROT_WRITE, 600 MAP_ANONYMOUS | MAP_SHARED, -1, 0); 601 602 /* Do these tests before we have an LDT. */ 603 test_ptrace_write_gs_read_base(); 604 605 /* Probe FSGSBASE */ 606 sethandler(SIGILL, sigill, 0); 607 if (sigsetjmp(jmpbuf, 1) == 0) { 608 rdfsbase(); 609 have_fsgsbase = true; 610 printf("\tFSGSBASE instructions are enabled\n"); 611 } else { 612 printf("\tFSGSBASE instructions are disabled\n"); 613 } 614 clearhandler(SIGILL); 615 616 sethandler(SIGSEGV, sigsegv, 0); 617 618 check_gs_value(0); 619 check_gs_value(1); 620 check_gs_value(0x200000000); 621 check_gs_value(0); 622 check_gs_value(0x200000000); 623 check_gs_value(1); 624 625 for (int sched = 0; sched < 2; sched++) { 626 mov_0_gs(0, !!sched); 627 mov_0_gs(1, !!sched); 628 mov_0_gs(0x200000000, !!sched); 629 } 630 631 /* Set up for multithreading. */ 632 633 cpu_set_t cpuset; 634 CPU_ZERO(&cpuset); 635 CPU_SET(0, &cpuset); 636 if (sched_setaffinity(0, sizeof(cpuset), &cpuset) != 0) 637 err(1, "sched_setaffinity to CPU 0"); /* should never fail */ 638 639 if (pthread_create(&thread, 0, threadproc, 0) != 0) 640 err(1, "pthread_create"); 641 642 static unsigned long bases_with_hard_zero[] = { 643 0, HARD_ZERO, 1, 0x200000000, 644 }; 645 646 for (int local = 0; local < 4; local++) { 647 for (int remote = 0; remote < 4; remote++) { 648 for (unsigned short s = 0; s < 5; s++) { 649 unsigned short sel = s; 650 if (s == 4) 651 asm ("mov %%ss, %0" : "=rm" (sel)); 652 set_gs_and_switch_to( 653 bases_with_hard_zero[local], 654 sel, 655 bases_with_hard_zero[remote]); 656 } 657 } 658 } 659 660 test_unexpected_base(); 661 662 if (have_fsgsbase) { 663 unsigned short ss; 664 665 asm volatile ("mov %%ss, %0" : "=rm" (ss)); 666 667 test_wrbase(0, 0); 668 test_wrbase(0, 1); 669 test_wrbase(0, 0x200000000); 670 test_wrbase(0, 0xffffffffffffffff); 671 test_wrbase(ss, 0); 672 test_wrbase(ss, 1); 673 test_wrbase(ss, 0x200000000); 674 test_wrbase(ss, 0xffffffffffffffff); 675 } 676 677 ftx = 3; /* Kill the thread. */ 678 syscall(SYS_futex, &ftx, FUTEX_WAKE, 0, NULL, NULL, 0); 679 680 if (pthread_join(thread, NULL) != 0) 681 err(1, "pthread_join"); 682 683 test_ptrace_write_gsbase(); 684 685 return nerrs == 0 ? 0 : 1; 686 } 687