433 lines
15 KiB
C++
433 lines
15 KiB
C++
// Copyright (c) 2012 The Chromium Authors. All rights reserved.
|
|
// Use of this source code is governed by a BSD-style license that can be
|
|
// found in the LICENSE file.
|
|
|
|
#include "sandbox/linux/seccomp-bpf/syscall.h"
|
|
|
|
#include <errno.h>
|
|
#include <stdint.h>
|
|
|
|
#include "base/logging.h"
|
|
#include "sandbox/linux/bpf_dsl/seccomp_macros.h"
|
|
|
|
namespace sandbox {
|
|
|
|
namespace {
|
|
|
|
#if defined(ARCH_CPU_X86_FAMILY) || defined(ARCH_CPU_ARM_FAMILY) || \
|
|
defined(ARCH_CPU_MIPS_FAMILY)
|
|
// Number that's not currently used by any Linux kernel ABIs.
|
|
const int kInvalidSyscallNumber = 0x351d3;
|
|
#else
|
|
#error Unrecognized architecture
|
|
#endif
|
|
|
|
asm(// We need to be able to tell the kernel exactly where we made a
|
|
// system call. The C++ compiler likes to sometimes clone or
|
|
// inline code, which would inadvertently end up duplicating
|
|
// the entry point.
|
|
// "gcc" can suppress code duplication with suitable function
|
|
// attributes, but "clang" doesn't have this ability.
|
|
// The "clang" developer mailing list suggested that the correct
|
|
// and portable solution is a file-scope assembly block.
|
|
// N.B. We do mark our code as a proper function so that backtraces
|
|
// work correctly. But we make absolutely no attempt to use the
|
|
// ABI's calling conventions for passing arguments. We will only
|
|
// ever be called from assembly code and thus can pick more
|
|
// suitable calling conventions.
|
|
#if defined(__i386__)
|
|
".text\n"
|
|
".align 16, 0x90\n"
|
|
".type SyscallAsm, @function\n"
|
|
"SyscallAsm:.cfi_startproc\n"
|
|
// Check if "%eax" is negative. If so, do not attempt to make a
|
|
// system call. Instead, compute the return address that is visible
|
|
// to the kernel after we execute "int $0x80". This address can be
|
|
// used as a marker that BPF code inspects.
|
|
"test %eax, %eax\n"
|
|
"jge 1f\n"
|
|
// Always, make sure that our code is position-independent, or
|
|
// address space randomization might not work on i386. This means,
|
|
// we can't use "lea", but instead have to rely on "call/pop".
|
|
"call 0f; .cfi_adjust_cfa_offset 4\n"
|
|
"0:pop %eax; .cfi_adjust_cfa_offset -4\n"
|
|
"addl $2f-0b, %eax\n"
|
|
"ret\n"
|
|
// Save register that we don't want to clobber. On i386, we need to
|
|
// save relatively aggressively, as there are a couple or registers
|
|
// that are used internally (e.g. %ebx for position-independent
|
|
// code, and %ebp for the frame pointer), and as we need to keep at
|
|
// least a few registers available for the register allocator.
|
|
"1:push %esi; .cfi_adjust_cfa_offset 4; .cfi_rel_offset esi, 0\n"
|
|
"push %edi; .cfi_adjust_cfa_offset 4; .cfi_rel_offset edi, 0\n"
|
|
"push %ebx; .cfi_adjust_cfa_offset 4; .cfi_rel_offset ebx, 0\n"
|
|
"push %ebp; .cfi_adjust_cfa_offset 4; .cfi_rel_offset ebp, 0\n"
|
|
// Copy entries from the array holding the arguments into the
|
|
// correct CPU registers.
|
|
"movl 0(%edi), %ebx\n"
|
|
"movl 4(%edi), %ecx\n"
|
|
"movl 8(%edi), %edx\n"
|
|
"movl 12(%edi), %esi\n"
|
|
"movl 20(%edi), %ebp\n"
|
|
"movl 16(%edi), %edi\n"
|
|
// Enter the kernel.
|
|
"int $0x80\n"
|
|
// This is our "magic" return address that the BPF filter sees.
|
|
"2:"
|
|
// Restore any clobbered registers that we didn't declare to the
|
|
// compiler.
|
|
"pop %ebp; .cfi_restore ebp; .cfi_adjust_cfa_offset -4\n"
|
|
"pop %ebx; .cfi_restore ebx; .cfi_adjust_cfa_offset -4\n"
|
|
"pop %edi; .cfi_restore edi; .cfi_adjust_cfa_offset -4\n"
|
|
"pop %esi; .cfi_restore esi; .cfi_adjust_cfa_offset -4\n"
|
|
"ret\n"
|
|
".cfi_endproc\n"
|
|
"9:.size SyscallAsm, 9b-SyscallAsm\n"
|
|
#elif defined(__x86_64__)
|
|
".text\n"
|
|
".align 16, 0x90\n"
|
|
".type SyscallAsm, @function\n"
|
|
"SyscallAsm:.cfi_startproc\n"
|
|
// Check if "%rdi" is negative. If so, do not attempt to make a
|
|
// system call. Instead, compute the return address that is visible
|
|
// to the kernel after we execute "syscall". This address can be
|
|
// used as a marker that BPF code inspects.
|
|
"test %rdi, %rdi\n"
|
|
"jge 1f\n"
|
|
// Always make sure that our code is position-independent, or the
|
|
// linker will throw a hissy fit on x86-64.
|
|
"lea 2f(%rip), %rax\n"
|
|
"ret\n"
|
|
// Now we load the registers used to pass arguments to the system
|
|
// call: system call number in %rax, and arguments in %rdi, %rsi,
|
|
// %rdx, %r10, %r8, %r9. Note: These are all caller-save registers
|
|
// (only %rbx, %rbp, %rsp, and %r12-%r15 are callee-save), so no
|
|
// need to worry here about spilling registers or CFI directives.
|
|
"1:movq %rdi, %rax\n"
|
|
"movq 0(%rsi), %rdi\n"
|
|
"movq 16(%rsi), %rdx\n"
|
|
"movq 24(%rsi), %r10\n"
|
|
"movq 32(%rsi), %r8\n"
|
|
"movq 40(%rsi), %r9\n"
|
|
"movq 8(%rsi), %rsi\n"
|
|
// Enter the kernel.
|
|
"syscall\n"
|
|
// This is our "magic" return address that the BPF filter sees.
|
|
"2:ret\n"
|
|
".cfi_endproc\n"
|
|
"9:.size SyscallAsm, 9b-SyscallAsm\n"
|
|
#elif defined(__arm__)
|
|
// Throughout this file, we use the same mode (ARM vs. thumb)
|
|
// that the C++ compiler uses. This means, when transfering control
|
|
// from C++ to assembly code, we do not need to switch modes (e.g.
|
|
// by using the "bx" instruction). It also means that our assembly
|
|
// code should not be invoked directly from code that lives in
|
|
// other compilation units, as we don't bother implementing thumb
|
|
// interworking. That's OK, as we don't make any of the assembly
|
|
// symbols public. They are all local to this file.
|
|
".text\n"
|
|
".align 2\n"
|
|
".type SyscallAsm, %function\n"
|
|
#if defined(__thumb__)
|
|
".thumb_func\n"
|
|
#else
|
|
".arm\n"
|
|
#endif
|
|
"SyscallAsm:\n"
|
|
#if !defined(__native_client_nonsfi__)
|
|
// .fnstart and .fnend pseudo operations creates unwind table.
|
|
// It also creates a reference to the symbol __aeabi_unwind_cpp_pr0, which
|
|
// is not provided by PNaCl toolchain. Disable it.
|
|
".fnstart\n"
|
|
#endif
|
|
"@ args = 0, pretend = 0, frame = 8\n"
|
|
"@ frame_needed = 1, uses_anonymous_args = 0\n"
|
|
#if defined(__thumb__)
|
|
".cfi_startproc\n"
|
|
"push {r7, lr}\n"
|
|
".save {r7, lr}\n"
|
|
".cfi_offset 14, -4\n"
|
|
".cfi_offset 7, -8\n"
|
|
".cfi_def_cfa_offset 8\n"
|
|
#else
|
|
"stmfd sp!, {fp, lr}\n"
|
|
"add fp, sp, #4\n"
|
|
#endif
|
|
// Check if "r0" is negative. If so, do not attempt to make a
|
|
// system call. Instead, compute the return address that is visible
|
|
// to the kernel after we execute "swi 0". This address can be
|
|
// used as a marker that BPF code inspects.
|
|
"cmp r0, #0\n"
|
|
"bge 1f\n"
|
|
"adr r0, 2f\n"
|
|
"b 2f\n"
|
|
// We declared (almost) all clobbered registers to the compiler. On
|
|
// ARM there is no particular register pressure. So, we can go
|
|
// ahead and directly copy the entries from the arguments array
|
|
// into the appropriate CPU registers.
|
|
"1:ldr r5, [r6, #20]\n"
|
|
"ldr r4, [r6, #16]\n"
|
|
"ldr r3, [r6, #12]\n"
|
|
"ldr r2, [r6, #8]\n"
|
|
"ldr r1, [r6, #4]\n"
|
|
"mov r7, r0\n"
|
|
"ldr r0, [r6, #0]\n"
|
|
// Enter the kernel
|
|
"swi 0\n"
|
|
// Restore the frame pointer. Also restore the program counter from
|
|
// the link register; this makes us return to the caller.
|
|
#if defined(__thumb__)
|
|
"2:pop {r7, pc}\n"
|
|
".cfi_endproc\n"
|
|
#else
|
|
"2:ldmfd sp!, {fp, pc}\n"
|
|
#endif
|
|
#if !defined(__native_client_nonsfi__)
|
|
// Do not use .fnstart and .fnend for PNaCl toolchain. See above comment,
|
|
// for more details.
|
|
".fnend\n"
|
|
#endif
|
|
"9:.size SyscallAsm, 9b-SyscallAsm\n"
|
|
#elif defined(__mips__)
|
|
".text\n"
|
|
".option pic2\n"
|
|
".align 4\n"
|
|
".global SyscallAsm\n"
|
|
".type SyscallAsm, @function\n"
|
|
"SyscallAsm:.ent SyscallAsm\n"
|
|
".frame $sp, 40, $ra\n"
|
|
".set push\n"
|
|
".set noreorder\n"
|
|
".cpload $t9\n"
|
|
"addiu $sp, $sp, -40\n"
|
|
"sw $ra, 36($sp)\n"
|
|
// Check if "v0" is negative. If so, do not attempt to make a
|
|
// system call. Instead, compute the return address that is visible
|
|
// to the kernel after we execute "syscall". This address can be
|
|
// used as a marker that BPF code inspects.
|
|
"bgez $v0, 1f\n"
|
|
" nop\n"
|
|
// This is equivalent to "la $v0, 2f".
|
|
// LA macro has to be avoided since LLVM-AS has issue with LA in PIC mode
|
|
// https://llvm.org/bugs/show_bug.cgi?id=27644
|
|
"lw $v0, %got(2f)($gp)\n"
|
|
"addiu $v0, $v0, %lo(2f)\n"
|
|
"b 2f\n"
|
|
" nop\n"
|
|
// On MIPS first four arguments go to registers a0 - a3 and any
|
|
// argument after that goes to stack. We can go ahead and directly
|
|
// copy the entries from the arguments array into the appropriate
|
|
// CPU registers and on the stack.
|
|
"1:lw $a3, 28($a0)\n"
|
|
"lw $a2, 24($a0)\n"
|
|
"lw $a1, 20($a0)\n"
|
|
"lw $t0, 16($a0)\n"
|
|
"sw $a3, 28($sp)\n"
|
|
"sw $a2, 24($sp)\n"
|
|
"sw $a1, 20($sp)\n"
|
|
"sw $t0, 16($sp)\n"
|
|
"lw $a3, 12($a0)\n"
|
|
"lw $a2, 8($a0)\n"
|
|
"lw $a1, 4($a0)\n"
|
|
"lw $a0, 0($a0)\n"
|
|
// Enter the kernel
|
|
"syscall\n"
|
|
// This is our "magic" return address that the BPF filter sees.
|
|
// Restore the return address from the stack.
|
|
"2:lw $ra, 36($sp)\n"
|
|
"jr $ra\n"
|
|
" addiu $sp, $sp, 40\n"
|
|
".set pop\n"
|
|
".end SyscallAsm\n"
|
|
".size SyscallAsm,.-SyscallAsm\n"
|
|
#elif defined(__aarch64__)
|
|
".text\n"
|
|
".align 2\n"
|
|
".type SyscallAsm, %function\n"
|
|
"SyscallAsm:\n"
|
|
".cfi_startproc\n"
|
|
"cmp x0, #0\n"
|
|
"b.ge 1f\n"
|
|
"adr x0,2f\n"
|
|
"b 2f\n"
|
|
"1:ldr x5, [x6, #40]\n"
|
|
"ldr x4, [x6, #32]\n"
|
|
"ldr x3, [x6, #24]\n"
|
|
"ldr x2, [x6, #16]\n"
|
|
"ldr x1, [x6, #8]\n"
|
|
"mov x8, x0\n"
|
|
"ldr x0, [x6, #0]\n"
|
|
// Enter the kernel
|
|
"svc 0\n"
|
|
"2:ret\n"
|
|
".cfi_endproc\n"
|
|
".size SyscallAsm, .-SyscallAsm\n"
|
|
#endif
|
|
); // asm
|
|
|
|
#if defined(__x86_64__)
|
|
extern "C" {
|
|
intptr_t SyscallAsm(intptr_t nr, const intptr_t args[6]);
|
|
}
|
|
#elif defined(__mips__)
|
|
extern "C" {
|
|
intptr_t SyscallAsm(intptr_t nr, const intptr_t args[8]);
|
|
}
|
|
#endif
|
|
|
|
} // namespace
|
|
|
|
intptr_t Syscall::InvalidCall() {
|
|
// Explicitly pass eight zero arguments just in case.
|
|
return Call(kInvalidSyscallNumber, 0, 0, 0, 0, 0, 0, 0, 0);
|
|
}
|
|
|
|
intptr_t Syscall::Call(int nr,
|
|
intptr_t p0,
|
|
intptr_t p1,
|
|
intptr_t p2,
|
|
intptr_t p3,
|
|
intptr_t p4,
|
|
intptr_t p5,
|
|
intptr_t p6,
|
|
intptr_t p7) {
|
|
// We rely on "intptr_t" to be the exact size as a "void *". This is
|
|
// typically true, but just in case, we add a check. The language
|
|
// specification allows platforms some leeway in cases, where
|
|
// "sizeof(void *)" is not the same as "sizeof(void (*)())". We expect
|
|
// that this would only be an issue for IA64, which we are currently not
|
|
// planning on supporting. And it is even possible that this would work
|
|
// on IA64, but for lack of actual hardware, I cannot test.
|
|
static_assert(sizeof(void*) == sizeof(intptr_t),
|
|
"pointer types and intptr_t must be exactly the same size");
|
|
|
|
// TODO(nedeljko): Enable use of more than six parameters on architectures
|
|
// where that makes sense.
|
|
#if defined(__mips__)
|
|
const intptr_t args[8] = {p0, p1, p2, p3, p4, p5, p6, p7};
|
|
#else
|
|
DCHECK_EQ(p6, 0) << " Support for syscalls with more than six arguments not "
|
|
"added for this architecture";
|
|
DCHECK_EQ(p7, 0) << " Support for syscalls with more than six arguments not "
|
|
"added for this architecture";
|
|
const intptr_t args[6] = {p0, p1, p2, p3, p4, p5};
|
|
#endif // defined(__mips__)
|
|
|
|
// Invoke our file-scope assembly code. The constraints have been picked
|
|
// carefully to match what the rest of the assembly code expects in input,
|
|
// output, and clobbered registers.
|
|
#if defined(__i386__)
|
|
intptr_t ret = nr;
|
|
asm volatile(
|
|
"call SyscallAsm\n"
|
|
// N.B. These are not the calling conventions normally used by the ABI.
|
|
: "=a"(ret)
|
|
: "0"(ret), "D"(args)
|
|
: "cc", "esp", "memory", "ecx", "edx");
|
|
#elif defined(__x86_64__)
|
|
intptr_t ret = SyscallAsm(nr, args);
|
|
#elif defined(__arm__)
|
|
intptr_t ret;
|
|
{
|
|
register intptr_t inout __asm__("r0") = nr;
|
|
register const intptr_t* data __asm__("r6") = args;
|
|
asm volatile(
|
|
"bl SyscallAsm\n"
|
|
// N.B. These are not the calling conventions normally used by the ABI.
|
|
: "=r"(inout)
|
|
: "0"(inout), "r"(data)
|
|
: "cc",
|
|
"lr",
|
|
"memory",
|
|
"r1",
|
|
"r2",
|
|
"r3",
|
|
"r4",
|
|
"r5"
|
|
#if !defined(__thumb__)
|
|
// In thumb mode, we cannot use "r7" as a general purpose register, as
|
|
// it is our frame pointer. We have to manually manage and preserve
|
|
// it.
|
|
// In ARM mode, we have a dedicated frame pointer register and "r7" is
|
|
// thus available as a general purpose register. We don't preserve it,
|
|
// but instead mark it as clobbered.
|
|
,
|
|
"r7"
|
|
#endif // !defined(__thumb__)
|
|
);
|
|
ret = inout;
|
|
}
|
|
#elif defined(__mips__)
|
|
int err_status;
|
|
intptr_t ret = Syscall::SandboxSyscallRaw(nr, args, &err_status);
|
|
|
|
if (err_status) {
|
|
// On error, MIPS returns errno from syscall instead of -errno.
|
|
// The purpose of this negation is for SandboxSyscall() to behave
|
|
// more like it would on other architectures.
|
|
ret = -ret;
|
|
}
|
|
#elif defined(__aarch64__)
|
|
intptr_t ret;
|
|
{
|
|
register intptr_t inout __asm__("x0") = nr;
|
|
register const intptr_t* data __asm__("x6") = args;
|
|
asm volatile("bl SyscallAsm\n"
|
|
: "=r"(inout)
|
|
: "0"(inout), "r"(data)
|
|
: "memory", "x1", "x2", "x3", "x4", "x5", "x8", "x30");
|
|
ret = inout;
|
|
}
|
|
|
|
#else
|
|
#error "Unimplemented architecture"
|
|
#endif
|
|
return ret;
|
|
}
|
|
|
|
void Syscall::PutValueInUcontext(intptr_t ret_val, ucontext_t* ctx) {
|
|
#if defined(__mips__)
|
|
// Mips ABI states that on error a3 CPU register has non zero value and if
|
|
// there is no error, it should be zero.
|
|
if (ret_val <= -1 && ret_val >= -4095) {
|
|
// |ret_val| followes the Syscall::Call() convention of being -errno on
|
|
// errors. In order to write correct value to return register this sign
|
|
// needs to be changed back.
|
|
ret_val = -ret_val;
|
|
SECCOMP_PARM4(ctx) = 1;
|
|
} else
|
|
SECCOMP_PARM4(ctx) = 0;
|
|
#endif
|
|
SECCOMP_RESULT(ctx) = static_cast<greg_t>(ret_val);
|
|
}
|
|
|
|
#if defined(__mips__)
|
|
intptr_t Syscall::SandboxSyscallRaw(int nr,
|
|
const intptr_t* args,
|
|
intptr_t* err_ret) {
|
|
register intptr_t ret __asm__("v0") = nr;
|
|
register intptr_t syscallasm __asm__("t9") = (intptr_t) &SyscallAsm;
|
|
// a3 register becomes non zero on error.
|
|
register intptr_t err_stat __asm__("a3") = 0;
|
|
{
|
|
register const intptr_t* data __asm__("a0") = args;
|
|
asm volatile(
|
|
"jalr $t9\n"
|
|
" nop\n"
|
|
: "=r"(ret), "=r"(err_stat)
|
|
: "0"(ret),
|
|
"r"(data),
|
|
"r"(syscallasm)
|
|
// a2 is in the clober list so inline assembly can not change its
|
|
// value.
|
|
: "memory", "ra", "a2");
|
|
}
|
|
|
|
// Set an error status so it can be used outside of this function
|
|
*err_ret = err_stat;
|
|
|
|
return ret;
|
|
}
|
|
#endif // defined(__mips__)
|
|
|
|
} // namespace sandbox
|