1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36#define _GNU_SOURCE
37
38#include <sys/time.h>
39#include <time.h>
40#include <stdlib.h>
41#include <sys/syscall.h>
42#include <unistd.h>
43#include <stdio.h>
44#include <string.h>
45#include <inttypes.h>
46#include <sys/mman.h>
47#include <sys/signal.h>
48#include <sys/ucontext.h>
49#include <asm/ldt.h>
50#include <err.h>
51#include <setjmp.h>
52#include <stddef.h>
53#include <stdbool.h>
54#include <sys/ptrace.h>
55#include <sys/user.h>
56
57
58typedef unsigned int u32;
59typedef unsigned short u16;
60#include "../../../../arch/x86/include/asm/desc_defs.h"
61
62
63
64
65
66#ifdef __x86_64__
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84#define UC_SIGCONTEXT_SS 0x2
85#define UC_STRICT_RESTORE_SS 0x4
86#endif
87
88
89
90
91
92
93
94
95#define LDT_OFFSET 6
96
97
98static unsigned char stack16[65536] __attribute__((aligned(4096)));
99
100
101
102
103
104
105asm (".pushsection .text\n\t"
106 ".type int3, @function\n\t"
107 ".align 4096\n\t"
108 "int3:\n\t"
109 "mov %ss,%ecx\n\t"
110 "int3\n\t"
111 ".size int3, . - int3\n\t"
112 ".align 4096, 0xcc\n\t"
113 ".popsection");
114extern char int3[4096];
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134static unsigned short ldt_nonexistent_sel;
135static unsigned short code16_sel, data16_sel, npcode32_sel, npdata32_sel;
136
137static unsigned short gdt_data16_idx, gdt_npdata32_idx;
138
139static unsigned short GDT3(int idx)
140{
141 return (idx << 3) | 3;
142}
143
144static unsigned short LDT3(int idx)
145{
146 return (idx << 3) | 7;
147}
148
149
150static char altstack_data[SIGSTKSZ];
151
152static void sethandler(int sig, void (*handler)(int, siginfo_t *, void *),
153 int flags)
154{
155 struct sigaction sa;
156 memset(&sa, 0, sizeof(sa));
157 sa.sa_sigaction = handler;
158 sa.sa_flags = SA_SIGINFO | flags;
159 sigemptyset(&sa.sa_mask);
160 if (sigaction(sig, &sa, 0))
161 err(1, "sigaction");
162}
163
164static void clearhandler(int sig)
165{
166 struct sigaction sa;
167 memset(&sa, 0, sizeof(sa));
168 sa.sa_handler = SIG_DFL;
169 sigemptyset(&sa.sa_mask);
170 if (sigaction(sig, &sa, 0))
171 err(1, "sigaction");
172}
173
174static void add_ldt(const struct user_desc *desc, unsigned short *var,
175 const char *name)
176{
177 if (syscall(SYS_modify_ldt, 1, desc, sizeof(*desc)) == 0) {
178 *var = LDT3(desc->entry_number);
179 } else {
180 printf("[NOTE]\tFailed to create %s segment\n", name);
181 *var = 0;
182 }
183}
184
185static void setup_ldt(void)
186{
187 if ((unsigned long)stack16 > (1ULL << 32) - sizeof(stack16))
188 errx(1, "stack16 is too high\n");
189 if ((unsigned long)int3 > (1ULL << 32) - sizeof(int3))
190 errx(1, "int3 is too high\n");
191
192 ldt_nonexistent_sel = LDT3(LDT_OFFSET + 2);
193
194 const struct user_desc code16_desc = {
195 .entry_number = LDT_OFFSET + 0,
196 .base_addr = (unsigned long)int3,
197 .limit = 4095,
198 .seg_32bit = 0,
199 .contents = 2,
200 .read_exec_only = 0,
201 .limit_in_pages = 0,
202 .seg_not_present = 0,
203 .useable = 0
204 };
205 add_ldt(&code16_desc, &code16_sel, "code16");
206
207 const struct user_desc data16_desc = {
208 .entry_number = LDT_OFFSET + 1,
209 .base_addr = (unsigned long)stack16,
210 .limit = 0xffff,
211 .seg_32bit = 0,
212 .contents = 0,
213 .read_exec_only = 0,
214 .limit_in_pages = 0,
215 .seg_not_present = 0,
216 .useable = 0
217 };
218 add_ldt(&data16_desc, &data16_sel, "data16");
219
220 const struct user_desc npcode32_desc = {
221 .entry_number = LDT_OFFSET + 3,
222 .base_addr = (unsigned long)int3,
223 .limit = 4095,
224 .seg_32bit = 1,
225 .contents = 2,
226 .read_exec_only = 0,
227 .limit_in_pages = 0,
228 .seg_not_present = 1,
229 .useable = 0
230 };
231 add_ldt(&npcode32_desc, &npcode32_sel, "npcode32");
232
233 const struct user_desc npdata32_desc = {
234 .entry_number = LDT_OFFSET + 4,
235 .base_addr = (unsigned long)stack16,
236 .limit = 0xffff,
237 .seg_32bit = 1,
238 .contents = 0,
239 .read_exec_only = 0,
240 .limit_in_pages = 0,
241 .seg_not_present = 1,
242 .useable = 0
243 };
244 add_ldt(&npdata32_desc, &npdata32_sel, "npdata32");
245
246 struct user_desc gdt_data16_desc = {
247 .entry_number = -1,
248 .base_addr = (unsigned long)stack16,
249 .limit = 0xffff,
250 .seg_32bit = 0,
251 .contents = 0,
252 .read_exec_only = 0,
253 .limit_in_pages = 0,
254 .seg_not_present = 0,
255 .useable = 0
256 };
257
258 if (syscall(SYS_set_thread_area, &gdt_data16_desc) == 0) {
259
260
261
262
263
264 printf("[WARN]\tset_thread_area allocated data16 at index %d\n",
265 gdt_data16_desc.entry_number);
266 gdt_data16_idx = gdt_data16_desc.entry_number;
267 } else {
268 printf("[OK]\tset_thread_area refused 16-bit data\n");
269 }
270
271 struct user_desc gdt_npdata32_desc = {
272 .entry_number = -1,
273 .base_addr = (unsigned long)stack16,
274 .limit = 0xffff,
275 .seg_32bit = 1,
276 .contents = 0,
277 .read_exec_only = 0,
278 .limit_in_pages = 0,
279 .seg_not_present = 1,
280 .useable = 0
281 };
282
283 if (syscall(SYS_set_thread_area, &gdt_npdata32_desc) == 0) {
284
285
286
287 printf("[WARN]\tset_thread_area allocated npdata32 at index %d\n",
288 gdt_npdata32_desc.entry_number);
289 gdt_npdata32_idx = gdt_npdata32_desc.entry_number;
290 } else {
291 printf("[OK]\tset_thread_area refused 16-bit data\n");
292 }
293}
294
295
296static gregset_t initial_regs, requested_regs, resulting_regs;
297
298
299static volatile unsigned short sig_cs, sig_ss;
300static volatile sig_atomic_t sig_trapped, sig_err, sig_trapno;
301#ifdef __x86_64__
302static volatile sig_atomic_t sig_corrupt_final_ss;
303#endif
304
305
306#ifdef __x86_64__
307# define REG_IP REG_RIP
308# define REG_SP REG_RSP
309# define REG_CX REG_RCX
310
311struct selectors {
312 unsigned short cs, gs, fs, ss;
313};
314
315static unsigned short *ssptr(ucontext_t *ctx)
316{
317 struct selectors *sels = (void *)&ctx->uc_mcontext.gregs[REG_CSGSFS];
318 return &sels->ss;
319}
320
321static unsigned short *csptr(ucontext_t *ctx)
322{
323 struct selectors *sels = (void *)&ctx->uc_mcontext.gregs[REG_CSGSFS];
324 return &sels->cs;
325}
326#else
327# define REG_IP REG_EIP
328# define REG_SP REG_ESP
329# define REG_CX REG_ECX
330
331static greg_t *ssptr(ucontext_t *ctx)
332{
333 return &ctx->uc_mcontext.gregs[REG_SS];
334}
335
336static greg_t *csptr(ucontext_t *ctx)
337{
338 return &ctx->uc_mcontext.gregs[REG_CS];
339}
340#endif
341
342
343
344
345
346int cs_bitness(unsigned short cs)
347{
348 uint32_t valid = 0, ar;
349 asm ("lar %[cs], %[ar]\n\t"
350 "jnz 1f\n\t"
351 "mov $1, %[valid]\n\t"
352 "1:"
353 : [ar] "=r" (ar), [valid] "+rm" (valid)
354 : [cs] "r" (cs));
355
356 if (!valid)
357 return -1;
358
359 bool db = (ar & (1 << 22));
360 bool l = (ar & (1 << 21));
361
362 if (!(ar & (1<<11)))
363 return -1;
364
365 if (l && !db)
366 return 64;
367 else if (!l && db)
368 return 32;
369 else if (!l && !db)
370 return 16;
371 else
372 return -1;
373}
374
375
376
377
378
379bool is_valid_ss(unsigned short cs)
380{
381 uint32_t valid = 0, ar;
382 asm ("lar %[cs], %[ar]\n\t"
383 "jnz 1f\n\t"
384 "mov $1, %[valid]\n\t"
385 "1:"
386 : [ar] "=r" (ar), [valid] "+rm" (valid)
387 : [cs] "r" (cs));
388
389 if (!valid)
390 return false;
391
392 if ((ar & AR_TYPE_MASK) != AR_TYPE_RWDATA &&
393 (ar & AR_TYPE_MASK) != AR_TYPE_RWDATA_EXPDOWN)
394 return false;
395
396 return (ar & AR_P);
397}
398
399
400static volatile sig_atomic_t nerrs;
401
402static void validate_signal_ss(int sig, ucontext_t *ctx)
403{
404#ifdef __x86_64__
405 bool was_64bit = (cs_bitness(*csptr(ctx)) == 64);
406
407 if (!(ctx->uc_flags & UC_SIGCONTEXT_SS)) {
408 printf("[FAIL]\tUC_SIGCONTEXT_SS was not set\n");
409 nerrs++;
410
411
412
413
414
415 return;
416 }
417
418
419 if (!!(ctx->uc_flags & UC_STRICT_RESTORE_SS) != was_64bit) {
420 printf("[FAIL]\tUC_STRICT_RESTORE_SS was wrong in signal %d\n",
421 sig);
422 nerrs++;
423 }
424
425 if (is_valid_ss(*ssptr(ctx))) {
426
427
428
429
430
431 unsigned short hw_ss;
432 asm ("mov %%ss, %0" : "=rm" (hw_ss));
433 if (hw_ss != *ssptr(ctx)) {
434 printf("[FAIL]\tHW SS didn't match saved SS\n");
435 nerrs++;
436 }
437 }
438#endif
439}
440
441
442
443
444
445
446static void sigusr1(int sig, siginfo_t *info, void *ctx_void)
447{
448 ucontext_t *ctx = (ucontext_t*)ctx_void;
449
450 validate_signal_ss(sig, ctx);
451
452 memcpy(&initial_regs, &ctx->uc_mcontext.gregs, sizeof(gregset_t));
453
454 *csptr(ctx) = sig_cs;
455 *ssptr(ctx) = sig_ss;
456
457 ctx->uc_mcontext.gregs[REG_IP] =
458 sig_cs == code16_sel ? 0 : (unsigned long)&int3;
459 ctx->uc_mcontext.gregs[REG_SP] = (unsigned long)0x8badf00d5aadc0deULL;
460 ctx->uc_mcontext.gregs[REG_CX] = 0;
461
462 memcpy(&requested_regs, &ctx->uc_mcontext.gregs, sizeof(gregset_t));
463 requested_regs[REG_CX] = *ssptr(ctx);
464
465 return;
466}
467
468
469
470
471
472
473static void sigtrap(int sig, siginfo_t *info, void *ctx_void)
474{
475 ucontext_t *ctx = (ucontext_t*)ctx_void;
476
477 validate_signal_ss(sig, ctx);
478
479 sig_err = ctx->uc_mcontext.gregs[REG_ERR];
480 sig_trapno = ctx->uc_mcontext.gregs[REG_TRAPNO];
481
482 unsigned short ss;
483 asm ("mov %%ss,%0" : "=r" (ss));
484
485 greg_t asm_ss = ctx->uc_mcontext.gregs[REG_CX];
486 if (asm_ss != sig_ss && sig == SIGTRAP) {
487
488 printf("[FAIL]\tSIGTRAP: ss = %hx, frame ss = %hx, ax = %llx\n",
489 ss, *ssptr(ctx), (unsigned long long)asm_ss);
490 nerrs++;
491 }
492
493 memcpy(&resulting_regs, &ctx->uc_mcontext.gregs, sizeof(gregset_t));
494 memcpy(&ctx->uc_mcontext.gregs, &initial_regs, sizeof(gregset_t));
495
496#ifdef __x86_64__
497 if (sig_corrupt_final_ss) {
498 if (ctx->uc_flags & UC_STRICT_RESTORE_SS) {
499 printf("[FAIL]\tUC_STRICT_RESTORE_SS was set inappropriately\n");
500 nerrs++;
501 } else {
502
503
504
505
506
507 printf("\tCorrupting SS on return to 64-bit mode\n");
508 *ssptr(ctx) = 0;
509 }
510 }
511#endif
512
513 sig_trapped = sig;
514}
515
516#ifdef __x86_64__
517
518static void sigusr2(int sig, siginfo_t *info, void *ctx_void)
519{
520 ucontext_t *ctx = (ucontext_t*)ctx_void;
521
522 if (!(ctx->uc_flags & UC_STRICT_RESTORE_SS)) {
523 printf("[FAIL]\traise(2) didn't set UC_STRICT_RESTORE_SS\n");
524 nerrs++;
525 return;
526 }
527
528 ctx->uc_flags &= ~UC_STRICT_RESTORE_SS;
529 *ssptr(ctx) = 0;
530
531
532}
533
534static int test_nonstrict_ss(void)
535{
536 clearhandler(SIGUSR1);
537 clearhandler(SIGTRAP);
538 clearhandler(SIGSEGV);
539 clearhandler(SIGILL);
540 sethandler(SIGUSR2, sigusr2, 0);
541
542 nerrs = 0;
543
544 printf("[RUN]\tClear UC_STRICT_RESTORE_SS and corrupt SS\n");
545 raise(SIGUSR2);
546 if (!nerrs)
547 printf("[OK]\tIt worked\n");
548
549 return nerrs;
550}
551#endif
552
553
554int find_cs(int bitness)
555{
556 unsigned short my_cs;
557
558 asm ("mov %%cs,%0" : "=r" (my_cs));
559
560 if (cs_bitness(my_cs) == bitness)
561 return my_cs;
562 if (cs_bitness(my_cs + (2 << 3)) == bitness)
563 return my_cs + (2 << 3);
564 if (my_cs > (2<<3) && cs_bitness(my_cs - (2 << 3)) == bitness)
565 return my_cs - (2 << 3);
566 if (cs_bitness(code16_sel) == bitness)
567 return code16_sel;
568
569 printf("[WARN]\tCould not find %d-bit CS\n", bitness);
570 return -1;
571}
572
573static int test_valid_sigreturn(int cs_bits, bool use_16bit_ss, int force_ss)
574{
575 int cs = find_cs(cs_bits);
576 if (cs == -1) {
577 printf("[SKIP]\tCode segment unavailable for %d-bit CS, %d-bit SS\n",
578 cs_bits, use_16bit_ss ? 16 : 32);
579 return 0;
580 }
581
582 if (force_ss != -1) {
583 sig_ss = force_ss;
584 } else {
585 if (use_16bit_ss) {
586 if (!data16_sel) {
587 printf("[SKIP]\tData segment unavailable for %d-bit CS, 16-bit SS\n",
588 cs_bits);
589 return 0;
590 }
591 sig_ss = data16_sel;
592 } else {
593 asm volatile ("mov %%ss,%0" : "=r" (sig_ss));
594 }
595 }
596
597 sig_cs = cs;
598
599 printf("[RUN]\tValid sigreturn: %d-bit CS (%hx), %d-bit SS (%hx%s)\n",
600 cs_bits, sig_cs, use_16bit_ss ? 16 : 32, sig_ss,
601 (sig_ss & 4) ? "" : ", GDT");
602
603 raise(SIGUSR1);
604
605 nerrs = 0;
606
607
608
609
610
611 for (int i = 0; i < NGREG; i++) {
612 greg_t req = requested_regs[i], res = resulting_regs[i];
613 if (i == REG_TRAPNO || i == REG_IP)
614 continue;
615 if (i == REG_SP) {
616 printf("\tSP: %llx -> %llx\n", (unsigned long long)req,
617 (unsigned long long)res);
618
619
620
621
622
623
624
625
626 if (res == (req & 0xFFFFFFFF))
627 continue;
628 }
629
630 bool ignore_reg = false;
631#if __i386__
632 if (i == REG_UESP)
633 ignore_reg = true;
634#else
635 if (i == REG_CSGSFS) {
636 struct selectors *req_sels =
637 (void *)&requested_regs[REG_CSGSFS];
638 struct selectors *res_sels =
639 (void *)&resulting_regs[REG_CSGSFS];
640 if (req_sels->cs != res_sels->cs) {
641 printf("[FAIL]\tCS mismatch: requested 0x%hx; got 0x%hx\n",
642 req_sels->cs, res_sels->cs);
643 nerrs++;
644 }
645
646 if (req_sels->ss != res_sels->ss) {
647 printf("[FAIL]\tSS mismatch: requested 0x%hx; got 0x%hx\n",
648 req_sels->ss, res_sels->ss);
649 nerrs++;
650 }
651
652 continue;
653 }
654#endif
655
656
657 if (i == REG_CX && requested_regs[i] != resulting_regs[i]) {
658 printf("[FAIL]\tCX (saved SP) mismatch: requested 0x%llx; got 0x%llx\n",
659 (unsigned long long)requested_regs[i],
660 (unsigned long long)resulting_regs[i]);
661 nerrs++;
662 continue;
663 }
664
665 if (requested_regs[i] != resulting_regs[i] && !ignore_reg) {
666
667
668
669
670
671
672
673 printf("[FAIL]\tReg %d mismatch: requested 0x%llx; got 0x%llx\n",
674 i, (unsigned long long)requested_regs[i],
675 (unsigned long long)resulting_regs[i]);
676 nerrs++;
677 }
678 }
679
680 if (nerrs == 0)
681 printf("[OK]\tall registers okay\n");
682
683 return nerrs;
684}
685
686static int test_bad_iret(int cs_bits, unsigned short ss, int force_cs)
687{
688 int cs = force_cs == -1 ? find_cs(cs_bits) : force_cs;
689 if (cs == -1)
690 return 0;
691
692 sig_cs = cs;
693 sig_ss = ss;
694
695 printf("[RUN]\t%d-bit CS (%hx), bogus SS (%hx)\n",
696 cs_bits, sig_cs, sig_ss);
697
698 sig_trapped = 0;
699 raise(SIGUSR1);
700 if (sig_trapped) {
701 char errdesc[32] = "";
702 if (sig_err) {
703 const char *src = (sig_err & 1) ? " EXT" : "";
704 const char *table;
705 if ((sig_err & 0x6) == 0x0)
706 table = "GDT";
707 else if ((sig_err & 0x6) == 0x4)
708 table = "LDT";
709 else if ((sig_err & 0x6) == 0x2)
710 table = "IDT";
711 else
712 table = "???";
713
714 sprintf(errdesc, "%s%s index %d, ",
715 table, src, sig_err >> 3);
716 }
717
718 char trapname[32];
719 if (sig_trapno == 13)
720 strcpy(trapname, "GP");
721 else if (sig_trapno == 11)
722 strcpy(trapname, "NP");
723 else if (sig_trapno == 12)
724 strcpy(trapname, "SS");
725 else if (sig_trapno == 32)
726 strcpy(trapname, "IRET");
727 else
728 sprintf(trapname, "%d", sig_trapno);
729
730 printf("[OK]\tGot #%s(0x%lx) (i.e. %s%s)\n",
731 trapname, (unsigned long)sig_err,
732 errdesc, strsignal(sig_trapped));
733 return 0;
734 } else {
735
736
737
738
739
740
741 printf("[FAIL]\tDid not get SIGSEGV\n");
742 return 1;
743 }
744}
745
746int main()
747{
748 int total_nerrs = 0;
749 unsigned short my_cs, my_ss;
750
751 asm volatile ("mov %%cs,%0" : "=r" (my_cs));
752 asm volatile ("mov %%ss,%0" : "=r" (my_ss));
753 setup_ldt();
754
755 stack_t stack = {
756 .ss_sp = altstack_data,
757 .ss_size = SIGSTKSZ,
758 };
759 if (sigaltstack(&stack, NULL) != 0)
760 err(1, "sigaltstack");
761
762 sethandler(SIGUSR1, sigusr1, 0);
763 sethandler(SIGTRAP, sigtrap, SA_ONSTACK);
764
765
766 total_nerrs += test_valid_sigreturn(64, false, -1);
767 total_nerrs += test_valid_sigreturn(32, false, -1);
768 total_nerrs += test_valid_sigreturn(16, false, -1);
769
770
771
772
773
774
775
776
777 total_nerrs += test_valid_sigreturn(64, true, -1);
778 total_nerrs += test_valid_sigreturn(32, true, -1);
779 total_nerrs += test_valid_sigreturn(16, true, -1);
780
781 if (gdt_data16_idx) {
782
783
784
785
786
787
788
789 total_nerrs += test_valid_sigreturn(64, true,
790 GDT3(gdt_data16_idx));
791 total_nerrs += test_valid_sigreturn(32, true,
792 GDT3(gdt_data16_idx));
793 total_nerrs += test_valid_sigreturn(16, true,
794 GDT3(gdt_data16_idx));
795 }
796
797#ifdef __x86_64__
798
799 sig_corrupt_final_ss = 1;
800 total_nerrs += test_valid_sigreturn(32, false, -1);
801 total_nerrs += test_valid_sigreturn(32, true, -1);
802 sig_corrupt_final_ss = 0;
803#endif
804
805
806
807
808
809
810
811
812
813 clearhandler(SIGTRAP);
814 sethandler(SIGSEGV, sigtrap, SA_ONSTACK);
815 sethandler(SIGBUS, sigtrap, SA_ONSTACK);
816 sethandler(SIGILL, sigtrap, SA_ONSTACK);
817
818
819 test_bad_iret(64, ldt_nonexistent_sel, -1);
820 test_bad_iret(32, ldt_nonexistent_sel, -1);
821 test_bad_iret(16, ldt_nonexistent_sel, -1);
822
823
824 test_bad_iret(64, my_cs, -1);
825 test_bad_iret(32, my_cs, -1);
826 test_bad_iret(16, my_cs, -1);
827
828
829 test_bad_iret(32, my_ss, npcode32_sel);
830
831
832
833
834
835
836
837
838
839
840
841
842 test_bad_iret(32, npdata32_sel, -1);
843
844
845
846
847
848
849
850 if (gdt_npdata32_idx)
851 test_bad_iret(32, GDT3(gdt_npdata32_idx), -1);
852
853#ifdef __x86_64__
854 total_nerrs += test_nonstrict_ss();
855#endif
856
857 return total_nerrs ? 1 : 0;
858}
859