tools/testing/selftests/x86/fsgsbase.c

   1 // SPDX-License-Identifier: GPL-2.0-only
   2 /*
   3  * fsgsbase.c, an fsgsbase test
   4  * Copyright (c) 2014-2016 Andy Lutomirski
   5  */
   6
   7 #define _GNU_SOURCE
   8 #include <stdio.h>
   9 #include <stdlib.h>
  10 #include <stdbool.h>
  11 #include <string.h>
  12 #include <sys/syscall.h>
  13 #include <unistd.h>
  14 #include <err.h>
  15 #include <sys/user.h>
  16 #include <asm/prctl.h>
  17 #include <sys/prctl.h>
  18 #include <signal.h>
  19 #include <limits.h>
  20 #include <sys/ucontext.h>
  21 #include <sched.h>
  22 #include <linux/futex.h>
  23 #include <pthread.h>
  24 #include <asm/ldt.h>
  25 #include <sys/mman.h>
  26 #include <stddef.h>
  27 #include <sys/ptrace.h>
  28 #include <sys/wait.h>
  29 #include <setjmp.h>
  30
  31 #ifndef __x86_64__
  32 # error This test is 64-bit only
  33 #endif
  34
  35 static volatile sig_atomic_t want_segv;
  36 static volatile unsigned long segv_addr;
  37
  38 static unsigned short *shared_scratch;
  39
  40 static int nerrs;
  41
  42 static void sethandler(int sig, void (*handler)(int, siginfo_t *, void *),
  43                        int flags)
  44 {
  45         struct sigaction sa;
  46         memset(&sa, 0, sizeof(sa));
  47         sa.sa_sigaction = handler;
  48         sa.sa_flags = SA_SIGINFO | flags;
  49         sigemptyset(&sa.sa_mask);
  50         if (sigaction(sig, &sa, 0))
  51                 err(1, "sigaction");
  52 }
  53
  54 static void clearhandler(int sig)
  55 {
  56         struct sigaction sa;
  57         memset(&sa, 0, sizeof(sa));
  58         sa.sa_handler = SIG_DFL;
  59         sigemptyset(&sa.sa_mask);
  60         if (sigaction(sig, &sa, 0))
  61                 err(1, "sigaction");
  62 }
  63
  64 static void sigsegv(int sig, siginfo_t *si, void *ctx_void)
  65 {
  66         ucontext_t *ctx = (ucontext_t*)ctx_void;
  67
  68         if (!want_segv) {
  69                 clearhandler(SIGSEGV);
  70                 return;  /* Crash cleanly. */
  71         }
  72
  73         want_segv = false;
  74         segv_addr = (unsigned long)si->si_addr;
  75
  76         ctx->uc_mcontext.gregs[REG_RIP] += 4;   /* Skip the faulting mov */
  77
  78 }
  79
  80 static jmp_buf jmpbuf;
  81
  82 static void sigill(int sig, siginfo_t *si, void *ctx_void)
  83 {
  84         siglongjmp(jmpbuf, 1);
  85 }
  86
  87 static bool have_fsgsbase;
  88
  89 static inline unsigned long rdgsbase(void)
  90 {
  91         unsigned long gsbase;
  92
  93         asm volatile("rdgsbase %0" : "=r" (gsbase) :: "memory");
  94
  95         return gsbase;
  96 }
  97
  98 static inline unsigned long rdfsbase(void)
  99 {
 100         unsigned long fsbase;
 101
 102         asm volatile("rdfsbase %0" : "=r" (fsbase) :: "memory");
 103
 104         return fsbase;
 105 }
 106
 107 static inline void wrgsbase(unsigned long gsbase)
 108 {
 109         asm volatile("wrgsbase %0" :: "r" (gsbase) : "memory");
 110 }
 111
 112 static inline void wrfsbase(unsigned long fsbase)
 113 {
 114         asm volatile("wrfsbase %0" :: "r" (fsbase) : "memory");
 115 }
 116
 117 enum which_base { FS, GS };
 118
 119 static unsigned long read_base(enum which_base which)
 120 {
 121         unsigned long offset;
 122         /*
 123          * Unless we have FSGSBASE, there's no direct way to do this from
 124          * user mode.  We can get at it indirectly using signals, though.
 125          */
 126
 127         want_segv = true;
 128
 129         offset = 0;
 130         if (which == FS) {
 131                 /* Use a constant-length instruction here. */
 132                 asm volatile ("mov %%fs:(%%rcx), %%rax" : : "c" (offset) : "rax");
 133         } else {
 134                 asm volatile ("mov %%gs:(%%rcx), %%rax" : : "c" (offset) : "rax");
 135         }
 136         if (!want_segv)
 137                 return segv_addr + offset;
 138
 139         /*
 140          * If that didn't segfault, try the other end of the address space.
 141          * Unless we get really unlucky and run into the vsyscall page, this
 142          * is guaranteed to segfault.
 143          */
 144
 145         offset = (ULONG_MAX >> 1) + 1;
 146         if (which == FS) {
 147                 asm volatile ("mov %%fs:(%%rcx), %%rax"
 148                               : : "c" (offset) : "rax");
 149         } else {
 150                 asm volatile ("mov %%gs:(%%rcx), %%rax"
 151                               : : "c" (offset) : "rax");
 152         }
 153         if (!want_segv)
 154                 return segv_addr + offset;
 155
 156         abort();
 157 }
 158
 159 static void check_gs_value(unsigned long value)
 160 {
 161         unsigned long base;
 162         unsigned short sel;
 163
 164         printf("[RUN]\tARCH_SET_GS to 0x%lx\n", value);
 165         if (syscall(SYS_arch_prctl, ARCH_SET_GS, value) != 0)
 166                 err(1, "ARCH_SET_GS");
 167
 168         asm volatile ("mov %%gs, %0" : "=rm" (sel));
 169         base = read_base(GS);
 170         if (base == value) {
 171                 printf("[OK]\tGSBASE was set as expected (selector 0x%hx)\n",
 172                        sel);
 173         } else {
 174                 nerrs++;
 175                 printf("[FAIL]\tGSBASE was not as expected: got 0x%lx (selector 0x%hx)\n",
 176                        base, sel);
 177         }
 178
 179         if (syscall(SYS_arch_prctl, ARCH_GET_GS, &base) != 0)
 180                 err(1, "ARCH_GET_GS");
 181         if (base == value) {
 182                 printf("[OK]\tARCH_GET_GS worked as expected (selector 0x%hx)\n",
 183                        sel);
 184         } else {
 185                 nerrs++;
 186                 printf("[FAIL]\tARCH_GET_GS was not as expected: got 0x%lx (selector 0x%hx)\n",
 187                        base, sel);
 188         }
 189 }
 190
 191 static void mov_0_gs(unsigned long initial_base, bool schedule)
 192 {
 193         unsigned long base, arch_base;
 194
 195         printf("[RUN]\tARCH_SET_GS to 0x%lx then mov 0 to %%gs%s\n", initial_base, schedule ? " and schedule " : "");
 196         if (syscall(SYS_arch_prctl, ARCH_SET_GS, initial_base) != 0)
 197                 err(1, "ARCH_SET_GS");
 198
 199         if (schedule)
 200                 usleep(10);
 201
 202         asm volatile ("mov %0, %%gs" : : "rm" (0));
 203         base = read_base(GS);
 204         if (syscall(SYS_arch_prctl, ARCH_GET_GS, &arch_base) != 0)
 205                 err(1, "ARCH_GET_GS");
 206         if (base == arch_base) {
 207                 printf("[OK]\tGSBASE is 0x%lx\n", base);
 208         } else {
 209                 nerrs++;
 210                 printf("[FAIL]\tGSBASE changed to 0x%lx but kernel reports 0x%lx\n", base, arch_base);
 211         }
 212 }
 213
 214 static volatile unsigned long remote_base;
 215 static volatile bool remote_hard_zero;
 216 static volatile unsigned int ftx;
 217
 218 /*
 219  * ARCH_SET_FS/GS(0) may or may not program a selector of zero.  HARD_ZERO
 220  * means to force the selector to zero to improve test coverage.
 221  */
 222 #define HARD_ZERO 0xa1fa5f343cb85fa4
 223
 224 static void do_remote_base()
 225 {
 226         unsigned long to_set = remote_base;
 227         bool hard_zero = false;
 228         if (to_set == HARD_ZERO) {
 229                 to_set = 0;
 230                 hard_zero = true;
 231         }
 232
 233         if (syscall(SYS_arch_prctl, ARCH_SET_GS, to_set) != 0)
 234                 err(1, "ARCH_SET_GS");
 235
 236         if (hard_zero)
 237                 asm volatile ("mov %0, %%gs" : : "rm" ((unsigned short)0));
 238
 239         unsigned short sel;
 240         asm volatile ("mov %%gs, %0" : "=rm" (sel));
 241         printf("\tother thread: ARCH_SET_GS(0x%lx)%s -- sel is 0x%hx\n",
 242                to_set, hard_zero ? " and clear gs" : "", sel);
 243 }
 244
 245 static __thread int set_thread_area_entry_number = -1;
 246
 247 static unsigned short load_gs(void)
 248 {
 249         /*
 250          * Sets GS != 0 and GSBASE != 0 but arranges for the kernel to think
 251          * that GSBASE == 0 (i.e. thread.gsbase == 0).
 252          */
 253
 254         /* Step 1: tell the kernel that we have GSBASE == 0. */
 255         if (syscall(SYS_arch_prctl, ARCH_SET_GS, 0) != 0)
 256                 err(1, "ARCH_SET_GS");
 257
 258         /* Step 2: change GSBASE without telling the kernel. */
 259         struct user_desc desc = {
 260                 .entry_number    = 0,
 261                 .base_addr       = 0xBAADF00D,
 262                 .limit           = 0xfffff,
 263                 .seg_32bit       = 1,
 264                 .contents        = 0, /* Data, grow-up */
 265                 .read_exec_only  = 0,
 266                 .limit_in_pages  = 1,
 267                 .seg_not_present = 0,
 268                 .useable         = 0
 269         };
 270         if (syscall(SYS_modify_ldt, 1, &desc, sizeof(desc)) == 0) {
 271                 printf("\tusing LDT slot 0\n");
 272                 asm volatile ("mov %0, %%gs" : : "rm" ((unsigned short)0x7));
 273                 return 0x7;
 274         } else {
 275                 /* No modify_ldt for us (configured out, perhaps) */
 276
 277                 struct user_desc *low_desc = mmap(
 278                         NULL, sizeof(desc),
 279                         PROT_READ | PROT_WRITE,
 280                         MAP_PRIVATE | MAP_ANONYMOUS | MAP_32BIT, -1, 0);
 281                 memcpy(low_desc, &desc, sizeof(desc));
 282
 283                 low_desc->entry_number = set_thread_area_entry_number;
 284
 285                 /* 32-bit set_thread_area */
 286                 long ret;
 287                 asm volatile ("int $0x80"
 288                               : "=a" (ret), "+m" (*low_desc)
 289                               : "a" (243), "b" (low_desc)
 290                               : "r8", "r9", "r10", "r11");
 291                 memcpy(&desc, low_desc, sizeof(desc));
 292                 munmap(low_desc, sizeof(desc));
 293
 294                 if (ret != 0) {
 295                         printf("[NOTE]\tcould not create a segment -- test won't do anything\n");
 296                         return 0;
 297                 }
 298                 printf("\tusing GDT slot %d\n", desc.entry_number);
 299                 set_thread_area_entry_number = desc.entry_number;
 300
 301                 unsigned short gs = (unsigned short)((desc.entry_number << 3) | 0x3);
 302                 asm volatile ("mov %0, %%gs" : : "rm" (gs));
 303                 return gs;
 304         }
 305 }
 306
 307 void test_wrbase(unsigned short index, unsigned long base)
 308 {
 309         unsigned short newindex;
 310         unsigned long newbase;
 311
 312         printf("[RUN]\tGS = 0x%hx, GSBASE = 0x%lx\n", index, base);
 313
 314         asm volatile ("mov %0, %%gs" : : "rm" (index));
 315         wrgsbase(base);
 316
 317         remote_base = 0;
 318         ftx = 1;
 319         syscall(SYS_futex, &ftx, FUTEX_WAKE, 0, NULL, NULL, 0);
 320         while (ftx != 0)
 321                 syscall(SYS_futex, &ftx, FUTEX_WAIT, 1, NULL, NULL, 0);
 322
 323         asm volatile ("mov %%gs, %0" : "=rm" (newindex));
 324         newbase = rdgsbase();
 325
 326         if (newindex == index && newbase == base) {
 327                 printf("[OK]\tIndex and base were preserved\n");
 328         } else {
 329                 printf("[FAIL]\tAfter switch, GS = 0x%hx and GSBASE = 0x%lx\n",
 330                        newindex, newbase);
 331                 nerrs++;
 332         }
 333 }
 334
 335 static void *threadproc(void *ctx)
 336 {
 337         while (1) {
 338                 while (ftx == 0)
 339                         syscall(SYS_futex, &ftx, FUTEX_WAIT, 0, NULL, NULL, 0);
 340                 if (ftx == 3)
 341                         return NULL;
 342
 343                 if (ftx == 1) {
 344                         do_remote_base();
 345                 } else if (ftx == 2) {
 346                         /*
 347                          * On AMD chips, this causes GSBASE != 0, GS == 0, and
 348                          * thread.gsbase == 0.
 349                          */
 350
 351                         load_gs();
 352                         asm volatile ("mov %0, %%gs" : : "rm" ((unsigned short)0));
 353                 } else {
 354                         errx(1, "helper thread got bad command");
 355                 }
 356
 357                 ftx = 0;
 358                 syscall(SYS_futex, &ftx, FUTEX_WAKE, 0, NULL, NULL, 0);
 359         }
 360 }
 361
 362 static void set_gs_and_switch_to(unsigned long local,
 363                                  unsigned short force_sel,
 364                                  unsigned long remote)
 365 {
 366         unsigned long base;
 367         unsigned short sel_pre_sched, sel_post_sched;
 368
 369         bool hard_zero = false;
 370         if (local == HARD_ZERO) {
 371                 hard_zero = true;
 372                 local = 0;
 373         }
 374
 375         printf("[RUN]\tARCH_SET_GS(0x%lx)%s, then schedule to 0x%lx\n",
 376                local, hard_zero ? " and clear gs" : "", remote);
 377         if (force_sel)
 378                 printf("\tBefore schedule, set selector to 0x%hx\n", force_sel);
 379         if (syscall(SYS_arch_prctl, ARCH_SET_GS, local) != 0)
 380                 err(1, "ARCH_SET_GS");
 381         if (hard_zero)
 382                 asm volatile ("mov %0, %%gs" : : "rm" ((unsigned short)0));
 383
 384         if (read_base(GS) != local) {
 385                 nerrs++;
 386                 printf("[FAIL]\tGSBASE wasn't set as expected\n");
 387         }
 388
 389         if (force_sel) {
 390                 asm volatile ("mov %0, %%gs" : : "rm" (force_sel));
 391                 sel_pre_sched = force_sel;
 392                 local = read_base(GS);
 393
 394                 /*
 395                  * Signal delivery is quite likely to change a selector
 396                  * of 1, 2, or 3 back to 0 due to IRET being defective.
 397                  */
 398                 asm volatile ("mov %0, %%gs" : : "rm" (force_sel));
 399         } else {
 400                 asm volatile ("mov %%gs, %0" : "=rm" (sel_pre_sched));
 401         }
 402
 403         remote_base = remote;
 404         ftx = 1;
 405         syscall(SYS_futex, &ftx, FUTEX_WAKE, 0, NULL, NULL, 0);
 406         while (ftx != 0)
 407                 syscall(SYS_futex, &ftx, FUTEX_WAIT, 1, NULL, NULL, 0);
 408
 409         asm volatile ("mov %%gs, %0" : "=rm" (sel_post_sched));
 410         base = read_base(GS);
 411         if (base == local && sel_pre_sched == sel_post_sched) {
 412                 printf("[OK]\tGS/BASE remained 0x%hx/0x%lx\n",
 413                        sel_pre_sched, local);
 414         } else if (base == local && sel_pre_sched >= 1 && sel_pre_sched <= 3 &&
 415                    sel_post_sched == 0) {
 416                 /*
 417                  * IRET is misdesigned and will squash selectors 1, 2, or 3
 418                  * to zero.  Don't fail the test just because this happened.
 419                  */
 420                 printf("[OK]\tGS/BASE changed from 0x%hx/0x%lx to 0x%hx/0x%lx because IRET is defective\n",
 421                        sel_pre_sched, local, sel_post_sched, base);
 422         } else {
 423                 nerrs++;
 424                 printf("[FAIL]\tGS/BASE changed from 0x%hx/0x%lx to 0x%hx/0x%lx\n",
 425                        sel_pre_sched, local, sel_post_sched, base);
 426         }
 427 }
 428
 429 static void test_unexpected_base(void)
 430 {
 431         unsigned long base;
 432
 433         printf("[RUN]\tARCH_SET_GS(0), clear gs, then manipulate GSBASE in a different thread\n");
 434         if (syscall(SYS_arch_prctl, ARCH_SET_GS, 0) != 0)
 435                 err(1, "ARCH_SET_GS");
 436         asm volatile ("mov %0, %%gs" : : "rm" ((unsigned short)0));
 437
 438         ftx = 2;
 439         syscall(SYS_futex, &ftx, FUTEX_WAKE, 0, NULL, NULL, 0);
 440         while (ftx != 0)
 441                 syscall(SYS_futex, &ftx, FUTEX_WAIT, 1, NULL, NULL, 0);
 442
 443         base = read_base(GS);
 444         if (base == 0) {
 445                 printf("[OK]\tGSBASE remained 0\n");
 446         } else {
 447                 nerrs++;
 448                 printf("[FAIL]\tGSBASE changed to 0x%lx\n", base);
 449         }
 450 }
 451
 452 #define USER_REGS_OFFSET(r) offsetof(struct user_regs_struct, r)
 453
 454 static void test_ptrace_write_gs_read_base(void)
 455 {
 456         int status;
 457         pid_t child = fork();
 458
 459         if (child < 0)
 460                 err(1, "fork");
 461
 462         if (child == 0) {
 463                 printf("[RUN]\tPTRACE_POKE GS, read GSBASE back\n");
 464
 465                 printf("[RUN]\tARCH_SET_GS to 1\n");
 466                 if (syscall(SYS_arch_prctl, ARCH_SET_GS, 1) != 0)
 467                         err(1, "ARCH_SET_GS");
 468
 469                 if (ptrace(PTRACE_TRACEME, 0, NULL, NULL) != 0)
 470                         err(1, "PTRACE_TRACEME");
 471
 472                 raise(SIGTRAP);
 473                 _exit(0);
 474         }
 475
 476         wait(&status);
 477
 478         if (WSTOPSIG(status) == SIGTRAP) {
 479                 unsigned long base;
 480                 unsigned long gs_offset = USER_REGS_OFFSET(gs);
 481                 unsigned long base_offset = USER_REGS_OFFSET(gs_base);
 482
 483                 /* Read the initial base.  It should be 1. */
 484                 base = ptrace(PTRACE_PEEKUSER, child, base_offset, NULL);
 485                 if (base == 1) {
 486                         printf("[OK]\tGSBASE started at 1\n");
 487                 } else {
 488                         nerrs++;
 489                         printf("[FAIL]\tGSBASE started at 0x%lx\n", base);
 490                 }
 491
 492                 printf("[RUN]\tSet GS = 0x7, read GSBASE\n");
 493
 494                 /* Poke an LDT selector into GS. */
 495                 if (ptrace(PTRACE_POKEUSER, child, gs_offset, 0x7) != 0)
 496                         err(1, "PTRACE_POKEUSER");
 497
 498                 /* And read the base. */
 499                 base = ptrace(PTRACE_PEEKUSER, child, base_offset, NULL);
 500
 501                 if (base == 0 || base == 1) {
 502                         printf("[OK]\tGSBASE reads as 0x%lx with invalid GS\n", base);
 503                 } else {
 504                         nerrs++;
 505                         printf("[FAIL]\tGSBASE=0x%lx (should be 0 or 1)\n", base);
 506                 }
 507         }
 508
 509         ptrace(PTRACE_CONT, child, NULL, NULL);
 510
 511         wait(&status);
 512         if (!WIFEXITED(status))
 513                 printf("[WARN]\tChild didn't exit cleanly.\n");
 514 }
 515
 516 static void test_ptrace_write_gsbase(void)
 517 {
 518         int status;
 519         pid_t child = fork();
 520
 521         if (child < 0)
 522                 err(1, "fork");
 523
 524         if (child == 0) {
 525                 printf("[RUN]\tPTRACE_POKE(), write GSBASE from ptracer\n");
 526
 527                 *shared_scratch = load_gs();
 528
 529                 if (ptrace(PTRACE_TRACEME, 0, NULL, NULL) != 0)
 530                         err(1, "PTRACE_TRACEME");
 531
 532                 raise(SIGTRAP);
 533                 _exit(0);
 534         }
 535
 536         wait(&status);
 537
 538         if (WSTOPSIG(status) == SIGTRAP) {
 539                 unsigned long gs, base;
 540                 unsigned long gs_offset = USER_REGS_OFFSET(gs);
 541                 unsigned long base_offset = USER_REGS_OFFSET(gs_base);
 542
 543                 gs = ptrace(PTRACE_PEEKUSER, child, gs_offset, NULL);
 544
 545                 if (gs != *shared_scratch) {
 546                         nerrs++;
 547                         printf("[FAIL]\tGS is not prepared with nonzero\n");
 548                         goto END;
 549                 }
 550
 551                 if (ptrace(PTRACE_POKEUSER, child, base_offset, 0xFF) != 0)
 552                         err(1, "PTRACE_POKEUSER");
 553
 554                 gs = ptrace(PTRACE_PEEKUSER, child, gs_offset, NULL);
 555                 base = ptrace(PTRACE_PEEKUSER, child, base_offset, NULL);
 556
 557                 /*
 558                  * In a non-FSGSBASE system, the nonzero selector will load
 559                  * GSBASE (again). But what is tested here is whether the
 560                  * selector value is changed or not by the GSBASE write in
 561                  * a ptracer.
 562                  */
 563                 if (gs != *shared_scratch) {
 564                         nerrs++;
 565                         printf("[FAIL]\tGS changed to %lx\n", gs);
 566
 567                         /*
 568                          * On older kernels, poking a nonzero value into the
 569                          * base would zero the selector.  On newer kernels,
 570                          * this behavior has changed -- poking the base
 571                          * changes only the base and, if FSGSBASE is not
 572                          * available, this may have no effect once the tracee
 573                          * is resumed.
 574                          */
 575                         if (gs == 0)
 576                                 printf("\tNote: this is expected behavior on older kernels.\n");
 577                 } else if (have_fsgsbase && (base != 0xFF)) {
 578                         nerrs++;
 579                         printf("[FAIL]\tGSBASE changed to %lx\n", base);
 580                 } else {
 581                         printf("[OK]\tGS remained 0x%hx", *shared_scratch);
 582                         if (have_fsgsbase)
 583                                 printf(" and GSBASE changed to 0xFF");
 584                         printf("\n");
 585                 }
 586         }
 587
 588 END:
 589         ptrace(PTRACE_CONT, child, NULL, NULL);
 590         wait(&status);
 591         if (!WIFEXITED(status))
 592                 printf("[WARN]\tChild didn't exit cleanly.\n");
 593 }
 594
 595 int main()
 596 {
 597         pthread_t thread;
 598
 599         shared_scratch = mmap(NULL, 4096, PROT_READ | PROT_WRITE,
 600                               MAP_ANONYMOUS | MAP_SHARED, -1, 0);
 601
 602         /* Do these tests before we have an LDT. */
 603         test_ptrace_write_gs_read_base();
 604
 605         /* Probe FSGSBASE */
 606         sethandler(SIGILL, sigill, 0);
 607         if (sigsetjmp(jmpbuf, 1) == 0) {
 608                 rdfsbase();
 609                 have_fsgsbase = true;
 610                 printf("\tFSGSBASE instructions are enabled\n");
 611         } else {
 612                 printf("\tFSGSBASE instructions are disabled\n");
 613         }
 614         clearhandler(SIGILL);
 615
 616         sethandler(SIGSEGV, sigsegv, 0);
 617
 618         check_gs_value(0);
 619         check_gs_value(1);
 620         check_gs_value(0x200000000);
 621         check_gs_value(0);
 622         check_gs_value(0x200000000);
 623         check_gs_value(1);
 624
 625         for (int sched = 0; sched < 2; sched++) {
 626                 mov_0_gs(0, !!sched);
 627                 mov_0_gs(1, !!sched);
 628                 mov_0_gs(0x200000000, !!sched);
 629         }
 630
 631         /* Set up for multithreading. */
 632
 633         cpu_set_t cpuset;
 634         CPU_ZERO(&cpuset);
 635         CPU_SET(0, &cpuset);
 636         if (sched_setaffinity(0, sizeof(cpuset), &cpuset) != 0)
 637                 err(1, "sched_setaffinity to CPU 0");   /* should never fail */
 638
 639         if (pthread_create(&thread, 0, threadproc, 0) != 0)
 640                 err(1, "pthread_create");
 641
 642         static unsigned long bases_with_hard_zero[] = {
 643                 0, HARD_ZERO, 1, 0x200000000,
 644         };
 645
 646         for (int local = 0; local < 4; local++) {
 647                 for (int remote = 0; remote < 4; remote++) {
 648                         for (unsigned short s = 0; s < 5; s++) {
 649                                 unsigned short sel = s;
 650                                 if (s == 4)
 651                                         asm ("mov %%ss, %0" : "=rm" (sel));
 652                                 set_gs_and_switch_to(
 653                                         bases_with_hard_zero[local],
 654                                         sel,
 655                                         bases_with_hard_zero[remote]);
 656                         }
 657                 }
 658         }
 659
 660         test_unexpected_base();
 661
 662         if (have_fsgsbase) {
 663                 unsigned short ss;
 664
 665                 asm volatile ("mov %%ss, %0" : "=rm" (ss));
 666
 667                 test_wrbase(0, 0);
 668                 test_wrbase(0, 1);
 669                 test_wrbase(0, 0x200000000);
 670                 test_wrbase(0, 0xffffffffffffffff);
 671                 test_wrbase(ss, 0);
 672                 test_wrbase(ss, 1);
 673                 test_wrbase(ss, 0x200000000);
 674                 test_wrbase(ss, 0xffffffffffffffff);
 675         }
 676
 677         ftx = 3;  /* Kill the thread. */
 678         syscall(SYS_futex, &ftx, FUTEX_WAKE, 0, NULL, NULL, 0);
 679
 680         if (pthread_join(thread, NULL) != 0)
 681                 err(1, "pthread_join");
 682
 683         test_ptrace_write_gsbase();
 684
 685         return nerrs == 0 ? 0 : 1;
 686 }