vsyscall_64.c 8.52 KB
Newer Older
Linus Torvalds's avatar
Linus Torvalds committed
1
2
3
4
/*
 *  Copyright (C) 2001 Andrea Arcangeli <andrea@suse.de> SuSE
 *  Copyright 2003 Andi Kleen, SuSE Labs.
 *
5
6
 *  [ NOTE: this mechanism is now deprecated in favor of the vDSO. ]
 *
Linus Torvalds's avatar
Linus Torvalds committed
7
8
9
10
11
12
13
14
15
16
 *  Thanks to hpa@transmeta.com for some useful hint.
 *  Special thanks to Ingo Molnar for his early experience with
 *  a different vsyscall implementation for Linux/IA32 and for the name.
 *
 *  vsyscall 1 is located at -10Mbyte, vsyscall 2 is located
 *  at virtual address -10Mbyte+1024bytes etc... There are at max 4
 *  vsyscalls. One vsyscall can reserve more than 1 slot to avoid
 *  jumping out of line if necessary. We cannot add more with this
 *  mechanism because older kernels won't return -ENOSYS.
 *
17
18
 *  Note: the concept clashes with user mode linux.  UML users should
 *  use the vDSO.
Linus Torvalds's avatar
Linus Torvalds committed
19
20
 */

21
22
#define pr_fmt(fmt) KBUILD_MODNAME ": " fmt

Linus Torvalds's avatar
Linus Torvalds committed
23
24
25
26
27
28
29
#include <linux/time.h>
#include <linux/init.h>
#include <linux/kernel.h>
#include <linux/timer.h>
#include <linux/seqlock.h>
#include <linux/jiffies.h>
#include <linux/sysctl.h>
30
#include <linux/topology.h>
31
#include <linux/timekeeper_internal.h>
32
#include <linux/getcpu.h>
33
34
35
#include <linux/cpu.h>
#include <linux/smp.h>
#include <linux/notifier.h>
36
37
#include <linux/syscalls.h>
#include <linux/ratelimit.h>
Linus Torvalds's avatar
Linus Torvalds committed
38
39
40

#include <asm/vsyscall.h>
#include <asm/pgtable.h>
41
#include <asm/compat.h>
Linus Torvalds's avatar
Linus Torvalds committed
42
#include <asm/page.h>
43
#include <asm/unistd.h>
Linus Torvalds's avatar
Linus Torvalds committed
44
45
46
#include <asm/fixmap.h>
#include <asm/errno.h>
#include <asm/io.h>
47
48
49
#include <asm/segment.h>
#include <asm/desc.h>
#include <asm/topology.h>
50
#include <asm/traps.h>
Linus Torvalds's avatar
Linus Torvalds committed
51

52
53
54
#define CREATE_TRACE_POINTS
#include "vsyscall_trace.h"

55
DEFINE_VVAR(int, vgetcpu_mode);
Linus Torvalds's avatar
Linus Torvalds committed
56

57
static enum { EMULATE, NATIVE, NONE } vsyscall_mode = EMULATE;
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77

static int __init vsyscall_setup(char *str)
{
	if (str) {
		if (!strcmp("emulate", str))
			vsyscall_mode = EMULATE;
		else if (!strcmp("native", str))
			vsyscall_mode = NATIVE;
		else if (!strcmp("none", str))
			vsyscall_mode = NONE;
		else
			return -EINVAL;

		return 0;
	}

	return -EINVAL;
}
early_param("vsyscall", vsyscall_setup);

78
79
static void warn_bad_vsyscall(const char *level, struct pt_regs *regs,
			      const char *message)
Linus Torvalds's avatar
Linus Torvalds committed
80
{
81
	if (!show_unhandled_signals)
82
		return;
Linus Torvalds's avatar
Linus Torvalds committed
83

84
85
86
87
	pr_notice_ratelimited("%s%s[%d] %s ip:%lx cs:%lx sp:%lx ax:%lx si:%lx di:%lx\n",
			      level, current->comm, task_pid_nr(current),
			      message, regs->ip, regs->cs,
			      regs->sp, regs->ax, regs->si, regs->di);
88
89
90
91
92
93
}

static int addr_to_vsyscall_nr(unsigned long addr)
{
	int nr;

94
	if ((addr & ~0xC00UL) != VSYSCALL_ADDR)
95
96
97
98
99
100
101
		return -EINVAL;

	nr = (addr & 0xC00UL) >> 10;
	if (nr >= 3)
		return -EINVAL;

	return nr;
Linus Torvalds's avatar
Linus Torvalds committed
102
103
}

104
105
106
107
108
109
110
111
112
113
114
115
116
static bool write_ok_or_segv(unsigned long ptr, size_t size)
{
	/*
	 * XXX: if access_ok, get_user, and put_user handled
	 * sig_on_uaccess_error, this could go away.
	 */

	if (!access_ok(VERIFY_WRITE, (void __user *)ptr, size)) {
		siginfo_t info;
		struct thread_struct *thread = &current->thread;

		thread->error_code	= 6;  /* user fault, no page, write */
		thread->cr2		= ptr;
117
		thread->trap_nr		= X86_TRAP_PF;
118
119
120
121
122
123
124
125
126
127
128
129
130
131

		memset(&info, 0, sizeof(info));
		info.si_signo		= SIGSEGV;
		info.si_errno		= 0;
		info.si_code		= SEGV_MAPERR;
		info.si_addr		= (void __user *)ptr;

		force_sig_info(SIGSEGV, &info, current);
		return false;
	} else {
		return true;
	}
}

132
bool emulate_vsyscall(struct pt_regs *regs, unsigned long address)
Linus Torvalds's avatar
Linus Torvalds committed
133
{
134
135
	struct task_struct *tsk;
	unsigned long caller;
136
	int vsyscall_nr, syscall_nr, tmp;
137
	int prev_sig_on_uaccess_error;
138
139
	long ret;

140
141
142
143
	/*
	 * No point in checking CS -- the only way to get here is a user mode
	 * trap to a high address, which means that we're in 64-bit user code.
	 */
144

145
	WARN_ON_ONCE(address != regs->ip);
146

147
148
149
150
	if (vsyscall_mode == NONE) {
		warn_bad_vsyscall(KERN_INFO, regs,
				  "vsyscall attempted with vsyscall=none");
		return false;
151
152
	}

153
	vsyscall_nr = addr_to_vsyscall_nr(address);
154
155
156

	trace_emulate_vsyscall(vsyscall_nr);

157
158
	if (vsyscall_nr < 0) {
		warn_bad_vsyscall(KERN_WARNING, regs,
159
				  "misaligned vsyscall (exploit attempt or buggy program) -- look up the vsyscall kernel parameter if you need a workaround");
160
161
		goto sigsegv;
	}
john stultz's avatar
john stultz committed
162

163
	if (get_user(caller, (unsigned long __user *)regs->sp) != 0) {
164
165
		warn_bad_vsyscall(KERN_WARNING, regs,
				  "vsyscall with bad stack (exploit attempt?)");
166
167
		goto sigsegv;
	}
168

169
	tsk = current;
170
171

	/*
172
173
	 * Check for access_ok violations and find the syscall nr.
	 *
174
	 * NULL is a valid user pointer (in the access_ok sense) on 32-bit and
175
	 * 64-bit, so we don't need to special-case it here.  For all the
176
	 * vsyscalls, NULL means "don't write anything" not "write it at
177
178
	 * address 0".
	 */
179
180
	switch (vsyscall_nr) {
	case 0:
181
		if (!write_ok_or_segv(regs->di, sizeof(struct timeval)) ||
182
183
184
185
		    !write_ok_or_segv(regs->si, sizeof(struct timezone))) {
			ret = -EFAULT;
			goto check_fault;
		}
186

187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
		syscall_nr = __NR_gettimeofday;
		break;

	case 1:
		if (!write_ok_or_segv(regs->di, sizeof(time_t))) {
			ret = -EFAULT;
			goto check_fault;
		}

		syscall_nr = __NR_time;
		break;

	case 2:
		if (!write_ok_or_segv(regs->di, sizeof(unsigned)) ||
		    !write_ok_or_segv(regs->si, sizeof(unsigned))) {
			ret = -EFAULT;
			goto check_fault;
		}

		syscall_nr = __NR_getcpu;
		break;
	}

	/*
	 * Handle seccomp.  regs->ip must be the original value.
	 * See seccomp_send_sigsys and Documentation/prctl/seccomp_filter.txt.
	 *
	 * We could optimize the seccomp disabled case, but performance
	 * here doesn't matter.
	 */
	regs->orig_ax = syscall_nr;
	regs->ax = -ENOSYS;
	tmp = secure_computing(syscall_nr);
	if ((!tmp && regs->orig_ax != syscall_nr) || regs->ip != address) {
		warn_bad_vsyscall(KERN_DEBUG, regs,
				  "seccomp tried to change syscall nr or ip");
		do_exit(SIGSYS);
	}
	if (tmp)
		goto do_ret;  /* skip requested */

	/*
	 * With a real vsyscall, page faults cause SIGSEGV.  We want to
	 * preserve that behavior to make writing exploits harder.
	 */
	prev_sig_on_uaccess_error = current_thread_info()->sig_on_uaccess_error;
	current_thread_info()->sig_on_uaccess_error = 1;

	ret = -EFAULT;
	switch (vsyscall_nr) {
	case 0:
238
239
240
241
242
243
244
245
246
247
248
249
		ret = sys_gettimeofday(
			(struct timeval __user *)regs->di,
			(struct timezone __user *)regs->si);
		break;

	case 1:
		ret = sys_time((time_t __user *)regs->di);
		break;

	case 2:
		ret = sys_getcpu((unsigned __user *)regs->di,
				 (unsigned __user *)regs->si,
250
				 NULL);
251
252
		break;
	}
253

254
255
	current_thread_info()->sig_on_uaccess_error = prev_sig_on_uaccess_error;

256
check_fault:
257
	if (ret == -EFAULT) {
258
		/* Bad news -- userspace fed a bad pointer to a vsyscall. */
259
260
		warn_bad_vsyscall(KERN_INFO, regs,
				  "vsyscall fault (exploit attempt?)");
261
262
263
264
265
266
267
268
269
270

		/*
		 * If we failed to generate a signal for any reason,
		 * generate one here.  (This should be impossible.)
		 */
		if (WARN_ON_ONCE(!sigismember(&tsk->pending.signal, SIGBUS) &&
				 !sigismember(&tsk->pending.signal, SIGSEGV)))
			goto sigsegv;

		return true;  /* Don't emulate the ret. */
271
	}
272

273
	regs->ax = ret;
Linus Torvalds's avatar
Linus Torvalds committed
274

275
do_ret:
276
277
278
	/* Emulate a ret instruction. */
	regs->ip = caller;
	regs->sp += 8;
279
	return true;
280
281
282

sigsegv:
	force_sig(SIGSEGV, current);
283
	return true;
Linus Torvalds's avatar
Linus Torvalds committed
284
285
}

286
287
288
289
/*
 * Assume __initcall executes before all user space. Hopefully kmod
 * doesn't violate that. We'll find out if it does.
 */
290
static void vsyscall_set_cpu(int cpu)
291
{
292
	unsigned long d;
293
294
	unsigned long node = 0;
#ifdef CONFIG_NUMA
Mike Travis's avatar
Mike Travis committed
295
	node = cpu_to_node(cpu);
296
#endif
297
	if (cpu_has(&cpu_data(cpu), X86_FEATURE_RDTSCP))
298
		write_rdtscp_aux((node << 12) | cpu);
299

300
301
302
303
	/*
	 * Store cpu number in limit so that it can be loaded quickly
	 * in user space in vgetcpu. (12 bits for the CPU and 8 bits for the node)
	 */
304
305
306
307
	d = 0x0f40000000000ULL;
	d |= cpu;
	d |= (node & 0xf) << 12;
	d |= (node >> 4) << 48;
308

309
	write_gdt_entry(get_cpu_gdt_table(cpu), GDT_ENTRY_PER_CPU, &d, DESCTYPE_S);
310
311
}

312
static void cpu_vsyscall_init(void *arg)
313
314
315
316
317
{
	/* preemption should be already off */
	vsyscall_set_cpu(raw_smp_processor_id());
}

318
static int
319
320
321
cpu_vsyscall_notifier(struct notifier_block *n, unsigned long action, void *arg)
{
	long cpu = (long)arg;
322

323
	if (action == CPU_ONLINE || action == CPU_ONLINE_FROZEN)
324
		smp_call_function_single(cpu, cpu_vsyscall_init, NULL, 1);
325

326
327
328
	return NOTIFY_DONE;
}

Ingo Molnar's avatar
Ingo Molnar committed
329
void __init map_vsyscall(void)
Linus Torvalds's avatar
Linus Torvalds committed
330
{
331
332
	extern char __vsyscall_page;
	unsigned long physaddr_vsyscall = __pa_symbol(&__vsyscall_page);
Linus Torvalds's avatar
Linus Torvalds committed
333

334
	__set_fixmap(VSYSCALL_PAGE, physaddr_vsyscall,
335
336
337
		     vsyscall_mode == NATIVE
		     ? PAGE_KERNEL_VSYSCALL
		     : PAGE_KERNEL_VVAR);
338
339
	BUILD_BUG_ON((unsigned long)__fix_to_virt(VSYSCALL_PAGE) !=
		     (unsigned long)VSYSCALL_ADDR);
Linus Torvalds's avatar
Linus Torvalds committed
340
341
342
343
}

static int __init vsyscall_init(void)
{
344
345
	cpu_notifier_register_begin();

346
	on_each_cpu(cpu_vsyscall_init, NULL, 1);
347
	/* notifier priority > KVM */
348
349
350
	__hotcpu_notifier(cpu_vsyscall_notifier, 30);

	cpu_notifier_register_done();
351

Linus Torvalds's avatar
Linus Torvalds committed
352
353
354
	return 0;
}
__initcall(vsyscall_init);