CINXE.COM
Remove syscall instructions at fixed addresses [LWN.net]
<!DOCTYPE html> <html lang="en"> <head><title>Remove syscall instructions at fixed addresses [LWN.net]</title> <meta name="viewport" content="width=device-width, initial-scale=1"> <meta HTTP-EQUIV="Content-Type" CONTENT="text/html; charset=utf-8"> <META NAME="robots" CONTENT="noai, noimageai"> <link rel="icon" href="https://static.lwn.net/images/favicon.png" type="image/png"> <link rel="alternate" type="application/rss+xml" title="LWN.net headlines" href="https://lwn.net/headlines/rss"> <link rel="stylesheet" href="/CSS/lwn"> <link rel="stylesheet" href="/CSS/nosub"> <script type="text/javascript">var p="http",d="static";if(document.location.protocol=="https:"){p+="s";d="engine";}var z=document.createElement("script");z.type="text/javascript";z.async=true;z.src=p+"://"+d+".adzerk.net/ados.js";var s=document.getElementsByTagName("script")[0];s.parentNode.insertBefore(z,s);</script> <script type="text/javascript"> var ados_keywords = ados_keywords || []; if( location.protocol=='https:' ) { ados_keywords.push('T:SSL'); } else { ados_keywords.push('T:HTTP'); } var ados = ados || {}; ados.run = ados.run || []; ados.run.push(function() { ados_add_placement(4669, 20979, "azk13321_leaderboard", 4).setZone(16026); ados_add_placement(4669, 20979, "azk93271_right_zone", [5,10,6]).setZone(16027); ados_add_placement(4669, 20979, "azk31017_tracking", 20).setZone(20995); ados_setKeywords(ados_keywords.join(', ')); ados_load(); });</script> </head> <body> <a name="t"></a> <div id="menu"><a href="/"><img src="https://static.lwn.net/images/logo/barepenguin-70.png" class="logo" border="0" alt="LWN.net Logo"> <span class="logo">LWN<br>.net</span> <span class="logobl">News from the source</span></a> <a href="/"><img src="https://static.lwn.net/images/lcorner-ss.png" class="sslogo" border="0" alt="LWN"></a><div class="navmenu-container"> <ul class="navmenu"> <li><a class="navmenu" href="#t"><b>Content</b></a><ul><li><a href="/current/">Weekly Edition</a></li><li><a href="/Archives/">Archives</a></li><li><a href="/Search/">Search</a></li><li><a href="/Kernel/">Kernel</a></li><li><a href="/Security/">Security</a></li><li><a href="/Calendar/">Events calendar</a></li><li><a href="/Comments/unread">Unread comments</a></li><li><hr></li><li><a href="/op/FAQ.lwn">LWN FAQ</a></li><li><a href="/op/AuthorGuide.lwn">Write for us</a></li></ul></li> <li><a class="navmenu" href="#t"><b>Edition</b></a><ul><li><a href="/Articles/446125/">Return to the Kernel page</a></li></ul></li> </ul></div> </div> <!-- menu --> <div class="not-handset" style="margin-left: 10.5em; display: block;"> <div class="not-print"> <div id="azk13321_leaderboard"></div> </div> </div> <div class="topnav-container"> <div class="not-handset"><form action="https://lwn.net/Login/" method="post" name="loginform" class="loginform"> <label><b>User:</b> <input type="text" name="uname" value="" size="8" id="uc" /></label> <label><b>Password:</b> <input type="password" name="pword" size="8" id="pc" /></label> <input type="hidden" name="target" value="/Articles/446220/" /> <input type="submit" name="submit" value="Log in" /></form> | <form action="https://lwn.net/subscribe/" method="post" class="loginform"> <input type="submit" name="submit" value="Subscribe" /> </form> | <form action="https://lwn.net/Login/newaccount" method="post" class="loginform"> <input type="submit" name="submit" value="Register" /> </form> </div> <div class="handset-only"> <a href="/subscribe/"><b>Subscribe</b></a> / <a href="/Login/"><b>Log in</b></a> / <a href="/Login/newaccount"><b>New account</b></a> </div> </div><div class="maincolumn flexcol"> <div class="middlecolumn"> <div class="PageHeadline"> <h1>Remove syscall instructions at fixed addresses </h1> </div> <div class="ArticleText"> <table> <tr><td valign="top"><b>From</b>:</td> <td> </td><td valign="top">Andy Lutomirski <luto@MIT.EDU> </td></tr> <tr><td valign="top"><b>To</b>:</td> <td> </td><td valign="top">Ingo Molnar <mingo@elte.hu>, x86@kernel.org </td></tr> <tr><td valign="top"><b>Subject</b>:</td> <td> </td><td valign="top">[PATCH v5 0/9] Remove syscall instructions at fixed addresses </td></tr> <tr><td valign="top"><b>Date</b>:</td> <td> </td><td valign="top">Sun, 5 Jun 2011 13:50:16 -0400</td></tr> <tr><td valign="top"><b>Message-ID</b>:</td> <td> </td><td valign="top"><cover.1307292171.git.luto@mit.edu></td></tr> <tr><td valign="top"><b>Cc</b>:</td> <td> </td><td valign="top">Thomas Gleixner <tglx@linutronix.de>, linux-kernel@vger.kernel.org, Jesper Juhl <jj@chaosbits.net>, Borislav Petkov <bp@alien8.de>, Linus Torvalds <torvalds@linux-foundation.org>, Andrew Morton <akpm@linux-foundation.org>, Arjan van de Ven <arjan@infradead.org>, Jan Beulich <JBeulich@novell.com>, richard -rw- weinberger <richard.weinberger@gmail.com>, Mikael Pettersson <mikpe@it.uu.se>, Andi Kleen <andi@firstfloor.org>, Brian Gerst <brgerst@gmail.com>, Louis Rilling <Louis.Rilling@kerlabs.com>, Valdis.Kletnieks@vt.edu, pageexec@freemail.hu, Andy Lutomirski <luto@mit.edu></td></tr> <tr><td><b>Archive‑link</b>:</td><td> </td> <td><a href="https://lore.kernel.org/all/cover.1307292171.git.luto@mit.edu/">Article</a></td></tr> </table><p> <pre> Patch 1 is just a bugfix from the last vdso series. The bug should be harmless but it's pretty dumb. This is almost certainly 3.0 material. Patch 2 adds documentation for entry_64.S. A lot of the magic in there is far from obvious. Patches 3, 4, and 5 remove a bunch of syscall instructions in kernel space at fixed addresses that user code can execute. Several are data that isn't marked NX. Patch 2 makes vvars NX and 5/10 makes the HPET NX. The time() vsyscall contains an explicit syscall fallback. Patch 3/10 removes it. At this point, there is only one explicit syscall left in the vsyscall page: the fallback case for vgettimeofday. The rest of the series is to remove it and most of the remaining vsyscall code. Patch 6 is pure cleanup. venosys (one of the four vsyscalls) has been broken for years, so patch 6 removes it. Patch 7 pads the empty parts of the vsyscall page with 0xcc. 0xcc is an explicit trap. Patch 8 removes the code implementing the vsyscalls and replaces it with magic int 0xcc incantations. These incantations are specifically designed so that jumping into them at funny offsets will either work fine or generate some kind of fault. This is a significant performance penalty (~220ns here) for all vsyscall users, but there aren't many left. Because current glibc still uses the time vsyscall (although it's fixed in glibc's git), the option CONFIG_UNSAFE_VSYSCALLS (default y) will leave time() alone. This patch is also nice because it removes a bunch of duplicated code from vsyscall_64.s. With CONFIG_UNSAFE_VSYSCALLS=y, I can boot Fedora 15 into GNOME and run Firefox without a single warning about emulated vsyscalls. Patch 9/10 randomizes the int 0xcc incantation at bootup. It is pretty much worthless for security (there are only three choices for the random number and it's easy to figure out which one is in use) but it prevents overly clever userspace programs from thinking that the incantation is ABI. One instrumentation tool author offered to hard-code special handling for int 0xcc; I want to discourage this approach. Patch 10/10 adds CONFIG_UNSAFE_VSYSCALLS to feature-removal-schedule.txt. Removing it won't break anything but it will slow some older code down. Changed from v4: - Remove int 0xcc randomization. - Make .vvar one section instead of three (and fix a typo in EMIT_VVAR). - Add a missing #ifdef CONFIG_X86_64. - Update feature removal changelog to clarify that CONFIG_UNSAFE_VSYSCALLS is new. Changes from v3: - Rebased onto tip/master (1a0c84d) Changes from v2: - Reordered the patches. - Removed the option to leave gettimeofday and getcpu as native code. - Clean up the int 0xcc handler and registration. - sched_getcpu works now (thanks, Borislav, for catching my blatant arithmetic error). - Numerous small fixes from review comments. - Abandon my plan to spread turbostat to the masses. Changes from v1: - Patches 6-10 are new. - The int 0xcc code is much prettier and has lots of bugs fixed. - I've decided to let everyone compile turbostat on their own :) Andy Lutomirski (9): x86-64: Fix alignment of jiffies variable x86-64: Document some of entry_64.S x86-64: Give vvars their own page x86-64: Remove kernel.vsyscall64 sysctl x86-64: Map the HPET NX x86-64: Remove vsyscall number 3 (venosys) x86-64: Fill unused parts of the vsyscall page with 0xcc x86-64: Emulate legacy vsyscalls x86-64: Add CONFIG_UNSAFE_VSYSCALLS to feature-removal-schedule Documentation/feature-removal-schedule.txt | 9 + Documentation/x86/entry_64.txt | 98 ++++++++++ arch/x86/Kconfig | 17 ++ arch/x86/include/asm/fixmap.h | 1 + arch/x86/include/asm/irq_vectors.h | 6 +- arch/x86/include/asm/pgtable_types.h | 6 +- arch/x86/include/asm/traps.h | 4 + arch/x86/include/asm/vgtod.h | 1 - arch/x86/include/asm/vsyscall.h | 6 + arch/x86/include/asm/vvar.h | 24 +-- arch/x86/kernel/Makefile | 1 + arch/x86/kernel/entry_64.S | 4 + arch/x86/kernel/hpet.c | 2 +- arch/x86/kernel/traps.c | 6 + arch/x86/kernel/vmlinux.lds.S | 48 +++--- arch/x86/kernel/vsyscall_64.c | 289 +++++++++++++++------------- arch/x86/kernel/vsyscall_emu_64.S | 42 ++++ arch/x86/vdso/vclock_gettime.c | 55 ++---- 18 files changed, 407 insertions(+), 212 deletions(-) create mode 100644 Documentation/x86/entry_64.txt create mode 100644 arch/x86/kernel/vsyscall_emu_64.S -- 1.7.5.2 -- To unsubscribe from this list: send the line "unsubscribe linux-kernel" in the body of a message to majordomo@vger.kernel.org More majordomo info at <a href="http://vger.kernel.org/majordomo-info.html">http://vger.kernel.org/majordomo-info.html</a> Please read the FAQ at <a href="http://www.tux.org/lkml/">http://www.tux.org/lkml/</a> </pre> </div> <!-- ArticleText --> </div> <!-- middlecolumn --> <div class="rightcol not-print"> <div id="azk93271_right_zone"></div> </div> </div> <!-- maincolumn --> <br clear="all"> <center> <P> <span class="ReallySmall"> Copyright © 2011, Eklektix, Inc.<BR> Comments and public postings are copyrighted by their creators.<br> Linux is a registered trademark of Linus Torvalds<br> </span> </center> </body></html>