Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 3ae36655 authored by Andy Lutomirski's avatar Andy Lutomirski Committed by H. Peter Anvin
Browse files

x86-64: Rework vsyscall emulation and add vsyscall= parameter 



There are three choices:

vsyscall=native: Vsyscalls are native code that issues the
corresponding syscalls.

vsyscall=emulate (default): Vsyscalls are emulated by instruction
fault traps, tested in the bad_area path.  The actual contents of
the vsyscall page is the same as the vsyscall=native case except
that it's marked NX.  This way programs that make assumptions about
what the code in the page does will not be confused when they read
that code.

vsyscall=none: Trying to execute a vsyscall will segfault.

Signed-off-by: default avatarAndy Lutomirski <luto@mit.edu>
Link: http://lkml.kernel.org/r/8449fb3abf89851fd6b2260972666a6f82542284.1312988155.git.luto@mit.edu


Signed-off-by: default avatarH. Peter Anvin <hpa@linux.intel.com>
parent fce8dc06

Documentation/kernel-parameters.txt

+21 −0
Original line number Original line Diff line number Diff line
@@ -2657,6 +2657,27 @@ bytes respectively. Such letter suffixes can also be entirely omitted. 
	vmpoff=		[KNL,S390] Perform z/VM CP command after power off.

	vmpoff=		[KNL,S390] Perform z/VM CP command after power off.

			Format: <command>

			Format: <command>





	vsyscall=	[X86-64]

			Controls the behavior of vsyscalls (i.e. calls to

			fixed addresses of 0xffffffffff600x00 from legacy

			code).  Most statically-linked binaries and older

			versions of glibc use these calls.  Because these

			functions are at fixed addresses, they make nice

			targets for exploits that can control RIP.



			emulate     [default] Vsyscalls turn into traps and are

			            emulated reasonably safely.



			native      Vsyscalls are native syscall instructions.

			            This is a little bit faster than trapping

			            and makes a few dynamic recompilers work

			            better than they would in emulation mode.

			            It also makes exploits much easier to write.



			none        Vsyscalls don't work at all.  This makes

			            them quite hard to use for exploits but

			            might break your system.



	vt.cur_default=	[VT] Default cursor shape.

	vt.cur_default=	[VT] Default cursor shape.

			Format: 0xCCBBAA, where AA, BB, and CC are the same as

			Format: 0xCCBBAA, where AA, BB, and CC are the same as

			the parameters of the <Esc>[?A;B;Cc escape sequence;

			the parameters of the <Esc>[?A;B;Cc escape sequence;

arch/x86/include/asm/irq_vectors.h

+0 −4
Original line number Original line Diff line number Diff line
@@ -17,7 +17,6 @@ 
 *  Vectors   0 ...  31 : system traps and exceptions - hardcoded events

 *  Vectors   0 ...  31 : system traps and exceptions - hardcoded events

 *  Vectors  32 ... 127 : device interrupts

 *  Vectors  32 ... 127 : device interrupts

 *  Vector  128         : legacy int80 syscall interface

 *  Vector  128         : legacy int80 syscall interface

 *  Vector  204         : legacy x86_64 vsyscall emulation

 *  Vectors 129 ... INVALIDATE_TLB_VECTOR_START-1 except 204 : device interrupts

 *  Vectors 129 ... INVALIDATE_TLB_VECTOR_START-1 except 204 : device interrupts

 *  Vectors INVALIDATE_TLB_VECTOR_START ... 255 : special interrupts

 *  Vectors INVALIDATE_TLB_VECTOR_START ... 255 : special interrupts

 *

 *
@@ -51,9 +50,6 @@ 
#ifdef CONFIG_X86_32

#ifdef CONFIG_X86_32

# define SYSCALL_VECTOR			0x80

# define SYSCALL_VECTOR			0x80

#endif

#endif

#ifdef CONFIG_X86_64

# define VSYSCALL_EMU_VECTOR		0xcc

#endif





/*

/*

 * Vectors 0x30-0x3f are used for ISA interrupts.

 * Vectors 0x30-0x3f are used for ISA interrupts.

arch/x86/include/asm/traps.h

+0 −2
Original line number Original line Diff line number Diff line
@@ -40,7 +40,6 @@ asmlinkage void alignment_check(void); 
asmlinkage void machine_check(void);

asmlinkage void machine_check(void);

#endif /* CONFIG_X86_MCE */

#endif /* CONFIG_X86_MCE */

asmlinkage void simd_coprocessor_error(void);

asmlinkage void simd_coprocessor_error(void);

asmlinkage void emulate_vsyscall(void);





dotraplinkage void do_divide_error(struct pt_regs *, long);

dotraplinkage void do_divide_error(struct pt_regs *, long);

dotraplinkage void do_debug(struct pt_regs *, long);

dotraplinkage void do_debug(struct pt_regs *, long);
@@ -67,7 +66,6 @@ dotraplinkage void do_alignment_check(struct pt_regs *, long); 
dotraplinkage void do_machine_check(struct pt_regs *, long);

dotraplinkage void do_machine_check(struct pt_regs *, long);

#endif

#endif

dotraplinkage void do_simd_coprocessor_error(struct pt_regs *, long);

dotraplinkage void do_simd_coprocessor_error(struct pt_regs *, long);

dotraplinkage void do_emulate_vsyscall(struct pt_regs *, long);

#ifdef CONFIG_X86_32

#ifdef CONFIG_X86_32

dotraplinkage void do_iret_error(struct pt_regs *, long);

dotraplinkage void do_iret_error(struct pt_regs *, long);

#endif

#endif

arch/x86/include/asm/vsyscall.h

+6 −0
Original line number Original line Diff line number Diff line
@@ -27,6 +27,12 @@ extern struct timezone sys_tz; 




extern void map_vsyscall(void);

extern void map_vsyscall(void);





/*

 * Called on instruction fetch fault in vsyscall page.

 * Returns true if handled.

 */

extern bool emulate_vsyscall(struct pt_regs *regs, unsigned long address);



#endif /* __KERNEL__ */

#endif /* __KERNEL__ */





#endif /* _ASM_X86_VSYSCALL_H */
 
#endif /* _ASM_X86_VSYSCALL_H */

arch/x86/kernel/entry_64.S

+0 −1
Original line number Original line Diff line number Diff line
@@ -1123,7 +1123,6 @@ zeroentry spurious_interrupt_bug do_spurious_interrupt_bug 
zeroentry coprocessor_error do_coprocessor_error

zeroentry coprocessor_error do_coprocessor_error

errorentry alignment_check do_alignment_check

errorentry alignment_check do_alignment_check

zeroentry simd_coprocessor_error do_simd_coprocessor_error

zeroentry simd_coprocessor_error do_simd_coprocessor_error

zeroentry emulate_vsyscall do_emulate_vsyscall









	/* Reload gs selector with exception handling */

	/* Reload gs selector with exception handling */