aboutsummaryrefslogtreecommitdiff
path: root/src/runtime/sys_freebsd_arm64.s
AgeCommit message (Collapse)Author
2023-06-06runtime: implement SUID/SGID protectionsRoland Shoemaker
On Unix platforms, the runtime previously did nothing special when a program was run with either the SUID or SGID bits set. This can be dangerous in certain cases, such as when dumping memory state, or assuming the status of standard i/o file descriptors. Taking cues from glibc, this change implements a set of protections when a binary is run with SUID or SGID bits set (or is SUID/SGID-like). On Linux, whether to enable these protections is determined by whether the AT_SECURE flag is passed in the auxiliary vector. On platforms which have the issetugid syscall (the BSDs, darwin, and Solaris/Illumos), that is used. On the remaining platforms (currently only AIX) we check !(getuid() == geteuid() && getgid == getegid()). Currently when we determine a binary is "tainted" (using the glibc terminology), we implement two specific protections: 1. we check if the file descriptors 0, 1, and 2 are open, and if they are not, we open them, pointing at /dev/null (or fail). 2. we force GOTRACKBACK=none, and generally prevent dumping of trackbacks and registers when a program panics/aborts. In the future we may add additional protections. This change requires implementing issetugid on the platforms which support it, and implementing getuid, geteuid, getgid, and getegid on AIX. Thanks to Vincent Dehors from Synacktiv for reporting this issue. Fixes #60272 Fixes CVE-2023-29403 Change-Id: I73fc93f2b7a8933c192ce3eabbf1db359db7d5fa Reviewed-on: https://team-review.git.corp.google.com/c/golang/go-private/+/1878434 Reviewed-by: Damien Neil <dneil@google.com> Reviewed-by: Ian Lance Taylor <iant@google.com> Run-TryBot: Roland Shoemaker <bracewell@google.com> Reviewed-by: Russ Cox <rsc@google.com> Reviewed-on: https://go-review.googlesource.com/c/go/+/501223 Run-TryBot: David Chase <drchase@google.com> Reviewed-by: Michael Knyszek <mknyszek@google.com> TryBot-Result: Gopher Robot <gobot@golang.org>
2023-05-22runtime: remove some unused constants from assembler codeIan Lance Taylor
Change-Id: Ibcd919afcb7ff4db79036ef427d088097362a574 Reviewed-on: https://go-review.googlesource.com/c/go/+/496695 Reviewed-by: Michael Pratt <mpratt@google.com> Auto-Submit: Ian Lance Taylor <iant@google.com> TryBot-Result: Gopher Robot <gobot@golang.org> Run-TryBot: Ian Lance Taylor <iant@google.com> Reviewed-by: Ian Lance Taylor <iant@google.com> Run-TryBot: Ian Lance Taylor <iant@golang.org>
2023-05-20runtime: consolidate on a single closeonexec definitionIan Lance Taylor
Now that we implement fcntl on all Unix systems, we can write closeonexec that uses it. This lets us remove a bunch of assembler code. Change-Id: If35591df535ccfc67292086a9492f0a8920e3681 Reviewed-on: https://go-review.googlesource.com/c/go/+/496081 Reviewed-by: Brad Fitzpatrick <bradfitz@golang.org> Run-TryBot: Ian Lance Taylor <iant@google.com> Run-TryBot: Ian Lance Taylor <iant@golang.org> Auto-Submit: Ian Lance Taylor <iant@google.com> TryBot-Result: Gopher Robot <gobot@golang.org> Reviewed-by: Bryan Mills <bcmills@google.com> Reviewed-by: Ian Lance Taylor <iant@google.com>
2023-05-20runtime: change fcntl to return two valuesIan Lance Taylor
Separate the result and the errno value, rather than assuming that the result can never be negative. Change-Id: Ib01a70a3d46285aa77e95371cdde74e1504e7c12 Reviewed-on: https://go-review.googlesource.com/c/go/+/496416 Run-TryBot: Ian Lance Taylor <iant@golang.org> Run-TryBot: Ian Lance Taylor <iant@google.com> TryBot-Result: Gopher Robot <gobot@golang.org> Reviewed-by: Ian Lance Taylor <iant@google.com> Reviewed-by: Bryan Mills <bcmills@google.com> Auto-Submit: Ian Lance Taylor <iant@google.com>
2023-05-17runtime: consistently define fcntlIan Lance Taylor
Clean up and consolidate on a single consistent definition of fcntl, which takes three int32 arguments and returns either a positive result or a negative errno value. Change-Id: Id9505492712db4b0aab469c6bd15e4fce3c9ff6e Reviewed-on: https://go-review.googlesource.com/c/go/+/495075 Run-TryBot: Ian Lance Taylor <iant@golang.org> Reviewed-by: Ian Lance Taylor <iant@google.com> TryBot-Result: Gopher Robot <gobot@golang.org> Auto-Submit: Ian Lance Taylor <iant@google.com> Run-TryBot: Ian Lance Taylor <iant@google.com> Reviewed-by: Tobias Klauser <tobias.klauser@gmail.com> Reviewed-by: Michael Pratt <mpratt@google.com>
2023-03-17runtime: remove arm64 non-register ABI fallback codeJoel Sing
This presumably got missed in CL 393875. Change-Id: I4f2de00ebd6ec405d5e289a7f8c2fc781607260b Reviewed-on: https://go-review.googlesource.com/c/go/+/475617 TryBot-Result: Gopher Robot <gobot@golang.org> Run-TryBot: Joel Sing <joel@sing.id.au> Reviewed-by: Cherry Mui <cherryyz@google.com> Reviewed-by: Dmitri Shuralyov <dmitshur@google.com>
2022-10-18runtime: always keep global reference to mp until mexit completesMichael Pratt
Ms are allocated via standard heap allocation (`new(m)`), which means we must keep them alive (i.e., reachable by the GC) until we are completely done using them. Ms are primarily reachable through runtime.allm. However, runtime.mexit drops the M from allm fairly early, long before it is done using the M structure. If that was the last reference to the M, it is now at risk of being freed by the GC and used for some other allocation, leading to memory corruption. Ms with a Go-allocated stack coincidentally already keep a reference to the M in sched.freem, so that the stack can be freed lazily. This reference has the side effect of keeping this Ms reachable. However, Ms with an OS stack skip this and are at risk of corruption. Fix this lifetime by extending sched.freem use to all Ms, with the value of mp.freeWait determining whether the stack needs to be freed or not. Fixes #56243. Change-Id: Ic0c01684775f5646970df507111c9abaac0ba52e Reviewed-on: https://go-review.googlesource.com/c/go/+/443716 TryBot-Result: Gopher Robot <gobot@golang.org> Run-TryBot: Michael Pratt <mpratt@google.com> Reviewed-by: Michael Knyszek <mknyszek@google.com>
2022-09-16runtime: switch FreeBSD to use the non-COMPAT_FREEBSD11 version of the ↵Yuval Pavel Zholkover
kevent syscall Update #53280 Change-Id: I1c8d4510fbe8bdfe9a41575bde54ea2fbf6b67e9 Reviewed-on: https://go-review.googlesource.com/c/go/+/413174 Reviewed-by: Dmitri Goutnik <dgoutnik@gmail.com> TryBot-Result: Gopher Robot <gobot@golang.org> Reviewed-by: Bryan Mills <bcmills@google.com> Reviewed-by: Ian Lance Taylor <iant@google.com> Run-TryBot: Yuval Pavel Zholkover <paulzhol@gmail.com>
2022-09-04runtime: fast clock_gettime on FreeBSD, use physical/virtual ARM timerYuval Pavel Zholkover
as setup by the kernel on GOARCH=arm64. Update #50947 Change-Id: I2f44be9b36e9ce8d264eccc0aa3df10825c5f4f9 Reviewed-on: https://go-review.googlesource.com/c/go/+/422977 Reviewed-by: Heschi Kreinick <heschi@google.com> Reviewed-by: Ian Lance Taylor <iant@google.com> TryBot-Result: Gopher Robot <gobot@golang.org> Reviewed-by: Meng Zhuo <mzh@golangcn.org> Reviewed-by: Dmitri Goutnik <dgoutnik@gmail.com> Run-TryBot: Yuval Pavel Zholkover <paulzhol@gmail.com>
2022-04-28runtime: mark sigtramp as TOPFRAME on the rest of unixMichael Pratt
This extends CL 402190 from Linux to the rest of the Unix OSes. Marking sigtramp as TOPFRAME allows gentraceback to stop tracebacks at the end of a signal handler, since there is not much beyond sigtramp. Change-Id: I8b7f5d55d41889f59c0a79c65351b9b0b2d77717 Reviewed-on: https://go-review.googlesource.com/c/go/+/402934 Reviewed-by: Cherry Mui <cherryyz@google.com> Reviewed-by: Austin Clements <austin@google.com> Auto-Submit: Michael Pratt <mpratt@google.com> TryBot-Result: Gopher Robot <gobot@golang.org> Run-TryBot: Michael Pratt <mpratt@google.com>
2022-04-26runtime: use ABIInternal for most calls to sigtrampgoMichael Pratt
sigtramp on openbsd-arm64 is teetering on the edge of the nosplit stack limit. Add more headroom by calling sigtrampgo using ABIInternal, which eliminates a 48-byte ABI wrapper frame. openbsd-amd64 has slightly more space, but is also close to the limit, so convert it as well. Other operating systems don't have it as bad, but many have nearly identical implementations of sigtramp, so I have converted them as well. I've omitted darwin-arm64 and solaris, as those are quite different and would benefit from not needing ifdef for both cases. For #51485. Change-Id: I70512645d4208b346a59d5e5d03836a45833b1d7 Reviewed-on: https://go-review.googlesource.com/c/go/+/390814 Run-TryBot: Michael Pratt <mpratt@google.com> TryBot-Result: Gopher Robot <gobot@golang.org> Reviewed-by: Cherry Mui <cherryyz@google.com>
2022-03-30runtime: unify C->Go ABI transitions on arm64eric fang
There are several of places that save and restore the C callee-saved registers, the operation is the same everywhere, so this CL defines several macros to do this, which will help reduce code redundancy and unify the operation. This CL also replaced consecutive MOVD instructions with STP and LDP instructions in several places where these macros do not apply. Change-Id: I815f39fe484a9ab9b6bd157dfcbc8ad99c1420fe Reviewed-on: https://go-review.googlesource.com/c/go/+/374397 Trust: Eric Fang <eric.fang@arm.com> Run-TryBot: Eric Fang <eric.fang@arm.com> TryBot-Result: Gopher Robot <gobot@golang.org> Reviewed-by: Cherry Mui <cherryyz@google.com>
2022-03-03runtime: remove fallback to pipe on platforms with pipe2Tobias Klauser
On Linux, the minimum required kernel version for Go 1.18 was be changed to 2.6.32, see #45964. The pipe2 syscall was added in 2.6.27. All other platforms already provide the pipe2 syscall in the minimum supported version: - DragonFly BSD added it in version 4.2, see https://www.dragonflybsd.org/release42/ - FreeBSD added it in version 10.0, see https://www.freebsd.org/cgi/man.cgi?pipe(2)#end - NetBSD added it in version 6.0, see https://man.netbsd.org/pipe2.2#HISTORY - OpenBSD added it in version 5.7, see https://man.openbsd.org/pipe.2#HISTORY - Illumos supports it since 2013, see https://www.illumos.org/issues/3714 - Solaris supports it since 11.4 This also allows to remove setNonblock which was only used in the pipe fallback path on these platforms. Change-Id: I1f40d32fd3065d74e22af77b9ff2292b9cf66706 Reviewed-on: https://go-review.googlesource.com/c/go/+/389354 Trust: Tobias Klauser <tobias.klauser@gmail.com> Run-TryBot: Tobias Klauser <tobias.klauser@gmail.com> TryBot-Result: Gopher Robot <gobot@golang.org> Reviewed-by: Ian Lance Taylor <iant@golang.org>
2020-12-22runtime: correct error handling in several FreeBSD syscall wrappersNikhil Benesch
The FreeBSD syscall convention uses the carry flag to indicate whether an error has occured. The sys_umtx_op, thr_new, and pipe2 syscall wrappers were failing to account for this convention and silently suppressing errors as a result. This commit corrects these wrappers by copying the pattern used by the other fallible syscall wrappers. Note that futexsleep1 must now explicitly ignore the ETIMEDOUT error from sys_umtx_op. Previously ETIMEDOUT was implicitly ignored because sys_umtx_op never returned an error. Fixes #43106. Change-Id: I9c422b87cf4c6d308003bf42c3b419f785578b5d Reviewed-on: https://go-review.googlesource.com/c/go/+/276892 Run-TryBot: Ian Lance Taylor <iant@golang.org> Reviewed-by: Austin Clements <austin@google.com> Trust: Than McIntosh <thanm@google.com>
2020-10-20internal/cpu: consolidate arm64 feature detectionMartin Möhrmann
Move code to detect and mask arm64 CPU features from runtime to internal/cpu. Change-Id: Ib784e2ff056e8def125d68827b852f07a3eff0db Reviewed-on: https://go-review.googlesource.com/c/go/+/261878 Trust: Martin Möhrmann <moehrmann@google.com> Trust: Tobias Klauser <tobias.klauser@gmail.com> Run-TryBot: Tobias Klauser <tobias.klauser@gmail.com> TryBot-Result: Go Bot <gobot@golang.org> Reviewed-by: Tobias Klauser <tobias.klauser@gmail.com> Reviewed-by: Benny Siegert <bsiegert@gmail.com>
2020-01-08runtime: use FP offsets for pipe/pipe2 on freebsd/arm64 and linux/arm64Joel Sing
This is more readable and less error-prone than using RSP offsets. Suggested during review of CL 212765. Change-Id: I070190abeeac8eae5dbd414407602619d9d57422 Reviewed-on: https://go-review.googlesource.com/c/go/+/213577 Run-TryBot: Ian Lance Taylor <iant@golang.org> TryBot-Result: Gobot Gobot <gobot@golang.org> Reviewed-by: Cherry Zhang <cherryyz@google.com>
2019-12-10runtime: use MRS instruction to read system registers on freebsd/arm64Tobias Klauser
Support for these was added in CL 189577 Change-Id: Iaf2a774b141995cbbdfb3888aea67ae9c7f928b1 Reviewed-on: https://go-review.googlesource.com/c/go/+/210677 Run-TryBot: Tobias Klauser <tobias.klauser@gmail.com> TryBot-Result: Gobot Gobot <gobot@golang.org> Reviewed-by: Ian Lance Taylor <iant@golang.org>
2019-10-26runtime: M-targeted signals for BSDsAustin Clements
For these, we split up the existing runtime.raise assembly implementation into its constituent "get thread ID" and "signal thread" parts. This lets us implement signalM and reimplement raise in pure Go. (NetBSD conveniently already had lwp_self.) We also change minit to store the procid directly, rather than depending on newosproc to do so. This is because newosproc isn't called for the bootstrap M, but we need a procid for every M. This is also simpler overall. For #10958, #24543. Change-Id: Ie5f1fcada6a33046375066bcbe054d1f784d39c0 Reviewed-on: https://go-review.googlesource.com/c/go/+/201402 Run-TryBot: Austin Clements <austin@google.com> Reviewed-by: Cherry Zhang <cherryyz@google.com>
2019-10-25runtime: define emptyfunc as static function in assembly for freebsd/arm64Tobias Klauser
CL 198544 broke the linux/arm64 build because it declares emptyfunc for GOARCH=arm64, but only freebsd/arm64 defines it. Make it a static assembly function specific for freebsd/arm64 and remove the stub. Fixes #35160 Change-Id: I5fd94249b60c6fd259c251407b6eccc8fa512934 Reviewed-on: https://go-review.googlesource.com/c/go/+/203418 Reviewed-by: Bryan C. Mills <bcmills@google.com>
2019-10-25runtime: add support for freebsd/arm64Tobias Klauser
Based on work by Mikaël Urankar (@MikaelUrankar), Shigeru YAMAMOTO (@bsd-hacker) and @myfreeweb. Updates #24715 Change-Id: If3189a693ca0aa627029e22b0f91534bcf322bc0 Reviewed-on: https://go-review.googlesource.com/c/go/+/198544 Run-TryBot: Tobias Klauser <tobias.klauser@gmail.com> TryBot-Result: Gobot Gobot <gobot@golang.org> Reviewed-by: Brad Fitzpatrick <bradfitz@golang.org>
generated by cgit v1.3 (git 2.53.0) at 2026-04-16 03:10:13 +0000