chen-charles / psp2cldr Goto Github PK

   sc->eflags = LibVEX_GuestX86_get_eflags(&tst->arch.vex);

   sc->arm_cpsr = LibVEX_GuestARM_get_cpsr(&tst->arch.vex);

// compile with `gcc a.c`

#include <assert.h>
#include <signal.h>
#include <stdint.h>
#include <stdlib.h>
#include <sys/mman.h>
#include <unistd.h>

#define TESTBIT(var, pos) ((var) & ((uintptr_t)1 << (pos)))
#define SETBIT(var, pos) ((var) | ((uintptr_t)1 << (pos)))
#define CLEARBIT(var, pos) ((var) & ~((uintptr_t)1 << (pos)))

volatile sig_atomic_t count = 0;
uintptr_t ptr;
int pagesize;

void sigill_handler(int sig, siginfo_t *info, void *ucontext)
{
    ucontext_t *ctx = (ucontext_t *)(ucontext);

    if (count == 0)
    {
        count = 1;

        // On linux, this will goto SIGILL, because the processor will decide based on CPSR.T, not PC's LSB.
        // see DDI0406C_d_armv7ar_arm B1.8.10 Exception return
        // https://developer.arm.com/documentation/ddi0406/cd/?lang=en

        // On qemu, anything could happen, because strictly speaking, ARM stated that,
        // "ARM deprecates any dependence on the requirements that the hardware ignores bits of the address."
        // also see https://lists.gnu.org/archive/html/qemu-devel/2021-04/msg02211.html

        // On valgrind, we would head to Thumb and SEGV.

        ctx->uc_mcontext.arm_pc = ptr + pagesize;
        ctx->uc_mcontext.arm_pc = SETBIT(ctx->uc_mcontext.arm_pc, 0);
        ctx->uc_mcontext.arm_cpsr = CLEARBIT(ctx->uc_mcontext.arm_cpsr, 5);

        // alternatively, on qemu and linux, if we do the followings,

        // ctx->uc_mcontext.arm_pc = ptr + pagesize;
        // ctx->uc_mcontext.arm_cpsr = SETBIT(ctx->uc_mcontext.arm_cpsr, 5);

        // we will see SEGV because we would head to Thumb
        // it's probably unfair to mention valgrind's behavior because valgrind ignores cpsr altogether
    }
    else
    {
        // make sure we landed because we were on an ARM instruction
        assert(TESTBIT(ctx->uc_mcontext.arm_pc, 0) == 0);
        assert(ctx->uc_mcontext.arm_pc == ptr + pagesize);
        _exit(0);
    }
}

int main(int argc, char *argv[])
{
    /**
     * ARM: (SIGILL)
     * udf #0x44
     *
     * THUMB: (SEGV if we protect the page ahead of us)
     * lsls r4, r6, #0x13
     * b 0xffffffe6
     */
    static const uint32_t INSTR_UDF44_ARM = 0xe7f004f0;

    pagesize = sysconf(_SC_PAGE_SIZE);
    assert(pagesize != -1);

    ptr = (uintptr_t)mmap(NULL, 2 * pagesize, PROT_EXEC | PROT_READ | PROT_WRITE,
                          MAP_ANONYMOUS | MAP_POPULATE | MAP_PRIVATE, -1, 0);
    assert(TESTBIT(ptr, 0) == 0);

    *(uint32_t *)(ptr + pagesize) = INSTR_UDF44_ARM;
    assert(mprotect((void *)ptr, pagesize, PROT_NONE) != -1);

    struct sigaction action, oldaction;
    sigfillset(&action.sa_mask);
    action.sa_flags = SA_SIGINFO;
    action.sa_sigaction = sigill_handler;
    assert(sigaction(SIGILL, &action, &oldaction) == 0);

    __asm__("udf #0xff");

    return 0;
}

// compile with `gcc a.c -pthread`

#include <assert.h>
#include <pthread.h>

#define MAGIC_RETURN ((void *)42)

void *thread_main(void *arg)
{
    return MAGIC_RETURN;
}

int main(int argc, char *argv[])
{
    size_t i;
    for (i = 0;; i++)
    {
        pthread_t thread;
        assert(pthread_create(&thread, NULL, thread_main, NULL) == 0);
        void *ret;
        assert(pthread_join(thread, &ret) == 0);
        assert(ret == MAGIC_RETURN);
    }

    return 0;
}