Messages in this thread | | | From | "Jason A. Donenfeld" <> | Date | Mon, 30 Dec 2019 22:42:40 +0100 | Subject | Re: [PATCH] mips: vdso: conditionalize 32-bit time functions on COMPAT_32BIT_TIME |
| |
On Mon, Dec 30, 2019 at 10:09 PM Jason A. Donenfeld <Jason@zx2c4.com> wrote: > > On Mon, Dec 30, 2019 at 6:33 PM Arnd Bergmann <arnd@arndb.de> wrote > > Is this immediately before/after the syscall instruction or the > > indirect function call? > > It's immediately after/before the call to the VDSO function itself. > Next I'll try to instrument the VDSO to get closer to that syscall. > > I produced those reg dumps by hooking the page fault handler in the > kernel to print them and then disabling aslr and sticking a > `*(volatile int *)0 = 0;` in the code. Pretty gnarly.
Here's immediately before and immediately after the syscall asm that the vdso has in mips/include/asm/vdso/gettimeofday.h. sp and ra are wrong?
Before:
[ 0.546364] $ 0 : 0000000000000000 0000000000000001 0000000000000002 0000000000000000 [ 0.546545] $ 4 : 000000007fff4000 0000000000000000 0000000077ff0000 0000000000000406 [ 0.546762] $ 8 : 000000007fff5000 0000000000000020 0000000000000002 0000000000000000 [ 0.546912] $12 : 0000000000000000 000000000000000a ffffffff80000000 000000000000006d [ 0.547046] $16 : 000000007fff2e40 000000007fff2e40 0000000010000000 0000000010000000 [ 0.547178] $20 : 0000000010000000 0000000010000000 0000000000000000 0000000077ff0000 [ 0.547548] $24 : 0000000000000005 0000000000000000 [ 0.547743] $28 : 000000007fff5000 000000007fff2df0 0000000000000000 000000007fff550c [ 0.547898] Hi : 0000000000000000 [ 0.548010] Lo : 0000000000000000 [ 0.548175] epc : 000000007fff5580 0x7fff5580 [ 0.548358] ra : 000000007fff550c 0x7fff550c [ 0.549305] Stack : 0000000000000002 000000007fff2e40 0000000000000002 0000000077f9e80c [ 0.549500] 0000000000000000 0000000000000000 ffffffffffffffff 0000000010000000 [ 0.549687] 0000000010019dd0 0000000010000c20 0000000077ff0000 0000000077fa4868 [ 0.549951] 0000000377ff19b8 0000000000000000 000000007fff2f04 0000000000000001 [ 0.550127] 0000000010000870 0000000077ff0000 0000000077fa4868 0000000077ff19b8 [ 0.550277] 0000000077ff7180 0000000077f297ac 7fff2f0c77ff7180 0000000077f29800 [ 0.550458] 0000000000000000 000000007fff2f00 0000000077ff19b8 0000000077ff1e30 [ 0.550613] 0000000010019dd0 0000000010000dec 0000000010019dd0 0000000010000db0 [ 0.550811] 0000000000000000 0000000000000000 000000017fff2fda 000000007fff2fe0 [ 0.550957] 7fff2fe700000000 000000217fff5000 0000001000000020 0000000600001000
After:
[ 0.577975] $ 0 : 0000000000000000 0000000000000001 0000000000000059 000000007fff5000 [ 0.578191] $ 4 : 0000000000000002 000000007fff2e40 0000000077ff0000 0000000000000001 [ 0.578392] $ 8 : 0000000000000006 0000000000000020 0000000000000002 0000000000000000 [ 0.578611] $12 : 0000000000000000 0000000000001852 ffffffff801560e0 000000000000006d [ 0.578817] $16 : 0000000000000002 000000007fff2e40 0000000010000000 0000000010000000 [ 0.579004] $20 : 0000000010000000 0000000010000000 0000000000000000 0000000077ff0000 [ 0.579149] $24 : 0000000000000005 0000000000000000 [ 0.579375] $28 : 000000007fff5000 000000007fff2de0 0000000000000000 000000007fff551c [ 0.579640] Hi : 0000000000000000 [ 0.579799] Lo : 0000000000000000 [ 0.579974] epc : 000000007fff55a0 0x7fff55a0 [ 0.580134] ra : 000000007fff551c 0x7fff551c [ 0.581293] Stack : 0000000000000000 0000000077f9e760 0000000000000002 000000007fff2e40 [ 0.581456] 0000000077ff0000 0000000077f9e80c 0000000000000000 0000000000000000 [ 0.581619] ffffffffffffffff 0000000010000000 0000000010019dd0 0000000010000c20 [ 0.581834] 0000000077ff0000 0000000077fa4868 0000000377ff19b8 0000000000000000 [ 0.581985] 000000007fff2f04 0000000000000001 0000000010000870 0000000077ff0000 [ 0.582136] 0000000077fa4868 0000000077ff19b8 0000000077ff7180 0000000077f297ac [ 0.582288] 7fff2f0c77ff7180 0000000077f29800 0000000000000000 000000007fff2f00 [ 0.582438] 0000000077ff19b8 0000000077ff1e30 0000000010019dd0 0000000010000dec [ 0.582585] 0000000010019dd0 0000000010000db0 0000000000000000 0000000000000000 [ 0.582732] 000000017fff2fda 000000007fff2fe0 7fff2fe700000000 000000217fff5000
| |