From: "Chang S. Bae" <chang.seok.bae@intel.com>
To: Andy Lutomirski <luto@kernel.org>,
Thomas Gleixner <tglx@linutronix.de>,
Ingo Molnar <mingo@kernel.org>, "H . Peter Anvin" <hpa@zytor.com>,
Andi Kleen <ak@linux.intel.com>
Cc: Ravi Shankar <ravi.v.shankar@intel.com>,
"Chang S . Bae" <chang.seok.bae@intel.com>,
LKML <linux-kernel@vger.kernel.org>
Subject: [PATCH v7 02/18] selftests/x86/fsgsbase: Test ptracer-induced GSBASE write
Date: Wed, 8 May 2019 03:02:17 -0700 [thread overview]
Message-ID: <1557309753-24073-3-git-send-email-chang.seok.bae@intel.com> (raw)
In-Reply-To: <1557309753-24073-1-git-send-email-chang.seok.bae@intel.com>
The test validates to make sure the selector is not changed when a
ptracer writes a ptracee's GSBASE.
Suggested-by: Andy Lutomirski <luto@kernel.org>
Signed-off-by: Chang S. Bae <chang.seok.bae@intel.com>
Cc: Thomas Gleixner <tglx@linutronix.de>
Cc: Ingo Molnar <mingo@kernel.org>
Cc: H. Peter Anvin <hpa@zytor.com>
Cc: Andi Kleen <ak@linux.intel.com>
---
tools/testing/selftests/x86/fsgsbase.c | 70 ++++++++++++++++++++++++++++++++++
1 file changed, 70 insertions(+)
diff --git a/tools/testing/selftests/x86/fsgsbase.c b/tools/testing/selftests/x86/fsgsbase.c
index f249e04..1c2dda0 100644
--- a/tools/testing/selftests/x86/fsgsbase.c
+++ b/tools/testing/selftests/x86/fsgsbase.c
@@ -23,6 +23,9 @@
#include <pthread.h>
#include <asm/ldt.h>
#include <sys/mman.h>
+#include <stddef.h>
+#include <sys/ptrace.h>
+#include <sys/wait.h>
#ifndef __x86_64__
# error This test is 64-bit only
@@ -367,6 +370,71 @@ static void test_unexpected_base(void)
}
}
+#define USER_REGS_OFFSET(r) offsetof(struct user_regs_struct, r)
+
+static void test_ptrace_write_gsbase(void)
+{
+ int status;
+ pid_t child = fork();
+
+ if (child < 0)
+ err(1, "fork");
+
+ if (child == 0) {
+ printf("[RUN]\tPTRACE_POKE(), write GSBASE from ptracer\n");
+
+ /*
+ * Use the LDT setup and fetch the GSBASE from the LDT
+ * by switching to the (nonzero) selector (again)
+ */
+ do_unexpected_base();
+ asm volatile ("mov %0, %%gs" : : "rm" ((unsigned short)0x7));
+
+ if (ptrace(PTRACE_TRACEME, 0, NULL, NULL) != 0)
+ err(1, "PTRACE_TRACEME");
+
+ raise(SIGTRAP);
+ _exit(0);
+ }
+
+ wait(&status);
+
+ if (WSTOPSIG(status) == SIGTRAP) {
+ unsigned long gs;
+ unsigned long gs_offset = USER_REGS_OFFSET(gs);
+ unsigned long base_offset = USER_REGS_OFFSET(gs_base);
+
+ gs = ptrace(PTRACE_PEEKUSER, child, gs_offset, NULL);
+
+ if (gs != 0x7) {
+ nerrs++;
+ printf("[FAIL]\tGS is not prepared with nonzero\n");
+ goto END;
+ }
+
+ if (ptrace(PTRACE_POKEUSER, child, base_offset, 0xFF) != 0)
+ err(1, "PTRACE_POKEUSER");
+
+ gs = ptrace(PTRACE_PEEKUSER, child, gs_offset, NULL);
+
+ /*
+ * In a non-FSGSBASE system, the nonzero selector will load
+ * GSBASE (again). But what is tested here is whether the
+ * selector value is changed or not by the GSBASE write in
+ * a ptracer.
+ */
+ if (gs != 0x7) {
+ nerrs++;
+ printf("[FAIL]\tGS changed to %lx\n", gs);
+ } else {
+ printf("[OK]\tGS remained 0x7\n");
+ }
+ }
+
+END:
+ ptrace(PTRACE_CONT, child, NULL, NULL);
+}
+
int main()
{
pthread_t thread;
@@ -423,5 +491,7 @@ int main()
if (pthread_join(thread, NULL) != 0)
err(1, "pthread_join");
+ test_ptrace_write_gsbase();
+
return nerrs == 0 ? 0 : 1;
}
--
2.7.4
next prev parent reply other threads:[~2019-05-08 17:04 UTC|newest]
Thread overview: 63+ messages / expand[flat|nested] mbox.gz Atom feed top
2019-05-08 10:02 [PATCH v7 00/18] x86: Enable FSGSBASE instructions Chang S. Bae
2019-05-08 10:02 ` [PATCH v7 01/18] x86/fsgsbase/64: Fix ARCH_SET_FS/GS behaviors for a remote task Chang S. Bae
[not found] ` <74F4F506-2913-4013-9D81-A0C69FA8CDF1@intel.com>
[not found] ` <6420E1A5-B5AD-4028-AA91-AA4D5445AC83@intel.com>
2019-06-16 15:44 ` Bae, Chang Seok
2019-06-16 16:32 ` Thomas Gleixner
2019-06-22 10:04 ` [tip:x86/cpu] x86/ptrace: Prevent ptrace from clearing the FS/GS selector tip-bot for Chang S. Bae
2020-06-18 13:50 ` [tip: x86/fsgsbase] " tip-bot2 for Chang S. Bae
2019-05-08 10:02 ` Chang S. Bae [this message]
2019-06-22 10:04 ` [tip:x86/cpu] selftests/x86/fsgsbase: Test ptracer-induced GSBASE write tip-bot for Chang S. Bae
2019-05-08 10:02 ` [PATCH v7 03/18] x86/fsgsbase/64: Add 'unsafe_fsgsbase' to enable CR4.FSGSBASE Chang S. Bae
2019-06-22 10:05 ` [tip:x86/cpu] x86/cpu: " tip-bot for Andy Lutomirski
2020-06-18 13:50 ` [tip: x86/fsgsbase] " tip-bot2 for Andy Lutomirski
2019-05-08 10:02 ` [PATCH v7 04/18] kbuild: Raise the minimum required binutils version to 2.21 Chang S. Bae
2019-06-22 10:06 ` [tip:x86/cpu] " tip-bot for Chang S. Bae
2019-05-08 10:02 ` [PATCH v7 05/18] x86/fsgsbase/64: Add intrinsics for FSGSBASE instructions Chang S. Bae
2019-06-22 10:06 ` [tip:x86/cpu] " tip-bot for Andi Kleen
2020-06-18 13:50 ` [tip: x86/fsgsbase] " tip-bot2 for Andi Kleen
2019-05-08 10:02 ` [PATCH v7 06/18] x86/fsgsbase/64: Enable FSGSBASE instructions in the helper functions Chang S. Bae
2019-06-22 10:07 ` [tip:x86/cpu] x86/fsgsbase/64: Enable FSGSBASE instructions in " tip-bot for Chang S. Bae
2020-06-18 13:50 ` [tip: x86/fsgsbase] " tip-bot2 for Chang S. Bae
2019-05-08 10:02 ` [PATCH v7 07/18] x86/fsgsbase/64: Preserve FS/GS state in __switch_to() if FSGSBASE is on Chang S. Bae
2019-06-21 15:22 ` Thomas Gleixner
2019-06-22 10:08 ` [tip:x86/cpu] x86/process/64: Use FSBSBASE in switch_to() if available tip-bot for Andy Lutomirski
2020-06-18 13:50 ` [tip: x86/fsgsbase] " tip-bot2 for Andy Lutomirski
2019-05-08 10:02 ` [PATCH v7 08/18] x86/fsgsbase/64: When copying a thread, use the FSGSBASE instructions Chang S. Bae
2019-06-22 10:09 ` [tip:x86/cpu] x86/process/64: Use FSGSBASE instructions on thread copy and ptrace tip-bot for Chang S. Bae
2020-06-18 13:50 ` [tip: x86/fsgsbase] " tip-bot2 for Chang S. Bae
2019-05-08 10:02 ` [PATCH v7 09/18] x86/entry/64: Add the READ_MSR_GSBASE macro Chang S. Bae
2019-05-08 10:02 ` [PATCH v7 10/18] x86/entry/64: Switch CR3 before SWAPGS on the paranoid entry Chang S. Bae
2019-06-22 10:09 ` [tip:x86/cpu] x86/entry/64: Switch CR3 before SWAPGS in " tip-bot for Chang S. Bae
2020-06-18 13:50 ` [tip: x86/fsgsbase] " tip-bot2 for Chang S. Bae
2019-05-08 10:02 ` [PATCH v7 11/18] x86/fsgsbase/64: Introduce the FIND_PERCPU_BASE macro Chang S. Bae
2019-06-22 10:10 ` [tip:x86/cpu] x86/entry/64: " tip-bot for Chang S. Bae
2020-06-18 13:50 ` [tip: x86/fsgsbase] " tip-bot2 for Chang S. Bae
2019-05-08 10:02 ` [PATCH v7 12/18] x86/fsgsbase/64: GSBASE handling with FSGSBASE in the paranoid path Chang S. Bae
2019-06-22 10:11 ` [tip:x86/cpu] x86/entry/64: Handle FSGSBASE enabled paranoid entry/exit tip-bot for Chang S. Bae
2019-06-29 7:21 ` [PATCH v7 12/18] x86/fsgsbase/64: GSBASE handling with FSGSBASE in the paranoid path Bae, Chang Seok
2019-06-29 7:37 ` Thomas Gleixner
2020-06-18 13:50 ` [tip: x86/fsgsbase] x86/entry/64: Handle FSGSBASE enabled paranoid entry/exit tip-bot2 for Chang S. Bae
2019-05-08 10:02 ` [PATCH v7 13/18] x86/fsgsbase/64: Document GSBASE handling in the paranoid path Chang S. Bae
2019-06-22 10:11 ` [tip:x86/cpu] x86/entry/64: " tip-bot for Chang S. Bae
2019-05-08 10:02 ` [PATCH v7 14/18] selftests/x86/fsgsbase: Test WRGSBASE Chang S. Bae
2019-06-22 10:12 ` [tip:x86/cpu] selftests/x86/fsgsbase: Test RD/WRGSBASE tip-bot for Andy Lutomirski
2019-05-08 10:02 ` [PATCH v7 15/18] selftests/x86/fsgsbase: Test ptracer-induced GSBASE write with FSGSBASE Chang S. Bae
2019-06-22 10:13 ` [tip:x86/cpu] " tip-bot for Chang S. Bae
2019-05-08 10:02 ` [PATCH v7 16/18] x86/fsgsbase/64: Enable FSGSBASE by default and add a chicken bit Chang S. Bae
2019-06-22 10:14 ` [tip:x86/cpu] x86/cpu: Enable FSGSBASE on 64bit " tip-bot for Andy Lutomirski
2020-06-18 13:50 ` [tip: x86/fsgsbase] " tip-bot2 for Andy Lutomirski
2019-05-08 10:02 ` [PATCH v7 17/18] x86/elf: Enumerate kernel FSGSBASE capability in AT_HWCAP2 Chang S. Bae
2019-06-22 10:14 ` [tip:x86/cpu] " tip-bot for Andi Kleen
2020-06-18 13:50 ` [tip: x86/fsgsbase] " tip-bot2 for Andi Kleen
2019-05-08 10:02 ` [PATCH v7 18/18] x86/fsgsbase/64: Add documentation for FSGSBASE Chang S. Bae
2019-06-14 6:54 ` Thomas Gleixner
2019-06-14 20:07 ` Bae, Chang Seok
[not found] ` <89BE934A-A392-4CED-83E5-CA4FADDAE6DF@intel.com>
2019-06-16 8:39 ` Thomas Gleixner
2019-06-16 12:34 ` Thomas Gleixner
2019-06-16 15:34 ` Bae, Chang Seok
2019-06-16 16:05 ` Thomas Gleixner
2019-06-16 20:48 ` Bae, Chang Seok
2019-06-16 22:00 ` Thomas Gleixner
[not found] ` <8E2E84B6-BCCC-424D-A1A7-604828B389FB@intel.com>
2019-06-17 5:18 ` Thomas Gleixner
2019-06-16 15:54 ` Randy Dunlap
2019-06-16 16:07 ` Thomas Gleixner
2019-06-22 10:15 ` [tip:x86/cpu] Documentation/x86/64: Add documentation for GS/FS addressing mode tip-bot for Thomas Gleixner
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=1557309753-24073-3-git-send-email-chang.seok.bae@intel.com \
--to=chang.seok.bae@intel.com \
--cc=ak@linux.intel.com \
--cc=hpa@zytor.com \
--cc=linux-kernel@vger.kernel.org \
--cc=luto@kernel.org \
--cc=mingo@kernel.org \
--cc=ravi.v.shankar@intel.com \
--cc=tglx@linutronix.de \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).