1 // SPDX-License-Identifier: GPL-2.0
2 /*
3 * Copyright (C) 2015 Thomas Meyer (thomas@m3y3r.de)
4 * Copyright (C) 2002- 2007 Jeff Dike (jdike@{addtoit,linux.intel}.com)
5 */
6
7 #include <stdlib.h>
8 #include <unistd.h>
9 #include <sched.h>
10 #include <errno.h>
11 #include <string.h>
12 #include <sys/mman.h>
13 #include <sys/wait.h>
14 #include <asm/unistd.h>
15 #include <as-layout.h>
16 #include <init.h>
17 #include <kern_util.h>
18 #include <mem.h>
19 #include <os.h>
20 #include <ptrace_user.h>
21 #include <registers.h>
22 #include <skas.h>
23 #include <sysdep/stub.h>
24 #include <linux/threads.h>
25
is_skas_winch(int pid,int fd,void * data)26 int is_skas_winch(int pid, int fd, void *data)
27 {
28 return pid == getpgrp();
29 }
30
ptrace_dump_regs(int pid)31 static int ptrace_dump_regs(int pid)
32 {
33 unsigned long regs[MAX_REG_NR];
34 int i;
35
36 if (ptrace(PTRACE_GETREGS, pid, 0, regs) < 0)
37 return -errno;
38
39 printk(UM_KERN_ERR "Stub registers -\n");
40 for (i = 0; i < ARRAY_SIZE(regs); i++)
41 printk(UM_KERN_ERR "\t%d - %lx\n", i, regs[i]);
42
43 return 0;
44 }
45
46 /*
47 * Signals that are OK to receive in the stub - we'll just continue it.
48 * SIGWINCH will happen when UML is inside a detached screen.
49 */
50 #define STUB_SIG_MASK ((1 << SIGALRM) | (1 << SIGWINCH))
51
52 /* Signals that the stub will finish with - anything else is an error */
53 #define STUB_DONE_MASK (1 << SIGTRAP)
54
wait_stub_done(int pid)55 void wait_stub_done(int pid)
56 {
57 int n, status, err;
58
59 while (1) {
60 CATCH_EINTR(n = waitpid(pid, &status, WUNTRACED | __WALL));
61 if ((n < 0) || !WIFSTOPPED(status))
62 goto bad_wait;
63
64 if (((1 << WSTOPSIG(status)) & STUB_SIG_MASK) == 0)
65 break;
66
67 err = ptrace(PTRACE_CONT, pid, 0, 0);
68 if (err) {
69 printk(UM_KERN_ERR "wait_stub_done : continue failed, "
70 "errno = %d\n", errno);
71 fatal_sigsegv();
72 }
73 }
74
75 if (((1 << WSTOPSIG(status)) & STUB_DONE_MASK) != 0)
76 return;
77
78 bad_wait:
79 err = ptrace_dump_regs(pid);
80 if (err)
81 printk(UM_KERN_ERR "Failed to get registers from stub, "
82 "errno = %d\n", -err);
83 printk(UM_KERN_ERR "wait_stub_done : failed to wait for SIGTRAP, "
84 "pid = %d, n = %d, errno = %d, status = 0x%x\n", pid, n, errno,
85 status);
86 fatal_sigsegv();
87 }
88
89 extern unsigned long current_stub_stack(void);
90
get_skas_faultinfo(int pid,struct faultinfo * fi,unsigned long * aux_fp_regs)91 static void get_skas_faultinfo(int pid, struct faultinfo *fi, unsigned long *aux_fp_regs)
92 {
93 int err;
94
95 err = get_fp_registers(pid, aux_fp_regs);
96 if (err < 0) {
97 printk(UM_KERN_ERR "save_fp_registers returned %d\n",
98 err);
99 fatal_sigsegv();
100 }
101 err = ptrace(PTRACE_CONT, pid, 0, SIGSEGV);
102 if (err) {
103 printk(UM_KERN_ERR "Failed to continue stub, pid = %d, "
104 "errno = %d\n", pid, errno);
105 fatal_sigsegv();
106 }
107 wait_stub_done(pid);
108
109 /*
110 * faultinfo is prepared by the stub_segv_handler at start of
111 * the stub stack page. We just have to copy it.
112 */
113 memcpy(fi, (void *)current_stub_stack(), sizeof(*fi));
114
115 err = put_fp_registers(pid, aux_fp_regs);
116 if (err < 0) {
117 printk(UM_KERN_ERR "put_fp_registers returned %d\n",
118 err);
119 fatal_sigsegv();
120 }
121 }
122
handle_segv(int pid,struct uml_pt_regs * regs,unsigned long * aux_fp_regs)123 static void handle_segv(int pid, struct uml_pt_regs *regs, unsigned long *aux_fp_regs)
124 {
125 get_skas_faultinfo(pid, ®s->faultinfo, aux_fp_regs);
126 segv(regs->faultinfo, 0, 1, NULL);
127 }
128
129 /*
130 * To use the same value of using_sysemu as the caller, ask it that value
131 * (in local_using_sysemu
132 */
handle_trap(int pid,struct uml_pt_regs * regs,int local_using_sysemu)133 static void handle_trap(int pid, struct uml_pt_regs *regs,
134 int local_using_sysemu)
135 {
136 int err, status;
137
138 if ((UPT_IP(regs) >= STUB_START) && (UPT_IP(regs) < STUB_END))
139 fatal_sigsegv();
140
141 if (!local_using_sysemu)
142 {
143 err = ptrace(PTRACE_POKEUSER, pid, PT_SYSCALL_NR_OFFSET,
144 __NR_getpid);
145 if (err < 0) {
146 printk(UM_KERN_ERR "handle_trap - nullifying syscall "
147 "failed, errno = %d\n", errno);
148 fatal_sigsegv();
149 }
150
151 err = ptrace(PTRACE_SYSCALL, pid, 0, 0);
152 if (err < 0) {
153 printk(UM_KERN_ERR "handle_trap - continuing to end of "
154 "syscall failed, errno = %d\n", errno);
155 fatal_sigsegv();
156 }
157
158 CATCH_EINTR(err = waitpid(pid, &status, WUNTRACED | __WALL));
159 if ((err < 0) || !WIFSTOPPED(status) ||
160 (WSTOPSIG(status) != SIGTRAP + 0x80)) {
161 err = ptrace_dump_regs(pid);
162 if (err)
163 printk(UM_KERN_ERR "Failed to get registers "
164 "from process, errno = %d\n", -err);
165 printk(UM_KERN_ERR "handle_trap - failed to wait at "
166 "end of syscall, errno = %d, status = %d\n",
167 errno, status);
168 fatal_sigsegv();
169 }
170 }
171
172 handle_syscall(regs);
173 }
174
175 extern char __syscall_stub_start[];
176
177 /**
178 * userspace_tramp() - userspace trampoline
179 * @stack: pointer to the new userspace stack page, can be NULL, if? FIXME:
180 *
181 * The userspace trampoline is used to setup a new userspace process in start_userspace() after it was clone()'ed.
182 * This function will run on a temporary stack page.
183 * It ptrace()'es itself, then
184 * Two pages are mapped into the userspace address space:
185 * - STUB_CODE (with EXEC), which contains the skas stub code
186 * - STUB_DATA (with R/W), which contains a data page that is used to transfer certain data between the UML userspace process and the UML kernel.
187 * Also for the userspace process a SIGSEGV handler is installed to catch pagefaults in the userspace process.
188 * And last the process stops itself to give control to the UML kernel for this userspace process.
189 *
190 * Return: Always zero, otherwise the current userspace process is ended with non null exit() call
191 */
userspace_tramp(void * stack)192 static int userspace_tramp(void *stack)
193 {
194 void *addr;
195 int fd;
196 unsigned long long offset;
197
198 ptrace(PTRACE_TRACEME, 0, 0, 0);
199
200 signal(SIGTERM, SIG_DFL);
201 signal(SIGWINCH, SIG_IGN);
202
203 /*
204 * This has a pte, but it can't be mapped in with the usual
205 * tlb_flush mechanism because this is part of that mechanism
206 */
207 fd = phys_mapping(to_phys(__syscall_stub_start), &offset);
208 addr = mmap64((void *) STUB_CODE, UM_KERN_PAGE_SIZE,
209 PROT_EXEC, MAP_FIXED | MAP_PRIVATE, fd, offset);
210 if (addr == MAP_FAILED) {
211 printk(UM_KERN_ERR "mapping mmap stub at 0x%lx failed, "
212 "errno = %d\n", STUB_CODE, errno);
213 exit(1);
214 }
215
216 if (stack != NULL) {
217 fd = phys_mapping(to_phys(stack), &offset);
218 addr = mmap((void *) STUB_DATA,
219 UM_KERN_PAGE_SIZE, PROT_READ | PROT_WRITE,
220 MAP_FIXED | MAP_SHARED, fd, offset);
221 if (addr == MAP_FAILED) {
222 printk(UM_KERN_ERR "mapping segfault stack "
223 "at 0x%lx failed, errno = %d\n",
224 STUB_DATA, errno);
225 exit(1);
226 }
227 }
228 if (stack != NULL) {
229 struct sigaction sa;
230
231 unsigned long v = STUB_CODE +
232 (unsigned long) stub_segv_handler -
233 (unsigned long) __syscall_stub_start;
234
235 set_sigstack((void *) STUB_DATA, UM_KERN_PAGE_SIZE);
236 sigemptyset(&sa.sa_mask);
237 sa.sa_flags = SA_ONSTACK | SA_NODEFER | SA_SIGINFO;
238 sa.sa_sigaction = (void *) v;
239 sa.sa_restorer = NULL;
240 if (sigaction(SIGSEGV, &sa, NULL) < 0) {
241 printk(UM_KERN_ERR "userspace_tramp - setting SIGSEGV "
242 "handler failed - errno = %d\n", errno);
243 exit(1);
244 }
245 }
246
247 kill(os_getpid(), SIGSTOP);
248 return 0;
249 }
250
251 int userspace_pid[NR_CPUS];
252 int kill_userspace_mm[NR_CPUS];
253
254 /**
255 * start_userspace() - prepare a new userspace process
256 * @stub_stack: pointer to the stub stack. Can be NULL, if? FIXME:
257 *
258 * Setups a new temporary stack page that is used while userspace_tramp() runs
259 * Clones the kernel process into a new userspace process, with FDs only.
260 *
261 * Return: When positive: the process id of the new userspace process,
262 * when negative: an error number.
263 * FIXME: can PIDs become negative?!
264 */
start_userspace(unsigned long stub_stack)265 int start_userspace(unsigned long stub_stack)
266 {
267 void *stack;
268 unsigned long sp;
269 int pid, status, n, flags, err;
270
271 /* setup a temporary stack page */
272 stack = mmap(NULL, UM_KERN_PAGE_SIZE,
273 PROT_READ | PROT_WRITE | PROT_EXEC,
274 MAP_PRIVATE | MAP_ANONYMOUS, -1, 0);
275 if (stack == MAP_FAILED) {
276 err = -errno;
277 printk(UM_KERN_ERR "start_userspace : mmap failed, "
278 "errno = %d\n", errno);
279 return err;
280 }
281
282 /* set stack pointer to the end of the stack page, so it can grow downwards */
283 sp = (unsigned long) stack + UM_KERN_PAGE_SIZE - sizeof(void *);
284
285 flags = CLONE_FILES | SIGCHLD;
286
287 /* clone into new userspace process */
288 pid = clone(userspace_tramp, (void *) sp, flags, (void *) stub_stack);
289 if (pid < 0) {
290 err = -errno;
291 printk(UM_KERN_ERR "start_userspace : clone failed, "
292 "errno = %d\n", errno);
293 return err;
294 }
295
296 do {
297 CATCH_EINTR(n = waitpid(pid, &status, WUNTRACED | __WALL));
298 if (n < 0) {
299 err = -errno;
300 printk(UM_KERN_ERR "start_userspace : wait failed, "
301 "errno = %d\n", errno);
302 goto out_kill;
303 }
304 } while (WIFSTOPPED(status) && (WSTOPSIG(status) == SIGALRM));
305
306 if (!WIFSTOPPED(status) || (WSTOPSIG(status) != SIGSTOP)) {
307 err = -EINVAL;
308 printk(UM_KERN_ERR "start_userspace : expected SIGSTOP, got "
309 "status = %d\n", status);
310 goto out_kill;
311 }
312
313 if (ptrace(PTRACE_OLDSETOPTIONS, pid, NULL,
314 (void *) PTRACE_O_TRACESYSGOOD) < 0) {
315 err = -errno;
316 printk(UM_KERN_ERR "start_userspace : PTRACE_OLDSETOPTIONS "
317 "failed, errno = %d\n", errno);
318 goto out_kill;
319 }
320
321 if (munmap(stack, UM_KERN_PAGE_SIZE) < 0) {
322 err = -errno;
323 printk(UM_KERN_ERR "start_userspace : munmap failed, "
324 "errno = %d\n", errno);
325 goto out_kill;
326 }
327
328 return pid;
329
330 out_kill:
331 os_kill_ptraced_process(pid, 1);
332 return err;
333 }
334
userspace(struct uml_pt_regs * regs,unsigned long * aux_fp_regs)335 void userspace(struct uml_pt_regs *regs, unsigned long *aux_fp_regs)
336 {
337 int err, status, op, pid = userspace_pid[0];
338 /* To prevent races if using_sysemu changes under us.*/
339 int local_using_sysemu;
340 siginfo_t si;
341
342 /* Handle any immediate reschedules or signals */
343 interrupt_end();
344
345 while (1) {
346 if (kill_userspace_mm[0])
347 fatal_sigsegv();
348
349 /*
350 * This can legitimately fail if the process loads a
351 * bogus value into a segment register. It will
352 * segfault and PTRACE_GETREGS will read that value
353 * out of the process. However, PTRACE_SETREGS will
354 * fail. In this case, there is nothing to do but
355 * just kill the process.
356 */
357 if (ptrace(PTRACE_SETREGS, pid, 0, regs->gp)) {
358 printk(UM_KERN_ERR "userspace - ptrace set regs "
359 "failed, errno = %d\n", errno);
360 fatal_sigsegv();
361 }
362
363 if (put_fp_registers(pid, regs->fp)) {
364 printk(UM_KERN_ERR "userspace - ptrace set fp regs "
365 "failed, errno = %d\n", errno);
366 fatal_sigsegv();
367 }
368
369 /* Now we set local_using_sysemu to be used for one loop */
370 local_using_sysemu = get_using_sysemu();
371
372 op = SELECT_PTRACE_OPERATION(local_using_sysemu,
373 singlestepping(NULL));
374
375 if (ptrace(op, pid, 0, 0)) {
376 printk(UM_KERN_ERR "userspace - ptrace continue "
377 "failed, op = %d, errno = %d\n", op, errno);
378 fatal_sigsegv();
379 }
380
381 CATCH_EINTR(err = waitpid(pid, &status, WUNTRACED | __WALL));
382 if (err < 0) {
383 printk(UM_KERN_ERR "userspace - wait failed, "
384 "errno = %d\n", errno);
385 fatal_sigsegv();
386 }
387
388 regs->is_user = 1;
389 if (ptrace(PTRACE_GETREGS, pid, 0, regs->gp)) {
390 printk(UM_KERN_ERR "userspace - PTRACE_GETREGS failed, "
391 "errno = %d\n", errno);
392 fatal_sigsegv();
393 }
394
395 if (get_fp_registers(pid, regs->fp)) {
396 printk(UM_KERN_ERR "userspace - get_fp_registers failed, "
397 "errno = %d\n", errno);
398 fatal_sigsegv();
399 }
400
401 UPT_SYSCALL_NR(regs) = -1; /* Assume: It's not a syscall */
402
403 if (WIFSTOPPED(status)) {
404 int sig = WSTOPSIG(status);
405
406 ptrace(PTRACE_GETSIGINFO, pid, 0, (struct siginfo *)&si);
407
408 switch (sig) {
409 case SIGSEGV:
410 if (PTRACE_FULL_FAULTINFO) {
411 get_skas_faultinfo(pid,
412 ®s->faultinfo, aux_fp_regs);
413 (*sig_info[SIGSEGV])(SIGSEGV, (struct siginfo *)&si,
414 regs);
415 }
416 else handle_segv(pid, regs, aux_fp_regs);
417 break;
418 case SIGTRAP + 0x80:
419 handle_trap(pid, regs, local_using_sysemu);
420 break;
421 case SIGTRAP:
422 relay_signal(SIGTRAP, (struct siginfo *)&si, regs);
423 break;
424 case SIGALRM:
425 break;
426 case SIGIO:
427 case SIGILL:
428 case SIGBUS:
429 case SIGFPE:
430 case SIGWINCH:
431 block_signals_trace();
432 (*sig_info[sig])(sig, (struct siginfo *)&si, regs);
433 unblock_signals_trace();
434 break;
435 default:
436 printk(UM_KERN_ERR "userspace - child stopped "
437 "with signal %d\n", sig);
438 fatal_sigsegv();
439 }
440 pid = userspace_pid[0];
441 interrupt_end();
442
443 /* Avoid -ERESTARTSYS handling in host */
444 if (PT_SYSCALL_NR_OFFSET != PT_SYSCALL_RET_OFFSET)
445 PT_SYSCALL_NR(regs->gp) = -1;
446 }
447 }
448 }
449
450 static unsigned long thread_regs[MAX_REG_NR];
451 static unsigned long thread_fp_regs[FP_SIZE];
452
init_thread_regs(void)453 static int __init init_thread_regs(void)
454 {
455 get_safe_registers(thread_regs, thread_fp_regs);
456 /* Set parent's instruction pointer to start of clone-stub */
457 thread_regs[REGS_IP_INDEX] = STUB_CODE +
458 (unsigned long) stub_clone_handler -
459 (unsigned long) __syscall_stub_start;
460 thread_regs[REGS_SP_INDEX] = STUB_DATA + UM_KERN_PAGE_SIZE -
461 sizeof(void *);
462 #ifdef __SIGNAL_FRAMESIZE
463 thread_regs[REGS_SP_INDEX] -= __SIGNAL_FRAMESIZE;
464 #endif
465 return 0;
466 }
467
468 __initcall(init_thread_regs);
469
copy_context_skas0(unsigned long new_stack,int pid)470 int copy_context_skas0(unsigned long new_stack, int pid)
471 {
472 int err;
473 unsigned long current_stack = current_stub_stack();
474 struct stub_data *data = (struct stub_data *) current_stack;
475 struct stub_data *child_data = (struct stub_data *) new_stack;
476 unsigned long long new_offset;
477 int new_fd = phys_mapping(to_phys((void *)new_stack), &new_offset);
478
479 /*
480 * prepare offset and fd of child's stack as argument for parent's
481 * and child's mmap2 calls
482 */
483 *data = ((struct stub_data) {
484 .offset = MMAP_OFFSET(new_offset),
485 .fd = new_fd
486 });
487
488 err = ptrace_setregs(pid, thread_regs);
489 if (err < 0) {
490 err = -errno;
491 printk(UM_KERN_ERR "copy_context_skas0 : PTRACE_SETREGS "
492 "failed, pid = %d, errno = %d\n", pid, -err);
493 return err;
494 }
495
496 err = put_fp_registers(pid, thread_fp_regs);
497 if (err < 0) {
498 printk(UM_KERN_ERR "copy_context_skas0 : put_fp_registers "
499 "failed, pid = %d, err = %d\n", pid, err);
500 return err;
501 }
502
503 /* set a well known return code for detection of child write failure */
504 child_data->err = 12345678;
505
506 /*
507 * Wait, until parent has finished its work: read child's pid from
508 * parent's stack, and check, if bad result.
509 */
510 err = ptrace(PTRACE_CONT, pid, 0, 0);
511 if (err) {
512 err = -errno;
513 printk(UM_KERN_ERR "Failed to continue new process, pid = %d, "
514 "errno = %d\n", pid, errno);
515 return err;
516 }
517
518 wait_stub_done(pid);
519
520 pid = data->err;
521 if (pid < 0) {
522 printk(UM_KERN_ERR "copy_context_skas0 - stub-parent reports "
523 "error %d\n", -pid);
524 return pid;
525 }
526
527 /*
528 * Wait, until child has finished too: read child's result from
529 * child's stack and check it.
530 */
531 wait_stub_done(pid);
532 if (child_data->err != STUB_DATA) {
533 printk(UM_KERN_ERR "copy_context_skas0 - stub-child reports "
534 "error %ld\n", child_data->err);
535 err = child_data->err;
536 goto out_kill;
537 }
538
539 if (ptrace(PTRACE_OLDSETOPTIONS, pid, NULL,
540 (void *)PTRACE_O_TRACESYSGOOD) < 0) {
541 err = -errno;
542 printk(UM_KERN_ERR "copy_context_skas0 : PTRACE_OLDSETOPTIONS "
543 "failed, errno = %d\n", errno);
544 goto out_kill;
545 }
546
547 return pid;
548
549 out_kill:
550 os_kill_ptraced_process(pid, 1);
551 return err;
552 }
553
new_thread(void * stack,jmp_buf * buf,void (* handler)(void))554 void new_thread(void *stack, jmp_buf *buf, void (*handler)(void))
555 {
556 (*buf)[0].JB_IP = (unsigned long) handler;
557 (*buf)[0].JB_SP = (unsigned long) stack + UM_THREAD_SIZE -
558 sizeof(void *);
559 }
560
561 #define INIT_JMP_NEW_THREAD 0
562 #define INIT_JMP_CALLBACK 1
563 #define INIT_JMP_HALT 2
564 #define INIT_JMP_REBOOT 3
565
switch_threads(jmp_buf * me,jmp_buf * you)566 void switch_threads(jmp_buf *me, jmp_buf *you)
567 {
568 if (UML_SETJMP(me) == 0)
569 UML_LONGJMP(you, 1);
570 }
571
572 static jmp_buf initial_jmpbuf;
573
574 /* XXX Make these percpu */
575 static void (*cb_proc)(void *arg);
576 static void *cb_arg;
577 static jmp_buf *cb_back;
578
start_idle_thread(void * stack,jmp_buf * switch_buf)579 int start_idle_thread(void *stack, jmp_buf *switch_buf)
580 {
581 int n;
582
583 set_handler(SIGWINCH);
584
585 /*
586 * Can't use UML_SETJMP or UML_LONGJMP here because they save
587 * and restore signals, with the possible side-effect of
588 * trying to handle any signals which came when they were
589 * blocked, which can't be done on this stack.
590 * Signals must be blocked when jumping back here and restored
591 * after returning to the jumper.
592 */
593 n = setjmp(initial_jmpbuf);
594 switch (n) {
595 case INIT_JMP_NEW_THREAD:
596 (*switch_buf)[0].JB_IP = (unsigned long) uml_finishsetup;
597 (*switch_buf)[0].JB_SP = (unsigned long) stack +
598 UM_THREAD_SIZE - sizeof(void *);
599 break;
600 case INIT_JMP_CALLBACK:
601 (*cb_proc)(cb_arg);
602 longjmp(*cb_back, 1);
603 break;
604 case INIT_JMP_HALT:
605 kmalloc_ok = 0;
606 return 0;
607 case INIT_JMP_REBOOT:
608 kmalloc_ok = 0;
609 return 1;
610 default:
611 printk(UM_KERN_ERR "Bad sigsetjmp return in "
612 "start_idle_thread - %d\n", n);
613 fatal_sigsegv();
614 }
615 longjmp(*switch_buf, 1);
616
617 /* unreachable */
618 printk(UM_KERN_ERR "impossible long jump!");
619 fatal_sigsegv();
620 return 0;
621 }
622
initial_thread_cb_skas(void (* proc)(void *),void * arg)623 void initial_thread_cb_skas(void (*proc)(void *), void *arg)
624 {
625 jmp_buf here;
626
627 cb_proc = proc;
628 cb_arg = arg;
629 cb_back = &here;
630
631 block_signals_trace();
632 if (UML_SETJMP(&here) == 0)
633 UML_LONGJMP(&initial_jmpbuf, INIT_JMP_CALLBACK);
634 unblock_signals_trace();
635
636 cb_proc = NULL;
637 cb_arg = NULL;
638 cb_back = NULL;
639 }
640
halt_skas(void)641 void halt_skas(void)
642 {
643 block_signals_trace();
644 UML_LONGJMP(&initial_jmpbuf, INIT_JMP_HALT);
645 }
646
reboot_skas(void)647 void reboot_skas(void)
648 {
649 block_signals_trace();
650 UML_LONGJMP(&initial_jmpbuf, INIT_JMP_REBOOT);
651 }
652
__switch_mm(struct mm_id * mm_idp)653 void __switch_mm(struct mm_id *mm_idp)
654 {
655 userspace_pid[0] = mm_idp->u.pid;
656 kill_userspace_mm[0] = mm_idp->kill;
657 }
658