From: Denys Vlasenko <vda.linux@googlemail.com>
To: Andy Lutomirski <luto@amacapital.net>
Cc: Denys Vlasenko <dvlasenk@redhat.com>,
Linus Torvalds <torvalds@linux-foundation.org>,
Steven Rostedt <rostedt@goodmis.org>,
Ingo Molnar <mingo@kernel.org>, Borislav Petkov <bp@alien8.de>,
"H. Peter Anvin" <hpa@zytor.com>, Oleg Nesterov <oleg@redhat.com>,
Frederic Weisbecker <fweisbec@gmail.com>,
Alexei Starovoitov <ast@plumgrid.com>,
Will Drewry <wad@chromium.org>, Kees Cook <keescook@chromium.org>,
X86 ML <x86@kernel.org>,
"linux-kernel@vger.kernel.org" <linux-kernel@vger.kernel.org>
Subject: Re: [PATCH] x86: entry_32.S: change ESPFIX test to not touch PT_OLDSS(%esp)
Date: Mon, 9 Mar 2015 20:31:55 +0100 [thread overview]
Message-ID: <CAK1hOcNbG1caVkaP062w62CG6fdcbXDnDe5=-GOhvRmO-CKy3A@mail.gmail.com> (raw)
In-Reply-To: <CALCETrWE4xfHuhtQ4K=dhevgrY+ThHiARZX0gg2X8nw3ngCT_w@mail.gmail.com>
[-- Attachment #1: Type: text/plain, Size: 398 bytes --]
>> What we definitely should do here is at least frame this check with
>>> That being said, what ends up in the high bits of esp when we iret to
>>> vm86 mode?
>>
>> I don't know. I guess it's time to write an actual vm86 testcase :)
>
> Ick. I can try...
I found an example which runs small bit of 16-bit code using vm86 machinery.
Tried in 32-bit kernel under qemu, it worked: printed "Hello".
[-- Attachment #2: vm86.c --]
[-- Type: text/x-csrc, Size: 4700 bytes --]
/*
* Adaped from: runcom version 0.1 (c) 2003 Fabrice Bellar
* "Simple example of use of vm86: launch a basic .com DOS executable"
*
* gcc -m32 -Os -Wall -static vm86.c -ovm86
*/
#include <stdlib.h>
#include <stdio.h>
#include <string.h>
#include <inttypes.h>
#include <unistd.h>
#include <fcntl.h>
#include <sys/mman.h>
#include <signal.h>
#include <linux/unistd.h>
#include <asm/vm86.h>
#include <sys/vm86.h>
//#define SIGTEST
#define COM_BASE_ADDR 0x10100
static inline void set_bit(uint8_t *a, unsigned int bit)
{
a[bit / 8] |= (1 << (bit % 8));
}
static inline uint8_t *seg_to_linear(unsigned int seg, unsigned int reg)
{
return (uint8_t *)((seg << 4) + (reg & 0xffff));
}
static inline void pushw(struct vm86_regs *r, int val)
{
r->esp = (r->esp & ~0xffff) | ((r->esp - 2) & 0xffff);
*(uint16_t *)seg_to_linear(r->ss, r->esp) = val;
}
void dump_regs(struct vm86_regs *r)
{
fprintf(stderr,
"AX=%08lx BX=%08lx CX=%08lx DX=%08lx\n"
"SI=%08lx DI=%08lx BP=%08lx SP=%08lx\n"
"IP=%08lx FL=%08lx\n"
"CS=%04x DS=%04x ES=%04x SS=%04x FS=%04x GS=%04x\n",
r->eax, r->ebx, r->ecx, r->edx, r->esi, r->edi, r->ebp, r->esp,
r->eip, r->eflags,
r->cs, r->ds, r->es, r->ss, r->fs, r->gs);
}
#ifdef SIGTEST
void alarm_handler(int sig)
{
fprintf(stderr, "alarm signal=%d\n", sig);
alarm(1);
}
#endif
extern char code16;
extern char code16_end;
int main(int argc, char **argv)
{
uint8_t *vm86_mem;
int ret, seg;
struct vm86plus_struct ctx;
struct vm86_regs *r;
vm86_mem = mmap((void *)0x00000000, 0x110000,
PROT_WRITE | PROT_READ | PROT_EXEC,
MAP_FIXED | MAP_ANON | MAP_PRIVATE, -1, 0);
if (vm86_mem == MAP_FAILED) {
perror("mmap");
exit(1);
}
#ifdef SIGTEST
{
struct sigaction act;
act.sa_handler = alarm_handler;
sigemptyset(&act.sa_mask);
act.sa_flags = 0;
sigaction(SIGALRM, &act, NULL);
alarm(1);
}
#endif
/* load 16-bit code at COM_BASE_ADDR */
memcpy(vm86_mem + COM_BASE_ADDR, &code16, &code16_end - &code16);
memset(&ctx, 0, sizeof(ctx));
/* init basic registers */
r = &ctx.regs;
r->eip = 0x100;
r->esp = 0xfffe;
seg = (COM_BASE_ADDR - 0x100) >> 4;
r->cs = seg;
r->ss = seg;
r->ds = seg;
r->es = seg;
r->fs = seg;
r->gs = seg;
r->eflags = 1 << 19; //EFLAGS.VIF
set_bit((uint8_t *)&ctx.int_revectored, 0x21);
/* put return code */
*seg_to_linear(r->cs, 0) = 0xb4; /* mov ah, $0 */
*seg_to_linear(r->cs, 1) = 0x00;
*seg_to_linear(r->cs, 2) = 0xcd; /* int $0x21 */
*seg_to_linear(r->cs, 3) = 0x21;
pushw(&ctx.regs, 0x0000);
for(;;) {
ret = vm86(VM86_ENTER, &ctx);
switch(VM86_TYPE(ret)) {
case VM86_INTx:
{
int int_num, ah;
int_num = VM86_ARG(ret);
if (int_num != 0x21)
goto unknown_int;
ah = (r->eax >> 8) & 0xff;
switch(ah) {
case 0x00: /* exit */
exit(0);
case 0x02: /* write char */
{
uint8_t c = r->edx;
write(1, &c, 1);
}
break;
case 0x09: /* write string */
{
int ptr = r->edx;
uint8_t c;
for(;;) {
c = *seg_to_linear(r->ds, ptr++);
if (c == '$')
break;
write(1, &c, 1);
}
r->eax = (r->eax & ~0xff) | '$';
}
break;
default:
unknown_int:
fprintf(stderr, "unsupported int 0x%02x\n", int_num);
dump_regs(&ctx.regs);
// exit(1);
}
}
break;
case VM86_SIGNAL:
/* a signal came, we just ignore that */
break;
case VM86_STI:
break;
default:
fprintf(stderr, "unhandled vm86 return code (0x%x)\n", ret);
dump_regs(&ctx.regs);
exit(1);
}
}
}
void code()
{
asm volatile("\n"
" .code16""\n"
"code16:""\n"
" mov $(0x100+msg-code16),%dx""\n"
" mov $0x09,%ah""\n"
" int $0x21""\n"
" ret""\n"
"msg:""\n"
" .string \"Hello\"""\n"
" .byte 10""\n"
" .string \"$\"""\n"
"code16_end:""\n"
" .code32""\n"
);
}
next prev parent reply other threads:[~2015-03-09 19:32 UTC|newest]
Thread overview: 24+ messages / expand[flat|nested] mbox.gz Atom feed top
2015-03-09 14:05 [PATCH] x86: entry_32.S: change ESPFIX test to not touch PT_OLDSS(%esp) Denys Vlasenko
2015-03-09 14:18 ` Andy Lutomirski
2015-03-09 15:00 ` Denys Vlasenko
2015-03-09 15:09 ` Andy Lutomirski
2015-03-09 19:31 ` Denys Vlasenko [this message]
2015-03-09 15:13 ` Ingo Molnar
2015-03-09 15:18 ` Andy Lutomirski
2015-03-09 15:47 ` Steven Rostedt
2015-03-09 15:54 ` Ingo Molnar
2015-03-09 16:08 ` Linus Torvalds
2015-03-09 16:28 ` Denys Vlasenko
2015-03-09 16:44 ` Linus Torvalds
2015-03-09 17:44 ` H. Peter Anvin
2015-03-09 19:13 ` Andy Lutomirski
2015-03-09 19:26 ` H. Peter Anvin
2015-03-09 19:51 ` Andy Lutomirski
2015-03-09 17:42 ` H. Peter Anvin
2015-03-09 17:45 ` Andy Lutomirski
2015-03-09 17:59 ` Linus Torvalds
2015-03-09 18:04 ` Andy Lutomirski
2015-03-09 18:16 ` Linus Torvalds
2015-03-09 18:32 ` Denys Vlasenko
2015-03-09 18:36 ` Andy Lutomirski
2015-03-10 6:25 ` Ingo Molnar
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to='CAK1hOcNbG1caVkaP062w62CG6fdcbXDnDe5=-GOhvRmO-CKy3A@mail.gmail.com' \
--to=vda.linux@googlemail.com \
--cc=ast@plumgrid.com \
--cc=bp@alien8.de \
--cc=dvlasenk@redhat.com \
--cc=fweisbec@gmail.com \
--cc=hpa@zytor.com \
--cc=keescook@chromium.org \
--cc=linux-kernel@vger.kernel.org \
--cc=luto@amacapital.net \
--cc=mingo@kernel.org \
--cc=oleg@redhat.com \
--cc=rostedt@goodmis.org \
--cc=torvalds@linux-foundation.org \
--cc=wad@chromium.org \
--cc=x86@kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).