INterested in: syscall32_from_64.c
What's does that do? I know in IA32 emu mode on a 64bit kernel from running binaries using strace that they make gettimeofday etc syscalls rather than use vdso.
On my Intel-based box, it gets SIGILL, but if I run it under QEMU without KVM, it says "syscall return = 137".
The more interesting things in there include segregs (testing for an info leak that has no CVE yet), syscall_exit_regs_64 (run it under strace and watch it fail), and dump_all_pmcs.
I'm hoping that dump_all_pmcs will stop working in Linux 3.20.
Also, on new enough kernels with new enough glibc (I think), even 32-bit programs use vdso timing.
I saw a patch being discussed but wasn't sure if it made it in. I'd rather it didn't because some people are insisting they need it so they can run 32bit Java (for performance reasons because GC is marginally faster). The irony is entirely lost on them.
Really useful little set of experiments, good to have them in one place.
Not familliar with pcmcs, what are they?
They're performance monitoring counters, which are complicated programmable things on most x86 chips that could cache misses, cycles, etc. They don't come with a sensible way to selectively grant user access.
However I haven't looked too hard, but grsec seems to have its own bugs in this area. I'll email them.
As usual, my nasty IRET test case is available [1], and, as of the embargo expiration (Monday), it contains tests for the whole pile of issues here, among others. Save your work before running it.
[1] https://gitorious.org/linux-test-utils/linux-clock-tests/sou...