Loading...
1/*
2 * Copyright (C) 2002- 2007 Jeff Dike (jdike@{addtoit,linux.intel}.com)
3 * Licensed under the GPL
4 */
5
6#include <stdlib.h>
7#include <unistd.h>
8#include <sched.h>
9#include <errno.h>
10#include <string.h>
11#include <sys/mman.h>
12#include <sys/wait.h>
13#include <asm/unistd.h>
14#include "as-layout.h"
15#include "init.h"
16#include "kern_util.h"
17#include "mem.h"
18#include "os.h"
19#include "proc_mm.h"
20#include "ptrace_user.h"
21#include "registers.h"
22#include "skas.h"
23#include "skas_ptrace.h"
24#include "sysdep/stub.h"
25
26int is_skas_winch(int pid, int fd, void *data)
27{
28 return pid == getpgrp();
29}
30
31static int ptrace_dump_regs(int pid)
32{
33 unsigned long regs[MAX_REG_NR];
34 int i;
35
36 if (ptrace(PTRACE_GETREGS, pid, 0, regs) < 0)
37 return -errno;
38
39 printk(UM_KERN_ERR "Stub registers -\n");
40 for (i = 0; i < ARRAY_SIZE(regs); i++)
41 printk(UM_KERN_ERR "\t%d - %lx\n", i, regs[i]);
42
43 return 0;
44}
45
46/*
47 * Signals that are OK to receive in the stub - we'll just continue it.
48 * SIGWINCH will happen when UML is inside a detached screen.
49 */
50#define STUB_SIG_MASK ((1 << SIGVTALRM) | (1 << SIGWINCH))
51
52/* Signals that the stub will finish with - anything else is an error */
53#define STUB_DONE_MASK (1 << SIGTRAP)
54
55void wait_stub_done(int pid)
56{
57 int n, status, err;
58
59 while (1) {
60 CATCH_EINTR(n = waitpid(pid, &status, WUNTRACED | __WALL));
61 if ((n < 0) || !WIFSTOPPED(status))
62 goto bad_wait;
63
64 if (((1 << WSTOPSIG(status)) & STUB_SIG_MASK) == 0)
65 break;
66
67 err = ptrace(PTRACE_CONT, pid, 0, 0);
68 if (err) {
69 printk(UM_KERN_ERR "wait_stub_done : continue failed, "
70 "errno = %d\n", errno);
71 fatal_sigsegv();
72 }
73 }
74
75 if (((1 << WSTOPSIG(status)) & STUB_DONE_MASK) != 0)
76 return;
77
78bad_wait:
79 err = ptrace_dump_regs(pid);
80 if (err)
81 printk(UM_KERN_ERR "Failed to get registers from stub, "
82 "errno = %d\n", -err);
83 printk(UM_KERN_ERR "wait_stub_done : failed to wait for SIGTRAP, "
84 "pid = %d, n = %d, errno = %d, status = 0x%x\n", pid, n, errno,
85 status);
86 fatal_sigsegv();
87}
88
89extern unsigned long current_stub_stack(void);
90
91static void get_skas_faultinfo(int pid, struct faultinfo *fi)
92{
93 int err;
94
95 if (ptrace_faultinfo) {
96 err = ptrace(PTRACE_FAULTINFO, pid, 0, fi);
97 if (err) {
98 printk(UM_KERN_ERR "get_skas_faultinfo - "
99 "PTRACE_FAULTINFO failed, errno = %d\n", errno);
100 fatal_sigsegv();
101 }
102
103 /* Special handling for i386, which has different structs */
104 if (sizeof(struct ptrace_faultinfo) < sizeof(struct faultinfo))
105 memset((char *)fi + sizeof(struct ptrace_faultinfo), 0,
106 sizeof(struct faultinfo) -
107 sizeof(struct ptrace_faultinfo));
108 }
109 else {
110 unsigned long fpregs[FP_SIZE];
111
112 err = get_fp_registers(pid, fpregs);
113 if (err < 0) {
114 printk(UM_KERN_ERR "save_fp_registers returned %d\n",
115 err);
116 fatal_sigsegv();
117 }
118 err = ptrace(PTRACE_CONT, pid, 0, SIGSEGV);
119 if (err) {
120 printk(UM_KERN_ERR "Failed to continue stub, pid = %d, "
121 "errno = %d\n", pid, errno);
122 fatal_sigsegv();
123 }
124 wait_stub_done(pid);
125
126 /*
127 * faultinfo is prepared by the stub-segv-handler at start of
128 * the stub stack page. We just have to copy it.
129 */
130 memcpy(fi, (void *)current_stub_stack(), sizeof(*fi));
131
132 err = put_fp_registers(pid, fpregs);
133 if (err < 0) {
134 printk(UM_KERN_ERR "put_fp_registers returned %d\n",
135 err);
136 fatal_sigsegv();
137 }
138 }
139}
140
141static void handle_segv(int pid, struct uml_pt_regs * regs)
142{
143 get_skas_faultinfo(pid, ®s->faultinfo);
144 segv(regs->faultinfo, 0, 1, NULL);
145}
146
147/*
148 * To use the same value of using_sysemu as the caller, ask it that value
149 * (in local_using_sysemu
150 */
151static void handle_trap(int pid, struct uml_pt_regs *regs,
152 int local_using_sysemu)
153{
154 int err, status;
155
156 if ((UPT_IP(regs) >= STUB_START) && (UPT_IP(regs) < STUB_END))
157 fatal_sigsegv();
158
159 /* Mark this as a syscall */
160 UPT_SYSCALL_NR(regs) = PT_SYSCALL_NR(regs->gp);
161
162 if (!local_using_sysemu)
163 {
164 err = ptrace(PTRACE_POKEUSER, pid, PT_SYSCALL_NR_OFFSET,
165 __NR_getpid);
166 if (err < 0) {
167 printk(UM_KERN_ERR "handle_trap - nullifying syscall "
168 "failed, errno = %d\n", errno);
169 fatal_sigsegv();
170 }
171
172 err = ptrace(PTRACE_SYSCALL, pid, 0, 0);
173 if (err < 0) {
174 printk(UM_KERN_ERR "handle_trap - continuing to end of "
175 "syscall failed, errno = %d\n", errno);
176 fatal_sigsegv();
177 }
178
179 CATCH_EINTR(err = waitpid(pid, &status, WUNTRACED | __WALL));
180 if ((err < 0) || !WIFSTOPPED(status) ||
181 (WSTOPSIG(status) != SIGTRAP + 0x80)) {
182 err = ptrace_dump_regs(pid);
183 if (err)
184 printk(UM_KERN_ERR "Failed to get registers "
185 "from process, errno = %d\n", -err);
186 printk(UM_KERN_ERR "handle_trap - failed to wait at "
187 "end of syscall, errno = %d, status = %d\n",
188 errno, status);
189 fatal_sigsegv();
190 }
191 }
192
193 handle_syscall(regs);
194}
195
196extern int __syscall_stub_start;
197
198static int userspace_tramp(void *stack)
199{
200 void *addr;
201 int err;
202
203 ptrace(PTRACE_TRACEME, 0, 0, 0);
204
205 signal(SIGTERM, SIG_DFL);
206 signal(SIGWINCH, SIG_IGN);
207 err = set_interval();
208 if (err) {
209 printk(UM_KERN_ERR "userspace_tramp - setting timer failed, "
210 "errno = %d\n", err);
211 exit(1);
212 }
213
214 if (!proc_mm) {
215 /*
216 * This has a pte, but it can't be mapped in with the usual
217 * tlb_flush mechanism because this is part of that mechanism
218 */
219 int fd;
220 unsigned long long offset;
221 fd = phys_mapping(to_phys(&__syscall_stub_start), &offset);
222 addr = mmap64((void *) STUB_CODE, UM_KERN_PAGE_SIZE,
223 PROT_EXEC, MAP_FIXED | MAP_PRIVATE, fd, offset);
224 if (addr == MAP_FAILED) {
225 printk(UM_KERN_ERR "mapping mmap stub at 0x%lx failed, "
226 "errno = %d\n", STUB_CODE, errno);
227 exit(1);
228 }
229
230 if (stack != NULL) {
231 fd = phys_mapping(to_phys(stack), &offset);
232 addr = mmap((void *) STUB_DATA,
233 UM_KERN_PAGE_SIZE, PROT_READ | PROT_WRITE,
234 MAP_FIXED | MAP_SHARED, fd, offset);
235 if (addr == MAP_FAILED) {
236 printk(UM_KERN_ERR "mapping segfault stack "
237 "at 0x%lx failed, errno = %d\n",
238 STUB_DATA, errno);
239 exit(1);
240 }
241 }
242 }
243 if (!ptrace_faultinfo && (stack != NULL)) {
244 struct sigaction sa;
245
246 unsigned long v = STUB_CODE +
247 (unsigned long) stub_segv_handler -
248 (unsigned long) &__syscall_stub_start;
249
250 set_sigstack((void *) STUB_DATA, UM_KERN_PAGE_SIZE);
251 sigemptyset(&sa.sa_mask);
252 sa.sa_flags = SA_ONSTACK | SA_NODEFER | SA_SIGINFO;
253 sa.sa_sigaction = (void *) v;
254 sa.sa_restorer = NULL;
255 if (sigaction(SIGSEGV, &sa, NULL) < 0) {
256 printk(UM_KERN_ERR "userspace_tramp - setting SIGSEGV "
257 "handler failed - errno = %d\n", errno);
258 exit(1);
259 }
260 }
261
262 kill(os_getpid(), SIGSTOP);
263 return 0;
264}
265
266/* Each element set once, and only accessed by a single processor anyway */
267#undef NR_CPUS
268#define NR_CPUS 1
269int userspace_pid[NR_CPUS];
270
271int start_userspace(unsigned long stub_stack)
272{
273 void *stack;
274 unsigned long sp;
275 int pid, status, n, flags, err;
276
277 stack = mmap(NULL, UM_KERN_PAGE_SIZE,
278 PROT_READ | PROT_WRITE | PROT_EXEC,
279 MAP_PRIVATE | MAP_ANONYMOUS, -1, 0);
280 if (stack == MAP_FAILED) {
281 err = -errno;
282 printk(UM_KERN_ERR "start_userspace : mmap failed, "
283 "errno = %d\n", errno);
284 return err;
285 }
286
287 sp = (unsigned long) stack + UM_KERN_PAGE_SIZE - sizeof(void *);
288
289 flags = CLONE_FILES;
290 if (proc_mm)
291 flags |= CLONE_VM;
292 else
293 flags |= SIGCHLD;
294
295 pid = clone(userspace_tramp, (void *) sp, flags, (void *) stub_stack);
296 if (pid < 0) {
297 err = -errno;
298 printk(UM_KERN_ERR "start_userspace : clone failed, "
299 "errno = %d\n", errno);
300 return err;
301 }
302
303 do {
304 CATCH_EINTR(n = waitpid(pid, &status, WUNTRACED | __WALL));
305 if (n < 0) {
306 err = -errno;
307 printk(UM_KERN_ERR "start_userspace : wait failed, "
308 "errno = %d\n", errno);
309 goto out_kill;
310 }
311 } while (WIFSTOPPED(status) && (WSTOPSIG(status) == SIGVTALRM));
312
313 if (!WIFSTOPPED(status) || (WSTOPSIG(status) != SIGSTOP)) {
314 err = -EINVAL;
315 printk(UM_KERN_ERR "start_userspace : expected SIGSTOP, got "
316 "status = %d\n", status);
317 goto out_kill;
318 }
319
320 if (ptrace(PTRACE_OLDSETOPTIONS, pid, NULL,
321 (void *) PTRACE_O_TRACESYSGOOD) < 0) {
322 err = -errno;
323 printk(UM_KERN_ERR "start_userspace : PTRACE_OLDSETOPTIONS "
324 "failed, errno = %d\n", errno);
325 goto out_kill;
326 }
327
328 if (munmap(stack, UM_KERN_PAGE_SIZE) < 0) {
329 err = -errno;
330 printk(UM_KERN_ERR "start_userspace : munmap failed, "
331 "errno = %d\n", errno);
332 goto out_kill;
333 }
334
335 return pid;
336
337 out_kill:
338 os_kill_ptraced_process(pid, 1);
339 return err;
340}
341
342void userspace(struct uml_pt_regs *regs)
343{
344 struct itimerval timer;
345 unsigned long long nsecs, now;
346 int err, status, op, pid = userspace_pid[0];
347 /* To prevent races if using_sysemu changes under us.*/
348 int local_using_sysemu;
349
350 if (getitimer(ITIMER_VIRTUAL, &timer))
351 printk(UM_KERN_ERR "Failed to get itimer, errno = %d\n", errno);
352 nsecs = timer.it_value.tv_sec * UM_NSEC_PER_SEC +
353 timer.it_value.tv_usec * UM_NSEC_PER_USEC;
354 nsecs += os_nsecs();
355
356 while (1) {
357 /*
358 * This can legitimately fail if the process loads a
359 * bogus value into a segment register. It will
360 * segfault and PTRACE_GETREGS will read that value
361 * out of the process. However, PTRACE_SETREGS will
362 * fail. In this case, there is nothing to do but
363 * just kill the process.
364 */
365 if (ptrace(PTRACE_SETREGS, pid, 0, regs->gp))
366 fatal_sigsegv();
367
368 if (put_fp_registers(pid, regs->fp))
369 fatal_sigsegv();
370
371 /* Now we set local_using_sysemu to be used for one loop */
372 local_using_sysemu = get_using_sysemu();
373
374 op = SELECT_PTRACE_OPERATION(local_using_sysemu,
375 singlestepping(NULL));
376
377 if (ptrace(op, pid, 0, 0)) {
378 printk(UM_KERN_ERR "userspace - ptrace continue "
379 "failed, op = %d, errno = %d\n", op, errno);
380 fatal_sigsegv();
381 }
382
383 CATCH_EINTR(err = waitpid(pid, &status, WUNTRACED | __WALL));
384 if (err < 0) {
385 printk(UM_KERN_ERR "userspace - wait failed, "
386 "errno = %d\n", errno);
387 fatal_sigsegv();
388 }
389
390 regs->is_user = 1;
391 if (ptrace(PTRACE_GETREGS, pid, 0, regs->gp)) {
392 printk(UM_KERN_ERR "userspace - PTRACE_GETREGS failed, "
393 "errno = %d\n", errno);
394 fatal_sigsegv();
395 }
396
397 if (get_fp_registers(pid, regs->fp)) {
398 printk(UM_KERN_ERR "userspace - get_fp_registers failed, "
399 "errno = %d\n", errno);
400 fatal_sigsegv();
401 }
402
403 UPT_SYSCALL_NR(regs) = -1; /* Assume: It's not a syscall */
404
405 if (WIFSTOPPED(status)) {
406 int sig = WSTOPSIG(status);
407 switch (sig) {
408 case SIGSEGV:
409 if (PTRACE_FULL_FAULTINFO ||
410 !ptrace_faultinfo) {
411 get_skas_faultinfo(pid,
412 ®s->faultinfo);
413 (*sig_info[SIGSEGV])(SIGSEGV, regs);
414 }
415 else handle_segv(pid, regs);
416 break;
417 case SIGTRAP + 0x80:
418 handle_trap(pid, regs, local_using_sysemu);
419 break;
420 case SIGTRAP:
421 relay_signal(SIGTRAP, regs);
422 break;
423 case SIGVTALRM:
424 now = os_nsecs();
425 if (now < nsecs)
426 break;
427 block_signals();
428 (*sig_info[sig])(sig, regs);
429 unblock_signals();
430 nsecs = timer.it_value.tv_sec *
431 UM_NSEC_PER_SEC +
432 timer.it_value.tv_usec *
433 UM_NSEC_PER_USEC;
434 nsecs += os_nsecs();
435 break;
436 case SIGIO:
437 case SIGILL:
438 case SIGBUS:
439 case SIGFPE:
440 case SIGWINCH:
441 block_signals();
442 (*sig_info[sig])(sig, regs);
443 unblock_signals();
444 break;
445 default:
446 printk(UM_KERN_ERR "userspace - child stopped "
447 "with signal %d\n", sig);
448 fatal_sigsegv();
449 }
450 pid = userspace_pid[0];
451 interrupt_end();
452
453 /* Avoid -ERESTARTSYS handling in host */
454 if (PT_SYSCALL_NR_OFFSET != PT_SYSCALL_RET_OFFSET)
455 PT_SYSCALL_NR(regs->gp) = -1;
456 }
457 }
458}
459
460static unsigned long thread_regs[MAX_REG_NR];
461static unsigned long thread_fp_regs[FP_SIZE];
462
463static int __init init_thread_regs(void)
464{
465 get_safe_registers(thread_regs, thread_fp_regs);
466 /* Set parent's instruction pointer to start of clone-stub */
467 thread_regs[REGS_IP_INDEX] = STUB_CODE +
468 (unsigned long) stub_clone_handler -
469 (unsigned long) &__syscall_stub_start;
470 thread_regs[REGS_SP_INDEX] = STUB_DATA + UM_KERN_PAGE_SIZE -
471 sizeof(void *);
472#ifdef __SIGNAL_FRAMESIZE
473 thread_regs[REGS_SP_INDEX] -= __SIGNAL_FRAMESIZE;
474#endif
475 return 0;
476}
477
478__initcall(init_thread_regs);
479
480int copy_context_skas0(unsigned long new_stack, int pid)
481{
482 struct timeval tv = { .tv_sec = 0, .tv_usec = UM_USEC_PER_SEC / UM_HZ };
483 int err;
484 unsigned long current_stack = current_stub_stack();
485 struct stub_data *data = (struct stub_data *) current_stack;
486 struct stub_data *child_data = (struct stub_data *) new_stack;
487 unsigned long long new_offset;
488 int new_fd = phys_mapping(to_phys((void *)new_stack), &new_offset);
489
490 /*
491 * prepare offset and fd of child's stack as argument for parent's
492 * and child's mmap2 calls
493 */
494 *data = ((struct stub_data) { .offset = MMAP_OFFSET(new_offset),
495 .fd = new_fd,
496 .timer = ((struct itimerval)
497 { .it_value = tv,
498 .it_interval = tv }) });
499
500 err = ptrace_setregs(pid, thread_regs);
501 if (err < 0) {
502 err = -errno;
503 printk(UM_KERN_ERR "copy_context_skas0 : PTRACE_SETREGS "
504 "failed, pid = %d, errno = %d\n", pid, -err);
505 return err;
506 }
507
508 err = put_fp_registers(pid, thread_fp_regs);
509 if (err < 0) {
510 printk(UM_KERN_ERR "copy_context_skas0 : put_fp_registers "
511 "failed, pid = %d, err = %d\n", pid, err);
512 return err;
513 }
514
515 /* set a well known return code for detection of child write failure */
516 child_data->err = 12345678;
517
518 /*
519 * Wait, until parent has finished its work: read child's pid from
520 * parent's stack, and check, if bad result.
521 */
522 err = ptrace(PTRACE_CONT, pid, 0, 0);
523 if (err) {
524 err = -errno;
525 printk(UM_KERN_ERR "Failed to continue new process, pid = %d, "
526 "errno = %d\n", pid, errno);
527 return err;
528 }
529
530 wait_stub_done(pid);
531
532 pid = data->err;
533 if (pid < 0) {
534 printk(UM_KERN_ERR "copy_context_skas0 - stub-parent reports "
535 "error %d\n", -pid);
536 return pid;
537 }
538
539 /*
540 * Wait, until child has finished too: read child's result from
541 * child's stack and check it.
542 */
543 wait_stub_done(pid);
544 if (child_data->err != STUB_DATA) {
545 printk(UM_KERN_ERR "copy_context_skas0 - stub-child reports "
546 "error %ld\n", child_data->err);
547 err = child_data->err;
548 goto out_kill;
549 }
550
551 if (ptrace(PTRACE_OLDSETOPTIONS, pid, NULL,
552 (void *)PTRACE_O_TRACESYSGOOD) < 0) {
553 err = -errno;
554 printk(UM_KERN_ERR "copy_context_skas0 : PTRACE_OLDSETOPTIONS "
555 "failed, errno = %d\n", errno);
556 goto out_kill;
557 }
558
559 return pid;
560
561 out_kill:
562 os_kill_ptraced_process(pid, 1);
563 return err;
564}
565
566/*
567 * This is used only, if stub pages are needed, while proc_mm is
568 * available. Opening /proc/mm creates a new mm_context, which lacks
569 * the stub-pages. Thus, we map them using /proc/mm-fd
570 */
571int map_stub_pages(int fd, unsigned long code, unsigned long data,
572 unsigned long stack)
573{
574 struct proc_mm_op mmop;
575 int n;
576 unsigned long long code_offset;
577 int code_fd = phys_mapping(to_phys((void *) &__syscall_stub_start),
578 &code_offset);
579
580 mmop = ((struct proc_mm_op) { .op = MM_MMAP,
581 .u =
582 { .mmap =
583 { .addr = code,
584 .len = UM_KERN_PAGE_SIZE,
585 .prot = PROT_EXEC,
586 .flags = MAP_FIXED | MAP_PRIVATE,
587 .fd = code_fd,
588 .offset = code_offset
589 } } });
590 CATCH_EINTR(n = write(fd, &mmop, sizeof(mmop)));
591 if (n != sizeof(mmop)) {
592 n = errno;
593 printk(UM_KERN_ERR "mmap args - addr = 0x%lx, fd = %d, "
594 "offset = %llx\n", code, code_fd,
595 (unsigned long long) code_offset);
596 printk(UM_KERN_ERR "map_stub_pages : /proc/mm map for code "
597 "failed, err = %d\n", n);
598 return -n;
599 }
600
601 if (stack) {
602 unsigned long long map_offset;
603 int map_fd = phys_mapping(to_phys((void *)stack), &map_offset);
604 mmop = ((struct proc_mm_op)
605 { .op = MM_MMAP,
606 .u =
607 { .mmap =
608 { .addr = data,
609 .len = UM_KERN_PAGE_SIZE,
610 .prot = PROT_READ | PROT_WRITE,
611 .flags = MAP_FIXED | MAP_SHARED,
612 .fd = map_fd,
613 .offset = map_offset
614 } } });
615 CATCH_EINTR(n = write(fd, &mmop, sizeof(mmop)));
616 if (n != sizeof(mmop)) {
617 n = errno;
618 printk(UM_KERN_ERR "map_stub_pages : /proc/mm map for "
619 "data failed, err = %d\n", n);
620 return -n;
621 }
622 }
623
624 return 0;
625}
626
627void new_thread(void *stack, jmp_buf *buf, void (*handler)(void))
628{
629 (*buf)[0].JB_IP = (unsigned long) handler;
630 (*buf)[0].JB_SP = (unsigned long) stack + UM_THREAD_SIZE -
631 sizeof(void *);
632}
633
634#define INIT_JMP_NEW_THREAD 0
635#define INIT_JMP_CALLBACK 1
636#define INIT_JMP_HALT 2
637#define INIT_JMP_REBOOT 3
638
639void switch_threads(jmp_buf *me, jmp_buf *you)
640{
641 if (UML_SETJMP(me) == 0)
642 UML_LONGJMP(you, 1);
643}
644
645static jmp_buf initial_jmpbuf;
646
647/* XXX Make these percpu */
648static void (*cb_proc)(void *arg);
649static void *cb_arg;
650static jmp_buf *cb_back;
651
652int start_idle_thread(void *stack, jmp_buf *switch_buf)
653{
654 int n;
655
656 set_handler(SIGWINCH);
657
658 /*
659 * Can't use UML_SETJMP or UML_LONGJMP here because they save
660 * and restore signals, with the possible side-effect of
661 * trying to handle any signals which came when they were
662 * blocked, which can't be done on this stack.
663 * Signals must be blocked when jumping back here and restored
664 * after returning to the jumper.
665 */
666 n = setjmp(initial_jmpbuf);
667 switch (n) {
668 case INIT_JMP_NEW_THREAD:
669 (*switch_buf)[0].JB_IP = (unsigned long) new_thread_handler;
670 (*switch_buf)[0].JB_SP = (unsigned long) stack +
671 UM_THREAD_SIZE - sizeof(void *);
672 break;
673 case INIT_JMP_CALLBACK:
674 (*cb_proc)(cb_arg);
675 longjmp(*cb_back, 1);
676 break;
677 case INIT_JMP_HALT:
678 kmalloc_ok = 0;
679 return 0;
680 case INIT_JMP_REBOOT:
681 kmalloc_ok = 0;
682 return 1;
683 default:
684 printk(UM_KERN_ERR "Bad sigsetjmp return in "
685 "start_idle_thread - %d\n", n);
686 fatal_sigsegv();
687 }
688 longjmp(*switch_buf, 1);
689}
690
691void initial_thread_cb_skas(void (*proc)(void *), void *arg)
692{
693 jmp_buf here;
694
695 cb_proc = proc;
696 cb_arg = arg;
697 cb_back = &here;
698
699 block_signals();
700 if (UML_SETJMP(&here) == 0)
701 UML_LONGJMP(&initial_jmpbuf, INIT_JMP_CALLBACK);
702 unblock_signals();
703
704 cb_proc = NULL;
705 cb_arg = NULL;
706 cb_back = NULL;
707}
708
709void halt_skas(void)
710{
711 block_signals();
712 UML_LONGJMP(&initial_jmpbuf, INIT_JMP_HALT);
713}
714
715void reboot_skas(void)
716{
717 block_signals();
718 UML_LONGJMP(&initial_jmpbuf, INIT_JMP_REBOOT);
719}
720
721void __switch_mm(struct mm_id *mm_idp)
722{
723 int err;
724
725 /* FIXME: need cpu pid in __switch_mm */
726 if (proc_mm) {
727 err = ptrace(PTRACE_SWITCH_MM, userspace_pid[0], 0,
728 mm_idp->u.mm_fd);
729 if (err) {
730 printk(UM_KERN_ERR "__switch_mm - PTRACE_SWITCH_MM "
731 "failed, errno = %d\n", errno);
732 fatal_sigsegv();
733 }
734 }
735 else userspace_pid[0] = mm_idp->u.pid;
736}
1// SPDX-License-Identifier: GPL-2.0
2/*
3 * Copyright (C) 2015 Thomas Meyer (thomas@m3y3r.de)
4 * Copyright (C) 2002- 2007 Jeff Dike (jdike@{addtoit,linux.intel}.com)
5 */
6
7#include <stdlib.h>
8#include <stdbool.h>
9#include <unistd.h>
10#include <sched.h>
11#include <errno.h>
12#include <string.h>
13#include <fcntl.h>
14#include <mem_user.h>
15#include <sys/mman.h>
16#include <sys/wait.h>
17#include <sys/stat.h>
18#include <asm/unistd.h>
19#include <as-layout.h>
20#include <init.h>
21#include <kern_util.h>
22#include <mem.h>
23#include <os.h>
24#include <ptrace_user.h>
25#include <registers.h>
26#include <skas.h>
27#include <sysdep/stub.h>
28#include <linux/threads.h>
29#include <timetravel.h>
30#include "../internal.h"
31
32int is_skas_winch(int pid, int fd, void *data)
33{
34 return pid == getpgrp();
35}
36
37static const char *ptrace_reg_name(int idx)
38{
39#define R(n) case HOST_##n: return #n
40
41 switch (idx) {
42#ifdef __x86_64__
43 R(BX);
44 R(CX);
45 R(DI);
46 R(SI);
47 R(DX);
48 R(BP);
49 R(AX);
50 R(R8);
51 R(R9);
52 R(R10);
53 R(R11);
54 R(R12);
55 R(R13);
56 R(R14);
57 R(R15);
58 R(ORIG_AX);
59 R(CS);
60 R(SS);
61 R(EFLAGS);
62#elif defined(__i386__)
63 R(IP);
64 R(SP);
65 R(EFLAGS);
66 R(AX);
67 R(BX);
68 R(CX);
69 R(DX);
70 R(SI);
71 R(DI);
72 R(BP);
73 R(CS);
74 R(SS);
75 R(DS);
76 R(FS);
77 R(ES);
78 R(GS);
79 R(ORIG_AX);
80#endif
81 }
82 return "";
83}
84
85static int ptrace_dump_regs(int pid)
86{
87 unsigned long regs[MAX_REG_NR];
88 int i;
89
90 if (ptrace(PTRACE_GETREGS, pid, 0, regs) < 0)
91 return -errno;
92
93 printk(UM_KERN_ERR "Stub registers -\n");
94 for (i = 0; i < ARRAY_SIZE(regs); i++) {
95 const char *regname = ptrace_reg_name(i);
96
97 printk(UM_KERN_ERR "\t%s\t(%2d): %lx\n", regname, i, regs[i]);
98 }
99
100 return 0;
101}
102
103/*
104 * Signals that are OK to receive in the stub - we'll just continue it.
105 * SIGWINCH will happen when UML is inside a detached screen.
106 */
107#define STUB_SIG_MASK ((1 << SIGALRM) | (1 << SIGWINCH))
108
109/* Signals that the stub will finish with - anything else is an error */
110#define STUB_DONE_MASK (1 << SIGTRAP)
111
112void wait_stub_done(int pid)
113{
114 int n, status, err;
115
116 while (1) {
117 CATCH_EINTR(n = waitpid(pid, &status, WUNTRACED | __WALL));
118 if ((n < 0) || !WIFSTOPPED(status))
119 goto bad_wait;
120
121 if (((1 << WSTOPSIG(status)) & STUB_SIG_MASK) == 0)
122 break;
123
124 err = ptrace(PTRACE_CONT, pid, 0, 0);
125 if (err) {
126 printk(UM_KERN_ERR "%s : continue failed, errno = %d\n",
127 __func__, errno);
128 fatal_sigsegv();
129 }
130 }
131
132 if (((1 << WSTOPSIG(status)) & STUB_DONE_MASK) != 0)
133 return;
134
135bad_wait:
136 err = ptrace_dump_regs(pid);
137 if (err)
138 printk(UM_KERN_ERR "Failed to get registers from stub, errno = %d\n",
139 -err);
140 printk(UM_KERN_ERR "%s : failed to wait for SIGTRAP, pid = %d, n = %d, errno = %d, status = 0x%x\n",
141 __func__, pid, n, errno, status);
142 fatal_sigsegv();
143}
144
145extern unsigned long current_stub_stack(void);
146
147static void get_skas_faultinfo(int pid, struct faultinfo *fi)
148{
149 int err;
150
151 err = ptrace(PTRACE_CONT, pid, 0, SIGSEGV);
152 if (err) {
153 printk(UM_KERN_ERR "Failed to continue stub, pid = %d, "
154 "errno = %d\n", pid, errno);
155 fatal_sigsegv();
156 }
157 wait_stub_done(pid);
158
159 /*
160 * faultinfo is prepared by the stub_segv_handler at start of
161 * the stub stack page. We just have to copy it.
162 */
163 memcpy(fi, (void *)current_stub_stack(), sizeof(*fi));
164}
165
166static void handle_segv(int pid, struct uml_pt_regs *regs)
167{
168 get_skas_faultinfo(pid, ®s->faultinfo);
169 segv(regs->faultinfo, 0, 1, NULL);
170}
171
172static void handle_trap(int pid, struct uml_pt_regs *regs)
173{
174 if ((UPT_IP(regs) >= STUB_START) && (UPT_IP(regs) < STUB_END))
175 fatal_sigsegv();
176
177 handle_syscall(regs);
178}
179
180extern char __syscall_stub_start[];
181
182static int stub_exe_fd;
183
184#ifndef CLOSE_RANGE_CLOEXEC
185#define CLOSE_RANGE_CLOEXEC (1U << 2)
186#endif
187
188static int userspace_tramp(void *stack)
189{
190 char *const argv[] = { "uml-userspace", NULL };
191 int pipe_fds[2];
192 unsigned long long offset;
193 struct stub_init_data init_data = {
194 .stub_start = STUB_START,
195 .segv_handler = STUB_CODE +
196 (unsigned long) stub_segv_handler -
197 (unsigned long) __syscall_stub_start,
198 };
199 struct iomem_region *iomem;
200 int ret;
201
202 init_data.stub_code_fd = phys_mapping(uml_to_phys(__syscall_stub_start),
203 &offset);
204 init_data.stub_code_offset = MMAP_OFFSET(offset);
205
206 init_data.stub_data_fd = phys_mapping(uml_to_phys(stack), &offset);
207 init_data.stub_data_offset = MMAP_OFFSET(offset);
208
209 /*
210 * Avoid leaking unneeded FDs to the stub by setting CLOEXEC on all FDs
211 * and then unsetting it on all memory related FDs.
212 * This is not strictly necessary from a safety perspective.
213 */
214 syscall(__NR_close_range, 0, ~0U, CLOSE_RANGE_CLOEXEC);
215
216 fcntl(init_data.stub_data_fd, F_SETFD, 0);
217 for (iomem = iomem_regions; iomem; iomem = iomem->next)
218 fcntl(iomem->fd, F_SETFD, 0);
219
220 /* Create a pipe for init_data (no CLOEXEC) and dup2 to STDIN */
221 if (pipe(pipe_fds))
222 exit(2);
223
224 if (dup2(pipe_fds[0], 0) < 0)
225 exit(3);
226 close(pipe_fds[0]);
227
228 /* Write init_data and close write side */
229 ret = write(pipe_fds[1], &init_data, sizeof(init_data));
230 close(pipe_fds[1]);
231
232 if (ret != sizeof(init_data))
233 exit(4);
234
235 /* Raw execveat for compatibility with older libc versions */
236 syscall(__NR_execveat, stub_exe_fd, (unsigned long)"",
237 (unsigned long)argv, NULL, AT_EMPTY_PATH);
238
239 exit(5);
240}
241
242extern char stub_exe_start[];
243extern char stub_exe_end[];
244
245extern char *tempdir;
246
247#define STUB_EXE_NAME_TEMPLATE "/uml-userspace-XXXXXX"
248
249#ifndef MFD_EXEC
250#define MFD_EXEC 0x0010U
251#endif
252
253static int __init init_stub_exe_fd(void)
254{
255 size_t written = 0;
256 char *tmpfile = NULL;
257
258 stub_exe_fd = memfd_create("uml-userspace",
259 MFD_EXEC | MFD_CLOEXEC | MFD_ALLOW_SEALING);
260
261 if (stub_exe_fd < 0) {
262 printk(UM_KERN_INFO "Could not create executable memfd, using temporary file!");
263
264 tmpfile = malloc(strlen(tempdir) +
265 strlen(STUB_EXE_NAME_TEMPLATE) + 1);
266 if (tmpfile == NULL)
267 panic("Failed to allocate memory for stub binary name");
268
269 strcpy(tmpfile, tempdir);
270 strcat(tmpfile, STUB_EXE_NAME_TEMPLATE);
271
272 stub_exe_fd = mkstemp(tmpfile);
273 if (stub_exe_fd < 0)
274 panic("Could not create temporary file for stub binary: %d",
275 -errno);
276 }
277
278 while (written < stub_exe_end - stub_exe_start) {
279 ssize_t res = write(stub_exe_fd, stub_exe_start + written,
280 stub_exe_end - stub_exe_start - written);
281 if (res < 0) {
282 if (errno == EINTR)
283 continue;
284
285 if (tmpfile)
286 unlink(tmpfile);
287 panic("Failed write stub binary: %d", -errno);
288 }
289
290 written += res;
291 }
292
293 if (!tmpfile) {
294 fcntl(stub_exe_fd, F_ADD_SEALS,
295 F_SEAL_WRITE | F_SEAL_SHRINK | F_SEAL_GROW | F_SEAL_SEAL);
296 } else {
297 if (fchmod(stub_exe_fd, 00500) < 0) {
298 unlink(tmpfile);
299 panic("Could not make stub binary executable: %d",
300 -errno);
301 }
302
303 close(stub_exe_fd);
304 stub_exe_fd = open(tmpfile, O_RDONLY | O_CLOEXEC | O_NOFOLLOW);
305 if (stub_exe_fd < 0) {
306 unlink(tmpfile);
307 panic("Could not reopen stub binary: %d", -errno);
308 }
309
310 unlink(tmpfile);
311 free(tmpfile);
312 }
313
314 return 0;
315}
316__initcall(init_stub_exe_fd);
317
318int userspace_pid[NR_CPUS];
319
320/**
321 * start_userspace() - prepare a new userspace process
322 * @stub_stack: pointer to the stub stack.
323 *
324 * Setups a new temporary stack page that is used while userspace_tramp() runs
325 * Clones the kernel process into a new userspace process, with FDs only.
326 *
327 * Return: When positive: the process id of the new userspace process,
328 * when negative: an error number.
329 * FIXME: can PIDs become negative?!
330 */
331int start_userspace(unsigned long stub_stack)
332{
333 void *stack;
334 unsigned long sp;
335 int pid, status, n, err;
336
337 /* setup a temporary stack page */
338 stack = mmap(NULL, UM_KERN_PAGE_SIZE,
339 PROT_READ | PROT_WRITE | PROT_EXEC,
340 MAP_PRIVATE | MAP_ANONYMOUS, -1, 0);
341 if (stack == MAP_FAILED) {
342 err = -errno;
343 printk(UM_KERN_ERR "%s : mmap failed, errno = %d\n",
344 __func__, errno);
345 return err;
346 }
347
348 /* set stack pointer to the end of the stack page, so it can grow downwards */
349 sp = (unsigned long)stack + UM_KERN_PAGE_SIZE;
350
351 /* clone into new userspace process */
352 pid = clone(userspace_tramp, (void *) sp,
353 CLONE_VFORK | CLONE_VM | SIGCHLD,
354 (void *)stub_stack);
355 if (pid < 0) {
356 err = -errno;
357 printk(UM_KERN_ERR "%s : clone failed, errno = %d\n",
358 __func__, errno);
359 return err;
360 }
361
362 do {
363 CATCH_EINTR(n = waitpid(pid, &status, WUNTRACED | __WALL));
364 if (n < 0) {
365 err = -errno;
366 printk(UM_KERN_ERR "%s : wait failed, errno = %d\n",
367 __func__, errno);
368 goto out_kill;
369 }
370 } while (WIFSTOPPED(status) && (WSTOPSIG(status) == SIGALRM));
371
372 if (!WIFSTOPPED(status) || (WSTOPSIG(status) != SIGSTOP)) {
373 err = -EINVAL;
374 printk(UM_KERN_ERR "%s : expected SIGSTOP, got status = %d\n",
375 __func__, status);
376 goto out_kill;
377 }
378
379 if (ptrace(PTRACE_SETOPTIONS, pid, NULL,
380 (void *) PTRACE_O_TRACESYSGOOD) < 0) {
381 err = -errno;
382 printk(UM_KERN_ERR "%s : PTRACE_SETOPTIONS failed, errno = %d\n",
383 __func__, errno);
384 goto out_kill;
385 }
386
387 if (munmap(stack, UM_KERN_PAGE_SIZE) < 0) {
388 err = -errno;
389 printk(UM_KERN_ERR "%s : munmap failed, errno = %d\n",
390 __func__, errno);
391 goto out_kill;
392 }
393
394 return pid;
395
396 out_kill:
397 os_kill_ptraced_process(pid, 1);
398 return err;
399}
400
401int unscheduled_userspace_iterations;
402extern unsigned long tt_extra_sched_jiffies;
403
404void userspace(struct uml_pt_regs *regs)
405{
406 int err, status, op, pid = userspace_pid[0];
407 siginfo_t si;
408
409 /* Handle any immediate reschedules or signals */
410 interrupt_end();
411
412 while (1) {
413 /*
414 * When we are in time-travel mode, userspace can theoretically
415 * do a *lot* of work without being scheduled. The problem with
416 * this is that it will prevent kernel bookkeeping (primarily
417 * the RCU) from running and this can for example cause OOM
418 * situations.
419 *
420 * This code accounts a jiffie against the scheduling clock
421 * after the defined userspace iterations in the same thread.
422 * By doing so the situation is effectively prevented.
423 */
424 if (time_travel_mode == TT_MODE_INFCPU ||
425 time_travel_mode == TT_MODE_EXTERNAL) {
426#ifdef CONFIG_UML_MAX_USERSPACE_ITERATIONS
427 if (CONFIG_UML_MAX_USERSPACE_ITERATIONS &&
428 unscheduled_userspace_iterations++ >
429 CONFIG_UML_MAX_USERSPACE_ITERATIONS) {
430 tt_extra_sched_jiffies += 1;
431 unscheduled_userspace_iterations = 0;
432 }
433#endif
434 }
435
436 time_travel_print_bc_msg();
437
438 current_mm_sync();
439
440 /* Flush out any pending syscalls */
441 err = syscall_stub_flush(current_mm_id());
442 if (err) {
443 if (err == -ENOMEM)
444 report_enomem();
445
446 printk(UM_KERN_ERR "%s - Error flushing stub syscalls: %d",
447 __func__, -err);
448 fatal_sigsegv();
449 }
450
451 /*
452 * This can legitimately fail if the process loads a
453 * bogus value into a segment register. It will
454 * segfault and PTRACE_GETREGS will read that value
455 * out of the process. However, PTRACE_SETREGS will
456 * fail. In this case, there is nothing to do but
457 * just kill the process.
458 */
459 if (ptrace(PTRACE_SETREGS, pid, 0, regs->gp)) {
460 printk(UM_KERN_ERR "%s - ptrace set regs failed, errno = %d\n",
461 __func__, errno);
462 fatal_sigsegv();
463 }
464
465 if (put_fp_registers(pid, regs->fp)) {
466 printk(UM_KERN_ERR "%s - ptrace set fp regs failed, errno = %d\n",
467 __func__, errno);
468 fatal_sigsegv();
469 }
470
471 if (singlestepping())
472 op = PTRACE_SYSEMU_SINGLESTEP;
473 else
474 op = PTRACE_SYSEMU;
475
476 if (ptrace(op, pid, 0, 0)) {
477 printk(UM_KERN_ERR "%s - ptrace continue failed, op = %d, errno = %d\n",
478 __func__, op, errno);
479 fatal_sigsegv();
480 }
481
482 CATCH_EINTR(err = waitpid(pid, &status, WUNTRACED | __WALL));
483 if (err < 0) {
484 printk(UM_KERN_ERR "%s - wait failed, errno = %d\n",
485 __func__, errno);
486 fatal_sigsegv();
487 }
488
489 regs->is_user = 1;
490 if (ptrace(PTRACE_GETREGS, pid, 0, regs->gp)) {
491 printk(UM_KERN_ERR "%s - PTRACE_GETREGS failed, errno = %d\n",
492 __func__, errno);
493 fatal_sigsegv();
494 }
495
496 if (get_fp_registers(pid, regs->fp)) {
497 printk(UM_KERN_ERR "%s - get_fp_registers failed, errno = %d\n",
498 __func__, errno);
499 fatal_sigsegv();
500 }
501
502 UPT_SYSCALL_NR(regs) = -1; /* Assume: It's not a syscall */
503
504 if (WIFSTOPPED(status)) {
505 int sig = WSTOPSIG(status);
506
507 /* These signal handlers need the si argument.
508 * The SIGIO and SIGALARM handlers which constitute the
509 * majority of invocations, do not use it.
510 */
511 switch (sig) {
512 case SIGSEGV:
513 case SIGTRAP:
514 case SIGILL:
515 case SIGBUS:
516 case SIGFPE:
517 case SIGWINCH:
518 ptrace(PTRACE_GETSIGINFO, pid, 0, (struct siginfo *)&si);
519 break;
520 }
521
522 switch (sig) {
523 case SIGSEGV:
524 if (PTRACE_FULL_FAULTINFO) {
525 get_skas_faultinfo(pid,
526 ®s->faultinfo);
527 (*sig_info[SIGSEGV])(SIGSEGV, (struct siginfo *)&si,
528 regs);
529 }
530 else handle_segv(pid, regs);
531 break;
532 case SIGTRAP + 0x80:
533 handle_trap(pid, regs);
534 break;
535 case SIGTRAP:
536 relay_signal(SIGTRAP, (struct siginfo *)&si, regs);
537 break;
538 case SIGALRM:
539 break;
540 case SIGIO:
541 case SIGILL:
542 case SIGBUS:
543 case SIGFPE:
544 case SIGWINCH:
545 block_signals_trace();
546 (*sig_info[sig])(sig, (struct siginfo *)&si, regs);
547 unblock_signals_trace();
548 break;
549 default:
550 printk(UM_KERN_ERR "%s - child stopped with signal %d\n",
551 __func__, sig);
552 fatal_sigsegv();
553 }
554 pid = userspace_pid[0];
555 interrupt_end();
556
557 /* Avoid -ERESTARTSYS handling in host */
558 if (PT_SYSCALL_NR_OFFSET != PT_SYSCALL_RET_OFFSET)
559 PT_SYSCALL_NR(regs->gp) = -1;
560 }
561 }
562}
563
564void new_thread(void *stack, jmp_buf *buf, void (*handler)(void))
565{
566 (*buf)[0].JB_IP = (unsigned long) handler;
567 (*buf)[0].JB_SP = (unsigned long) stack + UM_THREAD_SIZE -
568 sizeof(void *);
569}
570
571#define INIT_JMP_NEW_THREAD 0
572#define INIT_JMP_CALLBACK 1
573#define INIT_JMP_HALT 2
574#define INIT_JMP_REBOOT 3
575
576void switch_threads(jmp_buf *me, jmp_buf *you)
577{
578 unscheduled_userspace_iterations = 0;
579
580 if (UML_SETJMP(me) == 0)
581 UML_LONGJMP(you, 1);
582}
583
584static jmp_buf initial_jmpbuf;
585
586/* XXX Make these percpu */
587static void (*cb_proc)(void *arg);
588static void *cb_arg;
589static jmp_buf *cb_back;
590
591int start_idle_thread(void *stack, jmp_buf *switch_buf)
592{
593 int n;
594
595 set_handler(SIGWINCH);
596
597 /*
598 * Can't use UML_SETJMP or UML_LONGJMP here because they save
599 * and restore signals, with the possible side-effect of
600 * trying to handle any signals which came when they were
601 * blocked, which can't be done on this stack.
602 * Signals must be blocked when jumping back here and restored
603 * after returning to the jumper.
604 */
605 n = setjmp(initial_jmpbuf);
606 switch (n) {
607 case INIT_JMP_NEW_THREAD:
608 (*switch_buf)[0].JB_IP = (unsigned long) uml_finishsetup;
609 (*switch_buf)[0].JB_SP = (unsigned long) stack +
610 UM_THREAD_SIZE - sizeof(void *);
611 break;
612 case INIT_JMP_CALLBACK:
613 (*cb_proc)(cb_arg);
614 longjmp(*cb_back, 1);
615 break;
616 case INIT_JMP_HALT:
617 kmalloc_ok = 0;
618 return 0;
619 case INIT_JMP_REBOOT:
620 kmalloc_ok = 0;
621 return 1;
622 default:
623 printk(UM_KERN_ERR "Bad sigsetjmp return in %s - %d\n",
624 __func__, n);
625 fatal_sigsegv();
626 }
627 longjmp(*switch_buf, 1);
628
629 /* unreachable */
630 printk(UM_KERN_ERR "impossible long jump!");
631 fatal_sigsegv();
632 return 0;
633}
634
635void initial_thread_cb_skas(void (*proc)(void *), void *arg)
636{
637 jmp_buf here;
638
639 cb_proc = proc;
640 cb_arg = arg;
641 cb_back = &here;
642
643 block_signals_trace();
644 if (UML_SETJMP(&here) == 0)
645 UML_LONGJMP(&initial_jmpbuf, INIT_JMP_CALLBACK);
646 unblock_signals_trace();
647
648 cb_proc = NULL;
649 cb_arg = NULL;
650 cb_back = NULL;
651}
652
653void halt_skas(void)
654{
655 block_signals_trace();
656 UML_LONGJMP(&initial_jmpbuf, INIT_JMP_HALT);
657}
658
659static bool noreboot;
660
661static int __init noreboot_cmd_param(char *str, int *add)
662{
663 *add = 0;
664 noreboot = true;
665 return 0;
666}
667
668__uml_setup("noreboot", noreboot_cmd_param,
669"noreboot\n"
670" Rather than rebooting, exit always, akin to QEMU's -no-reboot option.\n"
671" This is useful if you're using CONFIG_PANIC_TIMEOUT in order to catch\n"
672" crashes in CI\n");
673
674void reboot_skas(void)
675{
676 block_signals_trace();
677 UML_LONGJMP(&initial_jmpbuf, noreboot ? INIT_JMP_HALT : INIT_JMP_REBOOT);
678}
679
680void __switch_mm(struct mm_id *mm_idp)
681{
682 userspace_pid[0] = mm_idp->pid;
683}