SWAMPy

✎ CARVE FLESH

EDITING: bs_trampolines.h

#ifndef TRAMPOLINES_H
#define TRAMPOLINES_H

/*
 * The Linux kernel Spectre CPU bug fix replaces indirect branches with a
 * direct branch to a "return trampoline" thunk (passing the original indirect
 * address as an argument) in order to subvert speculative execution and avoid
 * leaking privileged data from the cache via the CPU bug.  However, the direct
 * branch uses PC-relative addressing, which becomes invalid when we relocate
 * our trampolines to pinned memory to accommodate long-running system calls
 * across driver unloads/reloads, causing panics when the trampoline code is
 * executed.
 *
 * The solution is to disable retpoline thunks in our trampolines.  Compiler
 * versions that don't support this attribute will normally throw a warning
 * (and break the build, since we treat warnings as errors), but we have
 * disabled "unrecognized attribute" warnings for this file in the Makefile.
 *
 * Reference: https://gcc.gnu.org/onlinedocs/gcc/x86-Function-Attributes.html
 */
/*
 * The default driver compilation options add NOP instrumention point in the
 * function prologue. It is "callq .+0", a function call, using a relative
 * address, to the next instruction. In this inactive state it pushes the
 * return address and continues execution.
 *
 * This isn't normally an issue. However, certain kernel instrumention facilities
 * will "fix up" the code, inserting the offset to a data gathering function.
 * Normally, this is OK, but when it happens to the trampolines, BEFORE they
 * are copied to the dynamically trampoline page. When the functions
 * are copied, the offsets now point off into random memory locations, resulting
 * in a kernel crash when executed.
 *
 * The no_instrument_function suppresses the generation of the instrumentation
 * point in the function.
 *
 * Reference: https://gcc.gnu.org/onlinedocs/gcc-3.1/gcc/Function-Attributes.html
 */
#define __nocodefixups __attribute__((indirect_branch("thunk-inline"),no_instrument_function))

#define GET_SUPERTRAMP(st) \
	supertramp_ext_t *ste=NULL; \
	GET_CURCODEPAGE(ste); \
	st = ste->supertramp

#define DECLARE_LINUX_TRAMPOLINE(rettype, name, argsdecl, argsdecl_ret, argspass, argspass_ret, entry_datatype, ID) \
	extern const int name##_size; \
	typedef rettype (*name##_funcptr)argsdecl; \
	typedef entry_datatype (*name##_efuncptr)argsdecl; \
	typedef void (*name##_retfuncptr)argsdecl_ret; \
	__nocodefixups rettype name argsdecl { \
	register supertramp_t *st; \
	trampoline_t* tramp; \
    name##_funcptr func; \
	name##_efuncptr efunc; \
	name##_retfuncptr rfunc; \
	rettype ret=0; \
	entry_datatype edata=NULL; \
	GET_SUPERTRAMP(st); \
	if (st->magic != SUPERTRAMP_MAGIC) { \
		return ret; \
	} \
	tramp = &st->trampolines[ID]; \
	if (tramp->entry_cb) { \
		ATOMIC_INC_32(&tramp->refcnt); \
		efunc = (name##_efuncptr)tramp->entry_cb; \
		if (efunc) edata = efunc argspass; \
		ATOMIC_DEC_32(&tramp->refcnt); \
	} \
	func = (name##_funcptr)tramp->original_funcptr; \
	if (func) ret = func argspass; \
	if (tramp->return_cb) { \
		ATOMIC_INC_32(&tramp->refcnt); \
		rfunc = (name##_retfuncptr)tramp->return_cb; \
		if (rfunc) rfunc argspass_ret; \
		ATOMIC_DEC_32(&tramp->refcnt); \
	} \
	return ret; \
}
#define DECLARE_LINUX_VOID_TRAMPOLINE(name, argsdecl, argsdecl_ret, argspass, argspass_ret, entry_datatype, ID) \
	extern const int name##_size; \
	typedef void (*name##_funcptr)argsdecl; \
	typedef entry_datatype (*name##_efuncptr)argsdecl; \
	typedef void (*name##_retfuncptr)argsdecl_ret; \
	__nocodefixups void name argsdecl { \
	register supertramp_t *st; \
	trampoline_t* tramp; \
    name##_funcptr func; \
	name##_efuncptr efunc; \
	name##_retfuncptr rfunc; \
	entry_datatype edata=NULL; \
	GET_SUPERTRAMP(st); \
	if (st->magic != SUPERTRAMP_MAGIC) { \
		return; \
	} \
	tramp = &st->trampolines[ID]; \
	if (tramp->entry_cb) { \
		ATOMIC_INC_32(&tramp->refcnt); \
		efunc = (name##_efuncptr)tramp->entry_cb; \
		if (efunc) edata = efunc argspass; \
		ATOMIC_DEC_32(&tramp->refcnt); \
	} \
	func = (name##_funcptr)tramp->original_funcptr; \
	if (func) func argspass; \
	if (tramp->return_cb) { \
		ATOMIC_INC_32(&tramp->refcnt); \
		rfunc = (name##_retfuncptr)tramp->return_cb; \
		if (rfunc) rfunc argspass_ret; \
		ATOMIC_DEC_32(&tramp->refcnt); \
	} \
}

#define DECLARE_LINUX_TRAMPOLINE_WITH_SAVESTATE(rettype, name, savestate_datatype, argsdecl, argsdecl_notif, argspass, argspass_notif, ID) \
	typedef rettype (*name##_funcptr)argsdecl; \
	typedef int (*name##_efuncptr)argsdecl_notif; \
	typedef rettype (*name##_retfuncptr)argsdecl_notif; \
	__nocodefixups rettype name argsdecl { \
	register supertramp_t *st; \
	trampoline_t* tramp; \
    name##_funcptr func; \
	name##_efuncptr efunc; \
	name##_retfuncptr rfunc; \
	rettype ret = 0; \
	int savestate_flag = 0; \
	savestate_datatype savedata; \
	GET_SUPERTRAMP(st); \
	if (st->magic != SUPERTRAMP_MAGIC) { \
		return ret; \
	} \
	tramp = &st->trampolines[ID]; \
	if (tramp->entry_cb) { \
		ATOMIC_INC_32(&tramp->refcnt); \
		efunc = (name##_efuncptr)tramp->entry_cb; \
		if (efunc) savestate_flag = efunc argspass_notif; \
		ATOMIC_DEC_32(&tramp->refcnt); \
	} \
	func = (name##_funcptr)tramp->original_funcptr; \
	if (func) ret = func argspass; \
	if (savestate_flag && tramp->return_cb) { \
		ATOMIC_INC_32(&tramp->refcnt); \
		rfunc = (name##_retfuncptr)tramp->return_cb; \
		if (rfunc) rfunc argspass_notif; \
		ATOMIC_DEC_32(&tramp->refcnt); \
	} \
	return ret; \
}

#define INET_POLL_FUNC_ID		0
#define INET_RECVMSG_FUNC_ID	1
#define INET_SENDMSG_FUNC_ID	2
#define INET_ACCEPT_FUNC_ID		3
#define INET_LISTEN_FUNC_ID		4
#define INET_CONNECT_FUNC_ID	5
#define SOCK_DEF_WAKEUP_FUNC_ID	6
#define INET_RELEASE_FUNC_ID	7
#define SOCK_DEF_ERROR_REPORT_FUNC_ID 8
#define INET_UDP_RECVMSG_FUNC_ID	9
#define INET_UDP_SENDMSG_FUNC_ID	10

#define INET6_POLL_FUNC_ID		11
#define INET6_RECVMSG_FUNC_ID	12
#define INET6_SENDMSG_FUNC_ID	13
#define INET6_ACCEPT_FUNC_ID	14
#define INET6_LISTEN_FUNC_ID	15
#define INET6_CONNECT_FUNC_ID	16
#define INET6_RELEASE_FUNC_ID	17
#define INET6_UDP_RECVMSG_FUNC_ID	18
#define INET6_UDP_SENDMSG_FUNC_ID	19

#define FIRST_V6_TRAMPOLINE INET6_POLL_FUNC_ID
#define NUM_V4_TRAMPOLINES      11
#define NUM_TRAMPOLINES			20

#define LINUX_SUPERTRAMP_VER 8

#if LINUX_VERSION_CODE >= KERNEL_VERSION(4,1,0)
#define KIOCB_DECL
#define KIOCB_ARG
#else
#define KIOCB_DECL struct kiocb *iocb,
#define KIOCB_ARG iocb,
#endif

unsigned int inet_poll_trampoline (struct file *file, struct socket *sock, poll_table *wait);
unsigned int inet6_poll_trampoline(struct file *file, struct socket *sock, poll_table *wait);

int inet_recvmsg_trampoline (KIOCB_DECL struct socket *sock, struct msghdr *msg, size_t len, int flags);
int inet6_recvmsg_trampoline(KIOCB_DECL struct socket *sock, struct msghdr *msg, size_t len, int flags);
int inet_udp_recvmsg_trampoline (KIOCB_DECL struct socket *sock, struct msghdr *msg, size_t len, int flags);
int inet6_udp_recvmsg_trampoline(KIOCB_DECL struct socket *sock, struct msghdr *msg, size_t len, int flags);

int inet_sendmsg_trampoline (KIOCB_DECL struct socket *sock, struct msghdr *msg, size_t size);
int inet6_sendmsg_trampoline(KIOCB_DECL struct socket *sock, struct msghdr *msg, size_t size);
int inet_udp_sendmsg_trampoline (KIOCB_DECL struct socket *sock, struct msghdr *msg, size_t size);
int inet6_udp_sendmsg_trampoline(KIOCB_DECL struct socket *sock, struct msghdr *msg, size_t size);

int inet_accept_trampoline(struct socket *sock, struct socket *newsock, int flags);
int inet6_accept_trampoline(struct socket *sock, struct socket *newsock, int flags);

int inet_listen_trampoline(struct socket *sock, int backlog);
int inet6_listen_trampoline(struct socket *sock, int backlog);

int inet_connect_trampoline(struct socket *sock, struct sockaddr *uaddr, int addr_len, int flags);
int inet6_connect_trampoline(struct socket *sock, struct sockaddr *uaddr, int addr_len, int flags);

int inet_release_trampoline(struct socket *sock);
int inet6_release_trampoline(struct socket *sock);

// For state_change, what about modifying sock.sk_state_change,sk_error_report to point to trampolines?
// We could do the modify in a connect() hook.
// Or we can punt and just fault-in async-connects
void sock_def_wakeup_trampoline(struct sock *sk);
void sock_def_error_report_trampoline(struct sock *sk);

// Supertramp port: sock_create may not be readily available, try net_proto_family.create
//static int hookret_sock_create_kern(struct kretprobe_instance *ri, struct pt_regs *regs);
//static int hookret_sock_create(int family, int type, int protocol, struct socket **res);

#endif

CANCEL

Name	Type	Size	Modified	Actions
↩ ..	DIR	—	—
📁 bluechannel/	DIR	—	2022-12-06 04:06
📄 bs_driver.c	C	40.4 KB	2023-06-26 03:19	EDIT
📄 bs_driver.h	H	4.6 KB	2023-06-26 03:19	EDIT
📄 bs_gpl_fixes.h	H	467 B	2023-06-26 03:19	EDIT
📄 bs_hooks.c	C	33.8 KB	2023-06-26 03:19	EDIT
📄 bs_trampolines.c	C	6.4 KB	2023-06-26 03:19	EDIT
📄 bs_trampolines.h	H	8.4 KB	2023-06-26 03:19	EDIT
📄 bsioctl.c	C	6.8 KB	2023-06-26 03:19	EDIT
📄 bsioctl.h	H	1.9 KB	2023-06-26 03:19	EDIT
📄 collectorcmd.c	C	4.4 KB	2023-06-26 03:19	EDIT
📄 ehook.c	C	3 KB	2023-06-26 03:19	EDIT
📄 extants.c	C	12.4 KB	2023-06-26 03:19	EDIT
📄 iov_compress.c	C	5.7 KB	2023-06-26 03:19	EDIT
📄 iov_compress.h	H	242 B	2023-06-26 03:19	EDIT
📄 linux_oscompat.c	C	15.8 KB	2023-06-26 03:19	EDIT
📄 linux_oscompat.h	H	3.7 KB	2023-06-26 03:19	EDIT
📄 Makefile	?	4.1 KB	2023-06-26 03:19	EDIT
📄 memcpy.c	C	201 B	2023-06-26 03:19	EDIT
📄 netnotifiers.c	C	3.7 KB	2023-06-26 03:19	EDIT
📄 netnotifiers.h	H	330 B	2023-06-26 03:19	EDIT
📄 proto.c	C	368 B	2023-06-26 03:19	EDIT
📄 sock_context.c	C	7.9 KB	2023-06-26 03:19	EDIT
📄 sock_context.h	H	3.6 KB	2023-06-26 03:19	EDIT
📄 tcphelpers.c	C	2.8 KB	2023-06-26 03:19	EDIT
📄 tcphelpers.h	H	1.4 KB	2023-06-26 03:19	EDIT
📄 verifier.c	C	2 KB	2023-06-26 03:19	EDIT
📄 verifier.h	H	918 B	2023-06-26 03:19	EDIT
📄 version.h	H	238 B	2023-06-26 03:19	EDIT