1// SPDX-License-Identifier: GPL-2.0
  2
  3//! Tasks (threads and processes).
  4//!
  5//! C header: [`include/linux/sched.h`](srctree/include/linux/sched.h).
  6
  7use crate::{
  8    bindings,
  9    ffi::{c_int, c_long, c_uint},
 10    pid_namespace::PidNamespace,
 11    types::{ARef, NotThreadSafe, Opaque},
 12};
 13use core::{
 14    cmp::{Eq, PartialEq},
 15    ops::Deref,
 16    ptr,
 17};
 18
 19/// A sentinel value used for infinite timeouts.
 20pub const MAX_SCHEDULE_TIMEOUT: c_long = c_long::MAX;
 21
 22/// Bitmask for tasks that are sleeping in an interruptible state.
 23pub const TASK_INTERRUPTIBLE: c_int = bindings::TASK_INTERRUPTIBLE as c_int;
 24/// Bitmask for tasks that are sleeping in an uninterruptible state.
 25pub const TASK_UNINTERRUPTIBLE: c_int = bindings::TASK_UNINTERRUPTIBLE as c_int;
 26/// Convenience constant for waking up tasks regardless of whether they are in interruptible or
 27/// uninterruptible sleep.
 28pub const TASK_NORMAL: c_uint = bindings::TASK_NORMAL as c_uint;
 29
 30/// Returns the currently running task.
 31#[macro_export]
 32macro_rules! current {
 33    () => {
 34        // SAFETY: Deref + addr-of below create a temporary `TaskRef` that cannot outlive the
 35        // caller.
 36        unsafe { &*$crate::task::Task::current() }
 37    };
 38}
 39
 40/// Returns the currently running task's pid namespace.
 41#[macro_export]
 42macro_rules! current_pid_ns {
 43    () => {
 44        // SAFETY: Deref + addr-of below create a temporary `PidNamespaceRef` that cannot outlive
 45        // the caller.
 46        unsafe { &*$crate::task::Task::current_pid_ns() }
 47    };
 48}
 49
 50/// Wraps the kernel's `struct task_struct`.
 51///
 52/// # Invariants
 53///
 54/// All instances are valid tasks created by the C portion of the kernel.
 55///
 56/// Instances of this type are always refcounted, that is, a call to `get_task_struct` ensures
 57/// that the allocation remains valid at least until the matching call to `put_task_struct`.
 58///
 59/// # Examples
 60///
 61/// The following is an example of getting the PID of the current thread with zero additional cost
 62/// when compared to the C version:
 63///
 64/// ```
 65/// let pid = current!().pid();
 66/// ```
 67///
 68/// Getting the PID of the current process, also zero additional cost:
 69///
 70/// ```
 71/// let pid = current!().group_leader().pid();
 72/// ```
 73///
 74/// Getting the current task and storing it in some struct. The reference count is automatically
 75/// incremented when creating `State` and decremented when it is dropped:
 76///
 77/// ```
 78/// use kernel::{task::Task, types::ARef};
 79///
 80/// struct State {
 81///     creator: ARef<Task>,
 82///     index: u32,
 83/// }
 84///
 85/// impl State {
 86///     fn new() -> Self {
 87///         Self {
 88///             creator: current!().into(),
 89///             index: 0,
 90///         }
 91///     }
 92/// }
 93/// ```
 94#[repr(transparent)]
 95pub struct Task(pub(crate) Opaque<bindings::task_struct>);
 96
 97// SAFETY: By design, the only way to access a `Task` is via the `current` function or via an
 98// `ARef<Task>` obtained through the `AlwaysRefCounted` impl. This means that the only situation in
 99// which a `Task` can be accessed mutably is when the refcount drops to zero and the destructor
100// runs. It is safe for that to happen on any thread, so it is ok for this type to be `Send`.
101unsafe impl Send for Task {}
102
103// SAFETY: It's OK to access `Task` through shared references from other threads because we're
104// either accessing properties that don't change (e.g., `pid`, `group_leader`) or that are properly
105// synchronised by C code (e.g., `signal_pending`).
106unsafe impl Sync for Task {}
107
108/// The type of process identifiers (PIDs).
109type Pid = bindings::pid_t;
110
111/// The type of user identifiers (UIDs).
112#[derive(Copy, Clone)]
113pub struct Kuid {
114    kuid: bindings::kuid_t,
115}
116
117impl Task {
118    /// Returns a raw pointer to the current task.
119    ///
120    /// It is up to the user to use the pointer correctly.
121    #[inline]
122    pub fn current_raw() -> *mut bindings::task_struct {
123        // SAFETY: Getting the current pointer is always safe.
124        unsafe { bindings::get_current() }
125    }
126
127    /// Returns a task reference for the currently executing task/thread.
128    ///
129    /// The recommended way to get the current task/thread is to use the
130    /// [`current`] macro because it is safe.
131    ///
132    /// # Safety
133    ///
134    /// Callers must ensure that the returned object doesn't outlive the current task/thread.
135    pub unsafe fn current() -> impl Deref<Target = Task> {
136        struct TaskRef<'a> {
137            task: &'a Task,
138            _not_send: NotThreadSafe,
139        }
140
141        impl Deref for TaskRef<'_> {
142            type Target = Task;
143
144            fn deref(&self) -> &Self::Target {
145                self.task
146            }
147        }
148
149        let current = Task::current_raw();
150        TaskRef {
151            // SAFETY: If the current thread is still running, the current task is valid. Given
152            // that `TaskRef` is not `Send`, we know it cannot be transferred to another thread
153            // (where it could potentially outlive the caller).
154            task: unsafe { &*current.cast() },
155            _not_send: NotThreadSafe,
156        }
157    }
158
159    /// Returns a PidNamespace reference for the currently executing task's/thread's pid namespace.
160    ///
161    /// This function can be used to create an unbounded lifetime by e.g., storing the returned
162    /// PidNamespace in a global variable which would be a bug. So the recommended way to get the
163    /// current task's/thread's pid namespace is to use the [`current_pid_ns`] macro because it is
164    /// safe.
165    ///
166    /// # Safety
167    ///
168    /// Callers must ensure that the returned object doesn't outlive the current task/thread.
169    pub unsafe fn current_pid_ns() -> impl Deref<Target = PidNamespace> {
170        struct PidNamespaceRef<'a> {
171            task: &'a PidNamespace,
172            _not_send: NotThreadSafe,
173        }
174
175        impl Deref for PidNamespaceRef<'_> {
176            type Target = PidNamespace;
177
178            fn deref(&self) -> &Self::Target {
179                self.task
180            }
181        }
182
183        // The lifetime of `PidNamespace` is bound to `Task` and `struct pid`.
184        //
185        // The `PidNamespace` of a `Task` doesn't ever change once the `Task` is alive. A
186        // `unshare(CLONE_NEWPID)` or `setns(fd_pidns/pidfd, CLONE_NEWPID)` will not have an effect
187        // on the calling `Task`'s pid namespace. It will only effect the pid namespace of children
188        // created by the calling `Task`. This invariant guarantees that after having acquired a
189        // reference to a `Task`'s pid namespace it will remain unchanged.
190        //
191        // When a task has exited and been reaped `release_task()` will be called. This will set
192        // the `PidNamespace` of the task to `NULL`. So retrieving the `PidNamespace` of a task
193        // that is dead will return `NULL`. Note, that neither holding the RCU lock nor holding a
194        // referencing count to
195        // the `Task` will prevent `release_task()` being called.
196        //
197        // In order to retrieve the `PidNamespace` of a `Task` the `task_active_pid_ns()` function
198        // can be used. There are two cases to consider:
199        //
200        // (1) retrieving the `PidNamespace` of the `current` task
201        // (2) retrieving the `PidNamespace` of a non-`current` task
202        //
203        // From system call context retrieving the `PidNamespace` for case (1) is always safe and
204        // requires neither RCU locking nor a reference count to be held. Retrieving the
205        // `PidNamespace` after `release_task()` for current will return `NULL` but no codepath
206        // like that is exposed to Rust.
207        //
208        // Retrieving the `PidNamespace` from system call context for (2) requires RCU protection.
209        // Accessing `PidNamespace` outside of RCU protection requires a reference count that
210        // must've been acquired while holding the RCU lock. Note that accessing a non-`current`
211        // task means `NULL` can be returned as the non-`current` task could have already passed
212        // through `release_task()`.
213        //
214        // To retrieve (1) the `current_pid_ns!()` macro should be used which ensure that the
215        // returned `PidNamespace` cannot outlive the calling scope. The associated
216        // `current_pid_ns()` function should not be called directly as it could be abused to
217        // created an unbounded lifetime for `PidNamespace`. The `current_pid_ns!()` macro allows
218        // Rust to handle the common case of accessing `current`'s `PidNamespace` without RCU
219        // protection and without having to acquire a reference count.
220        //
221        // For (2) the `task_get_pid_ns()` method must be used. This will always acquire a
222        // reference on `PidNamespace` and will return an `Option` to force the caller to
223        // explicitly handle the case where `PidNamespace` is `None`, something that tends to be
224        // forgotten when doing the equivalent operation in `C`. Missing RCU primitives make it
225        // difficult to perform operations that are otherwise safe without holding a reference
226        // count as long as RCU protection is guaranteed. But it is not important currently. But we
227        // do want it in the future.
228        //
229        // Note for (2) the required RCU protection around calling `task_active_pid_ns()`
230        // synchronizes against putting the last reference of the associated `struct pid` of
231        // `task->thread_pid`. The `struct pid` stored in that field is used to retrieve the
232        // `PidNamespace` of the caller. When `release_task()` is called `task->thread_pid` will be
233        // `NULL`ed and `put_pid()` on said `struct pid` will be delayed in `free_pid()` via
234        // `call_rcu()` allowing everyone with an RCU protected access to the `struct pid` acquired
235        // from `task->thread_pid` to finish.
236        //
237        // SAFETY: The current task's pid namespace is valid as long as the current task is running.
238        let pidns = unsafe { bindings::task_active_pid_ns(Task::current_raw()) };
239        PidNamespaceRef {
240            // SAFETY: If the current thread is still running, the current task and its associated
241            // pid namespace are valid. `PidNamespaceRef` is not `Send`, so we know it cannot be
242            // transferred to another thread (where it could potentially outlive the current
243            // `Task`). The caller needs to ensure that the PidNamespaceRef doesn't outlive the
244            // current task/thread.
245            task: unsafe { PidNamespace::from_ptr(pidns) },
246            _not_send: NotThreadSafe,
247        }
248    }
249
250    /// Returns a raw pointer to the task.
251    #[inline]
252    pub fn as_ptr(&self) -> *mut bindings::task_struct {
253        self.0.get()
254    }
255
256    /// Returns the group leader of the given task.
257    pub fn group_leader(&self) -> &Task {
258        // SAFETY: The group leader of a task never changes after initialization, so reading this
259        // field is not a data race.
260        let ptr = unsafe { *ptr::addr_of!((*self.as_ptr()).group_leader) };
261
262        // SAFETY: The lifetime of the returned task reference is tied to the lifetime of `self`,
263        // and given that a task has a reference to its group leader, we know it must be valid for
264        // the lifetime of the returned task reference.
265        unsafe { &*ptr.cast() }
266    }
267
268    /// Returns the PID of the given task.
269    pub fn pid(&self) -> Pid {
270        // SAFETY: The pid of a task never changes after initialization, so reading this field is
271        // not a data race.
272        unsafe { *ptr::addr_of!((*self.as_ptr()).pid) }
273    }
274
275    /// Returns the UID of the given task.
276    pub fn uid(&self) -> Kuid {
277        // SAFETY: It's always safe to call `task_uid` on a valid task.
278        Kuid::from_raw(unsafe { bindings::task_uid(self.as_ptr()) })
279    }
280
281    /// Returns the effective UID of the given task.
282    pub fn euid(&self) -> Kuid {
283        // SAFETY: It's always safe to call `task_euid` on a valid task.
284        Kuid::from_raw(unsafe { bindings::task_euid(self.as_ptr()) })
285    }
286
287    /// Determines whether the given task has pending signals.
288    pub fn signal_pending(&self) -> bool {
289        // SAFETY: It's always safe to call `signal_pending` on a valid task.
290        unsafe { bindings::signal_pending(self.as_ptr()) != 0 }
291    }
292
293    /// Returns task's pid namespace with elevated reference count
294    pub fn get_pid_ns(&self) -> Option<ARef<PidNamespace>> {
295        // SAFETY: By the type invariant, we know that `self.0` is valid.
296        let ptr = unsafe { bindings::task_get_pid_ns(self.as_ptr()) };
297        if ptr.is_null() {
298            None
299        } else {
300            // SAFETY: `ptr` is valid by the safety requirements of this function. And we own a
301            // reference count via `task_get_pid_ns()`.
302            // CAST: `Self` is a `repr(transparent)` wrapper around `bindings::pid_namespace`.
303            Some(unsafe { ARef::from_raw(ptr::NonNull::new_unchecked(ptr.cast::<PidNamespace>())) })
304        }
305    }
306
307    /// Returns the given task's pid in the provided pid namespace.
308    #[doc(alias = "task_tgid_nr_ns")]
309    pub fn tgid_nr_ns(&self, pidns: Option<&PidNamespace>) -> Pid {
310        let pidns = match pidns {
311            Some(pidns) => pidns.as_ptr(),
312            None => core::ptr::null_mut(),
313        };
314        // SAFETY: By the type invariant, we know that `self.0` is valid. We received a valid
315        // PidNamespace that we can use as a pointer or we received an empty PidNamespace and
316        // thus pass a null pointer. The underlying C function is safe to be used with NULL
317        // pointers.
318        unsafe { bindings::task_tgid_nr_ns(self.as_ptr(), pidns) }
319    }
320
321    /// Wakes up the task.
322    pub fn wake_up(&self) {
323        // SAFETY: It's always safe to call `signal_pending` on a valid task, even if the task
324        // running.
325        unsafe { bindings::wake_up_process(self.as_ptr()) };
326    }
327}
328
329// SAFETY: The type invariants guarantee that `Task` is always refcounted.
330unsafe impl crate::types::AlwaysRefCounted for Task {
331    fn inc_ref(&self) {
332        // SAFETY: The existence of a shared reference means that the refcount is nonzero.
333        unsafe { bindings::get_task_struct(self.as_ptr()) };
334    }
335
336    unsafe fn dec_ref(obj: ptr::NonNull<Self>) {
337        // SAFETY: The safety requirements guarantee that the refcount is nonzero.
338        unsafe { bindings::put_task_struct(obj.cast().as_ptr()) }
339    }
340}
341
342impl Kuid {
343    /// Get the current euid.
344    #[inline]
345    pub fn current_euid() -> Kuid {
346        // SAFETY: Just an FFI call.
347        Self::from_raw(unsafe { bindings::current_euid() })
348    }
349
350    /// Create a `Kuid` given the raw C type.
351    #[inline]
352    pub fn from_raw(kuid: bindings::kuid_t) -> Self {
353        Self { kuid }
354    }
355
356    /// Turn this kuid into the raw C type.
357    #[inline]
358    pub fn into_raw(self) -> bindings::kuid_t {
359        self.kuid
360    }
361
362    /// Converts this kernel UID into a userspace UID.
363    ///
364    /// Uses the namespace of the current task.
365    #[inline]
366    pub fn into_uid_in_current_ns(self) -> bindings::uid_t {
367        // SAFETY: Just an FFI call.
368        unsafe { bindings::from_kuid(bindings::current_user_ns(), self.kuid) }
369    }
370}
371
372impl PartialEq for Kuid {
373    #[inline]
374    fn eq(&self, other: &Kuid) -> bool {
375        // SAFETY: Just an FFI call.
376        unsafe { bindings::uid_eq(self.kuid, other.kuid) }
377    }
378}
379
380impl Eq for Kuid {}