245 lines · c
1// SPDX-License-Identifier: GPL-2.0-only2/*3 * fsgsbase_restore.c, test ptrace vs fsgsbase4 * Copyright (c) 2020 Andy Lutomirski5 *6 * This test case simulates a tracer redirecting tracee execution to7 * a function and then restoring tracee state using PTRACE_GETREGS and8 * PTRACE_SETREGS. This is similar to what gdb does when doing9 * 'p func()'. The catch is that this test has the called function10 * modify a segment register. This makes sure that ptrace correctly11 * restores segment state when using PTRACE_SETREGS.12 *13 * This is not part of fsgsbase.c, because that test is 64-bit only.14 */15 16#define _GNU_SOURCE17#include <stdio.h>18#include <stdlib.h>19#include <stdbool.h>20#include <string.h>21#include <sys/syscall.h>22#include <unistd.h>23#include <err.h>24#include <sys/user.h>25#include <asm/prctl.h>26#include <sys/prctl.h>27#include <asm/ldt.h>28#include <sys/mman.h>29#include <stddef.h>30#include <sys/ptrace.h>31#include <sys/wait.h>32#include <stdint.h>33 34#define EXPECTED_VALUE 0x1337f00d35 36#ifdef __x86_64__37# define SEG "%gs"38#else39# define SEG "%fs"40#endif41 42/*43 * Defined in clang_helpers_[32|64].S, because unlike gcc, clang inline asm does44 * not support segmentation prefixes.45 */46unsigned int dereference_seg_base(void);47 48static void init_seg(void)49{50 unsigned int *target = mmap(51 NULL, sizeof(unsigned int),52 PROT_READ | PROT_WRITE,53 MAP_PRIVATE | MAP_ANONYMOUS | MAP_32BIT, -1, 0);54 if (target == MAP_FAILED)55 err(1, "mmap");56 57 *target = EXPECTED_VALUE;58 59 printf("\tsegment base address = 0x%lx\n", (unsigned long)target);60 61 struct user_desc desc = {62 .entry_number = 0,63 .base_addr = (unsigned int)(uintptr_t)target,64 .limit = sizeof(unsigned int) - 1,65 .seg_32bit = 1,66 .contents = 0, /* Data, grow-up */67 .read_exec_only = 0,68 .limit_in_pages = 0,69 .seg_not_present = 0,70 .useable = 071 };72 if (syscall(SYS_modify_ldt, 1, &desc, sizeof(desc)) == 0) {73 printf("\tusing LDT slot 0\n");74 asm volatile ("mov %0, %" SEG :: "rm" ((unsigned short)0x7));75 } else {76 /* No modify_ldt for us (configured out, perhaps) */77 78 struct user_desc *low_desc = mmap(79 NULL, sizeof(desc),80 PROT_READ | PROT_WRITE,81 MAP_PRIVATE | MAP_ANONYMOUS | MAP_32BIT, -1, 0);82 memcpy(low_desc, &desc, sizeof(desc));83 84 low_desc->entry_number = -1;85 86 /* 32-bit set_thread_area */87 long ret;88 asm volatile ("int $0x80"89 : "=a" (ret), "+m" (*low_desc)90 : "a" (243), "b" (low_desc)91#ifdef __x86_64__92 : "r8", "r9", "r10", "r11"93#endif94 );95 memcpy(&desc, low_desc, sizeof(desc));96 munmap(low_desc, sizeof(desc));97 98 if (ret != 0) {99 printf("[NOTE]\tcould not create a segment -- can't test anything\n");100 exit(0);101 }102 printf("\tusing GDT slot %d\n", desc.entry_number);103 104 unsigned short sel = (unsigned short)((desc.entry_number << 3) | 0x3);105 asm volatile ("mov %0, %" SEG :: "rm" (sel));106 }107}108 109static void tracee_zap_segment(void)110{111 /*112 * The tracer will redirect execution here. This is meant to113 * work like gdb's 'p func()' feature. The tricky bit is that114 * we modify a segment register in order to make sure that ptrace115 * can correctly restore segment registers.116 */117 printf("\tTracee: in tracee_zap_segment()\n");118 119 /*120 * Write a nonzero selector with base zero to the segment register.121 * Using a null selector would defeat the test on AMD pre-Zen2122 * CPUs, as such CPUs don't clear the base when loading a null123 * selector.124 */125 unsigned short sel;126 asm volatile ("mov %%ss, %0\n\t"127 "mov %0, %" SEG128 : "=rm" (sel));129 130 pid_t pid = getpid(), tid = syscall(SYS_gettid);131 132 printf("\tTracee is going back to sleep\n");133 syscall(SYS_tgkill, pid, tid, SIGSTOP);134 135 /* Should not get here. */136 while (true) {137 printf("[FAIL]\tTracee hit unreachable code\n");138 pause();139 }140}141 142int main()143{144 printf("\tSetting up a segment\n");145 init_seg();146 147 unsigned int val = dereference_seg_base();148 if (val != EXPECTED_VALUE) {149 printf("[FAIL]\tseg[0] == %x; should be %x\n", val, EXPECTED_VALUE);150 return 1;151 }152 printf("[OK]\tThe segment points to the right place.\n");153 154 pid_t chld = fork();155 if (chld < 0)156 err(1, "fork");157 158 if (chld == 0) {159 prctl(PR_SET_PDEATHSIG, SIGKILL, 0, 0, 0, 0);160 161 if (ptrace(PTRACE_TRACEME, 0, 0, 0) != 0)162 err(1, "PTRACE_TRACEME");163 164 pid_t pid = getpid(), tid = syscall(SYS_gettid);165 166 printf("\tTracee will take a nap until signaled\n");167 syscall(SYS_tgkill, pid, tid, SIGSTOP);168 169 printf("\tTracee was resumed. Will re-check segment.\n");170 171 val = dereference_seg_base();172 if (val != EXPECTED_VALUE) {173 printf("[FAIL]\tseg[0] == %x; should be %x\n", val, EXPECTED_VALUE);174 exit(1);175 }176 177 printf("[OK]\tThe segment points to the right place.\n");178 exit(0);179 }180 181 int status;182 183 /* Wait for SIGSTOP. */184 if (waitpid(chld, &status, 0) != chld || !WIFSTOPPED(status))185 err(1, "waitpid");186 187 struct user_regs_struct regs;188 189 if (ptrace(PTRACE_GETREGS, chld, NULL, ®s) != 0)190 err(1, "PTRACE_GETREGS");191 192#ifdef __x86_64__193 printf("\tChild GS=0x%lx, GSBASE=0x%lx\n", (unsigned long)regs.gs, (unsigned long)regs.gs_base);194#else195 printf("\tChild FS=0x%lx\n", (unsigned long)regs.xfs);196#endif197 198 struct user_regs_struct regs2 = regs;199#ifdef __x86_64__200 regs2.rip = (unsigned long)tracee_zap_segment;201 regs2.rsp -= 128; /* Don't clobber the redzone. */202#else203 regs2.eip = (unsigned long)tracee_zap_segment;204#endif205 206 printf("\tTracer: redirecting tracee to tracee_zap_segment()\n");207 if (ptrace(PTRACE_SETREGS, chld, NULL, ®s2) != 0)208 err(1, "PTRACE_GETREGS");209 if (ptrace(PTRACE_CONT, chld, NULL, NULL) != 0)210 err(1, "PTRACE_GETREGS");211 212 /* Wait for SIGSTOP. */213 if (waitpid(chld, &status, 0) != chld || !WIFSTOPPED(status))214 err(1, "waitpid");215 216 printf("\tTracer: restoring tracee state\n");217 if (ptrace(PTRACE_SETREGS, chld, NULL, ®s) != 0)218 err(1, "PTRACE_GETREGS");219 if (ptrace(PTRACE_DETACH, chld, NULL, NULL) != 0)220 err(1, "PTRACE_GETREGS");221 222 /* Wait for SIGSTOP. */223 if (waitpid(chld, &status, 0) != chld)224 err(1, "waitpid");225 226 if (WIFSIGNALED(status)) {227 printf("[FAIL]\tTracee crashed\n");228 return 1;229 }230 231 if (!WIFEXITED(status)) {232 printf("[FAIL]\tTracee stopped for an unexpected reason: %d\n", status);233 return 1;234 }235 236 int exitcode = WEXITSTATUS(status);237 if (exitcode != 0) {238 printf("[FAIL]\tTracee reported failure\n");239 return 1;240 }241 242 printf("[OK]\tAll is well.\n");243 return 0;244}245