1 // SPDX-License-Identifier: GPL-2.0
2 /*
3 * Copyright (C) 2015 Thomas Meyer (thomas@m3y3r.de)
4 * Copyright (C) 2002 - 2007 Jeff Dike (jdike@{addtoit,linux.intel}.com)
5 */
6
7 #include <linux/mm.h>
8 #include <linux/sched/signal.h>
9 #include <linux/slab.h>
10
11 #include <shared/irq_kern.h>
12 #include <asm/pgalloc.h>
13 #include <asm/sections.h>
14 #include <asm/mmu_context.h>
15 #include <as-layout.h>
16 #include <os.h>
17 #include <skas.h>
18 #include <stub-data.h>
19
20 /* Ensure the stub_data struct covers the allocated area */
21 static_assert(sizeof(struct stub_data) == STUB_DATA_PAGES * UM_KERN_PAGE_SIZE);
22
23 static spinlock_t mm_list_lock;
24 static struct list_head mm_list;
25
enter_turnstile(struct mm_id * mm_id)26 void enter_turnstile(struct mm_id *mm_id) __acquires(turnstile)
27 {
28 struct mm_context *ctx = container_of(mm_id, struct mm_context, id);
29
30 mutex_lock(&ctx->turnstile);
31 }
32
exit_turnstile(struct mm_id * mm_id)33 void exit_turnstile(struct mm_id *mm_id) __releases(turnstile)
34 {
35 struct mm_context *ctx = container_of(mm_id, struct mm_context, id);
36
37 mutex_unlock(&ctx->turnstile);
38 }
39
init_new_context(struct task_struct * task,struct mm_struct * mm)40 int init_new_context(struct task_struct *task, struct mm_struct *mm)
41 {
42 struct mm_id *new_id = &mm->context.id;
43 unsigned long stack = 0;
44 int ret = -ENOMEM;
45
46 mutex_init(&mm->context.turnstile);
47 spin_lock_init(&mm->context.sync_tlb_lock);
48
49 stack = __get_free_pages(GFP_KERNEL | __GFP_ZERO, ilog2(STUB_DATA_PAGES));
50 if (stack == 0)
51 goto out;
52
53 new_id->stack = stack;
54 new_id->syscall_data_len = 0;
55 new_id->syscall_fd_num = 0;
56
57 scoped_guard(spinlock_irqsave, &mm_list_lock) {
58 /* Insert into list, used for lookups when the child dies */
59 list_add(&mm->context.list, &mm_list);
60 }
61
62 ret = start_userspace(new_id);
63 if (ret < 0)
64 goto out_free;
65
66 /* Ensure the new MM is clean and nothing unwanted is mapped */
67 unmap(new_id, 0, STUB_START);
68
69 return 0;
70
71 out_free:
72 free_pages(new_id->stack, ilog2(STUB_DATA_PAGES));
73 out:
74 return ret;
75 }
76
destroy_context(struct mm_struct * mm)77 void destroy_context(struct mm_struct *mm)
78 {
79 struct mm_context *mmu = &mm->context;
80
81 /*
82 * If init_new_context wasn't called, this will be
83 * zero, resulting in a kill(0), which will result in the
84 * whole UML suddenly dying. Also, cover negative and
85 * 1 cases, since they shouldn't happen either.
86 *
87 * Negative cases happen if the child died unexpectedly.
88 */
89 if (mmu->id.pid >= 0 && mmu->id.pid < 2) {
90 printk(KERN_ERR "corrupt mm_context - pid = %d\n",
91 mmu->id.pid);
92 return;
93 }
94
95 scoped_guard(spinlock_irqsave, &mm_list_lock)
96 list_del(&mm->context.list);
97
98 if (mmu->id.pid > 0) {
99 os_kill_ptraced_process(mmu->id.pid, 1);
100 mmu->id.pid = -1;
101 }
102
103 if (using_seccomp && mmu->id.sock)
104 os_close_file(mmu->id.sock);
105
106 free_pages(mmu->id.stack, ilog2(STUB_DATA_PAGES));
107 }
108
mm_sigchld_irq(int irq,void * dev)109 static irqreturn_t mm_sigchld_irq(int irq, void* dev)
110 {
111 struct mm_context *mm_context;
112 pid_t pid;
113
114 guard(spinlock)(&mm_list_lock);
115
116 while ((pid = os_reap_child()) > 0) {
117 /*
118 * A child died, check if we have an MM with the PID. This is
119 * only relevant in SECCOMP mode (as ptrace will fail anyway).
120 *
121 * See wait_stub_done_seccomp for more details.
122 */
123 list_for_each_entry(mm_context, &mm_list, list) {
124 if (mm_context->id.pid == pid) {
125 struct stub_data *stub_data;
126 printk("Unexpectedly lost MM child! Affected tasks will segfault.");
127
128 /* Marks the MM as dead */
129 mm_context->id.pid = -1;
130
131 stub_data = (void *)mm_context->id.stack;
132 stub_data->futex = FUTEX_IN_KERN;
133 #if IS_ENABLED(CONFIG_SMP)
134 os_futex_wake(&stub_data->futex);
135 #endif
136
137 /*
138 * NOTE: Currently executing syscalls by
139 * affected tasks may finish normally.
140 */
141 break;
142 }
143 }
144 }
145
146 return IRQ_HANDLED;
147 }
148
init_child_tracking(void)149 static int __init init_child_tracking(void)
150 {
151 int err;
152
153 spin_lock_init(&mm_list_lock);
154 INIT_LIST_HEAD(&mm_list);
155
156 err = request_irq(SIGCHLD_IRQ, mm_sigchld_irq, 0, "SIGCHLD", NULL);
157 if (err < 0)
158 panic("Failed to register SIGCHLD IRQ: %d", err);
159
160 return 0;
161 }
162 early_initcall(init_child_tracking)
163