2 * ldt_gdt.c - Test cases for LDT and GDT access
3 * Copyright (c) 2015 Andrew Lutomirski
16 #include <sys/syscall.h>
18 #include <sys/types.h>
23 #include <linux/futex.h>
25 #define AR_ACCESSED (1<<8)
27 #define AR_TYPE_RODATA (0 * (1<<9))
28 #define AR_TYPE_RWDATA (1 * (1<<9))
29 #define AR_TYPE_RODATA_EXPDOWN (2 * (1<<9))
30 #define AR_TYPE_RWDATA_EXPDOWN (3 * (1<<9))
31 #define AR_TYPE_XOCODE (4 * (1<<9))
32 #define AR_TYPE_XRCODE (5 * (1<<9))
33 #define AR_TYPE_XOCODE_CONF (6 * (1<<9))
34 #define AR_TYPE_XRCODE_CONF (7 * (1<<9))
36 #define AR_DPL3 (3 * (1<<13))
38 #define AR_S (1 << 12)
39 #define AR_P (1 << 15)
40 #define AR_AVL (1 << 20)
41 #define AR_L (1 << 21)
42 #define AR_DB (1 << 22)
43 #define AR_G (1 << 23)
47 static void check_invalid_segment(uint16_t index
, int ldt
)
49 uint32_t has_limit
= 0, has_ar
= 0, limit
, ar
;
50 uint32_t selector
= (index
<< 3) | (ldt
<< 2) | 3;
52 asm ("lsl %[selector], %[limit]\n\t"
54 "movl $1, %[has_limit]\n\t"
56 : [limit
] "=r" (limit
), [has_limit
] "+rm" (has_limit
)
57 : [selector
] "r" (selector
));
58 asm ("larl %[selector], %[ar]\n\t"
60 "movl $1, %[has_ar]\n\t"
62 : [ar
] "=r" (ar
), [has_ar
] "+rm" (has_ar
)
63 : [selector
] "r" (selector
));
65 if (has_limit
|| has_ar
) {
66 printf("[FAIL]\t%s entry %hu is valid but should be invalid\n",
67 (ldt
? "LDT" : "GDT"), index
);
70 printf("[OK]\t%s entry %hu is invalid\n",
71 (ldt
? "LDT" : "GDT"), index
);
75 static void check_valid_segment(uint16_t index
, int ldt
,
76 uint32_t expected_ar
, uint32_t expected_limit
,
79 uint32_t has_limit
= 0, has_ar
= 0, limit
, ar
;
80 uint32_t selector
= (index
<< 3) | (ldt
<< 2) | 3;
82 asm ("lsl %[selector], %[limit]\n\t"
84 "movl $1, %[has_limit]\n\t"
86 : [limit
] "=r" (limit
), [has_limit
] "+rm" (has_limit
)
87 : [selector
] "r" (selector
));
88 asm ("larl %[selector], %[ar]\n\t"
90 "movl $1, %[has_ar]\n\t"
92 : [ar
] "=r" (ar
), [has_ar
] "+rm" (has_ar
)
93 : [selector
] "r" (selector
));
95 if (!has_limit
|| !has_ar
) {
96 printf("[FAIL]\t%s entry %hu is invalid but should be valid\n",
97 (ldt
? "LDT" : "GDT"), index
);
102 if (ar
!= expected_ar
) {
103 printf("[FAIL]\t%s entry %hu has AR 0x%08X but expected 0x%08X\n",
104 (ldt
? "LDT" : "GDT"), index
, ar
, expected_ar
);
106 } else if (limit
!= expected_limit
) {
107 printf("[FAIL]\t%s entry %hu has limit 0x%08X but expected 0x%08X\n",
108 (ldt
? "LDT" : "GDT"), index
, limit
, expected_limit
);
110 } else if (verbose
) {
111 printf("[OK]\t%s entry %hu has AR 0x%08X and limit 0x%08X\n",
112 (ldt
? "LDT" : "GDT"), index
, ar
, limit
);
116 static bool install_valid_mode(const struct user_desc
*desc
, uint32_t ar
,
119 int ret
= syscall(SYS_modify_ldt
, oldmode
? 1 : 0x11,
120 desc
, sizeof(*desc
));
124 uint32_t limit
= desc
->limit
;
125 if (desc
->limit_in_pages
)
126 limit
= (limit
<< 12) + 4095;
127 check_valid_segment(desc
->entry_number
, 1, ar
, limit
, true);
129 } else if (errno
== ENOSYS
) {
130 printf("[OK]\tmodify_ldt returned -ENOSYS\n");
133 if (desc
->seg_32bit
) {
134 printf("[FAIL]\tUnexpected modify_ldt failure %d\n",
139 printf("[OK]\tmodify_ldt rejected 16 bit segment\n");
145 static bool install_valid(const struct user_desc
*desc
, uint32_t ar
)
147 return install_valid_mode(desc
, ar
, false);
150 static void install_invalid(const struct user_desc
*desc
, bool oldmode
)
152 int ret
= syscall(SYS_modify_ldt
, oldmode
? 1 : 0x11,
153 desc
, sizeof(*desc
));
157 check_invalid_segment(desc
->entry_number
, 1);
158 } else if (errno
== ENOSYS
) {
159 printf("[OK]\tmodify_ldt returned -ENOSYS\n");
161 if (desc
->seg_32bit
) {
162 printf("[FAIL]\tUnexpected modify_ldt failure %d\n",
166 printf("[OK]\tmodify_ldt rejected 16 bit segment\n");
171 static int safe_modify_ldt(int func
, struct user_desc
*ptr
,
172 unsigned long bytecount
)
174 int ret
= syscall(SYS_modify_ldt
, 0x11, ptr
, bytecount
);
180 static void fail_install(struct user_desc
*desc
)
182 if (safe_modify_ldt(0x11, desc
, sizeof(*desc
)) == 0) {
183 printf("[FAIL]\tmodify_ldt accepted a bad descriptor\n");
185 } else if (errno
== ENOSYS
) {
186 printf("[OK]\tmodify_ldt returned -ENOSYS\n");
188 printf("[OK]\tmodify_ldt failure %d\n", errno
);
192 static void do_simple_tests(void)
194 struct user_desc desc
= {
199 .contents
= 2, /* Code, not conforming */
202 .seg_not_present
= 0,
205 install_valid(&desc
, AR_DPL3
| AR_TYPE_XRCODE
| AR_S
| AR_P
| AR_DB
);
207 desc
.limit_in_pages
= 1;
208 install_valid(&desc
, AR_DPL3
| AR_TYPE_XRCODE
|
209 AR_S
| AR_P
| AR_DB
| AR_G
);
211 check_invalid_segment(1, 1);
213 desc
.entry_number
= 2;
214 install_valid(&desc
, AR_DPL3
| AR_TYPE_XRCODE
|
215 AR_S
| AR_P
| AR_DB
| AR_G
);
217 check_invalid_segment(1, 1);
219 desc
.base_addr
= 0xf0000000;
220 install_valid(&desc
, AR_DPL3
| AR_TYPE_XRCODE
|
221 AR_S
| AR_P
| AR_DB
| AR_G
);
224 install_valid(&desc
, AR_DPL3
| AR_TYPE_XRCODE
|
225 AR_S
| AR_P
| AR_DB
| AR_G
| AR_AVL
);
227 desc
.seg_not_present
= 1;
228 install_valid(&desc
, AR_DPL3
| AR_TYPE_XRCODE
|
229 AR_S
| AR_DB
| AR_G
| AR_AVL
);
232 install_valid(&desc
, AR_DPL3
| AR_TYPE_XRCODE
|
233 AR_S
| AR_G
| AR_AVL
);
237 install_valid(&desc
, AR_DPL3
| AR_TYPE_RWDATA
|
238 AR_S
| AR_DB
| AR_G
| AR_AVL
);
240 desc
.read_exec_only
= 1;
241 install_valid(&desc
, AR_DPL3
| AR_TYPE_RODATA
|
242 AR_S
| AR_DB
| AR_G
| AR_AVL
);
245 install_valid(&desc
, AR_DPL3
| AR_TYPE_RODATA_EXPDOWN
|
246 AR_S
| AR_DB
| AR_G
| AR_AVL
);
248 desc
.read_exec_only
= 0;
249 desc
.limit_in_pages
= 0;
250 install_valid(&desc
, AR_DPL3
| AR_TYPE_RWDATA_EXPDOWN
|
251 AR_S
| AR_DB
| AR_AVL
);
254 install_valid(&desc
, AR_DPL3
| AR_TYPE_XRCODE_CONF
|
255 AR_S
| AR_DB
| AR_AVL
);
257 desc
.read_exec_only
= 1;
258 install_valid(&desc
, AR_DPL3
| AR_TYPE_XOCODE_CONF
|
259 AR_S
| AR_DB
| AR_AVL
);
261 desc
.read_exec_only
= 0;
263 install_valid(&desc
, AR_DPL3
| AR_TYPE_XRCODE
|
264 AR_S
| AR_DB
| AR_AVL
);
266 desc
.read_exec_only
= 1;
270 install_valid(&desc
, AR_DPL3
| AR_TYPE_XOCODE
|
271 AR_S
| AR_DB
| AR_AVL
);
275 bool entry1_okay
= install_valid(&desc
, AR_DPL3
| AR_TYPE_XOCODE
|
276 AR_S
| AR_DB
| AR_AVL
);
279 printf("[RUN]\tTest fork\n");
280 pid_t child
= fork();
283 check_valid_segment(desc
.entry_number
, 1,
284 AR_DPL3
| AR_TYPE_XOCODE
|
285 AR_S
| AR_DB
| AR_AVL
, desc
.limit
,
287 check_invalid_segment(1, 1);
291 if (waitpid(child
, &status
, 0) != child
||
292 !WIFEXITED(status
)) {
293 printf("[FAIL]\tChild died\n");
295 } else if (WEXITSTATUS(status
) != 0) {
296 printf("[FAIL]\tChild failed\n");
299 printf("[OK]\tChild succeeded\n");
303 printf("[RUN]\tTest size\n");
305 for (i
= 0; i
< 8192; i
++) {
306 desc
.entry_number
= i
;
308 if (safe_modify_ldt(0x11, &desc
, sizeof(desc
)) != 0) {
309 printf("[FAIL]\tFailed to install entry %d\n", i
);
314 for (int j
= 0; j
< i
; j
++) {
315 check_valid_segment(j
, 1, AR_DPL3
| AR_TYPE_XOCODE
|
316 AR_S
| AR_DB
| AR_AVL
, j
, false);
318 printf("[DONE]\tSize test\n");
320 printf("[SKIP]\tSkipping fork and size tests because we have no LDT\n");
323 /* Test entry_number too high. */
324 desc
.entry_number
= 8192;
327 /* Test deletion and actions mistakeable for deletion. */
328 memset(&desc
, 0, sizeof(desc
));
329 install_valid(&desc
, AR_DPL3
| AR_TYPE_RWDATA
| AR_S
| AR_P
);
331 desc
.seg_not_present
= 1;
332 install_valid(&desc
, AR_DPL3
| AR_TYPE_RWDATA
| AR_S
);
334 desc
.seg_not_present
= 0;
335 desc
.read_exec_only
= 1;
336 install_valid(&desc
, AR_DPL3
| AR_TYPE_RODATA
| AR_S
| AR_P
);
338 desc
.read_exec_only
= 0;
339 desc
.seg_not_present
= 1;
340 install_valid(&desc
, AR_DPL3
| AR_TYPE_RWDATA
| AR_S
);
342 desc
.read_exec_only
= 1;
344 install_valid(&desc
, AR_DPL3
| AR_TYPE_RODATA
| AR_S
);
348 install_valid(&desc
, AR_DPL3
| AR_TYPE_RODATA
| AR_S
);
351 install_invalid(&desc
, false);
353 desc
.seg_not_present
= 0;
355 desc
.read_exec_only
= 0;
356 desc
.limit
= 0xfffff;
358 install_valid(&desc
, AR_DPL3
| AR_TYPE_RWDATA
| AR_S
| AR_P
| AR_DB
);
360 desc
.limit_in_pages
= 1;
362 install_valid(&desc
, AR_DPL3
| AR_TYPE_RWDATA
| AR_S
| AR_P
| AR_DB
| AR_G
);
363 desc
.read_exec_only
= 1;
364 install_valid(&desc
, AR_DPL3
| AR_TYPE_RODATA
| AR_S
| AR_P
| AR_DB
| AR_G
);
366 desc
.read_exec_only
= 0;
367 install_valid(&desc
, AR_DPL3
| AR_TYPE_RWDATA_EXPDOWN
| AR_S
| AR_P
| AR_DB
| AR_G
);
368 desc
.read_exec_only
= 1;
369 install_valid(&desc
, AR_DPL3
| AR_TYPE_RODATA_EXPDOWN
| AR_S
| AR_P
| AR_DB
| AR_G
);
372 install_invalid(&desc
, true);
378 * 2: thread should clear LDT entry 0
379 * 3: thread should exit
381 static volatile unsigned int ftx
;
383 static void *threadproc(void *ctx
)
388 if (sched_setaffinity(0, sizeof(cpuset
), &cpuset
) != 0)
389 err(1, "sched_setaffinity to CPU 1"); /* should never fail */
392 syscall(SYS_futex
, &ftx
, FUTEX_WAIT
, 0, NULL
, NULL
, 0);
398 /* clear LDT entry 0 */
399 const struct user_desc desc
= {};
400 if (syscall(SYS_modify_ldt
, 1, &desc
, sizeof(desc
)) != 0)
401 err(1, "modify_ldt");
403 /* If ftx == 2, set it to zero. If ftx == 100, quit. */
405 asm volatile ("lock xaddl %[x], %[ftx]" :
406 [x
] "+r" (x
), [ftx
] "+m" (ftx
));
415 #define SA_RESTORER 0x04000000
419 * The UAPI header calls this 'struct sigaction', which conflicts with
422 struct fake_ksigaction
{
423 void *handler
; /* the real type is nasty */
424 unsigned long sa_flags
;
425 void (*sa_restorer
)(void);
426 unsigned char sigset
[8];
429 static void fix_sa_restorer(int sig
)
431 struct fake_ksigaction ksa
;
433 if (syscall(SYS_rt_sigaction
, sig
, NULL
, &ksa
, 8) == 0) {
435 * glibc has a nasty bug: it sometimes writes garbage to
436 * sa_restorer. This interacts quite badly with anything
437 * that fiddles with SS because it can trigger legacy
438 * stack switching. Patch it up. See:
440 * https://sourceware.org/bugzilla/show_bug.cgi?id=21269
442 if (!(ksa
.sa_flags
& SA_RESTORER
) && ksa
.sa_restorer
) {
443 ksa
.sa_restorer
= NULL
;
444 if (syscall(SYS_rt_sigaction
, sig
, &ksa
, NULL
,
445 sizeof(ksa
.sigset
)) != 0)
446 err(1, "rt_sigaction");
451 static void fix_sa_restorer(int sig
)
453 /* 64-bit glibc works fine. */
457 static void sethandler(int sig
, void (*handler
)(int, siginfo_t
*, void *),
461 memset(&sa
, 0, sizeof(sa
));
462 sa
.sa_sigaction
= handler
;
463 sa
.sa_flags
= SA_SIGINFO
| flags
;
464 sigemptyset(&sa
.sa_mask
);
465 if (sigaction(sig
, &sa
, 0))
468 fix_sa_restorer(sig
);
471 static jmp_buf jmpbuf
;
473 static void sigsegv(int sig
, siginfo_t
*info
, void *ctx_void
)
475 siglongjmp(jmpbuf
, 1);
478 static void do_multicpu_tests(void)
482 int failures
= 0, iters
= 5, i
;
483 unsigned short orig_ss
;
487 if (sched_setaffinity(0, sizeof(cpuset
), &cpuset
) != 0) {
488 printf("[SKIP]\tCannot set affinity to CPU 1\n");
494 if (sched_setaffinity(0, sizeof(cpuset
), &cpuset
) != 0) {
495 printf("[SKIP]\tCannot set affinity to CPU 0\n");
499 sethandler(SIGSEGV
, sigsegv
, 0);
501 /* True 32-bit kernels send SIGILL instead of SIGSEGV on IRET faults. */
502 sethandler(SIGILL
, sigsegv
, 0);
505 printf("[RUN]\tCross-CPU LDT invalidation\n");
507 if (pthread_create(&thread
, 0, threadproc
, 0) != 0)
508 err(1, "pthread_create");
510 asm volatile ("mov %%ss, %0" : "=rm" (orig_ss
));
512 for (i
= 0; i
< 5; i
++) {
513 if (sigsetjmp(jmpbuf
, 1) != 0)
516 /* Make sure the thread is ready after the last test. */
520 struct user_desc desc
= {
525 .contents
= 0, /* Data */
528 .seg_not_present
= 0,
532 if (safe_modify_ldt(0x11, &desc
, sizeof(desc
)) != 0) {
534 err(1, "modify_ldt");
535 printf("[SKIP]\tmodify_ldt unavailable\n");
539 /* Arm the thread. */
541 syscall(SYS_futex
, &ftx
, FUTEX_WAKE
, 0, NULL
, NULL
, 0);
543 asm volatile ("mov %0, %%ss" : : "r" (0x7));
552 * On success, modify_ldt will segfault us synchronously,
553 * and we'll escape via siglongjmp.
557 asm volatile ("mov %0, %%ss" : : "rm" (orig_ss
));
560 ftx
= 100; /* Kill the thread. */
561 syscall(SYS_futex
, &ftx
, FUTEX_WAKE
, 0, NULL
, NULL
, 0);
563 if (pthread_join(thread
, NULL
) != 0)
564 err(1, "pthread_join");
567 printf("[FAIL]\t%d of %d iterations failed\n", failures
, iters
);
570 printf("[OK]\tAll %d iterations succeeded\n", iters
);
574 static int finish_exec_test(void)
577 * In a sensible world, this would be check_invalid_segment(0, 1);
578 * For better or for worse, though, the LDT is inherited across exec.
579 * We can probably change this safely, but for now we test it.
581 check_valid_segment(0, 1,
582 AR_DPL3
| AR_TYPE_XRCODE
| AR_S
| AR_P
| AR_DB
,
585 return nerrs
? 1 : 0;
588 static void do_exec_test(void)
590 printf("[RUN]\tTest exec\n");
592 struct user_desc desc
= {
597 .contents
= 2, /* Code, not conforming */
600 .seg_not_present
= 0,
603 install_valid(&desc
, AR_DPL3
| AR_TYPE_XRCODE
| AR_S
| AR_P
| AR_DB
);
605 pid_t child
= fork();
607 execl("/proc/self/exe", "ldt_gdt_test_exec", NULL
);
608 printf("[FAIL]\tCould not exec self\n");
609 exit(1); /* exec failed */
612 if (waitpid(child
, &status
, 0) != child
||
613 !WIFEXITED(status
)) {
614 printf("[FAIL]\tChild died\n");
616 } else if (WEXITSTATUS(status
) != 0) {
617 printf("[FAIL]\tChild failed\n");
620 printf("[OK]\tChild succeeded\n");
625 int main(int argc
, char **argv
)
627 if (argc
== 1 && !strcmp(argv
[0], "ldt_gdt_test_exec"))
628 return finish_exec_test();
636 return nerrs
? 1 : 0;