1 /* 2 * ldt_gdt.c - Test cases for LDT and GDT access 3 * Copyright (c) 2015 Andrew Lutomirski 4 */ 5 6 #define _GNU_SOURCE 7 #include <err.h> 8 #include <stdio.h> 9 #include <stdint.h> 10 #include <signal.h> 11 #include <setjmp.h> 12 #include <stdlib.h> 13 #include <string.h> 14 #include <errno.h> 15 #include <unistd.h> 16 #include <sys/syscall.h> 17 #include <asm/ldt.h> 18 #include <sys/types.h> 19 #include <sys/wait.h> 20 #include <stdbool.h> 21 #include <pthread.h> 22 #include <sched.h> 23 #include <linux/futex.h> 24 #include <sys/mman.h> 25 #include <asm/prctl.h> 26 #include <sys/prctl.h> 27 28 #define AR_ACCESSED (1<<8) 29 30 #define AR_TYPE_RODATA (0 * (1<<9)) 31 #define AR_TYPE_RWDATA (1 * (1<<9)) 32 #define AR_TYPE_RODATA_EXPDOWN (2 * (1<<9)) 33 #define AR_TYPE_RWDATA_EXPDOWN (3 * (1<<9)) 34 #define AR_TYPE_XOCODE (4 * (1<<9)) 35 #define AR_TYPE_XRCODE (5 * (1<<9)) 36 #define AR_TYPE_XOCODE_CONF (6 * (1<<9)) 37 #define AR_TYPE_XRCODE_CONF (7 * (1<<9)) 38 39 #define AR_DPL3 (3 * (1<<13)) 40 41 #define AR_S (1 << 12) 42 #define AR_P (1 << 15) 43 #define AR_AVL (1 << 20) 44 #define AR_L (1 << 21) 45 #define AR_DB (1 << 22) 46 #define AR_G (1 << 23) 47 48 #ifdef __x86_64__ 49 # define INT80_CLOBBERS "r8", "r9", "r10", "r11" 50 #else 51 # define INT80_CLOBBERS 52 #endif 53 54 static int nerrs; 55 56 /* Points to an array of 1024 ints, each holding its own index. */ 57 static const unsigned int *counter_page; 58 static struct user_desc *low_user_desc; 59 static struct user_desc *low_user_desc_clear; /* Use to delete GDT entry */ 60 static int gdt_entry_num; 61 62 static void check_invalid_segment(uint16_t index, int ldt) 63 { 64 uint32_t has_limit = 0, has_ar = 0, limit, ar; 65 uint32_t selector = (index << 3) | (ldt << 2) | 3; 66 67 asm ("lsl %[selector], %[limit]\n\t" 68 "jnz 1f\n\t" 69 "movl $1, %[has_limit]\n\t" 70 "1:" 71 : [limit] "=r" (limit), [has_limit] "+rm" (has_limit) 72 : [selector] "r" (selector)); 73 asm ("larl %[selector], %[ar]\n\t" 74 "jnz 1f\n\t" 75 "movl $1, %[has_ar]\n\t" 76 "1:" 77 : [ar] "=r" (ar), [has_ar] "+rm" (has_ar) 78 : [selector] "r" (selector)); 79 80 if (has_limit || has_ar) { 81 printf("[FAIL]\t%s entry %hu is valid but should be invalid\n", 82 (ldt ? "LDT" : "GDT"), index); 83 nerrs++; 84 } else { 85 printf("[OK]\t%s entry %hu is invalid\n", 86 (ldt ? "LDT" : "GDT"), index); 87 } 88 } 89 90 static void check_valid_segment(uint16_t index, int ldt, 91 uint32_t expected_ar, uint32_t expected_limit, 92 bool verbose) 93 { 94 uint32_t has_limit = 0, has_ar = 0, limit, ar; 95 uint32_t selector = (index << 3) | (ldt << 2) | 3; 96 97 asm ("lsl %[selector], %[limit]\n\t" 98 "jnz 1f\n\t" 99 "movl $1, %[has_limit]\n\t" 100 "1:" 101 : [limit] "=r" (limit), [has_limit] "+rm" (has_limit) 102 : [selector] "r" (selector)); 103 asm ("larl %[selector], %[ar]\n\t" 104 "jnz 1f\n\t" 105 "movl $1, %[has_ar]\n\t" 106 "1:" 107 : [ar] "=r" (ar), [has_ar] "+rm" (has_ar) 108 : [selector] "r" (selector)); 109 110 if (!has_limit || !has_ar) { 111 printf("[FAIL]\t%s entry %hu is invalid but should be valid\n", 112 (ldt ? "LDT" : "GDT"), index); 113 nerrs++; 114 return; 115 } 116 117 if (ar != expected_ar) { 118 printf("[FAIL]\t%s entry %hu has AR 0x%08X but expected 0x%08X\n", 119 (ldt ? "LDT" : "GDT"), index, ar, expected_ar); 120 nerrs++; 121 } else if (limit != expected_limit) { 122 printf("[FAIL]\t%s entry %hu has limit 0x%08X but expected 0x%08X\n", 123 (ldt ? "LDT" : "GDT"), index, limit, expected_limit); 124 nerrs++; 125 } else if (verbose) { 126 printf("[OK]\t%s entry %hu has AR 0x%08X and limit 0x%08X\n", 127 (ldt ? "LDT" : "GDT"), index, ar, limit); 128 } 129 } 130 131 static bool install_valid_mode(const struct user_desc *desc, uint32_t ar, 132 bool oldmode) 133 { 134 int ret = syscall(SYS_modify_ldt, oldmode ? 1 : 0x11, 135 desc, sizeof(*desc)); 136 if (ret < -1) 137 errno = -ret; 138 if (ret == 0) { 139 uint32_t limit = desc->limit; 140 if (desc->limit_in_pages) 141 limit = (limit << 12) + 4095; 142 check_valid_segment(desc->entry_number, 1, ar, limit, true); 143 return true; 144 } else if (errno == ENOSYS) { 145 printf("[OK]\tmodify_ldt returned -ENOSYS\n"); 146 return false; 147 } else { 148 if (desc->seg_32bit) { 149 printf("[FAIL]\tUnexpected modify_ldt failure %d\n", 150 errno); 151 nerrs++; 152 return false; 153 } else { 154 printf("[OK]\tmodify_ldt rejected 16 bit segment\n"); 155 return false; 156 } 157 } 158 } 159 160 static bool install_valid(const struct user_desc *desc, uint32_t ar) 161 { 162 return install_valid_mode(desc, ar, false); 163 } 164 165 static void install_invalid(const struct user_desc *desc, bool oldmode) 166 { 167 int ret = syscall(SYS_modify_ldt, oldmode ? 1 : 0x11, 168 desc, sizeof(*desc)); 169 if (ret < -1) 170 errno = -ret; 171 if (ret == 0) { 172 check_invalid_segment(desc->entry_number, 1); 173 } else if (errno == ENOSYS) { 174 printf("[OK]\tmodify_ldt returned -ENOSYS\n"); 175 } else { 176 if (desc->seg_32bit) { 177 printf("[FAIL]\tUnexpected modify_ldt failure %d\n", 178 errno); 179 nerrs++; 180 } else { 181 printf("[OK]\tmodify_ldt rejected 16 bit segment\n"); 182 } 183 } 184 } 185 186 static int safe_modify_ldt(int func, struct user_desc *ptr, 187 unsigned long bytecount) 188 { 189 int ret = syscall(SYS_modify_ldt, 0x11, ptr, bytecount); 190 if (ret < -1) 191 errno = -ret; 192 return ret; 193 } 194 195 static void fail_install(struct user_desc *desc) 196 { 197 if (safe_modify_ldt(0x11, desc, sizeof(*desc)) == 0) { 198 printf("[FAIL]\tmodify_ldt accepted a bad descriptor\n"); 199 nerrs++; 200 } else if (errno == ENOSYS) { 201 printf("[OK]\tmodify_ldt returned -ENOSYS\n"); 202 } else { 203 printf("[OK]\tmodify_ldt failure %d\n", errno); 204 } 205 } 206 207 static void do_simple_tests(void) 208 { 209 struct user_desc desc = { 210 .entry_number = 0, 211 .base_addr = 0, 212 .limit = 10, 213 .seg_32bit = 1, 214 .contents = 2, /* Code, not conforming */ 215 .read_exec_only = 0, 216 .limit_in_pages = 0, 217 .seg_not_present = 0, 218 .useable = 0 219 }; 220 install_valid(&desc, AR_DPL3 | AR_TYPE_XRCODE | AR_S | AR_P | AR_DB); 221 222 desc.limit_in_pages = 1; 223 install_valid(&desc, AR_DPL3 | AR_TYPE_XRCODE | 224 AR_S | AR_P | AR_DB | AR_G); 225 226 check_invalid_segment(1, 1); 227 228 desc.entry_number = 2; 229 install_valid(&desc, AR_DPL3 | AR_TYPE_XRCODE | 230 AR_S | AR_P | AR_DB | AR_G); 231 232 check_invalid_segment(1, 1); 233 234 desc.base_addr = 0xf0000000; 235 install_valid(&desc, AR_DPL3 | AR_TYPE_XRCODE | 236 AR_S | AR_P | AR_DB | AR_G); 237 238 desc.useable = 1; 239 install_valid(&desc, AR_DPL3 | AR_TYPE_XRCODE | 240 AR_S | AR_P | AR_DB | AR_G | AR_AVL); 241 242 desc.seg_not_present = 1; 243 install_valid(&desc, AR_DPL3 | AR_TYPE_XRCODE | 244 AR_S | AR_DB | AR_G | AR_AVL); 245 246 desc.seg_32bit = 0; 247 install_valid(&desc, AR_DPL3 | AR_TYPE_XRCODE | 248 AR_S | AR_G | AR_AVL); 249 250 desc.seg_32bit = 1; 251 desc.contents = 0; 252 install_valid(&desc, AR_DPL3 | AR_TYPE_RWDATA | 253 AR_S | AR_DB | AR_G | AR_AVL); 254 255 desc.read_exec_only = 1; 256 install_valid(&desc, AR_DPL3 | AR_TYPE_RODATA | 257 AR_S | AR_DB | AR_G | AR_AVL); 258 259 desc.contents = 1; 260 install_valid(&desc, AR_DPL3 | AR_TYPE_RODATA_EXPDOWN | 261 AR_S | AR_DB | AR_G | AR_AVL); 262 263 desc.read_exec_only = 0; 264 desc.limit_in_pages = 0; 265 install_valid(&desc, AR_DPL3 | AR_TYPE_RWDATA_EXPDOWN | 266 AR_S | AR_DB | AR_AVL); 267 268 desc.contents = 3; 269 install_valid(&desc, AR_DPL3 | AR_TYPE_XRCODE_CONF | 270 AR_S | AR_DB | AR_AVL); 271 272 desc.read_exec_only = 1; 273 install_valid(&desc, AR_DPL3 | AR_TYPE_XOCODE_CONF | 274 AR_S | AR_DB | AR_AVL); 275 276 desc.read_exec_only = 0; 277 desc.contents = 2; 278 install_valid(&desc, AR_DPL3 | AR_TYPE_XRCODE | 279 AR_S | AR_DB | AR_AVL); 280 281 desc.read_exec_only = 1; 282 283 #ifdef __x86_64__ 284 desc.lm = 1; 285 install_valid(&desc, AR_DPL3 | AR_TYPE_XOCODE | 286 AR_S | AR_DB | AR_AVL); 287 desc.lm = 0; 288 #endif 289 290 bool entry1_okay = install_valid(&desc, AR_DPL3 | AR_TYPE_XOCODE | 291 AR_S | AR_DB | AR_AVL); 292 293 if (entry1_okay) { 294 printf("[RUN]\tTest fork\n"); 295 pid_t child = fork(); 296 if (child == 0) { 297 nerrs = 0; 298 check_valid_segment(desc.entry_number, 1, 299 AR_DPL3 | AR_TYPE_XOCODE | 300 AR_S | AR_DB | AR_AVL, desc.limit, 301 true); 302 check_invalid_segment(1, 1); 303 exit(nerrs ? 1 : 0); 304 } else { 305 int status; 306 if (waitpid(child, &status, 0) != child || 307 !WIFEXITED(status)) { 308 printf("[FAIL]\tChild died\n"); 309 nerrs++; 310 } else if (WEXITSTATUS(status) != 0) { 311 printf("[FAIL]\tChild failed\n"); 312 nerrs++; 313 } else { 314 printf("[OK]\tChild succeeded\n"); 315 } 316 } 317 318 printf("[RUN]\tTest size\n"); 319 int i; 320 for (i = 0; i < 8192; i++) { 321 desc.entry_number = i; 322 desc.limit = i; 323 if (safe_modify_ldt(0x11, &desc, sizeof(desc)) != 0) { 324 printf("[FAIL]\tFailed to install entry %d\n", i); 325 nerrs++; 326 break; 327 } 328 } 329 for (int j = 0; j < i; j++) { 330 check_valid_segment(j, 1, AR_DPL3 | AR_TYPE_XOCODE | 331 AR_S | AR_DB | AR_AVL, j, false); 332 } 333 printf("[DONE]\tSize test\n"); 334 } else { 335 printf("[SKIP]\tSkipping fork and size tests because we have no LDT\n"); 336 } 337 338 /* Test entry_number too high. */ 339 desc.entry_number = 8192; 340 fail_install(&desc); 341 342 /* Test deletion and actions mistakeable for deletion. */ 343 memset(&desc, 0, sizeof(desc)); 344 install_valid(&desc, AR_DPL3 | AR_TYPE_RWDATA | AR_S | AR_P); 345 346 desc.seg_not_present = 1; 347 install_valid(&desc, AR_DPL3 | AR_TYPE_RWDATA | AR_S); 348 349 desc.seg_not_present = 0; 350 desc.read_exec_only = 1; 351 install_valid(&desc, AR_DPL3 | AR_TYPE_RODATA | AR_S | AR_P); 352 353 desc.read_exec_only = 0; 354 desc.seg_not_present = 1; 355 install_valid(&desc, AR_DPL3 | AR_TYPE_RWDATA | AR_S); 356 357 desc.read_exec_only = 1; 358 desc.limit = 1; 359 install_valid(&desc, AR_DPL3 | AR_TYPE_RODATA | AR_S); 360 361 desc.limit = 0; 362 desc.base_addr = 1; 363 install_valid(&desc, AR_DPL3 | AR_TYPE_RODATA | AR_S); 364 365 desc.base_addr = 0; 366 install_invalid(&desc, false); 367 368 desc.seg_not_present = 0; 369 desc.read_exec_only = 0; 370 desc.seg_32bit = 1; 371 install_valid(&desc, AR_DPL3 | AR_TYPE_RWDATA | AR_S | AR_P | AR_DB); 372 install_invalid(&desc, true); 373 } 374 375 /* 376 * 0: thread is idle 377 * 1: thread armed 378 * 2: thread should clear LDT entry 0 379 * 3: thread should exit 380 */ 381 static volatile unsigned int ftx; 382 383 static void *threadproc(void *ctx) 384 { 385 cpu_set_t cpuset; 386 CPU_ZERO(&cpuset); 387 CPU_SET(1, &cpuset); 388 if (sched_setaffinity(0, sizeof(cpuset), &cpuset) != 0) 389 err(1, "sched_setaffinity to CPU 1"); /* should never fail */ 390 391 while (1) { 392 syscall(SYS_futex, &ftx, FUTEX_WAIT, 0, NULL, NULL, 0); 393 while (ftx != 2) { 394 if (ftx >= 3) 395 return NULL; 396 } 397 398 /* clear LDT entry 0 */ 399 const struct user_desc desc = {}; 400 if (syscall(SYS_modify_ldt, 1, &desc, sizeof(desc)) != 0) 401 err(1, "modify_ldt"); 402 403 /* If ftx == 2, set it to zero. If ftx == 100, quit. */ 404 unsigned int x = -2; 405 asm volatile ("lock xaddl %[x], %[ftx]" : 406 [x] "+r" (x), [ftx] "+m" (ftx)); 407 if (x != 2) 408 return NULL; 409 } 410 } 411 412 #ifdef __i386__ 413 414 #ifndef SA_RESTORE 415 #define SA_RESTORER 0x04000000 416 #endif 417 418 /* 419 * The UAPI header calls this 'struct sigaction', which conflicts with 420 * glibc. Sigh. 421 */ 422 struct fake_ksigaction { 423 void *handler; /* the real type is nasty */ 424 unsigned long sa_flags; 425 void (*sa_restorer)(void); 426 unsigned char sigset[8]; 427 }; 428 429 static void fix_sa_restorer(int sig) 430 { 431 struct fake_ksigaction ksa; 432 433 if (syscall(SYS_rt_sigaction, sig, NULL, &ksa, 8) == 0) { 434 /* 435 * glibc has a nasty bug: it sometimes writes garbage to 436 * sa_restorer. This interacts quite badly with anything 437 * that fiddles with SS because it can trigger legacy 438 * stack switching. Patch it up. See: 439 * 440 * https://sourceware.org/bugzilla/show_bug.cgi?id=21269 441 */ 442 if (!(ksa.sa_flags & SA_RESTORER) && ksa.sa_restorer) { 443 ksa.sa_restorer = NULL; 444 if (syscall(SYS_rt_sigaction, sig, &ksa, NULL, 445 sizeof(ksa.sigset)) != 0) 446 err(1, "rt_sigaction"); 447 } 448 } 449 } 450 #else 451 static void fix_sa_restorer(int sig) 452 { 453 /* 64-bit glibc works fine. */ 454 } 455 #endif 456 457 static void sethandler(int sig, void (*handler)(int, siginfo_t *, void *), 458 int flags) 459 { 460 struct sigaction sa; 461 memset(&sa, 0, sizeof(sa)); 462 sa.sa_sigaction = handler; 463 sa.sa_flags = SA_SIGINFO | flags; 464 sigemptyset(&sa.sa_mask); 465 if (sigaction(sig, &sa, 0)) 466 err(1, "sigaction"); 467 468 fix_sa_restorer(sig); 469 } 470 471 static jmp_buf jmpbuf; 472 473 static void sigsegv(int sig, siginfo_t *info, void *ctx_void) 474 { 475 siglongjmp(jmpbuf, 1); 476 } 477 478 static void do_multicpu_tests(void) 479 { 480 cpu_set_t cpuset; 481 pthread_t thread; 482 int failures = 0, iters = 5, i; 483 unsigned short orig_ss; 484 485 CPU_ZERO(&cpuset); 486 CPU_SET(1, &cpuset); 487 if (sched_setaffinity(0, sizeof(cpuset), &cpuset) != 0) { 488 printf("[SKIP]\tCannot set affinity to CPU 1\n"); 489 return; 490 } 491 492 CPU_ZERO(&cpuset); 493 CPU_SET(0, &cpuset); 494 if (sched_setaffinity(0, sizeof(cpuset), &cpuset) != 0) { 495 printf("[SKIP]\tCannot set affinity to CPU 0\n"); 496 return; 497 } 498 499 sethandler(SIGSEGV, sigsegv, 0); 500 #ifdef __i386__ 501 /* True 32-bit kernels send SIGILL instead of SIGSEGV on IRET faults. */ 502 sethandler(SIGILL, sigsegv, 0); 503 #endif 504 505 printf("[RUN]\tCross-CPU LDT invalidation\n"); 506 507 if (pthread_create(&thread, 0, threadproc, 0) != 0) 508 err(1, "pthread_create"); 509 510 asm volatile ("mov %%ss, %0" : "=rm" (orig_ss)); 511 512 for (i = 0; i < 5; i++) { 513 if (sigsetjmp(jmpbuf, 1) != 0) 514 continue; 515 516 /* Make sure the thread is ready after the last test. */ 517 while (ftx != 0) 518 ; 519 520 struct user_desc desc = { 521 .entry_number = 0, 522 .base_addr = 0, 523 .limit = 0xfffff, 524 .seg_32bit = 1, 525 .contents = 0, /* Data */ 526 .read_exec_only = 0, 527 .limit_in_pages = 1, 528 .seg_not_present = 0, 529 .useable = 0 530 }; 531 532 if (safe_modify_ldt(0x11, &desc, sizeof(desc)) != 0) { 533 if (errno != ENOSYS) 534 err(1, "modify_ldt"); 535 printf("[SKIP]\tmodify_ldt unavailable\n"); 536 break; 537 } 538 539 /* Arm the thread. */ 540 ftx = 1; 541 syscall(SYS_futex, &ftx, FUTEX_WAKE, 0, NULL, NULL, 0); 542 543 asm volatile ("mov %0, %%ss" : : "r" (0x7)); 544 545 /* Go! */ 546 ftx = 2; 547 548 while (ftx != 0) 549 ; 550 551 /* 552 * On success, modify_ldt will segfault us synchronously, 553 * and we'll escape via siglongjmp. 554 */ 555 556 failures++; 557 asm volatile ("mov %0, %%ss" : : "rm" (orig_ss)); 558 }; 559 560 ftx = 100; /* Kill the thread. */ 561 syscall(SYS_futex, &ftx, FUTEX_WAKE, 0, NULL, NULL, 0); 562 563 if (pthread_join(thread, NULL) != 0) 564 err(1, "pthread_join"); 565 566 if (failures) { 567 printf("[FAIL]\t%d of %d iterations failed\n", failures, iters); 568 nerrs++; 569 } else { 570 printf("[OK]\tAll %d iterations succeeded\n", iters); 571 } 572 } 573 574 static int finish_exec_test(void) 575 { 576 /* 577 * In a sensible world, this would be check_invalid_segment(0, 1); 578 * For better or for worse, though, the LDT is inherited across exec. 579 * We can probably change this safely, but for now we test it. 580 */ 581 check_valid_segment(0, 1, 582 AR_DPL3 | AR_TYPE_XRCODE | AR_S | AR_P | AR_DB, 583 42, true); 584 585 return nerrs ? 1 : 0; 586 } 587 588 static void do_exec_test(void) 589 { 590 printf("[RUN]\tTest exec\n"); 591 592 struct user_desc desc = { 593 .entry_number = 0, 594 .base_addr = 0, 595 .limit = 42, 596 .seg_32bit = 1, 597 .contents = 2, /* Code, not conforming */ 598 .read_exec_only = 0, 599 .limit_in_pages = 0, 600 .seg_not_present = 0, 601 .useable = 0 602 }; 603 install_valid(&desc, AR_DPL3 | AR_TYPE_XRCODE | AR_S | AR_P | AR_DB); 604 605 pid_t child = fork(); 606 if (child == 0) { 607 execl("/proc/self/exe", "ldt_gdt_test_exec", NULL); 608 printf("[FAIL]\tCould not exec self\n"); 609 exit(1); /* exec failed */ 610 } else { 611 int status; 612 if (waitpid(child, &status, 0) != child || 613 !WIFEXITED(status)) { 614 printf("[FAIL]\tChild died\n"); 615 nerrs++; 616 } else if (WEXITSTATUS(status) != 0) { 617 printf("[FAIL]\tChild failed\n"); 618 nerrs++; 619 } else { 620 printf("[OK]\tChild succeeded\n"); 621 } 622 } 623 } 624 625 static void setup_counter_page(void) 626 { 627 unsigned int *page = mmap(NULL, 4096, PROT_READ | PROT_WRITE, 628 MAP_ANONYMOUS | MAP_PRIVATE | MAP_32BIT, -1, 0); 629 if (page == MAP_FAILED) 630 err(1, "mmap"); 631 632 for (int i = 0; i < 1024; i++) 633 page[i] = i; 634 counter_page = page; 635 } 636 637 static int invoke_set_thread_area(void) 638 { 639 int ret; 640 asm volatile ("int $0x80" 641 : "=a" (ret), "+m" (low_user_desc) : 642 "a" (243), "b" (low_user_desc) 643 : INT80_CLOBBERS); 644 return ret; 645 } 646 647 static void setup_low_user_desc(void) 648 { 649 low_user_desc = mmap(NULL, 2 * sizeof(struct user_desc), 650 PROT_READ | PROT_WRITE, 651 MAP_ANONYMOUS | MAP_PRIVATE | MAP_32BIT, -1, 0); 652 if (low_user_desc == MAP_FAILED) 653 err(1, "mmap"); 654 655 low_user_desc->entry_number = -1; 656 low_user_desc->base_addr = (unsigned long)&counter_page[1]; 657 low_user_desc->limit = 0xfffff; 658 low_user_desc->seg_32bit = 1; 659 low_user_desc->contents = 0; /* Data, grow-up*/ 660 low_user_desc->read_exec_only = 0; 661 low_user_desc->limit_in_pages = 1; 662 low_user_desc->seg_not_present = 0; 663 low_user_desc->useable = 0; 664 665 if (invoke_set_thread_area() == 0) { 666 gdt_entry_num = low_user_desc->entry_number; 667 printf("[NOTE]\tset_thread_area is available; will use GDT index %d\n", gdt_entry_num); 668 } else { 669 printf("[NOTE]\tset_thread_area is unavailable\n"); 670 } 671 672 low_user_desc_clear = low_user_desc + 1; 673 low_user_desc_clear->entry_number = gdt_entry_num; 674 low_user_desc_clear->read_exec_only = 1; 675 low_user_desc_clear->seg_not_present = 1; 676 } 677 678 static void test_gdt_invalidation(void) 679 { 680 if (!gdt_entry_num) 681 return; /* 64-bit only system -- we can't use set_thread_area */ 682 683 unsigned short prev_sel; 684 unsigned short sel; 685 unsigned int eax; 686 const char *result; 687 #ifdef __x86_64__ 688 unsigned long saved_base; 689 unsigned long new_base; 690 #endif 691 692 /* Test DS */ 693 invoke_set_thread_area(); 694 eax = 243; 695 sel = (gdt_entry_num << 3) | 3; 696 asm volatile ("movw %%ds, %[prev_sel]\n\t" 697 "movw %[sel], %%ds\n\t" 698 #ifdef __i386__ 699 "pushl %%ebx\n\t" 700 #endif 701 "movl %[arg1], %%ebx\n\t" 702 "int $0x80\n\t" /* Should invalidate ds */ 703 #ifdef __i386__ 704 "popl %%ebx\n\t" 705 #endif 706 "movw %%ds, %[sel]\n\t" 707 "movw %[prev_sel], %%ds" 708 : [prev_sel] "=&r" (prev_sel), [sel] "+r" (sel), 709 "+a" (eax) 710 : "m" (low_user_desc_clear), 711 [arg1] "r" ((unsigned int)(unsigned long)low_user_desc_clear) 712 : INT80_CLOBBERS); 713 714 if (sel != 0) { 715 result = "FAIL"; 716 nerrs++; 717 } else { 718 result = "OK"; 719 } 720 printf("[%s]\tInvalidate DS with set_thread_area: new DS = 0x%hx\n", 721 result, sel); 722 723 /* Test ES */ 724 invoke_set_thread_area(); 725 eax = 243; 726 sel = (gdt_entry_num << 3) | 3; 727 asm volatile ("movw %%es, %[prev_sel]\n\t" 728 "movw %[sel], %%es\n\t" 729 #ifdef __i386__ 730 "pushl %%ebx\n\t" 731 #endif 732 "movl %[arg1], %%ebx\n\t" 733 "int $0x80\n\t" /* Should invalidate es */ 734 #ifdef __i386__ 735 "popl %%ebx\n\t" 736 #endif 737 "movw %%es, %[sel]\n\t" 738 "movw %[prev_sel], %%es" 739 : [prev_sel] "=&r" (prev_sel), [sel] "+r" (sel), 740 "+a" (eax) 741 : "m" (low_user_desc_clear), 742 [arg1] "r" ((unsigned int)(unsigned long)low_user_desc_clear) 743 : INT80_CLOBBERS); 744 745 if (sel != 0) { 746 result = "FAIL"; 747 nerrs++; 748 } else { 749 result = "OK"; 750 } 751 printf("[%s]\tInvalidate ES with set_thread_area: new ES = 0x%hx\n", 752 result, sel); 753 754 /* Test FS */ 755 invoke_set_thread_area(); 756 eax = 243; 757 sel = (gdt_entry_num << 3) | 3; 758 #ifdef __x86_64__ 759 syscall(SYS_arch_prctl, ARCH_GET_FS, &saved_base); 760 #endif 761 asm volatile ("movw %%fs, %[prev_sel]\n\t" 762 "movw %[sel], %%fs\n\t" 763 #ifdef __i386__ 764 "pushl %%ebx\n\t" 765 #endif 766 "movl %[arg1], %%ebx\n\t" 767 "int $0x80\n\t" /* Should invalidate fs */ 768 #ifdef __i386__ 769 "popl %%ebx\n\t" 770 #endif 771 "movw %%fs, %[sel]\n\t" 772 : [prev_sel] "=&r" (prev_sel), [sel] "+r" (sel), 773 "+a" (eax) 774 : "m" (low_user_desc_clear), 775 [arg1] "r" ((unsigned int)(unsigned long)low_user_desc_clear) 776 : INT80_CLOBBERS); 777 778 #ifdef __x86_64__ 779 syscall(SYS_arch_prctl, ARCH_GET_FS, &new_base); 780 #endif 781 782 /* Restore FS/BASE for glibc */ 783 asm volatile ("movw %[prev_sel], %%fs" : : [prev_sel] "rm" (prev_sel)); 784 #ifdef __x86_64__ 785 if (saved_base) 786 syscall(SYS_arch_prctl, ARCH_SET_FS, saved_base); 787 #endif 788 789 if (sel != 0) { 790 result = "FAIL"; 791 nerrs++; 792 } else { 793 result = "OK"; 794 } 795 printf("[%s]\tInvalidate FS with set_thread_area: new FS = 0x%hx\n", 796 result, sel); 797 798 #ifdef __x86_64__ 799 if (sel == 0 && new_base != 0) { 800 nerrs++; 801 printf("[FAIL]\tNew FSBASE was 0x%lx\n", new_base); 802 } else { 803 printf("[OK]\tNew FSBASE was zero\n"); 804 } 805 #endif 806 807 /* Test GS */ 808 invoke_set_thread_area(); 809 eax = 243; 810 sel = (gdt_entry_num << 3) | 3; 811 #ifdef __x86_64__ 812 syscall(SYS_arch_prctl, ARCH_GET_GS, &saved_base); 813 #endif 814 asm volatile ("movw %%gs, %[prev_sel]\n\t" 815 "movw %[sel], %%gs\n\t" 816 #ifdef __i386__ 817 "pushl %%ebx\n\t" 818 #endif 819 "movl %[arg1], %%ebx\n\t" 820 "int $0x80\n\t" /* Should invalidate gs */ 821 #ifdef __i386__ 822 "popl %%ebx\n\t" 823 #endif 824 "movw %%gs, %[sel]\n\t" 825 : [prev_sel] "=&r" (prev_sel), [sel] "+r" (sel), 826 "+a" (eax) 827 : "m" (low_user_desc_clear), 828 [arg1] "r" ((unsigned int)(unsigned long)low_user_desc_clear) 829 : INT80_CLOBBERS); 830 831 #ifdef __x86_64__ 832 syscall(SYS_arch_prctl, ARCH_GET_GS, &new_base); 833 #endif 834 835 /* Restore GS/BASE for glibc */ 836 asm volatile ("movw %[prev_sel], %%gs" : : [prev_sel] "rm" (prev_sel)); 837 #ifdef __x86_64__ 838 if (saved_base) 839 syscall(SYS_arch_prctl, ARCH_SET_GS, saved_base); 840 #endif 841 842 if (sel != 0) { 843 result = "FAIL"; 844 nerrs++; 845 } else { 846 result = "OK"; 847 } 848 printf("[%s]\tInvalidate GS with set_thread_area: new GS = 0x%hx\n", 849 result, sel); 850 851 #ifdef __x86_64__ 852 if (sel == 0 && new_base != 0) { 853 nerrs++; 854 printf("[FAIL]\tNew GSBASE was 0x%lx\n", new_base); 855 } else { 856 printf("[OK]\tNew GSBASE was zero\n"); 857 } 858 #endif 859 } 860 861 int main(int argc, char **argv) 862 { 863 if (argc == 1 && !strcmp(argv[0], "ldt_gdt_test_exec")) 864 return finish_exec_test(); 865 866 setup_counter_page(); 867 setup_low_user_desc(); 868 869 do_simple_tests(); 870 871 do_multicpu_tests(); 872 873 do_exec_test(); 874 875 test_gdt_invalidation(); 876 877 return nerrs ? 1 : 0; 878 } 879