[src/trunk]: src/sys/arch/amd64/amd64 Remove this call gate on amd64, it is u...

[maxv <maxv%NetBSD.org@localhost>]

details:   https://anonhg.NetBSD.org/src/rev/70c9690afcf4
branches:  trunk
changeset: 352268:70c9690afcf4
user:      maxv <maxv%NetBSD.org@localhost>
date:      Thu Mar 23 17:25:51 2017 +0000

description:
Remove this call gate on amd64, it is useless and vulnerable.

Call gates do not modify %rflags, so interrupts are not disabled when
entering the gate. There is a small window where we are in kernel mode and
with a userland %gs, and if an interrupt happens here we will rejump into
the kernel but not switch to the kernel TLS.

Userland can simply perform a gate call in a loop, and hope that at some
point an interrupt will be received in this window - which necessarily will
be the case. With a specially-crafted %gs it is certainly enough to
escalate privileges.

diffstat:

 sys/arch/amd64/amd64/locore.S  |  23 +----------------------
 sys/arch/amd64/amd64/machdep.c |  20 +++-----------------
 sys/arch/amd64/amd64/trap.c    |   8 +++-----
 3 files changed, 7 insertions(+), 44 deletions(-)

diffs (129 lines):

diff -r bf1c8fcf979a -r 70c9690afcf4 sys/arch/amd64/amd64/locore.S
--- a/sys/arch/amd64/amd64/locore.S     Thu Mar 23 15:50:48 2017 +0000
+++ b/sys/arch/amd64/amd64/locore.S     Thu Mar 23 17:25:51 2017 +0000
@@ -1,4 +1,4 @@
-/*     $NetBSD: locore.S,v 1.121 2017/02/09 19:30:56 maxv Exp $        */
+/*     $NetBSD: locore.S,v 1.122 2017/03/23 17:25:51 maxv Exp $        */
 
 /*
  * Copyright-o-rama!
@@ -1399,27 +1399,6 @@
 END(lwp_trampoline)
 
 /*
- * oosyscall()
- *
- * Old call gate entry for syscall. only needed if we're
- * going to support running old i386 NetBSD 1.0 or ibcs2 binaries, etc,
- * on NetBSD/amd64.
- * The 64bit call gate can't request that arguments be copied from the
- * user stack (which the i386 code uses to get a gap for the flags).
- * push/pop are <read>:<modify_sp>:<write> cycles.
- */
-IDTVEC(oosyscall)
-       /* Set rflags in trap frame. */
-       pushq   (%rsp)          /* move user's %eip */
-       pushq   16(%rsp)        /* and %cs */
-       popq    8(%rsp)
-       pushfq
-       popq    16(%rsp)
-       pushq   $7              /* size of instruction for restart */
-       jmp     osyscall1
-IDTVEC_END(oosyscall)
-
-/*
  * osyscall()
  *
  * Trap gate entry for int $80 syscall, also used by sigreturn.
diff -r bf1c8fcf979a -r 70c9690afcf4 sys/arch/amd64/amd64/machdep.c
--- a/sys/arch/amd64/amd64/machdep.c    Thu Mar 23 15:50:48 2017 +0000
+++ b/sys/arch/amd64/amd64/machdep.c    Thu Mar 23 17:25:51 2017 +0000
@@ -1,4 +1,4 @@
-/*     $NetBSD: machdep.c,v 1.253 2017/03/10 14:54:12 maxv Exp $       */
+/*     $NetBSD: machdep.c,v 1.254 2017/03/23 17:25:51 maxv Exp $       */
 
 /*-
  * Copyright (c) 1996, 1997, 1998, 2000, 2006, 2007, 2008, 2011
@@ -111,7 +111,7 @@
  */
 
 #include <sys/cdefs.h>
-__KERNEL_RCSID(0, "$NetBSD: machdep.c,v 1.253 2017/03/10 14:54:12 maxv Exp $");
+__KERNEL_RCSID(0, "$NetBSD: machdep.c,v 1.254 2017/03/23 17:25:51 maxv Exp $");
 
 /* #define XENDEBUG_LOW  */
 
@@ -1452,7 +1452,6 @@
 extern vector IDTVEC(syscall);
 extern vector IDTVEC(syscall32);
 extern vector IDTVEC(osyscall);
-extern vector IDTVEC(oosyscall);
 extern vector *IDTVEC(exceptions)[];
 
 static void
@@ -1642,11 +1641,8 @@
 #endif
 
        /*
-        * Make LDT gates and memory segments.
+        * Make LDT memory segments.
         */
-       setgate((struct gate_descriptor *)(ldtstore + LSYS5CALLS_SEL),
-           &IDTVEC(oosyscall), 0, SDT_SYS386CGT, SEL_UPL,
-           GSEL(GCODE_SEL, SEL_KPL));
        *(struct mem_segment_descriptor *)(ldtstore + LUCODE_SEL) =
            *GDT_ADDR_MEM(gdtstore, GUCODE_SEL);
        *(struct mem_segment_descriptor *)(ldtstore + LUDATA_SEL) =
@@ -1677,16 +1673,6 @@
        set_mem_segment(ldt_segp, 0, x86_btop(VM_MAXUSER_ADDRESS32) - 1,
            SDT_MEMRWA, SEL_UPL, 1, 1, 0);
 
-       /*
-        * Other LDT entries.
-        */
-       memcpy((struct gate_descriptor *)(ldtstore + LSOL26CALLS_SEL),
-           (struct gate_descriptor *)(ldtstore + LSYS5CALLS_SEL),
-           sizeof (struct gate_descriptor));
-       memcpy((struct gate_descriptor *)(ldtstore + LBSDICALLS_SEL),
-           (struct gate_descriptor *)(ldtstore + LSYS5CALLS_SEL),
-           sizeof (struct gate_descriptor));
-
        /* CPU-specific IDT exceptions. */
        for (x = 0; x < NCPUIDT; x++) {
 #ifndef XEN
diff -r bf1c8fcf979a -r 70c9690afcf4 sys/arch/amd64/amd64/trap.c
--- a/sys/arch/amd64/amd64/trap.c       Thu Mar 23 15:50:48 2017 +0000
+++ b/sys/arch/amd64/amd64/trap.c       Thu Mar 23 17:25:51 2017 +0000
@@ -1,4 +1,4 @@
-/*     $NetBSD: trap.c,v 1.94 2017/03/18 13:39:23 maxv Exp $   */
+/*     $NetBSD: trap.c,v 1.95 2017/03/23 17:25:51 maxv Exp $   */
 
 /*-
  * Copyright (c) 1998, 2000 The NetBSD Foundation, Inc.
@@ -68,7 +68,7 @@
  */
 
 #include <sys/cdefs.h>
-__KERNEL_RCSID(0, "$NetBSD: trap.c,v 1.94 2017/03/18 13:39:23 maxv Exp $");
+__KERNEL_RCSID(0, "$NetBSD: trap.c,v 1.95 2017/03/23 17:25:51 maxv Exp $");
 
 #include "opt_ddb.h"
 #include "opt_kgdb.h"
@@ -222,7 +222,6 @@
        struct proc *p;
        struct pcb *pcb;
        extern char fusuintrfailure[], kcopy_fault[];
-       extern char IDTVEC(oosyscall)[];
        extern char IDTVEC(osyscall)[];
        extern char IDTVEC(syscall32)[];
 #ifndef XEN
@@ -692,8 +691,7 @@
                        break;
 
                /* Check whether they single-stepped into a lcall. */
-               if (frame->tf_rip == (uint64_t)IDTVEC(oosyscall) ||
-                   frame->tf_rip == (uint64_t)IDTVEC(osyscall) ||
+               if (frame->tf_rip == (uint64_t)IDTVEC(osyscall) ||
                    frame->tf_rip == (uint64_t)IDTVEC(syscall32)) {
                        frame->tf_rflags &= ~PSL_T;
                        return;