vsyscall and vdso Adrien «schischi» Schildknecht vsyscall and vdso March 17, 2014

Transcription

1 March 17, 2014

2 Section 1 Introduction

3 Goal In computing, a system call is how a program requests a service from an operating system s kernel. This may include hardware related services (e.g. accessing the hard disk), creating and executing new processes, and communicating with integral kernel services (like scheduling). System calls provide an essential interface between a process and the operating system. How to speed it up?

4 The kernel maps into user space a page (rw) containing some variable and the implementation of some syscalls. The syscall is executed in userland Reduce the overhead of context switching Variables are updated on each clock interrupt Only apply to «safe» syscalls (only read a variable) gettimeofday() time() getcpu()

5 vsyscall.h 1 # i f n d e f _ASM_X86_VSYSCALL_H # define _ASM_X86_VSYSCALL_H 3 enum vsyscall_num { 5 NR_vgettimeofday, NR_vtime, 7 NR_vgetcpu, } ; 9 # define VSYSCALL_START ( 10UL << 20) 11 # define VSYSCALL_SIZE 1024 # define VSYSCALL_END ( 2UL << 20) 13 # define VSYSCALL_MAPPED_PAGES 1 # define VSYSCALL_ADDR( v s y s c a l l _ n r ) (VSYSCALL_START+ VSYSCALL_SIZE ( v s y s c a l l _ n r ) ) # endif / _ASM_X86_VSYSCALL_H / /usr/include/asm/vsyscall.h

6 Section 2 vsyscall

7 Limitations small memory allocated only 4 system calls statically allocated (nailed down in the kernel ABI) last page - 1 (fixed address) security flaw structure of an elf??

8 Security Static, no ASLR several machine instructions that invoke syscalls (ROP) execute flag on a page with some variables. Thus allowing to jump into when it held the right value

9 Security patch not used anymore in 32bits (archlinux 3.13, glibc 2-19) variables have been moved into a separate page with execute permission turned off 1 sh> c a t linux / arch / x86 / kernel / v s y s c a l l _ 6 4. c void i n i t map_vsyscall ( void ) 3 {... 5 set_ fixmap ( VSYSCALL_FIRST_PAGE, physaddr_ vsyscall, vsyscall_mode == NATIVE 7? PAGE_KERNEL_VSYSCALL : PAGE_KERNEL_VVAR) ; 9 set_ fixmap (VVAR_PAGE, physaddr_vvar_page, PAGE_KERNEL_VVAR) ; } 11

10 Section 3 vdso

11 Definition A memory area allocated in user space which exposes some kernel functionalities at user space in a safe manner. A shared object exposed by the kernel Dynamically allocated can have more than 4 system calls. sh> ldd. / a. out 2 linux vdso. so. 1 (0 x ) # linux gate. so. 1 => (0 x ) 4 l i b c. so. 6 => / usr / l i b / l i b c. so. 6 (0 x ) / l i b 6 4 / ld linux x so. 2 (0 x ) 6

12 Section 4 Analasys

13 Subsection 1 32bits

14 vsyscall 1 sh> c a t / proc / s e l f / maps... 3 No [vsyscall] present!

15 32bits vdso gdb> i n f o proc map 2 gdb> dump binary memory vdso_32.dump... 4 sh> f i l e vdso_32.dump vdso_32 : ELF 32 b i t LSB shared o b j e c t, I n t e l sh> objdump T vdso_32.dump 8 f f f f e k e r n e l _ v s y s c a l l kernel_vsyscall is a method determined at boot time to make a system call using the fastest available method (sysenter, syscall, int 0x80,... ) 2 sh> l s linux / arch / x86 / vdso / vdso32 /. S

16 32bits glibc 1 sh> objdump d / l i b / l i b c so fgrep A12 < time >: a70d0 <time >: a70d0 : 31 c0 xor %eax,% eax 5 a70d2 : 8b mov 0 x4(%esp ),%edx a70d6 : 89 c1 mov %eax,% ecx 7 a70d8 : 87 cb xchg %ecx,% ebx a70da : b8 0d mov $0xd,% eax 9 a70df : 65 f f c a l l %gs : 0 x10 # l o c a t e d in the vdso 11 a70e6 : 87 cb xchg %ecx,% ebx a70e8 : 85 d2 t e s t %edx,%edx 13 a70ea : j e a70ee <time+0 x1e> a70ec : mov %eax,(% edx ) 15 a70ee : f3 c3 repz r e t

17 32bits Calling time() in a 32bits linux program : call time() from glibc call kernel_vsyscall from the vdso sysenter, syscall or 0x80 syscall is executed in kernel space...

18 Subsection 2 64bits

19 vdso 1 gdb> i n f o proc map gdb> dump binary memory vdso_64.dump... 3 sh> f i l e vdso_64.dump 5 vdso_64 : ELF 64 b i t LSB shared o b j e c t, x sh> objdump T vdso_64.dump f f f f f f f f f f clock_gettime 9 f f f f f f f f f f vdso_clock_gettime f f f f f f f f f f b 7 0 gettimeofday 11 f f f f f f f f f f b 7 0 vdso_gettimeofday f f f f f f f f f f d 2 0 getcpu 13 f f f f f f f f f f d 2 0 vdso_getcpu f f f f f f f f f f d 0 0 time 15 f f f f f f f f f f d 0 0 vdso_time

20 64bits vsyscall 1 gdb> dump binary memory v s y s c a l l _ 6 4.dump f f f f f f f f f f f f f f f f f f f f sh> f i l e v s y s c a l l _ 6 4.dump 3 v s y s c a l l _ 6 4 : data # wtf ( not an e l f! ) sh> ndisasm v s y s c a l l _ 6 4.dump l e s s dec ax C7C06000 mov ax, 0 x add [ bx+ s i ], a l F05 s y s c a l l C3 r e t A CC i n t B CC i n t 3 # a l o t of i n t 3 13 sh> ndisasm v s y s c a l l _ 6 4 grep mov C7C06000 mov ax, 0 x60 # gettimeofday C7C0C900 mov ax, 0 xc9 # time C7C03501 mov ax, 0 x135 # getcpu 17

21 The code in the vsyscall page has been removed and replaced by a special trap instruction. The kernel emulate the desired syscall in kernel space. The page contain a method which use a kernel syscall, emulating a virtual system call. Vsyscalls are now slower than standard syscalls... But they should not be used anyway...

22 glibc Retrieve time symbol from vdso. Substitute with vsyscall if not available. p = _dl_vdso_vsym ( " vdso_getcpu ", &linux26 ) ; 2 / I f the vdso i s not a v a i l a b l e we f a l l back on the old v s y s c a l l. / # define VSYSCALL_ADDR_vgetcpu 0 x f f f f f f f f f f i f ( p == NULL) p = ( void ) VSYSCALL_ADDR_vgetcpu ; 6

23 The end The end.