syscall_entrypoint.cc

// Copyright (c) 2010 The Chromium Authors. All rights reserved.
// Use of this source code is governed by a BSD-style license that can be
// found in the LICENSE file.

#include "syscall_entrypoint.h"

#include "debug.h"
#include "sandbox_impl.h"
#include "system_call_table.h"

namespace playground {

// TODO(markus): change this into a function that returns the address of the assembly code. If that isn't possible for sandbox_clone, then move that function into a *.S file
asm(
    ".pushsection .text, \"ax\", @progbits\n"

    // This is the special wrapper for the clone() system call. The code
    // relies on the stack layout of the system call entrypoint (c.f. below). It
    // passes the stack pointer as an additional argument to sandbox__clone(),
    // so that upon starting the child, register values can be restored and
    // the child can start executing at the correct IP, instead of trying to
    // run in the trusted thread.
    "playground$sandbox_clone:"
    ".internal playground$sandbox_clone\n"
    ".globl playground$sandbox_clone\n"
    ".type playground$sandbox_clone, @function\n"
    #if defined(__x86_64__)
    // Skip the 8 byte return address into the system call entrypoint. The
    // following bytes are the saved register values that we need to restore
    // upon return from clone() in the new thread.
    "lea 8(%rsp), %r9\n"
    "jmp playground$sandbox__clone\n"
    #elif defined(__i386__)
    // As i386 passes function arguments on the stack, we need to skip a few
    // more values before we can get to the saved registers.
    "mov 28(%esp), %eax\n"
    "mov %eax, 24(%esp)\n"
    "jmp playground$sandbox__clone\n"
    #else
    #error Unsupported target platform
    #endif
    ".size playground$sandbox_clone, .-playground$sandbox_clone\n"


    // This is the entrypoint which is called by the untrusted code, trying to
    // make a system call.
    "playground$syscallEntryPointNoFrame:"
    ".internal playground$syscallEntryPointNoFrame\n"
    ".globl playground$syscallEntryPointNoFrame\n"
    ".type playground$syscallEntryPointNoFrame, @function\n"
    #if defined(__x86_64__)
    "mov  0(%rsp), %r11\n"         // add fake return address by duplicating
    "push %r11\n"                  // real return address
    /* fall through */
    #elif defined(__i386__)
    "push %eax\n"                  // add fake return address, which in this
    "mov  4(%esp), %eax\n"         // case is identical to the real return
    "xchg %eax, 0(%esp)\n"         // address
    /* fall through */
    #else
    #error Unsupported target platform
    #endif
    ".size playground$syscallEntryPointNoFrame, "
        ".-playground$syscallEntryPointNoFrame\n"

    "playground$syscallEntryPointWithFrame:"
    ".internal playground$syscallEntryPointWithFrame\n"
    ".globl playground$syscallEntryPointWithFrame\n"
    ".type playground$syscallEntryPointWithFrame, @function\n"
    #if defined(__x86_64__)
    // Check for rt_sigreturn(). It needs to be handled specially.
    "cmp  $15, %rax\n"             // NR_rt_sigreturn
    "jnz  1f\n"
    "add  $0x90, %rsp\n"           // pop return addresses and red zone
  "0:syscall\n"                    // rt_sigreturn() is unrestricted
    "mov  $66, %edi\n"             // rt_sigreturn() should never return
    "mov  $231, %eax\n"            // NR_exit_group
    "jmp  0b\n"

    // Save all registers
  "1:push %rbp\n"
    "movq  $0xDEADBEEFDEADBEEF, %rbp\n" // marker used by breakpad to remove
    "push %rbp\n"                  // seccomp-sandbox's stack frame from dumps
    "mov  %rsp, %rbp\n"
    "push %rbx\n"
    "push %rcx\n"
    "push %rdx\n"
    "push %rsi\n"
    "push %rdi\n"
    "push %r8\n"
    "push %r9\n"
    "push %r10\n"
    "push %r11\n"
    "push %r12\n"
    "push %r13\n"
    "push %r14\n"
    "push %r15\n"

    // TODO(markus): On x86-32 we have to explicitly align the stack. Do we
    //               also have to do this on x86-64? Empirical evidence
    //               suggests, we are OK -- but we might have to revisit this
    //               decision.

    // Check range of system call
    "mov playground$maxSyscall@GOTPCREL(%rip), %rcx\n"
    "cmp 0(%rcx), %eax\n"
    "ja  3f\n"

    // Retrieve function call from system call table (c.f.system_call_table.cc)
    // We have three different types of entries; zero for denied system calls,
    // that should be handled by the defaultSystemCallHandler(); minus one
    // for unrestricted system calls that need to be forwarded to the trusted
    // thread; and function pointers to specific handler functions.
    "mov %rax, %rcx\n"
    "shl $4, %rcx\n"
    "mov playground$syscallTable@GOTPCREL(%rip), %r11\n"
    "mov 0(%r11), %r11\n"
    "add %r11, %rcx\n"
    "mov 0(%rcx), %rcx\n"

    // Jump to function if non-null and not UNRESTRICTED_SYSCALL, otherwise
    // jump to fallback handler.
    "cmp $1, %rcx\n"
    "jbe 3f\n"
    "xchg %r10, %rcx\n"            // Syscall to userspace calling conventions
    "call *%r10\n"
  "2:"

    // Restore CPU registers, except for %rax which was set by the system call.
    "pop %r15\n"
    "pop %r14\n"
    "pop %r13\n"
    "pop %r12\n"
    "pop %r11\n"
    "pop %r10\n"
    "pop %r9\n"
    "pop %r8\n"
    "pop %rdi\n"
    "pop %rsi\n"
    "pop %rdx\n"
    "pop %rcx\n"
    "pop %rbx\n"
    "pop %rbp\n"                   // 0xDEADBEEF marker
    "pop %rbp\n"

    // Remove fake return address. This is added in the patching code in
    // library.cc and it makes stack traces a little cleaner.
    "add $8, %rsp\n"

    // Return to caller
    "ret\n"

  "3:"
    // If we end up calling a specific handler, we don't need to know the
    // system call number. However, in the generic case, we do. Shift
    // registers so that the system call number becomes visible as the
    // first function argument.
    "push %r9\n"
    "mov  %r8, %r9\n"
    "mov  %r10, %r8\n"
    "mov  %rdx, %rcx\n"
    "mov  %rsi, %rdx\n"
    "mov  %rdi, %rsi\n"
    "mov  %rax, %rdi\n"

    // Call default handler.
    "call playground$defaultSystemCallHandler\n"
    "pop  %r9\n"
    "jmp 2b\n"
    #elif defined(__i386__)
    "cmp  $119, %eax\n"            // NR_sigreturn
    "jnz  1f\n"
    "add  $0x8, %esp\n"            // pop return address
  "0:int  $0x80\n"                 // sigreturn() is unrestricted
    "mov  $66, %ebx\n"             // sigreturn() should never return
    "mov  %ebx, %eax\n"            // NR_exit
    "jmp  0b\n"
  "1:cmp  $173, %eax\n"            // NR_rt_sigreturn
    "jnz  4f\n"

    // Convert rt_sigframe into sigframe, allowing us to call sigreturn().
    // This is possible since the first part of signal stack frames have
    // stayed very stable since the earliest kernel versions. While never
    // officially documented, lots of user space applications rely on this
    // part of the ABI, and kernel developers have been careful to maintain
    // backwards compatibility.
    // In general, the rt_sigframe includes a lot of extra information that
    // the signal handler can look at. Most notably, this means a complete
    // siginfo record.
    // Fortunately though, the kernel doesn't look at any of this extra data
    // when returning from a signal handler. So, we can safely convert an
    // rt_sigframe to a legacy sigframe, discarding the extra data in the
    // process. Interestingly, the legacy signal frame is actually larger than
    // the rt signal frame, as it includes a lot more padding.
    "sub  $0x1C4, %esp\n"          // a legacy signal stack is much larger
    "mov  0x1CC(%esp), %eax\n"     // push signal number
    "push %eax\n"
    "lea  0x270(%esp), %esi\n"     // copy siginfo register values
    "lea  0x4(%esp), %edi\n"       //     into new location
    "mov  $0x16, %ecx\n"
    "cld\n"
    "rep movsl\n"
    "mov  0x2C8(%esp), %ebx\n"     // copy first half of signal mask
    "mov  %ebx, 0x54(%esp)\n"
    "call 2f\n"
  "2:pop  %esi\n"
    "add  $(3f-2b), %esi\n"
    "push %esi\n"                  // push restorer function
    "lea  0x2D4(%esp), %edi\n"     // patch up retcode magic numbers
    "movb $2, %cl\n"
    "rep movsl\n"
    "ret\n"                        // return to restorer function
  "3:pop  %eax\n"                  // remove dummy argument (signo)
    "mov  $119, %eax\n"            // NR_sigaction
    "int  $0x80\n"


    // Preserve all registers
  "4:push %ebp\n"
    "push $0xDEADBEEF\n"           // marker used by breakpad
    "push %ebx\n"
    "push %ecx\n"
    "push %edx\n"
    "push %esi\n"
    "push %edi\n"

    // Align stack pointer, so that called functions can push SSE registers
    // onto stack. This apparently is a requirement of the x86-32 ABI.
    "mov  %esp, %ebp\n"
    "and  $-16, %esp\n"
    "sub $4, %esp\n"
    "push %ebp\n"                  // push old un-aligned stack pointer
    "lea  0x14(%ebp), %ebp\n"      // frame pointer points to 0xDEADBEEF
    "push %eax\n"
    "mov  4(%ebp), %eax\n"         // push original value of %ebp
    "xchg %eax, 0(%esp)\n"

    // Convert from syscall calling conventions to C calling conventions
    "push %edi\n"
    "push %esi\n"
    "push %edx\n"
    "push %ecx\n"
    "push %ebx\n"
    "push %eax\n"

    // Check range of system call
    "call 5f\n"
  "5:pop  %edx\n"
    "add $(_GLOBAL_OFFSET_TABLE_+(.-5b)), %edx\n"
    "mov playground$maxSyscall@GOT(%edx), %edx\n"
    "cmp 0(%edx), %eax\n"
    "ja  14f\n"

    // We often have long sequences of calls to gettimeofday(). This is
    // needlessly expensive. Coalesce them into a single call.
    //
    // We keep track of state in TLS storage that we can access through
    // the %fs segment register. See trusted_thread.cc for the exact
    // memory layout.
    //
    // TODO(markus): maybe, we should proactively call gettimeofday() and
    //               clock_gettime(), whenever we talk to the trusted thread?
    //               or maybe, if we have recently seen requests to compute
    //               the time. There might be a repeated pattern of those.
    "cmp  $78, %eax\n"             // __NR_gettimeofday
    "jnz  10f\n"
    "cmp  %eax, %fs:0x102C-0x58\n" // last system call
    "jnz  7f\n"

    // This system call and the last system call prior to this one both are
    // calls to gettimeofday(). Try to avoid making the new call and just
    // return the same result as in the previous call.
    // Just in case the caller is spinning on the result from gettimeofday(),
    // every so often, call the actual system call.
    "decl %fs:0x1030-0x58\n"       // countdown calls to gettimofday()
    "jz   7f\n"

    // Atomically read the 64bit word representing last-known timestamp and
    // return it to the caller. On x86-32 this is a little more complicated and
    // requires the use of the cmpxchg8b instruction.
    "mov  %ebx, %eax\n"
    "mov  %ecx, %edx\n"
    "call 6f\n"
  "6:pop %ebp\n"
    "add $(100f-6b), %ebp\n"
    "lock; cmpxchg8b 0(%ebp)\n"
    "mov  %eax, 0(%ebx)\n"
    "mov  %edx, 4(%ebx)\n"
    "xor  %eax, %eax\n"
    "add  $28, %esp\n"
    "jmp  13f\n"

    // This is a call to gettimeofday(), but we don't have a valid cached
    // result, yet.
  "7:mov  %eax, %fs:0x102C-0x58\n" // remember syscall number
    "movl $500, %fs:0x1030-0x58\n" // make system call, each 500 invocations
    "call playground$defaultSystemCallHandler@PLT\n"

    // Returned from gettimeofday(). Remember return value, in case the
    // application calls us again right away.
    // Again, this has to happen atomically and requires cmpxchg8b.
    "mov 4(%ebx), %ecx\n"
    "mov 0(%ebx), %ebx\n"
    "call 8f\n"
  "8:pop %ebp\n"
    "add $(100f-8b), %ebp\n"
    "mov 0(%ebp), %eax\n"
    "mov 4(%ebp), %edx\n"
  "9:lock; cmpxchg8b 0(%ebp)\n"
    "jnz 9b\n"
    "xor %eax, %eax\n"
    "jmp 15f\n"

    // Remember the number of the last system call made. We deliberately do
    // not remember calls to gettid(), as we have often seen long sequences
    // of calls to just gettimeofday() and gettid(). In that situation, we
    // would still like to coalesce the gettimeofday() calls.
 "10:cmp $224, %eax\n"             // __NR_gettid
    "jz  11f\n"
    "mov  %eax, %fs:0x102C-0x58\n" // remember syscall number

    // Retrieve function call from system call table (c.f.system_call_table.cc)
    // We have three different types of entries; zero for denied system calls,
    // that should be handled by the defaultSystemCallHandler(); minus one
    // for unrestricted system calls that need to be forwarded to the trusted
    // thread; and function pointers to specific handler functions.
 "11:shl  $3, %eax\n"
    "call 12f\n"
 "12:pop  %ebx\n"
    "add  $(_GLOBAL_OFFSET_TABLE_+(.-12b)), %ebx\n"
    "mov  playground$syscallTable@GOT(%ebx), %ebx\n"
    "add  0(%ebx), %eax\n"
    "mov  0(%eax), %eax\n"

    // Jump to function if non-null and not UNRESTRICTED_SYSCALL, otherwise
    // jump to fallback handler.
    "cmp  $1, %eax\n"
    "jbe  14f\n"
    "add  $4, %esp\n"
    "call *%eax\n"
    "add  $24, %esp\n"

    // Restore CPU registers, except for %eax which was set by the system call.
 "13:pop  %esp\n"
    "pop  %edi\n"
    "pop  %esi\n"
    "pop  %edx\n"
    "pop  %ecx\n"
    "pop  %ebx\n"
    "pop  %ebp\n"                  // 0xDEADBEEF marker
    "pop  %ebp\n"

    // Remove fake return address. This is added in the patching code in
    // library.cc and it makes stack traces a little cleaner.
    "add  $4, %esp\n"

    // Return to caller
    "ret\n"

    // Call default handler.
 "14:call playground$defaultSystemCallHandler@PLT\n"
 "15:add  $28, %esp\n"
    "jmp  13b\n"

    ".pushsection \".bss\"\n"
    ".balign 8\n"
"100:.byte 0, 0, 0, 0, 0, 0, 0, 0\n"
    ".popsection\n"

    #else
    #error Unsupported target platform
    #endif
    ".size playground$syscallEntryPointWithFrame,"
        ".-playground$syscallEntryPointWithFrame\n"
    ".popsection\n"
);


void* Sandbox::defaultSystemCallHandler(int syscallNum, void* arg0, void* arg1,
                                        void* arg2, void* arg3, void* arg4,
                                        void* arg5) {
  // TODO(markus): The following comment is currently not true, we do intercept these system calls. Try to fix that.

  // We try to avoid intercepting read(), and write(), as these system calls
  // are not restricted in Seccomp mode. But depending on the exact
  // instruction sequence in libc, we might not be able to reliably
  // filter out these system calls at the time when we instrument the code.
  SysCalls  sys;
  long      rc;
  long long tm;
  switch (syscallNum) {
    case __NR_read:
      Debug::syscall(&tm, syscallNum, "Allowing unrestricted system call");
      rc             = sys.read((long)arg0, arg1, (size_t)arg2);
      break;
    case __NR_write:
      Debug::syscall(&tm, syscallNum, "Allowing unrestricted system call");
      rc             = sys.write((long)arg0, arg1, (size_t)arg2);
      break;
    default:
      if (Debug::isEnabled()) {
        // In debug mode, prevent stderr from being closed
        if (syscallNum == __NR_close && arg0 == (void *)2)
          return 0;
      }

      if ((unsigned)syscallNum <= SyscallTable::maxSyscall &&
         SyscallTable::syscallTable[syscallNum].handler==UNRESTRICTED_SYSCALL){
        Debug::syscall(&tm, syscallNum, "Allowing unrestricted system call");
     perform_unrestricted:
        struct {
          int          sysnum;
          void*        unrestricted_req[6];
        } __attribute__((packed)) request = {
          syscallNum, { arg0, arg1, arg2, arg3, arg4, arg5 } };

        int   thread = threadFdPub();
        void* rc;
        if (write(sys, thread, &request, sizeof(request)) != sizeof(request) ||
            read(sys, thread, &rc, sizeof(rc)) != sizeof(rc)) {
          die("Failed to forward unrestricted system call");
        }
        Debug::elapsed(tm, syscallNum);
        return rc;
      } else if (Debug::isEnabled()) {
        Debug::syscall(&tm, syscallNum,
                       "In production mode, this call would be disallowed");
        goto perform_unrestricted;
      } else {
        return (void *)-ENOSYS;
      }
  }
  if (rc < 0) {
    rc               = -sys.my_errno;
  }
  Debug::elapsed(tm, syscallNum);
  return (void *)rc;
}

} // namespace