Merge branch 'x86/asm' into locking/core

Upcoming changes to static keys is interacting/conflicting with the following
pending TSC commits in tip:x86/asm:

  4ea1636b04db x86/asm/tsc: Rename native_read_tsc() to rdtsc()
  ...

So merge it into the locking tree to have a smoother resolution.

Signed-off-by: Ingo Molnar <mingo@kernel.org>

5 files changed, 839 insertions, 14 deletions

diff --git a/tools/power/cpupower/debug/kernel/cpufreq-test_tsc.c b/tools/power/cpupower/debug/kernel/cpufreq-test_tsc.c
index 5224ee5b392d..6ff8383f2941 100644
--- a/tools/power/cpupower/debug/kernel/cpufreq-test_tsc.c
+++ b/tools/power/cpupower/debug/kernel/cpufreq-test_tsc.c
@@ -81,11 +81,11 @@ static int __init cpufreq_test_tsc(void)
 
         printk(KERN_DEBUG "start--> \n");
         then = read_pmtmr();
-        rdtscll(then_tsc);
+        then_tsc = rdtsc();
         for (i=0;i<20;i++) {
                 mdelay(100);
                 now = read_pmtmr();
-                rdtscll(now_tsc);
+                now_tsc = rdtsc();
                 diff = (now - then) & 0xFFFFFF;
                 diff_tsc = now_tsc - then_tsc;
                 printk(KERN_DEBUG "t1: %08u t2: %08u diff_pmtmr: %08u diff_tsc: %016llu\n", then, now, diff, diff_tsc);
diff --git a/tools/testing/selftests/x86/Makefile b/tools/testing/selftests/x86/Makefile
index caa60d56d7d1..b70da4acb4e5 100644
--- a/tools/testing/selftests/x86/Makefile
+++ b/tools/testing/selftests/x86/Makefile
@@ -4,8 +4,8 @@ include ../lib.mk
 
 .PHONY: all all_32 all_64 warn_32bit_failure clean
 
-TARGETS_C_BOTHBITS := sigreturn single_step_syscall sysret_ss_attrs
-TARGETS_C_32BIT_ONLY := entry_from_vm86
+TARGETS_C_BOTHBITS := sigreturn single_step_syscall sysret_ss_attrs ldt_gdt
+TARGETS_C_32BIT_ONLY := entry_from_vm86 syscall_arg_fault
 
 TARGETS_C_32BIT_ALL := $(TARGETS_C_BOTHBITS) $(TARGETS_C_32BIT_ONLY)
 BINARIES_32 := $(TARGETS_C_32BIT_ALL:%=%_32)
diff --git a/tools/testing/selftests/x86/entry_from_vm86.c b/tools/testing/selftests/x86/entry_from_vm86.c
index 5c38a187677b..9a43a59a9bb4 100644
--- a/tools/testing/selftests/x86/entry_from_vm86.c
+++ b/tools/testing/selftests/x86/entry_from_vm86.c
@@ -28,6 +28,55 @@
 static unsigned long load_addr = 0x10000;
 static int nerrs = 0;
 
+static void sethandler(int sig, void (*handler)(int, siginfo_t *, void *),
+                       int flags)
+{
+        struct sigaction sa;
+        memset(&sa, 0, sizeof(sa));
+        sa.sa_sigaction = handler;
+        sa.sa_flags = SA_SIGINFO | flags;
+        sigemptyset(&sa.sa_mask);
+        if (sigaction(sig, &sa, 0))
+                err(1, "sigaction");
+}
+
+static void clearhandler(int sig)
+{
+        struct sigaction sa;
+        memset(&sa, 0, sizeof(sa));
+        sa.sa_handler = SIG_DFL;
+        sigemptyset(&sa.sa_mask);
+        if (sigaction(sig, &sa, 0))
+                err(1, "sigaction");
+}
+
+static sig_atomic_t got_signal;
+
+static void sighandler(int sig, siginfo_t *info, void *ctx_void)
+{
+        ucontext_t *ctx = (ucontext_t*)ctx_void;
+
+        if (ctx->uc_mcontext.gregs[REG_EFL] & X86_EFLAGS_VM ||
+            (ctx->uc_mcontext.gregs[REG_CS] & 3) != 3) {
+                printf("[FAIL]\tSignal frame should not reflect vm86 mode\n");
+                nerrs++;
+        }
+
+        const char *signame;
+        if (sig == SIGSEGV)
+                signame = "SIGSEGV";
+        else if (sig == SIGILL)
+                signame = "SIGILL";
+        else
+                signame = "unexpected signal";
+
+        printf("[INFO]\t%s: FLAGS = 0x%lx, CS = 0x%hx\n", signame,
+               (unsigned long)ctx->uc_mcontext.gregs[REG_EFL],
+               (unsigned short)ctx->uc_mcontext.gregs[REG_CS]);
+
+        got_signal = 1;
+}
+
 asm (
         ".pushsection .rodata\n\t"
         ".type vmcode_bound, @object\n\t"
@@ -38,6 +87,14 @@ asm (
         "int3\n\t"
         "vmcode_sysenter:\n\t"
         "sysenter\n\t"
+        "vmcode_syscall:\n\t"
+        "syscall\n\t"
+        "vmcode_sti:\n\t"
+        "sti\n\t"
+        "vmcode_int3:\n\t"
+        "int3\n\t"
+        "vmcode_int80:\n\t"
+        "int $0x80\n\t"
         ".size vmcode, . - vmcode\n\t"
         "end_vmcode:\n\t"
         ".code32\n\t"
@@ -45,9 +102,12 @@ asm (
         );
 
 extern unsigned char vmcode[], end_vmcode[];
-extern unsigned char vmcode_bound[], vmcode_sysenter[];
+extern unsigned char vmcode_bound[], vmcode_sysenter[], vmcode_syscall[],
+        vmcode_sti[], vmcode_int3[], vmcode_int80[];
 
-static void do_test(struct vm86plus_struct *v86, unsigned long eip,
+/* Returns false if the test was skipped. */
+static bool do_test(struct vm86plus_struct *v86, unsigned long eip,
+                    unsigned int rettype, unsigned int retarg,
                     const char *text)
 {
         long ret;
@@ -58,7 +118,7 @@ static void do_test(struct vm86plus_struct *v86, unsigned long eip,
 
         if (ret == -1 && errno == ENOSYS) {
                 printf("[SKIP]\tvm86 not supported\n");
-                return;
+                return false;
         }
 
         if (VM86_TYPE(ret) == VM86_INTx) {
@@ -73,13 +133,30 @@ static void do_test(struct vm86plus_struct *v86, unsigned long eip,
                 else
                         sprintf(trapname, "%d", trapno);
 
-                printf("[OK]\tExited vm86 mode due to #%s\n", trapname);
+                printf("[INFO]\tExited vm86 mode due to #%s\n", trapname);
         } else if (VM86_TYPE(ret) == VM86_UNKNOWN) {
-                printf("[OK]\tExited vm86 mode due to unhandled GP fault\n");
+                printf("[INFO]\tExited vm86 mode due to unhandled GP fault\n");
+        } else if (VM86_TYPE(ret) == VM86_TRAP) {
+                printf("[INFO]\tExited vm86 mode due to a trap (arg=%ld)\n",
+                       VM86_ARG(ret));
+        } else if (VM86_TYPE(ret) == VM86_SIGNAL) {
+                printf("[INFO]\tExited vm86 mode due to a signal\n");
+        } else if (VM86_TYPE(ret) == VM86_STI) {
+                printf("[INFO]\tExited vm86 mode due to STI\n");
         } else {
-                printf("[OK]\tExited vm86 mode due to type %ld, arg %ld\n",
+                printf("[INFO]\tExited vm86 mode due to type %ld, arg %ld\n",
                        VM86_TYPE(ret), VM86_ARG(ret));
         }
+
+        if (rettype == -1 ||
+            (VM86_TYPE(ret) == rettype && VM86_ARG(ret) == retarg)) {
+                printf("[OK]\tReturned correctly\n");
+        } else {
+                printf("[FAIL]\tIncorrect return reason\n");
+                nerrs++;
+        }
+
+        return true;
 }
 
 int main(void)
@@ -105,10 +182,52 @@ int main(void)
         assert((v86.regs.cs & 3) == 0); /* Looks like RPL = 0 */
 
         /* #BR -- should deliver SIG??? */
-        do_test(&v86, vmcode_bound - vmcode, "#BR");
-
-        /* SYSENTER -- should cause #GP or #UD depending on CPU */
-        do_test(&v86, vmcode_sysenter - vmcode, "SYSENTER");
+        do_test(&v86, vmcode_bound - vmcode, VM86_INTx, 5, "#BR");
+
+        /*
+         * SYSENTER -- should cause #GP or #UD depending on CPU.
+         * Expected return type -1 means that we shouldn't validate
+         * the vm86 return value.  This will avoid problems on non-SEP
+         * CPUs.
+         */
+        sethandler(SIGILL, sighandler, 0);
+        do_test(&v86, vmcode_sysenter - vmcode, -1, 0, "SYSENTER");
+        clearhandler(SIGILL);
+
+        /*
+         * SYSCALL would be a disaster in VM86 mode.  Fortunately,
+         * there is no kernel that both enables SYSCALL and sets
+         * EFER.SCE, so it's #UD on all systems.  But vm86 is
+         * buggy (or has a "feature"), so the SIGILL will actually
+         * be delivered.
+         */
+        sethandler(SIGILL, sighandler, 0);
+        do_test(&v86, vmcode_syscall - vmcode, VM86_SIGNAL, 0, "SYSCALL");
+        clearhandler(SIGILL);
+
+        /* STI with VIP set */
+        v86.regs.eflags |= X86_EFLAGS_VIP;
+        v86.regs.eflags &= ~X86_EFLAGS_IF;
+        do_test(&v86, vmcode_sti - vmcode, VM86_STI, 0, "STI with VIP set");
+
+        /* INT3 -- should cause #BP */
+        do_test(&v86, vmcode_int3 - vmcode, VM86_TRAP, 3, "INT3");
+
+        /* INT80 -- should exit with "INTx 0x80" */
+        v86.regs.eax = (unsigned int)-1;
+        do_test(&v86, vmcode_int80 - vmcode, VM86_INTx, 0x80, "int80");
+
+        /* Execute a null pointer */
+        v86.regs.cs = 0;
+        v86.regs.ss = 0;
+        sethandler(SIGSEGV, sighandler, 0);
+        got_signal = 0;
+        if (do_test(&v86, 0, VM86_SIGNAL, 0, "Execute null pointer") &&
+            !got_signal) {
+                printf("[FAIL]\tDid not receive SIGSEGV\n");
+                nerrs++;
+        }
+        clearhandler(SIGSEGV);
 
         return (nerrs == 0 ? 0 : 1);
 }
diff --git a/tools/testing/selftests/x86/ldt_gdt.c b/tools/testing/selftests/x86/ldt_gdt.c
new file mode 100644
index 000000000000..31a3035cd4eb
--- /dev/null
+++ b/tools/testing/selftests/x86/ldt_gdt.c
@@ -0,0 +1,576 @@
+/*
+ * ldt_gdt.c - Test cases for LDT and GDT access
+ * Copyright (c) 2015 Andrew Lutomirski
+ */
+
+#define _GNU_SOURCE
+#include <err.h>
+#include <stdio.h>
+#include <stdint.h>
+#include <signal.h>
+#include <setjmp.h>
+#include <stdlib.h>
+#include <string.h>
+#include <errno.h>
+#include <unistd.h>
+#include <sys/syscall.h>
+#include <asm/ldt.h>
+#include <sys/types.h>
+#include <sys/wait.h>
+#include <stdbool.h>
+#include <pthread.h>
+#include <sched.h>
+#include <linux/futex.h>
+
+#define AR_ACCESSED             (1<<8)
+
+#define AR_TYPE_RODATA          (0 * (1<<9))
+#define AR_TYPE_RWDATA          (1 * (1<<9))
+#define AR_TYPE_RODATA_EXPDOWN  (2 * (1<<9))
+#define AR_TYPE_RWDATA_EXPDOWN  (3 * (1<<9))
+#define AR_TYPE_XOCODE          (4 * (1<<9))
+#define AR_TYPE_XRCODE          (5 * (1<<9))
+#define AR_TYPE_XOCODE_CONF     (6 * (1<<9))
+#define AR_TYPE_XRCODE_CONF     (7 * (1<<9))
+
+#define AR_DPL3                 (3 * (1<<13))
+
+#define AR_S                    (1 << 12)
+#define AR_P                    (1 << 15)
+#define AR_AVL                  (1 << 20)
+#define AR_L                    (1 << 21)
+#define AR_DB                   (1 << 22)
+#define AR_G                    (1 << 23)
+
+static int nerrs;
+
+static void check_invalid_segment(uint16_t index, int ldt)
+{
+        uint32_t has_limit = 0, has_ar = 0, limit, ar;
+        uint32_t selector = (index << 3) | (ldt << 2) | 3;
+
+        asm ("lsl %[selector], %[limit]\n\t"
+             "jnz 1f\n\t"
+             "movl $1, %[has_limit]\n\t"
+             "1:"
+             : [limit] "=r" (limit), [has_limit] "+rm" (has_limit)
+             : [selector] "r" (selector));
+        asm ("larl %[selector], %[ar]\n\t"
+             "jnz 1f\n\t"
+             "movl $1, %[has_ar]\n\t"
+             "1:"
+             : [ar] "=r" (ar), [has_ar] "+rm" (has_ar)
+             : [selector] "r" (selector));
+
+        if (has_limit || has_ar) {
+                printf("[FAIL]\t%s entry %hu is valid but should be invalid\n",
+                       (ldt ? "LDT" : "GDT"), index);
+                nerrs++;
+        } else {
+                printf("[OK]\t%s entry %hu is invalid\n",
+                       (ldt ? "LDT" : "GDT"), index);
+        }
+}
+
+static void check_valid_segment(uint16_t index, int ldt,
+                                uint32_t expected_ar, uint32_t expected_limit,
+                                bool verbose)
+{
+        uint32_t has_limit = 0, has_ar = 0, limit, ar;
+        uint32_t selector = (index << 3) | (ldt << 2) | 3;
+
+        asm ("lsl %[selector], %[limit]\n\t"
+             "jnz 1f\n\t"
+             "movl $1, %[has_limit]\n\t"
+             "1:"
+             : [limit] "=r" (limit), [has_limit] "+rm" (has_limit)
+             : [selector] "r" (selector));
+        asm ("larl %[selector], %[ar]\n\t"
+             "jnz 1f\n\t"
+             "movl $1, %[has_ar]\n\t"
+             "1:"
+             : [ar] "=r" (ar), [has_ar] "+rm" (has_ar)
+             : [selector] "r" (selector));
+
+        if (!has_limit || !has_ar) {
+                printf("[FAIL]\t%s entry %hu is invalid but should be valid\n",
+                       (ldt ? "LDT" : "GDT"), index);
+                nerrs++;
+                return;
+        }
+
+        if (ar != expected_ar) {
+                printf("[FAIL]\t%s entry %hu has AR 0x%08X but expected 0x%08X\n",
+                       (ldt ? "LDT" : "GDT"), index, ar, expected_ar);
+                nerrs++;
+        } else if (limit != expected_limit) {
+                printf("[FAIL]\t%s entry %hu has limit 0x%08X but expected 0x%08X\n",
+                       (ldt ? "LDT" : "GDT"), index, limit, expected_limit);
+                nerrs++;
+        } else if (verbose) {
+                printf("[OK]\t%s entry %hu has AR 0x%08X and limit 0x%08X\n",
+                       (ldt ? "LDT" : "GDT"), index, ar, limit);
+        }
+}
+
+static bool install_valid_mode(const struct user_desc *desc, uint32_t ar,
+                               bool oldmode)
+{
+        int ret = syscall(SYS_modify_ldt, oldmode ? 1 : 0x11,
+                          desc, sizeof(*desc));
+        if (ret < -1)
+                errno = -ret;
+        if (ret == 0) {
+                uint32_t limit = desc->limit;
+                if (desc->limit_in_pages)
+                        limit = (limit << 12) + 4095;
+                check_valid_segment(desc->entry_number, 1, ar, limit, true);
+                return true;
+        } else if (errno == ENOSYS) {
+                printf("[OK]\tmodify_ldt returned -ENOSYS\n");
+                return false;
+        } else {
+                if (desc->seg_32bit) {
+                        printf("[FAIL]\tUnexpected modify_ldt failure %d\n",
+                               errno);
+                        nerrs++;
+                        return false;
+                } else {
+                        printf("[OK]\tmodify_ldt rejected 16 bit segment\n");
+                        return false;
+                }
+        }
+}
+
+static bool install_valid(const struct user_desc *desc, uint32_t ar)
+{
+        return install_valid_mode(desc, ar, false);
+}
+
+static void install_invalid(const struct user_desc *desc, bool oldmode)
+{
+        int ret = syscall(SYS_modify_ldt, oldmode ? 1 : 0x11,
+                          desc, sizeof(*desc));
+        if (ret < -1)
+                errno = -ret;
+        if (ret == 0) {
+                check_invalid_segment(desc->entry_number, 1);
+        } else if (errno == ENOSYS) {
+                printf("[OK]\tmodify_ldt returned -ENOSYS\n");
+        } else {
+                if (desc->seg_32bit) {
+                        printf("[FAIL]\tUnexpected modify_ldt failure %d\n",
+                               errno);
+                        nerrs++;
+                } else {
+                        printf("[OK]\tmodify_ldt rejected 16 bit segment\n");
+                }
+        }
+}
+
+static int safe_modify_ldt(int func, struct user_desc *ptr,
+                           unsigned long bytecount)
+{
+        int ret = syscall(SYS_modify_ldt, 0x11, ptr, bytecount);
+        if (ret < -1)
+                errno = -ret;
+        return ret;
+}
+
+static void fail_install(struct user_desc *desc)
+{
+        if (safe_modify_ldt(0x11, desc, sizeof(*desc)) == 0) {
+                printf("[FAIL]\tmodify_ldt accepted a bad descriptor\n");
+                nerrs++;
+        } else if (errno == ENOSYS) {
+                printf("[OK]\tmodify_ldt returned -ENOSYS\n");
+        } else {
+                printf("[OK]\tmodify_ldt failure %d\n", errno);
+        }
+}
+
+static void do_simple_tests(void)
+{
+        struct user_desc desc = {
+                .entry_number    = 0,
+                .base_addr       = 0,
+                .limit           = 10,
+                .seg_32bit       = 1,
+                .contents        = 2, /* Code, not conforming */
+                .read_exec_only  = 0,
+                .limit_in_pages  = 0,
+                .seg_not_present = 0,
+                .useable         = 0
+        };
+        install_valid(&desc, AR_DPL3 | AR_TYPE_XRCODE | AR_S | AR_P | AR_DB);
+
+        desc.limit_in_pages = 1;
+        install_valid(&desc, AR_DPL3 | AR_TYPE_XRCODE |
+                      AR_S | AR_P | AR_DB | AR_G);
+
+        check_invalid_segment(1, 1);
+
+        desc.entry_number = 2;
+        install_valid(&desc, AR_DPL3 | AR_TYPE_XRCODE |
+                      AR_S | AR_P | AR_DB | AR_G);
+
+        check_invalid_segment(1, 1);
+
+        desc.base_addr = 0xf0000000;
+        install_valid(&desc, AR_DPL3 | AR_TYPE_XRCODE |
+                      AR_S | AR_P | AR_DB | AR_G);
+
+        desc.useable = 1;
+        install_valid(&desc, AR_DPL3 | AR_TYPE_XRCODE |
+                      AR_S | AR_P | AR_DB | AR_G | AR_AVL);
+
+        desc.seg_not_present = 1;
+        install_valid(&desc, AR_DPL3 | AR_TYPE_XRCODE |
+                      AR_S | AR_DB | AR_G | AR_AVL);
+
+        desc.seg_32bit = 0;
+        install_valid(&desc, AR_DPL3 | AR_TYPE_XRCODE |
+                      AR_S | AR_G | AR_AVL);
+
+        desc.seg_32bit = 1;
+        desc.contents = 0;
+        install_valid(&desc, AR_DPL3 | AR_TYPE_RWDATA |
+                      AR_S | AR_DB | AR_G | AR_AVL);
+
+        desc.read_exec_only = 1;
+        install_valid(&desc, AR_DPL3 | AR_TYPE_RODATA |
+                      AR_S | AR_DB | AR_G | AR_AVL);
+
+        desc.contents = 1;
+        install_valid(&desc, AR_DPL3 | AR_TYPE_RODATA_EXPDOWN |
+                      AR_S | AR_DB | AR_G | AR_AVL);
+
+        desc.read_exec_only = 0;
+        desc.limit_in_pages = 0;
+        install_valid(&desc, AR_DPL3 | AR_TYPE_RWDATA_EXPDOWN |
+                      AR_S | AR_DB | AR_AVL);
+
+        desc.contents = 3;
+        install_valid(&desc, AR_DPL3 | AR_TYPE_XRCODE_CONF |
+                      AR_S | AR_DB | AR_AVL);
+
+        desc.read_exec_only = 1;
+        install_valid(&desc, AR_DPL3 | AR_TYPE_XOCODE_CONF |
+                      AR_S | AR_DB | AR_AVL);
+
+        desc.read_exec_only = 0;
+        desc.contents = 2;
+        install_valid(&desc, AR_DPL3 | AR_TYPE_XRCODE |
+                      AR_S | AR_DB | AR_AVL);
+
+        desc.read_exec_only = 1;
+
+#ifdef __x86_64__
+        desc.lm = 1;
+        install_valid(&desc, AR_DPL3 | AR_TYPE_XOCODE |
+                      AR_S | AR_DB | AR_AVL);
+        desc.lm = 0;
+#endif
+
+        bool entry1_okay = install_valid(&desc, AR_DPL3 | AR_TYPE_XOCODE |
+                                         AR_S | AR_DB | AR_AVL);
+
+        if (entry1_okay) {
+                printf("[RUN]\tTest fork\n");
+                pid_t child = fork();
+                if (child == 0) {
+                        nerrs = 0;
+                        check_valid_segment(desc.entry_number, 1,
+                                            AR_DPL3 | AR_TYPE_XOCODE |
+                                            AR_S | AR_DB | AR_AVL, desc.limit,
+                                            true);
+                        check_invalid_segment(1, 1);
+                        exit(nerrs ? 1 : 0);
+                } else {
+                        int status;
+                        if (waitpid(child, &status, 0) != child ||
+                            !WIFEXITED(status)) {
+                                printf("[FAIL]\tChild died\n");
+                                nerrs++;
+                        } else if (WEXITSTATUS(status) != 0) {
+                                printf("[FAIL]\tChild failed\n");
+                                nerrs++;
+                        } else {
+                                printf("[OK]\tChild succeeded\n");
+                        }
+                }
+
+                printf("[RUN]\tTest size\n");
+                int i;
+                for (i = 0; i < 8192; i++) {
+                        desc.entry_number = i;
+                        desc.limit = i;
+                        if (safe_modify_ldt(0x11, &desc, sizeof(desc)) != 0) {
+                                printf("[FAIL]\tFailed to install entry %d\n", i);
+                                nerrs++;
+                                break;
+                        }
+                }
+                for (int j = 0; j < i; j++) {
+                        check_valid_segment(j, 1, AR_DPL3 | AR_TYPE_XOCODE |
+                                            AR_S | AR_DB | AR_AVL, j, false);
+                }
+                printf("[DONE]\tSize test\n");
+        } else {
+                printf("[SKIP]\tSkipping fork and size tests because we have no LDT\n");
+        }
+
+        /* Test entry_number too high. */
+        desc.entry_number = 8192;
+        fail_install(&desc);
+
+        /* Test deletion and actions mistakeable for deletion. */
+        memset(&desc, 0, sizeof(desc));
+        install_valid(&desc, AR_DPL3 | AR_TYPE_RWDATA | AR_S | AR_P);
+
+        desc.seg_not_present = 1;
+        install_valid(&desc, AR_DPL3 | AR_TYPE_RWDATA | AR_S);
+
+        desc.seg_not_present = 0;
+        desc.read_exec_only = 1;
+        install_valid(&desc, AR_DPL3 | AR_TYPE_RODATA | AR_S | AR_P);
+
+        desc.read_exec_only = 0;
+        desc.seg_not_present = 1;
+        install_valid(&desc, AR_DPL3 | AR_TYPE_RWDATA | AR_S);
+
+        desc.read_exec_only = 1;
+        desc.limit = 1;
+        install_valid(&desc, AR_DPL3 | AR_TYPE_RODATA | AR_S);
+
+        desc.limit = 0;
+        desc.base_addr = 1;
+        install_valid(&desc, AR_DPL3 | AR_TYPE_RODATA | AR_S);
+
+        desc.base_addr = 0;
+        install_invalid(&desc, false);
+
+        desc.seg_not_present = 0;
+        desc.read_exec_only = 0;
+        desc.seg_32bit = 1;
+        install_valid(&desc, AR_DPL3 | AR_TYPE_RWDATA | AR_S | AR_P | AR_DB);
+        install_invalid(&desc, true);
+}
+
+/*
+ * 0: thread is idle
+ * 1: thread armed
+ * 2: thread should clear LDT entry 0
+ * 3: thread should exit
+ */
+static volatile unsigned int ftx;
+
+static void *threadproc(void *ctx)
+{
+        cpu_set_t cpuset;
+        CPU_ZERO(&cpuset);
+        CPU_SET(1, &cpuset);
+        if (sched_setaffinity(0, sizeof(cpuset), &cpuset) != 0)
+                err(1, "sched_setaffinity to CPU 1");   /* should never fail */
+
+        while (1) {
+                syscall(SYS_futex, &ftx, FUTEX_WAIT, 0, NULL, NULL, 0);
+                while (ftx != 2) {
+                        if (ftx >= 3)
+                                return NULL;
+                }
+
+                /* clear LDT entry 0 */
+                const struct user_desc desc = {};
+                if (syscall(SYS_modify_ldt, 1, &desc, sizeof(desc)) != 0)
+                        err(1, "modify_ldt");
+
+                /* If ftx == 2, set it to zero.  If ftx == 100, quit. */
+                unsigned int x = -2;
+                asm volatile ("lock xaddl %[x], %[ftx]" :
+                              [x] "+r" (x), [ftx] "+m" (ftx));
+                if (x != 2)
+                        return NULL;
+        }
+}
+
+static void sethandler(int sig, void (*handler)(int, siginfo_t *, void *),
+                       int flags)
+{
+        struct sigaction sa;
+        memset(&sa, 0, sizeof(sa));
+        sa.sa_sigaction = handler;
+        sa.sa_flags = SA_SIGINFO | flags;
+        sigemptyset(&sa.sa_mask);
+        if (sigaction(sig, &sa, 0))
+                err(1, "sigaction");
+
+}
+
+static jmp_buf jmpbuf;
+
+static void sigsegv(int sig, siginfo_t *info, void *ctx_void)
+{
+        siglongjmp(jmpbuf, 1);
+}
+
+static void do_multicpu_tests(void)
+{
+        cpu_set_t cpuset;
+        pthread_t thread;
+        int failures = 0, iters = 5, i;
+        unsigned short orig_ss;
+
+        CPU_ZERO(&cpuset);
+        CPU_SET(1, &cpuset);
+        if (sched_setaffinity(0, sizeof(cpuset), &cpuset) != 0) {
+                printf("[SKIP]\tCannot set affinity to CPU 1\n");
+                return;
+        }
+
+        CPU_ZERO(&cpuset);
+        CPU_SET(0, &cpuset);
+        if (sched_setaffinity(0, sizeof(cpuset), &cpuset) != 0) {
+                printf("[SKIP]\tCannot set affinity to CPU 0\n");
+                return;
+        }
+
+        sethandler(SIGSEGV, sigsegv, 0);
+#ifdef __i386__
+        /* True 32-bit kernels send SIGILL instead of SIGSEGV on IRET faults. */
+        sethandler(SIGILL, sigsegv, 0);
+#endif
+
+        printf("[RUN]\tCross-CPU LDT invalidation\n");
+
+        if (pthread_create(&thread, 0, threadproc, 0) != 0)
+                err(1, "pthread_create");
+
+        asm volatile ("mov %%ss, %0" : "=rm" (orig_ss));
+
+        for (i = 0; i < 5; i++) {
+                if (sigsetjmp(jmpbuf, 1) != 0)
+                        continue;
+
+                /* Make sure the thread is ready after the last test. */
+                while (ftx != 0)
+                        ;
+
+                struct user_desc desc = {
+                        .entry_number    = 0,
+                        .base_addr       = 0,
+                        .limit           = 0xfffff,
+                        .seg_32bit       = 1,
+                        .contents        = 0, /* Data */
+                        .read_exec_only  = 0,
+                        .limit_in_pages  = 1,
+                        .seg_not_present = 0,
+                        .useable         = 0
+                };
+
+                if (safe_modify_ldt(0x11, &desc, sizeof(desc)) != 0) {
+                        if (errno != ENOSYS)
+                                err(1, "modify_ldt");
+                        printf("[SKIP]\tmodify_ldt unavailable\n");
+                        break;
+                }
+
+                /* Arm the thread. */
+                ftx = 1;
+                syscall(SYS_futex, &ftx, FUTEX_WAKE, 0, NULL, NULL, 0);
+
+                asm volatile ("mov %0, %%ss" : : "r" (0x7));
+
+                /* Go! */
+                ftx = 2;
+
+                while (ftx != 0)
+                        ;
+
+                /*
+                 * On success, modify_ldt will segfault us synchronously,
+                 * and we'll escape via siglongjmp.
+                 */
+
+                failures++;
+                asm volatile ("mov %0, %%ss" : : "rm" (orig_ss));
+        };
+
+        ftx = 100;  /* Kill the thread. */
+        syscall(SYS_futex, &ftx, FUTEX_WAKE, 0, NULL, NULL, 0);
+
+        if (pthread_join(thread, NULL) != 0)
+                err(1, "pthread_join");
+
+        if (failures) {
+                printf("[FAIL]\t%d of %d iterations failed\n", failures, iters);
+                nerrs++;
+        } else {
+                printf("[OK]\tAll %d iterations succeeded\n", iters);
+        }
+}
+
+static int finish_exec_test(void)
+{
+        /*
+         * In a sensible world, this would be check_invalid_segment(0, 1);
+         * For better or for worse, though, the LDT is inherited across exec.
+         * We can probably change this safely, but for now we test it.
+         */
+        check_valid_segment(0, 1,
+                            AR_DPL3 | AR_TYPE_XRCODE | AR_S | AR_P | AR_DB,
+                            42, true);
+
+        return nerrs ? 1 : 0;
+}
+
+static void do_exec_test(void)
+{
+        printf("[RUN]\tTest exec\n");
+
+        struct user_desc desc = {
+                .entry_number    = 0,
+                .base_addr       = 0,
+                .limit           = 42,
+                .seg_32bit       = 1,
+                .contents        = 2, /* Code, not conforming */
+                .read_exec_only  = 0,
+                .limit_in_pages  = 0,
+                .seg_not_present = 0,
+                .useable         = 0
+        };
+        install_valid(&desc, AR_DPL3 | AR_TYPE_XRCODE | AR_S | AR_P | AR_DB);
+
+        pid_t child = fork();
+        if (child == 0) {
+                execl("/proc/self/exe", "ldt_gdt_test_exec", NULL);
+                printf("[FAIL]\tCould not exec self\n");
+                exit(1);        /* exec failed */
+        } else {
+                int status;
+                if (waitpid(child, &status, 0) != child ||
+                    !WIFEXITED(status)) {
+                        printf("[FAIL]\tChild died\n");
+                        nerrs++;
+                } else if (WEXITSTATUS(status) != 0) {
+                        printf("[FAIL]\tChild failed\n");
+                        nerrs++;
+                } else {
+                        printf("[OK]\tChild succeeded\n");
+                }
+        }
+}
+
+int main(int argc, char **argv)
+{
+        if (argc == 1 && !strcmp(argv[0], "ldt_gdt_test_exec"))
+                return finish_exec_test();
+
+        do_simple_tests();
+
+        do_multicpu_tests();
+
+        do_exec_test();
+
+        return nerrs ? 1 : 0;
+}
diff --git a/tools/testing/selftests/x86/syscall_arg_fault.c b/tools/testing/selftests/x86/syscall_arg_fault.c
new file mode 100644
index 000000000000..7db4fc9fa09f
--- /dev/null
+++ b/tools/testing/selftests/x86/syscall_arg_fault.c
@@ -0,0 +1,130 @@
+/*
+ * syscall_arg_fault.c - tests faults 32-bit fast syscall stack args
+ * Copyright (c) 2015 Andrew Lutomirski
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms and conditions of the GNU General Public License,
+ * version 2, as published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope it will be useful, but
+ * WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ * General Public License for more details.
+ */
+
+#define _GNU_SOURCE
+
+#include <stdlib.h>
+#include <stdio.h>
+#include <string.h>
+#include <sys/signal.h>
+#include <sys/ucontext.h>
+#include <err.h>
+#include <setjmp.h>
+#include <errno.h>
+
+/* Our sigaltstack scratch space. */
+static unsigned char altstack_data[SIGSTKSZ];
+
+static void sethandler(int sig, void (*handler)(int, siginfo_t *, void *),
+                       int flags)
+{
+        struct sigaction sa;
+        memset(&sa, 0, sizeof(sa));
+        sa.sa_sigaction = handler;
+        sa.sa_flags = SA_SIGINFO | flags;
+        sigemptyset(&sa.sa_mask);
+        if (sigaction(sig, &sa, 0))
+                err(1, "sigaction");
+}
+
+static volatile sig_atomic_t sig_traps;
+static sigjmp_buf jmpbuf;
+
+static volatile sig_atomic_t n_errs;
+
+static void sigsegv(int sig, siginfo_t *info, void *ctx_void)
+{
+        ucontext_t *ctx = (ucontext_t*)ctx_void;
+
+        if (ctx->uc_mcontext.gregs[REG_EAX] != -EFAULT) {
+                printf("[FAIL]\tAX had the wrong value: 0x%x\n",
+                       ctx->uc_mcontext.gregs[REG_EAX]);
+                n_errs++;
+        } else {
+                printf("[OK]\tSeems okay\n");
+        }
+
+        siglongjmp(jmpbuf, 1);
+}
+
+static void sigill(int sig, siginfo_t *info, void *ctx_void)
+{
+        printf("[SKIP]\tIllegal instruction\n");
+        siglongjmp(jmpbuf, 1);
+}
+
+int main()
+{
+        stack_t stack = {
+                .ss_sp = altstack_data,
+                .ss_size = SIGSTKSZ,
+        };
+        if (sigaltstack(&stack, NULL) != 0)
+                err(1, "sigaltstack");
+
+        sethandler(SIGSEGV, sigsegv, SA_ONSTACK);
+        sethandler(SIGILL, sigill, SA_ONSTACK);
+
+        /*
+         * Exercise another nasty special case.  The 32-bit SYSCALL
+         * and SYSENTER instructions (even in compat mode) each
+         * clobber one register.  A Linux system call has a syscall
+         * number and six arguments, and the user stack pointer
+         * needs to live in some register on return.  That means
+         * that we need eight registers, but SYSCALL and SYSENTER
+         * only preserve seven registers.  As a result, one argument
+         * ends up on the stack.  The stack is user memory, which
+         * means that the kernel can fail to read it.
+         *
+         * The 32-bit fast system calls don't have a defined ABI:
+         * we're supposed to invoke them through the vDSO.  So we'll
+         * fudge it: we set all regs to invalid pointer values and
+         * invoke the entry instruction.  The return will fail no
+         * matter what, and we completely lose our program state,
+         * but we can fix it up with a signal handler.
+         */
+
+        printf("[RUN]\tSYSENTER with invalid state\n");
+        if (sigsetjmp(jmpbuf, 1) == 0) {
+                asm volatile (
+                        "movl $-1, %%eax\n\t"
+                        "movl $-1, %%ebx\n\t"
+                        "movl $-1, %%ecx\n\t"
+                        "movl $-1, %%edx\n\t"
+                        "movl $-1, %%esi\n\t"
+                        "movl $-1, %%edi\n\t"
+                        "movl $-1, %%ebp\n\t"
+                        "movl $-1, %%esp\n\t"
+                        "sysenter"
+                        : : : "memory", "flags");
+        }
+
+        printf("[RUN]\tSYSCALL with invalid state\n");
+        if (sigsetjmp(jmpbuf, 1) == 0) {
+                asm volatile (
+                        "movl $-1, %%eax\n\t"
+                        "movl $-1, %%ebx\n\t"
+                        "movl $-1, %%ecx\n\t"
+                        "movl $-1, %%edx\n\t"
+                        "movl $-1, %%esi\n\t"
+                        "movl $-1, %%edi\n\t"
+                        "movl $-1, %%ebp\n\t"
+                        "movl $-1, %%esp\n\t"
+                        "syscall\n\t"
+                        "pushl $0"      /* make sure we segfault cleanly */
+                        : : : "memory", "flags");
+        }
+
+        return 0;
+}