Messages in this thread |  | | Date | Fri, 1 Nov 2013 07:45:54 +0000 | Subject | Re: ARM seccomp filters and EABI/OABI | From | Kees Cook <> |
| |
On Thu, Oct 31, 2013 at 11:50 PM, Andy Lutomirski <luto@amacapital.net> wrote: > On Tue, Oct 29, 2013 at 12:38 PM, Paul Moore <paul@paul-moore.com> wrote: >> On Monday, October 28, 2013 11:16:20 PM Richard Weinberger wrote: >>> Am 28.10.2013 22:53, schrieb Paul Moore: >>> > On Thursday, October 24, 2013 09:55:57 PM Richard Weinberger wrote: >>> >> On Wed, Oct 23, 2013 at 11:02 PM, Andy Lutomirski <luto@amacapital.net> >>> > >>> > wrote: >>> >>> I'm looking at the seccomp code, the ARM entry code, and the >>> >>> syscall(2) manpage, and I'm a bit lost. (The fact that I don't really >>> >>> speak ARM assembly doesn't help.) My basic question is: what happens >>> >>> if an OABI syscall happens? >>> >>> >>> >>> AFAICS, the syscall arguments for EABI are r0..r5, although their >>> >>> ordering is a bit odd*. For OABI, r6 seems to play some role, but I'm >>> >>> lost as to what it is. The seccomp_bpf_load function won't load r6, >>> >>> so there had better not be anything useful in there... (Also, struct >>> >>> seccomp_data will have issues with a seventh "argument".) >>> >>> >>> >>> But what happens to the syscall number? For an EABI syscall, it's in >>> >>> r7. For an OABI syscall, it's in the swi instruction and gets copied >>> >>> to r7 on entry. If a debugger changes r7, presumably the syscall >>> >>> number changes. >>> >>> >>> >>> Oddly, there are two different syscall tables. The major differences >>> >>> seem to be that some of the OABI entries have their argument order >>> >>> changed. But there's also a magic constant 0x900000 added to the >>> >>> syscall number somewhere -- is it reflected in _sigsys._syscall? Is >>> >>> it reflected in ucontext's r7? >>> >>> >>> >>> I'm a bit surprised to see that both the EABI and OABI ABIs show up as >>> >>> AUDIT_ARCH_ARM. >>> >>> >>> >>> Can any of you shed some light on this? I don't have an ARM system I >>> >>> can test on, but if one of you can point me at a decent QEMU image, I >>> >>> can play around. >>> >> >>> >> Maybe this helps: >>> >> http://people.debian.org/~aurel32/qemu/armel/ >>> > >>> > Thanks for the pointer, although those images look quite old, has anyone >>> > done a refresh? >>> >>> You are free to run "apt-get upgrade" within the said images. :-) >> >> Okay, true ;) > > Except it didn't work... I fixed it with 'apt-key adv --recv-keys > --keyserver keyserver.ubuntu.com <key id from update's error > message>'. > > I have yet to build a working kernel for this thing, though. > Apparently kernels since 3.8 have something wrong in the "versatile" > board file. Do any of you have a working .config and qemu -M option?
For qemu before 1.5, I needed to revert f9b71fef12f0d6ac5c7051cfd87f7700f78c56b6 to get SCSI working again. I've attached my .config. I launch with:
sudo qemu-system-arm -nographic -m 256 -M versatilepb \ -kernel $HOME/Code/linux/arch/arm/boot/zImage \ -drive file=$DIR/vda.qcow2,if=scsi,format=qcow2 \ -net nic,vlan=0 -net tap,vlan=0,script=$HOME/kvm/kvm-ifup,downscript=$HOME/kvm/kvm-ifdown,ifname=tap-$IMG \ -monitor tcp:127.0.0.1:8087,server,nowait \ -append "loglevel=8 debug root=/dev/sda1 slub_debug=FZ console=ttyAMA0 $@"
I can send the if-up/down scripts if you want them too.
-Kees
-- Kees Cook Chrome OS Security [unhandled content-type:application/octet-stream] |  |