e6e5494cb2
Move the i386 VDSO down into a vma and thus randomize it. Besides the security implications, this feature also helps debuggers, which can COW a vma-backed VDSO just like a normal DSO and can thus do single-stepping and other debugging features. It's good for hypervisors (Xen, VMWare) too, which typically live in the same high-mapped address space as the VDSO, hence whenever the VDSO is used, they get lots of guest pagefaults and have to fix such guest accesses up - which slows things down instead of speeding things up (the primary purpose of the VDSO). There's a new CONFIG_COMPAT_VDSO (default=y) option, which provides support for older glibcs that still rely on a prelinked high-mapped VDSO. Newer distributions (using glibc 2.3.3 or later) can turn this option off. Turning it off is also recommended for security reasons: attackers cannot use the predictable high-mapped VDSO page as syscall trampoline anymore. There is a new vdso=[0|1] boot option as well, and a runtime /proc/sys/vm/vdso_enabled sysctl switch, that allows the VDSO to be turned on/off. (This version of the VDSO-randomization patch also has working ELF coredumping, the previous patch crashed in the coredumping code.) This code is a combined work of the exec-shield VDSO randomization code and Gerd Hoffmann's hypervisor-centric VDSO patch. Rusty Russell started this patch and i completed it. [akpm@osdl.org: cleanups] [akpm@osdl.org: compile fix] [akpm@osdl.org: compile fix 2] [akpm@osdl.org: compile fix 3] [akpm@osdl.org: revernt MAXMEM change] Signed-off-by: Ingo Molnar <mingo@elte.hu> Signed-off-by: Arjan van de Ven <arjan@infradead.org> Cc: Gerd Hoffmann <kraxel@suse.de> Cc: Rusty Russell <rusty@rustcorp.com.au> Cc: Zachary Amsden <zach@vmware.com> Cc: Andi Kleen <ak@muc.de> Cc: Jan Beulich <jbeulich@novell.com> Signed-off-by: Andrew Morton <akpm@osdl.org> Signed-off-by: Linus Torvalds <torvalds@osdl.org>
77 lines
2.4 KiB
C
77 lines
2.4 KiB
C
/*
|
|
* Generate definitions needed by assembly language modules.
|
|
* This code generates raw asm output which is post-processed
|
|
* to extract and format the required data.
|
|
*/
|
|
|
|
#include <linux/crypto.h>
|
|
#include <linux/sched.h>
|
|
#include <linux/signal.h>
|
|
#include <linux/personality.h>
|
|
#include <linux/suspend.h>
|
|
#include <asm/ucontext.h>
|
|
#include "sigframe.h"
|
|
#include <asm/fixmap.h>
|
|
#include <asm/processor.h>
|
|
#include <asm/thread_info.h>
|
|
#include <asm/elf.h>
|
|
|
|
#define DEFINE(sym, val) \
|
|
asm volatile("\n->" #sym " %0 " #val : : "i" (val))
|
|
|
|
#define BLANK() asm volatile("\n->" : : )
|
|
|
|
#define OFFSET(sym, str, mem) \
|
|
DEFINE(sym, offsetof(struct str, mem));
|
|
|
|
void foo(void)
|
|
{
|
|
OFFSET(SIGCONTEXT_eax, sigcontext, eax);
|
|
OFFSET(SIGCONTEXT_ebx, sigcontext, ebx);
|
|
OFFSET(SIGCONTEXT_ecx, sigcontext, ecx);
|
|
OFFSET(SIGCONTEXT_edx, sigcontext, edx);
|
|
OFFSET(SIGCONTEXT_esi, sigcontext, esi);
|
|
OFFSET(SIGCONTEXT_edi, sigcontext, edi);
|
|
OFFSET(SIGCONTEXT_ebp, sigcontext, ebp);
|
|
OFFSET(SIGCONTEXT_esp, sigcontext, esp);
|
|
OFFSET(SIGCONTEXT_eip, sigcontext, eip);
|
|
BLANK();
|
|
|
|
OFFSET(CPUINFO_x86, cpuinfo_x86, x86);
|
|
OFFSET(CPUINFO_x86_vendor, cpuinfo_x86, x86_vendor);
|
|
OFFSET(CPUINFO_x86_model, cpuinfo_x86, x86_model);
|
|
OFFSET(CPUINFO_x86_mask, cpuinfo_x86, x86_mask);
|
|
OFFSET(CPUINFO_hard_math, cpuinfo_x86, hard_math);
|
|
OFFSET(CPUINFO_cpuid_level, cpuinfo_x86, cpuid_level);
|
|
OFFSET(CPUINFO_x86_capability, cpuinfo_x86, x86_capability);
|
|
OFFSET(CPUINFO_x86_vendor_id, cpuinfo_x86, x86_vendor_id);
|
|
BLANK();
|
|
|
|
OFFSET(TI_task, thread_info, task);
|
|
OFFSET(TI_exec_domain, thread_info, exec_domain);
|
|
OFFSET(TI_flags, thread_info, flags);
|
|
OFFSET(TI_status, thread_info, status);
|
|
OFFSET(TI_cpu, thread_info, cpu);
|
|
OFFSET(TI_preempt_count, thread_info, preempt_count);
|
|
OFFSET(TI_addr_limit, thread_info, addr_limit);
|
|
OFFSET(TI_restart_block, thread_info, restart_block);
|
|
OFFSET(TI_sysenter_return, thread_info, sysenter_return);
|
|
BLANK();
|
|
|
|
OFFSET(EXEC_DOMAIN_handler, exec_domain, handler);
|
|
OFFSET(RT_SIGFRAME_sigcontext, rt_sigframe, uc.uc_mcontext);
|
|
BLANK();
|
|
|
|
OFFSET(pbe_address, pbe, address);
|
|
OFFSET(pbe_orig_address, pbe, orig_address);
|
|
OFFSET(pbe_next, pbe, next);
|
|
|
|
/* Offset from the sysenter stack to tss.esp0 */
|
|
DEFINE(TSS_sysenter_esp0, offsetof(struct tss_struct, esp0) -
|
|
sizeof(struct tss_struct));
|
|
|
|
DEFINE(PAGE_SIZE_asm, PAGE_SIZE);
|
|
DEFINE(VDSO_PRELINK, VDSO_PRELINK);
|
|
|
|
OFFSET(crypto_tfm_ctx_offset, crypto_tfm, __crt_ctx);
|
|
}
|