1 // SPDX-License-Identifier: GPL-2.0-only
4  * Copyright (c) 2014-2016 Andy Lutomirski
32 # error This test is 64-bit only
74 	segv_addr = (unsigned long)si->si_addr;  in sigsegv()
76 	ctx->uc_mcontext.gregs[REG_RIP] += 4;	/* Skip the faulting mov */  in sigsegv()
126 		/* Use a constant-length instruction here. */  in read_base()
156 	unsigned long base;  in check_gs_value()  local
159 	printf("[RUN]\tARCH_SET_GS to 0x%lx\n", value);  in check_gs_value()
164 	base = read_base(GS);  in check_gs_value()
165 	if (base == value) {  in check_gs_value()
166 		printf("[OK]\tGSBASE was set as expected (selector 0x%hx)\n",  in check_gs_value()
170 		printf("[FAIL]\tGSBASE was not as expected: got 0x%lx (selector 0x%hx)\n",  in check_gs_value()
171 		       base, sel);  in check_gs_value()
174 	if (syscall(SYS_arch_prctl, ARCH_GET_GS, &base) != 0)  in check_gs_value()
176 	if (base == value) {  in check_gs_value()
177 		printf("[OK]\tARCH_GET_GS worked as expected (selector 0x%hx)\n",  in check_gs_value()
181 		printf("[FAIL]\tARCH_GET_GS was not as expected: got 0x%lx (selector 0x%hx)\n",  in check_gs_value()
182 		       base, sel);  in check_gs_value()
188 	unsigned long base, arch_base;  in mov_0_gs()  local
190 …printf("[RUN]\tARCH_SET_GS to 0x%lx then mov 0 to %%gs%s\n", initial_base, schedule ? " and schedu…  in mov_0_gs()
198 	base = read_base(GS);  in mov_0_gs()
201 	if (base == arch_base) {  in mov_0_gs()
202 		printf("[OK]\tGSBASE is 0x%lx\n", base);  in mov_0_gs()
205 		printf("[FAIL]\tGSBASE changed to 0x%lx but kernel reports 0x%lx\n", base, arch_base);  in mov_0_gs()
235 	printf("\tother thread: ARCH_SET_GS(0x%lx)%s -- sel is 0x%hx\n",  in do_remote_base()
239 static __thread int set_thread_area_entry_number = -1;
258 		.contents        = 0, /* Data, grow-up */  in load_gs()
274 			MAP_PRIVATE | MAP_ANONYMOUS | MAP_32BIT, -1, 0);  in load_gs()
277 		low_desc->entry_number = set_thread_area_entry_number;  in load_gs()
279 		/* 32-bit set_thread_area */  in load_gs()
289 			printf("[NOTE]\tcould not create a segment -- test won't do anything\n");  in load_gs()
295 		unsigned short gs = (unsigned short)((desc.entry_number << 3) | 0x3);  in load_gs()
301 void test_wrbase(unsigned short index, unsigned long base)  in test_wrbase()  argument
306 	printf("[RUN]\tGS = 0x%hx, GSBASE = 0x%lx\n", index, base);  in test_wrbase()
309 	wrgsbase(base);  in test_wrbase()
320 	if (newindex == index && newbase == base) {  in test_wrbase()
321 		printf("[OK]\tIndex and base were preserved\n");  in test_wrbase()
323 		printf("[FAIL]\tAfter switch, GS = 0x%hx and GSBASE = 0x%lx\n",  in test_wrbase()
334 		if (ftx == 3)  in threadproc()
360 	unsigned long base;  in set_gs_and_switch_to()  local
369 	printf("[RUN]\tARCH_SET_GS(0x%lx)%s, then schedule to 0x%lx\n",  in set_gs_and_switch_to()
372 		printf("\tBefore schedule, set selector to 0x%hx\n", force_sel);  in set_gs_and_switch_to()
390 		 * of 1, 2, or 3 back to 0 due to IRET being defective.  in set_gs_and_switch_to()
404 	base = read_base(GS);  in set_gs_and_switch_to()
405 	if (base == local && sel_pre_sched == sel_post_sched) {  in set_gs_and_switch_to()
406 		printf("[OK]\tGS/BASE remained 0x%hx/0x%lx\n",  in set_gs_and_switch_to()
408 	} else if (base == local && sel_pre_sched >= 1 && sel_pre_sched <= 3 &&  in set_gs_and_switch_to()
411 		 * IRET is misdesigned and will squash selectors 1, 2, or 3  in set_gs_and_switch_to()
414 		printf("[OK]\tGS/BASE changed from 0x%hx/0x%lx to 0x%hx/0x%lx because IRET is defective\n",  in set_gs_and_switch_to()
415 		       sel_pre_sched, local, sel_post_sched, base);  in set_gs_and_switch_to()
418 		printf("[FAIL]\tGS/BASE changed from 0x%hx/0x%lx to 0x%hx/0x%lx\n",  in set_gs_and_switch_to()
419 		       sel_pre_sched, local, sel_post_sched, base);  in set_gs_and_switch_to()
425 	unsigned long base;  in test_unexpected_base()  local
437 	base = read_base(GS);  in test_unexpected_base()
438 	if (base == 0) {  in test_unexpected_base()
442 		printf("[FAIL]\tGSBASE changed to 0x%lx\n", base);  in test_unexpected_base()
473 		unsigned long base;  in test_ptrace_write_gs_read_base()  local
477 		/* Read the initial base.  It should be 1. */  in test_ptrace_write_gs_read_base()
478 		base = ptrace(PTRACE_PEEKUSER, child, base_offset, NULL);  in test_ptrace_write_gs_read_base()
479 		if (base == 1) {  in test_ptrace_write_gs_read_base()
483 			printf("[FAIL]\tGSBASE started at 0x%lx\n", base);  in test_ptrace_write_gs_read_base()
492 		/* And read the base. */  in test_ptrace_write_gs_read_base()
493 		base = ptrace(PTRACE_PEEKUSER, child, base_offset, NULL);  in test_ptrace_write_gs_read_base()
495 		if (base == 0 || base == 1) {  in test_ptrace_write_gs_read_base()
496 			printf("[OK]\tGSBASE reads as 0x%lx with invalid GS\n", base);  in test_ptrace_write_gs_read_base()
499 			printf("[FAIL]\tGSBASE=0x%lx (should be 0 or 1)\n", base);  in test_ptrace_write_gs_read_base()
533 		unsigned long gs, base;  in test_ptrace_write_gsbase()  local
549 		base = ptrace(PTRACE_PEEKUSER, child, base_offset, NULL);  in test_ptrace_write_gsbase()
552 		 * In a non-FSGSBASE system, the nonzero selector will load  in test_ptrace_write_gsbase()
563 			 * base would zero the selector.  On newer kernels,  in test_ptrace_write_gsbase()
564 			 * this behavior has changed -- poking the base  in test_ptrace_write_gsbase()
565 			 * changes only the base and, if FSGSBASE is not  in test_ptrace_write_gsbase()
571 		} else if (have_fsgsbase && (base != 0xFF)) {  in test_ptrace_write_gsbase()
573 			printf("[FAIL]\tGSBASE changed to %lx\n", base);  in test_ptrace_write_gsbase()
575 			printf("[OK]\tGS remained 0x%hx", *shared_scratch);  in test_ptrace_write_gsbase()
594 			      MAP_ANONYMOUS | MAP_SHARED, -1, 0);  in main()
671 	ftx = 3;  /* Kill the thread. */  in main()