1 // SPDX-License-Identifier: GPL-2.0 2 /* 3 * Copyright (C) 2015 Thomas Meyer (thomas@m3y3r.de) 4 * Copyright (C) 2002- 2007 Jeff Dike (jdike@{addtoit,linux.intel}.com) 5 */ 6 7 #include <stdlib.h> 8 #include <stdbool.h> 9 #include <unistd.h> 10 #include <sched.h> 11 #include <errno.h> 12 #include <string.h> 13 #include <sys/mman.h> 14 #include <sys/wait.h> 15 #include <asm/unistd.h> 16 #include <as-layout.h> 17 #include <init.h> 18 #include <kern_util.h> 19 #include <mem.h> 20 #include <os.h> 21 #include <ptrace_user.h> 22 #include <registers.h> 23 #include <skas.h> 24 #include <sysdep/stub.h> 25 #include <linux/threads.h> 26 #include <timetravel.h> 27 #include "../internal.h" 28 is_skas_winch(int pid,int fd,void * data)29 int is_skas_winch(int pid, int fd, void *data) 30 { 31 return pid == getpgrp(); 32 } 33 ptrace_reg_name(int idx)34 static const char *ptrace_reg_name(int idx) 35 { 36 #define R(n) case HOST_##n: return #n 37 38 switch (idx) { 39 #ifdef __x86_64__ 40 R(BX); 41 R(CX); 42 R(DI); 43 R(SI); 44 R(DX); 45 R(BP); 46 R(AX); 47 R(R8); 48 R(R9); 49 R(R10); 50 R(R11); 51 R(R12); 52 R(R13); 53 R(R14); 54 R(R15); 55 R(ORIG_AX); 56 R(CS); 57 R(SS); 58 R(EFLAGS); 59 #elif defined(__i386__) 60 R(IP); 61 R(SP); 62 R(EFLAGS); 63 R(AX); 64 R(BX); 65 R(CX); 66 R(DX); 67 R(SI); 68 R(DI); 69 R(BP); 70 R(CS); 71 R(SS); 72 R(DS); 73 R(FS); 74 R(ES); 75 R(GS); 76 R(ORIG_AX); 77 #endif 78 } 79 return ""; 80 } 81 ptrace_dump_regs(int pid)82 static int ptrace_dump_regs(int pid) 83 { 84 unsigned long regs[MAX_REG_NR]; 85 int i; 86 87 if (ptrace(PTRACE_GETREGS, pid, 0, regs) < 0) 88 return -errno; 89 90 printk(UM_KERN_ERR "Stub registers -\n"); 91 for (i = 0; i < ARRAY_SIZE(regs); i++) { 92 const char *regname = ptrace_reg_name(i); 93 94 printk(UM_KERN_ERR "\t%s\t(%2d): %lx\n", regname, i, regs[i]); 95 } 96 97 return 0; 98 } 99 100 /* 101 * Signals that are OK to receive in the stub - we'll just continue it. 102 * SIGWINCH will happen when UML is inside a detached screen. 103 */ 104 #define STUB_SIG_MASK ((1 << SIGALRM) | (1 << SIGWINCH)) 105 106 /* Signals that the stub will finish with - anything else is an error */ 107 #define STUB_DONE_MASK (1 << SIGTRAP) 108 wait_stub_done(int pid)109 void wait_stub_done(int pid) 110 { 111 int n, status, err; 112 113 while (1) { 114 CATCH_EINTR(n = waitpid(pid, &status, WUNTRACED | __WALL)); 115 if ((n < 0) || !WIFSTOPPED(status)) 116 goto bad_wait; 117 118 if (((1 << WSTOPSIG(status)) & STUB_SIG_MASK) == 0) 119 break; 120 121 err = ptrace(PTRACE_CONT, pid, 0, 0); 122 if (err) { 123 printk(UM_KERN_ERR "%s : continue failed, errno = %d\n", 124 __func__, errno); 125 fatal_sigsegv(); 126 } 127 } 128 129 if (((1 << WSTOPSIG(status)) & STUB_DONE_MASK) != 0) 130 return; 131 132 bad_wait: 133 err = ptrace_dump_regs(pid); 134 if (err) 135 printk(UM_KERN_ERR "Failed to get registers from stub, errno = %d\n", 136 -err); 137 printk(UM_KERN_ERR "%s : failed to wait for SIGTRAP, pid = %d, n = %d, errno = %d, status = 0x%x\n", 138 __func__, pid, n, errno, status); 139 fatal_sigsegv(); 140 } 141 142 extern unsigned long current_stub_stack(void); 143 get_skas_faultinfo(int pid,struct faultinfo * fi,unsigned long * aux_fp_regs)144 static void get_skas_faultinfo(int pid, struct faultinfo *fi, unsigned long *aux_fp_regs) 145 { 146 int err; 147 148 err = get_fp_registers(pid, aux_fp_regs); 149 if (err < 0) { 150 printk(UM_KERN_ERR "save_fp_registers returned %d\n", 151 err); 152 fatal_sigsegv(); 153 } 154 err = ptrace(PTRACE_CONT, pid, 0, SIGSEGV); 155 if (err) { 156 printk(UM_KERN_ERR "Failed to continue stub, pid = %d, " 157 "errno = %d\n", pid, errno); 158 fatal_sigsegv(); 159 } 160 wait_stub_done(pid); 161 162 /* 163 * faultinfo is prepared by the stub_segv_handler at start of 164 * the stub stack page. We just have to copy it. 165 */ 166 memcpy(fi, (void *)current_stub_stack(), sizeof(*fi)); 167 168 err = put_fp_registers(pid, aux_fp_regs); 169 if (err < 0) { 170 printk(UM_KERN_ERR "put_fp_registers returned %d\n", 171 err); 172 fatal_sigsegv(); 173 } 174 } 175 handle_segv(int pid,struct uml_pt_regs * regs,unsigned long * aux_fp_regs)176 static void handle_segv(int pid, struct uml_pt_regs *regs, unsigned long *aux_fp_regs) 177 { 178 get_skas_faultinfo(pid, ®s->faultinfo, aux_fp_regs); 179 segv(regs->faultinfo, 0, 1, NULL); 180 } 181 handle_trap(int pid,struct uml_pt_regs * regs)182 static void handle_trap(int pid, struct uml_pt_regs *regs) 183 { 184 if ((UPT_IP(regs) >= STUB_START) && (UPT_IP(regs) < STUB_END)) 185 fatal_sigsegv(); 186 187 handle_syscall(regs); 188 } 189 190 extern char __syscall_stub_start[]; 191 192 /** 193 * userspace_tramp() - userspace trampoline 194 * @stack: pointer to the new userspace stack page 195 * 196 * The userspace trampoline is used to setup a new userspace process in start_userspace() after it was clone()'ed. 197 * This function will run on a temporary stack page. 198 * It ptrace()'es itself, then 199 * Two pages are mapped into the userspace address space: 200 * - STUB_CODE (with EXEC), which contains the skas stub code 201 * - STUB_DATA (with R/W), which contains a data page that is used to transfer certain data between the UML userspace process and the UML kernel. 202 * Also for the userspace process a SIGSEGV handler is installed to catch pagefaults in the userspace process. 203 * And last the process stops itself to give control to the UML kernel for this userspace process. 204 * 205 * Return: Always zero, otherwise the current userspace process is ended with non null exit() call 206 */ userspace_tramp(void * stack)207 static int userspace_tramp(void *stack) 208 { 209 struct sigaction sa; 210 void *addr; 211 int fd; 212 unsigned long long offset; 213 unsigned long segv_handler = STUB_CODE + 214 (unsigned long) stub_segv_handler - 215 (unsigned long) __syscall_stub_start; 216 217 ptrace(PTRACE_TRACEME, 0, 0, 0); 218 219 signal(SIGTERM, SIG_DFL); 220 signal(SIGWINCH, SIG_IGN); 221 222 fd = phys_mapping(uml_to_phys(__syscall_stub_start), &offset); 223 addr = mmap64((void *) STUB_CODE, UM_KERN_PAGE_SIZE, 224 PROT_EXEC, MAP_FIXED | MAP_PRIVATE, fd, offset); 225 if (addr == MAP_FAILED) { 226 os_info("mapping mmap stub at 0x%lx failed, errno = %d\n", 227 STUB_CODE, errno); 228 exit(1); 229 } 230 231 fd = phys_mapping(uml_to_phys(stack), &offset); 232 addr = mmap((void *) STUB_DATA, 233 STUB_DATA_PAGES * UM_KERN_PAGE_SIZE, PROT_READ | PROT_WRITE, 234 MAP_FIXED | MAP_SHARED, fd, offset); 235 if (addr == MAP_FAILED) { 236 os_info("mapping segfault stack at 0x%lx failed, errno = %d\n", 237 STUB_DATA, errno); 238 exit(1); 239 } 240 241 set_sigstack((void *) STUB_DATA, STUB_DATA_PAGES * UM_KERN_PAGE_SIZE); 242 sigemptyset(&sa.sa_mask); 243 sa.sa_flags = SA_ONSTACK | SA_NODEFER | SA_SIGINFO; 244 sa.sa_sigaction = (void *) segv_handler; 245 sa.sa_restorer = NULL; 246 if (sigaction(SIGSEGV, &sa, NULL) < 0) { 247 os_info("%s - setting SIGSEGV handler failed - errno = %d\n", 248 __func__, errno); 249 exit(1); 250 } 251 252 kill(os_getpid(), SIGSTOP); 253 return 0; 254 } 255 256 int userspace_pid[NR_CPUS]; 257 258 /** 259 * start_userspace() - prepare a new userspace process 260 * @stub_stack: pointer to the stub stack. 261 * 262 * Setups a new temporary stack page that is used while userspace_tramp() runs 263 * Clones the kernel process into a new userspace process, with FDs only. 264 * 265 * Return: When positive: the process id of the new userspace process, 266 * when negative: an error number. 267 * FIXME: can PIDs become negative?! 268 */ start_userspace(unsigned long stub_stack)269 int start_userspace(unsigned long stub_stack) 270 { 271 void *stack; 272 unsigned long sp; 273 int pid, status, n, flags, err; 274 275 /* setup a temporary stack page */ 276 stack = mmap(NULL, UM_KERN_PAGE_SIZE, 277 PROT_READ | PROT_WRITE | PROT_EXEC, 278 MAP_PRIVATE | MAP_ANONYMOUS, -1, 0); 279 if (stack == MAP_FAILED) { 280 err = -errno; 281 printk(UM_KERN_ERR "%s : mmap failed, errno = %d\n", 282 __func__, errno); 283 return err; 284 } 285 286 /* set stack pointer to the end of the stack page, so it can grow downwards */ 287 sp = (unsigned long)stack + UM_KERN_PAGE_SIZE; 288 289 flags = CLONE_FILES | SIGCHLD; 290 291 /* clone into new userspace process */ 292 pid = clone(userspace_tramp, (void *) sp, flags, (void *) stub_stack); 293 if (pid < 0) { 294 err = -errno; 295 printk(UM_KERN_ERR "%s : clone failed, errno = %d\n", 296 __func__, errno); 297 return err; 298 } 299 300 do { 301 CATCH_EINTR(n = waitpid(pid, &status, WUNTRACED | __WALL)); 302 if (n < 0) { 303 err = -errno; 304 printk(UM_KERN_ERR "%s : wait failed, errno = %d\n", 305 __func__, errno); 306 goto out_kill; 307 } 308 } while (WIFSTOPPED(status) && (WSTOPSIG(status) == SIGALRM)); 309 310 if (!WIFSTOPPED(status) || (WSTOPSIG(status) != SIGSTOP)) { 311 err = -EINVAL; 312 printk(UM_KERN_ERR "%s : expected SIGSTOP, got status = %d\n", 313 __func__, status); 314 goto out_kill; 315 } 316 317 if (ptrace(PTRACE_SETOPTIONS, pid, NULL, 318 (void *) PTRACE_O_TRACESYSGOOD) < 0) { 319 err = -errno; 320 printk(UM_KERN_ERR "%s : PTRACE_SETOPTIONS failed, errno = %d\n", 321 __func__, errno); 322 goto out_kill; 323 } 324 325 if (munmap(stack, UM_KERN_PAGE_SIZE) < 0) { 326 err = -errno; 327 printk(UM_KERN_ERR "%s : munmap failed, errno = %d\n", 328 __func__, errno); 329 goto out_kill; 330 } 331 332 return pid; 333 334 out_kill: 335 os_kill_ptraced_process(pid, 1); 336 return err; 337 } 338 userspace(struct uml_pt_regs * regs,unsigned long * aux_fp_regs)339 void userspace(struct uml_pt_regs *regs, unsigned long *aux_fp_regs) 340 { 341 int err, status, op, pid = userspace_pid[0]; 342 siginfo_t si; 343 344 /* Handle any immediate reschedules or signals */ 345 interrupt_end(); 346 347 while (1) { 348 time_travel_print_bc_msg(); 349 350 current_mm_sync(); 351 352 /* Flush out any pending syscalls */ 353 err = syscall_stub_flush(current_mm_id()); 354 if (err) { 355 if (err == -ENOMEM) 356 report_enomem(); 357 358 printk(UM_KERN_ERR "%s - Error flushing stub syscalls: %d", 359 __func__, -err); 360 fatal_sigsegv(); 361 } 362 363 /* 364 * This can legitimately fail if the process loads a 365 * bogus value into a segment register. It will 366 * segfault and PTRACE_GETREGS will read that value 367 * out of the process. However, PTRACE_SETREGS will 368 * fail. In this case, there is nothing to do but 369 * just kill the process. 370 */ 371 if (ptrace(PTRACE_SETREGS, pid, 0, regs->gp)) { 372 printk(UM_KERN_ERR "%s - ptrace set regs failed, errno = %d\n", 373 __func__, errno); 374 fatal_sigsegv(); 375 } 376 377 if (put_fp_registers(pid, regs->fp)) { 378 printk(UM_KERN_ERR "%s - ptrace set fp regs failed, errno = %d\n", 379 __func__, errno); 380 fatal_sigsegv(); 381 } 382 383 if (singlestepping()) 384 op = PTRACE_SYSEMU_SINGLESTEP; 385 else 386 op = PTRACE_SYSEMU; 387 388 if (ptrace(op, pid, 0, 0)) { 389 printk(UM_KERN_ERR "%s - ptrace continue failed, op = %d, errno = %d\n", 390 __func__, op, errno); 391 fatal_sigsegv(); 392 } 393 394 CATCH_EINTR(err = waitpid(pid, &status, WUNTRACED | __WALL)); 395 if (err < 0) { 396 printk(UM_KERN_ERR "%s - wait failed, errno = %d\n", 397 __func__, errno); 398 fatal_sigsegv(); 399 } 400 401 regs->is_user = 1; 402 if (ptrace(PTRACE_GETREGS, pid, 0, regs->gp)) { 403 printk(UM_KERN_ERR "%s - PTRACE_GETREGS failed, errno = %d\n", 404 __func__, errno); 405 fatal_sigsegv(); 406 } 407 408 if (get_fp_registers(pid, regs->fp)) { 409 printk(UM_KERN_ERR "%s - get_fp_registers failed, errno = %d\n", 410 __func__, errno); 411 fatal_sigsegv(); 412 } 413 414 UPT_SYSCALL_NR(regs) = -1; /* Assume: It's not a syscall */ 415 416 if (WIFSTOPPED(status)) { 417 int sig = WSTOPSIG(status); 418 419 /* These signal handlers need the si argument. 420 * The SIGIO and SIGALARM handlers which constitute the 421 * majority of invocations, do not use it. 422 */ 423 switch (sig) { 424 case SIGSEGV: 425 case SIGTRAP: 426 case SIGILL: 427 case SIGBUS: 428 case SIGFPE: 429 case SIGWINCH: 430 ptrace(PTRACE_GETSIGINFO, pid, 0, (struct siginfo *)&si); 431 break; 432 } 433 434 switch (sig) { 435 case SIGSEGV: 436 if (PTRACE_FULL_FAULTINFO) { 437 get_skas_faultinfo(pid, 438 ®s->faultinfo, aux_fp_regs); 439 (*sig_info[SIGSEGV])(SIGSEGV, (struct siginfo *)&si, 440 regs); 441 } 442 else handle_segv(pid, regs, aux_fp_regs); 443 break; 444 case SIGTRAP + 0x80: 445 handle_trap(pid, regs); 446 break; 447 case SIGTRAP: 448 relay_signal(SIGTRAP, (struct siginfo *)&si, regs); 449 break; 450 case SIGALRM: 451 break; 452 case SIGIO: 453 case SIGILL: 454 case SIGBUS: 455 case SIGFPE: 456 case SIGWINCH: 457 block_signals_trace(); 458 (*sig_info[sig])(sig, (struct siginfo *)&si, regs); 459 unblock_signals_trace(); 460 break; 461 default: 462 printk(UM_KERN_ERR "%s - child stopped with signal %d\n", 463 __func__, sig); 464 fatal_sigsegv(); 465 } 466 pid = userspace_pid[0]; 467 interrupt_end(); 468 469 /* Avoid -ERESTARTSYS handling in host */ 470 if (PT_SYSCALL_NR_OFFSET != PT_SYSCALL_RET_OFFSET) 471 PT_SYSCALL_NR(regs->gp) = -1; 472 } 473 } 474 } 475 new_thread(void * stack,jmp_buf * buf,void (* handler)(void))476 void new_thread(void *stack, jmp_buf *buf, void (*handler)(void)) 477 { 478 (*buf)[0].JB_IP = (unsigned long) handler; 479 (*buf)[0].JB_SP = (unsigned long) stack + UM_THREAD_SIZE - 480 sizeof(void *); 481 } 482 483 #define INIT_JMP_NEW_THREAD 0 484 #define INIT_JMP_CALLBACK 1 485 #define INIT_JMP_HALT 2 486 #define INIT_JMP_REBOOT 3 487 switch_threads(jmp_buf * me,jmp_buf * you)488 void switch_threads(jmp_buf *me, jmp_buf *you) 489 { 490 if (UML_SETJMP(me) == 0) 491 UML_LONGJMP(you, 1); 492 } 493 494 static jmp_buf initial_jmpbuf; 495 496 /* XXX Make these percpu */ 497 static void (*cb_proc)(void *arg); 498 static void *cb_arg; 499 static jmp_buf *cb_back; 500 start_idle_thread(void * stack,jmp_buf * switch_buf)501 int start_idle_thread(void *stack, jmp_buf *switch_buf) 502 { 503 int n; 504 505 set_handler(SIGWINCH); 506 507 /* 508 * Can't use UML_SETJMP or UML_LONGJMP here because they save 509 * and restore signals, with the possible side-effect of 510 * trying to handle any signals which came when they were 511 * blocked, which can't be done on this stack. 512 * Signals must be blocked when jumping back here and restored 513 * after returning to the jumper. 514 */ 515 n = setjmp(initial_jmpbuf); 516 switch (n) { 517 case INIT_JMP_NEW_THREAD: 518 (*switch_buf)[0].JB_IP = (unsigned long) uml_finishsetup; 519 (*switch_buf)[0].JB_SP = (unsigned long) stack + 520 UM_THREAD_SIZE - sizeof(void *); 521 break; 522 case INIT_JMP_CALLBACK: 523 (*cb_proc)(cb_arg); 524 longjmp(*cb_back, 1); 525 break; 526 case INIT_JMP_HALT: 527 kmalloc_ok = 0; 528 return 0; 529 case INIT_JMP_REBOOT: 530 kmalloc_ok = 0; 531 return 1; 532 default: 533 printk(UM_KERN_ERR "Bad sigsetjmp return in %s - %d\n", 534 __func__, n); 535 fatal_sigsegv(); 536 } 537 longjmp(*switch_buf, 1); 538 539 /* unreachable */ 540 printk(UM_KERN_ERR "impossible long jump!"); 541 fatal_sigsegv(); 542 return 0; 543 } 544 initial_thread_cb_skas(void (* proc)(void *),void * arg)545 void initial_thread_cb_skas(void (*proc)(void *), void *arg) 546 { 547 jmp_buf here; 548 549 cb_proc = proc; 550 cb_arg = arg; 551 cb_back = &here; 552 553 block_signals_trace(); 554 if (UML_SETJMP(&here) == 0) 555 UML_LONGJMP(&initial_jmpbuf, INIT_JMP_CALLBACK); 556 unblock_signals_trace(); 557 558 cb_proc = NULL; 559 cb_arg = NULL; 560 cb_back = NULL; 561 } 562 halt_skas(void)563 void halt_skas(void) 564 { 565 block_signals_trace(); 566 UML_LONGJMP(&initial_jmpbuf, INIT_JMP_HALT); 567 } 568 569 static bool noreboot; 570 noreboot_cmd_param(char * str,int * add)571 static int __init noreboot_cmd_param(char *str, int *add) 572 { 573 noreboot = true; 574 return 0; 575 } 576 577 __uml_setup("noreboot", noreboot_cmd_param, 578 "noreboot\n" 579 " Rather than rebooting, exit always, akin to QEMU's -no-reboot option.\n" 580 " This is useful if you're using CONFIG_PANIC_TIMEOUT in order to catch\n" 581 " crashes in CI\n"); 582 reboot_skas(void)583 void reboot_skas(void) 584 { 585 block_signals_trace(); 586 UML_LONGJMP(&initial_jmpbuf, noreboot ? INIT_JMP_HALT : INIT_JMP_REBOOT); 587 } 588 __switch_mm(struct mm_id * mm_idp)589 void __switch_mm(struct mm_id *mm_idp) 590 { 591 userspace_pid[0] = mm_idp->pid; 592 } 593