perf/x86/intel/uncore: Fix SNB-EP/IVT Cbox filter mappings
[deliverable/linux.git] / arch / x86 / kernel / vsyscall_64.c
CommitLineData
1da177e4 1/*
1da177e4
LT
2 * Copyright (C) 2001 Andrea Arcangeli <andrea@suse.de> SuSE
3 * Copyright 2003 Andi Kleen, SuSE Labs.
4 *
5cec93c2
AL
5 * [ NOTE: this mechanism is now deprecated in favor of the vDSO. ]
6 *
1da177e4
LT
7 * Thanks to hpa@transmeta.com for some useful hint.
8 * Special thanks to Ingo Molnar for his early experience with
9 * a different vsyscall implementation for Linux/IA32 and for the name.
10 *
11 * vsyscall 1 is located at -10Mbyte, vsyscall 2 is located
12 * at virtual address -10Mbyte+1024bytes etc... There are at max 4
13 * vsyscalls. One vsyscall can reserve more than 1 slot to avoid
14 * jumping out of line if necessary. We cannot add more with this
15 * mechanism because older kernels won't return -ENOSYS.
1da177e4 16 *
5cec93c2
AL
17 * Note: the concept clashes with user mode linux. UML users should
18 * use the vDSO.
1da177e4
LT
19 */
20
c767a54b
JP
21#define pr_fmt(fmt) KBUILD_MODNAME ": " fmt
22
1da177e4
LT
23#include <linux/time.h>
24#include <linux/init.h>
25#include <linux/kernel.h>
26#include <linux/timer.h>
27#include <linux/seqlock.h>
28#include <linux/jiffies.h>
29#include <linux/sysctl.h>
29574022 30#include <linux/topology.h>
189374ae 31#include <linux/timekeeper_internal.h>
c08c8205 32#include <linux/getcpu.h>
8c131af1
AK
33#include <linux/cpu.h>
34#include <linux/smp.h>
35#include <linux/notifier.h>
5cec93c2
AL
36#include <linux/syscalls.h>
37#include <linux/ratelimit.h>
1da177e4
LT
38
39#include <asm/vsyscall.h>
40#include <asm/pgtable.h>
c9712944 41#include <asm/compat.h>
1da177e4 42#include <asm/page.h>
7460ed28 43#include <asm/unistd.h>
1da177e4
LT
44#include <asm/fixmap.h>
45#include <asm/errno.h>
46#include <asm/io.h>
c08c8205
VP
47#include <asm/segment.h>
48#include <asm/desc.h>
49#include <asm/topology.h>
5cec93c2 50#include <asm/traps.h>
1da177e4 51
c149a665
AL
52#define CREATE_TRACE_POINTS
53#include "vsyscall_trace.h"
54
8c49d9a7 55DEFINE_VVAR(int, vgetcpu_mode);
1da177e4 56
2e57ae05 57static enum { EMULATE, NATIVE, NONE } vsyscall_mode = EMULATE;
3ae36655
AL
58
59static int __init vsyscall_setup(char *str)
60{
61 if (str) {
62 if (!strcmp("emulate", str))
63 vsyscall_mode = EMULATE;
64 else if (!strcmp("native", str))
65 vsyscall_mode = NATIVE;
66 else if (!strcmp("none", str))
67 vsyscall_mode = NONE;
68 else
69 return -EINVAL;
70
71 return 0;
72 }
73
74 return -EINVAL;
75}
76early_param("vsyscall", vsyscall_setup);
77
5cec93c2
AL
78static void warn_bad_vsyscall(const char *level, struct pt_regs *regs,
79 const char *message)
1da177e4 80{
c767a54b 81 if (!show_unhandled_signals)
5cec93c2 82 return;
1da177e4 83
c767a54b
JP
84 pr_notice_ratelimited("%s%s[%d] %s ip:%lx cs:%lx sp:%lx ax:%lx si:%lx di:%lx\n",
85 level, current->comm, task_pid_nr(current),
86 message, regs->ip, regs->cs,
87 regs->sp, regs->ax, regs->si, regs->di);
c9712944
AL
88}
89
90static int addr_to_vsyscall_nr(unsigned long addr)
91{
92 int nr;
93
f40c3300 94 if ((addr & ~0xC00UL) != VSYSCALL_ADDR)
c9712944
AL
95 return -EINVAL;
96
97 nr = (addr & 0xC00UL) >> 10;
98 if (nr >= 3)
99 return -EINVAL;
100
101 return nr;
1da177e4
LT
102}
103
4fc34901
AL
104static bool write_ok_or_segv(unsigned long ptr, size_t size)
105{
106 /*
107 * XXX: if access_ok, get_user, and put_user handled
108 * sig_on_uaccess_error, this could go away.
109 */
110
111 if (!access_ok(VERIFY_WRITE, (void __user *)ptr, size)) {
112 siginfo_t info;
113 struct thread_struct *thread = &current->thread;
114
115 thread->error_code = 6; /* user fault, no page, write */
116 thread->cr2 = ptr;
51e7dc70 117 thread->trap_nr = X86_TRAP_PF;
4fc34901
AL
118
119 memset(&info, 0, sizeof(info));
120 info.si_signo = SIGSEGV;
121 info.si_errno = 0;
122 info.si_code = SEGV_MAPERR;
123 info.si_addr = (void __user *)ptr;
124
125 force_sig_info(SIGSEGV, &info, current);
126 return false;
127 } else {
128 return true;
129 }
130}
131
3ae36655 132bool emulate_vsyscall(struct pt_regs *regs, unsigned long address)
1da177e4 133{
5cec93c2
AL
134 struct task_struct *tsk;
135 unsigned long caller;
87b526d3 136 int vsyscall_nr, syscall_nr, tmp;
4fc34901 137 int prev_sig_on_uaccess_error;
5cec93c2
AL
138 long ret;
139
3ae36655
AL
140 /*
141 * No point in checking CS -- the only way to get here is a user mode
142 * trap to a high address, which means that we're in 64-bit user code.
143 */
5cec93c2 144
3ae36655 145 WARN_ON_ONCE(address != regs->ip);
c9712944 146
3ae36655
AL
147 if (vsyscall_mode == NONE) {
148 warn_bad_vsyscall(KERN_INFO, regs,
149 "vsyscall attempted with vsyscall=none");
150 return false;
c9712944
AL
151 }
152
3ae36655 153 vsyscall_nr = addr_to_vsyscall_nr(address);
c149a665
AL
154
155 trace_emulate_vsyscall(vsyscall_nr);
156
c9712944
AL
157 if (vsyscall_nr < 0) {
158 warn_bad_vsyscall(KERN_WARNING, regs,
3ae36655 159 "misaligned vsyscall (exploit attempt or buggy program) -- look up the vsyscall kernel parameter if you need a workaround");
5cec93c2
AL
160 goto sigsegv;
161 }
d0aff6e6 162
5cec93c2 163 if (get_user(caller, (unsigned long __user *)regs->sp) != 0) {
3ae36655
AL
164 warn_bad_vsyscall(KERN_WARNING, regs,
165 "vsyscall with bad stack (exploit attempt?)");
5cec93c2
AL
166 goto sigsegv;
167 }
8c73626a 168
5cec93c2 169 tsk = current;
4fc34901
AL
170
171 /*
87b526d3
AL
172 * Check for access_ok violations and find the syscall nr.
173 *
46ed99d1 174 * NULL is a valid user pointer (in the access_ok sense) on 32-bit and
4fc34901 175 * 64-bit, so we don't need to special-case it here. For all the
46ed99d1 176 * vsyscalls, NULL means "don't write anything" not "write it at
4fc34901
AL
177 * address 0".
178 */
5cec93c2
AL
179 switch (vsyscall_nr) {
180 case 0:
4fc34901 181 if (!write_ok_or_segv(regs->di, sizeof(struct timeval)) ||
87b526d3
AL
182 !write_ok_or_segv(regs->si, sizeof(struct timezone))) {
183 ret = -EFAULT;
184 goto check_fault;
185 }
4fc34901 186
87b526d3
AL
187 syscall_nr = __NR_gettimeofday;
188 break;
189
190 case 1:
191 if (!write_ok_or_segv(regs->di, sizeof(time_t))) {
192 ret = -EFAULT;
193 goto check_fault;
194 }
195
196 syscall_nr = __NR_time;
197 break;
198
199 case 2:
200 if (!write_ok_or_segv(regs->di, sizeof(unsigned)) ||
201 !write_ok_or_segv(regs->si, sizeof(unsigned))) {
202 ret = -EFAULT;
203 goto check_fault;
204 }
205
206 syscall_nr = __NR_getcpu;
207 break;
208 }
209
210 /*
211 * Handle seccomp. regs->ip must be the original value.
212 * See seccomp_send_sigsys and Documentation/prctl/seccomp_filter.txt.
213 *
214 * We could optimize the seccomp disabled case, but performance
215 * here doesn't matter.
216 */
217 regs->orig_ax = syscall_nr;
218 regs->ax = -ENOSYS;
219 tmp = secure_computing(syscall_nr);
220 if ((!tmp && regs->orig_ax != syscall_nr) || regs->ip != address) {
221 warn_bad_vsyscall(KERN_DEBUG, regs,
222 "seccomp tried to change syscall nr or ip");
223 do_exit(SIGSYS);
224 }
225 if (tmp)
226 goto do_ret; /* skip requested */
227
228 /*
229 * With a real vsyscall, page faults cause SIGSEGV. We want to
230 * preserve that behavior to make writing exploits harder.
231 */
232 prev_sig_on_uaccess_error = current_thread_info()->sig_on_uaccess_error;
233 current_thread_info()->sig_on_uaccess_error = 1;
234
235 ret = -EFAULT;
236 switch (vsyscall_nr) {
237 case 0:
5cec93c2
AL
238 ret = sys_gettimeofday(
239 (struct timeval __user *)regs->di,
240 (struct timezone __user *)regs->si);
241 break;
242
243 case 1:
5cec93c2
AL
244 ret = sys_time((time_t __user *)regs->di);
245 break;
246
247 case 2:
5cec93c2
AL
248 ret = sys_getcpu((unsigned __user *)regs->di,
249 (unsigned __user *)regs->si,
46ed99d1 250 NULL);
5cec93c2 251 break;
5cec93c2 252 }
8c73626a 253
4fc34901
AL
254 current_thread_info()->sig_on_uaccess_error = prev_sig_on_uaccess_error;
255
87b526d3 256check_fault:
5cec93c2 257 if (ret == -EFAULT) {
4fc34901 258 /* Bad news -- userspace fed a bad pointer to a vsyscall. */
5cec93c2
AL
259 warn_bad_vsyscall(KERN_INFO, regs,
260 "vsyscall fault (exploit attempt?)");
4fc34901
AL
261
262 /*
263 * If we failed to generate a signal for any reason,
264 * generate one here. (This should be impossible.)
265 */
266 if (WARN_ON_ONCE(!sigismember(&tsk->pending.signal, SIGBUS) &&
267 !sigismember(&tsk->pending.signal, SIGSEGV)))
268 goto sigsegv;
269
270 return true; /* Don't emulate the ret. */
5cec93c2 271 }
8c73626a 272
5cec93c2 273 regs->ax = ret;
1da177e4 274
5651721e 275do_ret:
5cec93c2
AL
276 /* Emulate a ret instruction. */
277 regs->ip = caller;
278 regs->sp += 8;
3ae36655 279 return true;
5cec93c2
AL
280
281sigsegv:
5cec93c2 282 force_sig(SIGSEGV, current);
3ae36655 283 return true;
1da177e4
LT
284}
285
5cec93c2
AL
286/*
287 * Assume __initcall executes before all user space. Hopefully kmod
288 * doesn't violate that. We'll find out if it does.
289 */
148f9bb8 290static void vsyscall_set_cpu(int cpu)
c08c8205 291{
fc8b8a60 292 unsigned long d;
c08c8205
VP
293 unsigned long node = 0;
294#ifdef CONFIG_NUMA
98c9e27a 295 node = cpu_to_node(cpu);
c08c8205 296#endif
92cb7612 297 if (cpu_has(&cpu_data(cpu), X86_FEATURE_RDTSCP))
8c131af1 298 write_rdtscp_aux((node << 12) | cpu);
c08c8205 299
5cec93c2
AL
300 /*
301 * Store cpu number in limit so that it can be loaded quickly
302 * in user space in vgetcpu. (12 bits for the CPU and 8 bits for the node)
303 */
fc8b8a60
JF
304 d = 0x0f40000000000ULL;
305 d |= cpu;
306 d |= (node & 0xf) << 12;
307 d |= (node >> 4) << 48;
5cec93c2 308
fc8b8a60 309 write_gdt_entry(get_cpu_gdt_table(cpu), GDT_ENTRY_PER_CPU, &d, DESCTYPE_S);
c08c8205
VP
310}
311
148f9bb8 312static void cpu_vsyscall_init(void *arg)
8c131af1
AK
313{
314 /* preemption should be already off */
315 vsyscall_set_cpu(raw_smp_processor_id());
316}
317
148f9bb8 318static int
8c131af1
AK
319cpu_vsyscall_notifier(struct notifier_block *n, unsigned long action, void *arg)
320{
321 long cpu = (long)arg;
5cec93c2 322
8bb78442 323 if (action == CPU_ONLINE || action == CPU_ONLINE_FROZEN)
8691e5a8 324 smp_call_function_single(cpu, cpu_vsyscall_init, NULL, 1);
5cec93c2 325
8c131af1
AK
326 return NOTIFY_DONE;
327}
328
e4026440 329void __init map_vsyscall(void)
1da177e4 330{
3ae36655
AL
331 extern char __vsyscall_page;
332 unsigned long physaddr_vsyscall = __pa_symbol(&__vsyscall_page);
1da177e4 333
f40c3300 334 __set_fixmap(VSYSCALL_PAGE, physaddr_vsyscall,
3ae36655
AL
335 vsyscall_mode == NATIVE
336 ? PAGE_KERNEL_VSYSCALL
337 : PAGE_KERNEL_VVAR);
f40c3300
AL
338 BUILD_BUG_ON((unsigned long)__fix_to_virt(VSYSCALL_PAGE) !=
339 (unsigned long)VSYSCALL_ADDR);
1da177e4
LT
340}
341
342static int __init vsyscall_init(void)
343{
42112a0f
SB
344 cpu_notifier_register_begin();
345
15c8b6c1 346 on_each_cpu(cpu_vsyscall_init, NULL, 1);
be43f83d 347 /* notifier priority > KVM */
42112a0f
SB
348 __hotcpu_notifier(cpu_vsyscall_notifier, 30);
349
350 cpu_notifier_register_done();
5cec93c2 351
1da177e4
LT
352 return 0;
353}
1da177e4 354__initcall(vsyscall_init);
This page took 0.868793 seconds and 5 git commands to generate.