Fix security holes in sigreturn(), ptrace() and procfs. sigreturn()

attempted to check for insecure and fatal eflags and segment
selectors, but missed many cases and got the IOPL check back to
front.  The other syscalls didn't check at all.

sys_process.c, machdep.c:
Only allow PT_WRITE_U to write to the registers (ordinary and FP).

psl.h, locore.s, machdep.c:
Eliminate PSL_MBZ, PSL_MBO and PSL_USERCLR.  We are not supposed
to assume anything about the reserved bits.  Use PSL_USERCHANGE
and PSL_KERNEL instead.  Rename PSL_USERSET to PSL_USER.

exception.s:
Define a private label for use by doreti when returning to user
mode fails.

machdep.c:
In syscalls, allow changing only the eflags that can be changed on
486's in user mode (no longer attempt to allow benign IOPL changes;
allow changing the nasty PSL_NT; don't allow changing the i586
bits).

Don't attempt to check all the cases involving invalid selectors
and %eip's.  Just check for privilege violations and let the invalid
things cause a trap.

procfs_machdep.c:
Call the ptrace register functions to do all the work for reading
and writing ordinary registers and for single stepping.

trap.c:
Ignore traps caused by PSL_NT being set.  Previously, users could
cause a fatal trap in user mode by setting PSL_NT and executing an
iret, and a fatal trap in kernel mode by setting PSL_NT and making
a syscall.  PSL_NT was cleared too late and not in enough modes to
fix the problem.

Make all traps in user mode (except T_NMI) nonfatal.

Recover from traps caused by attempting to load invalid user
registers in doreti by restarting the traps so that they appear to
occur in user mode.
---

Fix bogons that I noticed while fixing the above:

psl.h:
Fix some comments.

Uniformize idempotency ifdef.

exception.s, machdep.c:
Remove rsvd[0-14].  rsvd0 hasn't been reserved since the 486 came
out.  Replace rsvd0 by `align'.  rsvd[0-11] used wrong (magic
non-unique) trap numbers.  Replace rsvd[1-14] by rsvd.

locore.s:
Enable alignment check flag on 486's and 586's.

machdep.c:
Use a better type for kstack[].

Use TFREGP() to find the registers.

Reformat ptrace functions from SEF to something closer to KNF.

procfs_machdep.c:
The wrong pointer to the registers got fixed as a side effect.

Implement reading and writing of FP registers.

/proc/*/*regs now work (only) for processes that are in memory.

Clean up comments.

trap.c, trap.h:
Remove unused trap types.

1 files changed, 8 insertions, 13 deletions

diff --git a/sys/amd64/include/trap.h b/sys/amd64/include/trap.h
index aa832ff..e1ead77 100644
--- a/sys/amd64/include/trap.h
+++ b/sys/amd64/include/trap.h
@@ -34,33 +34,25 @@
  * SUCH DAMAGE.
  *
  *	from: @(#)trap.h	5.4 (Berkeley) 5/9/91
- *	$Id: trap.h,v 1.2 1993/10/16 14:39:37 rgrimes Exp $
+ *	$Id: trap.h,v 1.3 1993/11/07 17:43:15 wollman Exp $
  */
 
 #ifndef _MACHINE_TRAP_H_
-#define _MACHINE_TRAP_H_ 1
+#define	_MACHINE_TRAP_H_
 
 /*
  * Trap type values
  * also known in trap.c for name strings
  */
 
-#define	T_RESADFLT	0	/* reserved addressing */
 #define	T_PRIVINFLT	1	/* privileged instruction */
-#define	T_RESOPFLT	2	/* reserved operand */
 #define	T_BPTFLT	3	/* breakpoint instruction */
-#define	T_SYSCALL	5	/* system call (kcall) */
 #define	T_ARITHTRAP	6	/* arithmetic trap */
 #define	T_ASTFLT	7	/* system forced exception */
-#define	T_SEGFLT	8	/* segmentation (limit) fault */
 #define	T_PROTFLT	9	/* protection fault */
-#define	T_TRCTRAP	10	/* trace trap */
+#define	T_TRCTRAP	10	/* debug exception (sic) */
 #define	T_PAGEFLT	12	/* page fault */
-#define	T_TABLEFLT	13	/* page table fault */
 #define	T_ALIGNFLT	14	/* alignment fault */
-#define	T_KSPNOTVAL	15	/* kernel stack pointer not valid */
-#define	T_BUSERR	16	/* bus error */
-#define	T_KDBTRAP	17	/* kernel debugger trap */
 
 #define	T_DIVIDE	18	/* integer divide fault */
 #define	T_NMI		19	/* non-maskable trap */
@@ -72,7 +64,9 @@
 #define	T_TSSFLT	25	/* invalid tss fault */
 #define	T_SEGNPFLT	26	/* segment not present fault */
 #define	T_STKFLT	27	/* stack fault */
-#define	T_RESERVED	28	/* reserved fault base */
+#define	T_RESERVED	28	/* reserved (unknown) */
+
+/* XXX most of the following codes aren't used, but could be. */
 
 /* definitions for <sys/signal.h> */
 #define	    ILL_RESAD_FAULT	T_RESADFLT
@@ -98,4 +92,5 @@
 
 /* Trap's coming from user mode */
 #define	T_USER	0x100
-#endif /* _MACHINE_TRAP_H_ */
+
+#endif /* !_MACHINE_TRAP_H_ */