1/* 2 * Copyright (c) 2018 Kevin Wolf <kwolf@redhat.com> 3 * 4 * Permission is hereby granted, free of charge, to any person obtaining a copy 5 * of this software and associated documentation files (the "Software"), to deal 6 * in the Software without restriction, including without limitation the rights 7 * to use, copy, modify, merge, publish, distribute, sublicense, and/or sell 8 * copies of the Software, and to permit persons to whom the Software is 9 * furnished to do so, subject to the following conditions: 10 * 11 * The above copyright notice and this permission notice shall be included in 12 * all copies or substantial portions of the Software. 13 * 14 * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR 15 * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, 16 * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL 17 * THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER 18 * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, 19 * OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN 20 * THE SOFTWARE. 21 */ 22 23.section multiboot 24 25#define MB_MAGIC 0x1badb002 26#define MB_FLAGS 0x10000 27#define MB_CHECKSUM -(MB_MAGIC + MB_FLAGS) 28 29.align 4 30.int MB_MAGIC 31.int MB_FLAGS 32.int MB_CHECKSUM 33 34#define LAST_BYTE_VALUE 0xa5 35 36/* 37 * Order of fields in the a.out kludge header fields: 38 * 39 * header_addr 40 * load_addr 41 * load_end_addr 42 * bss_end_addr 43 * entry_addr 44 */ 45#if SCENARIO == 1 46/* Well-behaved kernel file with explicit bss_end */ 47.int 0x100000 48.int 0x100000 49.int data_end 50.int data_end 51.int _start 52#elif SCENARIO == 2 53/* Well-behaved kernel file with default bss_end */ 54.int 0x100000 55.int 0x100000 56.int data_end 57.int 0 58.int _start 59#elif SCENARIO == 3 60/* Well-behaved kernel file with default load_end */ 61.int 0x100000 62.int 0x100000 63.int 0 64.int 0 65.int _start 66#elif SCENARIO == 4 67/* Well-behaved kernel file with load_end < data_end and bss > data_end */ 68#undef LAST_BYTE_VALUE 69#define LAST_BYTE_VALUE 0 70.int 0x100000 71.int 0x100000 72.int code_end 73.int 0x140000 74.int _start 75#elif SCENARIO == 5 76/* header < load */ 77.int 0x10000 78.int 0x100000 79.int data_end 80.int data_end 81.int _start 82#elif SCENARIO == 6 83/* load_end < load */ 84.int 0x100000 85.int 0x100000 86.int 0x10000 87.int data_end 88.int _start 89#elif SCENARIO == 7 90/* header much larger than in reality with default load_end */ 91.int 0x80000000 92.int 0x100000 93.int 0 94.int data_end 95.int _start 96#elif SCENARIO == 8 97/* bss_end < load_end - load (regression test for CVE-2018-7550) */ 98.int 0x100000 99.int 0x100000 100.int data_end 101.int code_end 102.int _start 103#elif SCENARIO == 9 104/* Default load_end_addr, load_addr + kernel_file_size > UINT32_MAX */ 105.int 0xfffff000 106.int 0xfffff000 107.int 0 108.int 0xfffff001 109.int _start 110#else 111#error Invalid SCENARIO 112#endif 113 114.section .text 115.global _start 116_start: 117 xor %eax, %eax 118 119 cmpb $LAST_BYTE_VALUE, last_byte 120 je passed 121 or $0x1, %eax 122passed: 123 124 /* Test device exit */ 125 outl %eax, $0xf4 126 127 cli 128 hlt 129 jmp . 130code_end: 131 132#if SCENARIO != 8 133.space 8192 134#endif 135 136last_byte: 137.byte 0xa5 138data_end: 139