tools/testing/selftests/x86/ldt_gdt.c

   1 /*
   2  * ldt_gdt.c - Test cases for LDT and GDT access
   3  * Copyright (c) 2015 Andrew Lutomirski
   4  */
   5
   6 #define _GNU_SOURCE
   7 #include <err.h>
   8 #include <stdio.h>
   9 #include <stdint.h>
  10 #include <signal.h>
  11 #include <setjmp.h>
  12 #include <stdlib.h>
  13 #include <string.h>
  14 #include <errno.h>
  15 #include <unistd.h>
  16 #include <sys/syscall.h>
  17 #include <asm/ldt.h>
  18 #include <sys/types.h>
  19 #include <sys/wait.h>
  20 #include <stdbool.h>
  21 #include <pthread.h>
  22 #include <sched.h>
  23 #include <linux/futex.h>
  24 #include <sys/mman.h>
  25 #include <asm/prctl.h>
  26 #include <sys/prctl.h>
  27
  28 #define AR_ACCESSED             (1<<8)
  29
  30 #define AR_TYPE_RODATA          (0 * (1<<9))
  31 #define AR_TYPE_RWDATA          (1 * (1<<9))
  32 #define AR_TYPE_RODATA_EXPDOWN  (2 * (1<<9))
  33 #define AR_TYPE_RWDATA_EXPDOWN  (3 * (1<<9))
  34 #define AR_TYPE_XOCODE          (4 * (1<<9))
  35 #define AR_TYPE_XRCODE          (5 * (1<<9))
  36 #define AR_TYPE_XOCODE_CONF     (6 * (1<<9))
  37 #define AR_TYPE_XRCODE_CONF     (7 * (1<<9))
  38
  39 #define AR_DPL3                 (3 * (1<<13))
  40
  41 #define AR_S                    (1 << 12)
  42 #define AR_P                    (1 << 15)
  43 #define AR_AVL                  (1 << 20)
  44 #define AR_L                    (1 << 21)
  45 #define AR_DB                   (1 << 22)
  46 #define AR_G                    (1 << 23)
  47
  48 static int nerrs;
  49
  50 /* Points to an array of 1024 ints, each holding its own index. */
  51 static const unsigned int *counter_page;
  52 static struct user_desc *low_user_desc;
  53 static struct user_desc *low_user_desc_clear;  /* Use to delete GDT entry */
  54 static int gdt_entry_num;
  55
  56 static void check_invalid_segment(uint16_t index, int ldt)
  57 {
  58         uint32_t has_limit = 0, has_ar = 0, limit, ar;
  59         uint32_t selector = (index << 3) | (ldt << 2) | 3;
  60
  61         asm ("lsl %[selector], %[limit]\n\t"
  62              "jnz 1f\n\t"
  63              "movl $1, %[has_limit]\n\t"
  64              "1:"
  65              : [limit] "=r" (limit), [has_limit] "+rm" (has_limit)
  66              : [selector] "r" (selector));
  67         asm ("larl %[selector], %[ar]\n\t"
  68              "jnz 1f\n\t"
  69              "movl $1, %[has_ar]\n\t"
  70              "1:"
  71              : [ar] "=r" (ar), [has_ar] "+rm" (has_ar)
  72              : [selector] "r" (selector));
  73
  74         if (has_limit || has_ar) {
  75                 printf("[FAIL]\t%s entry %hu is valid but should be invalid\n",
  76                        (ldt ? "LDT" : "GDT"), index);
  77                 nerrs++;
  78         } else {
  79                 printf("[OK]\t%s entry %hu is invalid\n",
  80                        (ldt ? "LDT" : "GDT"), index);
  81         }
  82 }
  83
  84 static void check_valid_segment(uint16_t index, int ldt,
  85                                 uint32_t expected_ar, uint32_t expected_limit,
  86                                 bool verbose)
  87 {
  88         uint32_t has_limit = 0, has_ar = 0, limit, ar;
  89         uint32_t selector = (index << 3) | (ldt << 2) | 3;
  90
  91         asm ("lsl %[selector], %[limit]\n\t"
  92              "jnz 1f\n\t"
  93              "movl $1, %[has_limit]\n\t"
  94              "1:"
  95              : [limit] "=r" (limit), [has_limit] "+rm" (has_limit)
  96              : [selector] "r" (selector));
  97         asm ("larl %[selector], %[ar]\n\t"
  98              "jnz 1f\n\t"
  99              "movl $1, %[has_ar]\n\t"
 100              "1:"
 101              : [ar] "=r" (ar), [has_ar] "+rm" (has_ar)
 102              : [selector] "r" (selector));
 103
 104         if (!has_limit || !has_ar) {
 105                 printf("[FAIL]\t%s entry %hu is invalid but should be valid\n",
 106                        (ldt ? "LDT" : "GDT"), index);
 107                 nerrs++;
 108                 return;
 109         }
 110
 111         if (ar != expected_ar) {
 112                 printf("[FAIL]\t%s entry %hu has AR 0x%08X but expected 0x%08X\n",
 113                        (ldt ? "LDT" : "GDT"), index, ar, expected_ar);
 114                 nerrs++;
 115         } else if (limit != expected_limit) {
 116                 printf("[FAIL]\t%s entry %hu has limit 0x%08X but expected 0x%08X\n",
 117                        (ldt ? "LDT" : "GDT"), index, limit, expected_limit);
 118                 nerrs++;
 119         } else if (verbose) {
 120                 printf("[OK]\t%s entry %hu has AR 0x%08X and limit 0x%08X\n",
 121                        (ldt ? "LDT" : "GDT"), index, ar, limit);
 122         }
 123 }
 124
 125 static bool install_valid_mode(const struct user_desc *desc, uint32_t ar,
 126                                bool oldmode)
 127 {
 128         int ret = syscall(SYS_modify_ldt, oldmode ? 1 : 0x11,
 129                           desc, sizeof(*desc));
 130         if (ret < -1)
 131                 errno = -ret;
 132         if (ret == 0) {
 133                 uint32_t limit = desc->limit;
 134                 if (desc->limit_in_pages)
 135                         limit = (limit << 12) + 4095;
 136                 check_valid_segment(desc->entry_number, 1, ar, limit, true);
 137                 return true;
 138         } else if (errno == ENOSYS) {
 139                 printf("[OK]\tmodify_ldt returned -ENOSYS\n");
 140                 return false;
 141         } else {
 142                 if (desc->seg_32bit) {
 143                         printf("[FAIL]\tUnexpected modify_ldt failure %d\n",
 144                                errno);
 145                         nerrs++;
 146                         return false;
 147                 } else {
 148                         printf("[OK]\tmodify_ldt rejected 16 bit segment\n");
 149                         return false;
 150                 }
 151         }
 152 }
 153
 154 static bool install_valid(const struct user_desc *desc, uint32_t ar)
 155 {
 156         return install_valid_mode(desc, ar, false);
 157 }
 158
 159 static void install_invalid(const struct user_desc *desc, bool oldmode)
 160 {
 161         int ret = syscall(SYS_modify_ldt, oldmode ? 1 : 0x11,
 162                           desc, sizeof(*desc));
 163         if (ret < -1)
 164                 errno = -ret;
 165         if (ret == 0) {
 166                 check_invalid_segment(desc->entry_number, 1);
 167         } else if (errno == ENOSYS) {
 168                 printf("[OK]\tmodify_ldt returned -ENOSYS\n");
 169         } else {
 170                 if (desc->seg_32bit) {
 171                         printf("[FAIL]\tUnexpected modify_ldt failure %d\n",
 172                                errno);
 173                         nerrs++;
 174                 } else {
 175                         printf("[OK]\tmodify_ldt rejected 16 bit segment\n");
 176                 }
 177         }
 178 }
 179
 180 static int safe_modify_ldt(int func, struct user_desc *ptr,
 181                            unsigned long bytecount)
 182 {
 183         int ret = syscall(SYS_modify_ldt, 0x11, ptr, bytecount);
 184         if (ret < -1)
 185                 errno = -ret;
 186         return ret;
 187 }
 188
 189 static void fail_install(struct user_desc *desc)
 190 {
 191         if (safe_modify_ldt(0x11, desc, sizeof(*desc)) == 0) {
 192                 printf("[FAIL]\tmodify_ldt accepted a bad descriptor\n");
 193                 nerrs++;
 194         } else if (errno == ENOSYS) {
 195                 printf("[OK]\tmodify_ldt returned -ENOSYS\n");
 196         } else {
 197                 printf("[OK]\tmodify_ldt failure %d\n", errno);
 198         }
 199 }
 200
 201 static void do_simple_tests(void)
 202 {
 203         struct user_desc desc = {
 204                 .entry_number    = 0,
 205                 .base_addr       = 0,
 206                 .limit           = 10,
 207                 .seg_32bit       = 1,
 208                 .contents        = 2, /* Code, not conforming */
 209                 .read_exec_only  = 0,
 210                 .limit_in_pages  = 0,
 211                 .seg_not_present = 0,
 212                 .useable         = 0
 213         };
 214         install_valid(&desc, AR_DPL3 | AR_TYPE_XRCODE | AR_S | AR_P | AR_DB);
 215
 216         desc.limit_in_pages = 1;
 217         install_valid(&desc, AR_DPL3 | AR_TYPE_XRCODE |
 218                       AR_S | AR_P | AR_DB | AR_G);
 219
 220         check_invalid_segment(1, 1);
 221
 222         desc.entry_number = 2;
 223         install_valid(&desc, AR_DPL3 | AR_TYPE_XRCODE |
 224                       AR_S | AR_P | AR_DB | AR_G);
 225
 226         check_invalid_segment(1, 1);
 227
 228         desc.base_addr = 0xf0000000;
 229         install_valid(&desc, AR_DPL3 | AR_TYPE_XRCODE |
 230                       AR_S | AR_P | AR_DB | AR_G);
 231
 232         desc.useable = 1;
 233         install_valid(&desc, AR_DPL3 | AR_TYPE_XRCODE |
 234                       AR_S | AR_P | AR_DB | AR_G | AR_AVL);
 235
 236         desc.seg_not_present = 1;
 237         install_valid(&desc, AR_DPL3 | AR_TYPE_XRCODE |
 238                       AR_S | AR_DB | AR_G | AR_AVL);
 239
 240         desc.seg_32bit = 0;
 241         install_valid(&desc, AR_DPL3 | AR_TYPE_XRCODE |
 242                       AR_S | AR_G | AR_AVL);
 243
 244         desc.seg_32bit = 1;
 245         desc.contents = 0;
 246         install_valid(&desc, AR_DPL3 | AR_TYPE_RWDATA |
 247                       AR_S | AR_DB | AR_G | AR_AVL);
 248
 249         desc.read_exec_only = 1;
 250         install_valid(&desc, AR_DPL3 | AR_TYPE_RODATA |
 251                       AR_S | AR_DB | AR_G | AR_AVL);
 252
 253         desc.contents = 1;
 254         install_valid(&desc, AR_DPL3 | AR_TYPE_RODATA_EXPDOWN |
 255                       AR_S | AR_DB | AR_G | AR_AVL);
 256
 257         desc.read_exec_only = 0;
 258         desc.limit_in_pages = 0;
 259         install_valid(&desc, AR_DPL3 | AR_TYPE_RWDATA_EXPDOWN |
 260                       AR_S | AR_DB | AR_AVL);
 261
 262         desc.contents = 3;
 263         install_valid(&desc, AR_DPL3 | AR_TYPE_XRCODE_CONF |
 264                       AR_S | AR_DB | AR_AVL);
 265
 266         desc.read_exec_only = 1;
 267         install_valid(&desc, AR_DPL3 | AR_TYPE_XOCODE_CONF |
 268                       AR_S | AR_DB | AR_AVL);
 269
 270         desc.read_exec_only = 0;
 271         desc.contents = 2;
 272         install_valid(&desc, AR_DPL3 | AR_TYPE_XRCODE |
 273                       AR_S | AR_DB | AR_AVL);
 274
 275         desc.read_exec_only = 1;
 276
 277 #ifdef __x86_64__
 278         desc.lm = 1;
 279         install_valid(&desc, AR_DPL3 | AR_TYPE_XOCODE |
 280                       AR_S | AR_DB | AR_AVL);
 281         desc.lm = 0;
 282 #endif
 283
 284         bool entry1_okay = install_valid(&desc, AR_DPL3 | AR_TYPE_XOCODE |
 285                                          AR_S | AR_DB | AR_AVL);
 286
 287         if (entry1_okay) {
 288                 printf("[RUN]\tTest fork\n");
 289                 pid_t child = fork();
 290                 if (child == 0) {
 291                         nerrs = 0;
 292                         check_valid_segment(desc.entry_number, 1,
 293                                             AR_DPL3 | AR_TYPE_XOCODE |
 294                                             AR_S | AR_DB | AR_AVL, desc.limit,
 295                                             true);
 296                         check_invalid_segment(1, 1);
 297                         exit(nerrs ? 1 : 0);
 298                 } else {
 299                         int status;
 300                         if (waitpid(child, &status, 0) != child ||
 301                             !WIFEXITED(status)) {
 302                                 printf("[FAIL]\tChild died\n");
 303                                 nerrs++;
 304                         } else if (WEXITSTATUS(status) != 0) {
 305                                 printf("[FAIL]\tChild failed\n");
 306                                 nerrs++;
 307                         } else {
 308                                 printf("[OK]\tChild succeeded\n");
 309                         }
 310                 }
 311
 312                 printf("[RUN]\tTest size\n");
 313                 int i;
 314                 for (i = 0; i < 8192; i++) {
 315                         desc.entry_number = i;
 316                         desc.limit = i;
 317                         if (safe_modify_ldt(0x11, &desc, sizeof(desc)) != 0) {
 318                                 printf("[FAIL]\tFailed to install entry %d\n", i);
 319                                 nerrs++;
 320                                 break;
 321                         }
 322                 }
 323                 for (int j = 0; j < i; j++) {
 324                         check_valid_segment(j, 1, AR_DPL3 | AR_TYPE_XOCODE |
 325                                             AR_S | AR_DB | AR_AVL, j, false);
 326                 }
 327                 printf("[DONE]\tSize test\n");
 328         } else {
 329                 printf("[SKIP]\tSkipping fork and size tests because we have no LDT\n");
 330         }
 331
 332         /* Test entry_number too high. */
 333         desc.entry_number = 8192;
 334         fail_install(&desc);
 335
 336         /* Test deletion and actions mistakeable for deletion. */
 337         memset(&desc, 0, sizeof(desc));
 338         install_valid(&desc, AR_DPL3 | AR_TYPE_RWDATA | AR_S | AR_P);
 339
 340         desc.seg_not_present = 1;
 341         install_valid(&desc, AR_DPL3 | AR_TYPE_RWDATA | AR_S);
 342
 343         desc.seg_not_present = 0;
 344         desc.read_exec_only = 1;
 345         install_valid(&desc, AR_DPL3 | AR_TYPE_RODATA | AR_S | AR_P);
 346
 347         desc.read_exec_only = 0;
 348         desc.seg_not_present = 1;
 349         install_valid(&desc, AR_DPL3 | AR_TYPE_RWDATA | AR_S);
 350
 351         desc.read_exec_only = 1;
 352         desc.limit = 1;
 353         install_valid(&desc, AR_DPL3 | AR_TYPE_RODATA | AR_S);
 354
 355         desc.limit = 0;
 356         desc.base_addr = 1;
 357         install_valid(&desc, AR_DPL3 | AR_TYPE_RODATA | AR_S);
 358
 359         desc.base_addr = 0;
 360         install_invalid(&desc, false);
 361
 362         desc.seg_not_present = 0;
 363         desc.read_exec_only = 0;
 364         desc.seg_32bit = 1;
 365         install_valid(&desc, AR_DPL3 | AR_TYPE_RWDATA | AR_S | AR_P | AR_DB);
 366         install_invalid(&desc, true);
 367 }
 368
 369 /*
 370  * 0: thread is idle
 371  * 1: thread armed
 372  * 2: thread should clear LDT entry 0
 373  * 3: thread should exit
 374  */
 375 static volatile unsigned int ftx;
 376
 377 static void *threadproc(void *ctx)
 378 {
 379         cpu_set_t cpuset;
 380         CPU_ZERO(&cpuset);
 381         CPU_SET(1, &cpuset);
 382         if (sched_setaffinity(0, sizeof(cpuset), &cpuset) != 0)
 383                 err(1, "sched_setaffinity to CPU 1");   /* should never fail */
 384
 385         while (1) {
 386                 syscall(SYS_futex, &ftx, FUTEX_WAIT, 0, NULL, NULL, 0);
 387                 while (ftx != 2) {
 388                         if (ftx >= 3)
 389                                 return NULL;
 390                 }
 391
 392                 /* clear LDT entry 0 */
 393                 const struct user_desc desc = {};
 394                 if (syscall(SYS_modify_ldt, 1, &desc, sizeof(desc)) != 0)
 395                         err(1, "modify_ldt");
 396
 397                 /* If ftx == 2, set it to zero.  If ftx == 100, quit. */
 398                 unsigned int x = -2;
 399                 asm volatile ("lock xaddl %[x], %[ftx]" :
 400                               [x] "+r" (x), [ftx] "+m" (ftx));
 401                 if (x != 2)
 402                         return NULL;
 403         }
 404 }
 405
 406 static void sethandler(int sig, void (*handler)(int, siginfo_t *, void *),
 407                        int flags)
 408 {
 409         struct sigaction sa;
 410         memset(&sa, 0, sizeof(sa));
 411         sa.sa_sigaction = handler;
 412         sa.sa_flags = SA_SIGINFO | flags;
 413         sigemptyset(&sa.sa_mask);
 414         if (sigaction(sig, &sa, 0))
 415                 err(1, "sigaction");
 416
 417 }
 418
 419 static jmp_buf jmpbuf;
 420
 421 static void sigsegv(int sig, siginfo_t *info, void *ctx_void)
 422 {
 423         siglongjmp(jmpbuf, 1);
 424 }
 425
 426 static void do_multicpu_tests(void)
 427 {
 428         cpu_set_t cpuset;
 429         pthread_t thread;
 430         int failures = 0, iters = 5, i;
 431         unsigned short orig_ss;
 432
 433         CPU_ZERO(&cpuset);
 434         CPU_SET(1, &cpuset);
 435         if (sched_setaffinity(0, sizeof(cpuset), &cpuset) != 0) {
 436                 printf("[SKIP]\tCannot set affinity to CPU 1\n");
 437                 return;
 438         }
 439
 440         CPU_ZERO(&cpuset);
 441         CPU_SET(0, &cpuset);
 442         if (sched_setaffinity(0, sizeof(cpuset), &cpuset) != 0) {
 443                 printf("[SKIP]\tCannot set affinity to CPU 0\n");
 444                 return;
 445         }
 446
 447         sethandler(SIGSEGV, sigsegv, 0);
 448 #ifdef __i386__
 449         /* True 32-bit kernels send SIGILL instead of SIGSEGV on IRET faults. */
 450         sethandler(SIGILL, sigsegv, 0);
 451 #endif
 452
 453         printf("[RUN]\tCross-CPU LDT invalidation\n");
 454
 455         if (pthread_create(&thread, 0, threadproc, 0) != 0)
 456                 err(1, "pthread_create");
 457
 458         asm volatile ("mov %%ss, %0" : "=rm" (orig_ss));
 459
 460         for (i = 0; i < 5; i++) {
 461                 if (sigsetjmp(jmpbuf, 1) != 0)
 462                         continue;
 463
 464                 /* Make sure the thread is ready after the last test. */
 465                 while (ftx != 0)
 466                         ;
 467
 468                 struct user_desc desc = {
 469                         .entry_number    = 0,
 470                         .base_addr       = 0,
 471                         .limit           = 0xfffff,
 472                         .seg_32bit       = 1,
 473                         .contents        = 0, /* Data */
 474                         .read_exec_only  = 0,
 475                         .limit_in_pages  = 1,
 476                         .seg_not_present = 0,
 477                         .useable         = 0
 478                 };
 479
 480                 if (safe_modify_ldt(0x11, &desc, sizeof(desc)) != 0) {
 481                         if (errno != ENOSYS)
 482                                 err(1, "modify_ldt");
 483                         printf("[SKIP]\tmodify_ldt unavailable\n");
 484                         break;
 485                 }
 486
 487                 /* Arm the thread. */
 488                 ftx = 1;
 489                 syscall(SYS_futex, &ftx, FUTEX_WAKE, 0, NULL, NULL, 0);
 490
 491                 asm volatile ("mov %0, %%ss" : : "r" (0x7));
 492
 493                 /* Go! */
 494                 ftx = 2;
 495
 496                 while (ftx != 0)
 497                         ;
 498
 499                 /*
 500                  * On success, modify_ldt will segfault us synchronously,
 501                  * and we'll escape via siglongjmp.
 502                  */
 503
 504                 failures++;
 505                 asm volatile ("mov %0, %%ss" : : "rm" (orig_ss));
 506         };
 507
 508         ftx = 100;  /* Kill the thread. */
 509         syscall(SYS_futex, &ftx, FUTEX_WAKE, 0, NULL, NULL, 0);
 510
 511         if (pthread_join(thread, NULL) != 0)
 512                 err(1, "pthread_join");
 513
 514         if (failures) {
 515                 printf("[FAIL]\t%d of %d iterations failed\n", failures, iters);
 516                 nerrs++;
 517         } else {
 518                 printf("[OK]\tAll %d iterations succeeded\n", iters);
 519         }
 520 }
 521
 522 static int finish_exec_test(void)
 523 {
 524         /*
 525          * In a sensible world, this would be check_invalid_segment(0, 1);
 526          * For better or for worse, though, the LDT is inherited across exec.
 527          * We can probably change this safely, but for now we test it.
 528          */
 529         check_valid_segment(0, 1,
 530                             AR_DPL3 | AR_TYPE_XRCODE | AR_S | AR_P | AR_DB,
 531                             42, true);
 532
 533         return nerrs ? 1 : 0;
 534 }
 535
 536 static void do_exec_test(void)
 537 {
 538         printf("[RUN]\tTest exec\n");
 539
 540         struct user_desc desc = {
 541                 .entry_number    = 0,
 542                 .base_addr       = 0,
 543                 .limit           = 42,
 544                 .seg_32bit       = 1,
 545                 .contents        = 2, /* Code, not conforming */
 546                 .read_exec_only  = 0,
 547                 .limit_in_pages  = 0,
 548                 .seg_not_present = 0,
 549                 .useable         = 0
 550         };
 551         install_valid(&desc, AR_DPL3 | AR_TYPE_XRCODE | AR_S | AR_P | AR_DB);
 552
 553         pid_t child = fork();
 554         if (child == 0) {
 555                 execl("/proc/self/exe", "ldt_gdt_test_exec", NULL);
 556                 printf("[FAIL]\tCould not exec self\n");
 557                 exit(1);        /* exec failed */
 558         } else {
 559                 int status;
 560                 if (waitpid(child, &status, 0) != child ||
 561                     !WIFEXITED(status)) {
 562                         printf("[FAIL]\tChild died\n");
 563                         nerrs++;
 564                 } else if (WEXITSTATUS(status) != 0) {
 565                         printf("[FAIL]\tChild failed\n");
 566                         nerrs++;
 567                 } else {
 568                         printf("[OK]\tChild succeeded\n");
 569                 }
 570         }
 571 }
 572
 573 static void setup_counter_page(void)
 574 {
 575         unsigned int *page = mmap(NULL, 4096, PROT_READ | PROT_WRITE,
 576                          MAP_ANONYMOUS | MAP_PRIVATE | MAP_32BIT, -1, 0);
 577         if (page == MAP_FAILED)
 578                 err(1, "mmap");
 579
 580         for (int i = 0; i < 1024; i++)
 581                 page[i] = i;
 582         counter_page = page;
 583 }
 584
 585 static int invoke_set_thread_area(void)
 586 {
 587         int ret;
 588         asm volatile ("int $0x80"
 589                       : "=a" (ret), "+m" (low_user_desc) :
 590                         "a" (243), "b" (low_user_desc)
 591                       : "flags");
 592         return ret;
 593 }
 594
 595 static void setup_low_user_desc(void)
 596 {
 597         low_user_desc = mmap(NULL, 2 * sizeof(struct user_desc),
 598                              PROT_READ | PROT_WRITE,
 599                              MAP_ANONYMOUS | MAP_PRIVATE | MAP_32BIT, -1, 0);
 600         if (low_user_desc == MAP_FAILED)
 601                 err(1, "mmap");
 602
 603         low_user_desc->entry_number     = -1;
 604         low_user_desc->base_addr        = (unsigned long)&counter_page[1];
 605         low_user_desc->limit            = 0xfffff;
 606         low_user_desc->seg_32bit        = 1;
 607         low_user_desc->contents         = 0; /* Data, grow-up*/
 608         low_user_desc->read_exec_only   = 0;
 609         low_user_desc->limit_in_pages   = 1;
 610         low_user_desc->seg_not_present  = 0;
 611         low_user_desc->useable          = 0;
 612
 613         if (invoke_set_thread_area() == 0) {
 614                 gdt_entry_num = low_user_desc->entry_number;
 615                 printf("[NOTE]\tset_thread_area is available; will use GDT index %d\n", gdt_entry_num);
 616         } else {
 617                 printf("[NOTE]\tset_thread_area is unavailable\n");
 618         }
 619
 620         low_user_desc_clear = low_user_desc + 1;
 621         low_user_desc_clear->entry_number = gdt_entry_num;
 622         low_user_desc_clear->read_exec_only = 1;
 623         low_user_desc_clear->seg_not_present = 1;
 624 }
 625
 626 static void test_gdt_invalidation(void)
 627 {
 628         if (!gdt_entry_num)
 629                 return; /* 64-bit only system -- we can't use set_thread_area */
 630
 631         unsigned short prev_sel;
 632         unsigned short sel;
 633         unsigned int eax;
 634         const char *result;
 635 #ifdef __x86_64__
 636         unsigned long saved_base;
 637         unsigned long new_base;
 638 #endif
 639
 640         /* Test DS */
 641         invoke_set_thread_area();
 642         eax = 243;
 643         sel = (gdt_entry_num << 3) | 3;
 644         asm volatile ("movw %%ds, %[prev_sel]\n\t"
 645                       "movw %[sel], %%ds\n\t"
 646 #ifdef __i386__
 647                       "pushl %%ebx\n\t"
 648 #endif
 649                       "movl %[arg1], %%ebx\n\t"
 650                       "int $0x80\n\t"   /* Should invalidate ds */
 651 #ifdef __i386__
 652                       "popl %%ebx\n\t"
 653 #endif
 654                       "movw %%ds, %[sel]\n\t"
 655                       "movw %[prev_sel], %%ds"
 656                       : [prev_sel] "=&r" (prev_sel), [sel] "+r" (sel),
 657                         "+a" (eax)
 658                       : "m" (low_user_desc_clear),
 659                         [arg1] "r" ((unsigned int)(unsigned long)low_user_desc_clear)
 660                       : "flags");
 661
 662         if (sel != 0) {
 663                 result = "FAIL";
 664                 nerrs++;
 665         } else {
 666                 result = "OK";
 667         }
 668         printf("[%s]\tInvalidate DS with set_thread_area: new DS = 0x%hx\n",
 669                result, sel);
 670
 671         /* Test ES */
 672         invoke_set_thread_area();
 673         eax = 243;
 674         sel = (gdt_entry_num << 3) | 3;
 675         asm volatile ("movw %%es, %[prev_sel]\n\t"
 676                       "movw %[sel], %%es\n\t"
 677 #ifdef __i386__
 678                       "pushl %%ebx\n\t"
 679 #endif
 680                       "movl %[arg1], %%ebx\n\t"
 681                       "int $0x80\n\t"   /* Should invalidate es */
 682 #ifdef __i386__
 683                       "popl %%ebx\n\t"
 684 #endif
 685                       "movw %%es, %[sel]\n\t"
 686                       "movw %[prev_sel], %%es"
 687                       : [prev_sel] "=&r" (prev_sel), [sel] "+r" (sel),
 688                         "+a" (eax)
 689                       : "m" (low_user_desc_clear),
 690                         [arg1] "r" ((unsigned int)(unsigned long)low_user_desc_clear)
 691                       : "flags");
 692
 693         if (sel != 0) {
 694                 result = "FAIL";
 695                 nerrs++;
 696         } else {
 697                 result = "OK";
 698         }
 699         printf("[%s]\tInvalidate ES with set_thread_area: new ES = 0x%hx\n",
 700                result, sel);
 701
 702         /* Test FS */
 703         invoke_set_thread_area();
 704         eax = 243;
 705         sel = (gdt_entry_num << 3) | 3;
 706 #ifdef __x86_64__
 707         syscall(SYS_arch_prctl, ARCH_GET_FS, &saved_base);
 708 #endif
 709         asm volatile ("movw %%fs, %[prev_sel]\n\t"
 710                       "movw %[sel], %%fs\n\t"
 711 #ifdef __i386__
 712                       "pushl %%ebx\n\t"
 713 #endif
 714                       "movl %[arg1], %%ebx\n\t"
 715                       "int $0x80\n\t"   /* Should invalidate fs */
 716 #ifdef __i386__
 717                       "popl %%ebx\n\t"
 718 #endif
 719                       "movw %%fs, %[sel]\n\t"
 720                       : [prev_sel] "=&r" (prev_sel), [sel] "+r" (sel),
 721                         "+a" (eax)
 722                       : "m" (low_user_desc_clear),
 723                         [arg1] "r" ((unsigned int)(unsigned long)low_user_desc_clear)
 724                       : "flags");
 725
 726 #ifdef __x86_64__
 727         syscall(SYS_arch_prctl, ARCH_GET_FS, &new_base);
 728 #endif
 729
 730         /* Restore FS/BASE for glibc */
 731         asm volatile ("movw %[prev_sel], %%fs" : : [prev_sel] "rm" (prev_sel));
 732 #ifdef __x86_64__
 733         if (saved_base)
 734                 syscall(SYS_arch_prctl, ARCH_SET_FS, saved_base);
 735 #endif
 736
 737         if (sel != 0) {
 738                 result = "FAIL";
 739                 nerrs++;
 740         } else {
 741                 result = "OK";
 742         }
 743         printf("[%s]\tInvalidate FS with set_thread_area: new FS = 0x%hx\n",
 744                result, sel);
 745
 746 #ifdef __x86_64__
 747         if (sel == 0 && new_base != 0) {
 748                 nerrs++;
 749                 printf("[FAIL]\tNew FSBASE was 0x%lx\n", new_base);
 750         } else {
 751                 printf("[OK]\tNew FSBASE was zero\n");
 752         }
 753 #endif
 754
 755         /* Test GS */
 756         invoke_set_thread_area();
 757         eax = 243;
 758         sel = (gdt_entry_num << 3) | 3;
 759 #ifdef __x86_64__
 760         syscall(SYS_arch_prctl, ARCH_GET_GS, &saved_base);
 761 #endif
 762         asm volatile ("movw %%gs, %[prev_sel]\n\t"
 763                       "movw %[sel], %%gs\n\t"
 764 #ifdef __i386__
 765                       "pushl %%ebx\n\t"
 766 #endif
 767                       "movl %[arg1], %%ebx\n\t"
 768                       "int $0x80\n\t"   /* Should invalidate gs */
 769 #ifdef __i386__
 770                       "popl %%ebx\n\t"
 771 #endif
 772                       "movw %%gs, %[sel]\n\t"
 773                       : [prev_sel] "=&r" (prev_sel), [sel] "+r" (sel),
 774                         "+a" (eax)
 775                       : "m" (low_user_desc_clear),
 776                         [arg1] "r" ((unsigned int)(unsigned long)low_user_desc_clear)
 777                       : "flags");
 778
 779 #ifdef __x86_64__
 780         syscall(SYS_arch_prctl, ARCH_GET_GS, &new_base);
 781 #endif
 782
 783         /* Restore GS/BASE for glibc */
 784         asm volatile ("movw %[prev_sel], %%gs" : : [prev_sel] "rm" (prev_sel));
 785 #ifdef __x86_64__
 786         if (saved_base)
 787                 syscall(SYS_arch_prctl, ARCH_SET_GS, saved_base);
 788 #endif
 789
 790         if (sel != 0) {
 791                 result = "FAIL";
 792                 nerrs++;
 793         } else {
 794                 result = "OK";
 795         }
 796         printf("[%s]\tInvalidate GS with set_thread_area: new GS = 0x%hx\n",
 797                result, sel);
 798
 799 #ifdef __x86_64__
 800         if (sel == 0 && new_base != 0) {
 801                 nerrs++;
 802                 printf("[FAIL]\tNew GSBASE was 0x%lx\n", new_base);
 803         } else {
 804                 printf("[OK]\tNew GSBASE was zero\n");
 805         }
 806 #endif
 807 }
 808
 809 int main(int argc, char **argv)
 810 {
 811         if (argc == 1 && !strcmp(argv[0], "ldt_gdt_test_exec"))
 812                 return finish_exec_test();
 813
 814         setup_counter_page();
 815         setup_low_user_desc();
 816
 817         do_simple_tests();
 818
 819         do_multicpu_tests();
 820
 821         do_exec_test();
 822
 823         test_gdt_invalidation();
 824
 825         return nerrs ? 1 : 0;
 826 }