1 /*
2  * This file and its contents are supplied under the terms of the
3  * Common Development and Distribution License ("CDDL"), version 1.0.
4  * You may only use this file in accordance with the terms of version
5  * 1.0 of the CDDL.
6  *
7  * A full copy of the text of the CDDL should have accompanied this
8  * source.  A copy of the CDDL is also available via the Internet at
9  * http://www.illumos.org/license/CDDL.
10  */
11 
12 /*
13  * Copyright 2019 Joyent, Inc.
14  */
15 
16 #include <stdlib.h>
17 #include <ucontext.h>
18 #include <sys/wait.h>
19 #include <unistd.h>
20 #include <sys/regset.h>
21 #include <sys/resource.h>
22 #include <err.h>
23 
24 /*
25  * Load a bunch of bad selectors into the seg regs: this will typically cause
26  * the child process to core dump, but it shouldn't panic the kernel...
27  *
28  * It's especially interesting to run this on CPU0.
29  */
30 
31 unsigned short selector;
32 
33 static void badds(void)
34 {
35 	__asm__ volatile("movw %0, %%ds" : : "r" (selector));
36 }
37 
38 static void bades(void)
39 {
40 	__asm__ volatile("movw %0, %%es" : : "r" (selector));
41 }
42 
43 static void badfs(void)
44 {
45 	__asm__ volatile("movw %0, %%fs" : : "r" (selector));
46 }
47 
48 static void badgs(void)
49 {
50 	__asm__ volatile("movw %0, %%gs" : : "r" (selector));
51 }
52 
53 static void badss(void)
54 {
55 	__asm__ volatile("movw %0, %%ss" : : "r" (selector));
56 }
57 
58 static void
59 resetseg(uint_t seg)
60 {
61 	ucontext_t ucp;
62 	volatile int done = 0;
63 
64 	int rc = getcontext(&ucp);
65 	if (done) {
66 		(void) getcontext(&ucp);
67 		return;
68 	}
69 
70 	if (rc == 0) {
71 		done = 1;
72 		ucp.uc_mcontext.gregs[seg] = selector;
73 		(void) setcontext(&ucp);
74 	}
75 	abort();
76 }
77 
78 static void
79 resetcs(void)
80 {
81 	return (resetseg(CS));
82 }
83 
84 static void
85 resetds(void)
86 {
87 	return (resetseg(DS));
88 }
89 
90 static void
91 resetes(void)
92 {
93 	return (resetseg(ES));
94 }
95 
96 static void
97 resetfs(void)
98 {
99 	return (resetseg(FS));
100 }
101 
102 static void
103 resetgs(void)
104 {
105 	return (resetseg(GS));
106 }
107 
108 static void
109 resetss(void)
110 {
111 	return (resetseg(SS));
112 }
113 
114 static void
115 inchild(void (*func)())
116 {
117 	pid_t pid;
118 
119 	switch ((pid = fork())) {
120 	case 0:
121 		func();
122 		exit(EXIT_SUCCESS);
123 	case -1:
124 		exit(EXIT_FAILURE);
125 	default:
126 		(void) waitpid(pid, NULL, 0);
127 		return;
128 	}
129 
130 }
131 
132 int
133 main(int argc, char *argv[])
134 {
135 	struct rlimit rl = { 0, };
136 
137 	if (setrlimit(RLIMIT_CORE, &rl) != 0) {
138 		err(EXIT_FAILURE, "failed to disable cores");
139 	}
140 
141 	for (selector = 0; selector < 8194; selector++) {
142 		inchild(resetcs);
143 		inchild(resetds);
144 		inchild(resetes);
145 		inchild(resetfs);
146 		inchild(resetgs);
147 		inchild(resetss);
148 		inchild(badds);
149 		inchild(bades);
150 		inchild(badfs);
151 		inchild(badgs);
152 		inchild(badss);
153 	}
154 
155 	exit(EXIT_SUCCESS);
156 }
157