1 // SPDX-License-Identifier: GPL-2.0-only
4  * Copyright (c) 2014-2016 Andy Lutomirski
34 # error This test is 64-bit only
54 	segv_addr = (unsigned long)si->si_addr;  in sigsegv()
56 	ctx->uc_mcontext.gregs[REG_RIP] += 4;	/* Skip the faulting mov */  in sigsegv()
106 		/* Use a constant-length instruction here. */  in read_base()
136 	unsigned long base;  in check_gs_value()  local
139 	printf("[RUN]\tARCH_SET_GS to 0x%lx\n", value);  in check_gs_value()
144 	base = read_base(GS);  in check_gs_value()
145 	if (base == value) {  in check_gs_value()
146 		printf("[OK]\tGSBASE was set as expected (selector 0x%hx)\n",  in check_gs_value()
150 		printf("[FAIL]\tGSBASE was not as expected: got 0x%lx (selector 0x%hx)\n",  in check_gs_value()
151 		       base, sel);  in check_gs_value()
154 	if (syscall(SYS_arch_prctl, ARCH_GET_GS, &base) != 0)  in check_gs_value()
156 	if (base == value) {  in check_gs_value()
157 		printf("[OK]\tARCH_GET_GS worked as expected (selector 0x%hx)\n",  in check_gs_value()
161 		printf("[FAIL]\tARCH_GET_GS was not as expected: got 0x%lx (selector 0x%hx)\n",  in check_gs_value()
162 		       base, sel);  in check_gs_value()
168 	unsigned long base, arch_base;  in mov_0_gs()  local
170 …printf("[RUN]\tARCH_SET_GS to 0x%lx then mov 0 to %%gs%s\n", initial_base, schedule ? " and schedu…  in mov_0_gs()
178 	base = read_base(GS);  in mov_0_gs()
181 	if (base == arch_base) {  in mov_0_gs()
182 		printf("[OK]\tGSBASE is 0x%lx\n", base);  in mov_0_gs()
185 		printf("[FAIL]\tGSBASE changed to 0x%lx but kernel reports 0x%lx\n", base, arch_base);  in mov_0_gs()
215 	printf("\tother thread: ARCH_SET_GS(0x%lx)%s -- sel is 0x%hx\n",  in do_remote_base()
219 static __thread int set_thread_area_entry_number = -1;
238 		.contents        = 0, /* Data, grow-up */  in load_gs()
254 			MAP_PRIVATE | MAP_ANONYMOUS | MAP_32BIT, -1, 0);  in load_gs()
257 		low_desc->entry_number = set_thread_area_entry_number;  in load_gs()
259 		/* 32-bit set_thread_area */  in load_gs()
269 			printf("[NOTE]\tcould not create a segment -- test won't do anything\n");  in load_gs()
275 		unsigned short gs = (unsigned short)((desc.entry_number << 3) | 0x3);  in load_gs()
281 void test_wrbase(unsigned short index, unsigned long base)  in test_wrbase()  argument
286 	printf("[RUN]\tGS = 0x%hx, GSBASE = 0x%lx\n", index, base);  in test_wrbase()
289 	wrgsbase(base);  in test_wrbase()
300 	if (newindex == index && newbase == base) {  in test_wrbase()
301 		printf("[OK]\tIndex and base were preserved\n");  in test_wrbase()
303 		printf("[FAIL]\tAfter switch, GS = 0x%hx and GSBASE = 0x%lx\n",  in test_wrbase()
314 		if (ftx == 3)  in threadproc()
340 	unsigned long base;  in set_gs_and_switch_to()  local
349 	printf("[RUN]\tARCH_SET_GS(0x%lx)%s, then schedule to 0x%lx\n",  in set_gs_and_switch_to()
352 		printf("\tBefore schedule, set selector to 0x%hx\n", force_sel);  in set_gs_and_switch_to()
370 		 * of 1, 2, or 3 back to 0 due to IRET being defective.  in set_gs_and_switch_to()
384 	base = read_base(GS);  in set_gs_and_switch_to()
385 	if (base == local && sel_pre_sched == sel_post_sched) {  in set_gs_and_switch_to()
386 		printf("[OK]\tGS/BASE remained 0x%hx/0x%lx\n",  in set_gs_and_switch_to()
388 	} else if (base == local && sel_pre_sched >= 1 && sel_pre_sched <= 3 &&  in set_gs_and_switch_to()
391 		 * IRET is misdesigned and will squash selectors 1, 2, or 3  in set_gs_and_switch_to()
394 		printf("[OK]\tGS/BASE changed from 0x%hx/0x%lx to 0x%hx/0x%lx because IRET is defective\n",  in set_gs_and_switch_to()
395 		       sel_pre_sched, local, sel_post_sched, base);  in set_gs_and_switch_to()
398 		printf("[FAIL]\tGS/BASE changed from 0x%hx/0x%lx to 0x%hx/0x%lx\n",  in set_gs_and_switch_to()
399 		       sel_pre_sched, local, sel_post_sched, base);  in set_gs_and_switch_to()
405 	unsigned long base;  in test_unexpected_base()  local
417 	base = read_base(GS);  in test_unexpected_base()
418 	if (base == 0) {  in test_unexpected_base()
422 		printf("[FAIL]\tGSBASE changed to 0x%lx\n", base);  in test_unexpected_base()
453 		unsigned long base;  in test_ptrace_write_gs_read_base()  local
457 		/* Read the initial base.  It should be 1. */  in test_ptrace_write_gs_read_base()
458 		base = ptrace(PTRACE_PEEKUSER, child, base_offset, NULL);  in test_ptrace_write_gs_read_base()
459 		if (base == 1) {  in test_ptrace_write_gs_read_base()
463 			printf("[FAIL]\tGSBASE started at 0x%lx\n", base);  in test_ptrace_write_gs_read_base()
472 		/* And read the base. */  in test_ptrace_write_gs_read_base()
473 		base = ptrace(PTRACE_PEEKUSER, child, base_offset, NULL);  in test_ptrace_write_gs_read_base()
475 		if (base == 0 || base == 1) {  in test_ptrace_write_gs_read_base()
476 			printf("[OK]\tGSBASE reads as 0x%lx with invalid GS\n", base);  in test_ptrace_write_gs_read_base()
479 			printf("[FAIL]\tGSBASE=0x%lx (should be 0 or 1)\n", base);  in test_ptrace_write_gs_read_base()
513 		unsigned long gs, base;  in test_ptrace_write_gsbase()  local
529 		base = ptrace(PTRACE_PEEKUSER, child, base_offset, NULL);  in test_ptrace_write_gsbase()
532 		 * In a non-FSGSBASE system, the nonzero selector will load  in test_ptrace_write_gsbase()
543 			 * base would zero the selector.  On newer kernels,  in test_ptrace_write_gsbase()
544 			 * this behavior has changed -- poking the base  in test_ptrace_write_gsbase()
545 			 * changes only the base and, if FSGSBASE is not  in test_ptrace_write_gsbase()
551 		} else if (have_fsgsbase && (base != 0xFF)) {  in test_ptrace_write_gsbase()
553 			printf("[FAIL]\tGSBASE changed to %lx\n", base);  in test_ptrace_write_gsbase()
555 			printf("[OK]\tGS remained 0x%hx", *shared_scratch);  in test_ptrace_write_gsbase()
574 			      MAP_ANONYMOUS | MAP_SHARED, -1, 0);  in main()
651 	ftx = 3;  /* Kill the thread. */  in main()