[lkml]   [2013]   [Oct]   [28]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
Messages in this thread
SubjectRe: ARM seccomp filters and EABI/OABI
Am 28.10.2013 22:53, schrieb Paul Moore:
> On Thursday, October 24, 2013 09:55:57 PM Richard Weinberger wrote:
>> On Wed, Oct 23, 2013 at 11:02 PM, Andy Lutomirski <>
> wrote:
>>> I'm looking at the seccomp code, the ARM entry code, and the
>>> syscall(2) manpage, and I'm a bit lost. (The fact that I don't really
>>> speak ARM assembly doesn't help.) My basic question is: what happens
>>> if an OABI syscall happens?
>>> AFAICS, the syscall arguments for EABI are r0..r5, although their
>>> ordering is a bit odd*. For OABI, r6 seems to play some role, but I'm
>>> lost as to what it is. The seccomp_bpf_load function won't load r6,
>>> so there had better not be anything useful in there... (Also, struct
>>> seccomp_data will have issues with a seventh "argument".)
>>> But what happens to the syscall number? For an EABI syscall, it's in
>>> r7. For an OABI syscall, it's in the swi instruction and gets copied
>>> to r7 on entry. If a debugger changes r7, presumably the syscall
>>> number changes.
>>> Oddly, there are two different syscall tables. The major differences
>>> seem to be that some of the OABI entries have their argument order
>>> changed. But there's also a magic constant 0x900000 added to the
>>> syscall number somewhere -- is it reflected in _sigsys._syscall? Is
>>> it reflected in ucontext's r7?
>>> I'm a bit surprised to see that both the EABI and OABI ABIs show up as
>>> Can any of you shed some light on this? I don't have an ARM system I
>>> can test on, but if one of you can point me at a decent QEMU image, I
>>> can play around.
>> Maybe this helps:
> Thanks for the pointer, although those images look quite old, has anyone done
> a refresh?

You are free to run "apt-get upgrade" within the said images. :-)


 \ /
  Last update: 2013-10-28 23:21    [W:0.111 / U:0.176 seconds]
©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site