github.com/ttpreport/gvisor-ligolo@v0.0.0-20240123134145-a858404967ba/pkg/sentry/platform/systrap/subprocess_amd64.go (about)

     1  // Copyright 2018 The gVisor Authors.
     2  //
     3  // Licensed under the Apache License, Version 2.0 (the "License");
     4  // you may not use this file except in compliance with the License.
     5  // You may obtain a copy of the License at
     6  //
     7  //     http://www.apache.org/licenses/LICENSE-2.0
     8  //
     9  // Unless required by applicable law or agreed to in writing, software
    10  // distributed under the License is distributed on an "AS IS" BASIS,
    11  // WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
    12  // See the License for the specific language governing permissions and
    13  // limitations under the License.
    14  
    15  //go:build amd64
    16  // +build amd64
    17  
    18  package systrap
    19  
    20  import (
    21  	"fmt"
    22  	"strings"
    23  
    24  	"github.com/ttpreport/gvisor-ligolo/pkg/abi/linux"
    25  	"github.com/ttpreport/gvisor-ligolo/pkg/seccomp"
    26  	"github.com/ttpreport/gvisor-ligolo/pkg/sentry/arch"
    27  	"github.com/ttpreport/gvisor-ligolo/pkg/sentry/platform/systrap/sysmsg"
    28  	"golang.org/x/sys/unix"
    29  )
    30  
    31  const (
    32  	// initRegsRipAdjustment is the size of the syscall instruction.
    33  	initRegsRipAdjustment = 2
    34  )
    35  
    36  // resetSysemuRegs sets up emulation registers.
    37  //
    38  // This should be called prior to calling sysemu.
    39  func (s *subprocess) resetSysemuRegs(regs *arch.Registers) {
    40  	regs.Cs = s.sysmsgInitRegs.Cs
    41  	regs.Ss = s.sysmsgInitRegs.Ss
    42  	regs.Ds = s.sysmsgInitRegs.Ds
    43  	regs.Es = s.sysmsgInitRegs.Es
    44  	regs.Fs = s.sysmsgInitRegs.Fs
    45  	regs.Gs = s.sysmsgInitRegs.Gs
    46  }
    47  
    48  // createSyscallRegs sets up syscall registers.
    49  //
    50  // This should be called to generate registers for a system call.
    51  func createSyscallRegs(initRegs *arch.Registers, sysno uintptr, args ...arch.SyscallArgument) arch.Registers {
    52  	// Copy initial registers.
    53  	regs := *initRegs
    54  
    55  	// Set our syscall number.
    56  	regs.Rax = uint64(sysno)
    57  	if len(args) >= 1 {
    58  		regs.Rdi = args[0].Uint64()
    59  	}
    60  	if len(args) >= 2 {
    61  		regs.Rsi = args[1].Uint64()
    62  	}
    63  	if len(args) >= 3 {
    64  		regs.Rdx = args[2].Uint64()
    65  	}
    66  	if len(args) >= 4 {
    67  		regs.R10 = args[3].Uint64()
    68  	}
    69  	if len(args) >= 5 {
    70  		regs.R8 = args[4].Uint64()
    71  	}
    72  	if len(args) >= 6 {
    73  		regs.R9 = args[5].Uint64()
    74  	}
    75  
    76  	return regs
    77  }
    78  
    79  // updateSyscallRegs updates registers after finishing sysemu.
    80  func updateSyscallRegs(regs *arch.Registers) {
    81  	// Ptrace puts -ENOSYS in rax on syscall-enter-stop.
    82  	regs.Rax = regs.Orig_rax
    83  }
    84  
    85  // syscallReturnValue extracts a sensible return from registers.
    86  func syscallReturnValue(regs *arch.Registers) (uintptr, error) {
    87  	rval := int64(regs.Rax)
    88  	if rval < 0 {
    89  		return 0, unix.Errno(-rval)
    90  	}
    91  	return uintptr(rval), nil
    92  }
    93  
    94  func dumpRegs(regs *arch.Registers) string {
    95  	var m strings.Builder
    96  
    97  	fmt.Fprintf(&m, "Registers:\n")
    98  	fmt.Fprintf(&m, "\tR15\t = %016x\n", regs.R15)
    99  	fmt.Fprintf(&m, "\tR14\t = %016x\n", regs.R14)
   100  	fmt.Fprintf(&m, "\tR13\t = %016x\n", regs.R13)
   101  	fmt.Fprintf(&m, "\tR12\t = %016x\n", regs.R12)
   102  	fmt.Fprintf(&m, "\tRbp\t = %016x\n", regs.Rbp)
   103  	fmt.Fprintf(&m, "\tRbx\t = %016x\n", regs.Rbx)
   104  	fmt.Fprintf(&m, "\tR11\t = %016x\n", regs.R11)
   105  	fmt.Fprintf(&m, "\tR10\t = %016x\n", regs.R10)
   106  	fmt.Fprintf(&m, "\tR9\t = %016x\n", regs.R9)
   107  	fmt.Fprintf(&m, "\tR8\t = %016x\n", regs.R8)
   108  	fmt.Fprintf(&m, "\tRax\t = %016x\n", regs.Rax)
   109  	fmt.Fprintf(&m, "\tRcx\t = %016x\n", regs.Rcx)
   110  	fmt.Fprintf(&m, "\tRdx\t = %016x\n", regs.Rdx)
   111  	fmt.Fprintf(&m, "\tRsi\t = %016x\n", regs.Rsi)
   112  	fmt.Fprintf(&m, "\tRdi\t = %016x\n", regs.Rdi)
   113  	fmt.Fprintf(&m, "\tOrig_rax = %016x\n", regs.Orig_rax)
   114  	fmt.Fprintf(&m, "\tRip\t = %016x\n", regs.Rip)
   115  	fmt.Fprintf(&m, "\tCs\t = %016x\n", regs.Cs)
   116  	fmt.Fprintf(&m, "\tEflags\t = %016x\n", regs.Eflags)
   117  	fmt.Fprintf(&m, "\tRsp\t = %016x\n", regs.Rsp)
   118  	fmt.Fprintf(&m, "\tSs\t = %016x\n", regs.Ss)
   119  	fmt.Fprintf(&m, "\tFs_base\t = %016x\n", regs.Fs_base)
   120  	fmt.Fprintf(&m, "\tGs_base\t = %016x\n", regs.Gs_base)
   121  	fmt.Fprintf(&m, "\tDs\t = %016x\n", regs.Ds)
   122  	fmt.Fprintf(&m, "\tEs\t = %016x\n", regs.Es)
   123  	fmt.Fprintf(&m, "\tFs\t = %016x\n", regs.Fs)
   124  	fmt.Fprintf(&m, "\tGs\t = %016x\n", regs.Gs)
   125  
   126  	return m.String()
   127  }
   128  
   129  // adjustInitregsRip adjust the current register RIP value to
   130  // be just before the system call instruction excution
   131  func (t *thread) adjustInitRegsRip() {
   132  	t.initRegs.Rip -= initRegsRipAdjustment
   133  }
   134  
   135  // Pass the expected PPID to the child via R15 when creating stub process.
   136  func initChildProcessPPID(initregs *arch.Registers, ppid int32) {
   137  	initregs.R15 = uint64(ppid)
   138  	// Rbx has to be set to 1 when creating stub process.
   139  	initregs.Rbx = _NEW_STUB
   140  }
   141  
   142  // patchSignalInfo patches the signal info to account for hitting the seccomp
   143  // filters from vsyscall emulation, specified below. We allow for SIGSYS as a
   144  // synchronous trap, but patch the structure to appear like a SIGSEGV with the
   145  // Rip as the faulting address.
   146  //
   147  // Note that this should only be called after verifying that the signalInfo has
   148  // been generated by the kernel.
   149  // Returns true if the signal info was patched, false otherwise.
   150  func maybePatchSignalInfo(regs *arch.Registers, signalInfo *linux.SignalInfo) bool {
   151  	if signalInfo.Addr() < linux.VSyscallStartAddr ||
   152  		signalInfo.Addr() >= linux.VSyscallEndAddr {
   153  		return false
   154  	}
   155  	// The syscall event was triggered from vsyscall emulation.
   156  	signalInfo.Signo = int32(linux.SIGSEGV)
   157  
   158  	// Unwind the kernel emulation, if any has occurred. A SIGSYS is delivered
   159  	// with the si_call_addr field pointing to the current RIP. This field
   160  	// aligns with the si_addr field for a SIGSEGV, so we don't need to touch
   161  	// anything there. We do need to unwind emulation however, so we set the
   162  	// instruction pointer to the faulting value, and "unpop" the stack.
   163  	regs.Rip = signalInfo.Addr()
   164  	regs.Rsp -= 8
   165  	return true
   166  }
   167  
   168  // enableCpuidFault enables cpuid-faulting.
   169  //
   170  // This may fail on older kernels or hardware, so we just disregard the result.
   171  // Host CPUID will be enabled.
   172  //
   173  // This is safe to call in an afterFork context.
   174  //
   175  //go:nosplit
   176  //go:norace
   177  func enableCpuidFault() {
   178  	unix.RawSyscall6(unix.SYS_ARCH_PRCTL, linux.ARCH_SET_CPUID, 0, 0, 0, 0, 0)
   179  }
   180  
   181  // appendArchSeccompRules append architecture specific seccomp rules when creating BPF program.
   182  // Ref attachedThread() for more detail.
   183  func appendArchSeccompRules(rules []seccomp.RuleSet) []seccomp.RuleSet {
   184  	return append(rules, []seccomp.RuleSet{
   185  		// Rules for trapping vsyscall access.
   186  		{
   187  			Rules: seccomp.SyscallRules{
   188  				unix.SYS_GETTIMEOFDAY: {},
   189  				unix.SYS_TIME:         {},
   190  				unix.SYS_GETCPU:       {}, // SYS_GETCPU was not defined in package syscall on amd64.
   191  			},
   192  			Action:   linux.SECCOMP_RET_TRAP,
   193  			Vsyscall: true,
   194  		},
   195  		{
   196  			Rules: seccomp.SyscallRules{
   197  				unix.SYS_ARCH_PRCTL: []seccomp.Rule{
   198  					{seccomp.EqualTo(linux.ARCH_SET_CPUID), seccomp.EqualTo(0)},
   199  					{seccomp.EqualTo(linux.ARCH_SET_FS)},
   200  					{seccomp.EqualTo(linux.ARCH_GET_FS)},
   201  				},
   202  			},
   203  			Action: linux.SECCOMP_RET_ALLOW,
   204  		},
   205  	}...)
   206  }
   207  
   208  func restoreArchSpecificState(ctx *sysmsg.ThreadContext, ac *arch.Context64) {
   209  }
   210  
   211  func setArchSpecificRegs(sysThread *sysmsgThread, regs *arch.Registers) {
   212  	// Set the start function and initial stack.
   213  	regs.PtraceRegs.Rip = uint64(stubSysmsgStart + uintptr(sysmsg.Sighandler_blob_offset____export_start))
   214  	regs.PtraceRegs.Rsp = uint64(sysmsg.StackAddrToSyshandlerStack(sysThread.sysmsgPerThreadMemAddr()))
   215  
   216  	// Set gs_base; this is the only time we set it and we don't expect it to ever
   217  	// change for any thread.
   218  	regs.Gs_base = sysThread.msg.Self
   219  }
   220  
   221  func retrieveArchSpecificState(ctx *sysmsg.ThreadContext, ac *arch.Context64) {
   222  }
   223  
   224  func archSpecificSysmsgThreadInit(sysThread *sysmsgThread) {
   225  }