Re: [PATCH] mips: vdso: conditionalize 32-bit time functions on COMPAT_32BIT_TIME

From: Jason A. Donenfeld
Date: Mon Dec 30 2019 - 16:43:06 EST


On Mon, Dec 30, 2019 at 10:09 PM Jason A. Donenfeld <Jason@xxxxxxxxx> wrote:
>
> On Mon, Dec 30, 2019 at 6:33 PM Arnd Bergmann <arnd@xxxxxxxx> wrote
> > Is this immediately before/after the syscall instruction or the
> > indirect function call?
>
> It's immediately after/before the call to the VDSO function itself.
> Next I'll try to instrument the VDSO to get closer to that syscall.
>
> I produced those reg dumps by hooking the page fault handler in the
> kernel to print them and then disabling aslr and sticking a
> `*(volatile int *)0 = 0;` in the code. Pretty gnarly.

Here's immediately before and immediately after the syscall asm that
the vdso has in mips/include/asm/vdso/gettimeofday.h. sp and ra are
wrong?

Before:

[ 0.546364] $ 0 : 0000000000000000 0000000000000001
0000000000000002 0000000000000000
[ 0.546545] $ 4 : 000000007fff4000 0000000000000000
0000000077ff0000 0000000000000406
[ 0.546762] $ 8 : 000000007fff5000 0000000000000020
0000000000000002 0000000000000000
[ 0.546912] $12 : 0000000000000000 000000000000000a
ffffffff80000000 000000000000006d
[ 0.547046] $16 : 000000007fff2e40 000000007fff2e40
0000000010000000 0000000010000000
[ 0.547178] $20 : 0000000010000000 0000000010000000
0000000000000000 0000000077ff0000
[ 0.547548] $24 : 0000000000000005 0000000000000000
[ 0.547743] $28 : 000000007fff5000 000000007fff2df0
0000000000000000 000000007fff550c
[ 0.547898] Hi : 0000000000000000
[ 0.548010] Lo : 0000000000000000
[ 0.548175] epc : 000000007fff5580 0x7fff5580
[ 0.548358] ra : 000000007fff550c 0x7fff550c
[ 0.549305] Stack : 0000000000000002 000000007fff2e40
0000000000000002 0000000077f9e80c
[ 0.549500] 0000000000000000 0000000000000000
ffffffffffffffff 0000000010000000
[ 0.549687] 0000000010019dd0 0000000010000c20
0000000077ff0000 0000000077fa4868
[ 0.549951] 0000000377ff19b8 0000000000000000
000000007fff2f04 0000000000000001
[ 0.550127] 0000000010000870 0000000077ff0000
0000000077fa4868 0000000077ff19b8
[ 0.550277] 0000000077ff7180 0000000077f297ac
7fff2f0c77ff7180 0000000077f29800
[ 0.550458] 0000000000000000 000000007fff2f00
0000000077ff19b8 0000000077ff1e30
[ 0.550613] 0000000010019dd0 0000000010000dec
0000000010019dd0 0000000010000db0
[ 0.550811] 0000000000000000 0000000000000000
000000017fff2fda 000000007fff2fe0
[ 0.550957] 7fff2fe700000000 000000217fff5000
0000001000000020 0000000600001000

After:

[ 0.577975] $ 0 : 0000000000000000 0000000000000001
0000000000000059 000000007fff5000
[ 0.578191] $ 4 : 0000000000000002 000000007fff2e40
0000000077ff0000 0000000000000001
[ 0.578392] $ 8 : 0000000000000006 0000000000000020
0000000000000002 0000000000000000
[ 0.578611] $12 : 0000000000000000 0000000000001852
ffffffff801560e0 000000000000006d
[ 0.578817] $16 : 0000000000000002 000000007fff2e40
0000000010000000 0000000010000000
[ 0.579004] $20 : 0000000010000000 0000000010000000
0000000000000000 0000000077ff0000
[ 0.579149] $24 : 0000000000000005 0000000000000000
[ 0.579375] $28 : 000000007fff5000 000000007fff2de0
0000000000000000 000000007fff551c
[ 0.579640] Hi : 0000000000000000
[ 0.579799] Lo : 0000000000000000
[ 0.579974] epc : 000000007fff55a0 0x7fff55a0
[ 0.580134] ra : 000000007fff551c 0x7fff551c
[ 0.581293] Stack : 0000000000000000 0000000077f9e760
0000000000000002 000000007fff2e40
[ 0.581456] 0000000077ff0000 0000000077f9e80c
0000000000000000 0000000000000000
[ 0.581619] ffffffffffffffff 0000000010000000
0000000010019dd0 0000000010000c20
[ 0.581834] 0000000077ff0000 0000000077fa4868
0000000377ff19b8 0000000000000000
[ 0.581985] 000000007fff2f04 0000000000000001
0000000010000870 0000000077ff0000
[ 0.582136] 0000000077fa4868 0000000077ff19b8
0000000077ff7180 0000000077f297ac
[ 0.582288] 7fff2f0c77ff7180 0000000077f29800
0000000000000000 000000007fff2f00
[ 0.582438] 0000000077ff19b8 0000000077ff1e30
0000000010019dd0 0000000010000dec
[ 0.582585] 0000000010019dd0 0000000010000db0
0000000000000000 0000000000000000
[ 0.582732] 000000017fff2fda 000000007fff2fe0
7fff2fe700000000 000000217fff5000