From owner-svn-src-head@freebsd.org Thu May 10 13:52:54 2018 Return-Path: Delivered-To: svn-src-head@mailman.ysv.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2610:1c1:1:606c::19:1]) by mailman.ysv.freebsd.org (Postfix) with ESMTP id CE6CDFCA3A6; Thu, 10 May 2018 13:52:53 +0000 (UTC) (envelope-from kib@FreeBSD.org) Received: from mxrelay.nyi.freebsd.org (mxrelay.nyi.freebsd.org [IPv6:2610:1c1:1:606c::19:3]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (Client CN "mxrelay.nyi.freebsd.org", Issuer "Let's Encrypt Authority X3" (verified OK)) by mx1.freebsd.org (Postfix) with ESMTPS id 75AFD83C4A; Thu, 10 May 2018 13:52:53 +0000 (UTC) (envelope-from kib@FreeBSD.org) Received: from repo.freebsd.org (repo.freebsd.org [IPv6:2610:1c1:1:6068::e6a:0]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (Client did not present a certificate) by mxrelay.nyi.freebsd.org (Postfix) with ESMTPS id 55D6E214B4; Thu, 10 May 2018 13:52:53 +0000 (UTC) (envelope-from kib@FreeBSD.org) Received: from repo.freebsd.org ([127.0.1.37]) by repo.freebsd.org (8.15.2/8.15.2) with ESMTP id w4ADqrKZ005163; Thu, 10 May 2018 13:52:53 GMT (envelope-from kib@FreeBSD.org) Received: (from kib@localhost) by repo.freebsd.org (8.15.2/8.15.2/Submit) id w4ADqr7N005162; Thu, 10 May 2018 13:52:53 GMT (envelope-from kib@FreeBSD.org) Message-Id: <201805101352.w4ADqr7N005162@repo.freebsd.org> X-Authentication-Warning: repo.freebsd.org: kib set sender to kib@FreeBSD.org using -f From: Konstantin Belousov Date: Thu, 10 May 2018 13:52:53 +0000 (UTC) To: src-committers@freebsd.org, svn-src-all@freebsd.org, svn-src-head@freebsd.org Subject: svn commit: r333460 - head/tools/test/popss X-SVN-Group: head X-SVN-Commit-Author: kib X-SVN-Commit-Paths: head/tools/test/popss X-SVN-Commit-Revision: 333460 X-SVN-Commit-Repository: base MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit X-BeenThere: svn-src-head@freebsd.org X-Mailman-Version: 2.1.25 Precedence: list List-Id: SVN commit messages for the src tree for head/-current List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 10 May 2018 13:52:54 -0000 Author: kib Date: Thu May 10 13:52:52 2018 New Revision: 333460 URL: https://svnweb.freebsd.org/changeset/base/333460 Log: Add the test program to examine CPU behaviour for pop ss issue CVE-2018-8897. Requested by: emaste Sponsored by: The FreeBSD Foundation MFC after: 3 days Added: head/tools/test/popss/ head/tools/test/popss/popss.c (contents, props changed) Added: head/tools/test/popss/popss.c ============================================================================== --- /dev/null 00:00:00 1970 (empty, because file is newly added) +++ head/tools/test/popss/popss.c Thu May 10 13:52:52 2018 (r333460) @@ -0,0 +1,183 @@ +/*- + * SPDX-License-Identifier: BSD-2-Clause-FreeBSD + * + * Copyright (c) 2018 The FreeBSD Foundation + * All rights reserved. + * + * This software was developed by Konstantin Belousov + * under sponsorship from the FreeBSD Foundation. + * + * Redistribution and use in source and binary forms, with or without + * modification, are permitted provided that the following conditions + * are met: + * 1. Redistributions of source code must retain the above copyright + * notice, this list of conditions and the following disclaimer. + * 2. Redistributions in binary form must reproduce the above copyright + * notice, this list of conditions and the following disclaimer in the + * documentation and/or other materials provided with the distribution. + * + * THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND + * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE + * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE + * ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE + * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL + * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS + * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) + * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT + * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY + * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF + * SUCH DAMAGE. + * + * $Id: popss.c,v 1.28 2018/05/09 21:35:29 kostik Exp kostik $ + * $FreeBSD$ + * + * cc -m32 -Wall -Wextra -O2 -g -o popss popss.c + * Use as "popss ", where instruction is one of + * bound, into, int1, int3, int80, syscall, sysenter. + */ + +#include +#include +#include +#include +#include +#include +#include +#include +#include +#include + +static u_long *stk; + +#define ITERATIONS 4 + +static void +setup(pid_t child) +{ + struct reg r; + struct dbreg dbr; + int error, i, status; + + error = waitpid(child, &status, WTRAPPED | WEXITED); + if (error == -1) + err(1, "waitpid 1"); + error = ptrace(PT_GETREGS, child, (caddr_t)&r, 0); + if (error == -1) + err(1, "ptrace PT_GETREGS"); + printf("child %d stopped eip %#x esp %#x\n", child, r.r_eip, r.r_esp); + + error = ptrace(PT_GETDBREGS, child, (caddr_t)&dbr, 0); + if (error != 0) + err(1, "ptrace PT_GETDBREGS"); + dbr.dr[7] &= ~DBREG_DR7_MASK(0); + dbr.dr[7] |= DBREG_DR7_SET(0, DBREG_DR7_LEN_4, DBREG_DR7_RDWR, + DBREG_DR7_LOCAL_ENABLE | DBREG_DR7_GLOBAL_ENABLE); + dbr.dr[0] = (uintptr_t)stk; + error = ptrace(PT_SETDBREGS, child, (caddr_t)&dbr, 0); + if (error != 0) + err(1, "ptrace PT_SETDBREGS"); + error = ptrace(PT_CONTINUE, child, (caddr_t)1, 0); + if (error != 0) + err(1, "ptrace PT_CONTINUE fire"); + + for (i = 0; i < ITERATIONS; i++) { + error = waitpid(child, &status, WTRAPPED | WEXITED); + if (error == -1) + err(1, "waitpid 2"); + if (WIFEXITED(status)) + break; + error = ptrace(PT_GETREGS, child, (caddr_t)&r, 0); + if (error == -1) + err(1, "ptrace PT_GETREGS"); + error = ptrace(PT_GETDBREGS, child, (caddr_t)&dbr, 0); + if (error != 0) + err(1, "ptrace PT_GETDBREGS"); + printf("child %d stopped eip %#x esp %#x dr0 %#x " + "dr6 %#x dr7 %#x\n", child, r.r_eip, r.r_esp, + dbr.dr[0], dbr.dr[6], dbr.dr[7]); + error = ptrace(PT_CONTINUE, child, (caddr_t)1, 0); + if (error == -1) + err(1, "ptrace PT_CONTINUE tail"); + } + if (i == ITERATIONS) { + kill(child, SIGKILL); + ptrace(PT_DETACH, child, NULL, 0); + } +} + +static u_long tmpstk[1024 * 128]; + +static u_int +read_ss(void) +{ + u_int res; + + __asm volatile("movl\t%%ss,%0" : "=r" (res)); + return (res); +} + +#define PROLOGUE "int3;movl\t%0,%%esp;popl\t%%ss;" + +static void +act(const char *cmd) +{ + int error; + static const int boundx[2] = {0, 1}; + + printf("child pid %d, stk at %p\n", getpid(), stk); + *stk = read_ss(); + + error = ptrace(PT_TRACE_ME, 0, NULL, 0); + if (error != 0) + err(1, "ptrace PT_TRACE_ME"); + + if (strcmp(cmd, "bound") == 0) { + /* XXX BOUND args order clang ias bug */ + __asm volatile("int3;movl\t$11,%%eax;" + "movl\t%0,%%esp;popl\t%%ss;bound\t%1,%%eax" + : : "r" (stk), "m" (boundx) : "memory"); + } else if (strcmp(cmd, "int1") == 0) { + __asm volatile(PROLOGUE ".byte 0xf1" + : : "r" (stk) : "memory"); + } else if (strcmp(cmd, "int3") == 0) { + __asm volatile(PROLOGUE "int3" + : : "r" (stk) : "memory"); + } else if (strcmp(cmd, "into") == 0) { + __asm volatile("int3;movl\t$0x80000000,%%eax;" + "addl\t%%eax,%%eax;movl\t%0,%%esp;popl\t%%ss;into" + : : "r" (stk) : "memory"); + } else if (strcmp(cmd, "int80") == 0) { + __asm volatile(PROLOGUE "int\t$0x80" + : : "r" (stk) : "memory"); + } else if (strcmp(cmd, "syscall") == 0) { + __asm volatile(PROLOGUE "syscall" + : : "r" (stk) : "memory"); + } else if (strcmp(cmd, "sysenter") == 0) { + __asm volatile(PROLOGUE "sysenter" + : : "r" (stk) : "memory"); + } else { + fprintf(stderr, "unknown instruction\n"); + exit(1); + } + printf("ho\n"); +} + +int +main(int argc, char *argv[]) +{ + int child; + + if (argc != 2) { + printf( + "Usage: popss [bound|int1|int3|into|int80|syscall|sysenter]\n"); + exit(1); + } + stk = &tmpstk[nitems(tmpstk) - 1]; + child = fork(); + if (child == -1) + err(1, "fork"); + if (child == 0) + act(argv[1]); + else + setup(child); +}