1 // SPDX-License-Identifier: GPL-2.0 2 /* 3 * Copyright (C) 2015 Thomas Meyer (thomas@m3y3r.de) 4 * Copyright (C) 2002- 2007 Jeff Dike (jdike@{addtoit,linux.intel}.com) 5 */ 6 7 #include <stdlib.h> 8 #include <stdbool.h> 9 #include <unistd.h> 10 #include <sched.h> 11 #include <errno.h> 12 #include <string.h> 13 #include <sys/mman.h> 14 #include <sys/wait.h> 15 #include <asm/unistd.h> 16 #include <as-layout.h> 17 #include <init.h> 18 #include <kern_util.h> 19 #include <mem.h> 20 #include <os.h> 21 #include <ptrace_user.h> 22 #include <registers.h> 23 #include <skas.h> 24 #include <sysdep/stub.h> 25 #include <linux/threads.h> 26 #include "../internal.h" 27 28 int is_skas_winch(int pid, int fd, void *data) 29 { 30 return pid == getpgrp(); 31 } 32 33 static const char *ptrace_reg_name(int idx) 34 { 35 #define R(n) case HOST_##n: return #n 36 37 switch (idx) { 38 #ifdef __x86_64__ 39 R(BX); 40 R(CX); 41 R(DI); 42 R(SI); 43 R(DX); 44 R(BP); 45 R(AX); 46 R(R8); 47 R(R9); 48 R(R10); 49 R(R11); 50 R(R12); 51 R(R13); 52 R(R14); 53 R(R15); 54 R(ORIG_AX); 55 R(CS); 56 R(SS); 57 R(EFLAGS); 58 #elif defined(__i386__) 59 R(IP); 60 R(SP); 61 R(EFLAGS); 62 R(AX); 63 R(BX); 64 R(CX); 65 R(DX); 66 R(SI); 67 R(DI); 68 R(BP); 69 R(CS); 70 R(SS); 71 R(DS); 72 R(FS); 73 R(ES); 74 R(GS); 75 R(ORIG_AX); 76 #endif 77 } 78 return ""; 79 } 80 81 static int ptrace_dump_regs(int pid) 82 { 83 unsigned long regs[MAX_REG_NR]; 84 int i; 85 86 if (ptrace(PTRACE_GETREGS, pid, 0, regs) < 0) 87 return -errno; 88 89 printk(UM_KERN_ERR "Stub registers -\n"); 90 for (i = 0; i < ARRAY_SIZE(regs); i++) { 91 const char *regname = ptrace_reg_name(i); 92 93 printk(UM_KERN_ERR "\t%s\t(%2d): %lx\n", regname, i, regs[i]); 94 } 95 96 return 0; 97 } 98 99 /* 100 * Signals that are OK to receive in the stub - we'll just continue it. 101 * SIGWINCH will happen when UML is inside a detached screen. 102 */ 103 #define STUB_SIG_MASK ((1 << SIGALRM) | (1 << SIGWINCH)) 104 105 /* Signals that the stub will finish with - anything else is an error */ 106 #define STUB_DONE_MASK (1 << SIGTRAP) 107 108 void wait_stub_done(int pid) 109 { 110 int n, status, err; 111 112 while (1) { 113 CATCH_EINTR(n = waitpid(pid, &status, WUNTRACED | __WALL)); 114 if ((n < 0) || !WIFSTOPPED(status)) 115 goto bad_wait; 116 117 if (((1 << WSTOPSIG(status)) & STUB_SIG_MASK) == 0) 118 break; 119 120 err = ptrace(PTRACE_CONT, pid, 0, 0); 121 if (err) { 122 printk(UM_KERN_ERR "%s : continue failed, errno = %d\n", 123 __func__, errno); 124 fatal_sigsegv(); 125 } 126 } 127 128 if (((1 << WSTOPSIG(status)) & STUB_DONE_MASK) != 0) 129 return; 130 131 bad_wait: 132 err = ptrace_dump_regs(pid); 133 if (err) 134 printk(UM_KERN_ERR "Failed to get registers from stub, errno = %d\n", 135 -err); 136 printk(UM_KERN_ERR "%s : failed to wait for SIGTRAP, pid = %d, n = %d, errno = %d, status = 0x%x\n", 137 __func__, pid, n, errno, status); 138 fatal_sigsegv(); 139 } 140 141 extern unsigned long current_stub_stack(void); 142 143 static void get_skas_faultinfo(int pid, struct faultinfo *fi, unsigned long *aux_fp_regs) 144 { 145 int err; 146 147 err = get_fp_registers(pid, aux_fp_regs); 148 if (err < 0) { 149 printk(UM_KERN_ERR "save_fp_registers returned %d\n", 150 err); 151 fatal_sigsegv(); 152 } 153 err = ptrace(PTRACE_CONT, pid, 0, SIGSEGV); 154 if (err) { 155 printk(UM_KERN_ERR "Failed to continue stub, pid = %d, " 156 "errno = %d\n", pid, errno); 157 fatal_sigsegv(); 158 } 159 wait_stub_done(pid); 160 161 /* 162 * faultinfo is prepared by the stub_segv_handler at start of 163 * the stub stack page. We just have to copy it. 164 */ 165 memcpy(fi, (void *)current_stub_stack(), sizeof(*fi)); 166 167 err = put_fp_registers(pid, aux_fp_regs); 168 if (err < 0) { 169 printk(UM_KERN_ERR "put_fp_registers returned %d\n", 170 err); 171 fatal_sigsegv(); 172 } 173 } 174 175 static void handle_segv(int pid, struct uml_pt_regs *regs, unsigned long *aux_fp_regs) 176 { 177 get_skas_faultinfo(pid, ®s->faultinfo, aux_fp_regs); 178 segv(regs->faultinfo, 0, 1, NULL); 179 } 180 181 static void handle_trap(int pid, struct uml_pt_regs *regs) 182 { 183 if ((UPT_IP(regs) >= STUB_START) && (UPT_IP(regs) < STUB_END)) 184 fatal_sigsegv(); 185 186 handle_syscall(regs); 187 } 188 189 extern char __syscall_stub_start[]; 190 191 /** 192 * userspace_tramp() - userspace trampoline 193 * @stack: pointer to the new userspace stack page 194 * 195 * The userspace trampoline is used to setup a new userspace process in start_userspace() after it was clone()'ed. 196 * This function will run on a temporary stack page. 197 * It ptrace()'es itself, then 198 * Two pages are mapped into the userspace address space: 199 * - STUB_CODE (with EXEC), which contains the skas stub code 200 * - STUB_DATA (with R/W), which contains a data page that is used to transfer certain data between the UML userspace process and the UML kernel. 201 * Also for the userspace process a SIGSEGV handler is installed to catch pagefaults in the userspace process. 202 * And last the process stops itself to give control to the UML kernel for this userspace process. 203 * 204 * Return: Always zero, otherwise the current userspace process is ended with non null exit() call 205 */ 206 static int userspace_tramp(void *stack) 207 { 208 struct sigaction sa; 209 void *addr; 210 int fd; 211 unsigned long long offset; 212 unsigned long segv_handler = STUB_CODE + 213 (unsigned long) stub_segv_handler - 214 (unsigned long) __syscall_stub_start; 215 216 ptrace(PTRACE_TRACEME, 0, 0, 0); 217 218 signal(SIGTERM, SIG_DFL); 219 signal(SIGWINCH, SIG_IGN); 220 221 fd = phys_mapping(uml_to_phys(__syscall_stub_start), &offset); 222 addr = mmap64((void *) STUB_CODE, UM_KERN_PAGE_SIZE, 223 PROT_EXEC, MAP_FIXED | MAP_PRIVATE, fd, offset); 224 if (addr == MAP_FAILED) { 225 os_info("mapping mmap stub at 0x%lx failed, errno = %d\n", 226 STUB_CODE, errno); 227 exit(1); 228 } 229 230 fd = phys_mapping(uml_to_phys(stack), &offset); 231 addr = mmap((void *) STUB_DATA, 232 STUB_DATA_PAGES * UM_KERN_PAGE_SIZE, PROT_READ | PROT_WRITE, 233 MAP_FIXED | MAP_SHARED, fd, offset); 234 if (addr == MAP_FAILED) { 235 os_info("mapping segfault stack at 0x%lx failed, errno = %d\n", 236 STUB_DATA, errno); 237 exit(1); 238 } 239 240 set_sigstack((void *) STUB_DATA, STUB_DATA_PAGES * UM_KERN_PAGE_SIZE); 241 sigemptyset(&sa.sa_mask); 242 sa.sa_flags = SA_ONSTACK | SA_NODEFER | SA_SIGINFO; 243 sa.sa_sigaction = (void *) segv_handler; 244 sa.sa_restorer = NULL; 245 if (sigaction(SIGSEGV, &sa, NULL) < 0) { 246 os_info("%s - setting SIGSEGV handler failed - errno = %d\n", 247 __func__, errno); 248 exit(1); 249 } 250 251 kill(os_getpid(), SIGSTOP); 252 return 0; 253 } 254 255 int userspace_pid[NR_CPUS]; 256 int kill_userspace_mm[NR_CPUS]; 257 258 /** 259 * start_userspace() - prepare a new userspace process 260 * @stub_stack: pointer to the stub stack. 261 * 262 * Setups a new temporary stack page that is used while userspace_tramp() runs 263 * Clones the kernel process into a new userspace process, with FDs only. 264 * 265 * Return: When positive: the process id of the new userspace process, 266 * when negative: an error number. 267 * FIXME: can PIDs become negative?! 268 */ 269 int start_userspace(unsigned long stub_stack) 270 { 271 void *stack; 272 unsigned long sp; 273 int pid, status, n, flags, err; 274 275 /* setup a temporary stack page */ 276 stack = mmap(NULL, UM_KERN_PAGE_SIZE, 277 PROT_READ | PROT_WRITE | PROT_EXEC, 278 MAP_PRIVATE | MAP_ANONYMOUS, -1, 0); 279 if (stack == MAP_FAILED) { 280 err = -errno; 281 printk(UM_KERN_ERR "%s : mmap failed, errno = %d\n", 282 __func__, errno); 283 return err; 284 } 285 286 /* set stack pointer to the end of the stack page, so it can grow downwards */ 287 sp = (unsigned long)stack + UM_KERN_PAGE_SIZE; 288 289 flags = CLONE_FILES | SIGCHLD; 290 291 /* clone into new userspace process */ 292 pid = clone(userspace_tramp, (void *) sp, flags, (void *) stub_stack); 293 if (pid < 0) { 294 err = -errno; 295 printk(UM_KERN_ERR "%s : clone failed, errno = %d\n", 296 __func__, errno); 297 return err; 298 } 299 300 do { 301 CATCH_EINTR(n = waitpid(pid, &status, WUNTRACED | __WALL)); 302 if (n < 0) { 303 err = -errno; 304 printk(UM_KERN_ERR "%s : wait failed, errno = %d\n", 305 __func__, errno); 306 goto out_kill; 307 } 308 } while (WIFSTOPPED(status) && (WSTOPSIG(status) == SIGALRM)); 309 310 if (!WIFSTOPPED(status) || (WSTOPSIG(status) != SIGSTOP)) { 311 err = -EINVAL; 312 printk(UM_KERN_ERR "%s : expected SIGSTOP, got status = %d\n", 313 __func__, status); 314 goto out_kill; 315 } 316 317 if (ptrace(PTRACE_SETOPTIONS, pid, NULL, 318 (void *) PTRACE_O_TRACESYSGOOD) < 0) { 319 err = -errno; 320 printk(UM_KERN_ERR "%s : PTRACE_SETOPTIONS failed, errno = %d\n", 321 __func__, errno); 322 goto out_kill; 323 } 324 325 if (munmap(stack, UM_KERN_PAGE_SIZE) < 0) { 326 err = -errno; 327 printk(UM_KERN_ERR "%s : munmap failed, errno = %d\n", 328 __func__, errno); 329 goto out_kill; 330 } 331 332 return pid; 333 334 out_kill: 335 os_kill_ptraced_process(pid, 1); 336 return err; 337 } 338 339 void userspace(struct uml_pt_regs *regs, unsigned long *aux_fp_regs) 340 { 341 int err, status, op, pid = userspace_pid[0]; 342 siginfo_t si; 343 344 /* Handle any immediate reschedules or signals */ 345 interrupt_end(); 346 347 while (1) { 348 if (kill_userspace_mm[0]) 349 fatal_sigsegv(); 350 351 /* 352 * This can legitimately fail if the process loads a 353 * bogus value into a segment register. It will 354 * segfault and PTRACE_GETREGS will read that value 355 * out of the process. However, PTRACE_SETREGS will 356 * fail. In this case, there is nothing to do but 357 * just kill the process. 358 */ 359 if (ptrace(PTRACE_SETREGS, pid, 0, regs->gp)) { 360 printk(UM_KERN_ERR "%s - ptrace set regs failed, errno = %d\n", 361 __func__, errno); 362 fatal_sigsegv(); 363 } 364 365 if (put_fp_registers(pid, regs->fp)) { 366 printk(UM_KERN_ERR "%s - ptrace set fp regs failed, errno = %d\n", 367 __func__, errno); 368 fatal_sigsegv(); 369 } 370 371 if (singlestepping()) 372 op = PTRACE_SYSEMU_SINGLESTEP; 373 else 374 op = PTRACE_SYSEMU; 375 376 if (ptrace(op, pid, 0, 0)) { 377 printk(UM_KERN_ERR "%s - ptrace continue failed, op = %d, errno = %d\n", 378 __func__, op, errno); 379 fatal_sigsegv(); 380 } 381 382 CATCH_EINTR(err = waitpid(pid, &status, WUNTRACED | __WALL)); 383 if (err < 0) { 384 printk(UM_KERN_ERR "%s - wait failed, errno = %d\n", 385 __func__, errno); 386 fatal_sigsegv(); 387 } 388 389 regs->is_user = 1; 390 if (ptrace(PTRACE_GETREGS, pid, 0, regs->gp)) { 391 printk(UM_KERN_ERR "%s - PTRACE_GETREGS failed, errno = %d\n", 392 __func__, errno); 393 fatal_sigsegv(); 394 } 395 396 if (get_fp_registers(pid, regs->fp)) { 397 printk(UM_KERN_ERR "%s - get_fp_registers failed, errno = %d\n", 398 __func__, errno); 399 fatal_sigsegv(); 400 } 401 402 UPT_SYSCALL_NR(regs) = -1; /* Assume: It's not a syscall */ 403 404 if (WIFSTOPPED(status)) { 405 int sig = WSTOPSIG(status); 406 407 /* These signal handlers need the si argument. 408 * The SIGIO and SIGALARM handlers which constitute the 409 * majority of invocations, do not use it. 410 */ 411 switch (sig) { 412 case SIGSEGV: 413 case SIGTRAP: 414 case SIGILL: 415 case SIGBUS: 416 case SIGFPE: 417 case SIGWINCH: 418 ptrace(PTRACE_GETSIGINFO, pid, 0, (struct siginfo *)&si); 419 break; 420 } 421 422 switch (sig) { 423 case SIGSEGV: 424 if (PTRACE_FULL_FAULTINFO) { 425 get_skas_faultinfo(pid, 426 ®s->faultinfo, aux_fp_regs); 427 (*sig_info[SIGSEGV])(SIGSEGV, (struct siginfo *)&si, 428 regs); 429 } 430 else handle_segv(pid, regs, aux_fp_regs); 431 break; 432 case SIGTRAP + 0x80: 433 handle_trap(pid, regs); 434 break; 435 case SIGTRAP: 436 relay_signal(SIGTRAP, (struct siginfo *)&si, regs); 437 break; 438 case SIGALRM: 439 break; 440 case SIGIO: 441 case SIGILL: 442 case SIGBUS: 443 case SIGFPE: 444 case SIGWINCH: 445 block_signals_trace(); 446 (*sig_info[sig])(sig, (struct siginfo *)&si, regs); 447 unblock_signals_trace(); 448 break; 449 default: 450 printk(UM_KERN_ERR "%s - child stopped with signal %d\n", 451 __func__, sig); 452 fatal_sigsegv(); 453 } 454 pid = userspace_pid[0]; 455 interrupt_end(); 456 457 /* Avoid -ERESTARTSYS handling in host */ 458 if (PT_SYSCALL_NR_OFFSET != PT_SYSCALL_RET_OFFSET) 459 PT_SYSCALL_NR(regs->gp) = -1; 460 } 461 } 462 } 463 464 static unsigned long thread_regs[MAX_REG_NR]; 465 static unsigned long thread_fp_regs[FP_SIZE]; 466 467 static int __init init_thread_regs(void) 468 { 469 get_safe_registers(thread_regs, thread_fp_regs); 470 /* Set parent's instruction pointer to start of clone-stub */ 471 thread_regs[REGS_IP_INDEX] = STUB_CODE + 472 (unsigned long) stub_clone_handler - 473 (unsigned long) __syscall_stub_start; 474 thread_regs[REGS_SP_INDEX] = STUB_DATA + STUB_DATA_PAGES * UM_KERN_PAGE_SIZE - 475 sizeof(void *); 476 #ifdef __SIGNAL_FRAMESIZE 477 thread_regs[REGS_SP_INDEX] -= __SIGNAL_FRAMESIZE; 478 #endif 479 return 0; 480 } 481 482 __initcall(init_thread_regs); 483 484 int copy_context_skas0(unsigned long new_stack, int pid) 485 { 486 int err; 487 unsigned long current_stack = current_stub_stack(); 488 struct stub_data *data = (struct stub_data *) current_stack; 489 struct stub_data *child_data = (struct stub_data *) new_stack; 490 unsigned long long new_offset; 491 int new_fd = phys_mapping(uml_to_phys((void *)new_stack), &new_offset); 492 493 /* 494 * prepare offset and fd of child's stack as argument for parent's 495 * and child's mmap2 calls 496 */ 497 *data = ((struct stub_data) { 498 .offset = MMAP_OFFSET(new_offset), 499 .fd = new_fd, 500 .parent_err = -ESRCH, 501 .child_err = 0, 502 }); 503 504 *child_data = ((struct stub_data) { 505 .child_err = -ESRCH, 506 }); 507 508 err = ptrace_setregs(pid, thread_regs); 509 if (err < 0) { 510 err = -errno; 511 printk(UM_KERN_ERR "%s : PTRACE_SETREGS failed, pid = %d, errno = %d\n", 512 __func__, pid, -err); 513 return err; 514 } 515 516 err = put_fp_registers(pid, thread_fp_regs); 517 if (err < 0) { 518 printk(UM_KERN_ERR "%s : put_fp_registers failed, pid = %d, err = %d\n", 519 __func__, pid, err); 520 return err; 521 } 522 523 /* 524 * Wait, until parent has finished its work: read child's pid from 525 * parent's stack, and check, if bad result. 526 */ 527 err = ptrace(PTRACE_CONT, pid, 0, 0); 528 if (err) { 529 err = -errno; 530 printk(UM_KERN_ERR "Failed to continue new process, pid = %d, errno = %d\n", 531 pid, errno); 532 return err; 533 } 534 535 wait_stub_done(pid); 536 537 pid = data->parent_err; 538 if (pid < 0) { 539 printk(UM_KERN_ERR "%s - stub-parent reports error %d\n", 540 __func__, -pid); 541 return pid; 542 } 543 544 /* 545 * Wait, until child has finished too: read child's result from 546 * child's stack and check it. 547 */ 548 wait_stub_done(pid); 549 if (child_data->child_err != STUB_DATA) { 550 printk(UM_KERN_ERR "%s - stub-child %d reports error %ld\n", 551 __func__, pid, data->child_err); 552 err = data->child_err; 553 goto out_kill; 554 } 555 556 if (ptrace(PTRACE_SETOPTIONS, pid, NULL, 557 (void *)PTRACE_O_TRACESYSGOOD) < 0) { 558 err = -errno; 559 printk(UM_KERN_ERR "%s : PTRACE_SETOPTIONS failed, errno = %d\n", 560 __func__, errno); 561 goto out_kill; 562 } 563 564 return pid; 565 566 out_kill: 567 os_kill_ptraced_process(pid, 1); 568 return err; 569 } 570 571 void new_thread(void *stack, jmp_buf *buf, void (*handler)(void)) 572 { 573 (*buf)[0].JB_IP = (unsigned long) handler; 574 (*buf)[0].JB_SP = (unsigned long) stack + UM_THREAD_SIZE - 575 sizeof(void *); 576 } 577 578 #define INIT_JMP_NEW_THREAD 0 579 #define INIT_JMP_CALLBACK 1 580 #define INIT_JMP_HALT 2 581 #define INIT_JMP_REBOOT 3 582 583 void switch_threads(jmp_buf *me, jmp_buf *you) 584 { 585 if (UML_SETJMP(me) == 0) 586 UML_LONGJMP(you, 1); 587 } 588 589 static jmp_buf initial_jmpbuf; 590 591 /* XXX Make these percpu */ 592 static void (*cb_proc)(void *arg); 593 static void *cb_arg; 594 static jmp_buf *cb_back; 595 596 int start_idle_thread(void *stack, jmp_buf *switch_buf) 597 { 598 int n; 599 600 set_handler(SIGWINCH); 601 602 /* 603 * Can't use UML_SETJMP or UML_LONGJMP here because they save 604 * and restore signals, with the possible side-effect of 605 * trying to handle any signals which came when they were 606 * blocked, which can't be done on this stack. 607 * Signals must be blocked when jumping back here and restored 608 * after returning to the jumper. 609 */ 610 n = setjmp(initial_jmpbuf); 611 switch (n) { 612 case INIT_JMP_NEW_THREAD: 613 (*switch_buf)[0].JB_IP = (unsigned long) uml_finishsetup; 614 (*switch_buf)[0].JB_SP = (unsigned long) stack + 615 UM_THREAD_SIZE - sizeof(void *); 616 break; 617 case INIT_JMP_CALLBACK: 618 (*cb_proc)(cb_arg); 619 longjmp(*cb_back, 1); 620 break; 621 case INIT_JMP_HALT: 622 kmalloc_ok = 0; 623 return 0; 624 case INIT_JMP_REBOOT: 625 kmalloc_ok = 0; 626 return 1; 627 default: 628 printk(UM_KERN_ERR "Bad sigsetjmp return in %s - %d\n", 629 __func__, n); 630 fatal_sigsegv(); 631 } 632 longjmp(*switch_buf, 1); 633 634 /* unreachable */ 635 printk(UM_KERN_ERR "impossible long jump!"); 636 fatal_sigsegv(); 637 return 0; 638 } 639 640 void initial_thread_cb_skas(void (*proc)(void *), void *arg) 641 { 642 jmp_buf here; 643 644 cb_proc = proc; 645 cb_arg = arg; 646 cb_back = &here; 647 648 block_signals_trace(); 649 if (UML_SETJMP(&here) == 0) 650 UML_LONGJMP(&initial_jmpbuf, INIT_JMP_CALLBACK); 651 unblock_signals_trace(); 652 653 cb_proc = NULL; 654 cb_arg = NULL; 655 cb_back = NULL; 656 } 657 658 void halt_skas(void) 659 { 660 block_signals_trace(); 661 UML_LONGJMP(&initial_jmpbuf, INIT_JMP_HALT); 662 } 663 664 static bool noreboot; 665 666 static int __init noreboot_cmd_param(char *str, int *add) 667 { 668 noreboot = true; 669 return 0; 670 } 671 672 __uml_setup("noreboot", noreboot_cmd_param, 673 "noreboot\n" 674 " Rather than rebooting, exit always, akin to QEMU's -no-reboot option.\n" 675 " This is useful if you're using CONFIG_PANIC_TIMEOUT in order to catch\n" 676 " crashes in CI\n"); 677 678 void reboot_skas(void) 679 { 680 block_signals_trace(); 681 UML_LONGJMP(&initial_jmpbuf, noreboot ? INIT_JMP_HALT : INIT_JMP_REBOOT); 682 } 683 684 void __switch_mm(struct mm_id *mm_idp) 685 { 686 userspace_pid[0] = mm_idp->u.pid; 687 kill_userspace_mm[0] = mm_idp->kill; 688 } 689