beenull/ladybird
1
0
Fork 0
mirror of https://github.com/LadybirdBrowser/ladybird.git synced 2024-11-27 01:50:24 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 7
ladybird/Kernel/Process.cpp

4991 lines
156 KiB
C++
Raw Normal View History

Meta: Add license header to source files As suggested by Joshua, this commit adds the 2-clause BSD license as a comment block to the top of every source file. For the first pass, I've just added myself for simplicity. I encourage everyone to add themselves as copyright holders of any file they've added or modified in some significant way. If I've added myself in error somewhere, feel free to replace it with the appropriate copyright holder instead. Going forward, all new source files should include a license header.
2020-01-18 08:38:21 +00:00
/*
* Copyright (c) 2018-2020, Andreas Kling <kling@serenityos.org>
* All rights reserved.
*
* Redistribution and use in source and binary forms, with or without
* modification, are permitted provided that the following conditions are met:
*
* 1. Redistributions of source code must retain the above copyright notice, this
* list of conditions and the following disclaimer.
*
* 2. Redistributions in binary form must reproduce the above copyright notice,
* this list of conditions and the following disclaimer in the documentation
* and/or other materials provided with the distribution.
*
* THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS"
* AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
* IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
* DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE
* FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
* DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR
* SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER
* CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY,
* OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
* OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
*/
Kernel: Enforce W^X between sys$mmap() and sys$execve() It's now an error to sys$mmap() a file as writable if it's currently mapped executable by anyone else. It's also an error to sys$execve() a file that's currently mapped writable by anyone else. This fixes a race condition vulnerability where one program could make modifications to an executable while another process was in the kernel, in the middle of exec'ing the same executable. Test: Kernel/elf-execve-mmap-race.cpp
2020-01-18 22:31:29 +00:00
#include <AK/Demangle.h>
Kernel: Add realpath syscall
2019-08-25 16:17:05 +00:00
#include <AK/FileSystemPath.h>
Kernel: Tighten up exec/do_exec and allow for PT_INTERP iterpreters This patch changes how exec() figures out which program image to actually load. Previously, we opened the path to our main executable in find_shebang_interpreter_for_executable, read the first page (or less, if the file was smaller) and then decided whether to recurse with the interpreter instead. We then then re-opened the main executable in do_exec. However, since we now want to parse the ELF header and Program Headers of an elf image before even doing any memory region work, we can change the way this whole process works. We open the file and read (up to) the first page in exec() itself, then pass just the page and the amount read to find_shebang_interpreter_for_executable. Since we now have that page and the FileDescription for the main executable handy, we can do a few things. First, validate the ELF header and ELF program headers for any shenanigans. ELF32 Little Endian i386 only, please. Second, we can grab the PT_INTERP interpreter from any ET_DYN files, and open that guy right away if it exists. Finally, we can pass the main executable's and optionally the PT_INTERP interpreter's file descriptions down to do_exec and not have to feel guilty about opening the file twice. In do_exec, we now have a choice. Are we going to load the main executable, or the interpreter? We could load both, but it'll be way easier for the inital pass on the RTLD if we only load the interpreter. Then it can load the main executable itself like any old shared object, just, the one with main in it :). Later on we can load both of them into memory and the RTLD can relocate itself before trying to do anything. The way it's written now the RTLD will get dibs on its requested virtual addresses being the actual virtual addresses.
2020-01-11 01:28:02 +00:00
#include <AK/ScopeGuard.h>
Kernel: Run clang-format on everything.
2019-06-07 09:43:58 +00:00
#include <AK/StdLibExtras.h>
Move WindowServer to userspace. This is a monster patch that required changing a whole bunch of things. There are performance and stability issues all over the place, but it works. Pretty cool, I have to admit :^)
2019-02-16 23:13:47 +00:00
#include <AK/StringBuilder.h>
Kernel: Fix timeout support in select The scheduler expects m_select_timeout to act as a deadline. That is, it should contain the time that a task should wake at -- but we were directly copying the time from userspace, which meant that it always returned virtually immediately. At the same time, fix CEventLoop to not rely on the broken select behavior by subtracting the current time from the time of the nearest timer.
2019-05-18 00:00:01 +00:00
#include <AK/Time.h>
Kernel: Run clang-format on everything.
2019-06-07 09:43:58 +00:00
#include <AK/Types.h>
Kernel: Remove redundant "ACPI" from filenames in ACPI/
2020-04-09 16:17:27 +00:00
#include <Kernel/ACPI/Parser.h>
Kernel: Move i386.{cpp,h} => Arch/i386/CPU.{cpp,h} There's a ton of work that would need to be done before we could spin up on another architecture, but let's at least try to separate things out a bit.
2019-06-07 18:02:01 +00:00
#include <Kernel/Arch/i386/CPU.h>
Kernel: Add forward declaration header
2020-02-16 00:50:16 +00:00
#include <Kernel/Devices/BlockDevice.h>
Kernel: Implement the setkeymap() syscall.
2019-11-23 07:48:07 +00:00
#include <Kernel/Devices/KeyboardDevice.h>
Kernel: Implement very simple kernel module loading It's now possible to load a .o file into the kernel via a syscall. The kernel will perform all the necessary ELF relocations, and then call the "module_init" symbol in the loaded module.
2019-11-28 19:59:11 +00:00
#include <Kernel/Devices/NullDevice.h>
Kernel: Move PC speaker beep timing logic from scheduler to the syscall I don't know why I put this in the scheduler to begin with.. the caller can just block until the beeping is finished.
2019-12-26 21:31:26 +00:00
#include <Kernel/Devices/PCSpeaker.h>
Kernel: Add a Linux-style getrandom syscall The way it gets the entropy and blasts it to the buffer is pretty ugly IMHO, but it does work for now. (It should be replaced, by not truncating a u32.) It implements an (unused for now) flags argument, like Linux but instead of OpenBSD's. This is in case we want to distinguish between entropy sources or any other reason and have to implement a new syscall later. Of course, learn from Linux's struggles with entropy sourcing too.
2019-10-13 14:41:55 +00:00
#include <Kernel/Devices/RandomDevice.h>
FileSystem: Port most of the code over to using custodies. The current working directory is now stored as a custody. Likewise for a process executable file. This unbreaks /proc/PID/fd which has not been working since we made the filesystem bigger. This still needs a bunch of work, for instance when renaming or removing a file somewhere, we have to update the relevant custody links.
2019-05-30 16:58:59 +00:00
#include <Kernel/FileSystem/Custody.h>
Kernel+LibC+Userland: Support mounting other kinds of filesystems
2019-08-15 16:13:56 +00:00
#include <Kernel/FileSystem/DevPtsFS.h>
Kernel: Support partial munmap() You can now munmap() a part of a region. The kernel will then create one or two new regions around the "hole" and re-map them using the same physical pages as before. This goes towards fixing #175, but not all the way since we don't yet do munmap() across multiple mappings.
2019-08-29 18:57:02 +00:00
#include <Kernel/FileSystem/Ext2FileSystem.h>
Kernel: Run clang-format on everything.
2019-06-07 09:43:58 +00:00
#include <Kernel/FileSystem/FIFO.h>
#include <Kernel/FileSystem/FileDescription.h>
Kernel: Add a mechanism for listening for changes to an inode. The syscall is quite simple: int watch_file(const char* path, int path_length); It returns a file descriptor referring to a "InodeWatcher" object in the kernel. It becomes readable whenever something changes about the inode. Currently this is implemented by hooking the "metadata dirty bit" in Inode which isn't perfect, but it's a start. :^)
2019-07-22 18:01:11 +00:00
#include <Kernel/FileSystem/InodeWatcher.h>
Kernel: Support partial munmap() You can now munmap() a part of a region. The kernel will then create one or two new regions around the "hole" and re-map them using the same physical pages as before. This goes towards fixing #175, but not all the way since we don't yet do munmap() across multiple mappings.
2019-08-29 18:57:02 +00:00
#include <Kernel/FileSystem/ProcFS.h>
#include <Kernel/FileSystem/TmpFS.h>
Kernel: Run clang-format on everything.
2019-06-07 09:43:58 +00:00
#include <Kernel/FileSystem/VirtualFileSystem.h>
ELF: Fail layout when program header hooks return nullptr (#673) ELFLoader::layout() had a "failed" variable that was never set. This patch checks the return value of each hook (alloc/map section and tls) and fails the load if they return null. I also needed to patch Process so that the alloc_section_hook and map_section_hook actually return nullptr when allocating a region fails. Fixes #664 :)
2019-10-20 14:24:42 +00:00
#include <Kernel/Heap/kmalloc.h>
Kernel: Use KBufferBuilder to build ProcFS files and backtraces This is not perfect as it uses a lot of VM, but since the buffers are supposed to be temporary it's not super terrible. This could be improved by giving back the unused VM to the kernel's RangeAllocator after finishing the buffer building.
2019-08-07 19:52:43 +00:00
#include <Kernel/KBufferBuilder.h>
Kernel: Qualify a bunch of #include statements.
2019-06-07 17:29:34 +00:00
#include <Kernel/KSyms.h>
Kernel+LibC: Publish a "kernel info page" and use it for gettimeofday() This patch adds a single "kernel info page" that is mappable read-only by any process and contains the current time of day. This is then used to implement a version of gettimeofday() that doesn't have to make a syscall. To protect against race condition issues, the info page also has a serial number which is incremented whenever the kernel updates the contents of the page. Make sure to verify that the serial number is the same before and after reading the information you want from the page.
2019-12-15 20:29:26 +00:00
#include <Kernel/KernelInfoPage.h>
Kernel: Implement very simple kernel module loading It's now possible to load a .o file into the kernel via a syscall. The kernel will perform all the necessary ELF relocations, and then call the "module_init" symbol in the loaded module.
2019-11-28 19:59:11 +00:00
#include <Kernel/Module.h>
Kernel: Make better use of the multiboot info. Define the multiboot info struct properly so we don't have to grab at byte offsets in the memory access checker code. Also print kernel command line in init().
2019-06-02 07:50:18 +00:00
#include <Kernel/Multiboot.h>
Kernel: Run clang-format on everything.
2019-06-07 09:43:58 +00:00
#include <Kernel/Net/Socket.h>
Kernel: Reduce header dependencies of Process and Thread
2020-02-16 01:01:42 +00:00
#include <Kernel/PerformanceEventBuffer.h>
Kernel: Qualify a bunch of #include statements.
2019-06-07 17:29:34 +00:00
#include <Kernel/Process.h>
Kernel: Implement a simple process time profiler The kernel now supports basic profiling of all the threads in a process by calling profiling_enable(pid_t). You finish the profiling by calling profiling_disable(pid_t). This all works by recording thread stacks when the timer interrupt fires and the current thread is in a process being profiled. Note that symbolication is deferred until profiling_disable() to avoid adding more noise than necessary to the profile. A simple "/bin/profile" command is included here that can be used to start/stop profiling like so: $ profile 10 on ... wait ... $ profile 10 off After a profile has been recorded, it can be fetched in /proc/profile There are various limits (or "bugs") on this mechanism at the moment: - Only one process can be profiled at a time. - We allocate 8MB for the samples, if you use more space, things will not work, and probably break a bit. - Things will probably fall apart if the profiled process dies during profiling, or while extracing /proc/profile
2019-12-11 19:36:56 +00:00
#include <Kernel/Profiling.h>
ptrace: Add PT_SETREGS PT_SETTREGS sets the regsiters of the traced thread. It can only be used when the tracee is stopped. Also, refactor ptrace. The implementation was getting long and cluttered the alraedy large Process.cpp file. This commit moves the bulk of the implementation to Kernel/Ptrace.cpp, and factors out peek & poke to separate methods of the Process class.
2020-04-07 15:23:37 +00:00
#include <Kernel/Ptrace.h>
Kernel: Qualify a bunch of #include statements.
2019-06-07 17:29:34 +00:00
#include <Kernel/RTC.h>
Kernel: Add a more expressive API for getting random bytes We now have these API's in <Kernel/Random.h>: - get_fast_random_bytes(u8* buffer, size_t buffer_size) - get_good_random_bytes(u8* buffer, size_t buffer_size) - get_fast_random<T>() - get_good_random<T>() Internally they both use x86 RDRAND if available, otherwise they fall back to the same LCG we had in RandomDevice all along. The main purpose of this patch is to give kernel code a way to better express its needs for random data. Randomness is something that will require a lot more work, but this is hopefully a step in the right direction.
2020-01-03 11:36:30 +00:00
#include <Kernel/Random.h>
Kernel: Qualify a bunch of #include statements.
2019-06-07 17:29:34 +00:00
#include <Kernel/Scheduler.h>
SharedBuffer: Fix deadlock on destroy We were locking the list of references, and then destroying the reference, which made things go a little crazy. It's more straightforward to just remove the per-reference lock: the syscalls all have to lock the full list anyway, so let's just do that and avoid the hassle. While I'm at it, also move the SharedBuffer code out to its own file as it's getting a little long and unwieldly, and Process.cpp is already huge.
2019-07-16 13:03:39 +00:00
#include <Kernel/SharedBuffer.h>
Kernel: Qualify a bunch of #include statements.
2019-06-07 17:29:34 +00:00
#include <Kernel/Syscall.h>
Kernel: Run clang-format on everything.
2019-06-07 09:43:58 +00:00
#include <Kernel/TTY/MasterPTY.h>
Kernel: Reduce header dependencies of Process and Thread
2020-02-16 01:01:42 +00:00
#include <Kernel/TTY/TTY.h>
Kernel: Move E2BIG calculation from Thread to Process Thread::make_userspace_stack_for_main_thread is only ever called from Process::do_exec, after all the fun ELF loading and TSS setup has occured. The calculations in there that check if the combined argv + envp size will exceed the default stack size are not used in the rest of the stack setup. So, it should be safe to move this to the beginning of do_exec and bail early with -E2BIG, just like the man pages say. Additionally, advertise this limit in limits.h to be a good POSIX.1 citizen. :)
2019-10-20 16:11:40 +00:00
#include <Kernel/Thread.h>
Kernel: Add 'ptrace' syscall This commit adds a basic implementation of the ptrace syscall, which allows one process (the tracer) to control another process (the tracee). While a process is being traced, it is stopped whenever a signal is received (other than SIGCONT). The tracer can start tracing another thread with PT_ATTACH, which causes the tracee to stop. From there, the tracer can use PT_CONTINUE to continue the execution of the tracee, or use other request codes (which haven't been implemented yet) to modify the state of the tracee. Additional request codes are PT_SYSCALL, which causes the tracee to continue exection but stop at the next entry or exit from a syscall, and PT_GETREGS which fethces the last saved register set of the tracee (can be used to inspect syscall arguments and return value). A special request code is PT_TRACE_ME, which is issued by the tracee and causes it to stop when it calls execve and wait for the tracer to attach.
2020-03-28 08:47:16 +00:00
#include <Kernel/ThreadTracer.h>
Kernel: Introduce the new Time management subsystem This new subsystem includes better abstractions of how time will be handled in the OS. We take advantage of the existing RTC timer to aid in keeping time synchronized. This is standing in contrast to how we handled time-keeping in the kernel, where the PIT was responsible for that function in addition to update the scheduler about ticks. With that new advantage, we can easily change the ticking dynamically and still keep the time synchronized. In the process context, we no longer use a fixed declaration of TICKS_PER_SECOND, but we call the TimeManagement singleton class to provide us the right value. This allows us to use dynamic ticking in the future, a feature known as tickless kernel. The scheduler no longer does by himself the calculation of real time (Unix time), and just calls the TimeManagment singleton class to provide the value. Also, we can use 2 new boot arguments: - the "time" boot argument accpets either the value "modern", or "legacy". If "modern" is specified, the time management subsystem will try to setup HPET. Otherwise, for "legacy" value, the time subsystem will revert to use the PIT & RTC, leaving HPET disabled. If this boot argument is not specified, the default pattern is to try to setup HPET. - the "hpet" boot argumet accepts either the value "periodic" or "nonperiodic". If "periodic" is specified, the HPET will scan for periodic timers, and will assert if none are found. If only one is found, that timer will be assigned for the time-keeping task. If more than one is found, both time-keeping task & scheduler-ticking task will be assigned to periodic timers. If this boot argument is not specified, the default pattern is to try to scan for HPET periodic timers. This boot argument has no effect if HPET is disabled. In hardware context, PIT & RealTimeClock classes are merely inheriting from the HardwareTimer class, and they allow to use the old i8254 (PIT) and RTC devices, managing them via IO ports. By default, the RTC will be programmed to a frequency of 1024Hz. The PIT will be programmed to a frequency close to 1000Hz. About HPET, depending if we need to scan for periodic timers or not, we try to set a frequency close to 1000Hz for the time-keeping timer and scheduler-ticking timer. Also, if possible, we try to enable the Legacy replacement feature of the HPET. This feature if exists, instructs the chipset to disconnect both i8254 (PIT) and RTC. This behavior is observable on QEMU, and was verified against the source code: https://github.com/qemu/qemu/commit/ce967e2f33861b0e17753f97fa4527b5943c94b6 The HPETComparator class is inheriting from HardwareTimer class, and is responsible for an individual HPET comparator, which is essentially a timer. Therefore, it needs to call the singleton HPET class to perform HPET-related operations. The new abstraction of Hardware timers brings an opportunity of more new features in the foreseeable future. For example, we can change the callback function of each hardware timer, thus it makes it possible to swap missions between hardware timers, or to allow to use a hardware timer for other temporary missions (e.g. calibrating the LAPIC timer, measuring the CPU frequency, etc).
2020-03-09 15:03:27 +00:00
#include <Kernel/Time/TimeManagement.h>
Kernel: Reduce header dependencies of MemoryManager and Region
2020-02-16 00:33:41 +00:00
#include <Kernel/VM/PageDirectory.h>
Kernel: Use PrivateInodeVMObject for loading program executables This will be a memory usage pessimization until we actually implement CoW sharing of the memory pages with SharedInodeVMObject. However, it's a huge architectural improvement, so let's take it and improve on this incrementally. fork() should still be neutral, since all private mappings are CoW'ed.
2020-03-01 10:14:56 +00:00
#include <Kernel/VM/PrivateInodeVMObject.h>
ptrace: Add PT_PEEK PT_PEEK reads a single word from the tracee's address space and returns it to the tracer.
2020-04-04 08:26:56 +00:00
#include <Kernel/VM/ProcessPagingScope.h>
Kernel: Start implementing purgeable memory support It's now possible to get purgeable memory by using mmap(MAP_PURGEABLE). Purgeable memory has a "volatile" flag that can be set using madvise(): - madvise(..., MADV_SET_VOLATILE) - madvise(..., MADV_SET_NONVOLATILE) When in the "volatile" state, the kernel may take away the underlying physical memory pages at any time, without notifying the owner. This gives you a guilt discount when caching very large things. :^) Setting a purgeable region to non-volatile will return whether or not the memory has been taken away by the kernel while being volatile. Basically, if madvise(..., MADV_SET_NONVOLATILE) returns 1, that means the memory was purged while volatile, and whatever was in that piece of memory needs to be reconstructed before use.
2019-12-09 18:12:38 +00:00
#include <Kernel/VM/PurgeableVMObject.h>
Kernel: Remove some unnecessary indirection in InodeFile::mmap() InodeFile now directly calls Process::allocate_region_with_vmobject() instead of taking an awkward detour via a special Region constructor.
2020-02-28 19:29:14 +00:00
#include <Kernel/VM/SharedInodeVMObject.h>
Kernel: Apply changes to use LibBareMetal definitions
2020-02-09 14:47:15 +00:00
#include <LibBareMetal/IO.h>
#include <LibBareMetal/Output/Console.h>
#include <LibBareMetal/StdLib.h>
Kernel: Run clang-format on everything.
2019-06-07 09:43:58 +00:00
#include <LibC/errno_numbers.h>
Kernel: writev() should fail with EINVAL if total length > INT32_MAX
2020-01-02 12:01:41 +00:00
#include <LibC/limits.h>
Kernel: Run clang-format on everything.
2019-06-07 09:43:58 +00:00
#include <LibC/signal_numbers.h>
LibELF: Move ELF classes into namespace ELF This is for consistency with other namespace changes that were made a while back to the other libraries :)
2020-04-11 18:24:07 +00:00
#include <LibELF/Loader.h>
LibELF: Move validation methods to their own file These validate_elf_* methods really had no business being static methods of ELF::Image. Now that the ELF namespace exists, it makes sense to just move them to be free functions in the namespace.
2020-04-11 18:32:38 +00:00
#include <LibELF/Validation.h>
Import the "gerbert" kernel I worked on earlier this year. It's a lot crappier than I remembered it. It's gonna need a lot of work.
2018-10-16 09:01:38 +00:00
Kernel: Finalizer should not go back to sleep if there's more to do Before putting itself back on the wait queue, the finalizer task will now check if there's more work to do, and if so, do it first. :^) This patch also puts a bunch of process/thread debug logging behind PROCESS_DEBUG and THREAD_DEBUG since it was unbearable to debug this stuff with all the spam.
2020-02-01 09:27:25 +00:00
//#define PROCESS_DEBUG
Kernel: Add the ability to debug poll/select independently of read/write
2019-05-19 08:24:28 +00:00
//#define DEBUG_POLL_SELECT
Lots of hacking: - Turn Keyboard into a CharacterDevice (85,1) at /dev/keyboard. - Implement MM::unmapRegionsForTask() and MM::unmapRegion() - Save SS correctly on interrupt. - Add a simple Spawn syscall for launching another process. - Move a bunch of IO syscall debug output behind DEBUG_IO. - Have ASSERT do a "cli" immediately when failing. This makes the output look proper every time. - Implement a bunch of syscalls in LibC. - Add a simple shell ("sh"). All it can do now is read a line of text from /dev/keyboard and then try launching the specified executable by calling spawn(). There are definitely bugs in here, but we're moving on forward.
2018-10-23 08:12:50 +00:00
//#define DEBUG_IO
Kernel: Put a bunch of debug spam behind #ifdefs.
2019-03-27 14:07:12 +00:00
//#define TASK_DEBUG
//#define FORK_DEBUG
Kernel+LibELF: Validate PT_LOAD and PT_TLS offsets before memcpy()'ing Before this, you could make the kernel copy memory from anywhere by setting up an ELF executable with a program header specifying file offsets outside the file. Since ELFImage didn't even know how large it was, we had no clue that we were copying things from outside the ELF. Fix this by adding a size field to ELFImage and validating program header ranges before memcpy()'ing to them. The ELF code is definitely going to need more validation and checking.
2020-01-06 20:04:57 +00:00
//#define EXEC_DEBUG
Kernel: SharedBuffer sharing cleanup Rather than limiting it to two shared processes, store a Vector of references, so we can add more if we want. Makes the code a little more generic. No actual change to the syscall interface yet, so nothing takes advantage of this yet.
2019-07-15 18:38:41 +00:00
//#define SIGNAL_DEBUG
Move WindowServer to userspace. This is a monster patch that required changing a whole bunch of things. There are performance and stability issues all over the place, but it works. Pretty cool, I have to admit :^)
2019-02-16 23:13:47 +00:00
//#define SHARED_BUFFER_DEBUG
Implement COW pages! :^) sys$fork() now clones all writable regions with per-page COW bits. The pages are then mapped read-only and we handle a PF by COWing the pages. This is quite delightful. Obviously there's lots of work to do still, and it needs better data structures, but the general concept works.
2018-11-05 12:48:07 +00:00
Kernel: Move all code into the Kernel namespace
2020-02-16 00:27:42 +00:00
namespace Kernel {
Kernel: Share the "return to ring 0/3 from signal" trampolines globally. Generate a special page containing the "return from signal" trampoline code on startup and then route signalled threads to it. This avoids a page allocation in every process that ever receives a signal.
2019-07-19 15:01:16 +00:00
static void create_signal_trampolines();
Kernel+LibC: Publish a "kernel info page" and use it for gettimeofday() This patch adds a single "kernel info page" that is mappable read-only by any process and contains the current time of day. This is then used to implement a version of gettimeofday() that doesn't have to make a syscall. To protect against race condition issues, the info page also has a serial number which is incremented whenever the kernel updates the contents of the page. Make sure to verify that the serial number is the same before and after reading the information you want from the page.
2019-12-15 20:29:26 +00:00
static void create_kernel_info_page();
Kernel: Share the "return to ring 0/3 from signal" trampolines globally. Generate a special page containing the "return from signal" trampoline code on startup and then route signalled threads to it. This avoids a page allocation in every process that ever receives a signal.
2019-07-19 15:01:16 +00:00
Kernel: Replace "current" with Thread::current and Process::current Suggested by Sergey. The currently running Thread and Process are now Thread::current and Process::current respectively. :^)
2020-02-17 14:04:27 +00:00
Process* Process::current;
Import the "gerbert" kernel I worked on earlier this year. It's a lot crappier than I remembered it. It's gonna need a lot of work.
2018-10-16 09:01:38 +00:00
static pid_t next_pid;
Move the scheduler code to its own class. This is very mechanical.
2018-11-07 21:15:02 +00:00
InlineLinkedList<Process>* g_processes;
Add sys$gethostname and /bin/hostname
2018-10-26 07:54:29 +00:00
static String* s_hostname;
Kernel: Don't disable interrupts to access the system hostname.
2019-02-07 09:29:26 +00:00
static Lock* s_hostname_lock;
Kernel: Make sure the kernel info page is read-only for userspace To enforce this, we create two separate mappings of the same underlying physical page. A writable mapping for the kernel, and a read-only one for userspace (the one returned by sys$get_kernel_info_page.)
2019-12-15 21:21:28 +00:00
static VirtualAddress s_info_page_address_for_userspace;
static VirtualAddress s_info_page_address_for_kernel;
Kernel: Share the "return to ring 0/3 from signal" trampolines globally. Generate a special page containing the "return from signal" trampoline code on startup and then route signalled threads to it. This avoids a page allocation in every process that ever receives a signal.
2019-07-19 15:01:16 +00:00
VirtualAddress g_return_to_ring3_from_signal_trampoline;
Kernel: Implement very simple kernel module loading It's now possible to load a .o file into the kernel via a syscall. The kernel will perform all the necessary ELF relocations, and then call the "module_init" symbol in the loaded module.
2019-11-28 19:59:11 +00:00
HashMap<String, OwnPtr<Module>>* g_modules;
Add sys$uname() and a /bin/uname utility.
2018-10-26 12:56:21 +00:00
Kernel: Make TID's be unique PID's This is a little strange, but it's how I understand things should work. The first thread in a new process now has TID == PID. Additional threads subsequently spawned in that process all have unique TID's generated by the PID allocator. TIDs are now globally unique.
2019-12-22 10:51:24 +00:00
pid_t Process::allocate_pid()
{
InterruptDisabler disabler;
return next_pid++;
}
Process now maps regions immediately when they are allocated. This avoids having to do a separate MM.mapRegionsForTask() pass. Also, more Task => Process renaming that I apparently hadn't saved yet.
2018-11-01 12:15:46 +00:00
void Process::initialize()
Import the "gerbert" kernel I worked on earlier this year. It's a lot crappier than I remembered it. It's gonna need a lot of work.
2018-10-16 09:01:38 +00:00
{
Kernel: Implement very simple kernel module loading It's now possible to load a .o file into the kernel via a syscall. The kernel will perform all the necessary ELF relocations, and then call the "module_init" symbol in the loaded module.
2019-11-28 19:59:11 +00:00
g_modules = new HashMap<String, OwnPtr<Module>>;
Import the "gerbert" kernel I worked on earlier this year. It's a lot crappier than I remembered it. It's gonna need a lot of work.
2018-10-16 09:01:38 +00:00
next_pid = 0;
Move the scheduler code to its own class. This is very mechanical.
2018-11-07 21:15:02 +00:00
g_processes = new InlineLinkedList<Process>;
Tweak default hostname.
2018-11-16 23:23:39 +00:00
s_hostname = new String("courage");
Kernel: Don't disable interrupts to access the system hostname.
2019-02-07 09:29:26 +00:00
s_hostname_lock = new Lock;
Kernel: Share the "return to ring 0/3 from signal" trampolines globally. Generate a special page containing the "return from signal" trampoline code on startup and then route signalled threads to it. This avoids a page allocation in every process that ever receives a signal.
2019-07-19 15:01:16 +00:00
create_signal_trampolines();
Kernel+LibC: Publish a "kernel info page" and use it for gettimeofday() This patch adds a single "kernel info page" that is mappable read-only by any process and contains the current time of day. This is then used to implement a version of gettimeofday() that doesn't have to make a syscall. To protect against race condition issues, the info page also has a serial number which is incremented whenever the kernel updates the contents of the page. Make sure to verify that the serial number is the same before and after reading the information you want from the page.
2019-12-15 20:29:26 +00:00
create_kernel_info_page();
}
void Process::update_info_page_timestamp(const timeval& tv)
{
Kernel: Make sure the kernel info page is read-only for userspace To enforce this, we create two separate mappings of the same underlying physical page. A writable mapping for the kernel, and a read-only one for userspace (the one returned by sys$get_kernel_info_page.)
2019-12-15 21:21:28 +00:00
auto* info_page = (KernelInfoPage*)s_info_page_address_for_kernel.as_ptr();
Kernel+LibC: Publish a "kernel info page" and use it for gettimeofday() This patch adds a single "kernel info page" that is mappable read-only by any process and contains the current time of day. This is then used to implement a version of gettimeofday() that doesn't have to make a syscall. To protect against race condition issues, the info page also has a serial number which is incremented whenever the kernel updates the contents of the page. Make sure to verify that the serial number is the same before and after reading the information you want from the page.
2019-12-15 20:29:26 +00:00
info_page->serial++;
const_cast<timeval&>(info_page->now) = tv;
Basic ^C interrupt implementation. For testing, I made cat put itself into a new process group. This should eventually be done by sh between fork() and exec().
2018-11-02 13:06:48 +00:00
}
Kernel: Rewrite ProcFS. Now the filesystem is generated on-the-fly instead of manually adding and removing inodes as processes spawn and die. The code is convoluted and bloated as I wrote it while sleepless. However, it's still vastly better than the old ProcFS, so I'm committing it. I also added /proc/PID/fd/N symlinks for each of a process's open fd's.
2019-02-03 11:33:11 +00:00
Vector<pid_t> Process::all_pids()
{
Vector<pid_t> pids;
Kernel: Add a Finalizer process to take care of dying processes. Instead of processes themselves getting scheduled to finish dying, let's have a Finalizer process that wakes up whenever someone is dying. This way we can do all kinds of lock-taking in process cleanup without risking reentering the scheduler.
2019-02-06 17:45:21 +00:00
InterruptDisabler disabler;
AK: SinglyLinkedList::size_slow() should return size_t
2019-12-09 16:48:58 +00:00
pids.ensure_capacity((int)g_processes->size_slow());
Kernel: Use some more InlineLinkedList range-for iteration
2019-08-08 12:40:13 +00:00
for (auto& process : *g_processes)
pids.append(process.pid());
Kernel: Rewrite ProcFS. Now the filesystem is generated on-the-fly instead of manually adding and removing inodes as processes spawn and die. The code is convoluted and bloated as I wrote it while sleepless. However, it's still vastly better than the old ProcFS, so I'm committing it. I also added /proc/PID/fd/N symlinks for each of a process's open fd's.
2019-02-03 11:33:11 +00:00
return pids;
}
Big, possibly complete sweep of naming changes.
2019-01-31 16:31:23 +00:00
Vector<Process*> Process::all_processes()
Generate a basic /proc/summary file with some info about all tasks.
2018-10-23 10:44:46 +00:00
{
Process now maps regions immediately when they are allocated. This avoids having to do a separate MM.mapRegionsForTask() pass. Also, more Task => Process renaming that I apparently hadn't saved yet.
2018-11-01 12:15:46 +00:00
Vector<Process*> processes;
Kernel: Add a Finalizer process to take care of dying processes. Instead of processes themselves getting scheduled to finish dying, let's have a Finalizer process that wakes up whenever someone is dying. This way we can do all kinds of lock-taking in process cleanup without risking reentering the scheduler.
2019-02-06 17:45:21 +00:00
InterruptDisabler disabler;
AK: SinglyLinkedList::size_slow() should return size_t
2019-12-09 16:48:58 +00:00
processes.ensure_capacity((int)g_processes->size_slow());
Kernel: Use some more InlineLinkedList range-for iteration
2019-08-08 12:40:13 +00:00
for (auto& process : *g_processes)
processes.append(&process);
Process now maps regions immediately when they are allocated. This avoids having to do a separate MM.mapRegionsForTask() pass. Also, more Task => Process renaming that I apparently hadn't saved yet.
2018-11-01 12:15:46 +00:00
return processes;
Generate a basic /proc/summary file with some info about all tasks.
2018-10-23 10:44:46 +00:00
}
Add chown() syscall and a simple /bin/chown program.
2019-02-27 11:32:53 +00:00
bool Process::in_group(gid_t gid) const
{
Kernel: Don't include the process GID in the "extra GIDs" table Process::m_extra_gids is for supplementary GIDs only.
2020-01-02 22:45:52 +00:00
return m_gid == gid || m_extra_gids.contains(gid);
Add chown() syscall and a simple /bin/chown program.
2019-02-27 11:32:53 +00:00
}
Kernel+LibC: Allow sys$mmap() callers to specify address alignment This is exposed via the non-standard serenity_mmap() call in userspace.
2020-02-16 11:55:56 +00:00
Range Process::allocate_range(VirtualAddress vaddr, size_t size, size_t alignment)
More paging stuff. The test userspace process now runs at linear address 0x300000 which is mapped to a dynamically allocated page from the MemoryManager. Cool!
2018-10-18 11:05:00 +00:00
{
Kernel: Rename LinearAddress => VirtualAddress.
2019-06-07 10:56:50 +00:00
vaddr.mask(PAGE_MASK);
Make GraphicsBitmaps be Region-backed when running in the kernel. This is a lot better than having them in kmalloc memory. I'm gonna need a way to keep track of which process owns which bitmap eventually, maybe through some sort of resource keying system. We'll see.
2019-01-12 23:27:25 +00:00
size = PAGE_ROUND_UP(size);
Kernel: Rename LinearAddress => VirtualAddress.
2019-06-07 10:56:50 +00:00
if (vaddr.is_null())
Kernel+LibC: Allow sys$mmap() callers to specify address alignment This is exposed via the non-standard serenity_mmap() call in userspace.
2020-02-16 11:55:56 +00:00
return page_directory().range_allocator().allocate_anywhere(size, alignment);
Kernel: Rename LinearAddress => VirtualAddress.
2019-06-07 10:56:50 +00:00
return page_directory().range_allocator().allocate_specific(vaddr, size);
Kernel: Factor out range allocation from Process::allocate_region*(). These functions were doing exactly the same thing for range allocation, so share that code in an allocate_range() helper. Region allocation will now also fail if range allocation fails, which means that mmap() can actually fail without falling apart. Exciting times!
2019-05-17 02:39:22 +00:00
}
Kernel: Implement a simple virtual address range allocator. This replaces the previous virtual address allocator which was basically just "m_next_address += size;" With this in place, virtual addresses can get reused, which cuts down on the number of page tables created. When we implement ASLR some day, we'll probably have to do page table deallocation, but for now page tables are only deallocated once the process dies.
2019-05-17 01:40:15 +00:00
Kernel: Make the Process allocate_region* API's understand "int prot". Instead of having to inspect 'prot' at every call site, make the Process API's take care of that so we can just pass it through.
2019-05-30 14:14:37 +00:00
static unsigned prot_to_region_access_flags(int prot)
{
unsigned access = 0;
if (prot & PROT_READ)
access |= Region::Access::Read;
if (prot & PROT_WRITE)
access |= Region::Access::Write;
if (prot & PROT_EXEC)
access |= Region::Access::Execute;
return access;
}
Kernel: Rename vmo => vmobject everywhere
2019-12-19 18:13:44 +00:00
Region& Process::allocate_split_region(const Region& source_region, const Range& range, size_t offset_in_vmobject)
Kernel: Support partial munmap() You can now munmap() a part of a region. The kernel will then create one or two new regions around the "hole" and re-map them using the same physical pages as before. This goes towards fixing #175, but not all the way since we don't yet do munmap() across multiple mappings.
2019-08-29 18:57:02 +00:00
{
Kernel: Preserve CoW bits when splitting VM regions
2020-01-25 16:57:10 +00:00
auto& region = add_region(Region::create_user_accessible(range, source_region.vmobject(), offset_in_vmobject, source_region.name(), source_region.access()));
Kernel: Copy "stack" and "mmap" bits when splitting a Region
2020-01-29 18:24:42 +00:00
region.set_mmap(source_region.is_mmap());
region.set_stack(source_region.is_stack());
Kernel: Preserve CoW bits when splitting VM regions
2020-01-25 16:57:10 +00:00
size_t page_offset_in_source_region = (offset_in_vmobject - source_region.offset_in_vmobject()) / PAGE_SIZE;
for (size_t i = 0; i < region.page_count(); ++i) {
if (source_region.should_cow(page_offset_in_source_region + i))
region.set_should_cow(i, true);
}
return region;
Kernel: Support partial munmap() You can now munmap() a part of a region. The kernel will then create one or two new regions around the "hole" and re-map them using the same physical pages as before. This goes towards fixing #175, but not all the way since we don't yet do munmap() across multiple mappings.
2019-08-29 18:57:02 +00:00
}
Kernel+LibC: Allow sys$mmap() callers to specify address alignment This is exposed via the non-standard serenity_mmap() call in userspace.
2020-02-16 11:55:56 +00:00
Region* Process::allocate_region(const Range& range, const String& name, int prot, bool commit)
Kernel: Factor out range allocation from Process::allocate_region*(). These functions were doing exactly the same thing for range allocation, so share that code in an allocate_range() helper. Region allocation will now also fail if range allocation fails, which means that mmap() can actually fail without falling apart. Exciting times!
2019-05-17 02:39:22 +00:00
{
Kernel+LibC: Allow sys$mmap() callers to specify address alignment This is exposed via the non-standard serenity_mmap() call in userspace.
2020-02-16 11:55:56 +00:00
ASSERT(range.is_valid());
Kernel: Remove some Region construction helpers It's now up to the caller to provide a VMObject when constructing a new Region object. This will make it easier to handle things going wrong, like allocation failures, etc.
2020-03-01 10:02:22 +00:00
auto vmobject = AnonymousVMObject::create_with_size(range.size());
auto& region = add_region(Region::create_user_accessible(range, vmobject, 0, name, prot_to_region_access_flags(prot)));
Kernel: Add a Process::add_region() helper This is a private helper for adding a Region to Process::m_regions. It's just for convenience since it's a bit cumbersome to do this.
2020-01-19 15:25:38 +00:00
region.map(page_directory());
Kernel: Refactor Region/PageDirectory ownership model. Make PageDirectory retainable and have each Region co-own the PageDirectory they're mapped into. When unmapped, Region has no associated PageDirectory. This allows Region to automatically unmap itself when destroyed.
2019-01-22 04:01:00 +00:00
if (commit)
Kernel: Add a Process::add_region() helper This is a private helper for adding a Region to Process::m_regions. It's just for convenience since it's a bit cumbersome to do this.
2020-01-19 15:25:38 +00:00
region.commit();
return &region;
More paging stuff. The test userspace process now runs at linear address 0x300000 which is mapped to a dynamically allocated page from the MemoryManager. Cool!
2018-10-18 11:05:00 +00:00
}
Kernel+LibC: Allow sys$mmap() callers to specify address alignment This is exposed via the non-standard serenity_mmap() call in userspace.
2020-02-16 11:55:56 +00:00
Region* Process::allocate_region(VirtualAddress vaddr, size_t size, const String& name, int prot, bool commit)
{
auto range = allocate_range(vaddr, size);
if (!range.is_valid())
return nullptr;
return allocate_region(range, name, prot, commit);
}
Kernel: Remove ability to create kernel-only regions at user addresses This was only used by the mechanism for mapping executables into each process's own address space. Now that we remap executables on demand when needed for symbolication, this can go away.
2020-03-02 09:46:24 +00:00
Region* Process::allocate_region_with_vmobject(const Range& range, NonnullRefPtr<VMObject> vmobject, size_t offset_in_vmobject, const String& name, int prot)
Teach Process::exec() about the magic of file-backed VMO's. This is really sweet! :^) The four instances of /bin/sh spawned at startup now share their read-only text pages. There are problems and limitations here, and plenty of room for improvement. But it kinda works.
2018-11-08 20:20:09 +00:00
{
Kernel+LibC: Allow sys$mmap() callers to specify address alignment This is exposed via the non-standard serenity_mmap() call in userspace.
2020-02-16 11:55:56 +00:00
ASSERT(range.is_valid());
size_t end_in_vmobject = offset_in_vmobject + range.size();
Kernel: Use a FixedArray for a process's extra GIDs There's not really enough of these to justify using a HashTable.
2020-02-18 09:19:32 +00:00
if (end_in_vmobject <= offset_in_vmobject) {
Process: Use dbg() instead of dbgprintf() Also, fix a bad derefernce in sys$create_shared_buffer() method.
2020-02-24 22:13:33 +00:00
dbg() << "allocate_region_with_vmobject: Overflow (offset + size)";
Kernel: Validate the requested range in allocate_region_with_vmobject()
2020-01-18 13:37:22 +00:00
return nullptr;
}
if (offset_in_vmobject >= vmobject->size()) {
Process: Use dbg() instead of dbgprintf() Also, fix a bad derefernce in sys$create_shared_buffer() method.
2020-02-24 22:13:33 +00:00
dbg() << "allocate_region_with_vmobject: Attempt to allocate a region with an offset past the end of its VMObject.";
Kernel: Validate the requested range in allocate_region_with_vmobject()
2020-01-18 13:37:22 +00:00
return nullptr;
}
if (end_in_vmobject > vmobject->size()) {
Process: Use dbg() instead of dbgprintf() Also, fix a bad derefernce in sys$create_shared_buffer() method.
2020-02-24 22:13:33 +00:00
dbg() << "allocate_region_with_vmobject: Attempt to allocate a region with an end past the end of its VMObject.";
Kernel: Validate the requested range in allocate_region_with_vmobject()
2020-01-18 13:37:22 +00:00
return nullptr;
}
Kernel: Rename vmo => vmobject everywhere
2019-12-19 18:13:44 +00:00
offset_in_vmobject &= PAGE_MASK;
Kernel: Remove ability to create kernel-only regions at user addresses This was only used by the mechanism for mapping executables into each process's own address space. Now that we remap executables on demand when needed for symbolication, this can go away.
2020-03-02 09:46:24 +00:00
auto& region = add_region(Region::create_user_accessible(range, move(vmobject), offset_in_vmobject, name, prot_to_region_access_flags(prot)));
region.map(page_directory());
return &region;
Teach Process::exec() about the magic of file-backed VMO's. This is really sweet! :^) The four instances of /bin/sh spawned at startup now share their read-only text pages. There are problems and limitations here, and plenty of room for improvement. But it kinda works.
2018-11-08 20:20:09 +00:00
}
Kernel: Remove ability to create kernel-only regions at user addresses This was only used by the mechanism for mapping executables into each process's own address space. Now that we remap executables on demand when needed for symbolication, this can go away.
2020-03-02 09:46:24 +00:00
Region* Process::allocate_region_with_vmobject(VirtualAddress vaddr, size_t size, NonnullRefPtr<VMObject> vmobject, size_t offset_in_vmobject, const String& name, int prot)
Kernel+LibC: Allow sys$mmap() callers to specify address alignment This is exposed via the non-standard serenity_mmap() call in userspace.
2020-02-16 11:55:56 +00:00
{
auto range = allocate_range(vaddr, size);
if (!range.is_valid())
return nullptr;
Kernel: Remove ability to create kernel-only regions at user addresses This was only used by the mechanism for mapping executables into each process's own address space. Now that we remap executables on demand when needed for symbolication, this can go away.
2020-03-02 09:46:24 +00:00
return allocate_region_with_vmobject(range, move(vmobject), offset_in_vmobject, name, prot);
Kernel+LibC: Allow sys$mmap() callers to specify address alignment This is exposed via the non-standard serenity_mmap() call in userspace.
2020-02-16 11:55:56 +00:00
}
Use ELF program headers to load executables smarter. This turned out way better than the old code. ELF loading is now quite straightforward, and we don't need the weird concept of subregions anymore. Next step is to respect the is_writable flag.
2018-11-03 10:28:23 +00:00
bool Process::deallocate_region(Region& region)
Add simplified mmap() and munmap() syscalls.
2018-10-24 07:48:24 +00:00
{
Canonicalize the path used by sh. With a bunch of LibC work to support the feature. LibC now initializes AK::StringImpl by default. It's now fine to use AK in LibC/Userland! :^)
2018-10-28 08:36:21 +00:00
InterruptDisabler disabler;
Kernel: Add a 1-deep cache to Process::region_from_range() This simple cache gets hit over 70% of the time on "g++ Process.cpp" and shaves ~3% off the runtime.
2020-01-19 15:44:37 +00:00
if (m_region_lookup_cache.region == &region)
m_region_lookup_cache.region = nullptr;
AK: Make Vector use size_t for its size and capacity
2020-02-25 13:49:47 +00:00
for (size_t i = 0; i < m_regions.size(); ++i) {
Kernel: Use NonnullRefPtrVector in parts of the kernel.
2019-06-27 11:34:28 +00:00
if (&m_regions[i] == &region) {
Kernel: Use Vector::unstable_remove() when deallocating a region Process::m_regions is not sorted, so we can use unstable_remove() to avoid shifting the vector contents. :^)
2020-02-23 17:00:30 +00:00
m_regions.unstable_remove(i);
Add simplified mmap() and munmap() syscalls.
2018-10-24 07:48:24 +00:00
return true;
}
}
return false;
}
Kernel: Support partial munmap() You can now munmap() a part of a region. The kernel will then create one or two new regions around the "hole" and re-map them using the same physical pages as before. This goes towards fixing #175, but not all the way since we don't yet do munmap() across multiple mappings.
2019-08-29 18:57:02 +00:00
Region* Process::region_from_range(const Range& range)
{
Kernel: Add a 1-deep cache to Process::region_from_range() This simple cache gets hit over 70% of the time on "g++ Process.cpp" and shaves ~3% off the runtime.
2020-01-19 15:44:37 +00:00
if (m_region_lookup_cache.range == range && m_region_lookup_cache.region)
return m_region_lookup_cache.region;
Kernel: Support partial munmap() You can now munmap() a part of a region. The kernel will then create one or two new regions around the "hole" and re-map them using the same physical pages as before. This goes towards fixing #175, but not all the way since we don't yet do munmap() across multiple mappings.
2019-08-29 18:57:02 +00:00
size_t size = PAGE_ROUND_UP(range.size());
for (auto& region : m_regions) {
Kernel: Add a 1-deep cache to Process::region_from_range() This simple cache gets hit over 70% of the time on "g++ Process.cpp" and shaves ~3% off the runtime.
2020-01-19 15:44:37 +00:00
if (region.vaddr() == range.base() && region.size() == size) {
m_region_lookup_cache.range = range;
Kernel: Make Region weakable and use WeakPtr<Region> instead of Region* This turns use-after-free bugs into null pointer dereferences instead.
2020-02-24 12:24:30 +00:00
m_region_lookup_cache.region = region.make_weak_ptr();
Kernel: Support partial munmap() You can now munmap() a part of a region. The kernel will then create one or two new regions around the "hole" and re-map them using the same physical pages as before. This goes towards fixing #175, but not all the way since we don't yet do munmap() across multiple mappings.
2019-08-29 18:57:02 +00:00
return &region;
Kernel: Add a 1-deep cache to Process::region_from_range() This simple cache gets hit over 70% of the time on "g++ Process.cpp" and shaves ~3% off the runtime.
2020-01-19 15:44:37 +00:00
}
Kernel: Support partial munmap() You can now munmap() a part of a region. The kernel will then create one or two new regions around the "hole" and re-map them using the same physical pages as before. This goes towards fixing #175, but not all the way since we don't yet do munmap() across multiple mappings.
2019-08-29 18:57:02 +00:00
}
return nullptr;
}
Region* Process::region_containing(const Range& range)
Add simplified mmap() and munmap() syscalls.
2018-10-24 07:48:24 +00:00
{
for (auto& region : m_regions) {
Kernel: Support partial munmap() You can now munmap() a part of a region. The kernel will then create one or two new regions around the "hole" and re-map them using the same physical pages as before. This goes towards fixing #175, but not all the way since we don't yet do munmap() across multiple mappings.
2019-08-29 18:57:02 +00:00
if (region.contains(range))
Kernel: Use NonnullRefPtrVector in parts of the kernel.
2019-06-27 11:34:28 +00:00
return &region;
Add simplified mmap() and munmap() syscalls.
2018-10-24 07:48:24 +00:00
}
return nullptr;
}
Kernel: Pass name+length to set_mmap_name() and remove SmapDisabler
2020-01-06 10:56:59 +00:00
int Process::sys$set_mmap_name(const Syscall::SC_set_mmap_name_params* user_params)
Add sys$set_mmap_name and use it from LibC's malloc. It's nice to be able to identify mmap's in /proc/PID/vm.
2018-10-28 08:57:22 +00:00
{
ping: Use pledge()
2020-01-11 19:48:43 +00:00
REQUIRE_PROMISE(stdio);
Kernel: Pass name+length to set_mmap_name() and remove SmapDisabler
2020-01-06 10:56:59 +00:00
Syscall::SC_set_mmap_name_params params;
Kernel: Combine validate and copy of user mode pointers (#1069) Right now there is a significant amount of boiler plate code required to validate user mode parameters in syscalls. In an attempt to reduce this a bit, introduce validate_read_and_copy_typed which combines the usermode address check and does the copy internally if the validation passes. This cleans up a little bit of code from a significant amount of syscalls.
2020-01-13 10:19:18 +00:00
if (!validate_read_and_copy_typed(&params, user_params))
return -EFAULT;
Kernel: Pass name+length to set_mmap_name() and remove SmapDisabler
2020-01-06 10:56:59 +00:00
Kernel: Disallow mmap names longer than PATH_MAX
2020-01-18 10:34:53 +00:00
if (params.name.length > PATH_MAX)
return -ENAMETOOLONG;
Kernel: Use the Syscall string and buffer types more While I was updating syscalls to stop passing null-terminated strings, I added some helpful struct types: - StringArgument { const char*; size_t; } - ImmutableBuffer<Data, Size> { const Data*; Size; } - MutableBuffer<Data, Size> { Data*; Size; } The Process class has some convenience functions for validating and optionally extracting the contents from these structs: - get_syscall_path_argument(StringArgument) - validate_and_copy_string_from_user(StringArgument) - validate(ImmutableBuffer) - validate(MutableBuffer) There's still so much code around this and I'm wondering if we should generate most of it instead. Possible nice little project.
2020-01-11 11:47:47 +00:00
auto name = validate_and_copy_string_from_user(params.name);
if (name.is_null())
Kernel: Pass name+length to set_mmap_name() and remove SmapDisabler
2020-01-06 10:56:59 +00:00
return -EFAULT;
Kernel: Remove some unnecessary casts to uintptr_t VirtualAddress is constructible from uintptr_t and const void*. PhysicalAddress is constructible from uintptr_t but not const void*.
2020-01-20 12:06:41 +00:00
auto* region = region_from_range({ VirtualAddress(params.addr), params.size });
Add sys$set_mmap_name and use it from LibC's malloc. It's nice to be able to identify mmap's in /proc/PID/vm.
2018-10-28 08:57:22 +00:00
if (!region)
return -EINVAL;
Kernel: Mark mmap()-created regions with a special bit Then only allow regions with that bit to be manipulated via munmap() and mprotect(). This prevents messing with non-mmap()ed regions in a process's address space (stacks, shared buffers, ...)
2019-11-24 11:24:16 +00:00
if (!region->is_mmap())
return -EPERM;
Kernel: Pass name+length to set_mmap_name() and remove SmapDisabler
2020-01-06 10:56:59 +00:00
region->set_name(name);
Add sys$set_mmap_name and use it from LibC's malloc. It's nice to be able to identify mmap's in /proc/PID/vm.
2018-10-28 08:57:22 +00:00
return 0;
}
Kernel: Clarify the various input validity checks in mmap() Also share some validation logic between mmap() and mprotect().
2019-12-25 20:50:13 +00:00
static bool validate_mmap_prot(int prot, bool map_stack)
{
bool readable = prot & PROT_READ;
bool writable = prot & PROT_WRITE;
bool executable = prot & PROT_EXEC;
if (writable && executable)
return false;
if (map_stack) {
if (executable)
return false;
if (!readable || !writable)
return false;
}
return true;
}
Kernel: Implement basic support for sys$mmap() with MAP_PRIVATE You can now mmap a file as private and writable, and the changes you make will only be visible to you. This works because internally a MAP_PRIVATE region is backed by a unique PrivateInodeVMObject instead of using the globally shared SharedInodeVMObject like we always did before. :^) Fixes #1045.
2020-02-28 19:47:27 +00:00
static bool validate_inode_mmap_prot(const Process& process, int prot, const Inode& inode, bool map_shared)
Kernel: Validate PROT_READ and PROT_WRITE against underlying file This patch fixes some issues with the mmap() and mprotect() syscalls, neither of whom were checking the permission bits of the underlying files when mapping an inode MAP_SHARED. This made it possible to subvert execution of any running program by simply memory-mapping its executable and replacing some of the code. Test: Kernel/mmap-write-into-running-programs-executable-file.cpp
2020-01-07 18:29:18 +00:00
{
auto metadata = inode.metadata();
if ((prot & PROT_READ) && !metadata.may_read(process))
return false;
Kernel: Implement basic support for sys$mmap() with MAP_PRIVATE You can now mmap a file as private and writable, and the changes you make will only be visible to you. This works because internally a MAP_PRIVATE region is backed by a unique PrivateInodeVMObject instead of using the globally shared SharedInodeVMObject like we always did before. :^) Fixes #1045.
2020-02-28 19:47:27 +00:00
if (map_shared) {
if ((prot & PROT_WRITE) && !metadata.may_write(process))
Kernel: Enforce W^X between sys$mmap() and sys$execve() It's now an error to sys$mmap() a file as writable if it's currently mapped executable by anyone else. It's also an error to sys$execve() a file that's currently mapped writable by anyone else. This fixes a race condition vulnerability where one program could make modifications to an executable while another process was in the kernel, in the middle of exec'ing the same executable. Test: Kernel/elf-execve-mmap-race.cpp
2020-01-18 22:31:29 +00:00
return false;
Kernel: Implement basic support for sys$mmap() with MAP_PRIVATE You can now mmap a file as private and writable, and the changes you make will only be visible to you. This works because internally a MAP_PRIVATE region is backed by a unique PrivateInodeVMObject instead of using the globally shared SharedInodeVMObject like we always did before. :^) Fixes #1045.
2020-02-28 19:47:27 +00:00
InterruptDisabler disabler;
if (inode.shared_vmobject()) {
if ((prot & PROT_EXEC) && inode.shared_vmobject()->writable_mappings())
return false;
if ((prot & PROT_WRITE) && inode.shared_vmobject()->executable_mappings())
return false;
}
Kernel: Enforce W^X between sys$mmap() and sys$execve() It's now an error to sys$mmap() a file as writable if it's currently mapped executable by anyone else. It's also an error to sys$execve() a file that's currently mapped writable by anyone else. This fixes a race condition vulnerability where one program could make modifications to an executable while another process was in the kernel, in the middle of exec'ing the same executable. Test: Kernel/elf-execve-mmap-race.cpp
2020-01-18 22:31:29 +00:00
}
Kernel: Validate PROT_READ and PROT_WRITE against underlying file This patch fixes some issues with the mmap() and mprotect() syscalls, neither of whom were checking the permission bits of the underlying files when mapping an inode MAP_SHARED. This made it possible to subvert execution of any running program by simply memory-mapping its executable and replacing some of the code. Test: Kernel/mmap-write-into-running-programs-executable-file.cpp
2020-01-07 18:29:18 +00:00
return true;
}
Kernel: sys$mprotect protects sub-regions as well as whole ones Split a region into two/three if the desired mprotect range is a strict subset of an existing region. We can then set the access bits on a new region that is just our desired range and add both the new desired subregion and the leftovers back to our page tables.
2019-12-30 20:11:25 +00:00
// Carve out a virtual address range from a region and return the two regions on either side
Vector<Region*, 2> Process::split_region_around_range(const Region& source_region, const Range& desired_range)
{
Range old_region_range = source_region.range();
auto remaining_ranges_after_unmap = old_region_range.carve(desired_range);
Kernel: Reject non-user address ranges in mmap/munmap/mprotect/madvise There's no valid reason to allow non-userspace address ranges in these system calls.
2020-01-30 20:46:45 +00:00
Kernel: sys$mprotect protects sub-regions as well as whole ones Split a region into two/three if the desired mprotect range is a strict subset of an existing region. We can then set the access bits on a new region that is just our desired range and add both the new desired subregion and the leftovers back to our page tables.
2019-12-30 20:11:25 +00:00
ASSERT(!remaining_ranges_after_unmap.is_empty());
auto make_replacement_region = [&](const Range& new_range) -> Region& {
Kernel: Simplify process assertion checking if region is in range Let's use the helper function for this :)
2020-03-22 01:02:01 +00:00
ASSERT(old_region_range.contains(new_range));
Kernel: sys$mprotect protects sub-regions as well as whole ones Split a region into two/three if the desired mprotect range is a strict subset of an existing region. We can then set the access bits on a new region that is just our desired range and add both the new desired subregion and the leftovers back to our page tables.
2019-12-30 20:11:25 +00:00
size_t new_range_offset_in_vmobject = source_region.offset_in_vmobject() + (new_range.base().get() - old_region_range.base().get());
return allocate_split_region(source_region, new_range, new_range_offset_in_vmobject);
};
Vector<Region*, 2> new_regions;
for (auto& new_range : remaining_ranges_after_unmap) {
new_regions.unchecked_append(&make_replacement_region(new_range));
}
return new_regions;
}
Kernel: Pass name+length to mmap() and remove SmapDisabler
2020-01-06 11:04:55 +00:00
void* Process::sys$mmap(const Syscall::SC_mmap_params* user_params)
Add simplified mmap() and munmap() syscalls.
2018-10-24 07:48:24 +00:00
{
ping: Use pledge()
2020-01-11 19:48:43 +00:00
REQUIRE_PROMISE(stdio);
Kernel: Pass name+length to mmap() and remove SmapDisabler
2020-01-06 11:04:55 +00:00
Syscall::SC_mmap_params params;
Kernel: Combine validate and copy of user mode pointers (#1069) Right now there is a significant amount of boiler plate code required to validate user mode parameters in syscalls. In an attempt to reduce this a bit, introduce validate_read_and_copy_typed which combines the usermode address check and does the copy internally if the validation passes. This cleans up a little bit of code from a significant amount of syscalls.
2020-01-13 10:19:18 +00:00
if (!validate_read_and_copy_typed(&params, user_params))
return (void*)-EFAULT;
Kernel: Pass name+length to mmap() and remove SmapDisabler
2020-01-06 11:04:55 +00:00
void* addr = (void*)params.addr;
size_t size = params.size;
Kernel+LibC: Allow sys$mmap() callers to specify address alignment This is exposed via the non-standard serenity_mmap() call in userspace.
2020-02-16 11:55:56 +00:00
size_t alignment = params.alignment;
Kernel: Pass name+length to mmap() and remove SmapDisabler
2020-01-06 11:04:55 +00:00
int prot = params.prot;
int flags = params.flags;
int fd = params.fd;
int offset = params.offset;
Kernel: Use C++ structured bindings to bind syscall parameters Some syscalls have to pass parameters through a struct, since we can only fit 3 parameters with our calling convention. This patch makes use of C++ structured binding to clean up the places where we expand those parameters structs into local variables.
2019-11-10 14:32:59 +00:00
Kernel+LibC: Allow sys$mmap() callers to specify address alignment This is exposed via the non-standard serenity_mmap() call in userspace.
2020-02-16 11:55:56 +00:00
if (alignment & ~PAGE_MASK)
return (void*)-EINVAL;
Kernel: Reject non-user address ranges in mmap/munmap/mprotect/madvise There's no valid reason to allow non-userspace address ranges in these system calls.
2020-01-30 20:46:45 +00:00
if (!is_user_range(VirtualAddress(addr), size))
return (void*)-EFAULT;
Kernel: Use the Syscall string and buffer types more While I was updating syscalls to stop passing null-terminated strings, I added some helpful struct types: - StringArgument { const char*; size_t; } - ImmutableBuffer<Data, Size> { const Data*; Size; } - MutableBuffer<Data, Size> { Data*; Size; } The Process class has some convenience functions for validating and optionally extracting the contents from these structs: - get_syscall_path_argument(StringArgument) - validate_and_copy_string_from_user(StringArgument) - validate(ImmutableBuffer) - validate(MutableBuffer) There's still so much code around this and I'm wondering if we should generate most of it instead. Possible nice little project.
2020-01-11 11:47:47 +00:00
String name;
if (params.name.characters) {
Kernel: Disallow mmap names longer than PATH_MAX
2020-01-18 10:34:53 +00:00
if (params.name.length > PATH_MAX)
return (void*)-ENAMETOOLONG;
Kernel: Use the Syscall string and buffer types more While I was updating syscalls to stop passing null-terminated strings, I added some helpful struct types: - StringArgument { const char*; size_t; } - ImmutableBuffer<Data, Size> { const Data*; Size; } - MutableBuffer<Data, Size> { Data*; Size; } The Process class has some convenience functions for validating and optionally extracting the contents from these structs: - get_syscall_path_argument(StringArgument) - validate_and_copy_string_from_user(StringArgument) - validate(ImmutableBuffer) - validate(MutableBuffer) There's still so much code around this and I'm wondering if we should generate most of it instead. Possible nice little project.
2020-01-11 11:47:47 +00:00
name = validate_and_copy_string_from_user(params.name);
if (name.is_null())
return (void*)-EFAULT;
}
Kernel: Clarify the various input validity checks in mmap() Also share some validation logic between mmap() and mprotect().
2019-12-25 20:50:13 +00:00
Support basic mmap'ing of a file! All right, we can now mmap() a file and it gets magically paged in from fs in response to an NP page fault. This is really cool :^) I need to refactor this to support sharing of read-only file-backed pages, but it's cool to just have something working.
2018-11-08 11:59:16 +00:00
if (size == 0)
return (void*)-EINVAL;
AK: Add global FlatPtr typedef. It's u32 or u64, based on sizeof(void*) Use this instead of uintptr_t throughout the codebase. This makes it possible to pass a FlatPtr to something that has u32 and u64 overloads.
2020-03-08 09:36:51 +00:00
if ((FlatPtr)addr & ~PAGE_MASK)
Support basic mmap'ing of a file! All right, we can now mmap() a file and it gets magically paged in from fs in response to an NP page fault. This is really cool :^) I need to refactor this to support sharing of read-only file-backed pages, but it's cool to just have something working.
2018-11-08 11:59:16 +00:00
return (void*)-EINVAL;
Kernel: Clarify the various input validity checks in mmap() Also share some validation logic between mmap() and mprotect().
2019-12-25 20:50:13 +00:00
bool map_shared = flags & MAP_SHARED;
bool map_anonymous = flags & MAP_ANONYMOUS;
bool map_purgeable = flags & MAP_PURGEABLE;
bool map_private = flags & MAP_PRIVATE;
bool map_stack = flags & MAP_STACK;
Kernel: Retry mmap if MAP_FIXED is not in flags and addr is not 0 If an mmap fails to allocate a region, but the addr passed in was non-zero, non-fixed mmaps should attempt to allocate at any available virtual address.
2019-12-29 05:54:10 +00:00
bool map_fixed = flags & MAP_FIXED;
Kernel: Clarify the various input validity checks in mmap() Also share some validation logic between mmap() and mprotect().
2019-12-25 20:50:13 +00:00
if (map_shared && map_private)
Kernel: mmap() with both MAP_PRIVATE and MAP_SHARED is an error
2019-10-01 17:31:55 +00:00
return (void*)-EINVAL;
Kernel: Implement some basic stack pointer validation VM regions can now be marked as stack regions, which is then validated on syscall, and on page fault. If a thread is caught with its stack pointer pointing into anything that's *not* a Region with its stack bit set, we'll crash the whole process with SIGSTKFLT. Userspace must now allocate custom stacks by using mmap() with the new MAP_STACK flag. This mechanism was first introduced in OpenBSD, and now we have it too, yay! :^)
2019-11-17 11:11:43 +00:00
Kernel: Clarify the various input validity checks in mmap() Also share some validation logic between mmap() and mprotect().
2019-12-25 20:50:13 +00:00
if (!map_shared && !map_private)
Kernel: Don't allow mmap()/mprotect() to set up PROT_WRITE|PROT_EXEC ..but also allow mprotect() to set PROT_EXEC on a region, something we were just ignoring before.
2019-12-25 10:54:16 +00:00
return (void*)-EINVAL;
Kernel: Clarify the various input validity checks in mmap() Also share some validation logic between mmap() and mprotect().
2019-12-25 20:50:13 +00:00
if (!validate_mmap_prot(prot, map_stack))
Kernel: Implement some basic stack pointer validation VM regions can now be marked as stack regions, which is then validated on syscall, and on page fault. If a thread is caught with its stack pointer pointing into anything that's *not* a Region with its stack bit set, we'll crash the whole process with SIGSTKFLT. Userspace must now allocate custom stacks by using mmap() with the new MAP_STACK flag. This mechanism was first introduced in OpenBSD, and now we have it too, yay! :^)
2019-11-17 11:11:43 +00:00
return (void*)-EINVAL;
Kernel: Clarify the various input validity checks in mmap() Also share some validation logic between mmap() and mprotect().
2019-12-25 20:50:13 +00:00
if (map_stack && (!map_private || !map_anonymous))
Kernel: Implement some basic stack pointer validation VM regions can now be marked as stack regions, which is then validated on syscall, and on page fault. If a thread is caught with its stack pointer pointing into anything that's *not* a Region with its stack bit set, we'll crash the whole process with SIGSTKFLT. Userspace must now allocate custom stacks by using mmap() with the new MAP_STACK flag. This mechanism was first introduced in OpenBSD, and now we have it too, yay! :^)
2019-11-17 11:11:43 +00:00
return (void*)-EINVAL;
Kernel: Clarify the various input validity checks in mmap() Also share some validation logic between mmap() and mprotect().
2019-12-25 20:50:13 +00:00
Region* region = nullptr;
Kernel+LibC: Allow sys$mmap() callers to specify address alignment This is exposed via the non-standard serenity_mmap() call in userspace.
2020-02-16 11:55:56 +00:00
auto range = allocate_range(VirtualAddress(addr), size, alignment);
if (!range.is_valid())
return (void*)-ENOMEM;
Kernel: Clarify the various input validity checks in mmap() Also share some validation logic between mmap() and mprotect().
2019-12-25 20:50:13 +00:00
if (map_purgeable) {
Kernel: Start implementing purgeable memory support It's now possible to get purgeable memory by using mmap(MAP_PURGEABLE). Purgeable memory has a "volatile" flag that can be set using madvise(): - madvise(..., MADV_SET_VOLATILE) - madvise(..., MADV_SET_NONVOLATILE) When in the "volatile" state, the kernel may take away the underlying physical memory pages at any time, without notifying the owner. This gives you a guilt discount when caching very large things. :^) Setting a purgeable region to non-volatile will return whether or not the memory has been taken away by the kernel while being volatile. Basically, if madvise(..., MADV_SET_NONVOLATILE) returns 1, that means the memory was purged while volatile, and whatever was in that piece of memory needs to be reconstructed before use.
2019-12-09 18:12:38 +00:00
auto vmobject = PurgeableVMObject::create_with_size(size);
Kernel+LibC: Allow sys$mmap() callers to specify address alignment This is exposed via the non-standard serenity_mmap() call in userspace.
2020-02-16 11:55:56 +00:00
region = allocate_region_with_vmobject(range, vmobject, 0, !name.is_null() ? name : "mmap (purgeable)", prot);
Kernel: Retry mmap if MAP_FIXED is not in flags and addr is not 0 If an mmap fails to allocate a region, but the addr passed in was non-zero, non-fixed mmaps should attempt to allocate at any available virtual address.
2019-12-29 05:54:10 +00:00
if (!region && (!map_fixed && addr != 0))
Kernel: Pass name+length to mmap() and remove SmapDisabler
2020-01-06 11:04:55 +00:00
region = allocate_region_with_vmobject({}, size, vmobject, 0, !name.is_null() ? name : "mmap (purgeable)", prot);
Kernel: Clarify the various input validity checks in mmap() Also share some validation logic between mmap() and mprotect().
2019-12-25 20:50:13 +00:00
} else if (map_anonymous) {
Kernel+LibC: Allow sys$mmap() callers to specify address alignment This is exposed via the non-standard serenity_mmap() call in userspace.
2020-02-16 11:55:56 +00:00
region = allocate_region(range, !name.is_null() ? name : "mmap", prot, false);
Kernel: Retry mmap if MAP_FIXED is not in flags and addr is not 0 If an mmap fails to allocate a region, but the addr passed in was non-zero, non-fixed mmaps should attempt to allocate at any available virtual address.
2019-12-29 05:54:10 +00:00
if (!region && (!map_fixed && addr != 0))
Kernel+LibC: Allow sys$mmap() callers to specify address alignment This is exposed via the non-standard serenity_mmap() call in userspace.
2020-02-16 11:55:56 +00:00
region = allocate_region(allocate_range({}, size), !name.is_null() ? name : "mmap", prot, false);
Kernel: Clarify the various input validity checks in mmap() Also share some validation logic between mmap() and mprotect().
2019-12-25 20:50:13 +00:00
} else {
if (offset < 0)
return (void*)-EINVAL;
if (static_cast<size_t>(offset) & ~PAGE_MASK)
return (void*)-EINVAL;
Kernel: Make Process::file_description() vend a RefPtr<FileDescription> This encourages callers to strongly reference file descriptions while working with them. This fixes a use-after-free issue where one thread would close() an open fd while another thread was blocked on it becoming readable. Test: Kernel/uaf-close-while-blocked-in-read.cpp
2020-01-07 14:53:42 +00:00
auto description = file_description(fd);
Kernel: Clarify the various input validity checks in mmap() Also share some validation logic between mmap() and mprotect().
2019-12-25 20:50:13 +00:00
if (!description)
return (void*)-EBADF;
Kernel: mmap() should fail with ENODEV for directories
2020-01-08 11:33:36 +00:00
if (description->is_directory())
return (void*)-ENODEV;
Kernel: Validate PROT_READ and PROT_WRITE against underlying file This patch fixes some issues with the mmap() and mprotect() syscalls, neither of whom were checking the permission bits of the underlying files when mapping an inode MAP_SHARED. This made it possible to subvert execution of any running program by simply memory-mapping its executable and replacing some of the code. Test: Kernel/mmap-write-into-running-programs-executable-file.cpp
2020-01-07 18:29:18 +00:00
if ((prot & PROT_READ) && !description->is_readable())
return (void*)-EACCES;
Kernel: Implement basic support for sys$mmap() with MAP_PRIVATE You can now mmap a file as private and writable, and the changes you make will only be visible to you. This works because internally a MAP_PRIVATE region is backed by a unique PrivateInodeVMObject instead of using the globally shared SharedInodeVMObject like we always did before. :^) Fixes #1045.
2020-02-28 19:47:27 +00:00
if (map_shared) {
if ((prot & PROT_WRITE) && !description->is_writable())
return (void*)-EACCES;
}
Kernel: Validate PROT_READ and PROT_WRITE against underlying file This patch fixes some issues with the mmap() and mprotect() syscalls, neither of whom were checking the permission bits of the underlying files when mapping an inode MAP_SHARED. This made it possible to subvert execution of any running program by simply memory-mapping its executable and replacing some of the code. Test: Kernel/mmap-write-into-running-programs-executable-file.cpp
2020-01-07 18:29:18 +00:00
if (description->inode()) {
Kernel: Implement basic support for sys$mmap() with MAP_PRIVATE You can now mmap a file as private and writable, and the changes you make will only be visible to you. This works because internally a MAP_PRIVATE region is backed by a unique PrivateInodeVMObject instead of using the globally shared SharedInodeVMObject like we always did before. :^) Fixes #1045.
2020-02-28 19:47:27 +00:00
if (!validate_inode_mmap_prot(*this, prot, *description->inode(), map_shared))
Kernel: Validate PROT_READ and PROT_WRITE against underlying file This patch fixes some issues with the mmap() and mprotect() syscalls, neither of whom were checking the permission bits of the underlying files when mapping an inode MAP_SHARED. This made it possible to subvert execution of any running program by simply memory-mapping its executable and replacing some of the code. Test: Kernel/mmap-write-into-running-programs-executable-file.cpp
2020-01-07 18:29:18 +00:00
return (void*)-EACCES;
}
Kernel: Implement basic support for sys$mmap() with MAP_PRIVATE You can now mmap a file as private and writable, and the changes you make will only be visible to you. This works because internally a MAP_PRIVATE region is backed by a unique PrivateInodeVMObject instead of using the globally shared SharedInodeVMObject like we always did before. :^) Fixes #1045.
2020-02-28 19:47:27 +00:00
auto region_or_error = description->mmap(*this, VirtualAddress(addr), static_cast<size_t>(offset), size, prot, map_shared);
Kernel: Retry mmap if MAP_FIXED is not in flags and addr is not 0 If an mmap fails to allocate a region, but the addr passed in was non-zero, non-fixed mmaps should attempt to allocate at any available virtual address.
2019-12-29 05:54:10 +00:00
if (region_or_error.is_error()) {
// Fail if MAP_FIXED or address is 0, retry otherwise
if (map_fixed || addr == 0)
return (void*)(int)region_or_error.error();
Kernel: Implement basic support for sys$mmap() with MAP_PRIVATE You can now mmap a file as private and writable, and the changes you make will only be visible to you. This works because internally a MAP_PRIVATE region is backed by a unique PrivateInodeVMObject instead of using the globally shared SharedInodeVMObject like we always did before. :^) Fixes #1045.
2020-02-28 19:47:27 +00:00
region_or_error = description->mmap(*this, {}, static_cast<size_t>(offset), size, prot, map_shared);
Kernel: Retry mmap if MAP_FIXED is not in flags and addr is not 0 If an mmap fails to allocate a region, but the addr passed in was non-zero, non-fixed mmaps should attempt to allocate at any available virtual address.
2019-12-29 05:54:10 +00:00
}
Kernel: Clarify the various input validity checks in mmap() Also share some validation logic between mmap() and mprotect().
2019-12-25 20:50:13 +00:00
if (region_or_error.is_error())
return (void*)(int)region_or_error.error();
region = region_or_error.value();
Kernel: Start implementing purgeable memory support It's now possible to get purgeable memory by using mmap(MAP_PURGEABLE). Purgeable memory has a "volatile" flag that can be set using madvise(): - madvise(..., MADV_SET_VOLATILE) - madvise(..., MADV_SET_NONVOLATILE) When in the "volatile" state, the kernel may take away the underlying physical memory pages at any time, without notifying the owner. This gives you a guilt discount when caching very large things. :^) Setting a purgeable region to non-volatile will return whether or not the memory has been taken away by the kernel while being volatile. Basically, if madvise(..., MADV_SET_NONVOLATILE) returns 1, that means the memory was purged while volatile, and whatever was in that piece of memory needs to be reconstructed before use.
2019-12-09 18:12:38 +00:00
}
Kernel: Clarify the various input validity checks in mmap() Also share some validation logic between mmap() and mprotect().
2019-12-25 20:50:13 +00:00
if (!region)
return (void*)-ENOMEM;
region->set_mmap(true);
if (map_shared)
Move WindowServer to userspace. This is a monster patch that required changing a whole bunch of things. There are performance and stability issues all over the place, but it works. Pretty cool, I have to admit :^)
2019-02-16 23:13:47 +00:00
region->set_shared(true);
Kernel: Clarify the various input validity checks in mmap() Also share some validation logic between mmap() and mprotect().
2019-12-25 20:50:13 +00:00
if (map_stack)
region->set_stack(true);
Kernel: Pass name+length to mmap() and remove SmapDisabler
2020-01-06 11:04:55 +00:00
if (!name.is_null())
LibC: Add mmap_with_name() that names the allocation immediately. This allows us to skip the separate call to set_mmap_name() in code that we control, e.g malloc() and GraphicsBitmap.
2019-05-19 13:54:56 +00:00
region->set_name(name);
Kernel: Rename LinearAddress => VirtualAddress.
2019-06-07 10:56:50 +00:00
return region->vaddr().as_ptr();
Add simplified mmap() and munmap() syscalls.
2018-10-24 07:48:24 +00:00
}
Process now maps regions immediately when they are allocated. This avoids having to do a separate MM.mapRegionsForTask() pass. Also, more Task => Process renaming that I apparently hadn't saved yet.
2018-11-01 12:15:46 +00:00
int Process::sys$munmap(void* addr, size_t size)
Add simplified mmap() and munmap() syscalls.
2018-10-24 07:48:24 +00:00
{
ping: Use pledge()
2020-01-11 19:48:43 +00:00
REQUIRE_PROMISE(stdio);
Kernel: Reject non-user address ranges in mmap/munmap/mprotect/madvise There's no valid reason to allow non-userspace address ranges in these system calls.
2020-01-30 20:46:45 +00:00
Kernel: Disallow empty ranges in munmap/mprotect/madvise
2020-01-30 20:55:49 +00:00
if (!size)
return -EINVAL;
Kernel: Reject non-user address ranges in mmap/munmap/mprotect/madvise There's no valid reason to allow non-userspace address ranges in these system calls.
2020-01-30 20:46:45 +00:00
if (!is_user_range(VirtualAddress(addr), size))
return -EFAULT;
Kernel: Remove some unnecessary casts to uintptr_t VirtualAddress is constructible from uintptr_t and const void*. PhysicalAddress is constructible from uintptr_t but not const void*.
2020-01-20 12:06:41 +00:00
Range range_to_unmap { VirtualAddress(addr), size };
Kernel: Support partial munmap() You can now munmap() a part of a region. The kernel will then create one or two new regions around the "hole" and re-map them using the same physical pages as before. This goes towards fixing #175, but not all the way since we don't yet do munmap() across multiple mappings.
2019-08-29 18:57:02 +00:00
if (auto* whole_region = region_from_range(range_to_unmap)) {
Kernel: Mark mmap()-created regions with a special bit Then only allow regions with that bit to be manipulated via munmap() and mprotect(). This prevents messing with non-mmap()ed regions in a process's address space (stacks, shared buffers, ...)
2019-11-24 11:24:16 +00:00
if (!whole_region->is_mmap())
return -EPERM;
Kernel: Support partial munmap() You can now munmap() a part of a region. The kernel will then create one or two new regions around the "hole" and re-map them using the same physical pages as before. This goes towards fixing #175, but not all the way since we don't yet do munmap() across multiple mappings.
2019-08-29 18:57:02 +00:00
bool success = deallocate_region(*whole_region);
ASSERT(success);
return 0;
}
if (auto* old_region = region_containing(range_to_unmap)) {
Kernel: Mark mmap()-created regions with a special bit Then only allow regions with that bit to be manipulated via munmap() and mprotect(). This prevents messing with non-mmap()ed regions in a process's address space (stacks, shared buffers, ...)
2019-11-24 11:24:16 +00:00
if (!old_region->is_mmap())
return -EPERM;
Kernel: sys$mprotect protects sub-regions as well as whole ones Split a region into two/three if the desired mprotect range is a strict subset of an existing region. We can then set the access bits on a new region that is just our desired range and add both the new desired subregion and the leftovers back to our page tables.
2019-12-30 20:11:25 +00:00
auto new_regions = split_region_around_range(*old_region, range_to_unmap);
Kernel: Fix partial munmap() deallocating still-in-use VM We were always returning the full VM range of the partially-unmapped Region to the range allocator. This caused us to re-use those addresses for subsequent VM allocations. This patch also skips creating a new VMObject in partial munmap(). Instead we just make split regions that point into the same VMObject. This fixes the mysterious GCC ICE on large C++ programs.
2019-09-27 18:17:41 +00:00
// We manually unmap the old region here, specifying that we *don't* want the VM deallocated.
Kernel: Move region map/unmap operations into the Region class The more Region can take care of itself, the better.
2019-11-03 19:37:03 +00:00
old_region->unmap(Region::ShouldDeallocateVirtualMemoryRange::No);
Kernel: Support partial munmap() You can now munmap() a part of a region. The kernel will then create one or two new regions around the "hole" and re-map them using the same physical pages as before. This goes towards fixing #175, but not all the way since we don't yet do munmap() across multiple mappings.
2019-08-29 18:57:02 +00:00
deallocate_region(*old_region);
Kernel: Fix partial munmap() deallocating still-in-use VM We were always returning the full VM range of the partially-unmapped Region to the range allocator. This caused us to re-use those addresses for subsequent VM allocations. This patch also skips creating a new VMObject in partial munmap(). Instead we just make split regions that point into the same VMObject. This fixes the mysterious GCC ICE on large C++ programs.
2019-09-27 18:17:41 +00:00
// Instead we give back the unwanted VM manually.
page_directory().range_allocator().deallocate(range_to_unmap);
Kernel: sys$mprotect protects sub-regions as well as whole ones Split a region into two/three if the desired mprotect range is a strict subset of an existing region. We can then set the access bits on a new region that is just our desired range and add both the new desired subregion and the leftovers back to our page tables.
2019-12-30 20:11:25 +00:00
// And finally we map the new region(s) using our page directory (they were just allocated and don't have one).
Kernel: Support partial munmap() You can now munmap() a part of a region. The kernel will then create one or two new regions around the "hole" and re-map them using the same physical pages as before. This goes towards fixing #175, but not all the way since we don't yet do munmap() across multiple mappings.
2019-08-29 18:57:02 +00:00
for (auto* new_region : new_regions) {
Kernel: Regions should be mapped into a PageDirectory, not a Process This patch changes the parameter to Region::map() to be a PageDirectory since that matches how we think about the memory model: Regions are views onto VMObjects, and are mapped into PageDirectories. Each Process has a PageDirectory. The kernel also has a PageDirectory.
2019-11-03 19:48:35 +00:00
new_region->map(page_directory());
Kernel: Support partial munmap() You can now munmap() a part of a region. The kernel will then create one or two new regions around the "hole" and re-map them using the same physical pages as before. This goes towards fixing #175, but not all the way since we don't yet do munmap() across multiple mappings.
2019-08-29 18:57:02 +00:00
}
return 0;
}
// FIXME: We should also support munmap() across multiple regions. (#175)
return -EINVAL;
Add simplified mmap() and munmap() syscalls.
2018-10-24 07:48:24 +00:00
}
Kernel+LibC+crash: Add mprotect() syscall This patch adds the mprotect() syscall to allow changing the protection flags for memory regions. We don't do any region splitting/merging yet, so this only works on whole mmap() regions. Added a "crash -r" flag to verify that we crash when you attempt to write to read-only memory. :^)
2019-08-12 17:33:24 +00:00
int Process::sys$mprotect(void* addr, size_t size, int prot)
{
ping: Use pledge()
2020-01-11 19:48:43 +00:00
REQUIRE_PROMISE(stdio);
Kernel: Reject non-user address ranges in mmap/munmap/mprotect/madvise There's no valid reason to allow non-userspace address ranges in these system calls.
2020-01-30 20:46:45 +00:00
Kernel: Disallow empty ranges in munmap/mprotect/madvise
2020-01-30 20:55:49 +00:00
if (!size)
return -EINVAL;
Kernel: Reject non-user address ranges in mmap/munmap/mprotect/madvise There's no valid reason to allow non-userspace address ranges in these system calls.
2020-01-30 20:46:45 +00:00
if (!is_user_range(VirtualAddress(addr), size))
return -EFAULT;
Kernel: Remove some unnecessary casts to uintptr_t VirtualAddress is constructible from uintptr_t and const void*. PhysicalAddress is constructible from uintptr_t but not const void*.
2020-01-20 12:06:41 +00:00
Range range_to_mprotect = { VirtualAddress(addr), size };
Kernel: sys$mprotect protects sub-regions as well as whole ones Split a region into two/three if the desired mprotect range is a strict subset of an existing region. We can then set the access bits on a new region that is just our desired range and add both the new desired subregion and the leftovers back to our page tables.
2019-12-30 20:11:25 +00:00
if (auto* whole_region = region_from_range(range_to_mprotect)) {
if (!whole_region->is_mmap())
return -EPERM;
if (!validate_mmap_prot(prot, whole_region->is_stack()))
return -EINVAL;
if (whole_region->access() == prot_to_region_access_flags(prot))
return 0;
Kernel: Validate PROT_READ and PROT_WRITE against underlying file This patch fixes some issues with the mmap() and mprotect() syscalls, neither of whom were checking the permission bits of the underlying files when mapping an inode MAP_SHARED. This made it possible to subvert execution of any running program by simply memory-mapping its executable and replacing some of the code. Test: Kernel/mmap-write-into-running-programs-executable-file.cpp
2020-01-07 18:29:18 +00:00
if (whole_region->vmobject().is_inode()
Kernel: Remove some more harmless InodeVMObject miscasts
2020-03-01 11:27:03 +00:00
&& !validate_inode_mmap_prot(*this, prot, static_cast<const InodeVMObject&>(whole_region->vmobject()).inode(), whole_region->is_shared())) {
Kernel: Validate PROT_READ and PROT_WRITE against underlying file This patch fixes some issues with the mmap() and mprotect() syscalls, neither of whom were checking the permission bits of the underlying files when mapping an inode MAP_SHARED. This made it possible to subvert execution of any running program by simply memory-mapping its executable and replacing some of the code. Test: Kernel/mmap-write-into-running-programs-executable-file.cpp
2020-01-07 18:29:18 +00:00
return -EACCES;
}
Kernel: sys$mprotect protects sub-regions as well as whole ones Split a region into two/three if the desired mprotect range is a strict subset of an existing region. We can then set the access bits on a new region that is just our desired range and add both the new desired subregion and the leftovers back to our page tables.
2019-12-30 20:11:25 +00:00
whole_region->set_readable(prot & PROT_READ);
whole_region->set_writable(prot & PROT_WRITE);
whole_region->set_executable(prot & PROT_EXEC);
whole_region->remap();
return 0;
}
// Check if we can carve out the desired range from an existing region
if (auto* old_region = region_containing(range_to_mprotect)) {
if (!old_region->is_mmap())
return -EPERM;
if (!validate_mmap_prot(prot, old_region->is_stack()))
return -EINVAL;
if (old_region->access() == prot_to_region_access_flags(prot))
return 0;
Kernel: Validate PROT_READ and PROT_WRITE against underlying file This patch fixes some issues with the mmap() and mprotect() syscalls, neither of whom were checking the permission bits of the underlying files when mapping an inode MAP_SHARED. This made it possible to subvert execution of any running program by simply memory-mapping its executable and replacing some of the code. Test: Kernel/mmap-write-into-running-programs-executable-file.cpp
2020-01-07 18:29:18 +00:00
if (old_region->vmobject().is_inode()
Kernel: Remove some more harmless InodeVMObject miscasts
2020-03-01 11:27:03 +00:00
&& !validate_inode_mmap_prot(*this, prot, static_cast<const InodeVMObject&>(old_region->vmobject()).inode(), old_region->is_shared())) {
Kernel: Validate PROT_READ and PROT_WRITE against underlying file This patch fixes some issues with the mmap() and mprotect() syscalls, neither of whom were checking the permission bits of the underlying files when mapping an inode MAP_SHARED. This made it possible to subvert execution of any running program by simply memory-mapping its executable and replacing some of the code. Test: Kernel/mmap-write-into-running-programs-executable-file.cpp
2020-01-07 18:29:18 +00:00
return -EACCES;
}
Kernel: sys$mprotect protects sub-regions as well as whole ones Split a region into two/three if the desired mprotect range is a strict subset of an existing region. We can then set the access bits on a new region that is just our desired range and add both the new desired subregion and the leftovers back to our page tables.
2019-12-30 20:11:25 +00:00
// This vector is the region(s) adjacent to our range.
// We need to allocate a new region for the range we wanted to change permission bits on.
auto adjacent_regions = split_region_around_range(*old_region, range_to_mprotect);
size_t new_range_offset_in_vmobject = old_region->offset_in_vmobject() + (range_to_mprotect.base().get() - old_region->range().base().get());
auto& new_region = allocate_split_region(*old_region, range_to_mprotect, new_range_offset_in_vmobject);
new_region.set_readable(prot & PROT_READ);
new_region.set_writable(prot & PROT_WRITE);
new_region.set_executable(prot & PROT_EXEC);
// Unmap the old region here, specifying that we *don't* want the VM deallocated.
old_region->unmap(Region::ShouldDeallocateVirtualMemoryRange::No);
deallocate_region(*old_region);
// Map the new regions using our page directory (they were just allocated and don't have one).
for (auto* adjacent_region : adjacent_regions) {
adjacent_region->map(page_directory());
}
new_region.map(page_directory());
return 0;
}
// FIXME: We should also support mprotect() across multiple regions. (#175) (#964)
return -EINVAL;
Kernel+LibC+crash: Add mprotect() syscall This patch adds the mprotect() syscall to allow changing the protection flags for memory regions. We don't do any region splitting/merging yet, so this only works on whole mmap() regions. Added a "crash -r" flag to verify that we crash when you attempt to write to read-only memory. :^)
2019-08-12 17:33:24 +00:00
}
Kernel: Start implementing purgeable memory support It's now possible to get purgeable memory by using mmap(MAP_PURGEABLE). Purgeable memory has a "volatile" flag that can be set using madvise(): - madvise(..., MADV_SET_VOLATILE) - madvise(..., MADV_SET_NONVOLATILE) When in the "volatile" state, the kernel may take away the underlying physical memory pages at any time, without notifying the owner. This gives you a guilt discount when caching very large things. :^) Setting a purgeable region to non-volatile will return whether or not the memory has been taken away by the kernel while being volatile. Basically, if madvise(..., MADV_SET_NONVOLATILE) returns 1, that means the memory was purged while volatile, and whatever was in that piece of memory needs to be reconstructed before use.
2019-12-09 18:12:38 +00:00
int Process::sys$madvise(void* address, size_t size, int advice)
{
ping: Use pledge()
2020-01-11 19:48:43 +00:00
REQUIRE_PROMISE(stdio);
Kernel: Reject non-user address ranges in mmap/munmap/mprotect/madvise There's no valid reason to allow non-userspace address ranges in these system calls.
2020-01-30 20:46:45 +00:00
Kernel: Disallow empty ranges in munmap/mprotect/madvise
2020-01-30 20:55:49 +00:00
if (!size)
return -EINVAL;
Kernel: Reject non-user address ranges in mmap/munmap/mprotect/madvise There's no valid reason to allow non-userspace address ranges in these system calls.
2020-01-30 20:46:45 +00:00
if (!is_user_range(VirtualAddress(address), size))
return -EFAULT;
Kernel: Remove some unnecessary casts to uintptr_t VirtualAddress is constructible from uintptr_t and const void*. PhysicalAddress is constructible from uintptr_t but not const void*.
2020-01-20 12:06:41 +00:00
auto* region = region_from_range({ VirtualAddress(address), size });
Kernel: Start implementing purgeable memory support It's now possible to get purgeable memory by using mmap(MAP_PURGEABLE). Purgeable memory has a "volatile" flag that can be set using madvise(): - madvise(..., MADV_SET_VOLATILE) - madvise(..., MADV_SET_NONVOLATILE) When in the "volatile" state, the kernel may take away the underlying physical memory pages at any time, without notifying the owner. This gives you a guilt discount when caching very large things. :^) Setting a purgeable region to non-volatile will return whether or not the memory has been taken away by the kernel while being volatile. Basically, if madvise(..., MADV_SET_NONVOLATILE) returns 1, that means the memory was purged while volatile, and whatever was in that piece of memory needs to be reconstructed before use.
2019-12-09 18:12:38 +00:00
if (!region)
return -EINVAL;
if (!region->is_mmap())
return -EPERM;
if ((advice & MADV_SET_VOLATILE) && (advice & MADV_SET_NONVOLATILE))
return -EINVAL;
if (advice & MADV_SET_VOLATILE) {
if (!region->vmobject().is_purgeable())
return -EPERM;
auto& vmobject = static_cast<PurgeableVMObject&>(region->vmobject());
vmobject.set_volatile(true);
return 0;
}
if (advice & MADV_SET_NONVOLATILE) {
if (!region->vmobject().is_purgeable())
return -EPERM;
auto& vmobject = static_cast<PurgeableVMObject&>(region->vmobject());
Kernel: Ignore MADV_SET_NONVOLATILE if already non-volatile Just return 0 right away without changing any region flags.
2019-12-18 19:48:58 +00:00
if (!vmobject.is_volatile())
return 0;
Kernel: Start implementing purgeable memory support It's now possible to get purgeable memory by using mmap(MAP_PURGEABLE). Purgeable memory has a "volatile" flag that can be set using madvise(): - madvise(..., MADV_SET_VOLATILE) - madvise(..., MADV_SET_NONVOLATILE) When in the "volatile" state, the kernel may take away the underlying physical memory pages at any time, without notifying the owner. This gives you a guilt discount when caching very large things. :^) Setting a purgeable region to non-volatile will return whether or not the memory has been taken away by the kernel while being volatile. Basically, if madvise(..., MADV_SET_NONVOLATILE) returns 1, that means the memory was purged while volatile, and whatever was in that piece of memory needs to be reconstructed before use.
2019-12-09 18:12:38 +00:00
vmobject.set_volatile(false);
bool was_purged = vmobject.was_purged();
vmobject.set_was_purged(false);
return was_purged ? 1 : 0;
}
Kernel: Add MADV_GET_VOLATILE for checking the volatile flag Sometimes you might want to know if a purgeable region is volatile.
2019-12-18 19:48:24 +00:00
if (advice & MADV_GET_VOLATILE) {
if (!region->vmobject().is_purgeable())
return -EPERM;
auto& vmobject = static_cast<PurgeableVMObject&>(region->vmobject());
return vmobject.is_volatile() ? 0 : 1;
}
Kernel: Start implementing purgeable memory support It's now possible to get purgeable memory by using mmap(MAP_PURGEABLE). Purgeable memory has a "volatile" flag that can be set using madvise(): - madvise(..., MADV_SET_VOLATILE) - madvise(..., MADV_SET_NONVOLATILE) When in the "volatile" state, the kernel may take away the underlying physical memory pages at any time, without notifying the owner. This gives you a guilt discount when caching very large things. :^) Setting a purgeable region to non-volatile will return whether or not the memory has been taken away by the kernel while being volatile. Basically, if madvise(..., MADV_SET_NONVOLATILE) returns 1, that means the memory was purged while volatile, and whatever was in that piece of memory needs to be reconstructed before use.
2019-12-09 18:12:38 +00:00
return -EINVAL;
}
Kernel+LibC: Add minherit() and MAP_INHERIT_ZERO This patch adds the minherit() syscall originally invented by OpenBSD. Only the MAP_INHERIT_ZERO mode is supported for now. If set on an mmap region, that region will be zeroed out on fork().
2020-04-12 18:22:26 +00:00
int Process::sys$minherit(void* address, size_t size, int inherit)
{
REQUIRE_PROMISE(stdio);
auto* region = region_from_range({ VirtualAddress(address), size });
if (!region)
return -EINVAL;
if (!region->is_mmap())
return -EINVAL;
if (region->is_shared())
return -EINVAL;
if (!region->vmobject().is_anonymous())
return -EINVAL;
switch (inherit) {
case MAP_INHERIT_ZERO:
region->set_inherit_mode(Region::InheritMode::ZeroedOnFork);
return 0;
}
return -EINVAL;
}
Kernel: Add a mode flag to sys$purge and allow purging clean inodes
2019-12-29 12:16:53 +00:00
int Process::sys$purge(int mode)
Kernel: Start implementing purgeable memory support It's now possible to get purgeable memory by using mmap(MAP_PURGEABLE). Purgeable memory has a "volatile" flag that can be set using madvise(): - madvise(..., MADV_SET_VOLATILE) - madvise(..., MADV_SET_NONVOLATILE) When in the "volatile" state, the kernel may take away the underlying physical memory pages at any time, without notifying the owner. This gives you a guilt discount when caching very large things. :^) Setting a purgeable region to non-volatile will return whether or not the memory has been taken away by the kernel while being volatile. Basically, if madvise(..., MADV_SET_NONVOLATILE) returns 1, that means the memory was purged while volatile, and whatever was in that piece of memory needs to be reconstructed before use.
2019-12-09 18:12:38 +00:00
{
ping: Use pledge()
2020-01-11 19:48:43 +00:00
REQUIRE_NO_PROMISES;
Kernel: Make the purge() syscall superuser-only I don't think we need to give unprivileged users access to what is essentially a kernel testing mechanism.
2020-01-02 12:37:23 +00:00
if (!is_superuser())
return -EPERM;
Kernel: Start implementing purgeable memory support It's now possible to get purgeable memory by using mmap(MAP_PURGEABLE). Purgeable memory has a "volatile" flag that can be set using madvise(): - madvise(..., MADV_SET_VOLATILE) - madvise(..., MADV_SET_NONVOLATILE) When in the "volatile" state, the kernel may take away the underlying physical memory pages at any time, without notifying the owner. This gives you a guilt discount when caching very large things. :^) Setting a purgeable region to non-volatile will return whether or not the memory has been taken away by the kernel while being volatile. Basically, if madvise(..., MADV_SET_NONVOLATILE) returns 1, that means the memory was purged while volatile, and whatever was in that piece of memory needs to be reconstructed before use.
2019-12-09 18:12:38 +00:00
int purged_page_count = 0;
Kernel: Add a mode flag to sys$purge and allow purging clean inodes
2019-12-29 12:16:53 +00:00
if (mode & PURGE_ALL_VOLATILE) {
NonnullRefPtrVector<PurgeableVMObject> vmobjects;
{
InterruptDisabler disabler;
MM.for_each_vmobject([&](auto& vmobject) {
if (vmobject.is_purgeable())
vmobjects.append(static_cast<PurgeableVMObject&>(vmobject));
return IterationDecision::Continue;
});
}
for (auto& vmobject : vmobjects) {
purged_page_count += vmobject.purge();
}
}
if (mode & PURGE_ALL_CLEAN_INODE) {
Kernel: Split InodeVMObject into two subclasses We now have PrivateInodeVMObject and SharedInodeVMObject, corresponding to MAP_PRIVATE and MAP_SHARED respectively. Note that PrivateInodeVMObject is not used yet.
2020-02-28 19:20:35 +00:00
NonnullRefPtrVector<InodeVMObject> vmobjects;
Kernel: Add a mode flag to sys$purge and allow purging clean inodes
2019-12-29 12:16:53 +00:00
{
InterruptDisabler disabler;
MM.for_each_vmobject([&](auto& vmobject) {
if (vmobject.is_inode())
Kernel: Split InodeVMObject into two subclasses We now have PrivateInodeVMObject and SharedInodeVMObject, corresponding to MAP_PRIVATE and MAP_SHARED respectively. Note that PrivateInodeVMObject is not used yet.
2020-02-28 19:20:35 +00:00
vmobjects.append(static_cast<InodeVMObject&>(vmobject));
Kernel: Add a mode flag to sys$purge and allow purging clean inodes
2019-12-29 12:16:53 +00:00
return IterationDecision::Continue;
});
}
for (auto& vmobject : vmobjects) {
purged_page_count += vmobject.release_all_clean_pages();
}
Kernel: Start implementing purgeable memory support It's now possible to get purgeable memory by using mmap(MAP_PURGEABLE). Purgeable memory has a "volatile" flag that can be set using madvise(): - madvise(..., MADV_SET_VOLATILE) - madvise(..., MADV_SET_NONVOLATILE) When in the "volatile" state, the kernel may take away the underlying physical memory pages at any time, without notifying the owner. This gives you a guilt discount when caching very large things. :^) Setting a purgeable region to non-volatile will return whether or not the memory has been taken away by the kernel while being volatile. Basically, if madvise(..., MADV_SET_NONVOLATILE) returns 1, that means the memory was purged while volatile, and whatever was in that piece of memory needs to be reconstructed before use.
2019-12-09 18:12:38 +00:00
}
return purged_page_count;
}
Kernel: Make syscalls that take a buffer size use ssize_t instead of size_t. Dealing with the unsigned overflow propagation here just seems unreasonably error prone. Let's limit ourselves to 2GB buffer sizes instead.
2019-02-25 20:19:57 +00:00
int Process::sys$gethostname(char* buffer, ssize_t size)
Add sys$gethostname and /bin/hostname
2018-10-26 07:54:29 +00:00
{
ping: Use pledge()
2020-01-11 19:48:43 +00:00
REQUIRE_PROMISE(stdio);
Kernel: Make syscalls that take a buffer size use ssize_t instead of size_t. Dealing with the unsigned overflow propagation here just seems unreasonably error prone. Let's limit ourselves to 2GB buffer sizes instead.
2019-02-25 20:19:57 +00:00
if (size < 0)
return -EINVAL;
Improve syscall address validation a bit.
2018-11-16 15:10:59 +00:00
if (!validate_write(buffer, size))
return -EFAULT;
Kernel: Don't disable interrupts to access the system hostname.
2019-02-07 09:29:26 +00:00
LOCKER(*s_hostname_lock);
AK: Use size_t for the length of strings Using int was a mistake. This patch changes String, StringImpl, StringView and StringBuilder to use size_t instead of int for lengths. Obviously a lot of code needs to change as a result of this.
2019-12-09 16:45:40 +00:00
if ((size_t)size < (s_hostname->length() + 1))
Add sys$gethostname and /bin/hostname
2018-10-26 07:54:29 +00:00
return -ENAMETOOLONG;
Kernel: Start implementing x86 SMAP support Supervisor Mode Access Prevention (SMAP) is an x86 CPU feature that prevents the kernel from accessing userspace memory. With SMAP enabled, trying to read/write a userspace memory address while in the kernel will now generate a page fault. Since it's sometimes necessary to read/write userspace memory, there are two new instructions that quickly switch the protection on/off: STAC (disables protection) and CLAC (enables protection.) These are exposed in kernel code via the stac() and clac() helpers. There's also a SmapDisabler RAII object that can be used to ensure that you don't forget to re-enable protection before returning to userspace code. THis patch also adds copy_to_user(), copy_from_user() and memset_user() which are the "correct" way of doing things. These functions allow us to briefly disable protection for a specific purpose, and then turn it back on immediately after it's done. Going forward all kernel code should be moved to using these and all uses of SmapDisabler are to be considered FIXME's. Note that we're not realizing the full potential of this feature since I've used SmapDisabler quite liberally in this initial bring-up patch.
2020-01-05 17:00:15 +00:00
copy_to_user(buffer, s_hostname->characters(), s_hostname->length() + 1);
Implement argc/argv support for spawned tasks. Celebrate the new functionality with a simple /bin/cat implementation. :^)
2018-10-26 09:16:56 +00:00
return 0;
Add sys$gethostname and /bin/hostname
2018-10-26 07:54:29 +00:00
}
Kernel: Rename RegisterDump => RegisterState
2020-02-15 23:15:37 +00:00
pid_t Process::sys$fork(RegisterState& regs)
Implement fork()! This is quite cool! The syscall entry point plumbs the register dump down to sys$fork(), which uses it to set up the child process's TSS in order to resume execution right after the int 0x80 fork() call. :^) This works pretty well, although there is some problem with the kernel alias mappings used to clone the parent process's regions. If I disable the MM::release_page_directory() code, there's no problem. Probably there's a premature freeing of a physical page somehow.
2018-11-02 19:41:58 +00:00
{
ping: Use pledge()
2020-01-11 19:48:43 +00:00
REQUIRE_PROMISE(proc);
Kernel: Get rid of "main thread" concept The idea of all processes reliably having a main thread was nice in some ways, but cumbersome in others. More importantly, it didn't match up with POSIX thread semantics, so let's move away from it. This thread gets rid of Process::main_thread() and you now we just have a bunch of Thread objects floating around each Process. When the finalizer nukes the last Thread in a Process, it will also tear down the Process. There's a bunch of more things to fix around this, but this is where we get started :^)
2019-12-22 10:35:02 +00:00
Thread* child_first_thread = nullptr;
auto* child = new Process(child_first_thread, m_name, m_uid, m_gid, m_pid, m_ring, m_cwd, m_executable, m_tty, this);
Kernel: Add a basic chroot() syscall :^) The chroot() syscall now allows the superuser to isolate a process into a specific subtree of the filesystem. This is not strictly permanent, as it is also possible for a superuser to break *out* of a chroot, but it is a useful mechanism for isolating unprivileged processes. The VFS now uses the current process's root_directory() as the root for path resolution purposes. The root directory is stored as an uncached Custody in the Process object.
2020-01-10 22:14:04 +00:00
child->m_root_directory = m_root_directory;
Kernel: Don't forget to copy & destroy root_directory_for_procfs Also, rename it to root_directory_relative_to_global_root.
2020-01-12 18:42:01 +00:00
child->m_root_directory_relative_to_global_root = m_root_directory_relative_to_global_root;
Kernel: fork()ed children should inherit pledge promises :^) Update various places that now need wider promises as they are not reset by fork() anymore.
2020-01-11 22:19:30 +00:00
child->m_promises = m_promises;
child->m_execpromises = m_execpromises;
Kernel: Rename UnveilState to VeilState
2020-01-21 18:28:29 +00:00
child->m_veil_state = m_veil_state;
Kernel: Forked children should inherit unveil()'ed paths
2020-01-21 08:44:32 +00:00
child->m_unveiled_paths = m_unveiled_paths;
Kernel: Simplify Process constructor Move all the fork-specific inheritance logic to sys$fork(), and all the stuff for setting up stdio for non-fork ring 3 processes moves to Process::create_user_process(). Also: we were setting up the PGID, SID and umask twice. Also the code for copying the open file descriptors was overly complicated. Now it's just a simple Vector copy assignment. :^)
2020-01-25 12:50:54 +00:00
child->m_fds = m_fds;
child->m_sid = m_sid;
child->m_pgid = m_pgid;
child->m_umask = m_umask;
Some improvements to signals. - Add sigprocmask() and sigpending(). - Forked children inherit signal dispositions and masks. - Exec clears signal dispositions and masks.
2018-11-10 22:29:07 +00:00
Implement fork()! This is quite cool! The syscall entry point plumbs the register dump down to sys$fork(), which uses it to set up the child process's TSS in order to resume execution right after the int 0x80 fork() call. :^) This works pretty well, although there is some problem with the kernel alias mappings used to clone the parent process's regions. If I disable the MM::release_page_directory() code, there's no problem. Probably there's a premature freeing of a physical page somehow.
2018-11-02 19:41:58 +00:00
#ifdef FORK_DEBUG
Process: Use dbg() instead of dbgprintf() Also, fix a bad derefernce in sys$create_shared_buffer() method.
2020-02-24 22:13:33 +00:00
dbg() << "fork: child=" << child;
Implement fork()! This is quite cool! The syscall entry point plumbs the register dump down to sys$fork(), which uses it to set up the child process's TSS in order to resume execution right after the int 0x80 fork() call. :^) This works pretty well, although there is some problem with the kernel alias mappings used to clone the parent process's regions. If I disable the MM::release_page_directory() code, there's no problem. Probably there's a premature freeing of a physical page somehow.
2018-11-02 19:41:58 +00:00
#endif
for (auto& region : m_regions) {
#ifdef FORK_DEBUG
Kernel: Fix bitrotted FORK_DEBUG logging code
2019-09-27 11:57:35 +00:00
dbg() << "fork: cloning Region{" << &region << "} '" << region.name() << "' @ " << region.vaddr();
Implement fork()! This is quite cool! The syscall entry point plumbs the register dump down to sys$fork(), which uses it to set up the child process's TSS in order to resume execution right after the int 0x80 fork() call. :^) This works pretty well, although there is some problem with the kernel alias mappings used to clone the parent process's regions. If I disable the MM::release_page_directory() code, there's no problem. Probably there's a premature freeing of a physical page somehow.
2018-11-02 19:41:58 +00:00
#endif
Kernel: Add a Process::add_region() helper This is a private helper for adding a Region to Process::m_regions. It's just for convenience since it's a bit cumbersome to do this.
2020-01-19 15:25:38 +00:00
auto& child_region = child->add_region(region.clone());
child_region.map(child->page_directory());
Kernel: Support thread-local storage This patch adds support for TLS according to the x86 System V ABI. Each thread gets a thread-specific memory region, and the GS segment register always points _to a pointer_ to the thread-specific memory. In other words, to access thread-local variables, userspace programs start by dereferencing the pointer at [gs:0]. The Process keeps a master copy of the TLS segment that new threads should use, and when a new thread is created, they get a copy of it. It's basically whatever the PT_TLS program header in the ELF says.
2019-09-07 13:50:44 +00:00
if (&region == m_master_tls_region)
Kernel: Make Process::m_master_tls_region a WeakPtr Let's not keep raw Region* variables around like that when it's so easy to avoid it.
2020-02-28 13:04:49 +00:00
child->m_master_tls_region = child_region.make_weak_ptr();
Implement fork()! This is quite cool! The syscall entry point plumbs the register dump down to sys$fork(), which uses it to set up the child process's TSS in order to resume execution right after the int 0x80 fork() call. :^) This works pretty well, although there is some problem with the kernel alias mappings used to clone the parent process's regions. If I disable the MM::release_page_directory() code, there's no problem. Probably there's a premature freeing of a physical page somehow.
2018-11-02 19:41:58 +00:00
}
Kernel: Don't include the process GID in the "extra GIDs" table Process::m_extra_gids is for supplementary GIDs only.
2020-01-02 22:45:52 +00:00
child->m_extra_gids = m_extra_gids;
Kernel: Clone Process::m_gids on fork() and hook up any framebuffer region.
2019-01-21 00:49:30 +00:00
Kernel: Get rid of "main thread" concept The idea of all processes reliably having a main thread was nice in some ways, but cumbersome in others. More importantly, it didn't match up with POSIX thread semantics, so let's move away from it. This thread gets rid of Process::main_thread() and you now we just have a bunch of Thread objects floating around each Process. When the finalizer nukes the last Thread in a Process, it will also tear down the Process. There's a bunch of more things to fix around this, but this is where we get started :^)
2019-12-22 10:35:02 +00:00
auto& child_tss = child_first_thread->m_tss;
Kernel: Introduce threads, and refactor everything in support of it. The scheduler now operates on threads, rather than on processes. Each process has a main thread, and can have any number of additional threads. The process exits when the main thread exits. This patch doesn't actually spawn any additional threads, it merely does all the plumbing needed to make it possible. :^)
2019-03-23 21:03:17 +00:00
child_tss.eax = 0; // fork() returns 0 in the child :^)
child_tss.ebx = regs.ebx;
child_tss.ecx = regs.ecx;
child_tss.edx = regs.edx;
child_tss.ebp = regs.ebp;
Kernel: Rename {ss,esp}_if_crossRing to userspace_{ss,esp} These were always so awkwardly named.
2020-01-09 17:02:01 +00:00
child_tss.esp = regs.userspace_esp;
Kernel: Introduce threads, and refactor everything in support of it. The scheduler now operates on threads, rather than on processes. Each process has a main thread, and can have any number of additional threads. The process exits when the main thread exits. This patch doesn't actually spawn any additional threads, it merely does all the plumbing needed to make it possible. :^)
2019-03-23 21:03:17 +00:00
child_tss.esi = regs.esi;
child_tss.edi = regs.edi;
child_tss.eflags = regs.eflags;
child_tss.eip = regs.eip;
child_tss.cs = regs.cs;
child_tss.ds = regs.ds;
child_tss.es = regs.es;
child_tss.fs = regs.fs;
child_tss.gs = regs.gs;
Kernel: Rename {ss,esp}_if_crossRing to userspace_{ss,esp} These were always so awkwardly named.
2020-01-09 17:02:01 +00:00
child_tss.ss = regs.userspace_ss;
Kernel: Implement lazy FPU state restore.
2019-01-25 06:52:44 +00:00
Implement fork()! This is quite cool! The syscall entry point plumbs the register dump down to sys$fork(), which uses it to set up the child process's TSS in order to resume execution right after the int 0x80 fork() call. :^) This works pretty well, although there is some problem with the kernel alias mappings used to clone the parent process's regions. If I disable the MM::release_page_directory() code, there's no problem. Probably there's a premature freeing of a physical page somehow.
2018-11-02 19:41:58 +00:00
#ifdef FORK_DEBUG
Process: Use dbg() instead of dbgprintf() Also, fix a bad derefernce in sys$create_shared_buffer() method.
2020-02-24 22:13:33 +00:00
dbg() << "fork: child will begin executing at " << String::format("%w", child_tss.cs) << ":" << String::format("%x", child_tss.eip) << " with stack " << String::format("%w", child_tss.ss) << ":" << String::format("%x", child_tss.esp) << ", kstack " << String::format("%w", child_tss.ss0) << ":" << String::format("%x", child_tss.esp0);
Implement fork()! This is quite cool! The syscall entry point plumbs the register dump down to sys$fork(), which uses it to set up the child process's TSS in order to resume execution right after the int 0x80 fork() call. :^) This works pretty well, although there is some problem with the kernel alias mappings used to clone the parent process's regions. If I disable the MM::release_page_directory() code, there's no problem. Probably there's a premature freeing of a physical page somehow.
2018-11-02 19:41:58 +00:00
#endif
Fix some paging related bugs exposed by the spawn stress test. - Process::exec() needs to restore the original paging scope when called on a non-current process. - Add missing InterruptDisabler guards around g_processes access. - Only flush the TLB when modifying the active page tables.
2018-11-09 00:25:31 +00:00
{
InterruptDisabler disabler;
g_processes->prepend(child);
}
Implement fork()! This is quite cool! The syscall entry point plumbs the register dump down to sys$fork(), which uses it to set up the child process's TSS in order to resume execution right after the int 0x80 fork() call. :^) This works pretty well, although there is some problem with the kernel alias mappings used to clone the parent process's regions. If I disable the MM::release_page_directory() code, there's no problem. Probably there's a premature freeing of a physical page somehow.
2018-11-02 19:41:58 +00:00
#ifdef TASK_DEBUG
Kernel: Use klog() instead of kprintf() Also, duplicate data in dbg() and klog() calls were removed. In addition, leakage of virtual address to kernel log is prevented. This is done by replacing kprintf() calls to dbg() calls with the leaked data instead. Also, other kprintf() calls were replaced with klog().
2020-03-01 19:45:39 +00:00
klog() << "Process " << child->pid() << " (" << child->name().characters() << ") forked from " << m_pid << " @ " << String::format("%p", child_tss.eip);
Implement fork()! This is quite cool! The syscall entry point plumbs the register dump down to sys$fork(), which uses it to set up the child process's TSS in order to resume execution right after the int 0x80 fork() call. :^) This works pretty well, although there is some problem with the kernel alias mappings used to clone the parent process's regions. If I disable the MM::release_page_directory() code, there's no problem. Probably there's a premature freeing of a physical page somehow.
2018-11-02 19:41:58 +00:00
#endif
Kernel: Introduce threads, and refactor everything in support of it. The scheduler now operates on threads, rather than on processes. Each process has a main thread, and can have any number of additional threads. The process exits when the main thread exits. This patch doesn't actually spawn any additional threads, it merely does all the plumbing needed to make it possible. :^)
2019-03-23 21:03:17 +00:00
Kernel: Get rid of "main thread" concept The idea of all processes reliably having a main thread was nice in some ways, but cumbersome in others. More importantly, it didn't match up with POSIX thread semantics, so let's move away from it. This thread gets rid of Process::main_thread() and you now we just have a bunch of Thread objects floating around each Process. When the finalizer nukes the last Thread in a Process, it will also tear down the Process. There's a bunch of more things to fix around this, but this is where we get started :^)
2019-12-22 10:35:02 +00:00
child_first_thread->set_state(Thread::State::Skip1SchedulerPass);
Implement fork()! This is quite cool! The syscall entry point plumbs the register dump down to sys$fork(), which uses it to set up the child process's TSS in order to resume execution right after the int 0x80 fork() call. :^) This works pretty well, although there is some problem with the kernel alias mappings used to clone the parent process's regions. If I disable the MM::release_page_directory() code, there's no problem. Probably there's a premature freeing of a physical page somehow.
2018-11-02 19:41:58 +00:00
return child->pid();
}
Kernel: Allow process with multiple threads to call exec and exit This allows a process wich has more than 1 thread to call exec, even from a thread. This kills all the other threads, but it won't wait for them to finish, just makes sure that they are not in a running/runable state. In the case where a thread does exec, the new program PID will be the thread TID, to keep the PID == TID in the new process. This introduces a new function inside the Process class, kill_threads_except_self which is called on exit() too (exit with multiple threads wasn't properly working either). Inside the Lock class, there is the need for a new function, clear_waiters, which removes all the waiters from the Process::big_lock. This is needed since after a exit/exec, there should be no other threads waiting for this lock, the threads should be simply killed. Only queued threads should wait for this lock at this point, since blocked threads are handled in set_should_die.
2020-02-18 12:28:28 +00:00
void Process::kill_threads_except_self()
{
InterruptDisabler disabler;
if (m_thread_count <= 1)
return;
for_each_thread([&](Thread& thread) {
if (&thread == Thread::current
Kernel: Run clang-format on Process.cpp
2020-03-01 20:16:12 +00:00
|| thread.state() == Thread::State::Dead
|| thread.state() == Thread::State::Dying)
Kernel: Allow process with multiple threads to call exec and exit This allows a process wich has more than 1 thread to call exec, even from a thread. This kills all the other threads, but it won't wait for them to finish, just makes sure that they are not in a running/runable state. In the case where a thread does exec, the new program PID will be the thread TID, to keep the PID == TID in the new process. This introduces a new function inside the Process class, kill_threads_except_self which is called on exit() too (exit with multiple threads wasn't properly working either). Inside the Lock class, there is the need for a new function, clear_waiters, which removes all the waiters from the Process::big_lock. This is needed since after a exit/exec, there should be no other threads waiting for this lock, the threads should be simply killed. Only queued threads should wait for this lock at this point, since blocked threads are handled in set_should_die.
2020-02-18 12:28:28 +00:00
return IterationDecision::Continue;
// At this point, we have no joiner anymore
thread.m_joiner = nullptr;
thread.set_should_die();
if (thread.state() != Thread::State::Dead)
thread.set_state(Thread::State::Dying);
return IterationDecision::Continue;
});
big_lock().clear_waiters();
}
void Process::kill_all_threads()
{
for_each_thread([&](Thread& thread) {
thread.set_should_die();
return IterationDecision::Continue;
});
}
Kernel: Tighten up exec/do_exec and allow for PT_INTERP iterpreters This patch changes how exec() figures out which program image to actually load. Previously, we opened the path to our main executable in find_shebang_interpreter_for_executable, read the first page (or less, if the file was smaller) and then decided whether to recurse with the interpreter instead. We then then re-opened the main executable in do_exec. However, since we now want to parse the ELF header and Program Headers of an elf image before even doing any memory region work, we can change the way this whole process works. We open the file and read (up to) the first page in exec() itself, then pass just the page and the amount read to find_shebang_interpreter_for_executable. Since we now have that page and the FileDescription for the main executable handy, we can do a few things. First, validate the ELF header and ELF program headers for any shenanigans. ELF32 Little Endian i386 only, please. Second, we can grab the PT_INTERP interpreter from any ET_DYN files, and open that guy right away if it exists. Finally, we can pass the main executable's and optionally the PT_INTERP interpreter's file descriptions down to do_exec and not have to feel guilty about opening the file twice. In do_exec, we now have a choice. Are we going to load the main executable, or the interpreter? We could load both, but it'll be way easier for the inital pass on the RTLD if we only load the interpreter. Then it can load the main executable itself like any old shared object, just, the one with main in it :). Later on we can load both of them into memory and the RTLD can relocate itself before trying to do anything. The way it's written now the RTLD will get dibs on its requested virtual addresses being the actual virtual addresses.
2020-01-11 01:28:02 +00:00
int Process::do_exec(NonnullRefPtr<FileDescription> main_program_description, Vector<String> arguments, Vector<String> environment, RefPtr<FileDescription> interpreter_description)
Implemented sys$execve(). It's really crufty, but it basically works!
2018-11-03 00:49:40 +00:00
{
Kernel: Increase default userspace stack size to 64 kilobytes.
2019-02-03 02:56:08 +00:00
ASSERT(is_ring3());
Kernel: Tighten up exec/do_exec and allow for PT_INTERP iterpreters This patch changes how exec() figures out which program image to actually load. Previously, we opened the path to our main executable in find_shebang_interpreter_for_executable, read the first page (or less, if the file was smaller) and then decided whether to recurse with the interpreter instead. We then then re-opened the main executable in do_exec. However, since we now want to parse the ELF header and Program Headers of an elf image before even doing any memory region work, we can change the way this whole process works. We open the file and read (up to) the first page in exec() itself, then pass just the page and the amount read to find_shebang_interpreter_for_executable. Since we now have that page and the FileDescription for the main executable handy, we can do a few things. First, validate the ELF header and ELF program headers for any shenanigans. ELF32 Little Endian i386 only, please. Second, we can grab the PT_INTERP interpreter from any ET_DYN files, and open that guy right away if it exists. Finally, we can pass the main executable's and optionally the PT_INTERP interpreter's file descriptions down to do_exec and not have to feel guilty about opening the file twice. In do_exec, we now have a choice. Are we going to load the main executable, or the interpreter? We could load both, but it'll be way easier for the inital pass on the RTLD if we only load the interpreter. Then it can load the main executable itself like any old shared object, just, the one with main in it :). Later on we can load both of them into memory and the RTLD can relocate itself before trying to do anything. The way it's written now the RTLD will get dibs on its requested virtual addresses being the actual virtual addresses.
2020-01-11 01:28:02 +00:00
auto path = main_program_description->absolute_path();
Kernel: Tidy up debug logging a little bit When using dbg() in the kernel, the output is automatically prefixed with [Process(PID:TID)]. This makes it a lot easier to understand which thread is generating the output. This patch also cleans up some common logging messages and removes the now-unnecessary "dbg() << *current << ..." pattern.
2020-01-21 15:14:39 +00:00
dbg() << "do_exec(" << path << ")";
Kernel: Process destruction should destroy all child threads. We were only destroying the main thread when a process died, leaving any secondary threads around. They couldn't run, but because they were still in the global thread list, strange things could happen since they had some now-stale pointers to their old process.
2019-04-23 20:17:01 +00:00
Kernel: Move E2BIG calculation from Thread to Process Thread::make_userspace_stack_for_main_thread is only ever called from Process::do_exec, after all the fun ELF loading and TSS setup has occured. The calculations in there that check if the combined argv + envp size will exceed the default stack size are not used in the rest of the stack setup. So, it should be safe to move this to the beginning of do_exec and bail early with -E2BIG, just like the man pages say. Additionally, advertise this limit in limits.h to be a good POSIX.1 citizen. :)
2019-10-20 16:11:40 +00:00
size_t total_blob_size = 0;
for (auto& a : arguments)
total_blob_size += a.length() + 1;
for (auto& e : environment)
total_blob_size += e.length() + 1;
size_t total_meta_size = sizeof(char*) * (arguments.size() + 1) + sizeof(char*) * (environment.size() + 1);
// FIXME: How much stack space does process startup need?
if ((total_blob_size + total_meta_size) >= Thread::default_userspace_stack_size)
return -E2BIG;
Implemented sys$execve(). It's really crufty, but it basically works!
2018-11-03 00:49:40 +00:00
auto parts = path.split('/');
Yet another pass of style fixes.
2018-12-21 01:10:45 +00:00
if (parts.is_empty())
Implemented sys$execve(). It's really crufty, but it basically works!
2018-11-03 00:49:40 +00:00
return -ENOENT;
Kernel: Use PrivateInodeVMObject for loading program executables This will be a memory usage pessimization until we actually implement CoW sharing of the memory pages with SharedInodeVMObject. However, it's a huge architectural improvement, so let's take it and improve on this incrementally. fork() should still be neutral, since all private mappings are CoW'ed.
2020-03-01 10:14:56 +00:00
auto& inode = interpreter_description ? *interpreter_description->inode() : *main_program_description->inode();
Kernel: Use SharedInodeVMObject for executables after all I had the wrong idea about this. Thanks to Sergey for pointing it out! Here's what he says (reproduced for posterity): > Private mappings protect the underlying file from the changes made by > you, not the other way around. To quote POSIX, "If MAP_PRIVATE is > specified, modifications to the mapped data by the calling process > shall be visible only to the calling process and shall not change the > underlying object. It is unspecified whether modifications to the > underlying object done after the MAP_PRIVATE mapping is established > are visible through the MAP_PRIVATE mapping." In practice that means > that the pages that were already paged in don't get updated when the > underlying file changes, and the pages that weren't paged in yet will > load the latest data at that moment. > The only thing MAP_FILE | MAP_PRIVATE is really useful for is mapping > a library and performing relocations; it's definitely useless (and > actively harmful for the system memory usage) if you only read from > the file. This effectively reverts e2697c2dddd531c0ac7cad3fd6ca78e81d0d86da.
2020-03-01 20:09:30 +00:00
auto vmobject = SharedInodeVMObject::create_with_inode(inode);
if (static_cast<const SharedInodeVMObject&>(*vmobject).writable_mappings()) {
dbg() << "Refusing to execute a write-mapped program";
return -ETXTBSY;
}
Kernel: Enforce W^X between sys$mmap() and sys$execve() It's now an error to sys$mmap() a file as writable if it's currently mapped executable by anyone else. It's also an error to sys$execve() a file that's currently mapped writable by anyone else. This fixes a race condition vulnerability where one program could make modifications to an executable while another process was in the kernel, in the middle of exec'ing the same executable. Test: Kernel/elf-execve-mmap-race.cpp
2020-01-18 22:31:29 +00:00
Kernel: Disable profiling during the critical section of sys$execve() Since we're gonna throw away these stacks at the end of exec anyway, we might as well disable profiling before starting to mess with the process page tables. One less weird situation to worry about in the sampling code.
2020-02-22 10:09:03 +00:00
// Disable profiling temporarily in case it's running on this process.
bool was_profiling = is_profiling();
TemporaryChange profiling_disabler(m_profiling, false);
Kernel: Allow process with multiple threads to call exec and exit This allows a process wich has more than 1 thread to call exec, even from a thread. This kills all the other threads, but it won't wait for them to finish, just makes sure that they are not in a running/runable state. In the case where a thread does exec, the new program PID will be the thread TID, to keep the PID == TID in the new process. This introduces a new function inside the Process class, kill_threads_except_self which is called on exit() too (exit with multiple threads wasn't properly working either). Inside the Lock class, there is the need for a new function, clear_waiters, which removes all the waiters from the Process::big_lock. This is needed since after a exit/exec, there should be no other threads waiting for this lock, the threads should be simply killed. Only queued threads should wait for this lock at this point, since blocked threads are handled in set_should_die.
2020-02-18 12:28:28 +00:00
// Mark this thread as the current thread that does exec
// No other thread from this process will be scheduled to run
m_exec_tid = Thread::current->tid();
Let PageDirectory have a PhysicalPage for the PDB instead of being the PDB. This is more efficient than using the wasteful kmalloc_aligned() approach to allocation. It also allows much tighter encapsulation of the class.
2018-12-31 13:58:03 +00:00
auto old_page_directory = move(m_page_directory);
Kernel: Simplify PageDirectory swapping in sys$execve() Swap out both the PageDirectory and the Region list at the same time, instead of doing the Region list slightly later.
2020-01-19 15:05:42 +00:00
auto old_regions = move(m_regions);
Kernel: Add mapping from page directory base (PDB) to PageDirectory This allows the page fault code to find the owning PageDirectory and corresponding process for faulting regions. The mapping is implemented as a global hash map right now, which is definitely not optimal. We can come up with something better when it becomes necessary.
2019-08-06 09:19:16 +00:00
m_page_directory = PageDirectory::create_for_userspace(*this);
Fix some paging related bugs exposed by the spawn stress test. - Process::exec() needs to restore the original paging scope when called on a non-current process. - Add missing InterruptDisabler guards around g_processes access. - Only flush the TLB when modifying the active page tables.
2018-11-09 00:25:31 +00:00
#ifdef MM_DEBUG
Process: Use dbg() instead of dbgprintf() Also, fix a bad derefernce in sys$create_shared_buffer() method.
2020-02-24 22:13:33 +00:00
dbg() << "Process " << pid() << " exec: PD=" << m_page_directory.ptr() << " created";
Fix some paging related bugs exposed by the spawn stress test. - Process::exec() needs to restore the original paging scope when called on a non-current process. - Add missing InterruptDisabler guards around g_processes access. - Only flush the TLB when modifying the active page tables.
2018-11-09 00:25:31 +00:00
#endif
Kernel: Make ProcessPagingScope restore CR3 properly Instead of restoring CR3 to the current process's paging scope when a ProcessPagingScope goes out of scope, we now restore exactly whatever the CR3 value was when we created the ProcessPagingScope. This fixes breakage in situations where a process ends up with nested ProcessPagingScopes. This was making profiling very fragile, and with this change it's now possible to profile g++! :^)
2020-01-19 12:44:53 +00:00
Kernel: Tighten up exec/do_exec and allow for PT_INTERP iterpreters This patch changes how exec() figures out which program image to actually load. Previously, we opened the path to our main executable in find_shebang_interpreter_for_executable, read the first page (or less, if the file was smaller) and then decided whether to recurse with the interpreter instead. We then then re-opened the main executable in do_exec. However, since we now want to parse the ELF header and Program Headers of an elf image before even doing any memory region work, we can change the way this whole process works. We open the file and read (up to) the first page in exec() itself, then pass just the page and the amount read to find_shebang_interpreter_for_executable. Since we now have that page and the FileDescription for the main executable handy, we can do a few things. First, validate the ELF header and ELF program headers for any shenanigans. ELF32 Little Endian i386 only, please. Second, we can grab the PT_INTERP interpreter from any ET_DYN files, and open that guy right away if it exists. Finally, we can pass the main executable's and optionally the PT_INTERP interpreter's file descriptions down to do_exec and not have to feel guilty about opening the file twice. In do_exec, we now have a choice. Are we going to load the main executable, or the interpreter? We could load both, but it'll be way easier for the inital pass on the RTLD if we only load the interpreter. Then it can load the main executable itself like any old shared object, just, the one with main in it :). Later on we can load both of them into memory and the RTLD can relocate itself before trying to do anything. The way it's written now the RTLD will get dibs on its requested virtual addresses being the actual virtual addresses.
2020-01-11 01:28:02 +00:00
InodeMetadata loader_metadata;
// FIXME: Hoooo boy this is a hack if I ever saw one.
// This is the 'random' offset we're giving to our ET_DYN exectuables to start as.
// It also happens to be the static Virtual Addresss offset every static exectuable gets :)
// Without this, some assumptions by the ELF loading hooks below are severely broken.
// 0x08000000 is a verified random number chosen by random dice roll https://xkcd.com/221/
u32 totally_random_offset = interpreter_description ? 0x08000000 : 0;
Kernel: Enforce W^X between sys$mmap() and sys$execve() It's now an error to sys$mmap() a file as writable if it's currently mapped executable by anyone else. It's also an error to sys$execve() a file that's currently mapped writable by anyone else. This fixes a race condition vulnerability where one program could make modifications to an executable while another process was in the kernel, in the middle of exec'ing the same executable. Test: Kernel/elf-execve-mmap-race.cpp
2020-01-18 22:31:29 +00:00
// FIXME: We should be able to load both the PT_INTERP interpreter and the main program... once the RTLD is smart enough
if (interpreter_description) {
loader_metadata = interpreter_description->metadata();
// we don't need the interpreter file desciption after we've loaded (or not) it into memory
interpreter_description = nullptr;
} else {
Kernel: Tighten up exec/do_exec and allow for PT_INTERP iterpreters This patch changes how exec() figures out which program image to actually load. Previously, we opened the path to our main executable in find_shebang_interpreter_for_executable, read the first page (or less, if the file was smaller) and then decided whether to recurse with the interpreter instead. We then then re-opened the main executable in do_exec. However, since we now want to parse the ELF header and Program Headers of an elf image before even doing any memory region work, we can change the way this whole process works. We open the file and read (up to) the first page in exec() itself, then pass just the page and the amount read to find_shebang_interpreter_for_executable. Since we now have that page and the FileDescription for the main executable handy, we can do a few things. First, validate the ELF header and ELF program headers for any shenanigans. ELF32 Little Endian i386 only, please. Second, we can grab the PT_INTERP interpreter from any ET_DYN files, and open that guy right away if it exists. Finally, we can pass the main executable's and optionally the PT_INTERP interpreter's file descriptions down to do_exec and not have to feel guilty about opening the file twice. In do_exec, we now have a choice. Are we going to load the main executable, or the interpreter? We could load both, but it'll be way easier for the inital pass on the RTLD if we only load the interpreter. Then it can load the main executable itself like any old shared object, just, the one with main in it :). Later on we can load both of them into memory and the RTLD can relocate itself before trying to do anything. The way it's written now the RTLD will get dibs on its requested virtual addresses being the actual virtual addresses.
2020-01-11 01:28:02 +00:00
loader_metadata = main_program_description->metadata();
Kernel: Enforce W^X between sys$mmap() and sys$execve() It's now an error to sys$mmap() a file as writable if it's currently mapped executable by anyone else. It's also an error to sys$execve() a file that's currently mapped writable by anyone else. This fixes a race condition vulnerability where one program could make modifications to an executable while another process was in the kernel, in the middle of exec'ing the same executable. Test: Kernel/elf-execve-mmap-race.cpp
2020-01-18 22:31:29 +00:00
}
Kernel: Tighten up exec/do_exec and allow for PT_INTERP iterpreters This patch changes how exec() figures out which program image to actually load. Previously, we opened the path to our main executable in find_shebang_interpreter_for_executable, read the first page (or less, if the file was smaller) and then decided whether to recurse with the interpreter instead. We then then re-opened the main executable in do_exec. However, since we now want to parse the ELF header and Program Headers of an elf image before even doing any memory region work, we can change the way this whole process works. We open the file and read (up to) the first page in exec() itself, then pass just the page and the amount read to find_shebang_interpreter_for_executable. Since we now have that page and the FileDescription for the main executable handy, we can do a few things. First, validate the ELF header and ELF program headers for any shenanigans. ELF32 Little Endian i386 only, please. Second, we can grab the PT_INTERP interpreter from any ET_DYN files, and open that guy right away if it exists. Finally, we can pass the main executable's and optionally the PT_INTERP interpreter's file descriptions down to do_exec and not have to feel guilty about opening the file twice. In do_exec, we now have a choice. Are we going to load the main executable, or the interpreter? We could load both, but it'll be way easier for the inital pass on the RTLD if we only load the interpreter. Then it can load the main executable itself like any old shared object, just, the one with main in it :). Later on we can load both of them into memory and the RTLD can relocate itself before trying to do anything. The way it's written now the RTLD will get dibs on its requested virtual addresses being the actual virtual addresses.
2020-01-11 01:28:02 +00:00
Kernel: Map executables at a kernel address during ELF load This is both simpler and more robust than mapping them in the process address space.
2020-03-02 09:42:53 +00:00
auto region = MM.allocate_kernel_region_with_vmobject(*vmobject, PAGE_ROUND_UP(loader_metadata.size), "ELF loading", Region::Access::Read);
if (!region)
return -ENOMEM;
Kernel: Make the "entire executable" region shared This makes Region::clone() do the right thing with it on fork().
2020-03-02 05:12:27 +00:00
Kernel: Make Region single-owner instead of ref-counted This simplifies the ownership model and makes Region easier to reason about. Userspace Regions are now primarily kept by Process::m_regions. Kernel Regions are kept in various OwnPtr<Regions>'s. Regions now only ever get unmapped when they are destroyed.
2019-09-27 12:19:07 +00:00
Region* master_tls_region { nullptr };
Kernel: Support thread-local storage This patch adds support for TLS according to the x86 System V ABI. Each thread gets a thread-specific memory region, and the GS segment register always points _to a pointer_ to the thread-specific memory. In other words, to access thread-local variables, userspace programs start by dereferencing the pointer at [gs:0]. The Process keeps a master copy of the TLS segment that new threads should use, and when a new thread is created, they get a copy of it. It's basically whatever the PT_TLS program header in the ELF says.
2019-09-07 13:50:44 +00:00
size_t master_tls_size = 0;
size_t master_tls_alignment = 0;
Kernel: Simplify PageDirectory swapping in sys$execve() Swap out both the PageDirectory and the Region list at the same time, instead of doing the Region list slightly later.
2020-01-19 15:05:42 +00:00
u32 entry_eip = 0;
Kernel: Support thread-local storage This patch adds support for TLS according to the x86 System V ABI. Each thread gets a thread-specific memory region, and the GS segment register always points _to a pointer_ to the thread-specific memory. In other words, to access thread-local variables, userspace programs start by dereferencing the pointer at [gs:0]. The Process keeps a master copy of the TLS segment that new threads should use, and when a new thread is created, they get a copy of it. It's basically whatever the PT_TLS program header in the ELF says.
2019-09-07 13:50:44 +00:00
Kernel: Map executables at a kernel address during ELF load This is both simpler and more robust than mapping them in the process address space.
2020-03-02 09:42:53 +00:00
MM.enter_process_paging_scope(*this);
LibELF: Move ELF classes into namespace ELF This is for consistency with other namespace changes that were made a while back to the other libraries :)
2020-04-11 18:24:07 +00:00
OwnPtr<ELF::Loader> loader;
Implemented sys$execve(). It's really crufty, but it basically works!
2018-11-03 00:49:40 +00:00
{
Kernel: Tighten up exec/do_exec and allow for PT_INTERP iterpreters This patch changes how exec() figures out which program image to actually load. Previously, we opened the path to our main executable in find_shebang_interpreter_for_executable, read the first page (or less, if the file was smaller) and then decided whether to recurse with the interpreter instead. We then then re-opened the main executable in do_exec. However, since we now want to parse the ELF header and Program Headers of an elf image before even doing any memory region work, we can change the way this whole process works. We open the file and read (up to) the first page in exec() itself, then pass just the page and the amount read to find_shebang_interpreter_for_executable. Since we now have that page and the FileDescription for the main executable handy, we can do a few things. First, validate the ELF header and ELF program headers for any shenanigans. ELF32 Little Endian i386 only, please. Second, we can grab the PT_INTERP interpreter from any ET_DYN files, and open that guy right away if it exists. Finally, we can pass the main executable's and optionally the PT_INTERP interpreter's file descriptions down to do_exec and not have to feel guilty about opening the file twice. In do_exec, we now have a choice. Are we going to load the main executable, or the interpreter? We could load both, but it'll be way easier for the inital pass on the RTLD if we only load the interpreter. Then it can load the main executable itself like any old shared object, just, the one with main in it :). Later on we can load both of them into memory and the RTLD can relocate itself before trying to do anything. The way it's written now the RTLD will get dibs on its requested virtual addresses being the actual virtual addresses.
2020-01-11 01:28:02 +00:00
ArmedScopeGuard rollback_regions_guard([&]() {
Kernel: Replace "current" with Thread::current and Process::current Suggested by Sergey. The currently running Thread and Process are now Thread::current and Process::current respectively. :^)
2020-02-17 14:04:27 +00:00
ASSERT(Process::current == this);
Kernel: Make ProcessPagingScope restore CR3 properly Instead of restoring CR3 to the current process's paging scope when a ProcessPagingScope goes out of scope, we now restore exactly whatever the CR3 value was when we created the ProcessPagingScope. This fixes breakage in situations where a process ends up with nested ProcessPagingScopes. This was making profiling very fragile, and with this change it's now possible to profile g++! :^)
2020-01-19 12:44:53 +00:00
m_page_directory = move(old_page_directory);
Kernel: Tighten up exec/do_exec and allow for PT_INTERP iterpreters This patch changes how exec() figures out which program image to actually load. Previously, we opened the path to our main executable in find_shebang_interpreter_for_executable, read the first page (or less, if the file was smaller) and then decided whether to recurse with the interpreter instead. We then then re-opened the main executable in do_exec. However, since we now want to parse the ELF header and Program Headers of an elf image before even doing any memory region work, we can change the way this whole process works. We open the file and read (up to) the first page in exec() itself, then pass just the page and the amount read to find_shebang_interpreter_for_executable. Since we now have that page and the FileDescription for the main executable handy, we can do a few things. First, validate the ELF header and ELF program headers for any shenanigans. ELF32 Little Endian i386 only, please. Second, we can grab the PT_INTERP interpreter from any ET_DYN files, and open that guy right away if it exists. Finally, we can pass the main executable's and optionally the PT_INTERP interpreter's file descriptions down to do_exec and not have to feel guilty about opening the file twice. In do_exec, we now have a choice. Are we going to load the main executable, or the interpreter? We could load both, but it'll be way easier for the inital pass on the RTLD if we only load the interpreter. Then it can load the main executable itself like any old shared object, just, the one with main in it :). Later on we can load both of them into memory and the RTLD can relocate itself before trying to do anything. The way it's written now the RTLD will get dibs on its requested virtual addresses being the actual virtual addresses.
2020-01-11 01:28:02 +00:00
m_regions = move(old_regions);
Kernel: Make ProcessPagingScope restore CR3 properly Instead of restoring CR3 to the current process's paging scope when a ProcessPagingScope goes out of scope, we now restore exactly whatever the CR3 value was when we created the ProcessPagingScope. This fixes breakage in situations where a process ends up with nested ProcessPagingScopes. This was making profiling very fragile, and with this change it's now possible to profile g++! :^)
2020-01-19 12:44:53 +00:00
MM.enter_process_paging_scope(*this);
Kernel: Tighten up exec/do_exec and allow for PT_INTERP iterpreters This patch changes how exec() figures out which program image to actually load. Previously, we opened the path to our main executable in find_shebang_interpreter_for_executable, read the first page (or less, if the file was smaller) and then decided whether to recurse with the interpreter instead. We then then re-opened the main executable in do_exec. However, since we now want to parse the ELF header and Program Headers of an elf image before even doing any memory region work, we can change the way this whole process works. We open the file and read (up to) the first page in exec() itself, then pass just the page and the amount read to find_shebang_interpreter_for_executable. Since we now have that page and the FileDescription for the main executable handy, we can do a few things. First, validate the ELF header and ELF program headers for any shenanigans. ELF32 Little Endian i386 only, please. Second, we can grab the PT_INTERP interpreter from any ET_DYN files, and open that guy right away if it exists. Finally, we can pass the main executable's and optionally the PT_INTERP interpreter's file descriptions down to do_exec and not have to feel guilty about opening the file twice. In do_exec, we now have a choice. Are we going to load the main executable, or the interpreter? We could load both, but it'll be way easier for the inital pass on the RTLD if we only load the interpreter. Then it can load the main executable itself like any old shared object, just, the one with main in it :). Later on we can load both of them into memory and the RTLD can relocate itself before trying to do anything. The way it's written now the RTLD will get dibs on its requested virtual addresses being the actual virtual addresses.
2020-01-11 01:28:02 +00:00
});
LibELF: Move ELF classes into namespace ELF This is for consistency with other namespace changes that were made a while back to the other libraries :)
2020-04-11 18:24:07 +00:00
loader = make<ELF::Loader>(region->vaddr().as_ptr(), loader_metadata.size);
Kernel: Tighten up exec/do_exec and allow for PT_INTERP iterpreters This patch changes how exec() figures out which program image to actually load. Previously, we opened the path to our main executable in find_shebang_interpreter_for_executable, read the first page (or less, if the file was smaller) and then decided whether to recurse with the interpreter instead. We then then re-opened the main executable in do_exec. However, since we now want to parse the ELF header and Program Headers of an elf image before even doing any memory region work, we can change the way this whole process works. We open the file and read (up to) the first page in exec() itself, then pass just the page and the amount read to find_shebang_interpreter_for_executable. Since we now have that page and the FileDescription for the main executable handy, we can do a few things. First, validate the ELF header and ELF program headers for any shenanigans. ELF32 Little Endian i386 only, please. Second, we can grab the PT_INTERP interpreter from any ET_DYN files, and open that guy right away if it exists. Finally, we can pass the main executable's and optionally the PT_INTERP interpreter's file descriptions down to do_exec and not have to feel guilty about opening the file twice. In do_exec, we now have a choice. Are we going to load the main executable, or the interpreter? We could load both, but it'll be way easier for the inital pass on the RTLD if we only load the interpreter. Then it can load the main executable itself like any old shared object, just, the one with main in it :). Later on we can load both of them into memory and the RTLD can relocate itself before trying to do anything. The way it's written now the RTLD will get dibs on its requested virtual addresses being the actual virtual addresses.
2020-01-11 01:28:02 +00:00
// Load the correct executable -- either interp or main program.
// FIXME: Once we actually load both interp and main, we'll need to be more clever about this.
// In that case, both will be ET_DYN objects, so they'll both be completely relocatable.
// That means, we can put them literally anywhere in User VM space (ASLR anyone?).
// ALSO FIXME: Reminder to really really fix that 'totally random offset' business.
ELF: Fail layout when program header hooks return nullptr (#673) ELFLoader::layout() had a "failed" variable that was never set. This patch checks the return value of each hook (alloc/map section and tls) and fails the load if they return null. I also needed to patch Process so that the alloc_section_hook and map_section_hook actually return nullptr when allocating a region fails. Fixes #664 :)
2019-10-20 14:24:42 +00:00
loader->map_section_hook = [&](VirtualAddress vaddr, size_t size, size_t alignment, size_t offset_in_image, bool is_readable, bool is_writable, bool is_executable, const String& name) -> u8* {
Teach Process::exec() about the magic of file-backed VMO's. This is really sweet! :^) The four instances of /bin/sh spawned at startup now share their read-only text pages. There are problems and limitations here, and plenty of room for improvement. But it kinda works.
2018-11-08 20:20:09 +00:00
ASSERT(size);
Fix all current build warnings in the kernel.
2018-11-09 09:03:21 +00:00
ASSERT(alignment == PAGE_SIZE);
Kernel: Make the Process allocate_region* API's understand "int prot". Instead of having to inspect 'prot' at every call site, make the Process API's take care of that so we can just pass it through.
2019-05-30 14:14:37 +00:00
int prot = 0;
if (is_readable)
prot |= PROT_READ;
if (is_writable)
prot |= PROT_WRITE;
if (is_executable)
prot |= PROT_EXEC;
Kernel: Mark read-only PT_LOAD mappings as shared regions This makes Region::clone() do the right thing for these now that we differentiate based on Region::is_shared().
2020-03-01 20:25:23 +00:00
if (auto* region = allocate_region_with_vmobject(vaddr.offset(totally_random_offset), size, *vmobject, offset_in_image, String(name), prot)) {
region->set_shared(true);
Kernel: Tighten up exec/do_exec and allow for PT_INTERP iterpreters This patch changes how exec() figures out which program image to actually load. Previously, we opened the path to our main executable in find_shebang_interpreter_for_executable, read the first page (or less, if the file was smaller) and then decided whether to recurse with the interpreter instead. We then then re-opened the main executable in do_exec. However, since we now want to parse the ELF header and Program Headers of an elf image before even doing any memory region work, we can change the way this whole process works. We open the file and read (up to) the first page in exec() itself, then pass just the page and the amount read to find_shebang_interpreter_for_executable. Since we now have that page and the FileDescription for the main executable handy, we can do a few things. First, validate the ELF header and ELF program headers for any shenanigans. ELF32 Little Endian i386 only, please. Second, we can grab the PT_INTERP interpreter from any ET_DYN files, and open that guy right away if it exists. Finally, we can pass the main executable's and optionally the PT_INTERP interpreter's file descriptions down to do_exec and not have to feel guilty about opening the file twice. In do_exec, we now have a choice. Are we going to load the main executable, or the interpreter? We could load both, but it'll be way easier for the inital pass on the RTLD if we only load the interpreter. Then it can load the main executable itself like any old shared object, just, the one with main in it :). Later on we can load both of them into memory and the RTLD can relocate itself before trying to do anything. The way it's written now the RTLD will get dibs on its requested virtual addresses being the actual virtual addresses.
2020-01-11 01:28:02 +00:00
return region->vaddr().as_ptr();
Kernel: Mark read-only PT_LOAD mappings as shared regions This makes Region::clone() do the right thing for these now that we differentiate based on Region::is_shared().
2020-03-01 20:25:23 +00:00
}
Kernel: Tighten up exec/do_exec and allow for PT_INTERP iterpreters This patch changes how exec() figures out which program image to actually load. Previously, we opened the path to our main executable in find_shebang_interpreter_for_executable, read the first page (or less, if the file was smaller) and then decided whether to recurse with the interpreter instead. We then then re-opened the main executable in do_exec. However, since we now want to parse the ELF header and Program Headers of an elf image before even doing any memory region work, we can change the way this whole process works. We open the file and read (up to) the first page in exec() itself, then pass just the page and the amount read to find_shebang_interpreter_for_executable. Since we now have that page and the FileDescription for the main executable handy, we can do a few things. First, validate the ELF header and ELF program headers for any shenanigans. ELF32 Little Endian i386 only, please. Second, we can grab the PT_INTERP interpreter from any ET_DYN files, and open that guy right away if it exists. Finally, we can pass the main executable's and optionally the PT_INTERP interpreter's file descriptions down to do_exec and not have to feel guilty about opening the file twice. In do_exec, we now have a choice. Are we going to load the main executable, or the interpreter? We could load both, but it'll be way easier for the inital pass on the RTLD if we only load the interpreter. Then it can load the main executable itself like any old shared object, just, the one with main in it :). Later on we can load both of them into memory and the RTLD can relocate itself before trying to do anything. The way it's written now the RTLD will get dibs on its requested virtual addresses being the actual virtual addresses.
2020-01-11 01:28:02 +00:00
return nullptr;
Teach Process::exec() about the magic of file-backed VMO's. This is really sweet! :^) The four instances of /bin/sh spawned at startup now share their read-only text pages. There are problems and limitations here, and plenty of room for improvement. But it kinda works.
2018-11-08 20:20:09 +00:00
};
ELF: Fail layout when program header hooks return nullptr (#673) ELFLoader::layout() had a "failed" variable that was never set. This patch checks the return value of each hook (alloc/map section and tls) and fails the load if they return null. I also needed to patch Process so that the alloc_section_hook and map_section_hook actually return nullptr when allocating a region fails. Fixes #664 :)
2019-10-20 14:24:42 +00:00
loader->alloc_section_hook = [&](VirtualAddress vaddr, size_t size, size_t alignment, bool is_readable, bool is_writable, const String& name) -> u8* {
Use ELF program headers to load executables smarter. This turned out way better than the old code. ELF loading is now quite straightforward, and we don't need the weird concept of subregions anymore. Next step is to respect the is_writable flag.
2018-11-03 10:28:23 +00:00
ASSERT(size);
Fix all current build warnings in the kernel.
2018-11-09 09:03:21 +00:00
ASSERT(alignment == PAGE_SIZE);
Kernel: Make the Process allocate_region* API's understand "int prot". Instead of having to inspect 'prot' at every call site, make the Process API's take care of that so we can just pass it through.
2019-05-30 14:14:37 +00:00
int prot = 0;
if (is_readable)
prot |= PROT_READ;
if (is_writable)
prot |= PROT_WRITE;
Kernel: Use Vector::unstable_remove() in a couple of places
2020-01-15 18:25:27 +00:00
if (auto* region = allocate_region(vaddr.offset(totally_random_offset), size, String(name), prot))
Kernel: Tighten up exec/do_exec and allow for PT_INTERP iterpreters This patch changes how exec() figures out which program image to actually load. Previously, we opened the path to our main executable in find_shebang_interpreter_for_executable, read the first page (or less, if the file was smaller) and then decided whether to recurse with the interpreter instead. We then then re-opened the main executable in do_exec. However, since we now want to parse the ELF header and Program Headers of an elf image before even doing any memory region work, we can change the way this whole process works. We open the file and read (up to) the first page in exec() itself, then pass just the page and the amount read to find_shebang_interpreter_for_executable. Since we now have that page and the FileDescription for the main executable handy, we can do a few things. First, validate the ELF header and ELF program headers for any shenanigans. ELF32 Little Endian i386 only, please. Second, we can grab the PT_INTERP interpreter from any ET_DYN files, and open that guy right away if it exists. Finally, we can pass the main executable's and optionally the PT_INTERP interpreter's file descriptions down to do_exec and not have to feel guilty about opening the file twice. In do_exec, we now have a choice. Are we going to load the main executable, or the interpreter? We could load both, but it'll be way easier for the inital pass on the RTLD if we only load the interpreter. Then it can load the main executable itself like any old shared object, just, the one with main in it :). Later on we can load both of them into memory and the RTLD can relocate itself before trying to do anything. The way it's written now the RTLD will get dibs on its requested virtual addresses being the actual virtual addresses.
2020-01-11 01:28:02 +00:00
return region->vaddr().as_ptr();
return nullptr;
Implemented sys$execve(). It's really crufty, but it basically works!
2018-11-03 00:49:40 +00:00
};
Kernel: Tighten up exec/do_exec and allow for PT_INTERP iterpreters This patch changes how exec() figures out which program image to actually load. Previously, we opened the path to our main executable in find_shebang_interpreter_for_executable, read the first page (or less, if the file was smaller) and then decided whether to recurse with the interpreter instead. We then then re-opened the main executable in do_exec. However, since we now want to parse the ELF header and Program Headers of an elf image before even doing any memory region work, we can change the way this whole process works. We open the file and read (up to) the first page in exec() itself, then pass just the page and the amount read to find_shebang_interpreter_for_executable. Since we now have that page and the FileDescription for the main executable handy, we can do a few things. First, validate the ELF header and ELF program headers for any shenanigans. ELF32 Little Endian i386 only, please. Second, we can grab the PT_INTERP interpreter from any ET_DYN files, and open that guy right away if it exists. Finally, we can pass the main executable's and optionally the PT_INTERP interpreter's file descriptions down to do_exec and not have to feel guilty about opening the file twice. In do_exec, we now have a choice. Are we going to load the main executable, or the interpreter? We could load both, but it'll be way easier for the inital pass on the RTLD if we only load the interpreter. Then it can load the main executable itself like any old shared object, just, the one with main in it :). Later on we can load both of them into memory and the RTLD can relocate itself before trying to do anything. The way it's written now the RTLD will get dibs on its requested virtual addresses being the actual virtual addresses.
2020-01-11 01:28:02 +00:00
// FIXME: Move TLS region allocation to userspace: LibC and the dynamic loader.
// LibC if we end up with a statically linked executable, and the
// dynamic loader so that it can create new TLS blocks for each shared libarary
// that gets loaded as part of DT_NEEDED processing, and via dlopen()
// If that doesn't happen quickly, at least pass the location of the TLS region
// some ELF Auxilliary Vector so the loader can use it/create new ones as necessary.
Kernel: Support thread-local storage This patch adds support for TLS according to the x86 System V ABI. Each thread gets a thread-specific memory region, and the GS segment register always points _to a pointer_ to the thread-specific memory. In other words, to access thread-local variables, userspace programs start by dereferencing the pointer at [gs:0]. The Process keeps a master copy of the TLS segment that new threads should use, and when a new thread is created, they get a copy of it. It's basically whatever the PT_TLS program header in the ELF says.
2019-09-07 13:50:44 +00:00
loader->tls_section_hook = [&](size_t size, size_t alignment) {
ASSERT(size);
master_tls_region = allocate_region({}, size, String(), PROT_READ | PROT_WRITE);
master_tls_size = size;
master_tls_alignment = alignment;
return master_tls_region->vaddr().as_ptr();
};
Kernel: Symbolicate userspace backtraces using ELFLoader. Stash away the ELFLoader used to load an executable in Process so we can use it for symbolicating userspace addresses later on. This will make debugging userspace programs a lot nicer. :^)
2019-05-16 15:18:25 +00:00
bool success = loader->load();
Kernel: Tighten up exec/do_exec and allow for PT_INTERP iterpreters This patch changes how exec() figures out which program image to actually load. Previously, we opened the path to our main executable in find_shebang_interpreter_for_executable, read the first page (or less, if the file was smaller) and then decided whether to recurse with the interpreter instead. We then then re-opened the main executable in do_exec. However, since we now want to parse the ELF header and Program Headers of an elf image before even doing any memory region work, we can change the way this whole process works. We open the file and read (up to) the first page in exec() itself, then pass just the page and the amount read to find_shebang_interpreter_for_executable. Since we now have that page and the FileDescription for the main executable handy, we can do a few things. First, validate the ELF header and ELF program headers for any shenanigans. ELF32 Little Endian i386 only, please. Second, we can grab the PT_INTERP interpreter from any ET_DYN files, and open that guy right away if it exists. Finally, we can pass the main executable's and optionally the PT_INTERP interpreter's file descriptions down to do_exec and not have to feel guilty about opening the file twice. In do_exec, we now have a choice. Are we going to load the main executable, or the interpreter? We could load both, but it'll be way easier for the inital pass on the RTLD if we only load the interpreter. Then it can load the main executable itself like any old shared object, just, the one with main in it :). Later on we can load both of them into memory and the RTLD can relocate itself before trying to do anything. The way it's written now the RTLD will get dibs on its requested virtual addresses being the actual virtual addresses.
2020-01-11 01:28:02 +00:00
if (!success) {
Kernel: Use klog() instead of kprintf() Also, duplicate data in dbg() and klog() calls were removed. In addition, leakage of virtual address to kernel log is prevented. This is done by replacing kprintf() calls to dbg() calls with the leaked data instead. Also, other kprintf() calls were replaced with klog().
2020-03-01 19:45:39 +00:00
klog() << "do_exec: Failure loading " << path.characters();
Implemented sys$execve(). It's really crufty, but it basically works!
2018-11-03 00:49:40 +00:00
return -ENOEXEC;
}
Kernel: Tighten up exec/do_exec and allow for PT_INTERP iterpreters This patch changes how exec() figures out which program image to actually load. Previously, we opened the path to our main executable in find_shebang_interpreter_for_executable, read the first page (or less, if the file was smaller) and then decided whether to recurse with the interpreter instead. We then then re-opened the main executable in do_exec. However, since we now want to parse the ELF header and Program Headers of an elf image before even doing any memory region work, we can change the way this whole process works. We open the file and read (up to) the first page in exec() itself, then pass just the page and the amount read to find_shebang_interpreter_for_executable. Since we now have that page and the FileDescription for the main executable handy, we can do a few things. First, validate the ELF header and ELF program headers for any shenanigans. ELF32 Little Endian i386 only, please. Second, we can grab the PT_INTERP interpreter from any ET_DYN files, and open that guy right away if it exists. Finally, we can pass the main executable's and optionally the PT_INTERP interpreter's file descriptions down to do_exec and not have to feel guilty about opening the file twice. In do_exec, we now have a choice. Are we going to load the main executable, or the interpreter? We could load both, but it'll be way easier for the inital pass on the RTLD if we only load the interpreter. Then it can load the main executable itself like any old shared object, just, the one with main in it :). Later on we can load both of them into memory and the RTLD can relocate itself before trying to do anything. The way it's written now the RTLD will get dibs on its requested virtual addresses being the actual virtual addresses.
2020-01-11 01:28:02 +00:00
// FIXME: Validate that this virtual address is within executable region,
// instead of just non-null. You could totally have a DSO with entry point of
// the beginning of the text segement.
if (!loader->entry().offset(totally_random_offset).get()) {
Kernel: Simplify a bunch of dbg() and klog() calls LogStream can handle VirtualAddress and PhysicalAddress directly.
2020-03-06 14:00:44 +00:00
klog() << "do_exec: Failure loading " << path.characters() << ", entry pointer is invalid! (" << loader->entry().offset(totally_random_offset) << ")";
Kernel: Tighten up exec/do_exec and allow for PT_INTERP iterpreters This patch changes how exec() figures out which program image to actually load. Previously, we opened the path to our main executable in find_shebang_interpreter_for_executable, read the first page (or less, if the file was smaller) and then decided whether to recurse with the interpreter instead. We then then re-opened the main executable in do_exec. However, since we now want to parse the ELF header and Program Headers of an elf image before even doing any memory region work, we can change the way this whole process works. We open the file and read (up to) the first page in exec() itself, then pass just the page and the amount read to find_shebang_interpreter_for_executable. Since we now have that page and the FileDescription for the main executable handy, we can do a few things. First, validate the ELF header and ELF program headers for any shenanigans. ELF32 Little Endian i386 only, please. Second, we can grab the PT_INTERP interpreter from any ET_DYN files, and open that guy right away if it exists. Finally, we can pass the main executable's and optionally the PT_INTERP interpreter's file descriptions down to do_exec and not have to feel guilty about opening the file twice. In do_exec, we now have a choice. Are we going to load the main executable, or the interpreter? We could load both, but it'll be way easier for the inital pass on the RTLD if we only load the interpreter. Then it can load the main executable itself like any old shared object, just, the one with main in it :). Later on we can load both of them into memory and the RTLD can relocate itself before trying to do anything. The way it's written now the RTLD will get dibs on its requested virtual addresses being the actual virtual addresses.
2020-01-11 01:28:02 +00:00
return -ENOEXEC;
}
rollback_regions_guard.disarm();
Implemented sys$execve(). It's really crufty, but it basically works!
2018-11-03 00:49:40 +00:00
Kernel: Do a bit more of do_exec() before disabling interrupts. We definitely need to replace m_executable before clearing interrupts, since otherwise we might call ~Custody() which would make it assert in locking. Also avoid calling FileDescriptor::metadata() repeatedly and just cache the result from the first call. I also added a comment at the point where we've decided to commit to the new executable and follow through with the swap.
2019-05-31 05:02:43 +00:00
// NOTE: At this point, we've committed to the new executable.
Kernel: Tighten up exec/do_exec and allow for PT_INTERP iterpreters This patch changes how exec() figures out which program image to actually load. Previously, we opened the path to our main executable in find_shebang_interpreter_for_executable, read the first page (or less, if the file was smaller) and then decided whether to recurse with the interpreter instead. We then then re-opened the main executable in do_exec. However, since we now want to parse the ELF header and Program Headers of an elf image before even doing any memory region work, we can change the way this whole process works. We open the file and read (up to) the first page in exec() itself, then pass just the page and the amount read to find_shebang_interpreter_for_executable. Since we now have that page and the FileDescription for the main executable handy, we can do a few things. First, validate the ELF header and ELF program headers for any shenanigans. ELF32 Little Endian i386 only, please. Second, we can grab the PT_INTERP interpreter from any ET_DYN files, and open that guy right away if it exists. Finally, we can pass the main executable's and optionally the PT_INTERP interpreter's file descriptions down to do_exec and not have to feel guilty about opening the file twice. In do_exec, we now have a choice. Are we going to load the main executable, or the interpreter? We could load both, but it'll be way easier for the inital pass on the RTLD if we only load the interpreter. Then it can load the main executable itself like any old shared object, just, the one with main in it :). Later on we can load both of them into memory and the RTLD can relocate itself before trying to do anything. The way it's written now the RTLD will get dibs on its requested virtual addresses being the actual virtual addresses.
2020-01-11 01:28:02 +00:00
entry_eip = loader->entry().offset(totally_random_offset).get();
Kernel+LibELF: Validate PT_LOAD and PT_TLS offsets before memcpy()'ing Before this, you could make the kernel copy memory from anywhere by setting up an ELF executable with a program header specifying file offsets outside the file. Since ELFImage didn't even know how large it was, we had no clue that we were copying things from outside the ELF. Fix this by adding a size field to ELFImage and validating program header ranges before memcpy()'ing to them. The ELF code is definitely going to need more validation and checking.
2020-01-06 20:04:57 +00:00
Kernel: Allow process with multiple threads to call exec and exit This allows a process wich has more than 1 thread to call exec, even from a thread. This kills all the other threads, but it won't wait for them to finish, just makes sure that they are not in a running/runable state. In the case where a thread does exec, the new program PID will be the thread TID, to keep the PID == TID in the new process. This introduces a new function inside the Process class, kill_threads_except_self which is called on exit() too (exit with multiple threads wasn't properly working either). Inside the Lock class, there is the need for a new function, clear_waiters, which removes all the waiters from the Process::big_lock. This is needed since after a exit/exec, there should be no other threads waiting for this lock, the threads should be simply killed. Only queued threads should wait for this lock at this point, since blocked threads are handled in set_should_die.
2020-02-18 12:28:28 +00:00
kill_threads_except_self();
Kernel+LibELF: Validate PT_LOAD and PT_TLS offsets before memcpy()'ing Before this, you could make the kernel copy memory from anywhere by setting up an ELF executable with a program header specifying file offsets outside the file. Since ELFImage didn't even know how large it was, we had no clue that we were copying things from outside the ELF. Fix this by adding a size field to ELFImage and validating program header ranges before memcpy()'ing to them. The ELF code is definitely going to need more validation and checking.
2020-01-06 20:04:57 +00:00
#ifdef EXEC_DEBUG
Kernel: Use klog() instead of kprintf() Also, duplicate data in dbg() and klog() calls were removed. In addition, leakage of virtual address to kernel log is prevented. This is done by replacing kprintf() calls to dbg() calls with the leaked data instead. Also, other kprintf() calls were replaced with klog().
2020-03-01 19:45:39 +00:00
klog() << "Memory layout after ELF load:";
Kernel+LibELF: Validate PT_LOAD and PT_TLS offsets before memcpy()'ing Before this, you could make the kernel copy memory from anywhere by setting up an ELF executable with a program header specifying file offsets outside the file. Since ELFImage didn't even know how large it was, we had no clue that we were copying things from outside the ELF. Fix this by adding a size field to ELFImage and validating program header ranges before memcpy()'ing to them. The ELF code is definitely going to need more validation and checking.
2020-01-06 20:04:57 +00:00
dump_regions();
#endif
Implemented sys$execve(). It's really crufty, but it basically works!
2018-11-03 00:49:40 +00:00
}
Kernel: Tighten up exec/do_exec and allow for PT_INTERP iterpreters This patch changes how exec() figures out which program image to actually load. Previously, we opened the path to our main executable in find_shebang_interpreter_for_executable, read the first page (or less, if the file was smaller) and then decided whether to recurse with the interpreter instead. We then then re-opened the main executable in do_exec. However, since we now want to parse the ELF header and Program Headers of an elf image before even doing any memory region work, we can change the way this whole process works. We open the file and read (up to) the first page in exec() itself, then pass just the page and the amount read to find_shebang_interpreter_for_executable. Since we now have that page and the FileDescription for the main executable handy, we can do a few things. First, validate the ELF header and ELF program headers for any shenanigans. ELF32 Little Endian i386 only, please. Second, we can grab the PT_INTERP interpreter from any ET_DYN files, and open that guy right away if it exists. Finally, we can pass the main executable's and optionally the PT_INTERP interpreter's file descriptions down to do_exec and not have to feel guilty about opening the file twice. In do_exec, we now have a choice. Are we going to load the main executable, or the interpreter? We could load both, but it'll be way easier for the inital pass on the RTLD if we only load the interpreter. Then it can load the main executable itself like any old shared object, just, the one with main in it :). Later on we can load both of them into memory and the RTLD can relocate itself before trying to do anything. The way it's written now the RTLD will get dibs on its requested virtual addresses being the actual virtual addresses.
2020-01-11 01:28:02 +00:00
m_executable = main_program_description->custody();
Kernel: Do a bit more of do_exec() before disabling interrupts. We definitely need to replace m_executable before clearing interrupts, since otherwise we might call ~Custody() which would make it assert in locking. Also avoid calling FileDescriptor::metadata() repeatedly and just cache the result from the first call. I also added a comment at the point where we've decided to commit to the new executable and follow through with the swap.
2019-05-31 05:02:43 +00:00
ping: Use pledge()
2020-01-11 19:48:43 +00:00
m_promises = m_execpromises;
Kernel: Rename UnveilState to VeilState
2020-01-21 18:28:29 +00:00
m_veil_state = VeilState::None;
Kernel: Clear unveiled state on exec()
2020-01-21 09:46:31 +00:00
m_unveiled_paths.clear();
Kernel: Support thread-local storage This patch adds support for TLS according to the x86 System V ABI. Each thread gets a thread-specific memory region, and the GS segment register always points _to a pointer_ to the thread-specific memory. In other words, to access thread-local variables, userspace programs start by dereferencing the pointer at [gs:0]. The Process keeps a master copy of the TLS segment that new threads should use, and when a new thread is created, they get a copy of it. It's basically whatever the PT_TLS program header in the ELF says.
2019-09-07 13:50:44 +00:00
// Copy of the master TLS region that we will clone for new threads
Kernel: Make Process::m_master_tls_region a WeakPtr Let's not keep raw Region* variables around like that when it's so easy to avoid it.
2020-02-28 13:04:49 +00:00
m_master_tls_region = master_tls_region->make_weak_ptr();
Kernel: Support thread-local storage This patch adds support for TLS according to the x86 System V ABI. Each thread gets a thread-specific memory region, and the GS segment register always points _to a pointer_ to the thread-specific memory. In other words, to access thread-local variables, userspace programs start by dereferencing the pointer at [gs:0]. The Process keeps a master copy of the TLS segment that new threads should use, and when a new thread is created, they get a copy of it. It's basically whatever the PT_TLS program header in the ELF says.
2019-09-07 13:50:44 +00:00
Kernel: Tighten up exec/do_exec and allow for PT_INTERP iterpreters This patch changes how exec() figures out which program image to actually load. Previously, we opened the path to our main executable in find_shebang_interpreter_for_executable, read the first page (or less, if the file was smaller) and then decided whether to recurse with the interpreter instead. We then then re-opened the main executable in do_exec. However, since we now want to parse the ELF header and Program Headers of an elf image before even doing any memory region work, we can change the way this whole process works. We open the file and read (up to) the first page in exec() itself, then pass just the page and the amount read to find_shebang_interpreter_for_executable. Since we now have that page and the FileDescription for the main executable handy, we can do a few things. First, validate the ELF header and ELF program headers for any shenanigans. ELF32 Little Endian i386 only, please. Second, we can grab the PT_INTERP interpreter from any ET_DYN files, and open that guy right away if it exists. Finally, we can pass the main executable's and optionally the PT_INTERP interpreter's file descriptions down to do_exec and not have to feel guilty about opening the file twice. In do_exec, we now have a choice. Are we going to load the main executable, or the interpreter? We could load both, but it'll be way easier for the inital pass on the RTLD if we only load the interpreter. Then it can load the main executable itself like any old shared object, just, the one with main in it :). Later on we can load both of them into memory and the RTLD can relocate itself before trying to do anything. The way it's written now the RTLD will get dibs on its requested virtual addresses being the actual virtual addresses.
2020-01-11 01:28:02 +00:00
auto main_program_metadata = main_program_description->metadata();
if (!(main_program_description->custody()->mount_flags() & MS_NOSUID)) {
if (main_program_metadata.is_setuid())
m_euid = main_program_metadata.uid;
if (main_program_metadata.is_setgid())
m_egid = main_program_metadata.gid;
Kernel+LibC: Implement a few mount flags We now support these mount flags: * MS_NODEV: disallow opening any devices from this file system * MS_NOEXEC: disallow executing any executables from this file system * MS_NOSUID: ignore set-user-id bits on executables from this file system The fourth flag, MS_BIND, is defined, but currently ignored.
2020-01-11 15:45:38 +00:00
}
Kernel: Symbolicate userspace backtraces using ELFLoader. Stash away the ELFLoader used to load an executable in Process so we can use it for symbolicating userspace addresses later on. This will make debugging userspace programs a lot nicer. :^)
2019-05-16 15:18:25 +00:00
Kernel: Replace "current" with Thread::current and Process::current Suggested by Sergey. The currently running Thread and Process are now Thread::current and Process::current respectively. :^)
2020-02-17 14:04:27 +00:00
Thread::current->set_default_signal_dispositions();
Thread::current->m_signal_mask = 0;
Thread::current->m_pending_signals = 0;
Some improvements to signals. - Add sigprocmask() and sigpending(). - Forked children inherit signal dispositions and masks. - Exec clears signal dispositions and masks.
2018-11-10 22:29:07 +00:00
Kernel: Drop futex queues/state on exec() This state is not meaningful to the new process image so just drop it.
2020-01-17 15:07:20 +00:00
m_futex_queues.clear();
Kernel: Clear the region lookup cache on exec() Each process has a 1-level lookup cache for fast repeated lookups of the same VM region (which tends to be the majority of lookups.) The cache is used by the following syscalls: munmap, madvise, mprotect and set_mmap_name. After a succesful exec(), there could be a stale Region* in the lookup cache, and the new executable was able to manipulate it using a number of use-after-free code paths.
2020-02-24 11:31:14 +00:00
m_region_lookup_cache = {};
Kernel: Disown shared buffers on sys$execve() When committing to a new executable, disown any shared buffers that the process was previously co-owning. Otherwise accessing the same shared buffer ID from the new program would cause the kernel to find a cached (and stale!) reference to the previous program's VM region corresponding to that shared buffer, leading to a Region* use-after-free. Fixes #1270.
2020-02-22 11:27:12 +00:00
disown_all_shared_buffers();
AK: Make Vector use size_t for its size and capacity
2020-02-25 13:49:47 +00:00
for (size_t i = 0; i < m_fds.size(); ++i) {
Add close-on-exec flag for file descriptors. I was surprised to find that dup()'ed fds don't share the close-on-exec flag. That means it has to be stored separately from the FileDescriptor object.
2018-11-13 00:36:31 +00:00
auto& daf = m_fds[i];
Kernel: Rename "descriptor" to "description" where appropriate. Now that FileDescription is called that, variables of that type should not be called "descriptor". This is kinda wordy but we'll get used to it.
2019-06-13 20:03:04 +00:00
if (daf.description && daf.flags & FD_CLOEXEC) {
daf.description->close();
Kernel: Run clang-format on everything.
2019-06-07 09:43:58 +00:00
daf = {};
Add close-on-exec flag for file descriptors. I was surprised to find that dup()'ed fds don't share the close-on-exec flag. That means it has to be stored separately from the FileDescriptor object.
2018-11-13 00:36:31 +00:00
}
}
Kernel: Get rid of "main thread" concept The idea of all processes reliably having a main thread was nice in some ways, but cumbersome in others. More importantly, it didn't match up with POSIX thread semantics, so let's move away from it. This thread gets rid of Process::main_thread() and you now we just have a bunch of Thread objects floating around each Process. When the finalizer nukes the last Thread in a Process, it will also tear down the Process. There's a bunch of more things to fix around this, but this is where we get started :^)
2019-12-22 10:35:02 +00:00
Thread* new_main_thread = nullptr;
Kernel: Replace "current" with Thread::current and Process::current Suggested by Sergey. The currently running Thread and Process are now Thread::current and Process::current respectively. :^)
2020-02-17 14:04:27 +00:00
if (Process::current == this) {
new_main_thread = Thread::current;
Kernel: Get rid of "main thread" concept The idea of all processes reliably having a main thread was nice in some ways, but cumbersome in others. More importantly, it didn't match up with POSIX thread semantics, so let's move away from it. This thread gets rid of Process::main_thread() and you now we just have a bunch of Thread objects floating around each Process. When the finalizer nukes the last Thread in a Process, it will also tear down the Process. There's a bunch of more things to fix around this, but this is where we get started :^)
2019-12-22 10:35:02 +00:00
} else {
for_each_thread([&](auto& thread) {
new_main_thread = &thread;
return IterationDecision::Break;
});
}
ASSERT(new_main_thread);
Kernel: Fix intermittent assertion failure in sys$exec() While setting up the main thread stack for a new process, we'd incur some zero-fill page faults. This was to be expected, since we allocate a huge stack but lazily populate it with physical pages. The problem is that page fault handlers may enable interrupts in order to grab a VMObject lock (or to page in from an inode.) During exec(), a process is reorganizing itself and will be in a very unrunnable state if the scheduler should interrupt it and then later ask it to run again. Which is exactly what happens if the process gets pre-empted while the new stack's zero-fill page fault grabs the lock. This patch fixes the issue by creating new main thread stacks before disabling interrupts and going into the critical part of exec().
2019-12-18 22:03:23 +00:00
// NOTE: We create the new stack before disabling interrupts since it will zero-fault
// and we don't want to deal with faults after this point.
Kernel: Get rid of "main thread" concept The idea of all processes reliably having a main thread was nice in some ways, but cumbersome in others. More importantly, it didn't match up with POSIX thread semantics, so let's move away from it. This thread gets rid of Process::main_thread() and you now we just have a bunch of Thread objects floating around each Process. When the finalizer nukes the last Thread in a Process, it will also tear down the Process. There's a bunch of more things to fix around this, but this is where we get started :^)
2019-12-22 10:35:02 +00:00
u32 new_userspace_esp = new_main_thread->make_userspace_stack_for_main_thread(move(arguments), move(environment));
Kernel: Fix intermittent assertion failure in sys$exec() While setting up the main thread stack for a new process, we'd incur some zero-fill page faults. This was to be expected, since we allocate a huge stack but lazily populate it with physical pages. The problem is that page fault handlers may enable interrupts in order to grab a VMObject lock (or to page in from an inode.) During exec(), a process is reorganizing itself and will be in a very unrunnable state if the scheduler should interrupt it and then later ask it to run again. Which is exactly what happens if the process gets pre-empted while the new stack's zero-fill page fault grabs the lock. This patch fixes the issue by creating new main thread stacks before disabling interrupts and going into the critical part of exec().
2019-12-18 22:03:23 +00:00
Fix race condition in exec(). ...also hook up sys$fstat in the syscall dispatcher.
2018-11-16 23:52:29 +00:00
// We cli() manually here because we don't want to get interrupted between do_exec() and Schedule::yield().
// The reason is that the task redirection we've set up above will be clobbered by the timer IRQ.
// If we used an InterruptDisabler that sti()'d on exit, we might timer tick'd too soon in exec().
Kernel: Replace "current" with Thread::current and Process::current Suggested by Sergey. The currently running Thread and Process are now Thread::current and Process::current respectively. :^)
2020-02-17 14:04:27 +00:00
if (Process::current == this)
Kernel: Various stability improvements. - Don't cli() in Process::do_exec() unless current is execing. Eventually this should go away once the scheduler is less retarded in the face of interrupts. - Improved memory access validation for ring0 processes. We now look at the kernel ELF header to determine if an access is appropriate. :^) It's very hackish but also kinda neat. - Have Process::die() put the process into a new "Dying" state where it can still get scheduled but no signals will be dispatched. This way we can keep executing in die() but won't get our EIP hijacked by signal dispatch. The main problem here was that die() wanted to take various locks.
2019-02-06 16:28:14 +00:00
cli();
Fix race condition in exec(). ...also hook up sys$fstat in the syscall dispatcher.
2018-11-16 23:52:29 +00:00
Kernel: Fix intermittent assertion failure in sys$exec() While setting up the main thread stack for a new process, we'd incur some zero-fill page faults. This was to be expected, since we allocate a huge stack but lazily populate it with physical pages. The problem is that page fault handlers may enable interrupts in order to grab a VMObject lock (or to page in from an inode.) During exec(), a process is reorganizing itself and will be in a very unrunnable state if the scheduler should interrupt it and then later ask it to run again. Which is exactly what happens if the process gets pre-empted while the new stack's zero-fill page fault grabs the lock. This patch fixes the issue by creating new main thread stacks before disabling interrupts and going into the critical part of exec().
2019-12-18 22:03:23 +00:00
// NOTE: Be careful to not trigger any page faults below!
Kernel: Get rid of "main thread" concept The idea of all processes reliably having a main thread was nice in some ways, but cumbersome in others. More importantly, it didn't match up with POSIX thread semantics, so let's move away from it. This thread gets rid of Process::main_thread() and you now we just have a bunch of Thread objects floating around each Process. When the finalizer nukes the last Thread in a Process, it will also tear down the Process. There's a bunch of more things to fix around this, but this is where we get started :^)
2019-12-22 10:35:02 +00:00
Scheduler::prepare_to_modify_tss(*new_main_thread);
Implemented sys$execve(). It's really crufty, but it basically works!
2018-11-03 00:49:40 +00:00
Coding style fixes in AK.
2019-01-19 21:53:05 +00:00
m_name = parts.take_last();
Kernel: Get rid of "main thread" concept The idea of all processes reliably having a main thread was nice in some ways, but cumbersome in others. More importantly, it didn't match up with POSIX thread semantics, so let's move away from it. This thread gets rid of Process::main_thread() and you now we just have a bunch of Thread objects floating around each Process. When the finalizer nukes the last Thread in a Process, it will also tear down the Process. There's a bunch of more things to fix around this, but this is where we get started :^)
2019-12-22 10:35:02 +00:00
new_main_thread->set_name(m_name);
auto& tss = new_main_thread->m_tss;
Implemented sys$execve(). It's really crufty, but it basically works!
2018-11-03 00:49:40 +00:00
Kernel: Get rid of "main thread" concept The idea of all processes reliably having a main thread was nice in some ways, but cumbersome in others. More importantly, it didn't match up with POSIX thread semantics, so let's move away from it. This thread gets rid of Process::main_thread() and you now we just have a bunch of Thread objects floating around each Process. When the finalizer nukes the last Thread in a Process, it will also tear down the Process. There's a bunch of more things to fix around this, but this is where we get started :^)
2019-12-22 10:35:02 +00:00
u32 old_esp0 = tss.esp0;
Kernel: Introduce threads, and refactor everything in support of it. The scheduler now operates on threads, rather than on processes. Each process has a main thread, and can have any number of additional threads. The process exits when the main thread exits. This patch doesn't actually spawn any additional threads, it merely does all the plumbing needed to make it possible. :^)
2019-03-23 21:03:17 +00:00
Kernel: Support thread-local storage This patch adds support for TLS according to the x86 System V ABI. Each thread gets a thread-specific memory region, and the GS segment register always points _to a pointer_ to the thread-specific memory. In other words, to access thread-local variables, userspace programs start by dereferencing the pointer at [gs:0]. The Process keeps a master copy of the TLS segment that new threads should use, and when a new thread is created, they get a copy of it. It's basically whatever the PT_TLS program header in the ELF says.
2019-09-07 13:50:44 +00:00
m_master_tls_size = master_tls_size;
m_master_tls_alignment = master_tls_alignment;
Kernel: Allow process with multiple threads to call exec and exit This allows a process wich has more than 1 thread to call exec, even from a thread. This kills all the other threads, but it won't wait for them to finish, just makes sure that they are not in a running/runable state. In the case where a thread does exec, the new program PID will be the thread TID, to keep the PID == TID in the new process. This introduces a new function inside the Process class, kill_threads_except_self which is called on exit() too (exit with multiple threads wasn't properly working either). Inside the Lock class, there is the need for a new function, clear_waiters, which removes all the waiters from the Process::big_lock. This is needed since after a exit/exec, there should be no other threads waiting for this lock, the threads should be simply killed. Only queued threads should wait for this lock at this point, since blocked threads are handled in set_should_die.
2020-02-18 12:28:28 +00:00
m_pid = new_main_thread->tid();
Kernel: Get rid of "main thread" concept The idea of all processes reliably having a main thread was nice in some ways, but cumbersome in others. More importantly, it didn't match up with POSIX thread semantics, so let's move away from it. This thread gets rid of Process::main_thread() and you now we just have a bunch of Thread objects floating around each Process. When the finalizer nukes the last Thread in a Process, it will also tear down the Process. There's a bunch of more things to fix around this, but this is where we get started :^)
2019-12-22 10:35:02 +00:00
new_main_thread->make_thread_specific_region({});
Kernel: Reset FPU state on exec()
2020-02-18 12:44:27 +00:00
new_main_thread->reset_fpu_state();
Kernel: Get rid of "main thread" concept The idea of all processes reliably having a main thread was nice in some ways, but cumbersome in others. More importantly, it didn't match up with POSIX thread semantics, so let's move away from it. This thread gets rid of Process::main_thread() and you now we just have a bunch of Thread objects floating around each Process. When the finalizer nukes the last Thread in a Process, it will also tear down the Process. There's a bunch of more things to fix around this, but this is where we get started :^)
2019-12-22 10:35:02 +00:00
memset(&tss, 0, sizeof(TSS32));
Kernel: Prevent executing I/O instructions in userspace All threads were running with iomapbase=0 in their TSS, which the CPU interprets as "there's an I/O permission bitmap starting at offset 0 into my TSS". Because of that, any bits that were 1 inside the TSS would allow the thread to execute I/O instructions on the port with that bit index. Fix this by always setting the iomapbase to sizeof(TSS32), and also setting the TSS descriptor's limit to sizeof(TSS32), effectively making the I/O permissions bitmap zero-length. This should make it no longer possible to do I/O from userspace. :^)
2020-01-01 16:26:25 +00:00
tss.iomapbase = sizeof(TSS32);
Kernel: Get rid of "main thread" concept The idea of all processes reliably having a main thread was nice in some ways, but cumbersome in others. More importantly, it didn't match up with POSIX thread semantics, so let's move away from it. This thread gets rid of Process::main_thread() and you now we just have a bunch of Thread objects floating around each Process. When the finalizer nukes the last Thread in a Process, it will also tear down the Process. There's a bunch of more things to fix around this, but this is where we get started :^)
2019-12-22 10:35:02 +00:00
tss.eflags = 0x0202;
tss.eip = entry_eip;
tss.cs = 0x1b;
tss.ds = 0x23;
tss.es = 0x23;
tss.fs = 0x23;
tss.gs = thread_specific_selector() | 3;
tss.ss = 0x23;
tss.cr3 = page_directory().cr3();
tss.esp = new_userspace_esp;
tss.ss0 = 0x10;
tss.esp0 = old_esp0;
tss.ss2 = m_pid;
Implemented sys$execve(). It's really crufty, but it basically works!
2018-11-03 00:49:40 +00:00
#ifdef TASK_DEBUG
Kernel: Use klog() instead of kprintf() Also, duplicate data in dbg() and klog() calls were removed. In addition, leakage of virtual address to kernel log is prevented. This is done by replacing kprintf() calls to dbg() calls with the leaked data instead. Also, other kprintf() calls were replaced with klog().
2020-03-01 19:45:39 +00:00
klog() << "Process exec'd " << path.characters() << " @ " << String::format("%p", tss.eip);
Implemented sys$execve(). It's really crufty, but it basically works!
2018-11-03 00:49:40 +00:00
#endif
Kernel: Disable profiling during the critical section of sys$execve() Since we're gonna throw away these stacks at the end of exec anyway, we might as well disable profiling before starting to mess with the process page tables. One less weird situation to worry about in the sampling code.
2020-02-22 10:09:03 +00:00
if (was_profiling)
Kernel: Reset profiling state on exec() (but keep it going) We now log the new executable on exec() and throw away all the samples we've accumulated so far. But profiling keeps going.
2020-02-22 09:54:50 +00:00
Profiling::did_exec(path);
Kernel: Get rid of "main thread" concept The idea of all processes reliably having a main thread was nice in some ways, but cumbersome in others. More importantly, it didn't match up with POSIX thread semantics, so let's move away from it. This thread gets rid of Process::main_thread() and you now we just have a bunch of Thread objects floating around each Process. When the finalizer nukes the last Thread in a Process, it will also tear down the Process. There's a bunch of more things to fix around this, but this is where we get started :^)
2019-12-22 10:35:02 +00:00
new_main_thread->set_state(Thread::State::Skip1SchedulerPass);
Kernel: Allow unlocking a held Lock with interrupts disabled This is needed to eliminate a race in Thread::wait_on() where we'd otherwise have to wait until after unlocking the process lock before we can disable interrupts.
2020-01-12 21:53:20 +00:00
big_lock().force_unlock_if_locked();
Okay, now *actually* plug the leaks in exec(). I didn't even put the { } properly around everything that would leak. Let's make sure this works correctly by splitting out the work into a helper called do_exec().
2018-11-09 16:59:14 +00:00
return 0;
}
Kernel: Tighten up exec/do_exec and allow for PT_INTERP iterpreters This patch changes how exec() figures out which program image to actually load. Previously, we opened the path to our main executable in find_shebang_interpreter_for_executable, read the first page (or less, if the file was smaller) and then decided whether to recurse with the interpreter instead. We then then re-opened the main executable in do_exec. However, since we now want to parse the ELF header and Program Headers of an elf image before even doing any memory region work, we can change the way this whole process works. We open the file and read (up to) the first page in exec() itself, then pass just the page and the amount read to find_shebang_interpreter_for_executable. Since we now have that page and the FileDescription for the main executable handy, we can do a few things. First, validate the ELF header and ELF program headers for any shenanigans. ELF32 Little Endian i386 only, please. Second, we can grab the PT_INTERP interpreter from any ET_DYN files, and open that guy right away if it exists. Finally, we can pass the main executable's and optionally the PT_INTERP interpreter's file descriptions down to do_exec and not have to feel guilty about opening the file twice. In do_exec, we now have a choice. Are we going to load the main executable, or the interpreter? We could load both, but it'll be way easier for the inital pass on the RTLD if we only load the interpreter. Then it can load the main executable itself like any old shared object, just, the one with main in it :). Later on we can load both of them into memory and the RTLD can relocate itself before trying to do anything. The way it's written now the RTLD will get dibs on its requested virtual addresses being the actual virtual addresses.
2020-01-11 01:28:02 +00:00
static KResultOr<Vector<String>> find_shebang_interpreter_for_executable(const char first_page[], int nread)
Kernel: Implement shebang executables ("#!/bin/sh") This patch makes it possible to *run* text files that start with the characters "#!" followed by an interpreter. I've tested this with both the Serenity built-in shell and the Bash shell, and it works as expected. :^)
2019-09-15 09:47:21 +00:00
{
Kernel: Support passing arguments in shebangged scripts Add the ability to both pass arguments to scripts with shebangs (./script argument1 argument2) and to specify them in the shebang line (#!/usr/local/bin/bash -x -e) Fixes #585
2019-10-27 09:42:07 +00:00
int word_start = 2;
int word_length = 0;
Kernel: Implement shebang executables ("#!/bin/sh") This patch makes it possible to *run* text files that start with the characters "#!" followed by an interpreter. I've tested this with both the Serenity built-in shell and the Bash shell, and it works as expected. :^)
2019-09-15 09:47:21 +00:00
if (nread > 2 && first_page[0] == '#' && first_page[1] == '!') {
Kernel: Support passing arguments in shebangged scripts Add the ability to both pass arguments to scripts with shebangs (./script argument1 argument2) and to specify them in the shebang line (#!/usr/local/bin/bash -x -e) Fixes #585
2019-10-27 09:42:07 +00:00
Vector<String> interpreter_words;
Kernel: Implement shebang executables ("#!/bin/sh") This patch makes it possible to *run* text files that start with the characters "#!" followed by an interpreter. I've tested this with both the Serenity built-in shell and the Bash shell, and it works as expected. :^)
2019-09-15 09:47:21 +00:00
for (int i = 2; i < nread; ++i) {
if (first_page[i] == '\n') {
break;
}
Kernel: Support passing arguments in shebangged scripts Add the ability to both pass arguments to scripts with shebangs (./script argument1 argument2) and to specify them in the shebang line (#!/usr/local/bin/bash -x -e) Fixes #585
2019-10-27 09:42:07 +00:00
if (first_page[i] != ' ') {
++word_length;
}
if (first_page[i] == ' ') {
if (word_length > 0) {
interpreter_words.append(String(&first_page[word_start], word_length));
}
word_length = 0;
word_start = i + 1;
}
Kernel: Implement shebang executables ("#!/bin/sh") This patch makes it possible to *run* text files that start with the characters "#!" followed by an interpreter. I've tested this with both the Serenity built-in shell and the Bash shell, and it works as expected. :^)
2019-09-15 09:47:21 +00:00
}
Kernel: Support passing arguments in shebangged scripts Add the ability to both pass arguments to scripts with shebangs (./script argument1 argument2) and to specify them in the shebang line (#!/usr/local/bin/bash -x -e) Fixes #585
2019-10-27 09:42:07 +00:00
if (word_length > 0)
interpreter_words.append(String(&first_page[word_start], word_length));
if (!interpreter_words.is_empty())
return interpreter_words;
Kernel: Implement shebang executables ("#!/bin/sh") This patch makes it possible to *run* text files that start with the characters "#!" followed by an interpreter. I've tested this with both the Serenity built-in shell and the Bash shell, and it works as expected. :^)
2019-09-15 09:47:21 +00:00
}
return KResult(-ENOEXEC);
}
Kernel: Tighten up exec/do_exec and allow for PT_INTERP iterpreters This patch changes how exec() figures out which program image to actually load. Previously, we opened the path to our main executable in find_shebang_interpreter_for_executable, read the first page (or less, if the file was smaller) and then decided whether to recurse with the interpreter instead. We then then re-opened the main executable in do_exec. However, since we now want to parse the ELF header and Program Headers of an elf image before even doing any memory region work, we can change the way this whole process works. We open the file and read (up to) the first page in exec() itself, then pass just the page and the amount read to find_shebang_interpreter_for_executable. Since we now have that page and the FileDescription for the main executable handy, we can do a few things. First, validate the ELF header and ELF program headers for any shenanigans. ELF32 Little Endian i386 only, please. Second, we can grab the PT_INTERP interpreter from any ET_DYN files, and open that guy right away if it exists. Finally, we can pass the main executable's and optionally the PT_INTERP interpreter's file descriptions down to do_exec and not have to feel guilty about opening the file twice. In do_exec, we now have a choice. Are we going to load the main executable, or the interpreter? We could load both, but it'll be way easier for the inital pass on the RTLD if we only load the interpreter. Then it can load the main executable itself like any old shared object, just, the one with main in it :). Later on we can load both of them into memory and the RTLD can relocate itself before trying to do anything. The way it's written now the RTLD will get dibs on its requested virtual addresses being the actual virtual addresses.
2020-01-11 01:28:02 +00:00
KResultOr<NonnullRefPtr<FileDescription>> Process::find_elf_interpreter_for_executable(const String& path, char (&first_page)[PAGE_SIZE], int nread, size_t file_size)
{
if (nread < (int)sizeof(Elf32_Ehdr))
return KResult(-ENOEXEC);
auto elf_header = (Elf32_Ehdr*)first_page;
LibELF: Move validation methods to their own file These validate_elf_* methods really had no business being static methods of ELF::Image. Now that the ELF namespace exists, it makes sense to just move them to be free functions in the namespace.
2020-04-11 18:32:38 +00:00
if (!ELF::validate_elf_header(*elf_header, file_size)) {
Kernel: Simplify some dbg() logging We don't have to log the process name/PID/TID, dbg() automatically adds that as a prefix to every line. Also we don't have to do .characters() on Strings passed to dbg() :^)
2020-02-29 11:51:44 +00:00
dbg() << "exec(" << path << "): File has invalid ELF header";
Kernel: Tighten up exec/do_exec and allow for PT_INTERP iterpreters This patch changes how exec() figures out which program image to actually load. Previously, we opened the path to our main executable in find_shebang_interpreter_for_executable, read the first page (or less, if the file was smaller) and then decided whether to recurse with the interpreter instead. We then then re-opened the main executable in do_exec. However, since we now want to parse the ELF header and Program Headers of an elf image before even doing any memory region work, we can change the way this whole process works. We open the file and read (up to) the first page in exec() itself, then pass just the page and the amount read to find_shebang_interpreter_for_executable. Since we now have that page and the FileDescription for the main executable handy, we can do a few things. First, validate the ELF header and ELF program headers for any shenanigans. ELF32 Little Endian i386 only, please. Second, we can grab the PT_INTERP interpreter from any ET_DYN files, and open that guy right away if it exists. Finally, we can pass the main executable's and optionally the PT_INTERP interpreter's file descriptions down to do_exec and not have to feel guilty about opening the file twice. In do_exec, we now have a choice. Are we going to load the main executable, or the interpreter? We could load both, but it'll be way easier for the inital pass on the RTLD if we only load the interpreter. Then it can load the main executable itself like any old shared object, just, the one with main in it :). Later on we can load both of them into memory and the RTLD can relocate itself before trying to do anything. The way it's written now the RTLD will get dibs on its requested virtual addresses being the actual virtual addresses.
2020-01-11 01:28:02 +00:00
return KResult(-ENOEXEC);
}
// Not using KResultOr here because we'll want to do the same thing in userspace in the RTLD
String interpreter_path;
LibELF: Move validation methods to their own file These validate_elf_* methods really had no business being static methods of ELF::Image. Now that the ELF namespace exists, it makes sense to just move them to be free functions in the namespace.
2020-04-11 18:32:38 +00:00
if (!ELF::validate_program_headers(*elf_header, file_size, (u8*)first_page, nread, interpreter_path)) {
Kernel: Simplify some dbg() logging We don't have to log the process name/PID/TID, dbg() automatically adds that as a prefix to every line. Also we don't have to do .characters() on Strings passed to dbg() :^)
2020-02-29 11:51:44 +00:00
dbg() << "exec(" << path << "): File has invalid ELF Program headers";
Kernel: Tighten up exec/do_exec and allow for PT_INTERP iterpreters This patch changes how exec() figures out which program image to actually load. Previously, we opened the path to our main executable in find_shebang_interpreter_for_executable, read the first page (or less, if the file was smaller) and then decided whether to recurse with the interpreter instead. We then then re-opened the main executable in do_exec. However, since we now want to parse the ELF header and Program Headers of an elf image before even doing any memory region work, we can change the way this whole process works. We open the file and read (up to) the first page in exec() itself, then pass just the page and the amount read to find_shebang_interpreter_for_executable. Since we now have that page and the FileDescription for the main executable handy, we can do a few things. First, validate the ELF header and ELF program headers for any shenanigans. ELF32 Little Endian i386 only, please. Second, we can grab the PT_INTERP interpreter from any ET_DYN files, and open that guy right away if it exists. Finally, we can pass the main executable's and optionally the PT_INTERP interpreter's file descriptions down to do_exec and not have to feel guilty about opening the file twice. In do_exec, we now have a choice. Are we going to load the main executable, or the interpreter? We could load both, but it'll be way easier for the inital pass on the RTLD if we only load the interpreter. Then it can load the main executable itself like any old shared object, just, the one with main in it :). Later on we can load both of them into memory and the RTLD can relocate itself before trying to do anything. The way it's written now the RTLD will get dibs on its requested virtual addresses being the actual virtual addresses.
2020-01-11 01:28:02 +00:00
return KResult(-ENOEXEC);
}
if (!interpreter_path.is_empty()) {
// Programs with an interpreter better be relocatable executables or we don't know what to do...
if (elf_header->e_type != ET_DYN)
return KResult(-ENOEXEC);
Kernel: Simplify some dbg() logging We don't have to log the process name/PID/TID, dbg() automatically adds that as a prefix to every line. Also we don't have to do .characters() on Strings passed to dbg() :^)
2020-02-29 11:51:44 +00:00
dbg() << "exec(" << path << "): Using program interpreter " << interpreter_path;
Kernel: Tighten up exec/do_exec and allow for PT_INTERP iterpreters This patch changes how exec() figures out which program image to actually load. Previously, we opened the path to our main executable in find_shebang_interpreter_for_executable, read the first page (or less, if the file was smaller) and then decided whether to recurse with the interpreter instead. We then then re-opened the main executable in do_exec. However, since we now want to parse the ELF header and Program Headers of an elf image before even doing any memory region work, we can change the way this whole process works. We open the file and read (up to) the first page in exec() itself, then pass just the page and the amount read to find_shebang_interpreter_for_executable. Since we now have that page and the FileDescription for the main executable handy, we can do a few things. First, validate the ELF header and ELF program headers for any shenanigans. ELF32 Little Endian i386 only, please. Second, we can grab the PT_INTERP interpreter from any ET_DYN files, and open that guy right away if it exists. Finally, we can pass the main executable's and optionally the PT_INTERP interpreter's file descriptions down to do_exec and not have to feel guilty about opening the file twice. In do_exec, we now have a choice. Are we going to load the main executable, or the interpreter? We could load both, but it'll be way easier for the inital pass on the RTLD if we only load the interpreter. Then it can load the main executable itself like any old shared object, just, the one with main in it :). Later on we can load both of them into memory and the RTLD can relocate itself before trying to do anything. The way it's written now the RTLD will get dibs on its requested virtual addresses being the actual virtual addresses.
2020-01-11 01:28:02 +00:00
auto interp_result = VFS::the().open(interpreter_path, O_EXEC, 0, current_directory());
if (interp_result.is_error()) {
Kernel: Simplify some dbg() logging We don't have to log the process name/PID/TID, dbg() automatically adds that as a prefix to every line. Also we don't have to do .characters() on Strings passed to dbg() :^)
2020-02-29 11:51:44 +00:00
dbg() << "exec(" << path << "): Unable to open program interpreter " << interpreter_path;
Kernel: Tighten up exec/do_exec and allow for PT_INTERP iterpreters This patch changes how exec() figures out which program image to actually load. Previously, we opened the path to our main executable in find_shebang_interpreter_for_executable, read the first page (or less, if the file was smaller) and then decided whether to recurse with the interpreter instead. We then then re-opened the main executable in do_exec. However, since we now want to parse the ELF header and Program Headers of an elf image before even doing any memory region work, we can change the way this whole process works. We open the file and read (up to) the first page in exec() itself, then pass just the page and the amount read to find_shebang_interpreter_for_executable. Since we now have that page and the FileDescription for the main executable handy, we can do a few things. First, validate the ELF header and ELF program headers for any shenanigans. ELF32 Little Endian i386 only, please. Second, we can grab the PT_INTERP interpreter from any ET_DYN files, and open that guy right away if it exists. Finally, we can pass the main executable's and optionally the PT_INTERP interpreter's file descriptions down to do_exec and not have to feel guilty about opening the file twice. In do_exec, we now have a choice. Are we going to load the main executable, or the interpreter? We could load both, but it'll be way easier for the inital pass on the RTLD if we only load the interpreter. Then it can load the main executable itself like any old shared object, just, the one with main in it :). Later on we can load both of them into memory and the RTLD can relocate itself before trying to do anything. The way it's written now the RTLD will get dibs on its requested virtual addresses being the actual virtual addresses.
2020-01-11 01:28:02 +00:00
return interp_result.error();
}
auto interpreter_description = interp_result.value();
auto interp_metadata = interpreter_description->metadata();
ASSERT(interpreter_description->inode());
// Validate the program interpreter as a valid elf binary.
// If your program interpreter is a #! file or something, it's time to stop playing games :)
if (interp_metadata.size < (int)sizeof(Elf32_Ehdr))
return KResult(-ENOEXEC);
memset(first_page, 0, sizeof(first_page));
nread = interpreter_description->read((u8*)&first_page, sizeof(first_page));
if (nread < (int)sizeof(Elf32_Ehdr))
return KResult(-ENOEXEC);
elf_header = (Elf32_Ehdr*)first_page;
LibELF: Move validation methods to their own file These validate_elf_* methods really had no business being static methods of ELF::Image. Now that the ELF namespace exists, it makes sense to just move them to be free functions in the namespace.
2020-04-11 18:32:38 +00:00
if (!ELF::validate_elf_header(*elf_header, interp_metadata.size)) {
Kernel: Simplify some dbg() logging We don't have to log the process name/PID/TID, dbg() automatically adds that as a prefix to every line. Also we don't have to do .characters() on Strings passed to dbg() :^)
2020-02-29 11:51:44 +00:00
dbg() << "exec(" << path << "): Interpreter (" << interpreter_description->absolute_path() << ") has invalid ELF header";
Kernel: Tighten up exec/do_exec and allow for PT_INTERP iterpreters This patch changes how exec() figures out which program image to actually load. Previously, we opened the path to our main executable in find_shebang_interpreter_for_executable, read the first page (or less, if the file was smaller) and then decided whether to recurse with the interpreter instead. We then then re-opened the main executable in do_exec. However, since we now want to parse the ELF header and Program Headers of an elf image before even doing any memory region work, we can change the way this whole process works. We open the file and read (up to) the first page in exec() itself, then pass just the page and the amount read to find_shebang_interpreter_for_executable. Since we now have that page and the FileDescription for the main executable handy, we can do a few things. First, validate the ELF header and ELF program headers for any shenanigans. ELF32 Little Endian i386 only, please. Second, we can grab the PT_INTERP interpreter from any ET_DYN files, and open that guy right away if it exists. Finally, we can pass the main executable's and optionally the PT_INTERP interpreter's file descriptions down to do_exec and not have to feel guilty about opening the file twice. In do_exec, we now have a choice. Are we going to load the main executable, or the interpreter? We could load both, but it'll be way easier for the inital pass on the RTLD if we only load the interpreter. Then it can load the main executable itself like any old shared object, just, the one with main in it :). Later on we can load both of them into memory and the RTLD can relocate itself before trying to do anything. The way it's written now the RTLD will get dibs on its requested virtual addresses being the actual virtual addresses.
2020-01-11 01:28:02 +00:00
return KResult(-ENOEXEC);
}
// Not using KResultOr here because we'll want to do the same thing in userspace in the RTLD
String interpreter_interpreter_path;
LibELF: Move validation methods to their own file These validate_elf_* methods really had no business being static methods of ELF::Image. Now that the ELF namespace exists, it makes sense to just move them to be free functions in the namespace.
2020-04-11 18:32:38 +00:00
if (!ELF::validate_program_headers(*elf_header, interp_metadata.size, (u8*)first_page, nread, interpreter_interpreter_path)) {
Kernel: Simplify some dbg() logging We don't have to log the process name/PID/TID, dbg() automatically adds that as a prefix to every line. Also we don't have to do .characters() on Strings passed to dbg() :^)
2020-02-29 11:51:44 +00:00
dbg() << "exec(" << path << "): Interpreter (" << interpreter_description->absolute_path() << ") has invalid ELF Program headers";
Kernel: Tighten up exec/do_exec and allow for PT_INTERP iterpreters This patch changes how exec() figures out which program image to actually load. Previously, we opened the path to our main executable in find_shebang_interpreter_for_executable, read the first page (or less, if the file was smaller) and then decided whether to recurse with the interpreter instead. We then then re-opened the main executable in do_exec. However, since we now want to parse the ELF header and Program Headers of an elf image before even doing any memory region work, we can change the way this whole process works. We open the file and read (up to) the first page in exec() itself, then pass just the page and the amount read to find_shebang_interpreter_for_executable. Since we now have that page and the FileDescription for the main executable handy, we can do a few things. First, validate the ELF header and ELF program headers for any shenanigans. ELF32 Little Endian i386 only, please. Second, we can grab the PT_INTERP interpreter from any ET_DYN files, and open that guy right away if it exists. Finally, we can pass the main executable's and optionally the PT_INTERP interpreter's file descriptions down to do_exec and not have to feel guilty about opening the file twice. In do_exec, we now have a choice. Are we going to load the main executable, or the interpreter? We could load both, but it'll be way easier for the inital pass on the RTLD if we only load the interpreter. Then it can load the main executable itself like any old shared object, just, the one with main in it :). Later on we can load both of them into memory and the RTLD can relocate itself before trying to do anything. The way it's written now the RTLD will get dibs on its requested virtual addresses being the actual virtual addresses.
2020-01-11 01:28:02 +00:00
return KResult(-ENOEXEC);
}
if (!interpreter_interpreter_path.is_empty()) {
Kernel: Simplify some dbg() logging We don't have to log the process name/PID/TID, dbg() automatically adds that as a prefix to every line. Also we don't have to do .characters() on Strings passed to dbg() :^)
2020-02-29 11:51:44 +00:00
dbg() << "exec(" << path << "): Interpreter (" << interpreter_description->absolute_path() << ") has its own interpreter (" << interpreter_interpreter_path << ")! No thank you!";
Kernel: Tighten up exec/do_exec and allow for PT_INTERP iterpreters This patch changes how exec() figures out which program image to actually load. Previously, we opened the path to our main executable in find_shebang_interpreter_for_executable, read the first page (or less, if the file was smaller) and then decided whether to recurse with the interpreter instead. We then then re-opened the main executable in do_exec. However, since we now want to parse the ELF header and Program Headers of an elf image before even doing any memory region work, we can change the way this whole process works. We open the file and read (up to) the first page in exec() itself, then pass just the page and the amount read to find_shebang_interpreter_for_executable. Since we now have that page and the FileDescription for the main executable handy, we can do a few things. First, validate the ELF header and ELF program headers for any shenanigans. ELF32 Little Endian i386 only, please. Second, we can grab the PT_INTERP interpreter from any ET_DYN files, and open that guy right away if it exists. Finally, we can pass the main executable's and optionally the PT_INTERP interpreter's file descriptions down to do_exec and not have to feel guilty about opening the file twice. In do_exec, we now have a choice. Are we going to load the main executable, or the interpreter? We could load both, but it'll be way easier for the inital pass on the RTLD if we only load the interpreter. Then it can load the main executable itself like any old shared object, just, the one with main in it :). Later on we can load both of them into memory and the RTLD can relocate itself before trying to do anything. The way it's written now the RTLD will get dibs on its requested virtual addresses being the actual virtual addresses.
2020-01-11 01:28:02 +00:00
return KResult(-ELOOP);
}
return interpreter_description;
}
if (elf_header->e_type != ET_EXEC) {
// We can't exec an ET_REL, that's just an object file from the compiler
// If it's ET_DYN with no PT_INTERP, then we can't load it properly either
return KResult(-ENOEXEC);
}
// No interpreter, but, path refers to a valid elf image
return KResult(KSuccess);
}
int Process::exec(String path, Vector<String> arguments, Vector<String> environment, int recursion_depth)
Okay, now *actually* plug the leaks in exec(). I didn't even put the { } properly around everything that would leak. Let's make sure this works correctly by splitting out the work into a helper called do_exec().
2018-11-09 16:59:14 +00:00
{
Kernel: Tighten up exec/do_exec and allow for PT_INTERP iterpreters This patch changes how exec() figures out which program image to actually load. Previously, we opened the path to our main executable in find_shebang_interpreter_for_executable, read the first page (or less, if the file was smaller) and then decided whether to recurse with the interpreter instead. We then then re-opened the main executable in do_exec. However, since we now want to parse the ELF header and Program Headers of an elf image before even doing any memory region work, we can change the way this whole process works. We open the file and read (up to) the first page in exec() itself, then pass just the page and the amount read to find_shebang_interpreter_for_executable. Since we now have that page and the FileDescription for the main executable handy, we can do a few things. First, validate the ELF header and ELF program headers for any shenanigans. ELF32 Little Endian i386 only, please. Second, we can grab the PT_INTERP interpreter from any ET_DYN files, and open that guy right away if it exists. Finally, we can pass the main executable's and optionally the PT_INTERP interpreter's file descriptions down to do_exec and not have to feel guilty about opening the file twice. In do_exec, we now have a choice. Are we going to load the main executable, or the interpreter? We could load both, but it'll be way easier for the inital pass on the RTLD if we only load the interpreter. Then it can load the main executable itself like any old shared object, just, the one with main in it :). Later on we can load both of them into memory and the RTLD can relocate itself before trying to do anything. The way it's written now the RTLD will get dibs on its requested virtual addresses being the actual virtual addresses.
2020-01-11 01:28:02 +00:00
if (recursion_depth > 2) {
Kernel: Simplify some dbg() logging We don't have to log the process name/PID/TID, dbg() automatically adds that as a prefix to every line. Also we don't have to do .characters() on Strings passed to dbg() :^)
2020-02-29 11:51:44 +00:00
dbg() << "exec(" << path << "): SHENANIGANS! recursed too far trying to find #! interpreter";
Kernel: Tighten up exec/do_exec and allow for PT_INTERP iterpreters This patch changes how exec() figures out which program image to actually load. Previously, we opened the path to our main executable in find_shebang_interpreter_for_executable, read the first page (or less, if the file was smaller) and then decided whether to recurse with the interpreter instead. We then then re-opened the main executable in do_exec. However, since we now want to parse the ELF header and Program Headers of an elf image before even doing any memory region work, we can change the way this whole process works. We open the file and read (up to) the first page in exec() itself, then pass just the page and the amount read to find_shebang_interpreter_for_executable. Since we now have that page and the FileDescription for the main executable handy, we can do a few things. First, validate the ELF header and ELF program headers for any shenanigans. ELF32 Little Endian i386 only, please. Second, we can grab the PT_INTERP interpreter from any ET_DYN files, and open that guy right away if it exists. Finally, we can pass the main executable's and optionally the PT_INTERP interpreter's file descriptions down to do_exec and not have to feel guilty about opening the file twice. In do_exec, we now have a choice. Are we going to load the main executable, or the interpreter? We could load both, but it'll be way easier for the inital pass on the RTLD if we only load the interpreter. Then it can load the main executable itself like any old shared object, just, the one with main in it :). Later on we can load both of them into memory and the RTLD can relocate itself before trying to do anything. The way it's written now the RTLD will get dibs on its requested virtual addresses being the actual virtual addresses.
2020-01-11 01:28:02 +00:00
return -ELOOP;
}
// Open the file to check what kind of binary format it is
// Currently supported formats:
// - #! interpreted file
// - ELF32
// * ET_EXEC binary that just gets loaded
// * ET_DYN binary that requires a program interpreter
//
auto result = VFS::the().open(path, O_EXEC, 0, current_directory());
if (result.is_error())
return result.error();
auto description = result.value();
auto metadata = description->metadata();
// Always gonna need at least 3 bytes. these are for #!X
if (metadata.size < 3)
return -ENOEXEC;
ASSERT(description->inode());
// Read the first page of the program into memory so we can validate the binfmt of it
char first_page[PAGE_SIZE];
int nread = description->read((u8*)&first_page, sizeof(first_page));
// 1) #! interpreted file
auto shebang_result = find_shebang_interpreter_for_executable(first_page, nread);
if (!shebang_result.is_error()) {
Vector<String> new_arguments(shebang_result.value());
Kernel: Support passing arguments in shebangged scripts Add the ability to both pass arguments to scripts with shebangs (./script argument1 argument2) and to specify them in the shebang line (#!/usr/local/bin/bash -x -e) Fixes #585
2019-10-27 09:42:07 +00:00
new_arguments.append(path);
arguments.remove(0);
new_arguments.append(move(arguments));
Kernel: Tighten up exec/do_exec and allow for PT_INTERP iterpreters This patch changes how exec() figures out which program image to actually load. Previously, we opened the path to our main executable in find_shebang_interpreter_for_executable, read the first page (or less, if the file was smaller) and then decided whether to recurse with the interpreter instead. We then then re-opened the main executable in do_exec. However, since we now want to parse the ELF header and Program Headers of an elf image before even doing any memory region work, we can change the way this whole process works. We open the file and read (up to) the first page in exec() itself, then pass just the page and the amount read to find_shebang_interpreter_for_executable. Since we now have that page and the FileDescription for the main executable handy, we can do a few things. First, validate the ELF header and ELF program headers for any shenanigans. ELF32 Little Endian i386 only, please. Second, we can grab the PT_INTERP interpreter from any ET_DYN files, and open that guy right away if it exists. Finally, we can pass the main executable's and optionally the PT_INTERP interpreter's file descriptions down to do_exec and not have to feel guilty about opening the file twice. In do_exec, we now have a choice. Are we going to load the main executable, or the interpreter? We could load both, but it'll be way easier for the inital pass on the RTLD if we only load the interpreter. Then it can load the main executable itself like any old shared object, just, the one with main in it :). Later on we can load both of them into memory and the RTLD can relocate itself before trying to do anything. The way it's written now the RTLD will get dibs on its requested virtual addresses being the actual virtual addresses.
2020-01-11 01:28:02 +00:00
return exec(shebang_result.value().first(), move(new_arguments), move(environment), ++recursion_depth);
Kernel: Support passing arguments in shebangged scripts Add the ability to both pass arguments to scripts with shebangs (./script argument1 argument2) and to specify them in the shebang line (#!/usr/local/bin/bash -x -e) Fixes #585
2019-10-27 09:42:07 +00:00
}
Kernel: Implement shebang executables ("#!/bin/sh") This patch makes it possible to *run* text files that start with the characters "#!" followed by an interpreter. I've tested this with both the Serenity built-in shell and the Bash shell, and it works as expected. :^)
2019-09-15 09:47:21 +00:00
Kernel: Tighten up exec/do_exec and allow for PT_INTERP iterpreters This patch changes how exec() figures out which program image to actually load. Previously, we opened the path to our main executable in find_shebang_interpreter_for_executable, read the first page (or less, if the file was smaller) and then decided whether to recurse with the interpreter instead. We then then re-opened the main executable in do_exec. However, since we now want to parse the ELF header and Program Headers of an elf image before even doing any memory region work, we can change the way this whole process works. We open the file and read (up to) the first page in exec() itself, then pass just the page and the amount read to find_shebang_interpreter_for_executable. Since we now have that page and the FileDescription for the main executable handy, we can do a few things. First, validate the ELF header and ELF program headers for any shenanigans. ELF32 Little Endian i386 only, please. Second, we can grab the PT_INTERP interpreter from any ET_DYN files, and open that guy right away if it exists. Finally, we can pass the main executable's and optionally the PT_INTERP interpreter's file descriptions down to do_exec and not have to feel guilty about opening the file twice. In do_exec, we now have a choice. Are we going to load the main executable, or the interpreter? We could load both, but it'll be way easier for the inital pass on the RTLD if we only load the interpreter. Then it can load the main executable itself like any old shared object, just, the one with main in it :). Later on we can load both of them into memory and the RTLD can relocate itself before trying to do anything. The way it's written now the RTLD will get dibs on its requested virtual addresses being the actual virtual addresses.
2020-01-11 01:28:02 +00:00
// #2) ELF32 for i386
auto elf_result = find_elf_interpreter_for_executable(path, first_page, nread, metadata.size);
RefPtr<FileDescription> interpreter_description;
// We're getting either an interpreter, an error, or KSuccess (i.e. no interpreter but file checks out)
if (!elf_result.is_error())
interpreter_description = elf_result.value();
else if (elf_result.error().is_error())
return elf_result.error();
Okay, now *actually* plug the leaks in exec(). I didn't even put the { } properly around everything that would leak. Let's make sure this works correctly by splitting out the work into a helper called do_exec().
2018-11-09 16:59:14 +00:00
// The bulk of exec() is done by do_exec(), which ensures that all locals
// are cleaned up by the time we yield-teleport below.
Kernel: Tighten up exec/do_exec and allow for PT_INTERP iterpreters This patch changes how exec() figures out which program image to actually load. Previously, we opened the path to our main executable in find_shebang_interpreter_for_executable, read the first page (or less, if the file was smaller) and then decided whether to recurse with the interpreter instead. We then then re-opened the main executable in do_exec. However, since we now want to parse the ELF header and Program Headers of an elf image before even doing any memory region work, we can change the way this whole process works. We open the file and read (up to) the first page in exec() itself, then pass just the page and the amount read to find_shebang_interpreter_for_executable. Since we now have that page and the FileDescription for the main executable handy, we can do a few things. First, validate the ELF header and ELF program headers for any shenanigans. ELF32 Little Endian i386 only, please. Second, we can grab the PT_INTERP interpreter from any ET_DYN files, and open that guy right away if it exists. Finally, we can pass the main executable's and optionally the PT_INTERP interpreter's file descriptions down to do_exec and not have to feel guilty about opening the file twice. In do_exec, we now have a choice. Are we going to load the main executable, or the interpreter? We could load both, but it'll be way easier for the inital pass on the RTLD if we only load the interpreter. Then it can load the main executable itself like any old shared object, just, the one with main in it :). Later on we can load both of them into memory and the RTLD can relocate itself before trying to do anything. The way it's written now the RTLD will get dibs on its requested virtual addresses being the actual virtual addresses.
2020-01-11 01:28:02 +00:00
int rc = do_exec(move(description), move(arguments), move(environment), move(interpreter_description));
Kernel: Allow process with multiple threads to call exec and exit This allows a process wich has more than 1 thread to call exec, even from a thread. This kills all the other threads, but it won't wait for them to finish, just makes sure that they are not in a running/runable state. In the case where a thread does exec, the new program PID will be the thread TID, to keep the PID == TID in the new process. This introduces a new function inside the Process class, kill_threads_except_self which is called on exit() too (exit with multiple threads wasn't properly working either). Inside the Lock class, there is the need for a new function, clear_waiters, which removes all the waiters from the Process::big_lock. This is needed since after a exit/exec, there should be no other threads waiting for this lock, the threads should be simply killed. Only queued threads should wait for this lock at this point, since blocked threads are handled in set_should_die.
2020-02-18 12:28:28 +00:00
m_exec_tid = 0;
Okay, now *actually* plug the leaks in exec(). I didn't even put the { } properly around everything that would leak. Let's make sure this works correctly by splitting out the work into a helper called do_exec().
2018-11-09 16:59:14 +00:00
if (rc < 0)
return rc;
Finally unbreak the colonel process and make it the true idle process.
2018-11-07 22:13:38 +00:00
ptrace: Stop a traced thread when it exists from execve This was a missing feature in the PT_TRACEME command. This feature allows the tracer to interact with the tracee before the tracee has started executing its program. It will be useful for automatically inserting a breakpoint at a debugged program's entry point.
2020-04-06 13:08:25 +00:00
if (m_wait_for_tracer_at_next_execve) {
ASSERT(Thread::current->state() == Thread::State::Skip1SchedulerPass);
// State::Skip1SchedulerPass is irrelevant since we block the thread
Thread::current->set_state(Thread::State::Running);
Thread::current->send_urgent_signal_to_self(SIGSTOP);
}
Kernel: Replace "current" with Thread::current and Process::current Suggested by Sergey. The currently running Thread and Process are now Thread::current and Process::current respectively. :^)
2020-02-17 14:04:27 +00:00
if (Process::current == this) {
Fix some paging related bugs exposed by the spawn stress test. - Process::exec() needs to restore the original paging scope when called on a non-current process. - Add missing InterruptDisabler guards around g_processes access. - Only flush the TLB when modifying the active page tables.
2018-11-09 00:25:31 +00:00
Scheduler::yield();
Fix VMO leak in Process::exec(). Gotta make sure things get cleaned up before we yield-teleport in exec(). Also VMOs and regions are now viewable through /proc/mm and /proc/regions.
2018-11-08 21:24:02 +00:00
ASSERT_NOT_REACHED();
Finally unbreak the colonel process and make it the true idle process.
2018-11-07 22:13:38 +00:00
}
Implemented sys$execve(). It's really crufty, but it basically works!
2018-11-03 00:49:40 +00:00
return 0;
}
Kernel: Enable SMAP protection during the execve() syscall The userspace execve() wrapper now measures all the strings and puts them in a neat and tidy structure on the stack. This way we know exactly how much to copy in the kernel, and we don't have to use the SMAP-violating validate_read_str(). :^)
2020-01-10 11:20:36 +00:00
int Process::sys$execve(const Syscall::SC_execve_params* user_params)
Factor out the "non-syscall" parts of sys$execve() into exec(). ..to prepare for sharing code with createUserProcess().
2018-11-03 09:20:23 +00:00
{
ping: Use pledge()
2020-01-11 19:48:43 +00:00
REQUIRE_PROMISE(exec);
Kernel: Allow process with multiple threads to call exec and exit This allows a process wich has more than 1 thread to call exec, even from a thread. This kills all the other threads, but it won't wait for them to finish, just makes sure that they are not in a running/runable state. In the case where a thread does exec, the new program PID will be the thread TID, to keep the PID == TID in the new process. This introduces a new function inside the Process class, kill_threads_except_self which is called on exit() too (exit with multiple threads wasn't properly working either). Inside the Lock class, there is the need for a new function, clear_waiters, which removes all the waiters from the Process::big_lock. This is needed since after a exit/exec, there should be no other threads waiting for this lock, the threads should be simply killed. Only queued threads should wait for this lock at this point, since blocked threads are handled in set_should_die.
2020-02-18 12:28:28 +00:00
Kernel: Fix String leaks in exec(). When the kernel performs a successful exec(), whatever was on the kernel stack for that process before goes away. For this reason, we need to make sure we don't have any stack objects holding onto kmalloc memory.
2019-02-17 09:18:25 +00:00
// NOTE: Be extremely careful with allocating any kernel memory in exec().
// On success, the kernel stack will be lost.
Kernel: Enable SMAP protection during the execve() syscall The userspace execve() wrapper now measures all the strings and puts them in a neat and tidy structure on the stack. This way we know exactly how much to copy in the kernel, and we don't have to use the SMAP-violating validate_read_str(). :^)
2020-01-10 11:20:36 +00:00
Syscall::SC_execve_params params;
Kernel: Combine validate and copy of user mode pointers (#1069) Right now there is a significant amount of boiler plate code required to validate user mode parameters in syscalls. In an attempt to reduce this a bit, introduce validate_read_and_copy_typed which combines the usermode address check and does the copy internally if the validation passes. This cleans up a little bit of code from a significant amount of syscalls.
2020-01-13 10:19:18 +00:00
if (!validate_read_and_copy_typed(&params, user_params))
Kernel: Enable SMAP protection during the execve() syscall The userspace execve() wrapper now measures all the strings and puts them in a neat and tidy structure on the stack. This way we know exactly how much to copy in the kernel, and we don't have to use the SMAP-violating validate_read_str(). :^)
2020-01-10 11:20:36 +00:00
return -EFAULT;
if (params.arguments.length > ARG_MAX || params.environment.length > ARG_MAX)
return -E2BIG;
Kernel: Add 'ptrace' syscall This commit adds a basic implementation of the ptrace syscall, which allows one process (the tracer) to control another process (the tracee). While a process is being traced, it is stopped whenever a signal is received (other than SIGCONT). The tracer can start tracing another thread with PT_ATTACH, which causes the tracee to stop. From there, the tracer can use PT_CONTINUE to continue the execution of the tracee, or use other request codes (which haven't been implemented yet) to modify the state of the tracee. Additional request codes are PT_SYSCALL, which causes the tracee to continue exection but stop at the next entry or exit from a syscall, and PT_GETREGS which fethces the last saved register set of the tracee (can be used to inspect syscall arguments and return value). A special request code is PT_TRACE_ME, which is issued by the tracee and causes it to stop when it calls execve and wait for the tracer to attach.
2020-03-28 08:47:16 +00:00
if (m_wait_for_tracer_at_next_execve)
Thread::current->send_urgent_signal_to_self(SIGSTOP);
Kernel: Use get_syscall_path_argument() in sys$execve() Paths passed to sys$execve() should certainly be subject to all the usual path validation checks.
2020-01-18 10:43:28 +00:00
String path;
{
auto path_arg = get_syscall_path_argument(params.path);
if (path_arg.is_error())
return path_arg.error();
path = path_arg.value();
}
Kernel: Enable SMAP protection during the execve() syscall The userspace execve() wrapper now measures all the strings and puts them in a neat and tidy structure on the stack. This way we know exactly how much to copy in the kernel, and we don't have to use the SMAP-violating validate_read_str(). :^)
2020-01-10 11:20:36 +00:00
auto copy_user_strings = [&](const auto& list, auto& output) {
if (!list.length)
return true;
if (!validate_read_typed(list.strings, list.length))
return false;
Kernel: Rename Syscall::SyscallString => Syscall::StringArgument
2020-01-10 19:15:58 +00:00
Vector<Syscall::StringArgument, 32> strings;
Kernel: Enable SMAP protection during the execve() syscall The userspace execve() wrapper now measures all the strings and puts them in a neat and tidy structure on the stack. This way we know exactly how much to copy in the kernel, and we don't have to use the SMAP-violating validate_read_str(). :^)
2020-01-10 11:20:36 +00:00
strings.resize(list.length);
Kernel: Rename Syscall::SyscallString => Syscall::StringArgument
2020-01-10 19:15:58 +00:00
copy_from_user(strings.data(), list.strings, list.length * sizeof(Syscall::StringArgument));
Kernel: Enable SMAP protection during the execve() syscall The userspace execve() wrapper now measures all the strings and puts them in a neat and tidy structure on the stack. This way we know exactly how much to copy in the kernel, and we don't have to use the SMAP-violating validate_read_str(). :^)
2020-01-10 11:20:36 +00:00
for (size_t i = 0; i < list.length; ++i) {
Kernel: Allow empty strings in validate_and_copy_string_from_user() Sergey pointed out that we should just allow empty strings everywhere.
2020-01-25 13:14:11 +00:00
auto string = validate_and_copy_string_from_user(strings[i]);
if (string.is_null())
Kernel: Enable SMAP protection during the execve() syscall The userspace execve() wrapper now measures all the strings and puts them in a neat and tidy structure on the stack. This way we know exactly how much to copy in the kernel, and we don't have to use the SMAP-violating validate_read_str(). :^)
2020-01-10 11:20:36 +00:00
return false;
Kernel: Allow empty strings in validate_and_copy_string_from_user() Sergey pointed out that we should just allow empty strings everywhere.
2020-01-25 13:14:11 +00:00
output.append(move(string));
Factor out the "non-syscall" parts of sys$execve() into exec(). ..to prepare for sharing code with createUserProcess().
2018-11-03 09:20:23 +00:00
}
Kernel: Enable SMAP protection during the execve() syscall The userspace execve() wrapper now measures all the strings and puts them in a neat and tidy structure on the stack. This way we know exactly how much to copy in the kernel, and we don't have to use the SMAP-violating validate_read_str(). :^)
2020-01-10 11:20:36 +00:00
return true;
};
Factor out the "non-syscall" parts of sys$execve() into exec(). ..to prepare for sharing code with createUserProcess().
2018-11-03 09:20:23 +00:00
Vector<String> arguments;
Kernel: Enable SMAP protection during the execve() syscall The userspace execve() wrapper now measures all the strings and puts them in a neat and tidy structure on the stack. This way we know exactly how much to copy in the kernel, and we don't have to use the SMAP-violating validate_read_str(). :^)
2020-01-10 11:20:36 +00:00
if (!copy_user_strings(params.arguments, arguments))
return -EFAULT;
Kernel: Fix String leaks in exec(). When the kernel performs a successful exec(), whatever was on the kernel stack for that process before goes away. For this reason, we need to make sure we don't have any stack objects holding onto kmalloc memory.
2019-02-17 09:18:25 +00:00
Vector<String> environment;
Kernel: Enable SMAP protection during the execve() syscall The userspace execve() wrapper now measures all the strings and puts them in a neat and tidy structure on the stack. This way we know exactly how much to copy in the kernel, and we don't have to use the SMAP-violating validate_read_str(). :^)
2020-01-10 11:20:36 +00:00
if (!copy_user_strings(params.environment, environment))
return -EFAULT;
Factor out the "non-syscall" parts of sys$execve() into exec(). ..to prepare for sharing code with createUserProcess().
2018-11-03 09:20:23 +00:00
Kernel: Fix String leaks in exec(). When the kernel performs a successful exec(), whatever was on the kernel stack for that process before goes away. For this reason, we need to make sure we don't have any stack objects holding onto kmalloc memory.
2019-02-17 09:18:25 +00:00
int rc = exec(move(path), move(arguments), move(environment));
Finally unbreak the colonel process and make it the true idle process.
2018-11-07 22:13:38 +00:00
ASSERT(rc < 0); // We should never continue after a successful exec!
Share code between spawn() and exec() implementations. Okay, now there's only one ELF loading client in the process launch code.
2018-11-03 09:49:13 +00:00
return rc;
Factor out the "non-syscall" parts of sys$execve() into exec(). ..to prepare for sharing code with createUserProcess().
2018-11-03 09:20:23 +00:00
}
Kernel: Get rid of "main thread" concept The idea of all processes reliably having a main thread was nice in some ways, but cumbersome in others. More importantly, it didn't match up with POSIX thread semantics, so let's move away from it. This thread gets rid of Process::main_thread() and you now we just have a bunch of Thread objects floating around each Process. When the finalizer nukes the last Thread in a Process, it will also tear down the Process. There's a bunch of more things to fix around this, but this is where we get started :^)
2019-12-22 10:35:02 +00:00
Process* Process::create_user_process(Thread*& first_thread, const String& path, uid_t uid, gid_t gid, pid_t parent_pid, int& error, Vector<String>&& arguments, Vector<String>&& environment, TTY* tty)
Launching an arbitrary ELF executable from disk works! :^) This is so cool! It's a bit messy now with two Task constructors, but eventually they should fold into a single constructor somehow.
2018-10-22 13:42:39 +00:00
{
auto parts = path.split('/');
Yet another pass of style fixes.
2018-12-21 01:10:45 +00:00
if (arguments.is_empty()) {
Share code between spawn() and exec() implementations. Okay, now there's only one ELF loading client in the process launch code.
2018-11-03 09:49:13 +00:00
arguments.append(parts.last());
Implement errno in LibC. This also meant I had to implement BSS (SHT_NOBITS) sections in ELFLoader. I also added an strerror() so we can print out what the errors are.
2018-10-25 10:06:00 +00:00
}
AK: Rename RetainPtr => RefPtr and Retained => NonnullRefPtr.
2019-06-21 16:37:47 +00:00
RefPtr<Custody> cwd;
Kernel: Add a basic chroot() syscall :^) The chroot() syscall now allows the superuser to isolate a process into a specific subtree of the filesystem. This is not strictly permanent, as it is also possible for a superuser to break *out* of a chroot, but it is a useful mechanism for isolating unprivileged processes. The VFS now uses the current process's root_directory() as the root for path resolution purposes. The root directory is stored as an uncached Custody in the Process object.
2020-01-10 22:14:04 +00:00
RefPtr<Custody> root;
Implement sys$chdir() and teach sh+ls to cd around and browse different dirs.
2018-10-26 12:24:11 +00:00
{
InterruptDisabler disabler;
Kernel: Add a basic chroot() syscall :^) The chroot() syscall now allows the superuser to isolate a process into a specific subtree of the filesystem. This is not strictly permanent, as it is also possible for a superuser to break *out* of a chroot, but it is a useful mechanism for isolating unprivileged processes. The VFS now uses the current process's root_directory() as the root for path resolution purposes. The root directory is stored as an uncached Custody in the Process object.
2020-01-10 22:14:04 +00:00
if (auto* parent = Process::from_pid(parent_pid)) {
Kernel: Remove use of copy_ref() in favor of regular RefPtr copies. This is obviously more readable. If we ever run into a situation where ref count churn is actually causing trouble in the future, we can deal with it then. For now, let's keep it simple. :^)
2019-07-11 13:38:47 +00:00
cwd = parent->m_cwd;
Kernel: Add a basic chroot() syscall :^) The chroot() syscall now allows the superuser to isolate a process into a specific subtree of the filesystem. This is not strictly permanent, as it is also possible for a superuser to break *out* of a chroot, but it is a useful mechanism for isolating unprivileged processes. The VFS now uses the current process's root_directory() as the root for path resolution purposes. The root directory is stored as an uncached Custody in the Process object.
2020-01-10 22:14:04 +00:00
root = parent->m_root_directory;
}
Add some basic field width support to printf(). Use it to make "ls" output a bit better. Also sys$spawn now fails with EACCES if the path is not a file that's executable by the current uid/gid.
2018-10-27 14:43:03 +00:00
}
Get rid of Vnode concept. We already have an abstraction between Process and Inode/CharacterDevice/FIFO and it's called FileDescriptor. :^)
2019-01-16 11:57:07 +00:00
Share code between spawn() and exec() implementations. Okay, now there's only one ELF loading client in the process launch code.
2018-11-03 09:49:13 +00:00
if (!cwd)
FileSystem: Port most of the code over to using custodies. The current working directory is now stored as a custody. Likewise for a process executable file. This unbreaks /proc/PID/fd which has not been working since we made the filesystem bigger. This still needs a bunch of work, for instance when renaming or removing a file somewhere, we have to update the relevant custody links.
2019-05-30 16:58:59 +00:00
cwd = VFS::the().root_custody();
Add some basic field width support to printf(). Use it to make "ls" output a bit better. Also sys$spawn now fails with EACCES if the path is not a file that's executable by the current uid/gid.
2018-10-27 14:43:03 +00:00
Kernel: Add a basic chroot() syscall :^) The chroot() syscall now allows the superuser to isolate a process into a specific subtree of the filesystem. This is not strictly permanent, as it is also possible for a superuser to break *out* of a chroot, but it is a useful mechanism for isolating unprivileged processes. The VFS now uses the current process's root_directory() as the root for path resolution purposes. The root directory is stored as an uncached Custody in the Process object.
2020-01-10 22:14:04 +00:00
if (!root)
root = VFS::the().root_custody();
Kernel: Get rid of "main thread" concept The idea of all processes reliably having a main thread was nice in some ways, but cumbersome in others. More importantly, it didn't match up with POSIX thread semantics, so let's move away from it. This thread gets rid of Process::main_thread() and you now we just have a bunch of Thread objects floating around each Process. When the finalizer nukes the last Thread in a Process, it will also tear down the Process. There's a bunch of more things to fix around this, but this is where we get started :^)
2019-12-22 10:35:02 +00:00
auto* process = new Process(first_thread, parts.take_last(), uid, gid, parent_pid, Ring3, move(cwd), nullptr, tty);
Kernel: Simplify Process constructor Move all the fork-specific inheritance logic to sys$fork(), and all the stuff for setting up stdio for non-fork ring 3 processes moves to Process::create_user_process(). Also: we were setting up the PGID, SID and umask twice. Also the code for copying the open file descriptors was overly complicated. Now it's just a simple Vector copy assignment. :^)
2020-01-25 12:50:54 +00:00
process->m_fds.resize(m_max_open_file_descriptors);
auto& device_to_use_as_tty = tty ? (CharacterDevice&)*tty : NullDevice::the();
Kernel: Only open a single description for stdio in non-fork processes
2020-01-25 16:05:02 +00:00
auto description = device_to_use_as_tty.open(O_RDWR).value();
process->m_fds[0].set(*description);
process->m_fds[1].set(*description);
process->m_fds[2].set(*description);
Implement argc/argv support for spawned tasks. Celebrate the new functionality with a simple /bin/cat implementation. :^)
2018-10-26 09:16:56 +00:00
Share code between spawn() and exec() implementations. Okay, now there's only one ELF loading client in the process launch code.
2018-11-03 09:49:13 +00:00
error = process->exec(path, move(arguments), move(environment));
Process::create_user_process() shouldn't leak a process if exec() fails.
2018-12-26 20:04:27 +00:00
if (error != 0) {
delete process;
Launching an arbitrary ELF executable from disk works! :^) This is so cool! It's a bit messy now with two Task constructors, but eventually they should fold into a single constructor somehow.
2018-10-22 13:42:39 +00:00
return nullptr;
Process::create_user_process() shouldn't leak a process if exec() fails.
2018-12-26 20:04:27 +00:00
}
More work on per-process page directories. It basically works now! I spent some time stuck on a problem where processes would clobber each other's stacks. Took me a moment to figure out that their stacks were allocated in the sub-4MB linear address range which is shared between all processes. Oops!
2018-11-01 10:30:48 +00:00
Fix some paging related bugs exposed by the spawn stress test. - Process::exec() needs to restore the original paging scope when called on a non-current process. - Add missing InterruptDisabler guards around g_processes access. - Only flush the TLB when modifying the active page tables.
2018-11-09 00:25:31 +00:00
{
InterruptDisabler disabler;
g_processes->prepend(process);
}
Add a simplified waitpid() so that sh can wait on spawned commands.
2018-10-23 22:20:34 +00:00
#ifdef TASK_DEBUG
Kernel: Use klog() instead of kprintf() Also, duplicate data in dbg() and klog() calls were removed. In addition, leakage of virtual address to kernel log is prevented. This is done by replacing kprintf() calls to dbg() calls with the leaked data instead. Also, other kprintf() calls were replaced with klog().
2020-03-01 19:45:39 +00:00
klog() << "Process " << process->pid() << " (" << process->name().characters() << ") spawned @ " << String::format("%p", first_thread->tss().eip);
Add a simplified waitpid() so that sh can wait on spawned commands.
2018-10-23 22:20:34 +00:00
#endif
Implement errno in LibC. This also meant I had to implement BSS (SHT_NOBITS) sections in ELFLoader. I also added an strerror() so we can print out what the errors are.
2018-10-25 10:06:00 +00:00
error = 0;
Share code between spawn() and exec() implementations. Okay, now there's only one ELF loading client in the process launch code.
2018-11-03 09:49:13 +00:00
return process;
Launching an arbitrary ELF executable from disk works! :^) This is so cool! It's a bit messy now with two Task constructors, but eventually they should fold into a single constructor somehow.
2018-10-22 13:42:39 +00:00
}
Kernel: Get rid of "main thread" concept The idea of all processes reliably having a main thread was nice in some ways, but cumbersome in others. More importantly, it didn't match up with POSIX thread semantics, so let's move away from it. This thread gets rid of Process::main_thread() and you now we just have a bunch of Thread objects floating around each Process. When the finalizer nukes the last Thread in a Process, it will also tear down the Process. There's a bunch of more things to fix around this, but this is where we get started :^)
2019-12-22 10:35:02 +00:00
Process* Process::create_kernel_process(Thread*& first_thread, String&& name, void (*e)())
Unify the Task constructors. There's now Task::create() and Task::createKernelTask().
2018-10-25 09:15:17 +00:00
{
Kernel: Get rid of "main thread" concept The idea of all processes reliably having a main thread was nice in some ways, but cumbersome in others. More importantly, it didn't match up with POSIX thread semantics, so let's move away from it. This thread gets rid of Process::main_thread() and you now we just have a bunch of Thread objects floating around each Process. When the finalizer nukes the last Thread in a Process, it will also tear down the Process. There's a bunch of more things to fix around this, but this is where we get started :^)
2019-12-22 10:35:02 +00:00
auto* process = new Process(first_thread, move(name), (uid_t)0, (gid_t)0, (pid_t)0, Ring0);
AK: Add global FlatPtr typedef. It's u32 or u64, based on sizeof(void*) Use this instead of uintptr_t throughout the codebase. This makes it possible to pass a FlatPtr to something that has u32 and u64 overloads.
2020-03-08 09:36:51 +00:00
first_thread->tss().eip = (FlatPtr)e;
Unify the Task constructors. There's now Task::create() and Task::createKernelTask().
2018-10-25 09:15:17 +00:00
Process now maps regions immediately when they are allocated. This avoids having to do a separate MM.mapRegionsForTask() pass. Also, more Task => Process renaming that I apparently hadn't saved yet.
2018-11-01 12:15:46 +00:00
if (process->pid() != 0) {
Kernel: Introduce threads, and refactor everything in support of it. The scheduler now operates on threads, rather than on processes. Each process has a main thread, and can have any number of additional threads. The process exits when the main thread exits. This patch doesn't actually spawn any additional threads, it merely does all the plumbing needed to make it possible. :^)
2019-03-23 21:03:17 +00:00
InterruptDisabler disabler;
g_processes->prepend(process);
Unify the Task constructors. There's now Task::create() and Task::createKernelTask().
2018-10-25 09:15:17 +00:00
#ifdef TASK_DEBUG
Kernel: Use klog() instead of kprintf() Also, duplicate data in dbg() and klog() calls were removed. In addition, leakage of virtual address to kernel log is prevented. This is done by replacing kprintf() calls to dbg() calls with the leaked data instead. Also, other kprintf() calls were replaced with klog().
2020-03-01 19:45:39 +00:00
klog() << "Kernel process " << process->pid() << " (" << process->name().characters() << ") spawned @ " << String::format("%p", first_thread->tss().eip);
Unify the Task constructors. There's now Task::create() and Task::createKernelTask().
2018-10-25 09:15:17 +00:00
#endif
}
Kernel: Get rid of "main thread" concept The idea of all processes reliably having a main thread was nice in some ways, but cumbersome in others. More importantly, it didn't match up with POSIX thread semantics, so let's move away from it. This thread gets rid of Process::main_thread() and you now we just have a bunch of Thread objects floating around each Process. When the finalizer nukes the last Thread in a Process, it will also tear down the Process. There's a bunch of more things to fix around this, but this is where we get started :^)
2019-12-22 10:35:02 +00:00
first_thread->set_state(Thread::State::Runnable);
Process now maps regions immediately when they are allocated. This avoids having to do a separate MM.mapRegionsForTask() pass. Also, more Task => Process renaming that I apparently hadn't saved yet.
2018-11-01 12:15:46 +00:00
return process;
Unify the Task constructors. There's now Task::create() and Task::createKernelTask().
2018-10-25 09:15:17 +00:00
}
Kernel: Get rid of "main thread" concept The idea of all processes reliably having a main thread was nice in some ways, but cumbersome in others. More importantly, it didn't match up with POSIX thread semantics, so let's move away from it. This thread gets rid of Process::main_thread() and you now we just have a bunch of Thread objects floating around each Process. When the finalizer nukes the last Thread in a Process, it will also tear down the Process. There's a bunch of more things to fix around this, but this is where we get started :^)
2019-12-22 10:35:02 +00:00
Process::Process(Thread*& first_thread, const String& name, uid_t uid, gid_t gid, pid_t ppid, RingLevel ring, RefPtr<Custody> cwd, RefPtr<Custody> executable, TTY* tty, Process* fork_parent)
Launching an arbitrary ELF executable from disk works! :^) This is so cool! It's a bit messy now with two Task constructors, but eventually they should fold into a single constructor somehow.
2018-10-22 13:42:39 +00:00
: m_name(move(name))
Kernel: Make TID's be unique PID's This is a little strange, but it's how I understand things should work. The first thread in a new process now has TID == PID. Additional threads subsequently spawned in that process all have unique TID's generated by the PID allocator. TIDs are now globally unique.
2019-12-22 10:51:24 +00:00
, m_pid(allocate_pid())
Launching an arbitrary ELF executable from disk works! :^) This is so cool! It's a bit messy now with two Task constructors, but eventually they should fold into a single constructor somehow.
2018-10-22 13:42:39 +00:00
, m_uid(uid)
, m_gid(gid)
Add geteuid() and getegid(). There's no support for set-uid or set-gid executables yet so these don't actually do anything. It's just nice to get the boilerplate stuff in.
2018-11-05 14:04:19 +00:00
, m_euid(uid)
, m_egid(gid)
Unify the Task constructors. There's now Task::create() and Task::createKernelTask().
2018-10-25 09:15:17 +00:00
, m_ring(ring)
Kernel: Rename Process::cwd_custody() to Process::current_directory(). ...and executable_custody() to just executable().
2019-05-30 18:23:50 +00:00
, m_executable(move(executable))
, m_cwd(move(cwd))
Start working on virtual consoles/TTYs. This is a mess right now, but I'd rather commit as I go.
2018-10-30 12:59:29 +00:00
, m_tty(tty)
Add getppid().
2018-11-06 12:33:06 +00:00
, m_ppid(ppid)
Launching an arbitrary ELF executable from disk works! :^) This is so cool! It's a bit messy now with two Task constructors, but eventually they should fold into a single constructor somehow.
2018-10-22 13:42:39 +00:00
{
Kernel: Finalizer should not go back to sleep if there's more to do Before putting itself back on the wait queue, the finalizer task will now check if there's more work to do, and if so, do it first. :^) This patch also puts a bunch of process/thread debug logging behind PROCESS_DEBUG and THREAD_DEBUG since it was unbearable to debug this stuff with all the spam.
2020-02-01 09:27:25 +00:00
#ifdef PROCESS_DEBUG
Kernel: Tidy up debug logging a little bit When using dbg() in the kernel, the output is automatically prefixed with [Process(PID:TID)]. This makes it a lot easier to understand which thread is generating the output. This patch also cleans up some common logging messages and removes the now-unnecessary "dbg() << *current << ..." pattern.
2020-01-21 15:14:39 +00:00
dbg() << "Created new process " << m_name << "(" << m_pid << ")";
Kernel: Finalizer should not go back to sleep if there's more to do Before putting itself back on the wait queue, the finalizer task will now check if there's more work to do, and if so, do it first. :^) This patch also puts a bunch of process/thread debug logging behind PROCESS_DEBUG and THREAD_DEBUG since it was unbearable to debug this stuff with all the spam.
2020-02-01 09:27:25 +00:00
#endif
Kernel: Introduce threads, and refactor everything in support of it. The scheduler now operates on threads, rather than on processes. Each process has a main thread, and can have any number of additional threads. The process exits when the main thread exits. This patch doesn't actually spawn any additional threads, it merely does all the plumbing needed to make it possible. :^)
2019-03-23 21:03:17 +00:00
Kernel: Add mapping from page directory base (PDB) to PageDirectory This allows the page fault code to find the owning PageDirectory and corresponding process for faulting regions. The mapping is implemented as a global hash map right now, which is definitely not optimal. We can come up with something better when it becomes necessary.
2019-08-06 09:19:16 +00:00
m_page_directory = PageDirectory::create_for_userspace(*this, fork_parent ? &fork_parent->page_directory().range_allocator() : nullptr);
Kernel: Introduce threads, and refactor everything in support of it. The scheduler now operates on threads, rather than on processes. Each process has a main thread, and can have any number of additional threads. The process exits when the main thread exits. This patch doesn't actually spawn any additional threads, it merely does all the plumbing needed to make it possible. :^)
2019-03-23 21:03:17 +00:00
#ifdef MM_DEBUG
Process: Use dbg() instead of dbgprintf() Also, fix a bad derefernce in sys$create_shared_buffer() method.
2020-02-24 22:13:33 +00:00
dbg() << "Process " << pid() << " ctor: PD=" << m_page_directory.ptr() << " created";
Kernel: Introduce threads, and refactor everything in support of it. The scheduler now operates on threads, rather than on processes. Each process has a main thread, and can have any number of additional threads. The process exits when the main thread exits. This patch doesn't actually spawn any additional threads, it merely does all the plumbing needed to make it possible. :^)
2019-03-23 21:03:17 +00:00
#endif
Kernel: Ignore SIGCHLD by default. Also use an enum for the rather-confusing return value in dispatch_signal(). I will go through the rest of the signals and set them up with the appropriate default dispositions at some other point.
2019-02-04 13:06:38 +00:00
Implement fork()! This is quite cool! The syscall entry point plumbs the register dump down to sys$fork(), which uses it to set up the child process's TSS in order to resume execution right after the int 0x80 fork() call. :^) This works pretty well, although there is some problem with the kernel alias mappings used to clone the parent process's regions. If I disable the MM::release_page_directory() code, there's no problem. Probably there's a premature freeing of a physical page somehow.
2018-11-02 19:41:58 +00:00
if (fork_parent) {
Kernel: Simplify Process constructor Move all the fork-specific inheritance logic to sys$fork(), and all the stuff for setting up stdio for non-fork ring 3 processes moves to Process::create_user_process(). Also: we were setting up the PGID, SID and umask twice. Also the code for copying the open file descriptors was overly complicated. Now it's just a simple Vector copy assignment. :^)
2020-01-25 12:50:54 +00:00
// NOTE: fork() doesn't clone all threads; the thread that called fork() becomes the only thread in the new process.
Kernel: Replace "current" with Thread::current and Process::current Suggested by Sergey. The currently running Thread and Process are now Thread::current and Process::current respectively. :^)
2020-02-17 14:04:27 +00:00
first_thread = Thread::current->clone(*this);
Implement fork()! This is quite cool! The syscall entry point plumbs the register dump down to sys$fork(), which uses it to set up the child process's TSS in order to resume execution right after the int 0x80 fork() call. :^) This works pretty well, although there is some problem with the kernel alias mappings used to clone the parent process's regions. If I disable the MM::release_page_directory() code, there's no problem. Probably there's a premature freeing of a physical page somehow.
2018-11-02 19:41:58 +00:00
} else {
Kernel: Simplify Process constructor Move all the fork-specific inheritance logic to sys$fork(), and all the stuff for setting up stdio for non-fork ring 3 processes moves to Process::create_user_process(). Also: we were setting up the PGID, SID and umask twice. Also the code for copying the open file descriptors was overly complicated. Now it's just a simple Vector copy assignment. :^)
2020-01-25 12:50:54 +00:00
// NOTE: This non-forked code path is only taken when the kernel creates a process "manually" (at boot.)
first_thread = new Thread(*this);
Kernel: Respect the process umask in open() and mkdir().
2019-02-22 01:39:13 +00:00
}
Import the "gerbert" kernel I worked on earlier this year. It's a lot crappier than I remembered it. It's gonna need a lot of work.
2018-10-16 09:01:38 +00:00
}
Process now maps regions immediately when they are allocated. This avoids having to do a separate MM.mapRegionsForTask() pass. Also, more Task => Process renaming that I apparently hadn't saved yet.
2018-11-01 12:15:46 +00:00
Process::~Process()
Import the "gerbert" kernel I worked on earlier this year. It's a lot crappier than I remembered it. It's gonna need a lot of work.
2018-10-16 09:01:38 +00:00
{
Kernel: Get rid of "main thread" concept The idea of all processes reliably having a main thread was nice in some ways, but cumbersome in others. More importantly, it didn't match up with POSIX thread semantics, so let's move away from it. This thread gets rid of Process::main_thread() and you now we just have a bunch of Thread objects floating around each Process. When the finalizer nukes the last Thread in a Process, it will also tear down the Process. There's a bunch of more things to fix around this, but this is where we get started :^)
2019-12-22 10:35:02 +00:00
ASSERT(thread_count() == 0);
Add Regions concept to Task.
2018-10-18 12:53:00 +00:00
}
Big, possibly complete sweep of naming changes.
2019-01-31 16:31:23 +00:00
void Process::dump_regions()
Add Regions concept to Task.
2018-10-18 12:53:00 +00:00
{
Kernel: Use klog() instead of kprintf() Also, duplicate data in dbg() and klog() calls were removed. In addition, leakage of virtual address to kernel log is prevented. This is done by replacing kprintf() calls to dbg() calls with the leaked data instead. Also, other kprintf() calls were replaced with klog().
2020-03-01 19:45:39 +00:00
klog() << "Process regions:";
klog() << "BEGIN END SIZE ACCESS NAME";
Add Regions concept to Task.
2018-10-18 12:53:00 +00:00
for (auto& region : m_regions) {
Kernel: Use klog() instead of kprintf() Also, duplicate data in dbg() and klog() calls were removed. In addition, leakage of virtual address to kernel log is prevented. This is done by replacing kprintf() calls to dbg() calls with the leaked data instead. Also, other kprintf() calls were replaced with klog().
2020-03-01 19:45:39 +00:00
klog() << String::format("%08x", region.vaddr().get()) << " -- " << String::format("%08x", region.vaddr().offset(region.size() - 1).get()) << " " << String::format("%08x", region.size()) << " " << (region.is_readable() ? 'R' : ' ') << (region.is_writable() ? 'W' : ' ') << (region.is_executable() ? 'X' : ' ') << (region.is_shared() ? 'S' : ' ') << (region.is_stack() ? 'T' : ' ') << (region.vmobject().is_purgeable() ? 'P' : ' ') << " " << region.name().characters();
Add Regions concept to Task.
2018-10-18 12:53:00 +00:00
}
Kernel: Always dump kernel regions when dumping process regions
2020-01-18 07:34:28 +00:00
MM.dump_kernel_regions();
Import the "gerbert" kernel I worked on earlier this year. It's a lot crappier than I remembered it. It's gonna need a lot of work.
2018-10-16 09:01:38 +00:00
}
Process now maps regions immediately when they are allocated. This avoids having to do a separate MM.mapRegionsForTask() pass. Also, more Task => Process renaming that I apparently hadn't saved yet.
2018-11-01 12:15:46 +00:00
void Process::sys$exit(int status)
Add a sys$exit and make init_stage2 call it when finished.
2018-10-22 09:43:55 +00:00
{
cli();
Add a simplified waitpid() so that sh can wait on spawned commands.
2018-10-23 22:20:34 +00:00
#ifdef TASK_DEBUG
Kernel: Use klog() instead of kprintf() Also, duplicate data in dbg() and klog() calls were removed. In addition, leakage of virtual address to kernel log is prevented. This is done by replacing kprintf() calls to dbg() calls with the leaked data instead. Also, other kprintf() calls were replaced with klog().
2020-03-01 19:45:39 +00:00
klog() << "sys$exit: exit with status " << status;
Add a simplified waitpid() so that sh can wait on spawned commands.
2018-10-23 22:20:34 +00:00
#endif
Add a sys$exit and make init_stage2 call it when finished.
2018-10-22 09:43:55 +00:00
Kernel: Don't dump backtrace on successful exits This was getting really annoying.
2020-01-12 15:27:24 +00:00
if (status != 0)
dump_backtrace();
Kernel: Dump backtrace on exit() syscall. This makes assertion failures a lot more pleasant to investigate.
2019-05-06 19:48:48 +00:00
Rework process states to make a bit more sense. Processes are either alive (with many substates), dead or forgiven. A dead process is forgiven when the parent waitpid()s on it. Dead orphans are also forgiven. There's a lot of work to be done around this.
2018-11-07 17:30:59 +00:00
m_termination_status = status;
m_termination_signal = 0;
Kernel: Add a Finalizer process to take care of dying processes. Instead of processes themselves getting scheduled to finish dying, let's have a Finalizer process that wakes up whenever someone is dying. This way we can do all kinds of lock-taking in process cleanup without risking reentering the scheduler.
2019-02-06 17:45:21 +00:00
die();
Kernel: Replace "current" with Thread::current and Process::current Suggested by Sergey. The currently running Thread and Process are now Thread::current and Process::current respectively. :^)
2020-02-17 14:04:27 +00:00
Thread::current->die_if_needed();
Move the scheduler code to its own class. This is very mechanical.
2018-11-07 21:15:02 +00:00
ASSERT_NOT_REACHED();
Add a sys$exit and make init_stage2 call it when finished.
2018-10-22 09:43:55 +00:00
}
Kernel: Stop hardcoding syscall in signal trampoline. We now no longer hardcode the sigreturn syscall in the signal trampoline. Because of the way inline asm inputs work, I've had to enclose the trampoline in the function signal_trampoline_dummy.
2019-09-17 13:41:42 +00:00
void signal_trampoline_dummy(void)
{
// The trampoline preserves the current eax, pushes the signal code and
// then calls the signal handler. We do this because, when interrupting a
// blocking syscall, that syscall may return some special error code in eax;
// This error code would likely be overwritten by the signal handler, so it's
// neccessary to preserve it here.
asm(
".intel_syntax noprefix\n"
"asm_signal_trampoline:\n"
"push ebp\n"
"mov ebp, esp\n"
"push eax\n" // we have to store eax 'cause it might be the return value from a syscall
"sub esp, 4\n" // align the stack to 16 bytes
"mov eax, [ebp+12]\n" // push the signal code
"push eax\n"
"call [ebp+8]\n" // call the signal handler
"add esp, 8\n"
"mov eax, %P0\n"
"int 0x82\n" // sigreturn syscall
"asm_signal_trampoline_end:\n"
".att_syntax" ::"i"(Syscall::SC_sigreturn));
}
Kernel: Use user stack for signal handlers. This commit drastically changes how signals are handled. In the case that an unblocked thread is signaled it works much in the same way as previously. However, when a blocking syscall is interrupted, we set up the signal trampoline on the user stack, complete the blocking syscall, return down the kernel stack and then jump to the handler. This means that from the kernel stack's perspective, we only ever get one system call deep. The signal trampoline has also been changed in order to properly store the return value from system calls. This is necessary due to the new way we exit from signaled system calls.
2019-09-04 13:14:54 +00:00
extern "C" void asm_signal_trampoline(void);
extern "C" void asm_signal_trampoline_end(void);
Kernel: Share the "return to ring 0/3 from signal" trampolines globally. Generate a special page containing the "return from signal" trampoline code on startup and then route signalled threads to it. This avoids a page allocation in every process that ever receives a signal.
2019-07-19 15:01:16 +00:00
void create_signal_trampolines()
Kernel: More signal handling improvements. Finally fixed the weird flaky crashing when resizing Terminal windows. It was because we were dispatching a signal to "current" from the scheduler. Yet another thing I dislike about even having a "current" process while we're in the scheduler. Not sure yet how to fix this. Let the signal handler's kernel stack be a kmalloc() allocation for now. Once we can do allocation of consecutive physical pages in the supervisor memory region, we can use that for all types of kernel stacks.
2019-03-05 11:50:55 +00:00
{
Kernel: Share the "return to ring 0/3 from signal" trampolines globally. Generate a special page containing the "return from signal" trampoline code on startup and then route signalled threads to it. This avoids a page allocation in every process that ever receives a signal.
2019-07-19 15:01:16 +00:00
InterruptDisabler disabler;
// NOTE: We leak this region.
Kernel: Change Region allocation helpers We now can create a cacheable Region, so when map() is called, if a Region is cacheable then all the virtual memory space being allocated to it will be marked as not cache disabled. In addition to that, OS components can create a Region that will be mapped to a specific physical address by using the appropriate helper method.
2020-01-09 21:29:31 +00:00
auto* trampoline_region = MM.allocate_user_accessible_kernel_region(PAGE_SIZE, "Signal trampolines", Region::Access::Read | Region::Access::Write | Region::Access::Execute, false).leak_ptr();
Kernel: Share the "return to ring 0/3 from signal" trampolines globally. Generate a special page containing the "return from signal" trampoline code on startup and then route signalled threads to it. This avoids a page allocation in every process that ever receives a signal.
2019-07-19 15:01:16 +00:00
g_return_to_ring3_from_signal_trampoline = trampoline_region->vaddr();
Kernel: Use user stack for signal handlers. This commit drastically changes how signals are handled. In the case that an unblocked thread is signaled it works much in the same way as previously. However, when a blocking syscall is interrupted, we set up the signal trampoline on the user stack, complete the blocking syscall, return down the kernel stack and then jump to the handler. This means that from the kernel stack's perspective, we only ever get one system call deep. The signal trampoline has also been changed in order to properly store the return value from system calls. This is necessary due to the new way we exit from signaled system calls.
2019-09-04 13:14:54 +00:00
u8* trampoline = (u8*)asm_signal_trampoline;
u8* trampoline_end = (u8*)asm_signal_trampoline_end;
size_t trampoline_size = trampoline_end - trampoline;
Kernel: Assert that copy_to/from_user() are called with user addresses This will panic the kernel immediately if these functions are misused so we can catch it and fix the misuse. This patch fixes a couple of misuses: - create_signal_trampolines() writes to a user-accessible page above the 3GB address mark. We should really get rid of this page but that's a whole other thing. - CoW faults need to use copy_from_user rather than copy_to_user since it's the *source* pointer that points to user memory. - Inode faults need to use memcpy rather than copy_to_user since we're copying a kernel stack buffer into a quickmapped page. This should make the copy_to/from_user() functions slightly less useful for exploitation. Before this, they were essentially just glorified memcpy() with SMAP disabled. :^)
2020-01-19 08:14:14 +00:00
{
SmapDisabler disabler;
u8* code_ptr = (u8*)trampoline_region->vaddr().as_ptr();
memcpy(code_ptr, trampoline, trampoline_size);
}
Kernel: Share the "return to ring 0/3 from signal" trampolines globally. Generate a special page containing the "return from signal" trampoline code on startup and then route signalled threads to it. This avoids a page allocation in every process that ever receives a signal.
2019-07-19 15:01:16 +00:00
trampoline_region->set_writable(false);
Kernel: Teach Region how to remap itself Now remapping (i.e flushing kernel metadata to the CPU page tables) is done by simply calling Region::remap().
2019-11-03 19:59:54 +00:00
trampoline_region->remap();
Kernel: More signal handling improvements. Finally fixed the weird flaky crashing when resizing Terminal windows. It was because we were dispatching a signal to "current" from the scheduler. Yet another thing I dislike about even having a "current" process while we're in the scheduler. Not sure yet how to fix this. Let the signal handler's kernel stack be a kmalloc() allocation for now. Once we can do allocation of consecutive physical pages in the supervisor memory region, we can use that for all types of kernel stacks.
2019-03-05 11:50:55 +00:00
}
Kernel+LibC: Publish a "kernel info page" and use it for gettimeofday() This patch adds a single "kernel info page" that is mappable read-only by any process and contains the current time of day. This is then used to implement a version of gettimeofday() that doesn't have to make a syscall. To protect against race condition issues, the info page also has a serial number which is incremented whenever the kernel updates the contents of the page. Make sure to verify that the serial number is the same before and after reading the information you want from the page.
2019-12-15 20:29:26 +00:00
void create_kernel_info_page()
{
Kernel: Make kernel memory regions be non-executable by default From now on, you'll have to request executable memory specifically if you want some.
2019-12-25 21:41:34 +00:00
auto* info_page_region_for_userspace = MM.allocate_user_accessible_kernel_region(PAGE_SIZE, "Kernel info page", Region::Access::Read).leak_ptr();
auto* info_page_region_for_kernel = MM.allocate_kernel_region_with_vmobject(info_page_region_for_userspace->vmobject(), PAGE_SIZE, "Kernel info page", Region::Access::Read | Region::Access::Write).leak_ptr();
Kernel: Make sure the kernel info page is read-only for userspace To enforce this, we create two separate mappings of the same underlying physical page. A writable mapping for the kernel, and a read-only one for userspace (the one returned by sys$get_kernel_info_page.)
2019-12-15 21:21:28 +00:00
s_info_page_address_for_userspace = info_page_region_for_userspace->vaddr();
s_info_page_address_for_kernel = info_page_region_for_kernel->vaddr();
memset(s_info_page_address_for_kernel.as_ptr(), 0, PAGE_SIZE);
Kernel+LibC: Publish a "kernel info page" and use it for gettimeofday() This patch adds a single "kernel info page" that is mappable read-only by any process and contains the current time of day. This is then used to implement a version of gettimeofday() that doesn't have to make a syscall. To protect against race condition issues, the info page also has a serial number which is incremented whenever the kernel updates the contents of the page. Make sure to verify that the serial number is the same before and after reading the information you want from the page.
2019-12-15 20:29:26 +00:00
}
Kernel: Rename RegisterDump => RegisterState
2020-02-15 23:15:37 +00:00
int Process::sys$sigreturn(RegisterState& registers)
Implement sending signals to blocked-in-kernel processes. This is dirty but pretty cool! If we have a pending, unmasked signal for a process that's blocked inside the kernel, we set up alternate stacks for that process and unblock it to execute the signal handler. A slightly different return trampoline is used here: since we need to get back into the kernel, a dedicated syscall is used (sys$sigreturn.) This restores the TSS contents of the process to the state it was in while we were originally blocking in the kernel. NOTE: There's currently only one "kernel resume TSS" so signal nesting definitely won't work.
2018-11-07 20:19:47 +00:00
{
Kernel: Add sigreturn() to "stdio" with all the other signal syscalls
2020-01-12 09:32:56 +00:00
REQUIRE_PROMISE(stdio);
Kernel: Start implementing x86 SMAP support Supervisor Mode Access Prevention (SMAP) is an x86 CPU feature that prevents the kernel from accessing userspace memory. With SMAP enabled, trying to read/write a userspace memory address while in the kernel will now generate a page fault. Since it's sometimes necessary to read/write userspace memory, there are two new instructions that quickly switch the protection on/off: STAC (disables protection) and CLAC (enables protection.) These are exposed in kernel code via the stac() and clac() helpers. There's also a SmapDisabler RAII object that can be used to ensure that you don't forget to re-enable protection before returning to userspace code. THis patch also adds copy_to_user(), copy_from_user() and memset_user() which are the "correct" way of doing things. These functions allow us to briefly disable protection for a specific purpose, and then turn it back on immediately after it's done. Going forward all kernel code should be moved to using these and all uses of SmapDisabler are to be considered FIXME's. Note that we're not realizing the full potential of this feature since I've used SmapDisabler quite liberally in this initial bring-up patch.
2020-01-05 17:00:15 +00:00
SmapDisabler disabler;
Kernel: Use user stack for signal handlers. This commit drastically changes how signals are handled. In the case that an unblocked thread is signaled it works much in the same way as previously. However, when a blocking syscall is interrupted, we set up the signal trampoline on the user stack, complete the blocking syscall, return down the kernel stack and then jump to the handler. This means that from the kernel stack's perspective, we only ever get one system call deep. The signal trampoline has also been changed in order to properly store the return value from system calls. This is necessary due to the new way we exit from signaled system calls.
2019-09-04 13:14:54 +00:00
//Here, we restore the state pushed by dispatch signal and asm_signal_trampoline.
Kernel: Rename {ss,esp}_if_crossRing to userspace_{ss,esp} These were always so awkwardly named.
2020-01-09 17:02:01 +00:00
u32* stack_ptr = (u32*)registers.userspace_esp;
Kernel: Use user stack for signal handlers. This commit drastically changes how signals are handled. In the case that an unblocked thread is signaled it works much in the same way as previously. However, when a blocking syscall is interrupted, we set up the signal trampoline on the user stack, complete the blocking syscall, return down the kernel stack and then jump to the handler. This means that from the kernel stack's perspective, we only ever get one system call deep. The signal trampoline has also been changed in order to properly store the return value from system calls. This is necessary due to the new way we exit from signaled system calls.
2019-09-04 13:14:54 +00:00
u32 smuggled_eax = *stack_ptr;
//pop the stored eax, ebp, return address, handler and signal code
stack_ptr += 5;
Kernel: Replace "current" with Thread::current and Process::current Suggested by Sergey. The currently running Thread and Process are now Thread::current and Process::current respectively. :^)
2020-02-17 14:04:27 +00:00
Thread::current->m_signal_mask = *stack_ptr;
Kernel: Use user stack for signal handlers. This commit drastically changes how signals are handled. In the case that an unblocked thread is signaled it works much in the same way as previously. However, when a blocking syscall is interrupted, we set up the signal trampoline on the user stack, complete the blocking syscall, return down the kernel stack and then jump to the handler. This means that from the kernel stack's perspective, we only ever get one system call deep. The signal trampoline has also been changed in order to properly store the return value from system calls. This is necessary due to the new way we exit from signaled system calls.
2019-09-04 13:14:54 +00:00
stack_ptr++;
Kernel: Add exception_code to RegisterDump. Added the exception_code field to RegisterDump, removing the need for RegisterDumpWithExceptionCode. To accomplish this, I had to push a dummy exception code during some interrupt entries to properly pad out the RegisterDump. Note that we also needed to change some code in sys$sigreturn to deal with the new RegisterDump layout.
2019-10-04 14:31:34 +00:00
//pop edi, esi, ebp, esp, ebx, edx, ecx and eax
AK: Add global FlatPtr typedef. It's u32 or u64, based on sizeof(void*) Use this instead of uintptr_t throughout the codebase. This makes it possible to pass a FlatPtr to something that has u32 and u64 overloads.
2020-03-08 09:36:51 +00:00
memcpy(&registers.edi, stack_ptr, 8 * sizeof(FlatPtr));
Kernel: Add exception_code to RegisterDump. Added the exception_code field to RegisterDump, removing the need for RegisterDumpWithExceptionCode. To accomplish this, I had to push a dummy exception code during some interrupt entries to properly pad out the RegisterDump. Note that we also needed to change some code in sys$sigreturn to deal with the new RegisterDump layout.
2019-10-04 14:31:34 +00:00
stack_ptr += 8;
registers.eip = *stack_ptr;
stack_ptr++;
Kernel: Use user stack for signal handlers. This commit drastically changes how signals are handled. In the case that an unblocked thread is signaled it works much in the same way as previously. However, when a blocking syscall is interrupted, we set up the signal trampoline on the user stack, complete the blocking syscall, return down the kernel stack and then jump to the handler. This means that from the kernel stack's perspective, we only ever get one system call deep. The signal trampoline has also been changed in order to properly store the return value from system calls. This is necessary due to the new way we exit from signaled system calls.
2019-09-04 13:14:54 +00:00
registers.eflags = *stack_ptr;
stack_ptr++;
Kernel: Rename {ss,esp}_if_crossRing to userspace_{ss,esp} These were always so awkwardly named.
2020-01-09 17:02:01 +00:00
registers.userspace_esp = registers.esp;
Kernel: Use user stack for signal handlers. This commit drastically changes how signals are handled. In the case that an unblocked thread is signaled it works much in the same way as previously. However, when a blocking syscall is interrupted, we set up the signal trampoline on the user stack, complete the blocking syscall, return down the kernel stack and then jump to the handler. This means that from the kernel stack's perspective, we only ever get one system call deep. The signal trampoline has also been changed in order to properly store the return value from system calls. This is necessary due to the new way we exit from signaled system calls.
2019-09-04 13:14:54 +00:00
return smuggled_eax;
Add some basic signal support. It only works for sending a signal to a process that's in userspace code. We implement reception by synthesizing a PUSHA+PUSHF in the receiving process (operating on values in the TSS.) The TSS CS:EIP is then rerouted to the signal handler and a tiny return trampoline is constructed in a dedicated region in the receiving process. Also hacked up /bin/kill to be able to send arbitrary signals (kill -N PID)
2018-11-06 09:46:40 +00:00
}
AK: Rename the common integer typedefs to make it obvious what they are. These types can be picked up by including <AK/Types.h>: * u8, u16, u32, u64 (unsigned) * i8, i16, i32, i64 (signed)
2019-07-03 19:17:35 +00:00
void Process::crash(int signal, u32 eip)
Actually destroy tasks after they crash.
2018-10-17 22:26:30 +00:00
{
Add a few more InterruptDisablers.
2018-10-25 08:33:10 +00:00
ASSERT_INTERRUPTS_DISABLED();
Kernel: Introduce threads, and refactor everything in support of it. The scheduler now operates on threads, rather than on processes. Each process has a main thread, and can have any number of additional threads. The process exits when the main thread exits. This patch doesn't actually spawn any additional threads, it merely does all the plumbing needed to make it possible. :^)
2019-03-23 21:03:17 +00:00
ASSERT(!is_dead());
Kernel: Replace "current" with Thread::current and Process::current Suggested by Sergey. The currently running Thread and Process are now Thread::current and Process::current respectively. :^)
2020-02-17 14:04:27 +00:00
ASSERT(Process::current == this);
IPv4: More hacking on bringing up TCP support. This was a bit more complicated than I expected, but it's moving forward.
2019-03-13 22:14:30 +00:00
Kernel: Update cryptically-named functions related to symbolication
2020-04-08 11:30:50 +00:00
if (eip >= 0xc0000000 && g_kernel_symbols_available) {
auto* symbol = symbolicate_kernel_address(eip);
dbg() << "\033[31;1m" << String::format("%p", eip) << " " << (symbol ? demangle(symbol->name) : "(k?)") << " +" << (symbol ? eip - symbol->address : 0) << "\033[0m\n";
Kernel: Load executables on demand when symbolicating Previously we would map the entire executable of a program in its own address space (but make it unavailable to userspace code.) This patch removes that and changes the symbolication code to remap the executable on demand (and into the kernel's own address space instead of the process address space.) This opens up a couple of further simplifications that will follow.
2020-03-02 09:40:40 +00:00
} else if (auto elf_bundle = this->elf_bundle()) {
dbg() << "\033[31;1m" << String::format("%p", eip) << " " << elf_bundle->elf_loader->symbolicate(eip) << "\033[0m\n";
Kernel: Symbolicate kernel EIP on process crash Process::crash() was assuming that EIP was always inside the ELF binary of the program, but it could also be in the kernel.
2020-01-18 13:38:39 +00:00
} else {
Process: Use dbg() instead of dbgprintf() Also, fix a bad derefernce in sys$create_shared_buffer() method.
2020-02-24 22:13:33 +00:00
dbg() << "\033[31;1m" << String::format("%p", eip) << " (?)\033[0m\n";
Kernel: Symbolicate kernel EIP on process crash Process::crash() was assuming that EIP was always inside the ELF binary of the program, but it could also be in the kernel.
2020-01-18 13:38:39 +00:00
}
Kernel: Always dump_backtrace() on process crash.
2019-05-16 17:49:48 +00:00
dump_backtrace();
Kernel: Send more specific signals when crashing due to CPU exceptions. - For division by zero, send SIGFPE. - For illegal instruction, send SIGILL. - For the rest, default to SIGSEGV.
2019-05-26 00:08:51 +00:00
m_termination_signal = signal;
Big, possibly complete sweep of naming changes.
2019-01-31 16:31:23 +00:00
dump_regions();
Process: Dump regions when a ring0 process crashes.
2019-02-08 08:45:53 +00:00
ASSERT(is_ring3());
Deallocate PTY's when they close. This required a fair bit of plumbing. The CharacterDevice::close() virtual will now be closed by ~FileDescriptor(), allowing device implementations to do custom cleanup at that point. One big problem remains: if the master PTY is closed before the slave PTY, we go into crashy land.
2019-01-30 17:26:19 +00:00
die();
Kernel: Unwind kernel stacks before dying While executing in the kernel, a thread can acquire various resources that need cleanup, such as locks and references to RefCounted objects. This cleanup normally happens on the exit path, such as in destructors for various RAII guards. But we weren't calling those exit paths when killing threads that have been executing in the kernel, such as threads blocked on reading or sleeping, thus causing leaks. This commit changes how killing threads works. Now, instead of killing a thread directly, one is supposed to call thread->set_should_die(), which will unblock it and make it unwind the stack if it is blocked in the kernel. Then, just before returning to the userspace, the thread will automatically die.
2019-11-14 15:46:01 +00:00
// We can not return from here, as there is nowhere
// to unwind to, so die right away.
Kernel: Replace "current" with Thread::current and Process::current Suggested by Sergey. The currently running Thread and Process are now Thread::current and Process::current respectively. :^)
2020-02-17 14:04:27 +00:00
Thread::current->die_if_needed();
Move the scheduler code to its own class. This is very mechanical.
2018-11-07 21:15:02 +00:00
ASSERT_NOT_REACHED();
Actually destroy tasks after they crash.
2018-10-17 22:26:30 +00:00
}
Some refactor and style tweaks.
2018-11-07 20:38:18 +00:00
Process* Process::from_pid(pid_t pid)
Import the "gerbert" kernel I worked on earlier this year. It's a lot crappier than I remembered it. It's gonna need a lot of work.
2018-10-16 09:01:38 +00:00
{
Add ASSERT_INTERRUPTS_DISABLED in Task::fromPID().
2018-10-26 13:11:29 +00:00
ASSERT_INTERRUPTS_DISABLED();
Kernel: Use some more InlineLinkedList range-for iteration
2019-08-08 12:40:13 +00:00
for (auto& process : *g_processes) {
if (process.pid() == pid)
return &process;
Import the "gerbert" kernel I worked on earlier this year. It's a lot crappier than I remembered it. It's gonna need a lot of work.
2018-10-16 09:01:38 +00:00
}
return nullptr;
}
Kernel: Make Process::file_description() vend a RefPtr<FileDescription> This encourages callers to strongly reference file descriptions while working with them. This fixes a use-after-free issue where one thread would close() an open fd while another thread was blocked on it becoming readable. Test: Kernel/uaf-close-while-blocked-in-read.cpp
2020-01-07 14:53:42 +00:00
RefPtr<FileDescription> Process::file_description(int fd) const
Rename FileHandle to FileDescriptor.
2018-11-07 10:37:54 +00:00
{
if (fd < 0)
return nullptr;
AK: Make Vector use size_t for its size and capacity
2020-02-25 13:49:47 +00:00
if (static_cast<size_t>(fd) < m_fds.size())
Kernel: Rename "descriptor" to "description" where appropriate. Now that FileDescription is called that, variables of that type should not be called "descriptor". This is kinda wordy but we'll get used to it.
2019-06-13 20:03:04 +00:00
return m_fds[fd].description.ptr();
Import the "gerbert" kernel I worked on earlier this year. It's a lot crappier than I remembered it. It's gonna need a lot of work.
2018-10-16 09:01:38 +00:00
return nullptr;
}
Kernel: Expose blocking and cloexec fd flags in ProcFS
2019-09-28 20:00:38 +00:00
int Process::fd_flags(int fd) const
{
if (fd < 0)
return -1;
AK: Make Vector use size_t for its size and capacity
2020-02-25 13:49:47 +00:00
if (static_cast<size_t>(fd) < m_fds.size())
Kernel: Expose blocking and cloexec fd flags in ProcFS
2019-09-28 20:00:38 +00:00
return m_fds[fd].flags;
return -1;
}
Kernel: Make syscalls that take a buffer size use ssize_t instead of size_t. Dealing with the unsigned overflow propagation here just seems unreasonably error prone. Let's limit ourselves to 2GB buffer sizes instead.
2019-02-25 20:19:57 +00:00
ssize_t Process::sys$get_dir_entries(int fd, void* buffer, ssize_t size)
Lots of hacking to make a very simple "ls" utility. I added a dead-simple malloc that only allows allocations < 4096 bytes. It just forwards the request to mmap() every time. I also added simplified versions of opendir() and readdir().
2018-10-24 10:43:52 +00:00
{
ping: Use pledge()
2020-01-11 19:48:43 +00:00
REQUIRE_PROMISE(stdio);
Kernel: Make syscalls that take a buffer size use ssize_t instead of size_t. Dealing with the unsigned overflow propagation here just seems unreasonably error prone. Let's limit ourselves to 2GB buffer sizes instead.
2019-02-25 20:19:57 +00:00
if (size < 0)
return -EINVAL;
Improve syscall address validation a bit.
2018-11-16 15:10:59 +00:00
if (!validate_write(buffer, size))
return -EFAULT;
Kernel: Make Process::file_description() vend a RefPtr<FileDescription> This encourages callers to strongly reference file descriptions while working with them. This fixes a use-after-free issue where one thread would close() an open fd while another thread was blocked on it becoming readable. Test: Kernel/uaf-close-while-blocked-in-read.cpp
2020-01-07 14:53:42 +00:00
auto description = file_description(fd);
Kernel: Rename "descriptor" to "description" where appropriate. Now that FileDescription is called that, variables of that type should not be called "descriptor". This is kinda wordy but we'll get used to it.
2019-06-13 20:03:04 +00:00
if (!description)
Add sys$ttyname_r and ttyname_r() + ttyname(). And print a greeting when sh starts up so we know which TTY we're on.
2018-10-30 21:03:02 +00:00
return -EBADF;
AK: Rename the common integer typedefs to make it obvious what they are. These types can be picked up by including <AK/Types.h>: * u8, u16, u32, u64 (unsigned) * i8, i16, i32, i64 (signed)
2019-07-03 19:17:35 +00:00
return description->get_dir_entries((u8*)buffer, size);
Lots of hacking to make a very simple "ls" utility. I added a dead-simple malloc that only allows allocations < 4096 bytes. It just forwards the request to mmap() every time. I also added simplified versions of opendir() and readdir().
2018-10-24 10:43:52 +00:00
}
Process now maps regions immediately when they are allocated. This avoids having to do a separate MM.mapRegionsForTask() pass. Also, more Task => Process renaming that I apparently hadn't saved yet.
2018-11-01 12:15:46 +00:00
int Process::sys$lseek(int fd, off_t offset, int whence)
Import the "gerbert" kernel I worked on earlier this year. It's a lot crappier than I remembered it. It's gonna need a lot of work.
2018-10-16 09:01:38 +00:00
{
ping: Use pledge()
2020-01-11 19:48:43 +00:00
REQUIRE_PROMISE(stdio);
Kernel: Make Process::file_description() vend a RefPtr<FileDescription> This encourages callers to strongly reference file descriptions while working with them. This fixes a use-after-free issue where one thread would close() an open fd while another thread was blocked on it becoming readable. Test: Kernel/uaf-close-while-blocked-in-read.cpp
2020-01-07 14:53:42 +00:00
auto description = file_description(fd);
Kernel: Rename "descriptor" to "description" where appropriate. Now that FileDescription is called that, variables of that type should not be called "descriptor". This is kinda wordy but we'll get used to it.
2019-06-13 20:03:04 +00:00
if (!description)
Enough compatibility work to make figlet build and run! I ran out of steam writing library routines and imported two BSD-licensed libc routines: sscanf() and getopt(). I will most likely rewrite them sooner or later. For now I just wanted to see figlet running.
2018-10-31 16:50:43 +00:00
return -EBADF;
Kernel: Rename "descriptor" to "description" where appropriate. Now that FileDescription is called that, variables of that type should not be called "descriptor". This is kinda wordy but we'll get used to it.
2019-06-13 20:03:04 +00:00
return description->seek(offset, whence);
Import the "gerbert" kernel I worked on earlier this year. It's a lot crappier than I remembered it. It's gonna need a lot of work.
2018-10-16 09:01:38 +00:00
}
Kernel: Make syscalls that take a buffer size use ssize_t instead of size_t. Dealing with the unsigned overflow propagation here just seems unreasonably error prone. Let's limit ourselves to 2GB buffer sizes instead.
2019-02-25 20:19:57 +00:00
int Process::sys$ttyname_r(int fd, char* buffer, ssize_t size)
Add sys$ttyname_r and ttyname_r() + ttyname(). And print a greeting when sh starts up so we know which TTY we're on.
2018-10-30 21:03:02 +00:00
{
ping: Use pledge()
2020-01-11 19:48:43 +00:00
REQUIRE_PROMISE(tty);
Kernel: Make syscalls that take a buffer size use ssize_t instead of size_t. Dealing with the unsigned overflow propagation here just seems unreasonably error prone. Let's limit ourselves to 2GB buffer sizes instead.
2019-02-25 20:19:57 +00:00
if (size < 0)
return -EINVAL;
Improve syscall address validation a bit.
2018-11-16 15:10:59 +00:00
if (!validate_write(buffer, size))
return -EFAULT;
Kernel: Make Process::file_description() vend a RefPtr<FileDescription> This encourages callers to strongly reference file descriptions while working with them. This fixes a use-after-free issue where one thread would close() an open fd while another thread was blocked on it becoming readable. Test: Kernel/uaf-close-while-blocked-in-read.cpp
2020-01-07 14:53:42 +00:00
auto description = file_description(fd);
Kernel: Rename "descriptor" to "description" where appropriate. Now that FileDescription is called that, variables of that type should not be called "descriptor". This is kinda wordy but we'll get used to it.
2019-06-13 20:03:04 +00:00
if (!description)
Add sys$ttyname_r and ttyname_r() + ttyname(). And print a greeting when sh starts up so we know which TTY we're on.
2018-10-30 21:03:02 +00:00
return -EBADF;
Kernel: Rename "descriptor" to "description" where appropriate. Now that FileDescription is called that, variables of that type should not be called "descriptor". This is kinda wordy but we'll get used to it.
2019-06-13 20:03:04 +00:00
if (!description->is_tty())
Add sys$ttyname_r and ttyname_r() + ttyname(). And print a greeting when sh starts up so we know which TTY we're on.
2018-10-30 21:03:02 +00:00
return -ENOTTY;
Kernel: Start implementing x86 SMAP support Supervisor Mode Access Prevention (SMAP) is an x86 CPU feature that prevents the kernel from accessing userspace memory. With SMAP enabled, trying to read/write a userspace memory address while in the kernel will now generate a page fault. Since it's sometimes necessary to read/write userspace memory, there are two new instructions that quickly switch the protection on/off: STAC (disables protection) and CLAC (enables protection.) These are exposed in kernel code via the stac() and clac() helpers. There's also a SmapDisabler RAII object that can be used to ensure that you don't forget to re-enable protection before returning to userspace code. THis patch also adds copy_to_user(), copy_from_user() and memset_user() which are the "correct" way of doing things. These functions allow us to briefly disable protection for a specific purpose, and then turn it back on immediately after it's done. Going forward all kernel code should be moved to using these and all uses of SmapDisabler are to be considered FIXME's. Note that we're not realizing the full potential of this feature since I've used SmapDisabler quite liberally in this initial bring-up patch.
2020-01-05 17:00:15 +00:00
String tty_name = description->tty()->tty_name();
AK: Use size_t for the length of strings Using int was a mistake. This patch changes String, StringImpl, StringView and StringBuilder to use size_t instead of int for lengths. Obviously a lot of code needs to change as a result of this.
2019-12-09 16:45:40 +00:00
if ((size_t)size < tty_name.length() + 1)
Add sys$ttyname_r and ttyname_r() + ttyname(). And print a greeting when sh starts up so we know which TTY we're on.
2018-10-30 21:03:02 +00:00
return -ERANGE;
Kernel: Start implementing x86 SMAP support Supervisor Mode Access Prevention (SMAP) is an x86 CPU feature that prevents the kernel from accessing userspace memory. With SMAP enabled, trying to read/write a userspace memory address while in the kernel will now generate a page fault. Since it's sometimes necessary to read/write userspace memory, there are two new instructions that quickly switch the protection on/off: STAC (disables protection) and CLAC (enables protection.) These are exposed in kernel code via the stac() and clac() helpers. There's also a SmapDisabler RAII object that can be used to ensure that you don't forget to re-enable protection before returning to userspace code. THis patch also adds copy_to_user(), copy_from_user() and memset_user() which are the "correct" way of doing things. These functions allow us to briefly disable protection for a specific purpose, and then turn it back on immediately after it's done. Going forward all kernel code should be moved to using these and all uses of SmapDisabler are to be considered FIXME's. Note that we're not realizing the full potential of this feature since I've used SmapDisabler quite liberally in this initial bring-up patch.
2020-01-05 17:00:15 +00:00
copy_to_user(buffer, tty_name.characters(), tty_name.length() + 1);
Add sys$ttyname_r and ttyname_r() + ttyname(). And print a greeting when sh starts up so we know which TTY we're on.
2018-10-30 21:03:02 +00:00
return 0;
}
Kernel: Make syscalls that take a buffer size use ssize_t instead of size_t. Dealing with the unsigned overflow propagation here just seems unreasonably error prone. Let's limit ourselves to 2GB buffer sizes instead.
2019-02-25 20:19:57 +00:00
int Process::sys$ptsname_r(int fd, char* buffer, ssize_t size)
Add basic PTY support. For now, there are four hard-coded PTYs: /dev/pt{m,s}[0123] Use this in the Terminal to open a pty pair and spawn a shell.
2019-01-15 05:30:19 +00:00
{
ping: Use pledge()
2020-01-11 19:48:43 +00:00
REQUIRE_PROMISE(tty);
Kernel: Make syscalls that take a buffer size use ssize_t instead of size_t. Dealing with the unsigned overflow propagation here just seems unreasonably error prone. Let's limit ourselves to 2GB buffer sizes instead.
2019-02-25 20:19:57 +00:00
if (size < 0)
return -EINVAL;
Add basic PTY support. For now, there are four hard-coded PTYs: /dev/pt{m,s}[0123] Use this in the Terminal to open a pty pair and spawn a shell.
2019-01-15 05:30:19 +00:00
if (!validate_write(buffer, size))
return -EFAULT;
Kernel: Make Process::file_description() vend a RefPtr<FileDescription> This encourages callers to strongly reference file descriptions while working with them. This fixes a use-after-free issue where one thread would close() an open fd while another thread was blocked on it becoming readable. Test: Kernel/uaf-close-while-blocked-in-read.cpp
2020-01-07 14:53:42 +00:00
auto description = file_description(fd);
Kernel: Rename "descriptor" to "description" where appropriate. Now that FileDescription is called that, variables of that type should not be called "descriptor". This is kinda wordy but we'll get used to it.
2019-06-13 20:03:04 +00:00
if (!description)
Add basic PTY support. For now, there are four hard-coded PTYs: /dev/pt{m,s}[0123] Use this in the Terminal to open a pty pair and spawn a shell.
2019-01-15 05:30:19 +00:00
return -EBADF;
Kernel: Rename "descriptor" to "description" where appropriate. Now that FileDescription is called that, variables of that type should not be called "descriptor". This is kinda wordy but we'll get used to it.
2019-06-13 20:03:04 +00:00
auto* master_pty = description->master_pty();
Add basic PTY support. For now, there are four hard-coded PTYs: /dev/pt{m,s}[0123] Use this in the Terminal to open a pty pair and spawn a shell.
2019-01-15 05:30:19 +00:00
if (!master_pty)
return -ENOTTY;
auto pts_name = master_pty->pts_name();
AK: Use size_t for the length of strings Using int was a mistake. This patch changes String, StringImpl, StringView and StringBuilder to use size_t instead of int for lengths. Obviously a lot of code needs to change as a result of this.
2019-12-09 16:45:40 +00:00
if ((size_t)size < pts_name.length() + 1)
Add basic PTY support. For now, there are four hard-coded PTYs: /dev/pt{m,s}[0123] Use this in the Terminal to open a pty pair and spawn a shell.
2019-01-15 05:30:19 +00:00
return -ERANGE;
Kernel: Start implementing x86 SMAP support Supervisor Mode Access Prevention (SMAP) is an x86 CPU feature that prevents the kernel from accessing userspace memory. With SMAP enabled, trying to read/write a userspace memory address while in the kernel will now generate a page fault. Since it's sometimes necessary to read/write userspace memory, there are two new instructions that quickly switch the protection on/off: STAC (disables protection) and CLAC (enables protection.) These are exposed in kernel code via the stac() and clac() helpers. There's also a SmapDisabler RAII object that can be used to ensure that you don't forget to re-enable protection before returning to userspace code. THis patch also adds copy_to_user(), copy_from_user() and memset_user() which are the "correct" way of doing things. These functions allow us to briefly disable protection for a specific purpose, and then turn it back on immediately after it's done. Going forward all kernel code should be moved to using these and all uses of SmapDisabler are to be considered FIXME's. Note that we're not realizing the full potential of this feature since I've used SmapDisabler quite liberally in this initial bring-up patch.
2020-01-05 17:00:15 +00:00
copy_to_user(buffer, pts_name.characters(), pts_name.length() + 1);
Add basic PTY support. For now, there are four hard-coded PTYs: /dev/pt{m,s}[0123] Use this in the Terminal to open a pty pair and spawn a shell.
2019-01-15 05:30:19 +00:00
return 0;
}
Kernel: Add a writev() syscall for writing multiple buffers in one go. We then use this immediately in the WindowServer/LibGUI communication in order to send both message + optional "extra data" with a single syscall.
2019-05-10 01:19:25 +00:00
ssize_t Process::sys$writev(int fd, const struct iovec* iov, int iov_count)
Virtual consoles kinda work! We now make three VirtualConsoles at boot: tty0, tty1, and tty2. We launch an instance of /bin/sh in each one. You switch between them with Alt+1/2/3 How very very cool :^)
2018-10-30 14:33:37 +00:00
{
ping: Use pledge()
2020-01-11 19:48:43 +00:00
REQUIRE_PROMISE(stdio);
Kernel: Add a writev() syscall for writing multiple buffers in one go. We then use this immediately in the WindowServer/LibGUI communication in order to send both message + optional "extra data" with a single syscall.
2019-05-10 01:19:25 +00:00
if (iov_count < 0)
Kernel: Make syscalls that take a buffer size use ssize_t instead of size_t. Dealing with the unsigned overflow propagation here just seems unreasonably error prone. Let's limit ourselves to 2GB buffer sizes instead.
2019-02-25 20:19:57 +00:00
return -EINVAL;
Kernel: Add a writev() syscall for writing multiple buffers in one go. We then use this immediately in the WindowServer/LibGUI communication in order to send both message + optional "extra data" with a single syscall.
2019-05-10 01:19:25 +00:00
if (!validate_read_typed(iov, iov_count))
Improve syscall address validation a bit.
2018-11-16 15:10:59 +00:00
return -EFAULT;
Kernel: Add a writev() syscall for writing multiple buffers in one go. We then use this immediately in the WindowServer/LibGUI communication in order to send both message + optional "extra data" with a single syscall.
2019-05-10 01:19:25 +00:00
Kernel: writev() should fail with EINVAL if total length > INT32_MAX
2020-01-02 12:01:41 +00:00
u64 total_length = 0;
Kernel: Add missing iovec base validation for writev() syscall We were forgetting to validate the base pointers of iovecs passed into the writev() syscall. Thanks to braindead for finding this bug! :^)
2020-01-05 09:16:19 +00:00
Vector<iovec, 32> vecs;
Kernel: Make writev() work again Vector::ensure_capacity() makes sure the underlying vector buffer can contain all the data, but it doesn't update the Vector::size(). As a result, writev() would simply collect all the buffers to write, and then do nothing.
2020-01-26 09:10:15 +00:00
vecs.resize(iov_count);
Kernel: Fix SMAP violation in writev() syscall
2020-01-05 18:20:08 +00:00
copy_from_user(vecs.data(), iov, iov_count * sizeof(iovec));
for (auto& vec : vecs) {
if (!validate_read(vec.iov_base, vec.iov_len))
Kernel: Add missing iovec base validation for writev() syscall We were forgetting to validate the base pointers of iovecs passed into the writev() syscall. Thanks to braindead for finding this bug! :^)
2020-01-05 09:16:19 +00:00
return -EFAULT;
Kernel: Fix SMAP violation in writev() syscall
2020-01-05 18:20:08 +00:00
total_length += vec.iov_len;
Kernel: writev() should fail with EINVAL if total length > INT32_MAX
2020-01-02 12:01:41 +00:00
if (total_length > INT32_MAX)
return -EINVAL;
}
Kernel: Add a writev() syscall for writing multiple buffers in one go. We then use this immediately in the WindowServer/LibGUI communication in order to send both message + optional "extra data" with a single syscall.
2019-05-10 01:19:25 +00:00
Kernel: Make Process::file_description() vend a RefPtr<FileDescription> This encourages callers to strongly reference file descriptions while working with them. This fixes a use-after-free issue where one thread would close() an open fd while another thread was blocked on it becoming readable. Test: Kernel/uaf-close-while-blocked-in-read.cpp
2020-01-07 14:53:42 +00:00
auto description = file_description(fd);
Kernel: Rename "descriptor" to "description" where appropriate. Now that FileDescription is called that, variables of that type should not be called "descriptor". This is kinda wordy but we'll get used to it.
2019-06-13 20:03:04 +00:00
if (!description)
Virtual consoles kinda work! We now make three VirtualConsoles at boot: tty0, tty1, and tty2. We launch an instance of /bin/sh in each one. You switch between them with Alt+1/2/3 How very very cool :^)
2018-10-30 14:33:37 +00:00
return -EBADF;
Kernel: Add a writev() syscall for writing multiple buffers in one go. We then use this immediately in the WindowServer/LibGUI communication in order to send both message + optional "extra data" with a single syscall.
2019-05-10 01:19:25 +00:00
Kernel: read() and write() should fail with EBADF for wrong mode fd's It was previously possible to write to read-only file descriptors, and read from write-only file descriptors. All FileDescription objects now start out non-readable + non-writable, and whoever is creating them has to "manually" enable reading/writing by calling set_readable() and/or set_writable() on them.
2020-01-03 02:29:59 +00:00
if (!description->is_writable())
return -EBADF;
Kernel: Add a writev() syscall for writing multiple buffers in one go. We then use this immediately in the WindowServer/LibGUI communication in order to send both message + optional "extra data" with a single syscall.
2019-05-10 01:19:25 +00:00
int nwritten = 0;
Kernel: Add missing iovec base validation for writev() syscall We were forgetting to validate the base pointers of iovecs passed into the writev() syscall. Thanks to braindead for finding this bug! :^)
2020-01-05 09:16:19 +00:00
for (auto& vec : vecs) {
int rc = do_write(*description, (const u8*)vec.iov_base, vec.iov_len);
Kernel: Add a writev() syscall for writing multiple buffers in one go. We then use this immediately in the WindowServer/LibGUI communication in order to send both message + optional "extra data" with a single syscall.
2019-05-10 01:19:25 +00:00
if (rc < 0) {
if (nwritten == 0)
return rc;
return nwritten;
}
nwritten += rc;
}
return nwritten;
}
AK: Rename the common integer typedefs to make it obvious what they are. These types can be picked up by including <AK/Types.h>: * u8, u16, u32, u64 (unsigned) * i8, i16, i32, i64 (signed)
2019-07-03 19:17:35 +00:00
ssize_t Process::do_write(FileDescription& description, const u8* data, int data_size)
Kernel: Add a writev() syscall for writing multiple buffers in one go. We then use this immediately in the WindowServer/LibGUI communication in order to send both message + optional "extra data" with a single syscall.
2019-05-10 01:19:25 +00:00
{
Add primitive FIFO and hook it up to sys$pipe(). It's now possible to do this in bash: cat kernel.map | fgrep List This is very cool! :^)
2018-11-12 00:28:46 +00:00
ssize_t nwritten = 0;
Kernel: Rename "descriptor" to "description" where appropriate. Now that FileDescription is called that, variables of that type should not be called "descriptor". This is kinda wordy but we'll get used to it.
2019-06-13 20:03:04 +00:00
if (!description.is_blocking()) {
if (!description.can_write())
Kernel: Check can_write for blocking write This way the socket write buffer sizes are respected, and things that exceed them get sent EAGAIN.
2019-05-19 08:25:05 +00:00
return -EAGAIN;
}
Kernel: Add a writev() syscall for writing multiple buffers in one go. We then use this immediately in the WindowServer/LibGUI communication in order to send both message + optional "extra data" with a single syscall.
2019-05-10 01:19:25 +00:00
Kernel: Rename "descriptor" to "description" where appropriate. Now that FileDescription is called that, variables of that type should not be called "descriptor". This is kinda wordy but we'll get used to it.
2019-06-13 20:03:04 +00:00
if (description.should_append()) {
Kernel: Support O_APPEND As per the manpage, this acts as a transparent lseek() before write.
2019-05-25 23:18:04 +00:00
#ifdef IO_DEBUG
Process: Use dbg() instead of dbgprintf() Also, fix a bad derefernce in sys$create_shared_buffer() method.
2020-02-24 22:13:33 +00:00
dbg() << "seeking to end (O_APPEND)";
Kernel: Support O_APPEND As per the manpage, this acts as a transparent lseek() before write.
2019-05-25 23:18:04 +00:00
#endif
Kernel: Rename "descriptor" to "description" where appropriate. Now that FileDescription is called that, variables of that type should not be called "descriptor". This is kinda wordy but we'll get used to it.
2019-06-13 20:03:04 +00:00
description.seek(0, SEEK_END);
Kernel: Support O_APPEND As per the manpage, this acts as a transparent lseek() before write.
2019-05-25 23:18:04 +00:00
}
Kernel: Add a writev() syscall for writing multiple buffers in one go. We then use this immediately in the WindowServer/LibGUI communication in order to send both message + optional "extra data" with a single syscall.
2019-05-10 01:19:25 +00:00
while (nwritten < data_size) {
Add primitive FIFO and hook it up to sys$pipe(). It's now possible to do this in bash: cat kernel.map | fgrep List This is very cool! :^)
2018-11-12 00:28:46 +00:00
#ifdef IO_DEBUG
Process: Use dbg() instead of dbgprintf() Also, fix a bad derefernce in sys$create_shared_buffer() method.
2020-02-24 22:13:33 +00:00
dbg() << "while " << nwritten << " < " << size;
Add primitive FIFO and hook it up to sys$pipe(). It's now possible to do this in bash: cat kernel.map | fgrep List This is very cool! :^)
2018-11-12 00:28:46 +00:00
#endif
Kernel: Rename "descriptor" to "description" where appropriate. Now that FileDescription is called that, variables of that type should not be called "descriptor". This is kinda wordy but we'll get used to it.
2019-06-13 20:03:04 +00:00
if (!description.can_write()) {
Add primitive FIFO and hook it up to sys$pipe(). It's now possible to do this in bash: cat kernel.map | fgrep List This is very cool! :^)
2018-11-12 00:28:46 +00:00
#ifdef IO_DEBUG
Kernel: Simplify some dbg() logging We don't have to log the process name/PID/TID, dbg() automatically adds that as a prefix to every line. Also we don't have to do .characters() on Strings passed to dbg() :^)
2020-02-29 11:51:44 +00:00
dbg() << "block write on " << description.absolute_path();
Add primitive FIFO and hook it up to sys$pipe(). It's now possible to do this in bash: cat kernel.map | fgrep List This is very cool! :^)
2018-11-12 00:28:46 +00:00
#endif
Kernel: Replace "current" with Thread::current and Process::current Suggested by Sergey. The currently running Thread and Process are now Thread::current and Process::current respectively. :^)
2020-02-17 14:04:27 +00:00
if (Thread::current->block<Thread::WriteBlocker>(description) != Thread::BlockResult::WokeNormally) {
Thread: Return a result from block() indicating why the block terminated And use this to return EINTR in various places; some of which we were not handling properly before. This might expose a few bugs in userspace, but should be more compatible with other POSIX systems, and is certainly a little cleaner.
2019-07-20 09:05:52 +00:00
if (nwritten == 0)
return -EINTR;
}
Kernel: Add a writev() syscall for writing multiple buffers in one go. We then use this immediately in the WindowServer/LibGUI communication in order to send both message + optional "extra data" with a single syscall.
2019-05-10 01:19:25 +00:00
}
Kernel: Rename "descriptor" to "description" where appropriate. Now that FileDescription is called that, variables of that type should not be called "descriptor". This is kinda wordy but we'll get used to it.
2019-06-13 20:03:04 +00:00
ssize_t rc = description.write(data + nwritten, data_size - nwritten);
Add primitive FIFO and hook it up to sys$pipe(). It's now possible to do this in bash: cat kernel.map | fgrep List This is very cool! :^)
2018-11-12 00:28:46 +00:00
#ifdef IO_DEBUG
Process: Use dbg() instead of dbgprintf() Also, fix a bad derefernce in sys$create_shared_buffer() method.
2020-02-24 22:13:33 +00:00
dbg() << " -> write returned " << rc;
Add primitive FIFO and hook it up to sys$pipe(). It's now possible to do this in bash: cat kernel.map | fgrep List This is very cool! :^)
2018-11-12 00:28:46 +00:00
#endif
Kernel: Add a writev() syscall for writing multiple buffers in one go. We then use this immediately in the WindowServer/LibGUI communication in order to send both message + optional "extra data" with a single syscall.
2019-05-10 01:19:25 +00:00
if (rc < 0) {
Kernel: Return bytes written if sys$write() fails after writing some If we wrote anything we should just inform userspace that we did, and not worry about the error code. Userspace can call us again if it wants, and we'll give them the error then.
2020-02-29 17:42:35 +00:00
if (nwritten)
return nwritten;
Kernel: Add a writev() syscall for writing multiple buffers in one go. We then use this immediately in the WindowServer/LibGUI communication in order to send both message + optional "extra data" with a single syscall.
2019-05-10 01:19:25 +00:00
return rc;
Add primitive FIFO and hook it up to sys$pipe(). It's now possible to do this in bash: cat kernel.map | fgrep List This is very cool! :^)
2018-11-12 00:28:46 +00:00
}
Kernel: Add a writev() syscall for writing multiple buffers in one go. We then use this immediately in the WindowServer/LibGUI communication in order to send both message + optional "extra data" with a single syscall.
2019-05-10 01:19:25 +00:00
if (rc == 0)
break;
nwritten += rc;
Add primitive FIFO and hook it up to sys$pipe(). It's now possible to do this in bash: cat kernel.map | fgrep List This is very cool! :^)
2018-11-12 00:28:46 +00:00
}
Kernel: Add a writev() syscall for writing multiple buffers in one go. We then use this immediately in the WindowServer/LibGUI communication in order to send both message + optional "extra data" with a single syscall.
2019-05-10 01:19:25 +00:00
return nwritten;
}
AK: Rename the common integer typedefs to make it obvious what they are. These types can be picked up by including <AK/Types.h>: * u8, u16, u32, u64 (unsigned) * i8, i16, i32, i64 (signed)
2019-07-03 19:17:35 +00:00
ssize_t Process::sys$write(int fd, const u8* data, ssize_t size)
Kernel: Add a writev() syscall for writing multiple buffers in one go. We then use this immediately in the WindowServer/LibGUI communication in order to send both message + optional "extra data" with a single syscall.
2019-05-10 01:19:25 +00:00
{
ping: Use pledge()
2020-01-11 19:48:43 +00:00
REQUIRE_PROMISE(stdio);
Kernel: Add a writev() syscall for writing multiple buffers in one go. We then use this immediately in the WindowServer/LibGUI communication in order to send both message + optional "extra data" with a single syscall.
2019-05-10 01:19:25 +00:00
if (size < 0)
return -EINVAL;
if (size == 0)
return 0;
if (!validate_read(data, size))
return -EFAULT;
#ifdef DEBUG_IO
Kernel: Simplify some dbg() logging We don't have to log the process name/PID/TID, dbg() automatically adds that as a prefix to every line. Also we don't have to do .characters() on Strings passed to dbg() :^)
2020-02-29 11:51:44 +00:00
dbg() << "sys$write(" << fd << ", " << (const void*)(data) << ", " << size << ")";
Kernel: Add a writev() syscall for writing multiple buffers in one go. We then use this immediately in the WindowServer/LibGUI communication in order to send both message + optional "extra data" with a single syscall.
2019-05-10 01:19:25 +00:00
#endif
Kernel: Make Process::file_description() vend a RefPtr<FileDescription> This encourages callers to strongly reference file descriptions while working with them. This fixes a use-after-free issue where one thread would close() an open fd while another thread was blocked on it becoming readable. Test: Kernel/uaf-close-while-blocked-in-read.cpp
2020-01-07 14:53:42 +00:00
auto description = file_description(fd);
Kernel: Rename "descriptor" to "description" where appropriate. Now that FileDescription is called that, variables of that type should not be called "descriptor". This is kinda wordy but we'll get used to it.
2019-06-13 20:03:04 +00:00
if (!description)
Kernel: Add a writev() syscall for writing multiple buffers in one go. We then use this immediately in the WindowServer/LibGUI communication in order to send both message + optional "extra data" with a single syscall.
2019-05-10 01:19:25 +00:00
return -EBADF;
Kernel: read() and write() should fail with EBADF for wrong mode fd's It was previously possible to write to read-only file descriptors, and read from write-only file descriptors. All FileDescription objects now start out non-readable + non-writable, and whoever is creating them has to "manually" enable reading/writing by calling set_readable() and/or set_writable() on them.
2020-01-03 02:29:59 +00:00
if (!description->is_writable())
return -EBADF;
Kernel: Don't interrupt short writes Remove explicit checking for pending signals from writing code paths, since this is handled automatically when blocking, and should not happen if the write() call is "short", i.e. doesn't block. All the other syscalls already work like this. Fixes https://github.com/SerenityOS/serenity/issues/797
2019-11-19 12:33:08 +00:00
return do_write(*description, data, size);
Virtual consoles kinda work! We now make three VirtualConsoles at boot: tty0, tty1, and tty2. We launch an instance of /bin/sh in each one. You switch between them with Alt+1/2/3 How very very cool :^)
2018-10-30 14:33:37 +00:00
}
AK: Rename the common integer typedefs to make it obvious what they are. These types can be picked up by including <AK/Types.h>: * u8, u16, u32, u64 (unsigned) * i8, i16, i32, i64 (signed)
2019-07-03 19:17:35 +00:00
ssize_t Process::sys$read(int fd, u8* buffer, ssize_t size)
Import the "gerbert" kernel I worked on earlier this year. It's a lot crappier than I remembered it. It's gonna need a lot of work.
2018-10-16 09:01:38 +00:00
{
ping: Use pledge()
2020-01-11 19:48:43 +00:00
REQUIRE_PROMISE(stdio);
Kernel: Make syscalls that take a buffer size use ssize_t instead of size_t. Dealing with the unsigned overflow propagation here just seems unreasonably error prone. Let's limit ourselves to 2GB buffer sizes instead.
2019-02-25 20:19:57 +00:00
if (size < 0)
return -EINVAL;
Kernel: "Succeed" quietly for zero-length read() and write().
2019-04-27 14:17:24 +00:00
if (size == 0)
return 0;
Kernel: Make syscalls that take a buffer size use ssize_t instead of size_t. Dealing with the unsigned overflow propagation here just seems unreasonably error prone. Let's limit ourselves to 2GB buffer sizes instead.
2019-02-25 20:19:57 +00:00
if (!validate_write(buffer, size))
Improve syscall address validation a bit.
2018-11-16 15:10:59 +00:00
return -EFAULT;
Lots of hacking: - Turn Keyboard into a CharacterDevice (85,1) at /dev/keyboard. - Implement MM::unmapRegionsForTask() and MM::unmapRegion() - Save SS correctly on interrupt. - Add a simple Spawn syscall for launching another process. - Move a bunch of IO syscall debug output behind DEBUG_IO. - Have ASSERT do a "cli" immediately when failing. This makes the output look proper every time. - Implement a bunch of syscalls in LibC. - Add a simple shell ("sh"). All it can do now is read a line of text from /dev/keyboard and then try launching the specified executable by calling spawn(). There are definitely bugs in here, but we're moving on forward.
2018-10-23 08:12:50 +00:00
#ifdef DEBUG_IO
Kernel: Simplify some dbg() logging We don't have to log the process name/PID/TID, dbg() automatically adds that as a prefix to every line. Also we don't have to do .characters() on Strings passed to dbg() :^)
2020-02-29 11:51:44 +00:00
dbg() << "sys$read(" << fd << ", " << (const void*)buffer << ", " << size << ")";
Lots of hacking: - Turn Keyboard into a CharacterDevice (85,1) at /dev/keyboard. - Implement MM::unmapRegionsForTask() and MM::unmapRegion() - Save SS correctly on interrupt. - Add a simple Spawn syscall for launching another process. - Move a bunch of IO syscall debug output behind DEBUG_IO. - Have ASSERT do a "cli" immediately when failing. This makes the output look proper every time. - Implement a bunch of syscalls in LibC. - Add a simple shell ("sh"). All it can do now is read a line of text from /dev/keyboard and then try launching the specified executable by calling spawn(). There are definitely bugs in here, but we're moving on forward.
2018-10-23 08:12:50 +00:00
#endif
Kernel: Make Process::file_description() vend a RefPtr<FileDescription> This encourages callers to strongly reference file descriptions while working with them. This fixes a use-after-free issue where one thread would close() an open fd while another thread was blocked on it becoming readable. Test: Kernel/uaf-close-while-blocked-in-read.cpp
2020-01-07 14:53:42 +00:00
auto description = file_description(fd);
Kernel: Rename "descriptor" to "description" where appropriate. Now that FileDescription is called that, variables of that type should not be called "descriptor". This is kinda wordy but we'll get used to it.
2019-06-13 20:03:04 +00:00
if (!description)
Virtual consoles kinda work! We now make three VirtualConsoles at boot: tty0, tty1, and tty2. We launch an instance of /bin/sh in each one. You switch between them with Alt+1/2/3 How very very cool :^)
2018-10-30 14:33:37 +00:00
return -EBADF;
Kernel: read() and write() should fail with EBADF for wrong mode fd's It was previously possible to write to read-only file descriptors, and read from write-only file descriptors. All FileDescription objects now start out non-readable + non-writable, and whoever is creating them has to "manually" enable reading/writing by calling set_readable() and/or set_writable() on them.
2020-01-03 02:29:59 +00:00
if (!description->is_readable())
return -EBADF;
Kernel: Return error when attempting to read from a directory. We now return EISDIR whenever a program attempts to call sys$read on a directory. Previously, attempting to read a directory could either return junk data or, in the case of /proc/, cause a kernel panic.
2019-10-24 13:46:31 +00:00
if (description->is_directory())
return -EISDIR;
Kernel: Rename "descriptor" to "description" where appropriate. Now that FileDescription is called that, variables of that type should not be called "descriptor". This is kinda wordy but we'll get used to it.
2019-06-13 20:03:04 +00:00
if (description->is_blocking()) {
if (!description->can_read()) {
Kernel: Replace "current" with Thread::current and Process::current Suggested by Sergey. The currently running Thread and Process are now Thread::current and Process::current respectively. :^)
2020-02-17 14:04:27 +00:00
if (Thread::current->block<Thread::ReadBlocker>(*description) != Thread::BlockResult::WokeNormally)
Implement sending signals to blocked-in-kernel processes. This is dirty but pretty cool! If we have a pending, unmasked signal for a process that's blocked inside the kernel, we set up alternate stacks for that process and unblock it to execute the signal handler. A slightly different return trampoline is used here: since we need to get back into the kernel, a dedicated syscall is used (sys$sigreturn.) This restores the TSS contents of the process to the state it was in while we were originally blocking in the kernel. NOTE: There's currently only one "kernel resume TSS" so signal nesting definitely won't work.
2018-11-07 20:19:47 +00:00
return -EINTR;
Kernel: read()/write() should respect timeouts when used on a sockets Move timeout management to the ReadBlocker and WriteBlocker classes. Also get rid of the specialized ReceiveBlocker since it no longer does anything that ReadBlocker can't do.
2020-01-26 16:54:23 +00:00
if (!description->can_read())
return -EAGAIN;
Implement a basic way for read() to block. FileHandle gets a hasDataAvailableForRead() getter. If this returns true in sys$read(), the task will block(BlockedRead) + yield. The fd blocked on is stored in Task::m_fdBlockedOnRead. The scheduler then looks at the state of that fd during the unblock phase. This makes "sh" restful. :^) There's still some problem with the kernel not surviving the colonel task getting scheduled. I need to figure that out and fix it.
2018-10-25 11:07:59 +00:00
}
}
Kernel: Rename "descriptor" to "description" where appropriate. Now that FileDescription is called that, variables of that type should not be called "descriptor". This is kinda wordy but we'll get used to it.
2019-06-13 20:03:04 +00:00
return description->read(buffer, size);
Import the "gerbert" kernel I worked on earlier this year. It's a lot crappier than I remembered it. It's gonna need a lot of work.
2018-10-16 09:01:38 +00:00
}
Process now maps regions immediately when they are allocated. This avoids having to do a separate MM.mapRegionsForTask() pass. Also, more Task => Process renaming that I apparently hadn't saved yet.
2018-11-01 12:15:46 +00:00
int Process::sys$close(int fd)
Import the "gerbert" kernel I worked on earlier this year. It's a lot crappier than I remembered it. It's gonna need a lot of work.
2018-10-16 09:01:38 +00:00
{
ping: Use pledge()
2020-01-11 19:48:43 +00:00
REQUIRE_PROMISE(stdio);
Kernel: Make Process::file_description() vend a RefPtr<FileDescription> This encourages callers to strongly reference file descriptions while working with them. This fixes a use-after-free issue where one thread would close() an open fd while another thread was blocked on it becoming readable. Test: Kernel/uaf-close-while-blocked-in-read.cpp
2020-01-07 14:53:42 +00:00
auto description = file_description(fd);
WindowServer: Port to the new IPC system This patch introduces code generation for the WindowServer IPC with its clients. The client/server endpoints are defined by the two .ipc files in Servers/WindowServer/: WindowServer.ipc and WindowClient.ipc It now becomes significantly easier to add features and capabilities to WindowServer since you don't have to know nearly as much about all the intricate paths that IPC messages take between LibGUI and WSWindow. The new system also uses significantly less IPC bandwidth since we're now doing packed serialization instead of passing fixed-sized structs of ~600 bytes for each message. Some repaint coalescing optimizations are lost in this conversion and we'll need to look at how to implement those in the new world. The old CoreIPC::Client::Connection and CoreIPC::Server::Connection classes are removed by this patch and replaced by use of ConnectionNG, which will be renamed eventually. Goodbye, old WindowServer IPC. You served us well :^)
2019-12-02 08:33:37 +00:00
#ifdef DEBUG_IO
Kernel: Simplify some dbg() logging We don't have to log the process name/PID/TID, dbg() automatically adds that as a prefix to every line. Also we don't have to do .characters() on Strings passed to dbg() :^)
2020-02-29 11:51:44 +00:00
dbg() << "sys$close(" << fd << ") " << description.ptr();
WindowServer: Port to the new IPC system This patch introduces code generation for the WindowServer IPC with its clients. The client/server endpoints are defined by the two .ipc files in Servers/WindowServer/: WindowServer.ipc and WindowClient.ipc It now becomes significantly easier to add features and capabilities to WindowServer since you don't have to know nearly as much about all the intricate paths that IPC messages take between LibGUI and WSWindow. The new system also uses significantly less IPC bandwidth since we're now doing packed serialization instead of passing fixed-sized structs of ~600 bytes for each message. Some repaint coalescing optimizations are lost in this conversion and we'll need to look at how to implement those in the new world. The old CoreIPC::Client::Connection and CoreIPC::Server::Connection classes are removed by this patch and replaced by use of ConnectionNG, which will be renamed eventually. Goodbye, old WindowServer IPC. You served us well :^)
2019-12-02 08:33:37 +00:00
#endif
Kernel: Rename "descriptor" to "description" where appropriate. Now that FileDescription is called that, variables of that type should not be called "descriptor". This is kinda wordy but we'll get used to it.
2019-06-13 20:03:04 +00:00
if (!description)
Add sys$ttyname_r and ttyname_r() + ttyname(). And print a greeting when sh starts up so we know which TTY we're on.
2018-10-30 21:03:02 +00:00
return -EBADF;
Kernel: Rename "descriptor" to "description" where appropriate. Now that FileDescription is called that, variables of that type should not be called "descriptor". This is kinda wordy but we'll get used to it.
2019-06-13 20:03:04 +00:00
int rc = description->close();
Kernel: Run clang-format on everything.
2019-06-07 09:43:58 +00:00
m_fds[fd] = {};
Add a /proc/PID/fds text files that lists all the fds open in a process.
2018-11-01 13:00:28 +00:00
return rc;
Import the "gerbert" kernel I worked on earlier this year. It's a lot crappier than I remembered it. It's gonna need a lot of work.
2018-10-16 09:01:38 +00:00
}
Kernel: Make utime() take path+length, remove SmapDisabler
2020-01-06 11:23:30 +00:00
int Process::sys$utime(const char* user_path, size_t path_length, const utimbuf* user_buf)
Implement utime() along with a naive /bin/touch. This synchronous approach to inodes is silly, obviously. I need to rework it so that the in-memory CoreInode object is the canonical inode, and then we just need a sync() that flushes pending changes to disk.
2018-12-19 20:14:55 +00:00
{
ping: Use pledge()
2020-01-11 19:48:43 +00:00
REQUIRE_PROMISE(fattr);
Kernel: Make utime() take path+length, remove SmapDisabler
2020-01-06 11:23:30 +00:00
if (user_buf && !validate_read_typed(user_buf))
Implement utime() along with a naive /bin/touch. This synchronous approach to inodes is silly, obviously. I need to rework it so that the in-memory CoreInode object is the canonical inode, and then we just need a sync() that flushes pending changes to disk.
2018-12-19 20:14:55 +00:00
return -EFAULT;
Kernel: Make utime() take path+length, remove SmapDisabler
2020-01-06 11:23:30 +00:00
auto path = get_syscall_path_argument(user_path, path_length);
if (path.is_error())
return path.error();
utimbuf buf;
if (user_buf) {
Kernel: Use the templated copy_from_user where possible Now that the templated version of copy_from_user exists their is normally no reason to use the version which takes the number of bytes to copy. Move to the templated version where possible.
2020-01-13 07:00:35 +00:00
copy_from_user(&buf, user_buf);
Implement utime() along with a naive /bin/touch. This synchronous approach to inodes is silly, obviously. I need to rework it so that the in-memory CoreInode object is the canonical inode, and then we just need a sync() that flushes pending changes to disk.
2018-12-19 20:14:55 +00:00
} else {
Kernel: Make utime() take path+length, remove SmapDisabler
2020-01-06 11:23:30 +00:00
auto now = kgettimeofday();
buf = { now.tv_sec, now.tv_sec };
Implement utime() along with a naive /bin/touch. This synchronous approach to inodes is silly, obviously. I need to rework it so that the in-memory CoreInode object is the canonical inode, and then we just need a sync() that flushes pending changes to disk.
2018-12-19 20:14:55 +00:00
}
Kernel: Make utime() take path+length, remove SmapDisabler
2020-01-06 11:23:30 +00:00
return VFS::the().utime(path.value(), current_directory(), buf.actime, buf.modtime);
Implement utime() along with a naive /bin/touch. This synchronous approach to inodes is silly, obviously. I need to rework it so that the in-memory CoreInode object is the canonical inode, and then we just need a sync() that flushes pending changes to disk.
2018-12-19 20:14:55 +00:00
}
Kernel: Make access() take path+length Also, let's return EFAULT for nullptr at the LibC layer. We can't do all bad addresses this way, but we can at least do null. :^)
2020-01-06 09:43:53 +00:00
int Process::sys$access(const char* user_path, size_t path_length, int mode)
A bunch of compat work (mostly stubs but some real implementations, too.) Another pass at getting bash-1.14.7 to build. Not that many symbols remain.
2018-11-10 23:20:53 +00:00
{
ping: Use pledge()
2020-01-11 19:48:43 +00:00
REQUIRE_PROMISE(rpath);
Kernel: Use get_syscall_path_argument() for syscalls that take paths
2020-01-06 10:10:38 +00:00
auto path = get_syscall_path_argument(user_path, path_length);
if (path.is_error())
return path.error();
return VFS::the().access(path.value(), mode, current_directory());
A bunch of compat work (mostly stubs but some real implementations, too.) Another pass at getting bash-1.14.7 to build. Not that many symbols remain.
2018-11-10 23:20:53 +00:00
}
AK: Rename the common integer typedefs to make it obvious what they are. These types can be picked up by including <AK/Types.h>: * u8, u16, u32, u64 (unsigned) * i8, i16, i32, i64 (signed)
2019-07-03 19:17:35 +00:00
int Process::sys$fcntl(int fd, int cmd, u32 arg)
Stub out a bunch more functions to get closer to that sweet bash build.
2018-11-11 09:38:33 +00:00
{
ping: Use pledge()
2020-01-11 19:48:43 +00:00
REQUIRE_PROMISE(stdio);
Kernel: Put fcntl() debug spam behind DEBUG_IO
2020-01-12 08:59:04 +00:00
#ifdef DEBUG_IO
Process: Use dbg() instead of dbgprintf() Also, fix a bad derefernce in sys$create_shared_buffer() method.
2020-02-24 22:13:33 +00:00
dbg() << "sys$fcntl: fd=" << fd << ", cmd=" << cmd << ", arg=" << arg;
Kernel: Put fcntl() debug spam behind DEBUG_IO
2020-01-12 08:59:04 +00:00
#endif
Kernel: Make Process::file_description() vend a RefPtr<FileDescription> This encourages callers to strongly reference file descriptions while working with them. This fixes a use-after-free issue where one thread would close() an open fd while another thread was blocked on it becoming readable. Test: Kernel/uaf-close-while-blocked-in-read.cpp
2020-01-07 14:53:42 +00:00
auto description = file_description(fd);
Kernel: Rename "descriptor" to "description" where appropriate. Now that FileDescription is called that, variables of that type should not be called "descriptor". This is kinda wordy but we'll get used to it.
2019-06-13 20:03:04 +00:00
if (!description)
Stub out a bunch more functions to get closer to that sweet bash build.
2018-11-11 09:38:33 +00:00
return -EBADF;
Kernel: Rename FileDescriptor to FileDescription. After reading a bunch of POSIX specs, I've learned that a file descriptor is the number that refers to a file description, not the description itself. So this patch renames FileDescriptor to FileDescription, and Process now has FileDescription* file_description(int fd).
2019-06-07 07:36:51 +00:00
// NOTE: The FD flags are not shared between FileDescription objects.
Add close-on-exec flag for file descriptors. I was surprised to find that dup()'ed fds don't share the close-on-exec flag. That means it has to be stored separately from the FileDescriptor object.
2018-11-13 00:36:31 +00:00
// This means that dup() doesn't copy the FD_CLOEXEC flag!
Rage hacking to get bash to run. It finally runs. So cool! :^)
2018-11-11 14:36:40 +00:00
switch (cmd) {
Add fcntl() F_DUPFD which is slightly different from dup2().
2018-11-16 21:14:40 +00:00
case F_DUPFD: {
int arg_fd = (int)arg;
if (arg_fd < 0)
return -EINVAL;
Kernel: Use alloc_fd() more instead of walking fd list manually.
2019-04-06 12:54:32 +00:00
int new_fd = alloc_fd(arg_fd);
if (new_fd < 0)
return new_fd;
Kernel: Rename "descriptor" to "description" where appropriate. Now that FileDescription is called that, variables of that type should not be called "descriptor". This is kinda wordy but we'll get used to it.
2019-06-13 20:03:04 +00:00
m_fds[new_fd].set(*description);
Kernel: Return new fd from sys$fcntl(F_DUPFD) This fixes GNU Bash getting confused after performing a redirection.
2020-01-20 12:15:24 +00:00
return new_fd;
Add fcntl() F_DUPFD which is slightly different from dup2().
2018-11-16 21:14:40 +00:00
}
Rage hacking to get bash to run. It finally runs. So cool! :^)
2018-11-11 14:36:40 +00:00
case F_GETFD:
Add close-on-exec flag for file descriptors. I was surprised to find that dup()'ed fds don't share the close-on-exec flag. That means it has to be stored separately from the FileDescriptor object.
2018-11-13 00:36:31 +00:00
return m_fds[fd].flags;
Rage hacking to get bash to run. It finally runs. So cool! :^)
2018-11-11 14:36:40 +00:00
case F_SETFD:
Add close-on-exec flag for file descriptors. I was surprised to find that dup()'ed fds don't share the close-on-exec flag. That means it has to be stored separately from the FileDescriptor object.
2018-11-13 00:36:31 +00:00
m_fds[fd].flags = arg;
break;
Rage hacking to get bash to run. It finally runs. So cool! :^)
2018-11-11 14:36:40 +00:00
case F_GETFL:
Kernel: Rename "descriptor" to "description" where appropriate. Now that FileDescription is called that, variables of that type should not be called "descriptor". This is kinda wordy but we'll get used to it.
2019-06-13 20:03:04 +00:00
return description->file_flags();
Rage hacking to get bash to run. It finally runs. So cool! :^)
2018-11-11 14:36:40 +00:00
case F_SETFL:
Kernel: Rename "descriptor" to "description" where appropriate. Now that FileDescription is called that, variables of that type should not be called "descriptor". This is kinda wordy but we'll get used to it.
2019-06-13 20:03:04 +00:00
description->set_file_flags(arg);
Add close-on-exec flag for file descriptors. I was surprised to find that dup()'ed fds don't share the close-on-exec flag. That means it has to be stored separately from the FileDescriptor object.
2018-11-13 00:36:31 +00:00
break;
Rage hacking to get bash to run. It finally runs. So cool! :^)
2018-11-11 14:36:40 +00:00
default:
ASSERT_NOT_REACHED();
}
return 0;
Stub out a bunch more functions to get closer to that sweet bash build.
2018-11-11 09:38:33 +00:00
}
Kernel: Get rid of SmapDisabler in sys$fstat()
2020-03-10 12:34:24 +00:00
int Process::sys$fstat(int fd, stat* user_statbuf)
A bunch of compat work (mostly stubs but some real implementations, too.) Another pass at getting bash-1.14.7 to build. Not that many symbols remain.
2018-11-10 23:20:53 +00:00
{
ping: Use pledge()
2020-01-11 19:48:43 +00:00
REQUIRE_PROMISE(stdio);
Kernel: Get rid of SmapDisabler in sys$fstat()
2020-03-10 12:34:24 +00:00
if (!validate_write_typed(user_statbuf))
Improve syscall address validation a bit.
2018-11-16 15:10:59 +00:00
return -EFAULT;
Kernel: Make Process::file_description() vend a RefPtr<FileDescription> This encourages callers to strongly reference file descriptions while working with them. This fixes a use-after-free issue where one thread would close() an open fd while another thread was blocked on it becoming readable. Test: Kernel/uaf-close-while-blocked-in-read.cpp
2020-01-07 14:53:42 +00:00
auto description = file_description(fd);
Kernel: Rename "descriptor" to "description" where appropriate. Now that FileDescription is called that, variables of that type should not be called "descriptor". This is kinda wordy but we'll get used to it.
2019-06-13 20:03:04 +00:00
if (!description)
A bunch of compat work (mostly stubs but some real implementations, too.) Another pass at getting bash-1.14.7 to build. Not that many symbols remain.
2018-11-10 23:20:53 +00:00
return -EBADF;
Kernel: Get rid of SmapDisabler in sys$fstat()
2020-03-10 12:34:24 +00:00
stat buffer;
memset(&buffer, 0, sizeof(buffer));
int rc = description->fstat(buffer);
copy_to_user(user_statbuf, &buffer);
return rc;
A bunch of compat work (mostly stubs but some real implementations, too.) Another pass at getting bash-1.14.7 to build. Not that many symbols remain.
2018-11-10 23:20:53 +00:00
}
Kernel+LibC: Merge sys$stat() and sys$lstat() There is now only one sys$stat() instead of two separate syscalls.
2020-02-10 18:32:40 +00:00
int Process::sys$stat(const Syscall::SC_stat_params* user_params)
Add an lstat() syscall and use it to make "ls" nicer.
2018-10-24 11:19:36 +00:00
{
ping: Use pledge()
2020-01-11 19:48:43 +00:00
REQUIRE_PROMISE(rpath);
Kernel+LibC: Merge sys$stat() and sys$lstat() There is now only one sys$stat() instead of two separate syscalls.
2020-02-10 18:32:40 +00:00
Syscall::SC_stat_params params;
if (!validate_read_and_copy_typed(&params, user_params))
Improve syscall address validation a bit.
2018-11-16 15:10:59 +00:00
return -EFAULT;
Kernel+LibC: Merge sys$stat() and sys$lstat() There is now only one sys$stat() instead of two separate syscalls.
2020-02-10 18:32:40 +00:00
if (!validate_write_typed(params.statbuf))
Improve syscall address validation a bit.
2018-11-16 15:10:59 +00:00
return -EFAULT;
Kernel+LibC: Merge sys$stat() and sys$lstat() There is now only one sys$stat() instead of two separate syscalls.
2020-02-10 18:32:40 +00:00
auto path = get_syscall_path_argument(params.path);
Kernel: Use get_syscall_path_argument() for syscalls that take paths
2020-01-06 10:10:38 +00:00
if (path.is_error())
return path.error();
Kernel+LibC: Merge sys$stat() and sys$lstat() There is now only one sys$stat() instead of two separate syscalls.
2020-02-10 18:32:40 +00:00
auto metadata_or_error = VFS::the().lookup_metadata(path.value(), current_directory(), params.follow_symlinks ? 0 : O_NOFOLLOW_NOERROR);
Kernel: Generalize VFS metadata lookup and use it in mount() and stat() Refactored VFS::stat() into VFS::lookup_metadata(), which can now be used for general VFS metadata lookup by path.
2019-08-02 17:23:23 +00:00
if (metadata_or_error.is_error())
return metadata_or_error.error();
Kernel: Remove SmapDisablers in stat() and lstat()
2020-01-06 11:13:48 +00:00
stat statbuf;
auto result = metadata_or_error.value().stat(statbuf);
if (result.is_error())
return result;
Kernel+LibC: Merge sys$stat() and sys$lstat() There is now only one sys$stat() instead of two separate syscalls.
2020-02-10 18:32:40 +00:00
copy_to_user(params.statbuf, &statbuf);
Kernel: Remove SmapDisablers in stat() and lstat()
2020-01-06 11:13:48 +00:00
return 0;
More LibC portability work while trying to get figlet building.
2018-10-31 09:14:56 +00:00
}
Kernel: Pass characters+length to readlink() Note that I'm developing some helper types in the Syscall namespace as I go here. Once I settle on some nice types, I will convert all the other syscalls to use them as well.
2020-01-10 19:13:23 +00:00
template<typename DataType, typename SizeType>
bool Process::validate(const Syscall::MutableBufferArgument<DataType, SizeType>& buffer)
Add basic symlink support. - sys$readlink + readlink() - Add a /proc/PID/exe symlink to the process's executable. - Print symlink contents in ls output. - Some work on plumbing options into VFS::open().
2018-10-28 13:11:51 +00:00
{
Kernel: Pass characters+length to readlink() Note that I'm developing some helper types in the Syscall namespace as I go here. Once I settle on some nice types, I will convert all the other syscalls to use them as well.
2020-01-10 19:13:23 +00:00
return validate_write(buffer.data, buffer.size);
}
Kernel: Use the Syscall string and buffer types more While I was updating syscalls to stop passing null-terminated strings, I added some helpful struct types: - StringArgument { const char*; size_t; } - ImmutableBuffer<Data, Size> { const Data*; Size; } - MutableBuffer<Data, Size> { Data*; Size; } The Process class has some convenience functions for validating and optionally extracting the contents from these structs: - get_syscall_path_argument(StringArgument) - validate_and_copy_string_from_user(StringArgument) - validate(ImmutableBuffer) - validate(MutableBuffer) There's still so much code around this and I'm wondering if we should generate most of it instead. Possible nice little project.
2020-01-11 11:47:47 +00:00
template<typename DataType, typename SizeType>
bool Process::validate(const Syscall::ImmutableBufferArgument<DataType, SizeType>& buffer)
{
return validate_read(buffer.data, buffer.size);
}
String Process::validate_and_copy_string_from_user(const char* user_characters, size_t user_length) const
Kernel: Pass characters+length to link()
2020-01-10 20:26:47 +00:00
{
Kernel: Add a basic implementation of unveil() This syscall is a complement to pledge() and adds the same sort of incremental relinquishing of capabilities for filesystem access. The first call to unveil() will "drop a veil" on the process, and from now on, only unveiled parts of the filesystem are visible to it. Each call to unveil() specifies a path to either a directory or a file along with permissions for that path. The permissions are a combination of the following: - r: Read access (like the "rpath" promise) - w: Write access (like the "wpath" promise) - x: Execute access - c: Create/remove access (like the "cpath" promise) Attempts to open a path that has not been unveiled with fail with ENOENT. If the unveiled path lacks sufficient permissions, it will fail with EACCES. Like pledge(), subsequent calls to unveil() with the same path can only remove permissions, not add them. Once you call unveil(nullptr, nullptr), the veil is locked, and it's no longer possible to unveil any more paths for the process, ever. This concept comes from OpenBSD, and their implementation does various things differently, I'm sure. This is just a first implementation for SerenityOS, and we'll keep improving on it as we go. :^)
2020-01-20 21:12:04 +00:00
if (user_length == 0)
return String::empty();
Kernel: Allow empty strings in validate_and_copy_string_from_user() Sergey pointed out that we should just allow empty strings everywhere.
2020-01-25 13:14:11 +00:00
if (!user_characters)
return {};
Kernel: Use the Syscall string and buffer types more While I was updating syscalls to stop passing null-terminated strings, I added some helpful struct types: - StringArgument { const char*; size_t; } - ImmutableBuffer<Data, Size> { const Data*; Size; } - MutableBuffer<Data, Size> { Data*; Size; } The Process class has some convenience functions for validating and optionally extracting the contents from these structs: - get_syscall_path_argument(StringArgument) - validate_and_copy_string_from_user(StringArgument) - validate(ImmutableBuffer) - validate(MutableBuffer) There's still so much code around this and I'm wondering if we should generate most of it instead. Possible nice little project.
2020-01-11 11:47:47 +00:00
if (!validate_read(user_characters, user_length))
Kernel: Pass characters+length to link()
2020-01-10 20:26:47 +00:00
return {};
SmapDisabler disabler;
Kernel: Use the Syscall string and buffer types more While I was updating syscalls to stop passing null-terminated strings, I added some helpful struct types: - StringArgument { const char*; size_t; } - ImmutableBuffer<Data, Size> { const Data*; Size; } - MutableBuffer<Data, Size> { Data*; Size; } The Process class has some convenience functions for validating and optionally extracting the contents from these structs: - get_syscall_path_argument(StringArgument) - validate_and_copy_string_from_user(StringArgument) - validate(ImmutableBuffer) - validate(MutableBuffer) There's still so much code around this and I'm wondering if we should generate most of it instead. Possible nice little project.
2020-01-11 11:47:47 +00:00
size_t measured_length = strnlen(user_characters, user_length);
return String(user_characters, measured_length);
}
String Process::validate_and_copy_string_from_user(const Syscall::StringArgument& string) const
{
return validate_and_copy_string_from_user(string.characters, string.length);
Kernel: Pass characters+length to link()
2020-01-10 20:26:47 +00:00
}
Kernel: Pass characters+length to readlink() Note that I'm developing some helper types in the Syscall namespace as I go here. Once I settle on some nice types, I will convert all the other syscalls to use them as well.
2020-01-10 19:13:23 +00:00
int Process::sys$readlink(const Syscall::SC_readlink_params* user_params)
{
ping: Use pledge()
2020-01-11 19:48:43 +00:00
REQUIRE_PROMISE(rpath);
Kernel: Combine validate and copy of user mode pointers (#1069) Right now there is a significant amount of boiler plate code required to validate user mode parameters in syscalls. In an attempt to reduce this a bit, introduce validate_read_and_copy_typed which combines the usermode address check and does the copy internally if the validation passes. This cleans up a little bit of code from a significant amount of syscalls.
2020-01-13 10:19:18 +00:00
Kernel: Pass characters+length to readlink() Note that I'm developing some helper types in the Syscall namespace as I go here. Once I settle on some nice types, I will convert all the other syscalls to use them as well.
2020-01-10 19:13:23 +00:00
Syscall::SC_readlink_params params;
Kernel: Combine validate and copy of user mode pointers (#1069) Right now there is a significant amount of boiler plate code required to validate user mode parameters in syscalls. In an attempt to reduce this a bit, introduce validate_read_and_copy_typed which combines the usermode address check and does the copy internally if the validation passes. This cleans up a little bit of code from a significant amount of syscalls.
2020-01-13 10:19:18 +00:00
if (!validate_read_and_copy_typed(&params, user_params))
return -EFAULT;
Kernel: Pass characters+length to readlink() Note that I'm developing some helper types in the Syscall namespace as I go here. Once I settle on some nice types, I will convert all the other syscalls to use them as well.
2020-01-10 19:13:23 +00:00
if (!validate(params.buffer))
Improve syscall address validation a bit.
2018-11-16 15:10:59 +00:00
return -EFAULT;
Add basic symlink support. - sys$readlink + readlink() - Add a /proc/PID/exe symlink to the process's executable. - Print symlink contents in ls output. - Some work on plumbing options into VFS::open().
2018-10-28 13:11:51 +00:00
Kernel: Use the Syscall string and buffer types more While I was updating syscalls to stop passing null-terminated strings, I added some helpful struct types: - StringArgument { const char*; size_t; } - ImmutableBuffer<Data, Size> { const Data*; Size; } - MutableBuffer<Data, Size> { Data*; Size; } The Process class has some convenience functions for validating and optionally extracting the contents from these structs: - get_syscall_path_argument(StringArgument) - validate_and_copy_string_from_user(StringArgument) - validate(ImmutableBuffer) - validate(MutableBuffer) There's still so much code around this and I'm wondering if we should generate most of it instead. Possible nice little project.
2020-01-11 11:47:47 +00:00
auto path = get_syscall_path_argument(params.path);
Kernel: Pass characters+length to readlink() Note that I'm developing some helper types in the Syscall namespace as I go here. Once I settle on some nice types, I will convert all the other syscalls to use them as well.
2020-01-10 19:13:23 +00:00
if (path.is_error())
return path.error();
auto result = VFS::the().open(path.value(), O_RDONLY | O_NOFOLLOW_NOERROR, 0, current_directory());
Kernel: Port more code to KResult and KResultOr<T>.
2019-03-06 21:14:31 +00:00
if (result.is_error())
return result.error();
Kernel: Rename "descriptor" to "description" where appropriate. Now that FileDescription is called that, variables of that type should not be called "descriptor". This is kinda wordy but we'll get used to it.
2019-06-13 20:03:04 +00:00
auto description = result.value();
Add basic symlink support. - sys$readlink + readlink() - Add a /proc/PID/exe symlink to the process's executable. - Print symlink contents in ls output. - Some work on plumbing options into VFS::open().
2018-10-28 13:11:51 +00:00
Kernel: Rename "descriptor" to "description" where appropriate. Now that FileDescription is called that, variables of that type should not be called "descriptor". This is kinda wordy but we'll get used to it.
2019-06-13 20:03:04 +00:00
if (!description->metadata().is_symlink())
Add basic symlink support. - sys$readlink + readlink() - Add a /proc/PID/exe symlink to the process's executable. - Print symlink contents in ls output. - Some work on plumbing options into VFS::open().
2018-10-28 13:11:51 +00:00
return -EINVAL;
Kernel: Rename "descriptor" to "description" where appropriate. Now that FileDescription is called that, variables of that type should not be called "descriptor". This is kinda wordy but we'll get used to it.
2019-06-13 20:03:04 +00:00
auto contents = description->read_entire_file();
Add basic symlink support. - sys$readlink + readlink() - Add a /proc/PID/exe symlink to the process's executable. - Print symlink contents in ls output. - Some work on plumbing options into VFS::open().
2018-10-28 13:11:51 +00:00
if (!contents)
return -EIO; // FIXME: Get a more detailed error from VFS.
Kernel: Pass characters+length to readlink() Note that I'm developing some helper types in the Syscall namespace as I go here. Once I settle on some nice types, I will convert all the other syscalls to use them as well.
2020-01-10 19:13:23 +00:00
auto link_target = String::copy(contents);
if (link_target.length() + 1 > params.buffer.size)
return -ENAMETOOLONG;
copy_to_user(params.buffer.data, link_target.characters(), link_target.length() + 1);
Kernel: sys$readlink() should return the number of bytes written out
2020-01-27 20:47:30 +00:00
return link_target.length() + 1;
Add basic symlink support. - sys$readlink + readlink() - Add a /proc/PID/exe symlink to the process's executable. - Print symlink contents in ls output. - Some work on plumbing options into VFS::open().
2018-10-28 13:11:51 +00:00
}
Kernel: Make chdir() take path+length
2020-01-05 21:06:25 +00:00
int Process::sys$chdir(const char* user_path, size_t path_length)
Add a "pwd" utility to userland. It's implemented as a separate process. How cute is that. Tasks now have a current working directory. Spawned tasks inherit their parent task's working directory. Currently everyone just uses "/" as there's no way to chdir().
2018-10-24 12:28:22 +00:00
{
ping: Use pledge()
2020-01-11 19:48:43 +00:00
REQUIRE_PROMISE(rpath);
Kernel: Use get_syscall_path_argument() for syscalls that take paths
2020-01-06 10:10:38 +00:00
auto path = get_syscall_path_argument(user_path, path_length);
if (path.is_error())
return path.error();
auto directory_or_error = VFS::the().open_directory(path.value(), current_directory());
Kernel: Support chdir() to a directory that's executable but not readable. Also the superuser should be allowed to resolve any possible path without getting tripped up by EACCES.
2019-03-01 22:54:07 +00:00
if (directory_or_error.is_error())
return directory_or_error.error();
Kernel: Rename Process::cwd_custody() to Process::current_directory(). ...and executable_custody() to just executable().
2019-05-30 18:23:50 +00:00
m_cwd = *directory_or_error.value();
Add a "pwd" utility to userland. It's implemented as a separate process. How cute is that. Tasks now have a current working directory. Spawned tasks inherit their parent task's working directory. Currently everyone just uses "/" as there's no way to chdir().
2018-10-24 12:28:22 +00:00
return 0;
}
Kernel: Implement fchdir syscall The fchdir() function is equivalent to chdir() except that the directory that is to be the new current working directory is specified by a file descriptor.
2019-09-11 23:18:25 +00:00
int Process::sys$fchdir(int fd)
{
ping: Use pledge()
2020-01-11 19:48:43 +00:00
REQUIRE_PROMISE(stdio);
Kernel: Make Process::file_description() vend a RefPtr<FileDescription> This encourages callers to strongly reference file descriptions while working with them. This fixes a use-after-free issue where one thread would close() an open fd while another thread was blocked on it becoming readable. Test: Kernel/uaf-close-while-blocked-in-read.cpp
2020-01-07 14:53:42 +00:00
auto description = file_description(fd);
Kernel: Implement fchdir syscall The fchdir() function is equivalent to chdir() except that the directory that is to be the new current working directory is specified by a file descriptor.
2019-09-11 23:18:25 +00:00
if (!description)
return -EBADF;
if (!description->is_directory())
ELF: Fail layout when program header hooks return nullptr (#673) ELFLoader::layout() had a "failed" variable that was never set. This patch checks the return value of each hook (alloc/map section and tls) and fails the load if they return null. I also needed to patch Process so that the alloc_section_hook and map_section_hook actually return nullptr when allocating a region fails. Fixes #664 :)
2019-10-20 14:24:42 +00:00
return -ENOTDIR;
Kernel: Implement fchdir syscall The fchdir() function is equivalent to chdir() except that the directory that is to be the new current working directory is specified by a file descriptor.
2019-09-11 23:18:25 +00:00
Kernel: fchdir() should fail for non-searchable directories So sayeth POSIX.
2019-09-13 12:35:18 +00:00
if (!description->metadata().may_execute(*this))
return -EACCES;
Kernel: Implement fchdir syscall The fchdir() function is equivalent to chdir() except that the directory that is to be the new current working directory is specified by a file descriptor.
2019-09-11 23:18:25 +00:00
m_cwd = description->custody();
return 0;
}
Kernel: Make syscalls that take a buffer size use ssize_t instead of size_t. Dealing with the unsigned overflow propagation here just seems unreasonably error prone. Let's limit ourselves to 2GB buffer sizes instead.
2019-02-25 20:19:57 +00:00
int Process::sys$getcwd(char* buffer, ssize_t size)
Implement sys$chdir() and teach sh+ls to cd around and browse different dirs.
2018-10-26 12:24:11 +00:00
{
ping: Use pledge()
2020-01-11 19:48:43 +00:00
REQUIRE_PROMISE(rpath);
Kernel: Make syscalls that take a buffer size use ssize_t instead of size_t. Dealing with the unsigned overflow propagation here just seems unreasonably error prone. Let's limit ourselves to 2GB buffer sizes instead.
2019-02-25 20:19:57 +00:00
if (size < 0)
return -EINVAL;
Improve syscall address validation a bit.
2018-11-16 15:10:59 +00:00
if (!validate_write(buffer, size))
return -EFAULT;
Kernel: Rename Process::cwd_custody() to Process::current_directory(). ...and executable_custody() to just executable().
2019-05-30 18:23:50 +00:00
auto path = current_directory().absolute_path();
AK: Use size_t for the length of strings Using int was a mistake. This patch changes String, StringImpl, StringView and StringBuilder to use size_t instead of int for lengths. Obviously a lot of code needs to change as a result of this.
2019-12-09 16:45:40 +00:00
if ((size_t)size < path.length() + 1)
Implement sys$getcwd properly. Also fixed broken strcpy that didn't copy the null terminator.
2018-10-29 23:06:31 +00:00
return -ERANGE;
Kernel: Start implementing x86 SMAP support Supervisor Mode Access Prevention (SMAP) is an x86 CPU feature that prevents the kernel from accessing userspace memory. With SMAP enabled, trying to read/write a userspace memory address while in the kernel will now generate a page fault. Since it's sometimes necessary to read/write userspace memory, there are two new instructions that quickly switch the protection on/off: STAC (disables protection) and CLAC (enables protection.) These are exposed in kernel code via the stac() and clac() helpers. There's also a SmapDisabler RAII object that can be used to ensure that you don't forget to re-enable protection before returning to userspace code. THis patch also adds copy_to_user(), copy_from_user() and memset_user() which are the "correct" way of doing things. These functions allow us to briefly disable protection for a specific purpose, and then turn it back on immediately after it's done. Going forward all kernel code should be moved to using these and all uses of SmapDisabler are to be considered FIXME's. Note that we're not realizing the full potential of this feature since I've used SmapDisabler quite liberally in this initial bring-up patch.
2020-01-05 17:00:15 +00:00
copy_to_user(buffer, path.characters(), path.length() + 1);
Rage hacking to get bash to run. It finally runs. So cool! :^)
2018-11-11 14:36:40 +00:00
return 0;
Implement sys$chdir() and teach sh+ls to cd around and browse different dirs.
2018-10-26 12:24:11 +00:00
}
Kernel: And some more KResult/KResultOr<T> porting work.
2019-03-06 21:30:13 +00:00
int Process::number_of_open_file_descriptors() const
Preallocate the maximum number of FileHandle pointers (fds) in every process. This could even use a more specific data structure since it doesn't need the grow/shrink capabilities of a vector.
2018-11-01 12:39:28 +00:00
{
Kernel: And some more KResult/KResultOr<T> porting work.
2019-03-06 21:30:13 +00:00
int count = 0;
Kernel: Rename "descriptor" to "description" where appropriate. Now that FileDescription is called that, variables of that type should not be called "descriptor". This is kinda wordy but we'll get used to it.
2019-06-13 20:03:04 +00:00
for (auto& description : m_fds) {
if (description)
Preallocate the maximum number of FileHandle pointers (fds) in every process. This could even use a more specific data structure since it doesn't need the grow/shrink capabilities of a vector.
2018-11-01 12:39:28 +00:00
++count;
}
return count;
}
Kernel: Remove SmapDisablers in open(), openat() and set_thread_name() This patch introduces a helpful copy_string_from_user() function that takes a bounded null-terminated string from userspace memory and copies it into a String object.
2020-01-05 20:51:06 +00:00
int Process::sys$open(const Syscall::SC_open_params* user_params)
Import the "gerbert" kernel I worked on earlier this year. It's a lot crappier than I remembered it. It's gonna need a lot of work.
2018-10-16 09:01:38 +00:00
{
Kernel: Combine validate and copy of user mode pointers (#1069) Right now there is a significant amount of boiler plate code required to validate user mode parameters in syscalls. In an attempt to reduce this a bit, introduce validate_read_and_copy_typed which combines the usermode address check and does the copy internally if the validation passes. This cleans up a little bit of code from a significant amount of syscalls.
2020-01-13 10:19:18 +00:00
Syscall::SC_open_params params;
if (!validate_read_and_copy_typed(&params, user_params))
Kernel: Have the open() syscall take an explicit path length parameter. Instead of computing the path length inside the syscall handler, let the caller do that work. This allows us to implement to new variants of open() and creat(), called open_with_path_length() and creat_with_path_length(). These are suitable for use with e.g StringView.
2019-07-08 18:01:49 +00:00
return -EFAULT;
Kernel: Start implementing x86 SMAP support Supervisor Mode Access Prevention (SMAP) is an x86 CPU feature that prevents the kernel from accessing userspace memory. With SMAP enabled, trying to read/write a userspace memory address while in the kernel will now generate a page fault. Since it's sometimes necessary to read/write userspace memory, there are two new instructions that quickly switch the protection on/off: STAC (disables protection) and CLAC (enables protection.) These are exposed in kernel code via the stac() and clac() helpers. There's also a SmapDisabler RAII object that can be used to ensure that you don't forget to re-enable protection before returning to userspace code. THis patch also adds copy_to_user(), copy_from_user() and memset_user() which are the "correct" way of doing things. These functions allow us to briefly disable protection for a specific purpose, and then turn it back on immediately after it's done. Going forward all kernel code should be moved to using these and all uses of SmapDisabler are to be considered FIXME's. Note that we're not realizing the full potential of this feature since I've used SmapDisabler quite liberally in this initial bring-up patch.
2020-01-05 17:00:15 +00:00
Kernel: Remove SmapDisablers in open(), openat() and set_thread_name() This patch introduces a helpful copy_string_from_user() function that takes a bounded null-terminated string from userspace memory and copies it into a String object.
2020-01-05 20:51:06 +00:00
int dirfd = params.dirfd;
int options = params.options;
u16 mode = params.mode;
Kernel: Fix bad TOCTOU pattern in syscalls that take a parameter struct Our syscall calling convention only allows passing up to 3 arguments in registers. For syscalls that take more arguments, we bake them into a struct and pass a pointer to that struct instead. When doing pointer validation, this is what we would do: 1) Validate the "params" struct 2) Validate "params->some_pointer" 3) ... other stuff ... 4) Use "params->some_pointer" Since the parameter struct is stored in userspace, it can be modified by userspace after validation has completed. This was a recurring pattern in many syscalls that was further hidden by me using structured binding declarations to give convenient local names to things in the parameter struct: auto& [some_pointer, ...] = *params; memcpy(some_pointer, ...); This devilishly makes "some_pointer" look like a local variable but it's actually more like an alias for "params->some_pointer" and will expand to a dereference when accessed! This patch fixes the issues by explicitly copying out each member from the parameter structs before validating them, and then never using the "param" pointers beyond that. Thanks to braindead for finding this bug! :^)
2020-01-05 08:13:00 +00:00
Kernel: Don't allow userspace to sys$open() literal symlinks The O_NOFOLLOW_NOERROR is an internal kernel mechanism used for the implementation of sys$readlink() and sys$lstat(). There is no reason to allow userspace to open symlinks directly.
2020-01-15 20:19:26 +00:00
if (options & O_NOFOLLOW_NOERROR)
return -EINVAL;
Kernel: Add a basic implementation of unveil() This syscall is a complement to pledge() and adds the same sort of incremental relinquishing of capabilities for filesystem access. The first call to unveil() will "drop a veil" on the process, and from now on, only unveiled parts of the filesystem are visible to it. Each call to unveil() specifies a path to either a directory or a file along with permissions for that path. The permissions are a combination of the following: - r: Read access (like the "rpath" promise) - w: Write access (like the "wpath" promise) - x: Execute access - c: Create/remove access (like the "cpath" promise) Attempts to open a path that has not been unveiled with fail with ENOENT. If the unveiled path lacks sufficient permissions, it will fail with EACCES. Like pledge(), subsequent calls to unveil() with the same path can only remove permissions, not add them. Once you call unveil(nullptr, nullptr), the veil is locked, and it's no longer possible to unveil any more paths for the process, ever. This concept comes from OpenBSD, and their implementation does various things differently, I'm sure. This is just a first implementation for SerenityOS, and we'll keep improving on it as we go. :^)
2020-01-20 21:12:04 +00:00
if (options & O_UNLINK_INTERNAL)
return -EINVAL;
Kernel: Make O_RDONLY non-zero Sergey suggested that having a non-zero O_RDONLY would make some things less confusing, and it seems like he's right about that. We can now easily check read/write permissions separately instead of dancing around with the bits. This patch also fixes unveil() validation for O_RDWR which previously forgot to check for "r" permission.
2020-01-21 12:14:26 +00:00
if (options & O_WRONLY)
ping: Use pledge()
2020-01-11 19:48:43 +00:00
REQUIRE_PROMISE(wpath);
Kernel: Make O_RDONLY non-zero Sergey suggested that having a non-zero O_RDONLY would make some things less confusing, and it seems like he's right about that. We can now easily check read/write permissions separately instead of dancing around with the bits. This patch also fixes unveil() validation for O_RDWR which previously forgot to check for "r" permission.
2020-01-21 12:14:26 +00:00
else if (options & O_RDONLY)
ping: Use pledge()
2020-01-11 19:48:43 +00:00
REQUIRE_PROMISE(rpath);
if (options & O_CREAT)
REQUIRE_PROMISE(cpath);
Kernel: open() and openat() should ignore non-permission bits in mode
2020-01-08 12:59:22 +00:00
// Ignore everything except permission bits.
mode &= 04777;
Kernel: Use the Syscall string and buffer types more While I was updating syscalls to stop passing null-terminated strings, I added some helpful struct types: - StringArgument { const char*; size_t; } - ImmutableBuffer<Data, Size> { const Data*; Size; } - MutableBuffer<Data, Size> { Data*; Size; } The Process class has some convenience functions for validating and optionally extracting the contents from these structs: - get_syscall_path_argument(StringArgument) - validate_and_copy_string_from_user(StringArgument) - validate(ImmutableBuffer) - validate(MutableBuffer) There's still so much code around this and I'm wondering if we should generate most of it instead. Possible nice little project.
2020-01-11 11:47:47 +00:00
auto path = get_syscall_path_argument(params.path);
if (path.is_error())
return path.error();
Kernel+LibC: Implement the openat() syscall POSIX's openat() is very similar to open(), except you also provide a file descriptor referring to a directory from which relative paths should be resolved. Passing it the magical fd number AT_FDCWD means "resolve from current directory" (which is indeed also what open() normally does.) This fixes libarchive's bsdtar, since it was trying to do something extremely wrong in the absence of openat() support. The issue has recently been fixed upstream in libarchive: https://github.com/libarchive/libarchive/issues/1239 However, we should have openat() support anyway, so I went ahead and implemented it. :^) Fixes #748.
2019-11-10 12:47:02 +00:00
#ifdef DEBUG_IO
Kernel: Fix bitrotted DEBUG_IO logging
2020-02-21 11:25:40 +00:00
dbg() << "sys$open(dirfd=" << dirfd << ", path=\"" << path.value() << "\", options=" << options << ", mode=" << mode << ")";
Kernel+LibC: Implement the openat() syscall POSIX's openat() is very similar to open(), except you also provide a file descriptor referring to a directory from which relative paths should be resolved. Passing it the magical fd number AT_FDCWD means "resolve from current directory" (which is indeed also what open() normally does.) This fixes libarchive's bsdtar, since it was trying to do something extremely wrong in the absence of openat() support. The issue has recently been fixed upstream in libarchive: https://github.com/libarchive/libarchive/issues/1239 However, we should have openat() support anyway, so I went ahead and implemented it. :^) Fixes #748.
2019-11-10 12:47:02 +00:00
#endif
Kernel: Use alloc_fd() more instead of walking fd list manually.
2019-04-06 12:54:32 +00:00
int fd = alloc_fd();
if (fd < 0)
return fd;
Kernel+LibC: Implement the openat() syscall POSIX's openat() is very similar to open(), except you also provide a file descriptor referring to a directory from which relative paths should be resolved. Passing it the magical fd number AT_FDCWD means "resolve from current directory" (which is indeed also what open() normally does.) This fixes libarchive's bsdtar, since it was trying to do something extremely wrong in the absence of openat() support. The issue has recently been fixed upstream in libarchive: https://github.com/libarchive/libarchive/issues/1239 However, we should have openat() support anyway, so I went ahead and implemented it. :^) Fixes #748.
2019-11-10 12:47:02 +00:00
RefPtr<Custody> base;
if (dirfd == AT_FDCWD) {
base = current_directory();
} else {
Kernel: Make Process::file_description() vend a RefPtr<FileDescription> This encourages callers to strongly reference file descriptions while working with them. This fixes a use-after-free issue where one thread would close() an open fd while another thread was blocked on it becoming readable. Test: Kernel/uaf-close-while-blocked-in-read.cpp
2020-01-07 14:53:42 +00:00
auto base_description = file_description(dirfd);
Kernel+LibC: Implement the openat() syscall POSIX's openat() is very similar to open(), except you also provide a file descriptor referring to a directory from which relative paths should be resolved. Passing it the magical fd number AT_FDCWD means "resolve from current directory" (which is indeed also what open() normally does.) This fixes libarchive's bsdtar, since it was trying to do something extremely wrong in the absence of openat() support. The issue has recently been fixed upstream in libarchive: https://github.com/libarchive/libarchive/issues/1239 However, we should have openat() support anyway, so I went ahead and implemented it. :^) Fixes #748.
2019-11-10 12:47:02 +00:00
if (!base_description)
return -EBADF;
if (!base_description->is_directory())
return -ENOTDIR;
if (!base_description->custody())
return -EINVAL;
base = base_description->custody();
}
Kernel: Use the Syscall string and buffer types more While I was updating syscalls to stop passing null-terminated strings, I added some helpful struct types: - StringArgument { const char*; size_t; } - ImmutableBuffer<Data, Size> { const Data*; Size; } - MutableBuffer<Data, Size> { Data*; Size; } The Process class has some convenience functions for validating and optionally extracting the contents from these structs: - get_syscall_path_argument(StringArgument) - validate_and_copy_string_from_user(StringArgument) - validate(ImmutableBuffer) - validate(MutableBuffer) There's still so much code around this and I'm wondering if we should generate most of it instead. Possible nice little project.
2020-01-11 11:47:47 +00:00
auto result = VFS::the().open(path.value(), options, mode & ~umask(), *base);
Kernel: Port more code to KResult and KResultOr<T>.
2019-03-06 21:14:31 +00:00
if (result.is_error())
return result.error();
Kernel: Rename "descriptor" to "description" where appropriate. Now that FileDescription is called that, variables of that type should not be called "descriptor". This is kinda wordy but we'll get used to it.
2019-06-13 20:03:04 +00:00
auto description = result.value();
AK: Rename the common integer typedefs to make it obvious what they are. These types can be picked up by including <AK/Types.h>: * u8, u16, u32, u64 (unsigned) * i8, i16, i32, i64 (signed)
2019-07-03 19:17:35 +00:00
u32 fd_flags = (options & O_CLOEXEC) ? FD_CLOEXEC : 0;
Kernel: Rename "descriptor" to "description" where appropriate. Now that FileDescription is called that, variables of that type should not be called "descriptor". This is kinda wordy but we'll get used to it.
2019-06-13 20:03:04 +00:00
m_fds[fd].set(move(description), fd_flags);
Add per-task limit for open fd's. Hard-coded at 16 for now.
2018-10-26 12:30:13 +00:00
return fd;
Import the "gerbert" kernel I worked on earlier this year. It's a lot crappier than I remembered it. It's gonna need a lot of work.
2018-10-16 09:01:38 +00:00
}
Kernel: Use alloc_fd() more instead of walking fd list manually.
2019-04-06 12:54:32 +00:00
int Process::alloc_fd(int first_candidate_fd)
Add primitive FIFO and hook it up to sys$pipe(). It's now possible to do this in bash: cat kernel.map | fgrep List This is very cool! :^)
2018-11-12 00:28:46 +00:00
{
Kernel: Use alloc_fd() more instead of walking fd list manually.
2019-04-06 12:54:32 +00:00
for (int i = first_candidate_fd; i < (int)m_max_open_file_descriptors; ++i) {
Kernel: Misc tweaks
2020-01-20 12:18:54 +00:00
if (!m_fds[i])
return i;
Add primitive FIFO and hook it up to sys$pipe(). It's now possible to do this in bash: cat kernel.map | fgrep List This is very cool! :^)
2018-11-12 00:28:46 +00:00
}
Kernel: Misc tweaks
2020-01-20 12:18:54 +00:00
return -EMFILE;
Add primitive FIFO and hook it up to sys$pipe(). It's now possible to do this in bash: cat kernel.map | fgrep List This is very cool! :^)
2018-11-12 00:28:46 +00:00
}
Kernel+LibC: Support passing O_CLOEXEC to pipe() In the userspace, this mimics the Linux pipe2() syscall; in the kernel, the Process::sys$pipe() now always accepts a flags argument, the no-argument pipe() syscall is now a userspace wrapper over pipe2().
2019-08-05 12:29:05 +00:00
int Process::sys$pipe(int pipefd[2], int flags)
A bunch of compat work (mostly stubs but some real implementations, too.) Another pass at getting bash-1.14.7 to build. Not that many symbols remain.
2018-11-10 23:20:53 +00:00
{
ping: Use pledge()
2020-01-11 19:48:43 +00:00
REQUIRE_PROMISE(stdio);
Add templated helpers for read/write validation, and one for strings, too.
2018-11-16 15:23:39 +00:00
if (!validate_write_typed(pipefd))
Improve syscall address validation a bit.
2018-11-16 15:10:59 +00:00
return -EFAULT;
Add primitive FIFO and hook it up to sys$pipe(). It's now possible to do this in bash: cat kernel.map | fgrep List This is very cool! :^)
2018-11-12 00:28:46 +00:00
if (number_of_open_file_descriptors() + 2 > max_open_file_descriptors())
return -EMFILE;
Kernel+LibC: Support passing O_CLOEXEC to pipe() In the userspace, this mimics the Linux pipe2() syscall; in the kernel, the Process::sys$pipe() now always accepts a flags argument, the no-argument pipe() syscall is now a userspace wrapper over pipe2().
2019-08-05 12:29:05 +00:00
// Reject flags other than O_CLOEXEC.
if ((flags & O_CLOEXEC) != flags)
return -EINVAL;
u32 fd_flags = (flags & O_CLOEXEC) ? FD_CLOEXEC : 0;
Kernel: Make it possible to look up FIFO's by ID. This will be useful when implementing the /proc/PID/fd/N links where N is a file descriptor referring to a FIFO.
2019-04-25 11:52:07 +00:00
auto fifo = FIFO::create(m_uid);
Add primitive FIFO and hook it up to sys$pipe(). It's now possible to do this in bash: cat kernel.map | fgrep List This is very cool! :^)
2018-11-12 00:28:46 +00:00
int reader_fd = alloc_fd();
Kernel+LibC: Support passing O_CLOEXEC to pipe() In the userspace, this mimics the Linux pipe2() syscall; in the kernel, the Process::sys$pipe() now always accepts a flags argument, the no-argument pipe() syscall is now a userspace wrapper over pipe2().
2019-08-05 12:29:05 +00:00
m_fds[reader_fd].set(fifo->open_direction(FIFO::Direction::Reader), fd_flags);
Kernel: read() and write() should fail with EBADF for wrong mode fd's It was previously possible to write to read-only file descriptors, and read from write-only file descriptors. All FileDescription objects now start out non-readable + non-writable, and whoever is creating them has to "manually" enable reading/writing by calling set_readable() and/or set_writable() on them.
2020-01-03 02:29:59 +00:00
m_fds[reader_fd].description->set_readable(true);
Kernel: Use the templated copy_to/from_user() in more places These ensure that the "to" and "from" pointers have the same type, and also that we copy the correct number of bytes.
2020-01-20 12:38:31 +00:00
copy_to_user(&pipefd[0], &reader_fd);
Add primitive FIFO and hook it up to sys$pipe(). It's now possible to do this in bash: cat kernel.map | fgrep List This is very cool! :^)
2018-11-12 00:28:46 +00:00
int writer_fd = alloc_fd();
Kernel+LibC: Support passing O_CLOEXEC to pipe() In the userspace, this mimics the Linux pipe2() syscall; in the kernel, the Process::sys$pipe() now always accepts a flags argument, the no-argument pipe() syscall is now a userspace wrapper over pipe2().
2019-08-05 12:29:05 +00:00
m_fds[writer_fd].set(fifo->open_direction(FIFO::Direction::Writer), fd_flags);
Kernel: read() and write() should fail with EBADF for wrong mode fd's It was previously possible to write to read-only file descriptors, and read from write-only file descriptors. All FileDescription objects now start out non-readable + non-writable, and whoever is creating them has to "manually" enable reading/writing by calling set_readable() and/or set_writable() on them.
2020-01-03 02:29:59 +00:00
m_fds[writer_fd].description->set_writable(true);
Kernel: Use the templated copy_to/from_user() in more places These ensure that the "to" and "from" pointers have the same type, and also that we copy the correct number of bytes.
2020-01-20 12:38:31 +00:00
copy_to_user(&pipefd[1], &writer_fd);
Add primitive FIFO and hook it up to sys$pipe(). It's now possible to do this in bash: cat kernel.map | fgrep List This is very cool! :^)
2018-11-12 00:28:46 +00:00
return 0;
A bunch of compat work (mostly stubs but some real implementations, too.) Another pass at getting bash-1.14.7 to build. Not that many symbols remain.
2018-11-10 23:20:53 +00:00
}
int Process::sys$killpg(int pgrp, int signum)
{
ping: Use pledge()
2020-01-11 19:48:43 +00:00
REQUIRE_PROMISE(proc);
A bunch of compat work (mostly stubs but some real implementations, too.) Another pass at getting bash-1.14.7 to build. Not that many symbols remain.
2018-11-10 23:20:53 +00:00
if (signum < 1 || signum >= 32)
return -EINVAL;
Kernel: Implement the killpg() syscall
2019-11-14 16:16:30 +00:00
if (pgrp < 0)
return -EINVAL;
return do_killpg(pgrp, signum);
A bunch of compat work (mostly stubs but some real implementations, too.) Another pass at getting bash-1.14.7 to build. Not that many symbols remain.
2018-11-10 23:20:53 +00:00
}
Kernel+Userland: Implement setuid() and setgid() and add /bin/su Also show setuid and setgid bits in "ls -l" output. :^)
2019-02-21 22:35:07 +00:00
int Process::sys$setuid(uid_t uid)
A bunch of compat work (mostly stubs but some real implementations, too.) Another pass at getting bash-1.14.7 to build. Not that many symbols remain.
2018-11-10 23:20:53 +00:00
{
ping: Use pledge()
2020-01-11 19:48:43 +00:00
REQUIRE_PROMISE(id);
Kernel+Userland: Implement setuid() and setgid() and add /bin/su Also show setuid and setgid bits in "ls -l" output. :^)
2019-02-21 22:35:07 +00:00
if (uid != m_uid && !is_superuser())
return -EPERM;
m_uid = uid;
m_euid = uid;
return 0;
A bunch of compat work (mostly stubs but some real implementations, too.) Another pass at getting bash-1.14.7 to build. Not that many symbols remain.
2018-11-10 23:20:53 +00:00
}
Kernel+Userland: Implement setuid() and setgid() and add /bin/su Also show setuid and setgid bits in "ls -l" output. :^)
2019-02-21 22:35:07 +00:00
int Process::sys$setgid(gid_t gid)
A bunch of compat work (mostly stubs but some real implementations, too.) Another pass at getting bash-1.14.7 to build. Not that many symbols remain.
2018-11-10 23:20:53 +00:00
{
ping: Use pledge()
2020-01-11 19:48:43 +00:00
REQUIRE_PROMISE(id);
Kernel+Userland: Implement setuid() and setgid() and add /bin/su Also show setuid and setgid bits in "ls -l" output. :^)
2019-02-21 22:35:07 +00:00
if (gid != m_gid && !is_superuser())
return -EPERM;
m_gid = gid;
m_egid = gid;
return 0;
A bunch of compat work (mostly stubs but some real implementations, too.) Another pass at getting bash-1.14.7 to build. Not that many symbols remain.
2018-11-10 23:20:53 +00:00
}
unsigned Process::sys$alarm(unsigned seconds)
{
ping: Use pledge()
2020-01-11 19:48:43 +00:00
REQUIRE_PROMISE(stdio);
Kernel: Implement the alarm() syscall.
2019-06-07 09:30:07 +00:00
unsigned previous_alarm_remaining = 0;
if (m_alarm_deadline && m_alarm_deadline > g_uptime) {
Kernel: Introduce the new Time management subsystem This new subsystem includes better abstractions of how time will be handled in the OS. We take advantage of the existing RTC timer to aid in keeping time synchronized. This is standing in contrast to how we handled time-keeping in the kernel, where the PIT was responsible for that function in addition to update the scheduler about ticks. With that new advantage, we can easily change the ticking dynamically and still keep the time synchronized. In the process context, we no longer use a fixed declaration of TICKS_PER_SECOND, but we call the TimeManagement singleton class to provide us the right value. This allows us to use dynamic ticking in the future, a feature known as tickless kernel. The scheduler no longer does by himself the calculation of real time (Unix time), and just calls the TimeManagment singleton class to provide the value. Also, we can use 2 new boot arguments: - the "time" boot argument accpets either the value "modern", or "legacy". If "modern" is specified, the time management subsystem will try to setup HPET. Otherwise, for "legacy" value, the time subsystem will revert to use the PIT & RTC, leaving HPET disabled. If this boot argument is not specified, the default pattern is to try to setup HPET. - the "hpet" boot argumet accepts either the value "periodic" or "nonperiodic". If "periodic" is specified, the HPET will scan for periodic timers, and will assert if none are found. If only one is found, that timer will be assigned for the time-keeping task. If more than one is found, both time-keeping task & scheduler-ticking task will be assigned to periodic timers. If this boot argument is not specified, the default pattern is to try to scan for HPET periodic timers. This boot argument has no effect if HPET is disabled. In hardware context, PIT & RealTimeClock classes are merely inheriting from the HardwareTimer class, and they allow to use the old i8254 (PIT) and RTC devices, managing them via IO ports. By default, the RTC will be programmed to a frequency of 1024Hz. The PIT will be programmed to a frequency close to 1000Hz. About HPET, depending if we need to scan for periodic timers or not, we try to set a frequency close to 1000Hz for the time-keeping timer and scheduler-ticking timer. Also, if possible, we try to enable the Legacy replacement feature of the HPET. This feature if exists, instructs the chipset to disconnect both i8254 (PIT) and RTC. This behavior is observable on QEMU, and was verified against the source code: https://github.com/qemu/qemu/commit/ce967e2f33861b0e17753f97fa4527b5943c94b6 The HPETComparator class is inheriting from HardwareTimer class, and is responsible for an individual HPET comparator, which is essentially a timer. Therefore, it needs to call the singleton HPET class to perform HPET-related operations. The new abstraction of Hardware timers brings an opportunity of more new features in the foreseeable future. For example, we can change the callback function of each hardware timer, thus it makes it possible to swap missions between hardware timers, or to allow to use a hardware timer for other temporary missions (e.g. calibrating the LAPIC timer, measuring the CPU frequency, etc).
2020-03-09 15:03:27 +00:00
previous_alarm_remaining = (m_alarm_deadline - g_uptime) / TimeManagement::the().ticks_per_second();
Kernel: Implement the alarm() syscall.
2019-06-07 09:30:07 +00:00
}
if (!seconds) {
m_alarm_deadline = 0;
return previous_alarm_remaining;
}
Kernel: Introduce the new Time management subsystem This new subsystem includes better abstractions of how time will be handled in the OS. We take advantage of the existing RTC timer to aid in keeping time synchronized. This is standing in contrast to how we handled time-keeping in the kernel, where the PIT was responsible for that function in addition to update the scheduler about ticks. With that new advantage, we can easily change the ticking dynamically and still keep the time synchronized. In the process context, we no longer use a fixed declaration of TICKS_PER_SECOND, but we call the TimeManagement singleton class to provide us the right value. This allows us to use dynamic ticking in the future, a feature known as tickless kernel. The scheduler no longer does by himself the calculation of real time (Unix time), and just calls the TimeManagment singleton class to provide the value. Also, we can use 2 new boot arguments: - the "time" boot argument accpets either the value "modern", or "legacy". If "modern" is specified, the time management subsystem will try to setup HPET. Otherwise, for "legacy" value, the time subsystem will revert to use the PIT & RTC, leaving HPET disabled. If this boot argument is not specified, the default pattern is to try to setup HPET. - the "hpet" boot argumet accepts either the value "periodic" or "nonperiodic". If "periodic" is specified, the HPET will scan for periodic timers, and will assert if none are found. If only one is found, that timer will be assigned for the time-keeping task. If more than one is found, both time-keeping task & scheduler-ticking task will be assigned to periodic timers. If this boot argument is not specified, the default pattern is to try to scan for HPET periodic timers. This boot argument has no effect if HPET is disabled. In hardware context, PIT & RealTimeClock classes are merely inheriting from the HardwareTimer class, and they allow to use the old i8254 (PIT) and RTC devices, managing them via IO ports. By default, the RTC will be programmed to a frequency of 1024Hz. The PIT will be programmed to a frequency close to 1000Hz. About HPET, depending if we need to scan for periodic timers or not, we try to set a frequency close to 1000Hz for the time-keeping timer and scheduler-ticking timer. Also, if possible, we try to enable the Legacy replacement feature of the HPET. This feature if exists, instructs the chipset to disconnect both i8254 (PIT) and RTC. This behavior is observable on QEMU, and was verified against the source code: https://github.com/qemu/qemu/commit/ce967e2f33861b0e17753f97fa4527b5943c94b6 The HPETComparator class is inheriting from HardwareTimer class, and is responsible for an individual HPET comparator, which is essentially a timer. Therefore, it needs to call the singleton HPET class to perform HPET-related operations. The new abstraction of Hardware timers brings an opportunity of more new features in the foreseeable future. For example, we can change the callback function of each hardware timer, thus it makes it possible to swap missions between hardware timers, or to allow to use a hardware timer for other temporary missions (e.g. calibrating the LAPIC timer, measuring the CPU frequency, etc).
2020-03-09 15:03:27 +00:00
m_alarm_deadline = g_uptime + seconds * TimeManagement::the().ticks_per_second();
Kernel: Implement the alarm() syscall.
2019-06-07 09:30:07 +00:00
return previous_alarm_remaining;
A bunch of compat work (mostly stubs but some real implementations, too.) Another pass at getting bash-1.14.7 to build. Not that many symbols remain.
2018-11-10 23:20:53 +00:00
}
Process now maps regions immediately when they are allocated. This avoids having to do a separate MM.mapRegionsForTask() pass. Also, more Task => Process renaming that I apparently hadn't saved yet.
2018-11-01 12:15:46 +00:00
int Process::sys$uname(utsname* buf)
Add sys$uname() and a /bin/uname utility.
2018-10-26 12:56:21 +00:00
{
ping: Use pledge()
2020-01-11 19:48:43 +00:00
REQUIRE_PROMISE(stdio);
Add templated helpers for read/write validation, and one for strings, too.
2018-11-16 15:23:39 +00:00
if (!validate_write_typed(buf))
Improve syscall address validation a bit.
2018-11-16 15:10:59 +00:00
return -EFAULT;
Kernel: Don't disable interrupts to access the system hostname.
2019-02-07 09:29:26 +00:00
LOCKER(*s_hostname_lock);
Kernel: Start implementing x86 SMAP support Supervisor Mode Access Prevention (SMAP) is an x86 CPU feature that prevents the kernel from accessing userspace memory. With SMAP enabled, trying to read/write a userspace memory address while in the kernel will now generate a page fault. Since it's sometimes necessary to read/write userspace memory, there are two new instructions that quickly switch the protection on/off: STAC (disables protection) and CLAC (enables protection.) These are exposed in kernel code via the stac() and clac() helpers. There's also a SmapDisabler RAII object that can be used to ensure that you don't forget to re-enable protection before returning to userspace code. THis patch also adds copy_to_user(), copy_from_user() and memset_user() which are the "correct" way of doing things. These functions allow us to briefly disable protection for a specific purpose, and then turn it back on immediately after it's done. Going forward all kernel code should be moved to using these and all uses of SmapDisabler are to be considered FIXME's. Note that we're not realizing the full potential of this feature since I've used SmapDisabler quite liberally in this initial bring-up patch.
2020-01-05 17:00:15 +00:00
if (s_hostname->length() + 1 > sizeof(utsname::nodename))
return -ENAMETOOLONG;
copy_to_user(buf->sysname, "SerenityOS", 11);
copy_to_user(buf->release, "1.0-dev", 8);
copy_to_user(buf->version, "FIXME", 6);
copy_to_user(buf->machine, "i686", 5);
copy_to_user(buf->nodename, s_hostname->characters(), s_hostname->length() + 1);
Add sys$uname() and a /bin/uname utility.
2018-10-26 12:56:21 +00:00
return 0;
}
Kernel: Implement the killpg() syscall
2019-11-14 16:16:30 +00:00
KResult Process::do_kill(Process& process, int signal)
{
// FIXME: Allow sending SIGCONT to everyone in the process group.
// FIXME: Should setuid processes have some special treatment here?
if (!is_superuser() && m_euid != process.m_uid && m_uid != process.m_uid)
return KResult(-EPERM);
if (process.is_ring0() && signal == SIGKILL) {
Kernel: Use klog() instead of kprintf() Also, duplicate data in dbg() and klog() calls were removed. In addition, leakage of virtual address to kernel log is prevented. This is done by replacing kprintf() calls to dbg() calls with the leaked data instead. Also, other kprintf() calls were replaced with klog().
2020-03-01 19:45:39 +00:00
klog() << "attempted to send SIGKILL to ring 0 process " << process.name().characters() << "(" << process.pid() << ")";
Kernel: Implement the killpg() syscall
2019-11-14 16:16:30 +00:00
return KResult(-EPERM);
}
Kernel: kill() with signal 0 should not actually send anything Also kill() with pid 0 should send to everyone in the same process group as the calling process.
2020-01-03 01:01:45 +00:00
if (signal != 0)
process.send_signal(signal, this);
Kernel: Implement the killpg() syscall
2019-11-14 16:16:30 +00:00
return KSuccess;
}
KResult Process::do_killpg(pid_t pgrp, int signal)
{
Kernel: Always disable interrupts in do_killpg() Will caught an assertion when running "kill 9999999999999" :^)
2020-02-27 10:05:16 +00:00
InterruptDisabler disabler;
Kernel: Implement the killpg() syscall
2019-11-14 16:16:30 +00:00
ASSERT(pgrp >= 0);
// Send the signal to all processes in the given group.
if (pgrp == 0) {
// Send the signal to our own pgrp.
pgrp = pgid();
}
bool group_was_empty = true;
bool any_succeeded = false;
KResult error = KSuccess;
Process::for_each_in_pgrp(pgrp, [&](auto& process) {
group_was_empty = false;
KResult res = do_kill(process, signal);
if (res.is_success())
any_succeeded = true;
else
error = res;
return IterationDecision::Continue;
});
if (group_was_empty)
return KResult(-ESRCH);
if (any_succeeded)
return KSuccess;
return error;
}
Basic ^C interrupt implementation. For testing, I made cat put itself into a new process group. This should eventually be done by sh between fork() and exec().
2018-11-02 13:06:48 +00:00
int Process::sys$kill(pid_t pid, int signal)
Import the "gerbert" kernel I worked on earlier this year. It's a lot crappier than I remembered it. It's gonna need a lot of work.
2018-10-16 09:01:38 +00:00
{
Kernel: Only require "stdio" pledge for sending signals to self This should match what OpenBSD does. Sending a signal to yourself seems basically harmless.
2020-01-19 07:50:55 +00:00
if (pid == m_pid)
REQUIRE_PROMISE(stdio);
else
REQUIRE_PROMISE(proc);
Kernel: Only allow sending signals to process you own.
2019-02-28 10:45:45 +00:00
if (signal < 0 || signal >= 32)
return -EINVAL;
Kernel: Don't assert on sys$kill() with pid=INT32_MIN On 32-bit platforms, INT32_MIN == -INT32_MIN, so we can't expect this to always work: if (pid < 0) positive_pid = -pid; // may still be negative! This happens because the -INT32_MIN expression becomes a long and is then truncated back to an int. Fixes #1312.
2020-02-27 08:58:53 +00:00
if (pid <= 0) {
if (pid == INT32_MIN)
return -EINVAL;
Kernel: Implement the killpg() syscall
2019-11-14 16:16:30 +00:00
return do_killpg(-pid, signal);
Kernel: Don't assert on sys$kill() with pid=INT32_MIN On 32-bit platforms, INT32_MIN == -INT32_MIN, so we can't expect this to always work: if (pid < 0) positive_pid = -pid; // may still be negative! This happens because the -INT32_MIN expression becomes a long and is then truncated back to an int. Fixes #1312.
2020-02-27 08:58:53 +00:00
}
Import the "gerbert" kernel I worked on earlier this year. It's a lot crappier than I remembered it. It's gonna need a lot of work.
2018-10-16 09:01:38 +00:00
if (pid == -1) {
// FIXME: Send to all processes.
Kernel: kill() with signal 0 should not actually send anything Also kill() with pid 0 should send to everyone in the same process group as the calling process.
2020-01-03 01:01:45 +00:00
return -ENOTIMPL;
Import the "gerbert" kernel I worked on earlier this year. It's a lot crappier than I remembered it. It's gonna need a lot of work.
2018-10-16 09:01:38 +00:00
}
Kernel: kill() syscall should support sending a signal to yourself.
2019-02-28 08:44:48 +00:00
if (pid == m_pid) {
Kernel: kill() with signal 0 should not actually send anything Also kill() with pid 0 should send to everyone in the same process group as the calling process.
2020-01-03 01:01:45 +00:00
if (signal == 0)
return 0;
Kernel: Replace "current" with Thread::current and Process::current Suggested by Sergey. The currently running Thread and Process are now Thread::current and Process::current respectively. :^)
2020-02-17 14:04:27 +00:00
if (!Thread::current->should_ignore_signal(signal)) {
Thread::current->send_signal(signal, this);
(void)Thread::current->block<Thread::SemiPermanentBlocker>(Thread::SemiPermanentBlocker::Reason::Signal);
Kernel: kill() with signal 0 should not actually send anything Also kill() with pid 0 should send to everyone in the same process group as the calling process.
2020-01-03 01:01:45 +00:00
}
Kernel: kill() syscall should support sending a signal to yourself.
2019-02-28 08:44:48 +00:00
return 0;
}
Kernel: Only allow sending signals to process you own.
2019-02-28 10:45:45 +00:00
InterruptDisabler disabler;
auto* peer = Process::from_pid(pid);
Implement basic sys$kill() and add a /bin/kill All it can do right now is send SIGKILL which just murders the target task.
2018-10-31 00:06:57 +00:00
if (!peer)
return -ESRCH;
Kernel: Implement the killpg() syscall
2019-11-14 16:16:30 +00:00
return do_kill(*peer, signal);
Import the "gerbert" kernel I worked on earlier this year. It's a lot crappier than I remembered it. It's gonna need a lot of work.
2018-10-16 09:01:38 +00:00
}
Get nyancat nyanning in Serenity. I found a cute program that renders an animated nyancat in the terminal. This patch adds enough hackery to get it working correctly. :^)
2019-02-03 15:11:28 +00:00
int Process::sys$usleep(useconds_t usec)
{
ping: Use pledge()
2020-01-11 19:48:43 +00:00
REQUIRE_PROMISE(stdio);
Get nyancat nyanning in Serenity. I found a cute program that renders an animated nyancat in the terminal. This patch adds enough hackery to get it working correctly. :^)
2019-02-03 15:11:28 +00:00
if (!usec)
return 0;
Kernel: Replace "current" with Thread::current and Process::current Suggested by Sergey. The currently running Thread and Process are now Thread::current and Process::current respectively. :^)
2020-02-17 14:04:27 +00:00
u64 wakeup_time = Thread::current->sleep(usec / 1000);
Kernel: If a process is interrupted during usleep(), return -EINTR
2019-11-06 20:01:44 +00:00
if (wakeup_time > g_uptime)
return -EINTR;
Get nyancat nyanning in Serenity. I found a cute program that renders an animated nyancat in the terminal. This patch adds enough hackery to get it working correctly. :^)
2019-02-03 15:11:28 +00:00
return 0;
}
Process now maps regions immediately when they are allocated. This avoids having to do a separate MM.mapRegionsForTask() pass. Also, more Task => Process renaming that I apparently hadn't saved yet.
2018-11-01 12:15:46 +00:00
int Process::sys$sleep(unsigned seconds)
Add a "sleep" syscall that sleeps for N seconds.
2018-10-25 11:53:49 +00:00
{
ping: Use pledge()
2020-01-11 19:48:43 +00:00
REQUIRE_PROMISE(stdio);
Add a "sleep" syscall that sleeps for N seconds.
2018-10-25 11:53:49 +00:00
if (!seconds)
return 0;
Kernel: Introduce the new Time management subsystem This new subsystem includes better abstractions of how time will be handled in the OS. We take advantage of the existing RTC timer to aid in keeping time synchronized. This is standing in contrast to how we handled time-keeping in the kernel, where the PIT was responsible for that function in addition to update the scheduler about ticks. With that new advantage, we can easily change the ticking dynamically and still keep the time synchronized. In the process context, we no longer use a fixed declaration of TICKS_PER_SECOND, but we call the TimeManagement singleton class to provide us the right value. This allows us to use dynamic ticking in the future, a feature known as tickless kernel. The scheduler no longer does by himself the calculation of real time (Unix time), and just calls the TimeManagment singleton class to provide the value. Also, we can use 2 new boot arguments: - the "time" boot argument accpets either the value "modern", or "legacy". If "modern" is specified, the time management subsystem will try to setup HPET. Otherwise, for "legacy" value, the time subsystem will revert to use the PIT & RTC, leaving HPET disabled. If this boot argument is not specified, the default pattern is to try to setup HPET. - the "hpet" boot argumet accepts either the value "periodic" or "nonperiodic". If "periodic" is specified, the HPET will scan for periodic timers, and will assert if none are found. If only one is found, that timer will be assigned for the time-keeping task. If more than one is found, both time-keeping task & scheduler-ticking task will be assigned to periodic timers. If this boot argument is not specified, the default pattern is to try to scan for HPET periodic timers. This boot argument has no effect if HPET is disabled. In hardware context, PIT & RealTimeClock classes are merely inheriting from the HardwareTimer class, and they allow to use the old i8254 (PIT) and RTC devices, managing them via IO ports. By default, the RTC will be programmed to a frequency of 1024Hz. The PIT will be programmed to a frequency close to 1000Hz. About HPET, depending if we need to scan for periodic timers or not, we try to set a frequency close to 1000Hz for the time-keeping timer and scheduler-ticking timer. Also, if possible, we try to enable the Legacy replacement feature of the HPET. This feature if exists, instructs the chipset to disconnect both i8254 (PIT) and RTC. This behavior is observable on QEMU, and was verified against the source code: https://github.com/qemu/qemu/commit/ce967e2f33861b0e17753f97fa4527b5943c94b6 The HPETComparator class is inheriting from HardwareTimer class, and is responsible for an individual HPET comparator, which is essentially a timer. Therefore, it needs to call the singleton HPET class to perform HPET-related operations. The new abstraction of Hardware timers brings an opportunity of more new features in the foreseeable future. For example, we can change the callback function of each hardware timer, thus it makes it possible to swap missions between hardware timers, or to allow to use a hardware timer for other temporary missions (e.g. calibrating the LAPIC timer, measuring the CPU frequency, etc).
2020-03-09 15:03:27 +00:00
u64 wakeup_time = Thread::current->sleep(seconds * TimeManagement::the().ticks_per_second());
Kernel: Port sleep to ThreadBlocker
2019-07-18 15:26:11 +00:00
if (wakeup_time > g_uptime) {
u32 ticks_left_until_original_wakeup_time = wakeup_time - g_uptime;
Kernel: Introduce the new Time management subsystem This new subsystem includes better abstractions of how time will be handled in the OS. We take advantage of the existing RTC timer to aid in keeping time synchronized. This is standing in contrast to how we handled time-keeping in the kernel, where the PIT was responsible for that function in addition to update the scheduler about ticks. With that new advantage, we can easily change the ticking dynamically and still keep the time synchronized. In the process context, we no longer use a fixed declaration of TICKS_PER_SECOND, but we call the TimeManagement singleton class to provide us the right value. This allows us to use dynamic ticking in the future, a feature known as tickless kernel. The scheduler no longer does by himself the calculation of real time (Unix time), and just calls the TimeManagment singleton class to provide the value. Also, we can use 2 new boot arguments: - the "time" boot argument accpets either the value "modern", or "legacy". If "modern" is specified, the time management subsystem will try to setup HPET. Otherwise, for "legacy" value, the time subsystem will revert to use the PIT & RTC, leaving HPET disabled. If this boot argument is not specified, the default pattern is to try to setup HPET. - the "hpet" boot argumet accepts either the value "periodic" or "nonperiodic". If "periodic" is specified, the HPET will scan for periodic timers, and will assert if none are found. If only one is found, that timer will be assigned for the time-keeping task. If more than one is found, both time-keeping task & scheduler-ticking task will be assigned to periodic timers. If this boot argument is not specified, the default pattern is to try to scan for HPET periodic timers. This boot argument has no effect if HPET is disabled. In hardware context, PIT & RealTimeClock classes are merely inheriting from the HardwareTimer class, and they allow to use the old i8254 (PIT) and RTC devices, managing them via IO ports. By default, the RTC will be programmed to a frequency of 1024Hz. The PIT will be programmed to a frequency close to 1000Hz. About HPET, depending if we need to scan for periodic timers or not, we try to set a frequency close to 1000Hz for the time-keeping timer and scheduler-ticking timer. Also, if possible, we try to enable the Legacy replacement feature of the HPET. This feature if exists, instructs the chipset to disconnect both i8254 (PIT) and RTC. This behavior is observable on QEMU, and was verified against the source code: https://github.com/qemu/qemu/commit/ce967e2f33861b0e17753f97fa4527b5943c94b6 The HPETComparator class is inheriting from HardwareTimer class, and is responsible for an individual HPET comparator, which is essentially a timer. Therefore, it needs to call the singleton HPET class to perform HPET-related operations. The new abstraction of Hardware timers brings an opportunity of more new features in the foreseeable future. For example, we can change the callback function of each hardware timer, thus it makes it possible to swap missions between hardware timers, or to allow to use a hardware timer for other temporary missions (e.g. calibrating the LAPIC timer, measuring the CPU frequency, etc).
2020-03-09 15:03:27 +00:00
return ticks_left_until_original_wakeup_time / TimeManagement::the().ticks_per_second();
Implement sending signals to blocked-in-kernel processes. This is dirty but pretty cool! If we have a pending, unmasked signal for a process that's blocked inside the kernel, we set up alternate stacks for that process and unblock it to execute the signal handler. A slightly different return trampoline is used here: since we need to get back into the kernel, a dedicated syscall is used (sys$sigreturn.) This restores the TSS contents of the process to the state it was in while we were originally blocking in the kernel. NOTE: There's currently only one "kernel resume TSS" so signal nesting definitely won't work.
2018-11-07 20:19:47 +00:00
}
Add a "sleep" syscall that sleeps for N seconds.
2018-10-25 11:53:49 +00:00
return 0;
}
Kernel: Tidy up sys$select() to make it more readable.
2019-06-06 15:46:41 +00:00
timeval kgettimeofday()
Add support for socket send/receive timeouts. Only the receive timeout is hooked up yet. You can change the timeout by calling setsockopt(..., SOL_SOCKET, SO_RCVTIMEO, ...). Use this mechanism to make /bin/ping report timeouts.
2019-03-13 12:13:23 +00:00
{
Kernel: Make sure the kernel info page is read-only for userspace To enforce this, we create two separate mappings of the same underlying physical page. A writable mapping for the kernel, and a read-only one for userspace (the one returned by sys$get_kernel_info_page.)
2019-12-15 21:21:28 +00:00
return const_cast<const timeval&>(((KernelInfoPage*)s_info_page_address_for_kernel.as_ptr())->now);
Kernel: Tidy up sys$select() to make it more readable.
2019-06-06 15:46:41 +00:00
}
void kgettimeofday(timeval& tv)
{
tv = kgettimeofday();
Add support for socket send/receive timeouts. Only the receive timeout is hooked up yet. You can change the timeout by calling setsockopt(..., SOL_SOCKET, SO_RCVTIMEO, ...). Use this mechanism to make /bin/ping report timeouts.
2019-03-13 12:13:23 +00:00
}
Process now maps regions immediately when they are allocated. This avoids having to do a separate MM.mapRegionsForTask() pass. Also, more Task => Process renaming that I apparently hadn't saved yet.
2018-11-01 12:15:46 +00:00
int Process::sys$gettimeofday(timeval* tv)
Add gettimeofday() syscall and LibC wrappers gettimeofday() and time(). This only has second accuracy right now, I'll work out subseconds later.
2018-10-25 15:29:49 +00:00
{
ping: Use pledge()
2020-01-11 19:48:43 +00:00
REQUIRE_PROMISE(stdio);
Add templated helpers for read/write validation, and one for strings, too.
2018-11-16 15:23:39 +00:00
if (!validate_write_typed(tv))
Improve syscall address validation a bit.
2018-11-16 15:10:59 +00:00
return -EFAULT;
Kernel+LibC: Publish a "kernel info page" and use it for gettimeofday() This patch adds a single "kernel info page" that is mappable read-only by any process and contains the current time of day. This is then used to implement a version of gettimeofday() that doesn't have to make a syscall. To protect against race condition issues, the info page also has a serial number which is incremented whenever the kernel updates the contents of the page. Make sure to verify that the serial number is the same before and after reading the information you want from the page.
2019-12-15 20:29:26 +00:00
*tv = kgettimeofday();
Add gettimeofday() syscall and LibC wrappers gettimeofday() and time(). This only has second accuracy right now, I'll work out subseconds later.
2018-10-25 15:29:49 +00:00
return 0;
}
Process now maps regions immediately when they are allocated. This avoids having to do a separate MM.mapRegionsForTask() pass. Also, more Task => Process renaming that I apparently hadn't saved yet.
2018-11-01 12:15:46 +00:00
uid_t Process::sys$getuid()
Import the "gerbert" kernel I worked on earlier this year. It's a lot crappier than I remembered it. It's gonna need a lot of work.
2018-10-16 09:01:38 +00:00
{
ping: Use pledge()
2020-01-11 19:48:43 +00:00
REQUIRE_PROMISE(stdio);
Import the "gerbert" kernel I worked on earlier this year. It's a lot crappier than I remembered it. It's gonna need a lot of work.
2018-10-16 09:01:38 +00:00
return m_uid;
}
Process now maps regions immediately when they are allocated. This avoids having to do a separate MM.mapRegionsForTask() pass. Also, more Task => Process renaming that I apparently hadn't saved yet.
2018-11-01 12:15:46 +00:00
gid_t Process::sys$getgid()
Add getgid() and getpid() syscalls. Prep for LibC.
2018-10-22 11:55:11 +00:00
{
ping: Use pledge()
2020-01-11 19:48:43 +00:00
REQUIRE_PROMISE(stdio);
Add getgid() and getpid() syscalls. Prep for LibC.
2018-10-22 11:55:11 +00:00
return m_gid;
}
Add geteuid() and getegid(). There's no support for set-uid or set-gid executables yet so these don't actually do anything. It's just nice to get the boilerplate stuff in.
2018-11-05 14:04:19 +00:00
uid_t Process::sys$geteuid()
{
ping: Use pledge()
2020-01-11 19:48:43 +00:00
REQUIRE_PROMISE(stdio);
Add geteuid() and getegid(). There's no support for set-uid or set-gid executables yet so these don't actually do anything. It's just nice to get the boilerplate stuff in.
2018-11-05 14:04:19 +00:00
return m_euid;
}
gid_t Process::sys$getegid()
{
ping: Use pledge()
2020-01-11 19:48:43 +00:00
REQUIRE_PROMISE(stdio);
Add geteuid() and getegid(). There's no support for set-uid or set-gid executables yet so these don't actually do anything. It's just nice to get the boilerplate stuff in.
2018-11-05 14:04:19 +00:00
return m_egid;
}
Process now maps regions immediately when they are allocated. This avoids having to do a separate MM.mapRegionsForTask() pass. Also, more Task => Process renaming that I apparently hadn't saved yet.
2018-11-01 12:15:46 +00:00
pid_t Process::sys$getpid()
Add getgid() and getpid() syscalls. Prep for LibC.
2018-10-22 11:55:11 +00:00
{
ping: Use pledge()
2020-01-11 19:48:43 +00:00
REQUIRE_PROMISE(stdio);
Add getgid() and getpid() syscalls. Prep for LibC.
2018-10-22 11:55:11 +00:00
return m_pid;
}
Add getppid().
2018-11-06 12:33:06 +00:00
pid_t Process::sys$getppid()
{
ping: Use pledge()
2020-01-11 19:48:43 +00:00
REQUIRE_PROMISE(stdio);
Add getppid().
2018-11-06 12:33:06 +00:00
return m_ppid;
}
Add umask().
2018-11-06 12:40:23 +00:00
mode_t Process::sys$umask(mode_t mask)
{
ping: Use pledge()
2020-01-11 19:48:43 +00:00
REQUIRE_PROMISE(stdio);
Add umask().
2018-11-06 12:40:23 +00:00
auto old_mask = m_umask;
Kernel: Respect the process umask in open() and mkdir().
2019-02-22 01:39:13 +00:00
m_umask = mask & 0777;
Add umask().
2018-11-06 12:40:23 +00:00
return old_mask;
}
Kernel+LibC: Add sys$waitid(), and make sys$waitpid() wrap it sys$waitid() takes an explicit description of whether it's waiting for a single process with the given PID, all of the children, a group, etc., and returns its info as a siginfo_t. It also doesn't automatically imply WEXITED, which clears up the confusion in the kernel.
2020-02-05 16:42:43 +00:00
siginfo_t Process::reap(Process& process)
Get rid of the undertaker and have waitpid() be the reaper. For dead orphans, the scheduler calls reap().
2018-11-07 22:59:49 +00:00
{
Kernel+LibC: Add sys$waitid(), and make sys$waitpid() wrap it sys$waitid() takes an explicit description of whether it's waiting for a single process with the given PID, all of the children, a group, etc., and returns its info as a siginfo_t. It also doesn't automatically imply WEXITED, which clears up the confusion in the kernel.
2020-02-05 16:42:43 +00:00
siginfo_t siginfo;
Kernel: memset() all siginfo_t structs after creating them
2020-02-06 13:12:20 +00:00
memset(&siginfo, 0, sizeof(siginfo));
Kernel+LibC: Add sys$waitid(), and make sys$waitpid() wrap it sys$waitid() takes an explicit description of whether it's waiting for a single process with the given PID, all of the children, a group, etc., and returns its info as a siginfo_t. It also doesn't automatically imply WEXITED, which clears up the confusion in the kernel.
2020-02-05 16:42:43 +00:00
siginfo.si_signo = SIGCHLD;
siginfo.si_pid = process.pid();
siginfo.si_uid = process.uid();
if (process.m_termination_signal) {
siginfo.si_status = process.m_termination_signal;
siginfo.si_code = CLD_KILLED;
} else {
siginfo.si_status = process.m_termination_status;
siginfo.si_code = CLD_EXITED;
}
Kernel: Don't disable interrupts during Process destruction.
2019-03-27 13:38:32 +00:00
{
InterruptDisabler disabler;
Implement basic support for times(). The kernel now bills processes for time spent in kernelspace and userspace separately. The accounting is forwarded to the parent process in reap(). This makes the "time" builtin in bash work.
2018-12-03 00:12:26 +00:00
Kernel: Don't disable interrupts during Process destruction.
2019-03-27 13:38:32 +00:00
if (process.ppid()) {
auto* parent = Process::from_pid(process.ppid());
if (parent) {
parent->m_ticks_in_user_for_dead_children += process.m_ticks_in_user + process.m_ticks_in_user_for_dead_children;
parent->m_ticks_in_kernel_for_dead_children += process.m_ticks_in_kernel + process.m_ticks_in_kernel_for_dead_children;
}
Destroy all remaining windows in a process when it dies.
2019-01-30 18:35:38 +00:00
}
Implement basic support for times(). The kernel now bills processes for time spent in kernelspace and userspace separately. The accounting is forwarded to the parent process in reap(). This makes the "time" builtin in bash work.
2018-12-03 00:12:26 +00:00
Kernel: Finalizer should not go back to sleep if there's more to do Before putting itself back on the wait queue, the finalizer task will now check if there's more work to do, and if so, do it first. :^) This patch also puts a bunch of process/thread debug logging behind PROCESS_DEBUG and THREAD_DEBUG since it was unbearable to debug this stuff with all the spam.
2020-02-01 09:27:25 +00:00
#ifdef PROCESS_DEBUG
Kernel: Tidy up debug logging a little bit When using dbg() in the kernel, the output is automatically prefixed with [Process(PID:TID)]. This makes it a lot easier to understand which thread is generating the output. This patch also cleans up some common logging messages and removes the now-unnecessary "dbg() << *current << ..." pattern.
2020-01-21 15:14:39 +00:00
dbg() << "Reaping process " << process;
Kernel: Finalizer should not go back to sleep if there's more to do Before putting itself back on the wait queue, the finalizer task will now check if there's more work to do, and if so, do it first. :^) This patch also puts a bunch of process/thread debug logging behind PROCESS_DEBUG and THREAD_DEBUG since it was unbearable to debug this stuff with all the spam.
2020-02-01 09:27:25 +00:00
#endif
Kernel: Don't disable interrupts during Process destruction.
2019-03-27 13:38:32 +00:00
ASSERT(process.is_dead());
g_processes->remove(&process);
}
Fix some paging related bugs exposed by the spawn stress test. - Process::exec() needs to restore the original paging scope when called on a non-current process. - Add missing InterruptDisabler guards around g_processes access. - Only flush the TLB when modifying the active page tables.
2018-11-09 00:25:31 +00:00
delete &process;
Kernel+LibC: Add sys$waitid(), and make sys$waitpid() wrap it sys$waitid() takes an explicit description of whether it's waiting for a single process with the given PID, all of the children, a group, etc., and returns its info as a siginfo_t. It also doesn't automatically imply WEXITED, which clears up the confusion in the kernel.
2020-02-05 16:42:43 +00:00
return siginfo;
Get rid of the undertaker and have waitpid() be the reaper. For dead orphans, the scheduler calls reap().
2018-11-07 22:59:49 +00:00
}
Kernel+LibC: Add sys$waitid(), and make sys$waitpid() wrap it sys$waitid() takes an explicit description of whether it's waiting for a single process with the given PID, all of the children, a group, etc., and returns its info as a siginfo_t. It also doesn't automatically imply WEXITED, which clears up the confusion in the kernel.
2020-02-05 16:42:43 +00:00
KResultOr<siginfo_t> Process::do_waitid(idtype_t idtype, int id, int options)
Add a simplified waitpid() so that sh can wait on spawned commands.
2018-10-23 22:20:34 +00:00
{
Kernel+LibC: Add sys$waitid(), and make sys$waitpid() wrap it sys$waitid() takes an explicit description of whether it's waiting for a single process with the given PID, all of the children, a group, etc., and returns its info as a siginfo_t. It also doesn't automatically imply WEXITED, which clears up the confusion in the kernel.
2020-02-05 16:42:43 +00:00
if (idtype == P_PID) {
Get rid of the undertaker and have waitpid() be the reaper. For dead orphans, the scheduler calls reap().
2018-11-07 22:59:49 +00:00
InterruptDisabler disabler;
Kernel+LibC: Add sys$waitid(), and make sys$waitpid() wrap it sys$waitid() takes an explicit description of whether it's waiting for a single process with the given PID, all of the children, a group, etc., and returns its info as a siginfo_t. It also doesn't automatically imply WEXITED, which clears up the confusion in the kernel.
2020-02-05 16:42:43 +00:00
if (idtype == P_PID && !Process::from_pid(id))
return KResult(-ECHILD);
Get rid of the undertaker and have waitpid() be the reaper. For dead orphans, the scheduler calls reap().
2018-11-07 22:59:49 +00:00
}
Make bash-2.05b build with minimal changes. This is really neat. :^)
2018-11-16 23:11:08 +00:00
if (options & WNOHANG) {
Kernel: Add support for the WSTOPPED flag to the waitpid() syscall. This makes waitpid() return when a child process is stopped via a signal. Use this in Shell to catch stopped children and return control to the command line. :^) Fixes #298.
2019-07-14 09:35:49 +00:00
// FIXME: Figure out what WNOHANG should do with stopped children.
Kernel+LibC: Add sys$waitid(), and make sys$waitpid() wrap it sys$waitid() takes an explicit description of whether it's waiting for a single process with the given PID, all of the children, a group, etc., and returns its info as a siginfo_t. It also doesn't automatically imply WEXITED, which clears up the confusion in the kernel.
2020-02-05 16:42:43 +00:00
if (idtype == P_ALL) {
Make bash-2.05b build with minimal changes. This is really neat. :^)
2018-11-16 23:11:08 +00:00
InterruptDisabler disabler;
Kernel: memset() all siginfo_t structs after creating them
2020-02-06 13:12:20 +00:00
siginfo_t siginfo;
memset(&siginfo, 0, sizeof(siginfo));
Kernel+LibC: Add sys$waitid(), and make sys$waitpid() wrap it sys$waitid() takes an explicit description of whether it's waiting for a single process with the given PID, all of the children, a group, etc., and returns its info as a siginfo_t. It also doesn't automatically imply WEXITED, which clears up the confusion in the kernel.
2020-02-05 16:42:43 +00:00
for_each_child([&siginfo](Process& process) {
if (process.is_dead())
siginfo = reap(process);
Kernel: Add support for the WSTOPPED flag to the waitpid() syscall. This makes waitpid() return when a child process is stopped via a signal. Use this in Shell to catch stopped children and return control to the command line. :^) Fixes #298.
2019-07-14 09:35:49 +00:00
return IterationDecision::Continue;
Make bash-2.05b build with minimal changes. This is really neat. :^)
2018-11-16 23:11:08 +00:00
});
Kernel+LibC: Add sys$waitid(), and make sys$waitpid() wrap it sys$waitid() takes an explicit description of whether it's waiting for a single process with the given PID, all of the children, a group, etc., and returns its info as a siginfo_t. It also doesn't automatically imply WEXITED, which clears up the confusion in the kernel.
2020-02-05 16:42:43 +00:00
return siginfo;
} else if (idtype == P_PID) {
More compat work towards porting vim. It now builds and runs in the small-featureset configuration. :^)
2019-02-26 23:02:01 +00:00
InterruptDisabler disabler;
Kernel+LibC: Add sys$waitid(), and make sys$waitpid() wrap it sys$waitid() takes an explicit description of whether it's waiting for a single process with the given PID, all of the children, a group, etc., and returns its info as a siginfo_t. It also doesn't automatically imply WEXITED, which clears up the confusion in the kernel.
2020-02-05 16:42:43 +00:00
auto* waitee_process = Process::from_pid(id);
Make bash-2.05b build with minimal changes. This is really neat. :^)
2018-11-16 23:11:08 +00:00
if (!waitee_process)
Kernel+LibC: Add sys$waitid(), and make sys$waitpid() wrap it sys$waitid() takes an explicit description of whether it's waiting for a single process with the given PID, all of the children, a group, etc., and returns its info as a siginfo_t. It also doesn't automatically imply WEXITED, which clears up the confusion in the kernel.
2020-02-05 16:42:43 +00:00
return KResult(-ECHILD);
if (waitee_process->is_dead())
return reap(*waitee_process);
} else {
// FIXME: Implement other PID specs.
return KResult(-EINVAL);
Make bash-2.05b build with minimal changes. This is really neat. :^)
2018-11-16 23:11:08 +00:00
}
}
Kernel+LibC: Add sys$waitid(), and make sys$waitpid() wrap it sys$waitid() takes an explicit description of whether it's waiting for a single process with the given PID, all of the children, a group, etc., and returns its info as a siginfo_t. It also doesn't automatically imply WEXITED, which clears up the confusion in the kernel.
2020-02-05 16:42:43 +00:00
pid_t waitee_pid;
// FIXME: WaitBlocker should support idtype/id specs directly.
if (idtype == P_ALL) {
waitee_pid = -1;
} else if (idtype == P_PID) {
waitee_pid = id;
} else {
// FIXME: Implement other PID specs.
return KResult(-EINVAL);
}
Kernel: Replace "current" with Thread::current and Process::current Suggested by Sergey. The currently running Thread and Process are now Thread::current and Process::current respectively. :^)
2020-02-17 14:04:27 +00:00
if (Thread::current->block<Thread::WaitBlocker>(options, waitee_pid) != Thread::BlockResult::WokeNormally)
Kernel+LibC: Add sys$waitid(), and make sys$waitpid() wrap it sys$waitid() takes an explicit description of whether it's waiting for a single process with the given PID, all of the children, a group, etc., and returns its info as a siginfo_t. It also doesn't automatically imply WEXITED, which clears up the confusion in the kernel.
2020-02-05 16:42:43 +00:00
return KResult(-EINTR);
Kernel: Add support for the WSTOPPED flag to the waitpid() syscall. This makes waitpid() return when a child process is stopped via a signal. Use this in Shell to catch stopped children and return control to the command line. :^) Fixes #298.
2019-07-14 09:35:49 +00:00
InterruptDisabler disabler;
// NOTE: If waitee was -1, m_waitee_pid will have been filled in by the scheduler.
Kernel: Port wait to ThreadBlocker
2019-07-18 16:05:19 +00:00
Process* waitee_process = Process::from_pid(waitee_pid);
Kernel: waitpid() should unblock and -ECHILD if SIG_IGN reaps child
2019-09-08 11:54:48 +00:00
if (!waitee_process)
Kernel+LibC: Add sys$waitid(), and make sys$waitpid() wrap it sys$waitid() takes an explicit description of whether it's waiting for a single process with the given PID, all of the children, a group, etc., and returns its info as a siginfo_t. It also doesn't automatically imply WEXITED, which clears up the confusion in the kernel.
2020-02-05 16:42:43 +00:00
return KResult(-ECHILD);
Kernel: waitpid() should unblock and -ECHILD if SIG_IGN reaps child
2019-09-08 11:54:48 +00:00
Fix some paging related bugs exposed by the spawn stress test. - Process::exec() needs to restore the original paging scope when called on a non-current process. - Add missing InterruptDisabler guards around g_processes access. - Only flush the TLB when modifying the active page tables.
2018-11-09 00:25:31 +00:00
ASSERT(waitee_process);
Kernel: Add support for the WSTOPPED flag to the waitpid() syscall. This makes waitpid() return when a child process is stopped via a signal. Use this in Shell to catch stopped children and return control to the command line. :^) Fixes #298.
2019-07-14 09:35:49 +00:00
if (waitee_process->is_dead()) {
Kernel+LibC: Add sys$waitid(), and make sys$waitpid() wrap it sys$waitid() takes an explicit description of whether it's waiting for a single process with the given PID, all of the children, a group, etc., and returns its info as a siginfo_t. It also doesn't automatically imply WEXITED, which clears up the confusion in the kernel.
2020-02-05 16:42:43 +00:00
return reap(*waitee_process);
Kernel: Add support for the WSTOPPED flag to the waitpid() syscall. This makes waitpid() return when a child process is stopped via a signal. Use this in Shell to catch stopped children and return control to the command line. :^) Fixes #298.
2019-07-14 09:35:49 +00:00
} else {
Kernel: sys$waitpid() only needs the waitee thread in the stopped case If the waitee process is dead, we don't need to inspect the thread. This fixes an issue with sys$waitpid() failing before reap() since dead processes will have no remaining threads alive.
2020-01-27 20:20:58 +00:00
auto* waitee_thread = Thread::from_tid(waitee_pid);
if (!waitee_thread)
Kernel+LibC: Add sys$waitid(), and make sys$waitpid() wrap it sys$waitid() takes an explicit description of whether it's waiting for a single process with the given PID, all of the children, a group, etc., and returns its info as a siginfo_t. It also doesn't automatically imply WEXITED, which clears up the confusion in the kernel.
2020-02-05 16:42:43 +00:00
return KResult(-ECHILD);
Kernel: Expose the signal that stopped a thread via sys$waitpid()
2020-01-27 19:47:10 +00:00
ASSERT(waitee_thread->state() == Thread::State::Stopped);
Kernel+LibC: Add sys$waitid(), and make sys$waitpid() wrap it sys$waitid() takes an explicit description of whether it's waiting for a single process with the given PID, all of the children, a group, etc., and returns its info as a siginfo_t. It also doesn't automatically imply WEXITED, which clears up the confusion in the kernel.
2020-02-05 16:42:43 +00:00
siginfo_t siginfo;
Kernel: memset() all siginfo_t structs after creating them
2020-02-06 13:12:20 +00:00
memset(&siginfo, 0, sizeof(siginfo));
Kernel+LibC: Add sys$waitid(), and make sys$waitpid() wrap it sys$waitid() takes an explicit description of whether it's waiting for a single process with the given PID, all of the children, a group, etc., and returns its info as a siginfo_t. It also doesn't automatically imply WEXITED, which clears up the confusion in the kernel.
2020-02-05 16:42:43 +00:00
siginfo.si_signo = SIGCHLD;
siginfo.si_pid = waitee_process->pid();
siginfo.si_uid = waitee_process->uid();
Process: Fix siginfo for code CLD_STOPPED si_code, si_status where swapped
2020-04-10 14:27:23 +00:00
siginfo.si_code = CLD_STOPPED;
siginfo.si_status = waitee_thread->m_stop_signal;
Kernel+LibC: Add sys$waitid(), and make sys$waitpid() wrap it sys$waitid() takes an explicit description of whether it's waiting for a single process with the given PID, all of the children, a group, etc., and returns its info as a siginfo_t. It also doesn't automatically imply WEXITED, which clears up the confusion in the kernel.
2020-02-05 16:42:43 +00:00
return siginfo;
Kernel: Add support for the WSTOPPED flag to the waitpid() syscall. This makes waitpid() return when a child process is stopped via a signal. Use this in Shell to catch stopped children and return control to the command line. :^) Fixes #298.
2019-07-14 09:35:49 +00:00
}
Kernel+LibC: Add sys$waitid(), and make sys$waitpid() wrap it sys$waitid() takes an explicit description of whether it's waiting for a single process with the given PID, all of the children, a group, etc., and returns its info as a siginfo_t. It also doesn't automatically imply WEXITED, which clears up the confusion in the kernel.
2020-02-05 16:42:43 +00:00
}
pid_t Process::sys$waitid(const Syscall::SC_waitid_params* user_params)
{
REQUIRE_PROMISE(stdio);
Kernel: The waitpid() syscall was not storing to "wstatus" in all cases
2020-01-06 13:31:54 +00:00
Kernel+LibC: Add sys$waitid(), and make sys$waitpid() wrap it sys$waitid() takes an explicit description of whether it's waiting for a single process with the given PID, all of the children, a group, etc., and returns its info as a siginfo_t. It also doesn't automatically imply WEXITED, which clears up the confusion in the kernel.
2020-02-05 16:42:43 +00:00
Syscall::SC_waitid_params params;
if (!validate_read_and_copy_typed(&params, user_params))
return -EFAULT;
if (!validate_write_typed(params.infop))
return -EFAULT;
Kernel: Put sys$waitid() debug logging behind PROCESS_DEBUG
2020-02-05 18:14:56 +00:00
#ifdef PROCESS_DEBUG
Kernel+LibC: Add sys$waitid(), and make sys$waitpid() wrap it sys$waitid() takes an explicit description of whether it's waiting for a single process with the given PID, all of the children, a group, etc., and returns its info as a siginfo_t. It also doesn't automatically imply WEXITED, which clears up the confusion in the kernel.
2020-02-05 16:42:43 +00:00
dbg() << "sys$waitid(" << params.idtype << ", " << params.id << ", " << params.infop << ", " << params.options << ")";
Kernel: Put sys$waitid() debug logging behind PROCESS_DEBUG
2020-02-05 18:14:56 +00:00
#endif
Kernel+LibC: Add sys$waitid(), and make sys$waitpid() wrap it sys$waitid() takes an explicit description of whether it's waiting for a single process with the given PID, all of the children, a group, etc., and returns its info as a siginfo_t. It also doesn't automatically imply WEXITED, which clears up the confusion in the kernel.
2020-02-05 16:42:43 +00:00
auto siginfo_or_error = do_waitid(static_cast<idtype_t>(params.idtype), params.id, params.options);
if (siginfo_or_error.is_error())
return siginfo_or_error.error();
Kernel: Fix race in waitid This is similar to 28e1da344d1de4fb80ce9e9c8da9127fa8606dc7 and 4dd4dd2f3c067eca446d9513e814ae9aaa648882. The crux is that wait verifies that the outvalue (siginfo* infop) is writable *before* waiting, and writes to it *after* waiting. In the meantime, a concurrent thread can make the output region unwritable, e.g. by deallocating it.
2020-03-08 12:14:35 +00:00
// While we waited, the process lock was dropped. This gave other threads
// the opportunity to mess with the memory. For example, it could free the
// region, and map it to a region to which it has no write permissions.
// Therefore, we need to re-validate the pointer.
if (!validate_write_typed(params.infop))
return -EFAULT;
Kernel+LibC: Add sys$waitid(), and make sys$waitpid() wrap it sys$waitid() takes an explicit description of whether it's waiting for a single process with the given PID, all of the children, a group, etc., and returns its info as a siginfo_t. It also doesn't automatically imply WEXITED, which clears up the confusion in the kernel.
2020-02-05 16:42:43 +00:00
copy_to_user(params.infop, &siginfo_or_error.value());
return 0;
Import the "gerbert" kernel I worked on earlier this year. It's a lot crappier than I remembered it. It's gonna need a lot of work.
2018-10-16 09:01:38 +00:00
}
Kernel: Address validation helpers should take size_t, not ssize_t
2020-01-29 17:31:15 +00:00
bool Process::validate_read_from_kernel(VirtualAddress vaddr, size_t size) const
Greatly improve /proc/PID/stack by tracing the ebp frame chain. I also added a generator cache to FileHandle. This way, multiple reads to a generated file (i.e in a synthfs) can transparently handle multiple calls to read() without the contents changing between calls. The cache is discarded at EOF (or when the FileHandle is destroyed.)
2018-10-26 22:14:24 +00:00
{
Kernel: Rename LinearAddress => VirtualAddress.
2019-06-07 10:56:50 +00:00
if (vaddr.is_null())
Kernel: Make validate_read_from_kernel() return early for nullptr checks. Null pointers are always invalid, so don't bother going through all the various checks for them.
2019-04-15 21:48:31 +00:00
return false;
Kernel: Validate the full range of user memory passed to syscalls We now validate the full range of userspace memory passed into syscalls instead of just checking that the first and last byte of the memory are in process-owned regions. This fixes an issue where it was possible to avoid rejection of invalid addresses that sat between two valid ones, simply by passing a valid address and a size large enough to put the end of the range at another valid address. I added a little test utility that tries to provoke EFAULT in various ways to help verify this. I'm sure we can think of more ways to test this but it's at least a start. :^) Thanks to mozjag for pointing out that this code was still lacking! Incidentally this also makes backtraces work again. Fixes #989.
2020-01-02 01:09:25 +00:00
return MM.validate_kernel_read(*this, vaddr, size);
Greatly improve /proc/PID/stack by tracing the ebp frame chain. I also added a generator cache to FileHandle. This way, multiple reads to a generated file (i.e in a synthfs) can transparently handle multiple calls to read() without the contents changing between calls. The cache is discarded at EOF (or when the FileHandle is destroyed.)
2018-10-26 22:14:24 +00:00
}
Kernel: Address validation helpers should take size_t, not ssize_t
2020-01-29 17:31:15 +00:00
bool Process::validate_read(const void* address, size_t size) const
Reimplement tcsetattr/tcgetattr as ioctls.
2018-11-16 14:41:48 +00:00
{
Kernel: Fix incorrect EFAULTs when syscall would write into COW pages.
2019-01-25 00:39:15 +00:00
if (!size)
return false;
Kernel: Never validate access to the kmalloc memory range Memory validation is used to verify that user syscalls are allowed to access a given memory range. Ring 0 threads never make syscalls, and so will never end up in validation anyway. The reason we were allowing kmalloc memory accesses is because kernel thread stacks used to be allocated in kmalloc memory. Since that's no longer the case, we can stop making exceptions for kmalloc in the validation code.
2020-01-27 11:43:21 +00:00
return MM.validate_user_read(*this, VirtualAddress(address), size);
Reimplement tcsetattr/tcgetattr as ioctls.
2018-11-16 14:41:48 +00:00
}
Kernel: Address validation helpers should take size_t, not ssize_t
2020-01-29 17:31:15 +00:00
bool Process::validate_write(void* address, size_t size) const
Reimplement tcsetattr/tcgetattr as ioctls.
2018-11-16 14:41:48 +00:00
{
Kernel: Fix incorrect EFAULTs when syscall would write into COW pages.
2019-01-25 00:39:15 +00:00
if (!size)
return false;
Kernel: Never validate access to the kmalloc memory range Memory validation is used to verify that user syscalls are allowed to access a given memory range. Ring 0 threads never make syscalls, and so will never end up in validation anyway. The reason we were allowing kmalloc memory accesses is because kernel thread stacks used to be allocated in kmalloc memory. Since that's no longer the case, we can stop making exceptions for kmalloc in the validation code.
2020-01-27 11:43:21 +00:00
return MM.validate_user_write(*this, VirtualAddress(address), size);
Reimplement tcsetattr/tcgetattr as ioctls.
2018-11-16 14:41:48 +00:00
}
Start working on sessions and process groups.
2018-11-02 11:56:51 +00:00
pid_t Process::sys$getsid(pid_t pid)
{
ping: Use pledge()
2020-01-11 19:48:43 +00:00
REQUIRE_PROMISE(stdio);
Start working on sessions and process groups.
2018-11-02 11:56:51 +00:00
if (pid == 0)
return m_sid;
InterruptDisabler disabler;
Some refactor and style tweaks.
2018-11-07 20:38:18 +00:00
auto* process = Process::from_pid(pid);
Start working on sessions and process groups.
2018-11-02 11:56:51 +00:00
if (!process)
return -ESRCH;
if (m_sid != process->m_sid)
return -EPERM;
return process->m_sid;
}
pid_t Process::sys$setsid()
{
ping: Use pledge()
2020-01-11 19:48:43 +00:00
REQUIRE_PROMISE(proc);
Start working on sessions and process groups.
2018-11-02 11:56:51 +00:00
InterruptDisabler disabler;
bool found_process_with_same_pgid_as_my_pid = false;
Kernel: Run clang-format on everything.
2019-06-07 09:43:58 +00:00
Process::for_each_in_pgrp(pid(), [&](auto&) {
Some refactor and style tweaks.
2018-11-07 20:38:18 +00:00
found_process_with_same_pgid_as_my_pid = true;
Kernel: Use IteratorDecision in Process::for_each_in_pgrp()
2019-08-22 19:12:55 +00:00
return IterationDecision::Break;
Start working on sessions and process groups.
2018-11-02 11:56:51 +00:00
});
if (found_process_with_same_pgid_as_my_pid)
return -EPERM;
m_sid = m_pid;
m_pgid = m_pid;
Kernel: Make sys$setsid() clear the calling process's controlling TTY
2020-01-25 13:53:48 +00:00
m_tty = nullptr;
Start working on sessions and process groups.
2018-11-02 11:56:51 +00:00
return m_sid;
}
pid_t Process::sys$getpgid(pid_t pid)
{
ping: Use pledge()
2020-01-11 19:48:43 +00:00
REQUIRE_PROMISE(stdio);
Start working on sessions and process groups.
2018-11-02 11:56:51 +00:00
if (pid == 0)
return m_pgid;
InterruptDisabler disabler; // FIXME: Use a ProcessHandle
Some refactor and style tweaks.
2018-11-07 20:38:18 +00:00
auto* process = Process::from_pid(pid);
Start working on sessions and process groups.
2018-11-02 11:56:51 +00:00
if (!process)
return -ESRCH;
return process->m_pgid;
}
pid_t Process::sys$getpgrp()
{
ping: Use pledge()
2020-01-11 19:48:43 +00:00
REQUIRE_PROMISE(stdio);
Start working on sessions and process groups.
2018-11-02 11:56:51 +00:00
return m_pgid;
}
static pid_t get_sid_from_pgid(pid_t pgid)
{
InterruptDisabler disabler;
Some refactor and style tweaks.
2018-11-07 20:38:18 +00:00
auto* group_leader = Process::from_pid(pgid);
Start working on sessions and process groups.
2018-11-02 11:56:51 +00:00
if (!group_leader)
return -1;
return group_leader->sid();
}
int Process::sys$setpgid(pid_t specified_pid, pid_t specified_pgid)
{
ping: Use pledge()
2020-01-11 19:48:43 +00:00
REQUIRE_PROMISE(proc);
Start working on sessions and process groups.
2018-11-02 11:56:51 +00:00
InterruptDisabler disabler; // FIXME: Use a ProcessHandle
pid_t pid = specified_pid ? specified_pid : m_pid;
Kernel: Add some missing error checks to the setpgid() syscall
2020-01-02 18:40:04 +00:00
if (specified_pgid < 0) {
// The value of the pgid argument is less than 0, or is not a value supported by the implementation.
Start working on sessions and process groups.
2018-11-02 11:56:51 +00:00
return -EINVAL;
Kernel: Add some missing error checks to the setpgid() syscall
2020-01-02 18:40:04 +00:00
}
Some refactor and style tweaks.
2018-11-07 20:38:18 +00:00
auto* process = Process::from_pid(pid);
Start working on sessions and process groups.
2018-11-02 11:56:51 +00:00
if (!process)
return -ESRCH;
Kernel: Add some missing error checks to the setpgid() syscall
2020-01-02 18:40:04 +00:00
if (process != this && process->ppid() != m_pid) {
// The value of the pid argument does not match the process ID
// of the calling process or of a child process of the calling process.
return -ESRCH;
}
if (process->pid() == process->sid()) {
// The process indicated by the pid argument is a session leader.
return -EPERM;
}
if (process->ppid() == m_pid && process->sid() != sid()) {
// The value of the pid argument matches the process ID of a child
// process of the calling process and the child process is not in
// the same session as the calling process.
return -EPERM;
}
Start working on sessions and process groups.
2018-11-02 11:56:51 +00:00
pid_t new_pgid = specified_pgid ? specified_pgid : process->m_pid;
pid_t current_sid = get_sid_from_pgid(process->m_pgid);
pid_t new_sid = get_sid_from_pgid(new_pgid);
if (current_sid != new_sid) {
// Can't move a process between sessions.
return -EPERM;
}
// FIXME: There are more EPERM conditions to check for here..
process->m_pgid = new_pgid;
return 0;
}
Add tcsetpgrp()+tcgetpgrp(). One more step on the path to being able to ^C a runaway process. :^)
2018-11-02 12:14:25 +00:00
Add ioctl() and reimplement tcsetpgrp/tcsetpgrp as ioctls.
2018-11-16 12:11:21 +00:00
int Process::sys$ioctl(int fd, unsigned request, unsigned arg)
Add tcsetpgrp()+tcgetpgrp(). One more step on the path to being able to ^C a runaway process. :^)
2018-11-02 12:14:25 +00:00
{
Kernel: Make Process::file_description() vend a RefPtr<FileDescription> This encourages callers to strongly reference file descriptions while working with them. This fixes a use-after-free issue where one thread would close() an open fd while another thread was blocked on it becoming readable. Test: Kernel/uaf-close-while-blocked-in-read.cpp
2020-01-07 14:53:42 +00:00
auto description = file_description(fd);
Kernel: Rename "descriptor" to "description" where appropriate. Now that FileDescription is called that, variables of that type should not be called "descriptor". This is kinda wordy but we'll get used to it.
2019-06-13 20:03:04 +00:00
if (!description)
Add tcsetpgrp()+tcgetpgrp(). One more step on the path to being able to ^C a runaway process. :^)
2018-11-02 12:14:25 +00:00
return -EBADF;
Kernel: Start implementing x86 SMAP support Supervisor Mode Access Prevention (SMAP) is an x86 CPU feature that prevents the kernel from accessing userspace memory. With SMAP enabled, trying to read/write a userspace memory address while in the kernel will now generate a page fault. Since it's sometimes necessary to read/write userspace memory, there are two new instructions that quickly switch the protection on/off: STAC (disables protection) and CLAC (enables protection.) These are exposed in kernel code via the stac() and clac() helpers. There's also a SmapDisabler RAII object that can be used to ensure that you don't forget to re-enable protection before returning to userspace code. THis patch also adds copy_to_user(), copy_from_user() and memset_user() which are the "correct" way of doing things. These functions allow us to briefly disable protection for a specific purpose, and then turn it back on immediately after it's done. Going forward all kernel code should be moved to using these and all uses of SmapDisabler are to be considered FIXME's. Note that we're not realizing the full potential of this feature since I've used SmapDisabler quite liberally in this initial bring-up patch.
2020-01-05 17:00:15 +00:00
SmapDisabler disabler;
Kernel: Rename "descriptor" to "description" where appropriate. Now that FileDescription is called that, variables of that type should not be called "descriptor". This is kinda wordy but we'll get used to it.
2019-06-13 20:03:04 +00:00
return description->file().ioctl(*description, request, arg);
Add tcsetpgrp()+tcgetpgrp(). One more step on the path to being able to ^C a runaway process. :^)
2018-11-02 12:14:25 +00:00
}
More work towards getting bash to build. Implemented some syscalls: dup(), dup2(), getdtablesize(). FileHandle is now a retainable, since that's needed for dup()'ed fd's. I didn't really test any of this beyond a basic smoke check.
2018-11-05 18:01:22 +00:00
int Process::sys$getdtablesize()
{
ping: Use pledge()
2020-01-11 19:48:43 +00:00
REQUIRE_PROMISE(stdio);
More work towards getting bash to build. Implemented some syscalls: dup(), dup2(), getdtablesize(). FileHandle is now a retainable, since that's needed for dup()'ed fd's. I didn't really test any of this beyond a basic smoke check.
2018-11-05 18:01:22 +00:00
return m_max_open_file_descriptors;
}
int Process::sys$dup(int old_fd)
{
ping: Use pledge()
2020-01-11 19:48:43 +00:00
REQUIRE_PROMISE(stdio);
Kernel: Make Process::file_description() vend a RefPtr<FileDescription> This encourages callers to strongly reference file descriptions while working with them. This fixes a use-after-free issue where one thread would close() an open fd while another thread was blocked on it becoming readable. Test: Kernel/uaf-close-while-blocked-in-read.cpp
2020-01-07 14:53:42 +00:00
auto description = file_description(old_fd);
Kernel: Rename "descriptor" to "description" where appropriate. Now that FileDescription is called that, variables of that type should not be called "descriptor". This is kinda wordy but we'll get used to it.
2019-06-13 20:03:04 +00:00
if (!description)
More work towards getting bash to build. Implemented some syscalls: dup(), dup2(), getdtablesize(). FileHandle is now a retainable, since that's needed for dup()'ed fd's. I didn't really test any of this beyond a basic smoke check.
2018-11-05 18:01:22 +00:00
return -EBADF;
Kernel: Misc tweaks
2020-01-20 12:18:54 +00:00
int new_fd = alloc_fd();
Kernel: Use alloc_fd() more instead of walking fd list manually.
2019-04-06 12:54:32 +00:00
if (new_fd < 0)
return new_fd;
Kernel: Rename "descriptor" to "description" where appropriate. Now that FileDescription is called that, variables of that type should not be called "descriptor". This is kinda wordy but we'll get used to it.
2019-06-13 20:03:04 +00:00
m_fds[new_fd].set(*description);
More work towards getting bash to build. Implemented some syscalls: dup(), dup2(), getdtablesize(). FileHandle is now a retainable, since that's needed for dup()'ed fd's. I didn't really test any of this beyond a basic smoke check.
2018-11-05 18:01:22 +00:00
return new_fd;
}
int Process::sys$dup2(int old_fd, int new_fd)
{
ping: Use pledge()
2020-01-11 19:48:43 +00:00
REQUIRE_PROMISE(stdio);
Kernel: Make Process::file_description() vend a RefPtr<FileDescription> This encourages callers to strongly reference file descriptions while working with them. This fixes a use-after-free issue where one thread would close() an open fd while another thread was blocked on it becoming readable. Test: Kernel/uaf-close-while-blocked-in-read.cpp
2020-01-07 14:53:42 +00:00
auto description = file_description(old_fd);
Kernel: Rename "descriptor" to "description" where appropriate. Now that FileDescription is called that, variables of that type should not be called "descriptor". This is kinda wordy but we'll get used to it.
2019-06-13 20:03:04 +00:00
if (!description)
More work towards getting bash to build. Implemented some syscalls: dup(), dup2(), getdtablesize(). FileHandle is now a retainable, since that's needed for dup()'ed fd's. I didn't really test any of this beyond a basic smoke check.
2018-11-05 18:01:22 +00:00
return -EBADF;
Kernel: Use alloc_fd() more instead of walking fd list manually.
2019-04-06 12:54:32 +00:00
if (new_fd < 0 || new_fd >= m_max_open_file_descriptors)
return -EINVAL;
Kernel: Rename "descriptor" to "description" where appropriate. Now that FileDescription is called that, variables of that type should not be called "descriptor". This is kinda wordy but we'll get used to it.
2019-06-13 20:03:04 +00:00
m_fds[new_fd].set(*description);
More work towards getting bash to build. Implemented some syscalls: dup(), dup2(), getdtablesize(). FileHandle is now a retainable, since that's needed for dup()'ed fd's. I didn't really test any of this beyond a basic smoke check.
2018-11-05 18:01:22 +00:00
return new_fd;
}
Add some basic signal support. It only works for sending a signal to a process that's in userspace code. We implement reception by synthesizing a PUSHA+PUSHF in the receiving process (operating on values in the TSS.) The TSS CS:EIP is then rerouted to the signal handler and a tiny return trampoline is constructed in a dedicated region in the receiving process. Also hacked up /bin/kill to be able to send arbitrary signals (kill -N PID)
2018-11-06 09:46:40 +00:00
Kernel: Get rid of Unix namespace. This is no longer needed as the Kernel can stand on its own legs now and there won't be any conflict with host system data types.
2019-01-23 05:53:01 +00:00
int Process::sys$sigprocmask(int how, const sigset_t* set, sigset_t* old_set)
Some improvements to signals. - Add sigprocmask() and sigpending(). - Forked children inherit signal dispositions and masks. - Exec clears signal dispositions and masks.
2018-11-10 22:29:07 +00:00
{
ping: Use pledge()
2020-01-11 19:48:43 +00:00
REQUIRE_PROMISE(stdio);
Rage hacking to get bash to run. It finally runs. So cool! :^)
2018-11-11 14:36:40 +00:00
if (old_set) {
Kernel: sigpending() and sigprocmask() should validate memory writes.
2019-02-21 20:33:52 +00:00
if (!validate_write_typed(old_set))
Improve syscall address validation a bit.
2018-11-16 15:10:59 +00:00
return -EFAULT;
Kernel: Replace "current" with Thread::current and Process::current Suggested by Sergey. The currently running Thread and Process are now Thread::current and Process::current respectively. :^)
2020-02-17 14:04:27 +00:00
copy_to_user(old_set, &Thread::current->m_signal_mask);
Rage hacking to get bash to run. It finally runs. So cool! :^)
2018-11-11 14:36:40 +00:00
}
if (set) {
Add templated helpers for read/write validation, and one for strings, too.
2018-11-16 15:23:39 +00:00
if (!validate_read_typed(set))
Improve syscall address validation a bit.
2018-11-16 15:10:59 +00:00
return -EFAULT;
Kernel: Start implementing x86 SMAP support Supervisor Mode Access Prevention (SMAP) is an x86 CPU feature that prevents the kernel from accessing userspace memory. With SMAP enabled, trying to read/write a userspace memory address while in the kernel will now generate a page fault. Since it's sometimes necessary to read/write userspace memory, there are two new instructions that quickly switch the protection on/off: STAC (disables protection) and CLAC (enables protection.) These are exposed in kernel code via the stac() and clac() helpers. There's also a SmapDisabler RAII object that can be used to ensure that you don't forget to re-enable protection before returning to userspace code. THis patch also adds copy_to_user(), copy_from_user() and memset_user() which are the "correct" way of doing things. These functions allow us to briefly disable protection for a specific purpose, and then turn it back on immediately after it's done. Going forward all kernel code should be moved to using these and all uses of SmapDisabler are to be considered FIXME's. Note that we're not realizing the full potential of this feature since I've used SmapDisabler quite liberally in this initial bring-up patch.
2020-01-05 17:00:15 +00:00
sigset_t set_value;
Kernel: Use the templated copy_from_user where possible Now that the templated version of copy_from_user exists their is normally no reason to use the version which takes the number of bytes to copy. Move to the templated version where possible.
2020-01-13 07:00:35 +00:00
copy_from_user(&set_value, set);
Rage hacking to get bash to run. It finally runs. So cool! :^)
2018-11-11 14:36:40 +00:00
switch (how) {
case SIG_BLOCK:
Kernel: Replace "current" with Thread::current and Process::current Suggested by Sergey. The currently running Thread and Process are now Thread::current and Process::current respectively. :^)
2020-02-17 14:04:27 +00:00
Thread::current->m_signal_mask &= ~set_value;
Rage hacking to get bash to run. It finally runs. So cool! :^)
2018-11-11 14:36:40 +00:00
break;
case SIG_UNBLOCK:
Kernel: Replace "current" with Thread::current and Process::current Suggested by Sergey. The currently running Thread and Process are now Thread::current and Process::current respectively. :^)
2020-02-17 14:04:27 +00:00
Thread::current->m_signal_mask |= set_value;
Rage hacking to get bash to run. It finally runs. So cool! :^)
2018-11-11 14:36:40 +00:00
break;
case SIG_SETMASK:
Kernel: Replace "current" with Thread::current and Process::current Suggested by Sergey. The currently running Thread and Process are now Thread::current and Process::current respectively. :^)
2020-02-17 14:04:27 +00:00
Thread::current->m_signal_mask = set_value;
Rage hacking to get bash to run. It finally runs. So cool! :^)
2018-11-11 14:36:40 +00:00
break;
default:
return -EINVAL;
}
Some improvements to signals. - Add sigprocmask() and sigpending(). - Forked children inherit signal dispositions and masks. - Exec clears signal dispositions and masks.
2018-11-10 22:29:07 +00:00
}
return 0;
}
Kernel: Get rid of Unix namespace. This is no longer needed as the Kernel can stand on its own legs now and there won't be any conflict with host system data types.
2019-01-23 05:53:01 +00:00
int Process::sys$sigpending(sigset_t* set)
Some improvements to signals. - Add sigprocmask() and sigpending(). - Forked children inherit signal dispositions and masks. - Exec clears signal dispositions and masks.
2018-11-10 22:29:07 +00:00
{
ping: Use pledge()
2020-01-11 19:48:43 +00:00
REQUIRE_PROMISE(stdio);
Kernel: sigpending() and sigprocmask() should validate memory writes.
2019-02-21 20:33:52 +00:00
if (!validate_write_typed(set))
Improve syscall address validation a bit.
2018-11-16 15:10:59 +00:00
return -EFAULT;
Kernel: Replace "current" with Thread::current and Process::current Suggested by Sergey. The currently running Thread and Process are now Thread::current and Process::current respectively. :^)
2020-02-17 14:04:27 +00:00
copy_to_user(set, &Thread::current->m_pending_signals);
Some improvements to signals. - Add sigprocmask() and sigpending(). - Forked children inherit signal dispositions and masks. - Exec clears signal dispositions and masks.
2018-11-10 22:29:07 +00:00
return 0;
}
Kernel: Get rid of Unix namespace. This is no longer needed as the Kernel can stand on its own legs now and there won't be any conflict with host system data types.
2019-01-23 05:53:01 +00:00
int Process::sys$sigaction(int signum, const sigaction* act, sigaction* old_act)
Add some basic signal support. It only works for sending a signal to a process that's in userspace code. We implement reception by synthesizing a PUSHA+PUSHF in the receiving process (operating on values in the TSS.) The TSS CS:EIP is then rerouted to the signal handler and a tiny return trampoline is constructed in a dedicated region in the receiving process. Also hacked up /bin/kill to be able to send arbitrary signals (kill -N PID)
2018-11-06 09:46:40 +00:00
{
ping: Use pledge()
2020-01-11 19:48:43 +00:00
REQUIRE_PROMISE(stdio);
Let sys$sigaction() fail if called with SIGKILL or SIGSTOP.
2018-12-24 21:22:19 +00:00
if (signum < 1 || signum >= 32 || signum == SIGKILL || signum == SIGSTOP)
Add some basic signal support. It only works for sending a signal to a process that's in userspace code. We implement reception by synthesizing a PUSHA+PUSHF in the receiving process (operating on values in the TSS.) The TSS CS:EIP is then rerouted to the signal handler and a tiny return trampoline is constructed in a dedicated region in the receiving process. Also hacked up /bin/kill to be able to send arbitrary signals (kill -N PID)
2018-11-06 09:46:40 +00:00
return -EINVAL;
Add templated helpers for read/write validation, and one for strings, too.
2018-11-16 15:23:39 +00:00
if (!validate_read_typed(act))
Improve syscall address validation a bit.
2018-11-16 15:10:59 +00:00
return -EFAULT;
Kernel: Remove a bunch of unnecessary InterruptDisablers.
2019-02-07 10:24:09 +00:00
InterruptDisabler disabler; // FIXME: This should use a narrower lock. Maybe a way to ignore signals temporarily?
Kernel: Replace "current" with Thread::current and Process::current Suggested by Sergey. The currently running Thread and Process are now Thread::current and Process::current respectively. :^)
2020-02-17 14:04:27 +00:00
auto& action = Thread::current->m_signal_action_data[signum];
Fix sys$sigaction() to return the old action metadata if requested.
2018-11-07 09:48:44 +00:00
if (old_act) {
Add templated helpers for read/write validation, and one for strings, too.
2018-11-16 15:23:39 +00:00
if (!validate_write_typed(old_act))
Improve syscall address validation a bit.
2018-11-16 15:10:59 +00:00
return -EFAULT;
Kernel: Use the templated copy_to/from_user() in more places These ensure that the "to" and "from" pointers have the same type, and also that we copy the correct number of bytes.
2020-01-20 12:38:31 +00:00
copy_to_user(&old_act->sa_flags, &action.flags);
Kernel: Start implementing x86 SMAP support Supervisor Mode Access Prevention (SMAP) is an x86 CPU feature that prevents the kernel from accessing userspace memory. With SMAP enabled, trying to read/write a userspace memory address while in the kernel will now generate a page fault. Since it's sometimes necessary to read/write userspace memory, there are two new instructions that quickly switch the protection on/off: STAC (disables protection) and CLAC (enables protection.) These are exposed in kernel code via the stac() and clac() helpers. There's also a SmapDisabler RAII object that can be used to ensure that you don't forget to re-enable protection before returning to userspace code. THis patch also adds copy_to_user(), copy_from_user() and memset_user() which are the "correct" way of doing things. These functions allow us to briefly disable protection for a specific purpose, and then turn it back on immediately after it's done. Going forward all kernel code should be moved to using these and all uses of SmapDisabler are to be considered FIXME's. Note that we're not realizing the full potential of this feature since I've used SmapDisabler quite liberally in this initial bring-up patch.
2020-01-05 17:00:15 +00:00
copy_to_user(&old_act->sa_sigaction, &action.handler_or_sigaction, sizeof(action.handler_or_sigaction));
Fix sys$sigaction() to return the old action metadata if requested.
2018-11-07 09:48:44 +00:00
}
Kernel: Use the templated copy_from_user where possible Now that the templated version of copy_from_user exists their is normally no reason to use the version which takes the number of bytes to copy. Move to the templated version where possible.
2020-01-13 07:00:35 +00:00
copy_from_user(&action.flags, &act->sa_flags);
Kernel: Use the templated copy_to/from_user() in more places These ensure that the "to" and "from" pointers have the same type, and also that we copy the correct number of bytes.
2020-01-20 12:38:31 +00:00
copy_from_user(&action.handler_or_sigaction, &act->sa_sigaction, sizeof(action.handler_or_sigaction));
Add some basic signal support. It only works for sending a signal to a process that's in userspace code. We implement reception by synthesizing a PUSHA+PUSHF in the receiving process (operating on values in the TSS.) The TSS CS:EIP is then rerouted to the signal handler and a tiny return trampoline is constructed in a dedicated region in the receiving process. Also hacked up /bin/kill to be able to send arbitrary signals (kill -N PID)
2018-11-06 09:46:40 +00:00
return 0;
}
Add some basic setgroups(), getgroups() and initgroups(). Also teach /bin/id to print the user's supplemental groups.
2018-11-07 00:38:51 +00:00
Kernel: Remove SmapDisabler in sys$getgroups()
2020-02-15 23:30:00 +00:00
int Process::sys$getgroups(ssize_t count, gid_t* user_gids)
Add some basic setgroups(), getgroups() and initgroups(). Also teach /bin/id to print the user's supplemental groups.
2018-11-07 00:38:51 +00:00
{
ping: Use pledge()
2020-01-11 19:48:43 +00:00
REQUIRE_PROMISE(stdio);
Add some basic setgroups(), getgroups() and initgroups(). Also teach /bin/id to print the user's supplemental groups.
2018-11-07 00:38:51 +00:00
if (count < 0)
return -EINVAL;
if (!count)
Kernel: Don't include the process GID in the "extra GIDs" table Process::m_extra_gids is for supplementary GIDs only.
2020-01-02 22:45:52 +00:00
return m_extra_gids.size();
if (count != (int)m_extra_gids.size())
Add some basic setgroups(), getgroups() and initgroups(). Also teach /bin/id to print the user's supplemental groups.
2018-11-07 00:38:51 +00:00
return -EINVAL;
Kernel: Remove SmapDisabler in sys$getgroups()
2020-02-15 23:30:00 +00:00
if (!validate_write_typed(user_gids, m_extra_gids.size()))
Improve syscall address validation a bit.
2018-11-16 15:10:59 +00:00
return -EFAULT;
Kernel: Remove SmapDisabler in sys$getgroups()
2020-02-15 23:30:00 +00:00
Vector<gid_t> gids;
Kernel: Don't include the process GID in the "extra GIDs" table Process::m_extra_gids is for supplementary GIDs only.
2020-01-02 22:45:52 +00:00
for (auto gid : m_extra_gids)
Kernel: Remove SmapDisabler in sys$getgroups()
2020-02-15 23:30:00 +00:00
gids.append(gid);
copy_to_user(user_gids, gids.data(), sizeof(gid_t) * count);
Add some basic setgroups(), getgroups() and initgroups(). Also teach /bin/id to print the user's supplemental groups.
2018-11-07 00:38:51 +00:00
return 0;
}
Kernel: Remove SmapDisabler in sys$setgroups()
2020-02-15 23:27:10 +00:00
int Process::sys$setgroups(ssize_t count, const gid_t* user_gids)
Add some basic setgroups(), getgroups() and initgroups(). Also teach /bin/id to print the user's supplemental groups.
2018-11-07 00:38:51 +00:00
{
ping: Use pledge()
2020-01-11 19:48:43 +00:00
REQUIRE_PROMISE(id);
More moving towards using signed types. I'm still feeling this out, but I am starting to like the general idea.
2019-02-25 21:06:55 +00:00
if (count < 0)
return -EINVAL;
Kernel+Userland: Implement setuid() and setgid() and add /bin/su Also show setuid and setgid bits in "ls -l" output. :^)
2019-02-21 22:35:07 +00:00
if (!is_superuser())
Add some basic setgroups(), getgroups() and initgroups(). Also teach /bin/id to print the user's supplemental groups.
2018-11-07 00:38:51 +00:00
return -EPERM;
Kernel: Remove SmapDisabler in sys$setgroups()
2020-02-15 23:27:10 +00:00
if (count && !validate_read(user_gids, count))
Improve syscall address validation a bit.
2018-11-16 15:10:59 +00:00
return -EFAULT;
Kernel: Remove SmapDisabler in sys$setgroups()
2020-02-15 23:27:10 +00:00
Vector<gid_t> gids;
gids.resize(count);
copy_from_user(gids.data(), user_gids, sizeof(gid_t) * count);
Kernel: Use a FixedArray for a process's extra GIDs There's not really enough of these to justify using a HashTable.
2020-02-18 09:19:32 +00:00
HashTable<gid_t> unique_extra_gids;
for (auto& gid : gids) {
if (gid != m_gid)
unique_extra_gids.set(gid);
}
m_extra_gids.resize(unique_extra_gids.size());
size_t i = 0;
for (auto& gid : unique_extra_gids) {
if (gid == m_gid)
Kernel: Don't include the process GID in the "extra GIDs" table Process::m_extra_gids is for supplementary GIDs only.
2020-01-02 22:45:52 +00:00
continue;
Kernel: Use a FixedArray for a process's extra GIDs There's not really enough of these to justify using a HashTable.
2020-02-18 09:19:32 +00:00
m_extra_gids[i++] = gid;
Kernel: Don't include the process GID in the "extra GIDs" table Process::m_extra_gids is for supplementary GIDs only.
2020-01-02 22:45:52 +00:00
}
Add some basic setgroups(), getgroups() and initgroups(). Also teach /bin/id to print the user's supplemental groups.
2018-11-07 00:38:51 +00:00
return 0;
}
Finally hook up the mkdir code to a syscall. Added a /bin/mkdir that makes directories. How very neat :^) There are various limitations because of missing functionality.
2018-11-18 13:57:41 +00:00
Kernel: Pass path+length to mkdir(), rmdir() and chmod()
2020-01-06 10:05:59 +00:00
int Process::sys$mkdir(const char* user_path, size_t path_length, mode_t mode)
Finally hook up the mkdir code to a syscall. Added a /bin/mkdir that makes directories. How very neat :^) There are various limitations because of missing functionality.
2018-11-18 13:57:41 +00:00
{
ping: Use pledge()
2020-01-11 19:48:43 +00:00
REQUIRE_PROMISE(cpath);
Kernel: Pass path+length to mkdir(), rmdir() and chmod()
2020-01-06 10:05:59 +00:00
auto path = get_syscall_path_argument(user_path, path_length);
if (path.is_error())
return path.error();
return VFS::the().mkdir(path.value(), mode & ~umask(), current_directory());
Finally hook up the mkdir code to a syscall. Added a /bin/mkdir that makes directories. How very neat :^) There are various limitations because of missing functionality.
2018-11-18 13:57:41 +00:00
}
Implement basic support for times(). The kernel now bills processes for time spent in kernelspace and userspace separately. The accounting is forwarded to the parent process in reap(). This makes the "time" builtin in bash work.
2018-12-03 00:12:26 +00:00
Kernel: Make realpath() take path+length, get rid of SmapDisabler
2020-01-06 10:32:25 +00:00
int Process::sys$realpath(const Syscall::SC_realpath_params* user_params)
Kernel: Add realpath syscall
2019-08-25 16:17:05 +00:00
{
ping: Use pledge()
2020-01-11 19:48:43 +00:00
REQUIRE_PROMISE(rpath);
Kernel: Add realpath syscall
2019-08-25 16:17:05 +00:00
Kernel: Make realpath() take path+length, get rid of SmapDisabler
2020-01-06 10:32:25 +00:00
Syscall::SC_realpath_params params;
Kernel: Combine validate and copy of user mode pointers (#1069) Right now there is a significant amount of boiler plate code required to validate user mode parameters in syscalls. In an attempt to reduce this a bit, introduce validate_read_and_copy_typed which combines the usermode address check and does the copy internally if the validation passes. This cleans up a little bit of code from a significant amount of syscalls.
2020-01-13 10:19:18 +00:00
if (!validate_read_and_copy_typed(&params, user_params))
return -EFAULT;
Kernel: Make realpath() take path+length, get rid of SmapDisabler
2020-01-06 10:32:25 +00:00
Kernel: Use the Syscall string and buffer types more While I was updating syscalls to stop passing null-terminated strings, I added some helpful struct types: - StringArgument { const char*; size_t; } - ImmutableBuffer<Data, Size> { const Data*; Size; } - MutableBuffer<Data, Size> { Data*; Size; } The Process class has some convenience functions for validating and optionally extracting the contents from these structs: - get_syscall_path_argument(StringArgument) - validate_and_copy_string_from_user(StringArgument) - validate(ImmutableBuffer) - validate(MutableBuffer) There's still so much code around this and I'm wondering if we should generate most of it instead. Possible nice little project.
2020-01-11 11:47:47 +00:00
if (!validate_write(params.buffer.data, params.buffer.size))
Kernel: Add realpath syscall
2019-08-25 16:17:05 +00:00
return -EFAULT;
Kernel: Use the Syscall string and buffer types more While I was updating syscalls to stop passing null-terminated strings, I added some helpful struct types: - StringArgument { const char*; size_t; } - ImmutableBuffer<Data, Size> { const Data*; Size; } - MutableBuffer<Data, Size> { Data*; Size; } The Process class has some convenience functions for validating and optionally extracting the contents from these structs: - get_syscall_path_argument(StringArgument) - validate_and_copy_string_from_user(StringArgument) - validate(ImmutableBuffer) - validate(MutableBuffer) There's still so much code around this and I'm wondering if we should generate most of it instead. Possible nice little project.
2020-01-11 11:47:47 +00:00
auto path = get_syscall_path_argument(params.path);
Kernel: Make realpath() take path+length, get rid of SmapDisabler
2020-01-06 10:32:25 +00:00
if (path.is_error())
return path.error();
auto custody_or_error = VFS::the().resolve_path(path.value(), current_directory());
Kernel: Add realpath syscall
2019-08-25 16:17:05 +00:00
if (custody_or_error.is_error())
return custody_or_error.error();
auto& custody = custody_or_error.value();
Kernel: Remove the use of FileSystemPath in sys$realpath() Now that VFS::resolve_path() canonicalizes paths automatically, we don't need to do that here anymore.
2020-01-15 11:05:49 +00:00
auto absolute_path = custody->absolute_path();
Kernel: Add realpath syscall
2019-08-25 16:17:05 +00:00
Kernel: Remove the use of FileSystemPath in sys$realpath() Now that VFS::resolve_path() canonicalizes paths automatically, we don't need to do that here anymore.
2020-01-15 11:05:49 +00:00
if (absolute_path.length() + 1 > params.buffer.size)
Kernel: Make realpath() take path+length, get rid of SmapDisabler
2020-01-06 10:32:25 +00:00
return -ENAMETOOLONG;
Kernel: Remove the use of FileSystemPath in sys$realpath() Now that VFS::resolve_path() canonicalizes paths automatically, we don't need to do that here anymore.
2020-01-15 11:05:49 +00:00
copy_to_user(params.buffer.data, absolute_path.characters(), absolute_path.length() + 1);
Kernel: Add realpath syscall
2019-08-25 16:17:05 +00:00
return 0;
};
Kernel: Get rid of Unix namespace. This is no longer needed as the Kernel can stand on its own legs now and there won't be any conflict with host system data types.
2019-01-23 05:53:01 +00:00
clock_t Process::sys$times(tms* times)
Implement basic support for times(). The kernel now bills processes for time spent in kernelspace and userspace separately. The accounting is forwarded to the parent process in reap(). This makes the "time" builtin in bash work.
2018-12-03 00:12:26 +00:00
{
ping: Use pledge()
2020-01-11 19:48:43 +00:00
REQUIRE_PROMISE(stdio);
Implement basic support for times(). The kernel now bills processes for time spent in kernelspace and userspace separately. The accounting is forwarded to the parent process in reap(). This makes the "time" builtin in bash work.
2018-12-03 00:12:26 +00:00
if (!validate_write_typed(times))
return -EFAULT;
Kernel: Use the templated copy_to/from_user() in more places These ensure that the "to" and "from" pointers have the same type, and also that we copy the correct number of bytes.
2020-01-20 12:38:31 +00:00
copy_to_user(&times->tms_utime, &m_ticks_in_user);
copy_to_user(&times->tms_stime, &m_ticks_in_kernel);
copy_to_user(&times->tms_cutime, &m_ticks_in_user_for_dead_children);
copy_to_user(&times->tms_cstime, &m_ticks_in_kernel_for_dead_children);
Kernel: Make the times() syscall return something other than 0. Based on the description I read, this syscall doesn't seem completely reasonable, but let's at least return a number that is likely to change between invocations in case somebody depends on that happening.
2019-05-17 18:19:29 +00:00
return g_uptime & 0x7fffffff;
Implement basic support for times(). The kernel now bills processes for time spent in kernelspace and userspace separately. The accounting is forwarded to the parent process in reap(). This makes the "time" builtin in bash work.
2018-12-03 00:12:26 +00:00
}
Switch into 1024x768x32bpp VESA LFB mode at boot. This is going to be pretty cool once I can hook up the Widgets/ code to it.
2019-01-09 01:29:11 +00:00
Implement basic support for POSIX-style select(). Now we can block on both the PTY *and* the GUI event stream in Terminal.
2019-01-15 22:12:20 +00:00
int Process::sys$select(const Syscall::SC_select_params* params)
{
ping: Use pledge()
2020-01-11 19:48:43 +00:00
REQUIRE_PROMISE(stdio);
Kernel: Tidy up sys$select() to make it more readable.
2019-06-06 15:46:41 +00:00
// FIXME: Return -EINVAL if timeout is invalid.
Implement basic support for POSIX-style select(). Now we can block on both the PTY *and* the GUI event stream in Terminal.
2019-01-15 22:12:20 +00:00
if (!validate_read_typed(params))
return -EFAULT;
Kernel: Use C++ structured bindings to bind syscall parameters Some syscalls have to pass parameters through a struct, since we can only fit 3 parameters with our calling convention. This patch makes use of C++ structured binding to clean up the places where we expand those parameters structs into local variables.
2019-11-10 14:32:59 +00:00
Kernel: Start implementing x86 SMAP support Supervisor Mode Access Prevention (SMAP) is an x86 CPU feature that prevents the kernel from accessing userspace memory. With SMAP enabled, trying to read/write a userspace memory address while in the kernel will now generate a page fault. Since it's sometimes necessary to read/write userspace memory, there are two new instructions that quickly switch the protection on/off: STAC (disables protection) and CLAC (enables protection.) These are exposed in kernel code via the stac() and clac() helpers. There's also a SmapDisabler RAII object that can be used to ensure that you don't forget to re-enable protection before returning to userspace code. THis patch also adds copy_to_user(), copy_from_user() and memset_user() which are the "correct" way of doing things. These functions allow us to briefly disable protection for a specific purpose, and then turn it back on immediately after it's done. Going forward all kernel code should be moved to using these and all uses of SmapDisabler are to be considered FIXME's. Note that we're not realizing the full potential of this feature since I've used SmapDisabler quite liberally in this initial bring-up patch.
2020-01-05 17:00:15 +00:00
SmapDisabler disabler;
Kernel: Fix bad TOCTOU pattern in syscalls that take a parameter struct Our syscall calling convention only allows passing up to 3 arguments in registers. For syscalls that take more arguments, we bake them into a struct and pass a pointer to that struct instead. When doing pointer validation, this is what we would do: 1) Validate the "params" struct 2) Validate "params->some_pointer" 3) ... other stuff ... 4) Use "params->some_pointer" Since the parameter struct is stored in userspace, it can be modified by userspace after validation has completed. This was a recurring pattern in many syscalls that was further hidden by me using structured binding declarations to give convenient local names to things in the parameter struct: auto& [some_pointer, ...] = *params; memcpy(some_pointer, ...); This devilishly makes "some_pointer" look like a local variable but it's actually more like an alias for "params->some_pointer" and will expand to a dereference when accessed! This patch fixes the issues by explicitly copying out each member from the parameter structs before validating them, and then never using the "param" pointers beyond that. Thanks to braindead for finding this bug! :^)
2020-01-05 08:13:00 +00:00
int nfds = params->nfds;
fd_set* readfds = params->readfds;
fd_set* writefds = params->writefds;
fd_set* exceptfds = params->exceptfds;
timeval* timeout = params->timeout;
Kernel: Use C++ structured bindings to bind syscall parameters Some syscalls have to pass parameters through a struct, since we can only fit 3 parameters with our calling convention. This patch makes use of C++ structured binding to clean up the places where we expand those parameters structs into local variables.
2019-11-10 14:32:59 +00:00
if (writefds && !validate_write_typed(writefds))
Implement basic support for POSIX-style select(). Now we can block on both the PTY *and* the GUI event stream in Terminal.
2019-01-15 22:12:20 +00:00
return -EFAULT;
Kernel: Use C++ structured bindings to bind syscall parameters Some syscalls have to pass parameters through a struct, since we can only fit 3 parameters with our calling convention. This patch makes use of C++ structured binding to clean up the places where we expand those parameters structs into local variables.
2019-11-10 14:32:59 +00:00
if (readfds && !validate_write_typed(readfds))
Implement basic support for POSIX-style select(). Now we can block on both the PTY *and* the GUI event stream in Terminal.
2019-01-15 22:12:20 +00:00
return -EFAULT;
Kernel: Use C++ structured bindings to bind syscall parameters Some syscalls have to pass parameters through a struct, since we can only fit 3 parameters with our calling convention. This patch makes use of C++ structured binding to clean up the places where we expand those parameters structs into local variables.
2019-11-10 14:32:59 +00:00
if (exceptfds && !validate_write_typed(exceptfds))
Implement basic support for POSIX-style select(). Now we can block on both the PTY *and* the GUI event stream in Terminal.
2019-01-15 22:12:20 +00:00
return -EFAULT;
Kernel: Use C++ structured bindings to bind syscall parameters Some syscalls have to pass parameters through a struct, since we can only fit 3 parameters with our calling convention. This patch makes use of C++ structured binding to clean up the places where we expand those parameters structs into local variables.
2019-11-10 14:32:59 +00:00
if (timeout && !validate_read_typed(timeout))
Implement basic support for POSIX-style select(). Now we can block on both the PTY *and* the GUI event stream in Terminal.
2019-01-15 22:12:20 +00:00
return -EFAULT;
Kernel: Use C++ structured bindings to bind syscall parameters Some syscalls have to pass parameters through a struct, since we can only fit 3 parameters with our calling convention. This patch makes use of C++ structured binding to clean up the places where we expand those parameters structs into local variables.
2019-11-10 14:32:59 +00:00
if (nfds < 0)
Kernel: Tidy up sys$select() to make it more readable.
2019-06-06 15:46:41 +00:00
return -EINVAL;
Implement basic support for POSIX-style select(). Now we can block on both the PTY *and* the GUI event stream in Terminal.
2019-01-15 22:12:20 +00:00
Kernel: Use C++ structured bindings to bind syscall parameters Some syscalls have to pass parameters through a struct, since we can only fit 3 parameters with our calling convention. This patch makes use of C++ structured binding to clean up the places where we expand those parameters structs into local variables.
2019-11-10 14:32:59 +00:00
timeval computed_timeout;
Kernel: Port select to ThreadBlocker
2019-07-18 15:39:49 +00:00
bool select_has_timeout = false;
Kernel: Use C++ structured bindings to bind syscall parameters Some syscalls have to pass parameters through a struct, since we can only fit 3 parameters with our calling convention. This patch makes use of C++ structured binding to clean up the places where we expand those parameters structs into local variables.
2019-11-10 14:32:59 +00:00
if (timeout && (timeout->tv_sec || timeout->tv_usec)) {
Process: Use monotonic time for timeouts
2020-03-13 23:02:06 +00:00
timeval_add(Scheduler::time_since_boot(), *timeout, computed_timeout);
Kernel: Port select to ThreadBlocker
2019-07-18 15:39:49 +00:00
select_has_timeout = true;
Implement event loop timers. GObjects can now register a timer with the GEventLoop. This will eventually cause GTimerEvents to be dispatched to the GObject. This needed a few supporting changes in the kernel: - The PIT now ticks 1000 times/sec. - select() now supports an arbitrary timeout. - gettimeofday() now returns something in the tv_usec field. With these changes, the clock window in guitest2 finally ticks on its own.
2019-02-01 02:50:06 +00:00
}
Implement basic support for POSIX-style select(). Now we can block on both the PTY *and* the GUI event stream in Terminal.
2019-01-15 22:12:20 +00:00
Kernel: Avoid allocations for Select vectors by using inline capacity Good tip by Andreas :)
2019-07-19 07:04:12 +00:00
Thread::SelectBlocker::FDVector rfds;
Thread::SelectBlocker::FDVector wfds;
Thread::SelectBlocker::FDVector efds;
Kernel: Port select to ThreadBlocker
2019-07-18 15:39:49 +00:00
Kernel: Run clang-format on everything.
2019-06-07 09:43:58 +00:00
auto transfer_fds = [&](auto* fds, auto& vector) -> int {
Kernel: Make sure to clear FD sets when preparing for a select NULL sets can happen, and we don't want to incorrectly return FDs which aren't in the set too.
2019-05-18 00:00:54 +00:00
vector.clear_with_capacity();
Kernel: Tidy up sys$select() to make it more readable.
2019-06-06 15:46:41 +00:00
if (!fds)
Kernel: select() should fail with EBADF if any set contains an invalid fd.
2019-01-30 18:01:31 +00:00
return 0;
Kernel: Fix bad TOCTOU pattern in syscalls that take a parameter struct Our syscall calling convention only allows passing up to 3 arguments in registers. For syscalls that take more arguments, we bake them into a struct and pass a pointer to that struct instead. When doing pointer validation, this is what we would do: 1) Validate the "params" struct 2) Validate "params->some_pointer" 3) ... other stuff ... 4) Use "params->some_pointer" Since the parameter struct is stored in userspace, it can be modified by userspace after validation has completed. This was a recurring pattern in many syscalls that was further hidden by me using structured binding declarations to give convenient local names to things in the parameter struct: auto& [some_pointer, ...] = *params; memcpy(some_pointer, ...); This devilishly makes "some_pointer" look like a local variable but it's actually more like an alias for "params->some_pointer" and will expand to a dereference when accessed! This patch fixes the issues by explicitly copying out each member from the parameter structs before validating them, and then never using the "param" pointers beyond that. Thanks to braindead for finding this bug! :^)
2020-01-05 08:13:00 +00:00
for (int fd = 0; fd < nfds; ++fd) {
Kernel: Tidy up sys$select() to make it more readable.
2019-06-06 15:46:41 +00:00
if (FD_ISSET(fd, fds)) {
WindowServer: Port to the new IPC system This patch introduces code generation for the WindowServer IPC with its clients. The client/server endpoints are defined by the two .ipc files in Servers/WindowServer/: WindowServer.ipc and WindowClient.ipc It now becomes significantly easier to add features and capabilities to WindowServer since you don't have to know nearly as much about all the intricate paths that IPC messages take between LibGUI and WSWindow. The new system also uses significantly less IPC bandwidth since we're now doing packed serialization instead of passing fixed-sized structs of ~600 bytes for each message. Some repaint coalescing optimizations are lost in this conversion and we'll need to look at how to implement those in the new world. The old CoreIPC::Client::Connection and CoreIPC::Server::Connection classes are removed by this patch and replaced by use of ConnectionNG, which will be renamed eventually. Goodbye, old WindowServer IPC. You served us well :^)
2019-12-02 08:33:37 +00:00
if (!file_description(fd)) {
Kernel: Tidy up debug logging a little bit When using dbg() in the kernel, the output is automatically prefixed with [Process(PID:TID)]. This makes it a lot easier to understand which thread is generating the output. This patch also cleans up some common logging messages and removes the now-unnecessary "dbg() << *current << ..." pattern.
2020-01-21 15:14:39 +00:00
dbg() << "sys$select: Bad fd number " << fd;
Kernel: select() should fail with EBADF if any set contains an invalid fd.
2019-01-30 18:01:31 +00:00
return -EBADF;
WindowServer: Port to the new IPC system This patch introduces code generation for the WindowServer IPC with its clients. The client/server endpoints are defined by the two .ipc files in Servers/WindowServer/: WindowServer.ipc and WindowClient.ipc It now becomes significantly easier to add features and capabilities to WindowServer since you don't have to know nearly as much about all the intricate paths that IPC messages take between LibGUI and WSWindow. The new system also uses significantly less IPC bandwidth since we're now doing packed serialization instead of passing fixed-sized structs of ~600 bytes for each message. Some repaint coalescing optimizations are lost in this conversion and we'll need to look at how to implement those in the new world. The old CoreIPC::Client::Connection and CoreIPC::Server::Connection classes are removed by this patch and replaced by use of ConnectionNG, which will be renamed eventually. Goodbye, old WindowServer IPC. You served us well :^)
2019-12-02 08:33:37 +00:00
}
Kernel: Tidy up sys$select() to make it more readable.
2019-06-06 15:46:41 +00:00
vector.append(fd);
Kernel: select() should fail with EBADF if any set contains an invalid fd.
2019-01-30 18:01:31 +00:00
}
Implement basic support for POSIX-style select(). Now we can block on both the PTY *and* the GUI event stream in Terminal.
2019-01-15 22:12:20 +00:00
}
Kernel: select() should fail with EBADF if any set contains an invalid fd.
2019-01-30 18:01:31 +00:00
return 0;
Implement basic support for POSIX-style select(). Now we can block on both the PTY *and* the GUI event stream in Terminal.
2019-01-15 22:12:20 +00:00
};
Kernel: Use C++ structured bindings to bind syscall parameters Some syscalls have to pass parameters through a struct, since we can only fit 3 parameters with our calling convention. This patch makes use of C++ structured binding to clean up the places where we expand those parameters structs into local variables.
2019-11-10 14:32:59 +00:00
if (int error = transfer_fds(writefds, wfds))
Kernel: select() should fail with EBADF if any set contains an invalid fd.
2019-01-30 18:01:31 +00:00
return error;
Kernel: Use C++ structured bindings to bind syscall parameters Some syscalls have to pass parameters through a struct, since we can only fit 3 parameters with our calling convention. This patch makes use of C++ structured binding to clean up the places where we expand those parameters structs into local variables.
2019-11-10 14:32:59 +00:00
if (int error = transfer_fds(readfds, rfds))
Kernel: select() should fail with EBADF if any set contains an invalid fd.
2019-01-30 18:01:31 +00:00
return error;
Kernel: Use C++ structured bindings to bind syscall parameters Some syscalls have to pass parameters through a struct, since we can only fit 3 parameters with our calling convention. This patch makes use of C++ structured binding to clean up the places where we expand those parameters structs into local variables.
2019-11-10 14:32:59 +00:00
if (int error = transfer_fds(exceptfds, efds))
More compat work towards porting vim. It now builds and runs in the small-featureset configuration. :^)
2019-02-26 23:02:01 +00:00
return error;
Implement basic support for POSIX-style select(). Now we can block on both the PTY *and* the GUI event stream in Terminal.
2019-01-15 22:12:20 +00:00
Kernel: Add the ability to debug poll/select independently of read/write
2019-05-19 08:24:28 +00:00
#if defined(DEBUG_IO) || defined(DEBUG_POLL_SELECT)
Kernel: Simplify some dbg() logging We don't have to log the process name/PID/TID, dbg() automatically adds that as a prefix to every line. Also we don't have to do .characters() on Strings passed to dbg() :^)
2020-02-29 11:51:44 +00:00
dbg() << "selecting on (read:" << rfds.size() << ", write:" << wfds.size() << "), timeout=" << timeout;
Rework WindowServer to use select() in its main event loop. The system can finally idle without burning CPU. :^) There are some issues with scheduling making the mouse cursor sloppy and unresponsive that need to be dealt with.
2019-01-16 16:20:58 +00:00
#endif
Kernel: Use C++ structured bindings to bind syscall parameters Some syscalls have to pass parameters through a struct, since we can only fit 3 parameters with our calling convention. This patch makes use of C++ structured binding to clean up the places where we expand those parameters structs into local variables.
2019-11-10 14:32:59 +00:00
if (!timeout || select_has_timeout) {
Kernel: Replace "current" with Thread::current and Process::current Suggested by Sergey. The currently running Thread and Process are now Thread::current and Process::current respectively. :^)
2020-02-17 14:04:27 +00:00
if (Thread::current->block<Thread::SelectBlocker>(computed_timeout, select_has_timeout, rfds, wfds, efds) != Thread::BlockResult::WokeNormally)
Process: Fix select/poll EINTR Check for EINTR before doing anything with the passed sets, otherwise we zero them out which means a re-call with the same sets won't work.
2019-07-21 11:31:20 +00:00
return -EINTR;
Kernel: Fix race in select This is similar to 28e1da344d1de4fb80ce9e9c8da9127fa8606dc7 and 4dd4dd2f3c067eca446d9513e814ae9aaa648882. The crux is that select verifies that the filedescriptor sets are writable *before* blocking, and writes to them *after* blocking. In the meantime, a concurrent thread can make the output buffer unwritable, e.g. by deallocating it.
2020-03-07 22:38:47 +00:00
// While we blocked, the process lock was dropped. This gave other threads
// the opportunity to mess with the memory. For example, it could free the
// region, and map it to a region to which it has no write permissions.
// Therefore, we need to re-validate all pointers.
if (writefds && !validate_write_typed(writefds))
return -EFAULT;
if (readfds && !validate_write_typed(readfds))
return -EFAULT;
// See the fixme below.
if (exceptfds && !validate_write_typed(exceptfds))
return -EFAULT;
Process: Fix select/poll EINTR Check for EINTR before doing anything with the passed sets, otherwise we zero them out which means a re-call with the same sets won't work.
2019-07-21 11:31:20 +00:00
}
Implement basic support for POSIX-style select(). Now we can block on both the PTY *and* the GUI event stream in Terminal.
2019-01-15 22:12:20 +00:00
Kernel: Tidy up sys$select() to make it more readable.
2019-06-06 15:46:41 +00:00
int marked_fd_count = 0;
Kernel: Run clang-format on everything.
2019-06-07 09:43:58 +00:00
auto mark_fds = [&](auto* fds, auto& vector, auto should_mark) {
Kernel: Tidy up sys$select() to make it more readable.
2019-06-06 15:46:41 +00:00
if (!fds)
return;
FD_ZERO(fds);
for (int fd : vector) {
Kernel: Make Process::file_description() vend a RefPtr<FileDescription> This encourages callers to strongly reference file descriptions while working with them. This fixes a use-after-free issue where one thread would close() an open fd while another thread was blocked on it becoming readable. Test: Kernel/uaf-close-while-blocked-in-read.cpp
2020-01-07 14:53:42 +00:00
if (auto description = file_description(fd); description && should_mark(*description)) {
Kernel: Tidy up sys$select() to make it more readable.
2019-06-06 15:46:41 +00:00
FD_SET(fd, fds);
++marked_fd_count;
Implement basic support for POSIX-style select(). Now we can block on both the PTY *and* the GUI event stream in Terminal.
2019-01-15 22:12:20 +00:00
}
}
Kernel: Tidy up sys$select() to make it more readable.
2019-06-06 15:46:41 +00:00
};
Kernel: Use C++ structured bindings to bind syscall parameters Some syscalls have to pass parameters through a struct, since we can only fit 3 parameters with our calling convention. This patch makes use of C++ structured binding to clean up the places where we expand those parameters structs into local variables.
2019-11-10 14:32:59 +00:00
mark_fds(readfds, rfds, [](auto& description) { return description.can_read(); });
mark_fds(writefds, wfds, [](auto& description) { return description.can_write(); });
// FIXME: We should also mark exceptfds as appropriate.
Thread: Return a result from block() indicating why the block terminated And use this to return EINTR in various places; some of which we were not handling properly before. This might expose a few bugs in userspace, but should be more compatible with other POSIX systems, and is certainly a little cleaner.
2019-07-20 09:05:52 +00:00
Kernel: Tidy up sys$select() to make it more readable.
2019-06-06 15:46:41 +00:00
return marked_fd_count;
Implement basic support for POSIX-style select(). Now we can block on both the PTY *and* the GUI event stream in Terminal.
2019-01-15 22:12:20 +00:00
}
Rework WindowServer to use select() in its main event loop. The system can finally idle without burning CPU. :^) There are some issues with scheduling making the mouse cursor sloppy and unresponsive that need to be dealt with.
2019-01-16 16:20:58 +00:00
Stub out poll() syscall and LibC wrapper.
2019-01-23 06:27:41 +00:00
int Process::sys$poll(pollfd* fds, int nfds, int timeout)
{
ping: Use pledge()
2020-01-11 19:48:43 +00:00
REQUIRE_PROMISE(stdio);
Stub out poll() syscall and LibC wrapper.
2019-01-23 06:27:41 +00:00
if (!validate_read_typed(fds))
return -EFAULT;
Kernel: Implement a limited version of POSIX poll().
2019-01-23 07:03:31 +00:00
Kernel: Start implementing x86 SMAP support Supervisor Mode Access Prevention (SMAP) is an x86 CPU feature that prevents the kernel from accessing userspace memory. With SMAP enabled, trying to read/write a userspace memory address while in the kernel will now generate a page fault. Since it's sometimes necessary to read/write userspace memory, there are two new instructions that quickly switch the protection on/off: STAC (disables protection) and CLAC (enables protection.) These are exposed in kernel code via the stac() and clac() helpers. There's also a SmapDisabler RAII object that can be used to ensure that you don't forget to re-enable protection before returning to userspace code. THis patch also adds copy_to_user(), copy_from_user() and memset_user() which are the "correct" way of doing things. These functions allow us to briefly disable protection for a specific purpose, and then turn it back on immediately after it's done. Going forward all kernel code should be moved to using these and all uses of SmapDisabler are to be considered FIXME's. Note that we're not realizing the full potential of this feature since I've used SmapDisabler quite liberally in this initial bring-up patch.
2020-01-05 17:00:15 +00:00
SmapDisabler disabler;
Kernel: Avoid allocations for Select vectors by using inline capacity Good tip by Andreas :)
2019-07-19 07:04:12 +00:00
Thread::SelectBlocker::FDVector rfds;
Thread::SelectBlocker::FDVector wfds;
Kernel: Port select to ThreadBlocker
2019-07-18 15:39:49 +00:00
Kernel: Implement a limited version of POSIX poll().
2019-01-23 07:03:31 +00:00
for (int i = 0; i < nfds; ++i) {
if (fds[i].events & POLLIN)
Kernel: Port select to ThreadBlocker
2019-07-18 15:39:49 +00:00
rfds.append(fds[i].fd);
Kernel: Implement a limited version of POSIX poll().
2019-01-23 07:03:31 +00:00
if (fds[i].events & POLLOUT)
Kernel: Port select to ThreadBlocker
2019-07-18 15:39:49 +00:00
wfds.append(fds[i].fd);
Kernel: Implement a limited version of POSIX poll().
2019-01-23 07:03:31 +00:00
}
Kernel: Port select to ThreadBlocker
2019-07-18 15:39:49 +00:00
timeval actual_timeout;
bool has_timeout = false;
Kernel: Fix poll() with timeout
2019-05-18 01:59:48 +00:00
if (timeout >= 0) {
// poll is in ms, we want s/us.
struct timeval tvtimeout;
tvtimeout.tv_sec = 0;
while (timeout >= 1000) {
tvtimeout.tv_sec += 1;
timeout -= 1000;
}
tvtimeout.tv_usec = timeout * 1000;
Process: Use monotonic time for timeouts
2020-03-13 23:02:06 +00:00
timeval_add(Scheduler::time_since_boot(), tvtimeout, actual_timeout);
Kernel: Port select to ThreadBlocker
2019-07-18 15:39:49 +00:00
has_timeout = true;
Kernel: Fix poll() with timeout
2019-05-18 01:59:48 +00:00
}
Kernel: Add the ability to debug poll/select independently of read/write
2019-05-19 08:24:28 +00:00
#if defined(DEBUG_IO) || defined(DEBUG_POLL_SELECT)
Kernel: Simplify some dbg() logging We don't have to log the process name/PID/TID, dbg() automatically adds that as a prefix to every line. Also we don't have to do .characters() on Strings passed to dbg() :^)
2020-02-29 11:51:44 +00:00
dbg() << "polling on (read:" << rfds.size() << ", write:" << wfds.size() << "), timeout=" << timeout;
Kernel: Add the ability to debug poll/select independently of read/write
2019-05-19 08:24:28 +00:00
#endif
Kernel: mount system call (#396) It is now possible to mount ext2 `DiskDevice` devices under Serenity on any folder in the root filesystem. Currently any user can do this with any permissions. There's a fair amount of assumptions made here too, that might not be too good, but can be worked on in the future. This is a good start to allow more dynamic operation under the OS itself. It is also currently impossible to unmount and such, and devices will fail to mount in Linux as the FS 'needs to be cleaned'. I'll work on getting `umount` done ASAP to rectify this (as well as working on less assumption-making in the mount syscall. We don't want to just be able to mount DiskDevices!). This could probably be fixed with some `-t` flag or something similar.
2019-08-02 13:18:47 +00:00
if (has_timeout || timeout < 0) {
Kernel: Replace "current" with Thread::current and Process::current Suggested by Sergey. The currently running Thread and Process are now Thread::current and Process::current respectively. :^)
2020-02-17 14:04:27 +00:00
if (Thread::current->block<Thread::SelectBlocker>(actual_timeout, has_timeout, rfds, wfds, Thread::SelectBlocker::FDVector()) != Thread::BlockResult::WokeNormally)
Process: Fix select/poll EINTR Check for EINTR before doing anything with the passed sets, otherwise we zero them out which means a re-call with the same sets won't work.
2019-07-21 11:31:20 +00:00
return -EINTR;
}
Kernel: Implement a limited version of POSIX poll().
2019-01-23 07:03:31 +00:00
int fds_with_revents = 0;
for (int i = 0; i < nfds; ++i) {
Kernel: Make Process::file_description() vend a RefPtr<FileDescription> This encourages callers to strongly reference file descriptions while working with them. This fixes a use-after-free issue where one thread would close() an open fd while another thread was blocked on it becoming readable. Test: Kernel/uaf-close-while-blocked-in-read.cpp
2020-01-07 14:53:42 +00:00
auto description = file_description(fds[i].fd);
Kernel: Rename "descriptor" to "description" where appropriate. Now that FileDescription is called that, variables of that type should not be called "descriptor". This is kinda wordy but we'll get used to it.
2019-06-13 20:03:04 +00:00
if (!description) {
Kernel: Implement a limited version of POSIX poll().
2019-01-23 07:03:31 +00:00
fds[i].revents = POLLNVAL;
continue;
}
fds[i].revents = 0;
Kernel: Rename "descriptor" to "description" where appropriate. Now that FileDescription is called that, variables of that type should not be called "descriptor". This is kinda wordy but we'll get used to it.
2019-06-13 20:03:04 +00:00
if (fds[i].events & POLLIN && description->can_read())
Kernel: Implement a limited version of POSIX poll().
2019-01-23 07:03:31 +00:00
fds[i].revents |= POLLIN;
Kernel: Rename "descriptor" to "description" where appropriate. Now that FileDescription is called that, variables of that type should not be called "descriptor". This is kinda wordy but we'll get used to it.
2019-06-13 20:03:04 +00:00
if (fds[i].events & POLLOUT && description->can_write())
Kernel: Implement a limited version of POSIX poll().
2019-01-23 07:03:31 +00:00
fds[i].revents |= POLLOUT;
if (fds[i].revents)
++fds_with_revents;
}
return fds_with_revents;
Stub out poll() syscall and LibC wrapper.
2019-01-23 06:27:41 +00:00
}
Kernel: Rename Process::cwd_custody() to Process::current_directory(). ...and executable_custody() to just executable().
2019-05-30 18:23:50 +00:00
Custody& Process::current_directory()
Rework WindowServer to use select() in its main event loop. The system can finally idle without burning CPU. :^) There are some issues with scheduling making the mouse cursor sloppy and unresponsive that need to be dealt with.
2019-01-16 16:20:58 +00:00
{
Kernel: Rename Process::cwd_custody() to Process::current_directory(). ...and executable_custody() to just executable().
2019-05-30 18:23:50 +00:00
if (!m_cwd)
m_cwd = VFS::the().root_custody();
return *m_cwd;
Rework WindowServer to use select() in its main event loop. The system can finally idle without burning CPU. :^) There are some issues with scheduling making the mouse cursor sloppy and unresponsive that need to be dealt with.
2019-01-16 16:20:58 +00:00
}
Add unlink() syscall and /bin/rm. This patch adds most of the plumbing for working file deletion in Ext2FS. Directory entries are removed and inode link counts updated. We don't yet update the inode or block bitmaps, I will do that separately.
2019-01-22 06:03:44 +00:00
Kernel: Pass characters+length to link()
2020-01-10 20:26:47 +00:00
int Process::sys$link(const Syscall::SC_link_params* user_params)
Kernel: Add link() syscall to create hard links. This accidentally grew into a little bit of VFS cleanup as well. Also add a simple /bin/ln implementation to exercise it.
2019-02-21 12:26:40 +00:00
{
ping: Use pledge()
2020-01-11 19:48:43 +00:00
REQUIRE_PROMISE(cpath);
Kernel: Pass characters+length to link()
2020-01-10 20:26:47 +00:00
Syscall::SC_link_params params;
Kernel: Combine validate and copy of user mode pointers (#1069) Right now there is a significant amount of boiler plate code required to validate user mode parameters in syscalls. In an attempt to reduce this a bit, introduce validate_read_and_copy_typed which combines the usermode address check and does the copy internally if the validation passes. This cleans up a little bit of code from a significant amount of syscalls.
2020-01-13 10:19:18 +00:00
if (!validate_read_and_copy_typed(&params, user_params))
return -EFAULT;
Kernel: Pass characters+length to link()
2020-01-10 20:26:47 +00:00
auto old_path = validate_and_copy_string_from_user(params.old_path);
auto new_path = validate_and_copy_string_from_user(params.new_path);
if (old_path.is_null() || new_path.is_null())
Kernel: Add link() syscall to create hard links. This accidentally grew into a little bit of VFS cleanup as well. Also add a simple /bin/ln implementation to exercise it.
2019-02-21 12:26:40 +00:00
return -EFAULT;
Kernel: Pass characters+length to link()
2020-01-10 20:26:47 +00:00
return VFS::the().link(old_path, new_path, current_directory());
Kernel: Add link() syscall to create hard links. This accidentally grew into a little bit of VFS cleanup as well. Also add a simple /bin/ln implementation to exercise it.
2019-02-21 12:26:40 +00:00
}
Kernel: Take path+length in the unlink() and umount() syscalls
2020-01-09 11:41:15 +00:00
int Process::sys$unlink(const char* user_path, size_t path_length)
Add unlink() syscall and /bin/rm. This patch adds most of the plumbing for working file deletion in Ext2FS. Directory entries are removed and inode link counts updated. We don't yet update the inode or block bitmaps, I will do that separately.
2019-01-22 06:03:44 +00:00
{
ping: Use pledge()
2020-01-11 19:48:43 +00:00
REQUIRE_PROMISE(cpath);
Kernel: Take path+length in the unlink() and umount() syscalls
2020-01-09 11:41:15 +00:00
if (!validate_read(user_path, path_length))
return -EFAULT;
auto path = get_syscall_path_argument(user_path, path_length);
if (path.is_error())
return path.error();
return VFS::the().unlink(path.value(), current_directory());
Add unlink() syscall and /bin/rm. This patch adds most of the plumbing for working file deletion in Ext2FS. Directory entries are removed and inode link counts updated. We don't yet update the inode or block bitmaps, I will do that separately.
2019-01-22 06:03:44 +00:00
}
Terminal: Redraw entire line if any of its characters are dirty. This means we only have to do one fill_rect() per line and the whole process ends up being ~10% faster than before. Also added a read_tsc() syscall to give userspace access to the TSC.
2019-01-25 01:09:29 +00:00
Kernel: Pass a parameter struct to symlink()
2020-01-11 09:31:33 +00:00
int Process::sys$symlink(const Syscall::SC_symlink_params* user_params)
Kernel+Userland: Add symlink() syscall and add "-s" flag to /bin/ln. It's now possible to create symbolic links! :^) This exposed an issue in Ext2FS where we'd write uninitialized data past the end of an inode's content. Fix this by zeroing out the tail end of the last block in a file.
2019-03-02 00:50:34 +00:00
{
ping: Use pledge()
2020-01-11 19:48:43 +00:00
REQUIRE_PROMISE(cpath);
Kernel: Pass a parameter struct to symlink()
2020-01-11 09:31:33 +00:00
Syscall::SC_symlink_params params;
Kernel: Combine validate and copy of user mode pointers (#1069) Right now there is a significant amount of boiler plate code required to validate user mode parameters in syscalls. In an attempt to reduce this a bit, introduce validate_read_and_copy_typed which combines the usermode address check and does the copy internally if the validation passes. This cleans up a little bit of code from a significant amount of syscalls.
2020-01-13 10:19:18 +00:00
if (!validate_read_and_copy_typed(&params, user_params))
return -EFAULT;
Kernel: Use the Syscall string and buffer types more While I was updating syscalls to stop passing null-terminated strings, I added some helpful struct types: - StringArgument { const char*; size_t; } - ImmutableBuffer<Data, Size> { const Data*; Size; } - MutableBuffer<Data, Size> { Data*; Size; } The Process class has some convenience functions for validating and optionally extracting the contents from these structs: - get_syscall_path_argument(StringArgument) - validate_and_copy_string_from_user(StringArgument) - validate(ImmutableBuffer) - validate(MutableBuffer) There's still so much code around this and I'm wondering if we should generate most of it instead. Possible nice little project.
2020-01-11 11:47:47 +00:00
auto target = get_syscall_path_argument(params.target);
Kernel: Pass a parameter struct to symlink()
2020-01-11 09:31:33 +00:00
if (target.is_error())
return target.error();
Kernel: Use the Syscall string and buffer types more While I was updating syscalls to stop passing null-terminated strings, I added some helpful struct types: - StringArgument { const char*; size_t; } - ImmutableBuffer<Data, Size> { const Data*; Size; } - MutableBuffer<Data, Size> { Data*; Size; } The Process class has some convenience functions for validating and optionally extracting the contents from these structs: - get_syscall_path_argument(StringArgument) - validate_and_copy_string_from_user(StringArgument) - validate(ImmutableBuffer) - validate(MutableBuffer) There's still so much code around this and I'm wondering if we should generate most of it instead. Possible nice little project.
2020-01-11 11:47:47 +00:00
auto linkpath = get_syscall_path_argument(params.linkpath);
Kernel: Pass a parameter struct to symlink()
2020-01-11 09:31:33 +00:00
if (linkpath.is_error())
return linkpath.error();
return VFS::the().symlink(target.value(), linkpath.value(), current_directory());
Kernel+Userland: Add symlink() syscall and add "-s" flag to /bin/ln. It's now possible to create symbolic links! :^) This exposed an issue in Ext2FS where we'd write uninitialized data past the end of an inode's content. Fix this by zeroing out the tail end of the last block in a file.
2019-03-02 00:50:34 +00:00
}
Kernel: Use the Syscall string and buffer types more While I was updating syscalls to stop passing null-terminated strings, I added some helpful struct types: - StringArgument { const char*; size_t; } - ImmutableBuffer<Data, Size> { const Data*; Size; } - MutableBuffer<Data, Size> { Data*; Size; } The Process class has some convenience functions for validating and optionally extracting the contents from these structs: - get_syscall_path_argument(StringArgument) - validate_and_copy_string_from_user(StringArgument) - validate(ImmutableBuffer) - validate(MutableBuffer) There's still so much code around this and I'm wondering if we should generate most of it instead. Possible nice little project.
2020-01-11 11:47:47 +00:00
KResultOr<String> Process::get_syscall_path_argument(const char* user_path, size_t path_length) const
Add support for removing directories. It's really only supported in Ext2FS since SynthFS doesn't really want you mucking around with its files. This is pretty neat though :^) I ran into some trouble with HashMap while working on this but opted to work around it and leave that for a separate investigation.
2019-01-28 03:16:01 +00:00
{
Kernel: Pass path+length to mkdir(), rmdir() and chmod()
2020-01-06 10:05:59 +00:00
if (path_length == 0)
return KResult(-EINVAL);
if (path_length > PATH_MAX)
return KResult(-ENAMETOOLONG);
if (!validate_read(user_path, path_length))
return KResult(-EFAULT);
return copy_string_from_user(user_path, path_length);
Add support for removing directories. It's really only supported in Ext2FS since SynthFS doesn't really want you mucking around with its files. This is pretty neat though :^) I ran into some trouble with HashMap while working on this but opted to work around it and leave that for a separate investigation.
2019-01-28 03:16:01 +00:00
}
Kernel: Use the Syscall string and buffer types more While I was updating syscalls to stop passing null-terminated strings, I added some helpful struct types: - StringArgument { const char*; size_t; } - ImmutableBuffer<Data, Size> { const Data*; Size; } - MutableBuffer<Data, Size> { Data*; Size; } The Process class has some convenience functions for validating and optionally extracting the contents from these structs: - get_syscall_path_argument(StringArgument) - validate_and_copy_string_from_user(StringArgument) - validate(ImmutableBuffer) - validate(MutableBuffer) There's still so much code around this and I'm wondering if we should generate most of it instead. Possible nice little project.
2020-01-11 11:47:47 +00:00
KResultOr<String> Process::get_syscall_path_argument(const Syscall::StringArgument& path) const
{
return get_syscall_path_argument(path.characters, path.length);
}
Kernel: Pass path+length to mkdir(), rmdir() and chmod()
2020-01-06 10:05:59 +00:00
int Process::sys$rmdir(const char* user_path, size_t path_length)
Implement basic chmod() syscall and /bin/chmod helper. Only raw octal modes are supported right now. This patch also changes mode_t from 32-bit to 16-bit to match the on-disk type used by Ext2FS. I also ran into EPERM being errno=0 which was confusing, so I inserted an ESUCCESS in its place.
2019-01-29 03:55:08 +00:00
{
ping: Use pledge()
2020-01-11 19:48:43 +00:00
REQUIRE_PROMISE(cpath);
Kernel: Pass path+length to mkdir(), rmdir() and chmod()
2020-01-06 10:05:59 +00:00
auto path = get_syscall_path_argument(user_path, path_length);
if (path.is_error())
return path.error();
return VFS::the().rmdir(path.value(), current_directory());
}
int Process::sys$chmod(const char* user_path, size_t path_length, mode_t mode)
{
ping: Use pledge()
2020-01-11 19:48:43 +00:00
REQUIRE_PROMISE(fattr);
Kernel: Pass path+length to mkdir(), rmdir() and chmod()
2020-01-06 10:05:59 +00:00
auto path = get_syscall_path_argument(user_path, path_length);
if (path.is_error())
return path.error();
return VFS::the().chmod(path.value(), mode, current_directory());
Implement basic chmod() syscall and /bin/chmod helper. Only raw octal modes are supported right now. This patch also changes mode_t from 32-bit to 16-bit to match the on-disk type used by Ext2FS. I also ran into EPERM being errno=0 which was confusing, so I inserted an ESUCCESS in its place.
2019-01-29 03:55:08 +00:00
}
Deallocate PTY's when they close. This required a fair bit of plumbing. The CharacterDevice::close() virtual will now be closed by ~FileDescriptor(), allowing device implementations to do custom cleanup at that point. One big problem remains: if the master PTY is closed before the slave PTY, we go into crashy land.
2019-01-30 17:26:19 +00:00
Kernel+Userland: Implement fchmod() syscall and use it to improve /bin/cp. /bin/cp will now copy the permission bits from source to destination. :^)
2019-03-01 09:39:19 +00:00
int Process::sys$fchmod(int fd, mode_t mode)
{
ping: Use pledge()
2020-01-11 19:48:43 +00:00
REQUIRE_PROMISE(fattr);
Kernel: Make Process::file_description() vend a RefPtr<FileDescription> This encourages callers to strongly reference file descriptions while working with them. This fixes a use-after-free issue where one thread would close() an open fd while another thread was blocked on it becoming readable. Test: Kernel/uaf-close-while-blocked-in-read.cpp
2020-01-07 14:53:42 +00:00
auto description = file_description(fd);
Kernel: Rename "descriptor" to "description" where appropriate. Now that FileDescription is called that, variables of that type should not be called "descriptor". This is kinda wordy but we'll get used to it.
2019-06-13 20:03:04 +00:00
if (!description)
Kernel+Userland: Implement fchmod() syscall and use it to improve /bin/cp. /bin/cp will now copy the permission bits from source to destination. :^)
2019-03-01 09:39:19 +00:00
return -EBADF;
Kernel: Allow fchmod() and fchown() on pre-bind() local sockets In order to ensure a specific owner and mode when the local socket filesystem endpoint is instantiated, we need to be able to call fchmod() and fchown() on a socket fd between socket() and bind(). This is because until we call bind(), there is no filesystem inode for the socket yet.
2020-01-03 19:14:56 +00:00
return description->chmod(mode);
Kernel+Userland: Implement fchmod() syscall and use it to improve /bin/cp. /bin/cp will now copy the permission bits from source to destination. :^)
2019-03-01 09:39:19 +00:00
}
Kernel: Add fchown() syscall.
2019-06-01 18:31:36 +00:00
int Process::sys$fchown(int fd, uid_t uid, gid_t gid)
{
ping: Use pledge()
2020-01-11 19:48:43 +00:00
REQUIRE_PROMISE(chown);
Kernel: Make Process::file_description() vend a RefPtr<FileDescription> This encourages callers to strongly reference file descriptions while working with them. This fixes a use-after-free issue where one thread would close() an open fd while another thread was blocked on it becoming readable. Test: Kernel/uaf-close-while-blocked-in-read.cpp
2020-01-07 14:53:42 +00:00
auto description = file_description(fd);
Kernel: Rename "descriptor" to "description" where appropriate. Now that FileDescription is called that, variables of that type should not be called "descriptor". This is kinda wordy but we'll get used to it.
2019-06-13 20:03:04 +00:00
if (!description)
Kernel: Add fchown() syscall.
2019-06-01 18:31:36 +00:00
return -EBADF;
Kernel: Rename "descriptor" to "description" where appropriate. Now that FileDescription is called that, variables of that type should not be called "descriptor". This is kinda wordy but we'll get used to it.
2019-06-13 20:03:04 +00:00
return description->chown(uid, gid);
Kernel: Add fchown() syscall.
2019-06-01 18:31:36 +00:00
}
Kernel: Pass a parameter struct to chown()
2020-01-11 09:17:08 +00:00
int Process::sys$chown(const Syscall::SC_chown_params* user_params)
Add chown() syscall and a simple /bin/chown program.
2019-02-27 11:32:53 +00:00
{
ping: Use pledge()
2020-01-11 19:48:43 +00:00
REQUIRE_PROMISE(chown);
Kernel: Pass a parameter struct to chown()
2020-01-11 09:17:08 +00:00
Syscall::SC_chown_params params;
Kernel: Combine validate and copy of user mode pointers (#1069) Right now there is a significant amount of boiler plate code required to validate user mode parameters in syscalls. In an attempt to reduce this a bit, introduce validate_read_and_copy_typed which combines the usermode address check and does the copy internally if the validation passes. This cleans up a little bit of code from a significant amount of syscalls.
2020-01-13 10:19:18 +00:00
if (!validate_read_and_copy_typed(&params, user_params))
return -EFAULT;
Kernel: Use the Syscall string and buffer types more While I was updating syscalls to stop passing null-terminated strings, I added some helpful struct types: - StringArgument { const char*; size_t; } - ImmutableBuffer<Data, Size> { const Data*; Size; } - MutableBuffer<Data, Size> { Data*; Size; } The Process class has some convenience functions for validating and optionally extracting the contents from these structs: - get_syscall_path_argument(StringArgument) - validate_and_copy_string_from_user(StringArgument) - validate(ImmutableBuffer) - validate(MutableBuffer) There's still so much code around this and I'm wondering if we should generate most of it instead. Possible nice little project.
2020-01-11 11:47:47 +00:00
auto path = get_syscall_path_argument(params.path);
Kernel: Pass a parameter struct to chown()
2020-01-11 09:17:08 +00:00
if (path.is_error())
return path.error();
return VFS::the().chown(path.value(), params.uid, params.gid, current_directory());
Add chown() syscall and a simple /bin/chown program.
2019-02-27 11:32:53 +00:00
}
Kernel: Add a Finalizer process to take care of dying processes. Instead of processes themselves getting scheduled to finish dying, let's have a Finalizer process that wakes up whenever someone is dying. This way we can do all kinds of lock-taking in process cleanup without risking reentering the scheduler.
2019-02-06 17:45:21 +00:00
void Process::finalize()
Deallocate PTY's when they close. This required a fair bit of plumbing. The CharacterDevice::close() virtual will now be closed by ~FileDescriptor(), allowing device implementations to do custom cleanup at that point. One big problem remains: if the master PTY is closed before the slave PTY, we go into crashy land.
2019-01-30 17:26:19 +00:00
{
Kernel: Replace "current" with Thread::current and Process::current Suggested by Sergey. The currently running Thread and Process are now Thread::current and Process::current respectively. :^)
2020-02-17 14:04:27 +00:00
ASSERT(Thread::current == g_finalizer);
Kernel: Finalizer should not go back to sleep if there's more to do Before putting itself back on the wait queue, the finalizer task will now check if there's more work to do, and if so, do it first. :^) This patch also puts a bunch of process/thread debug logging behind PROCESS_DEBUG and THREAD_DEBUG since it was unbearable to debug this stuff with all the spam.
2020-02-01 09:27:25 +00:00
#ifdef PROCESS_DEBUG
Kernel: Tidy up debug logging a little bit When using dbg() in the kernel, the output is automatically prefixed with [Process(PID:TID)]. This makes it a lot easier to understand which thread is generating the output. This patch also cleans up some common logging messages and removes the now-unnecessary "dbg() << *current << ..." pattern.
2020-01-21 15:14:39 +00:00
dbg() << "Finalizing process " << *this;
Kernel: Finalizer should not go back to sleep if there's more to do Before putting itself back on the wait queue, the finalizer task will now check if there's more work to do, and if so, do it first. :^) This patch also puts a bunch of process/thread debug logging behind PROCESS_DEBUG and THREAD_DEBUG since it was unbearable to debug this stuff with all the spam.
2020-02-01 09:27:25 +00:00
#endif
Kernel: Various stability improvements. - Don't cli() in Process::do_exec() unless current is execing. Eventually this should go away once the scheduler is less retarded in the face of interrupts. - Improved memory access validation for ring0 processes. We now look at the kernel ELF header to determine if an access is appropriate. :^) It's very hackish but also kinda neat. - Have Process::die() put the process into a new "Dying" state where it can still get scheduled but no signals will be dispatched. This way we can keep executing in die() but won't get our EIP hijacked by signal dispatch. The main problem here was that die() wanted to take various locks.
2019-02-06 16:28:14 +00:00
Kernel: Start working on a syscall for logging performance events This patch introduces sys$perf_event() with two event types: - PERF_EVENT_MALLOC - PERF_EVENT_FREE After the first call to sys$perf_event(), a process will begin keeping these events in a buffer. When the process dies, that buffer will be written out to "perfcore" in the current directory unless that filename is already taken. This is probably not the best way to do this, but it's a start and will make it possible to start doing memory allocation profiling. :^)
2020-02-02 19:26:27 +00:00
if (m_perf_event_buffer) {
Kernel: Name perfcore files "perfcore.PID" This way we can trace many things and we get one perfcore file per process instead of everyone trying to write to "perfcore"
2020-03-01 19:58:48 +00:00
auto description_or_error = VFS::the().open(String::format("perfcore.%d", m_pid), O_CREAT | O_EXCL, 0400, current_directory(), UidAndGid { m_uid, m_gid });
Kernel: Start working on a syscall for logging performance events This patch introduces sys$perf_event() with two event types: - PERF_EVENT_MALLOC - PERF_EVENT_FREE After the first call to sys$perf_event(), a process will begin keeping these events in a buffer. When the process dies, that buffer will be written out to "perfcore" in the current directory unless that filename is already taken. This is probably not the best way to do this, but it's a start and will make it possible to start doing memory allocation profiling. :^)
2020-02-02 19:26:27 +00:00
if (!description_or_error.is_error()) {
auto& description = description_or_error.value();
auto json = m_perf_event_buffer->to_json(m_pid, m_executable ? m_executable->absolute_path() : "");
description->write(json.data(), json.size());
}
}
Deallocate PTY's when they close. This required a fair bit of plumbing. The CharacterDevice::close() virtual will now be closed by ~FileDescriptor(), allowing device implementations to do custom cleanup at that point. One big problem remains: if the master PTY is closed before the slave PTY, we go into crashy land.
2019-01-30 17:26:19 +00:00
m_fds.clear();
Kernel: Process should disassociate from its TTY when it dies. Just because we die doesn't mean we got waited on yet, so keeping around a dangling TTY pointer is just asking for trouble.
2019-02-04 09:21:15 +00:00
m_tty = nullptr;
Kernel: Process finalization should release cwd and executable custodies. Since Process destruction happens with interrupts disabled, it's not safe to still hold custodies at that point. Drop them in finalization.
2019-05-31 05:19:54 +00:00
m_executable = nullptr;
m_cwd = nullptr;
Kernel: Add a basic chroot() syscall :^) The chroot() syscall now allows the superuser to isolate a process into a specific subtree of the filesystem. This is not strictly permanent, as it is also possible for a superuser to break *out* of a chroot, but it is a useful mechanism for isolating unprivileged processes. The VFS now uses the current process's root_directory() as the root for path resolution purposes. The root directory is stored as an uncached Custody in the Process object.
2020-01-10 22:14:04 +00:00
m_root_directory = nullptr;
Kernel: Don't forget to copy & destroy root_directory_for_procfs Also, rename it to root_directory_relative_to_global_root.
2020-01-12 18:42:01 +00:00
m_root_directory_relative_to_global_root = nullptr;
Kernel: Discard a process's ELFLoader on finalization. We don't need after that point, and throwing it out might free up some cached data used for backtraces.
2019-05-31 06:03:58 +00:00
Kernel: Add a simple shared memory API for two processes only. And use this to implement shared bitmaps between WindowServer and clients.
2019-02-16 11:13:43 +00:00
disown_all_shared_buffers();
Kernel: Add a Finalizer process to take care of dying processes. Instead of processes themselves getting scheduled to finish dying, let's have a Finalizer process that wakes up whenever someone is dying. This way we can do all kinds of lock-taking in process cleanup without risking reentering the scheduler.
2019-02-06 17:45:21 +00:00
{
InterruptDisabler disabler;
Kernel: Send SIGCHLD to the thread with same PID as my PPID Instead of delivering SIGCHLD to "any thread" in the process with PPID, send it to the thread with the same TID as my PPID.
2020-01-06 13:34:28 +00:00
if (auto* parent_thread = Thread::from_tid(m_ppid)) {
if (parent_thread->m_signal_action_data[SIGCHLD].flags & SA_NOCLDWAIT) {
Kernel: Don't send SIGCHLD to parent process if he has SA_NOCLDWAIT set. Just transfer ownership of the dead process to the colonel and let the scheduler reap it on next iteration.
2019-03-01 14:47:07 +00:00
// NOTE: If the parent doesn't care about this process, let it go.
m_ppid = 0;
} else {
Kernel: Send SIGCHLD to the thread with same PID as my PPID Instead of delivering SIGCHLD to "any thread" in the process with PPID, send it to the thread with the same TID as my PPID.
2020-01-06 13:34:28 +00:00
parent_thread->send_signal(SIGCHLD, this);
Kernel: Don't send SIGCHLD to parent process if he has SA_NOCLDWAIT set. Just transfer ownership of the dead process to the colonel and let the scheduler reap it on next iteration.
2019-03-01 14:47:07 +00:00
}
Kernel: Add a Finalizer process to take care of dying processes. Instead of processes themselves getting scheduled to finish dying, let's have a Finalizer process that wakes up whenever someone is dying. This way we can do all kinds of lock-taking in process cleanup without risking reentering the scheduler.
2019-02-06 17:45:21 +00:00
}
Kernel: Process should send SIGCHLD to its parent when it dies.
2019-02-04 12:30:03 +00:00
}
Kernel: Fix broken destruction order for Process/Thread.
2019-03-24 00:20:35 +00:00
Kernel: Tear down process address space during finalization Process teardown is divided into two main stages: finalize and reap. Finalization happens in the "Finalizer" kernel and runs with interrupts enabled, allowing destructors to take locks, etc. Reaping happens either in sys$waitid() or in the scheduler for orphans. The more work we can do in finalization, the better, since it's fully pre-emptible and reduces the amount of time the system runs without interrupts enabled.
2020-02-17 13:33:06 +00:00
m_regions.clear();
Kernel: Fix broken destruction order for Process/Thread.
2019-03-24 00:20:35 +00:00
m_dead = true;
Deallocate PTY's when they close. This required a fair bit of plumbing. The CharacterDevice::close() virtual will now be closed by ~FileDescriptor(), allowing device implementations to do custom cleanup at that point. One big problem remains: if the master PTY is closed before the slave PTY, we go into crashy land.
2019-01-30 17:26:19 +00:00
}
Kernel: Add a /proc/all process table dump. This will be useful for implementing some process-related utilities.
2019-02-03 17:53:18 +00:00
Kernel: Add a Finalizer process to take care of dying processes. Instead of processes themselves getting scheduled to finish dying, let's have a Finalizer process that wakes up whenever someone is dying. This way we can do all kinds of lock-taking in process cleanup without risking reentering the scheduler.
2019-02-06 17:45:21 +00:00
void Process::die()
{
Kernel: Process should release its TTY immediately on exit Don't wait for someone to wait() on a dead process before releasing its TTY object. This fixes the child process death detection used by the Terminal application, which relies on getting an EOF on the master PTY in order to know it's time to wait() on the child process. :^)
2019-11-10 07:49:23 +00:00
// Let go of the TTY, otherwise a slave PTY may keep the master PTY from
// getting an EOF when the last process using the slave PTY dies.
// If the master PTY owner relies on an EOF to know when to wait() on a
// slave owner, we have to allow the PTY pair to be torn down.
m_tty = nullptr;
Kernel: Allow process with multiple threads to call exec and exit This allows a process wich has more than 1 thread to call exec, even from a thread. This kills all the other threads, but it won't wait for them to finish, just makes sure that they are not in a running/runable state. In the case where a thread does exec, the new program PID will be the thread TID, to keep the PID == TID in the new process. This introduces a new function inside the Process class, kill_threads_except_self which is called on exit() too (exit with multiple threads wasn't properly working either). Inside the Lock class, there is the need for a new function, clear_waiters, which removes all the waiters from the Process::big_lock. This is needed since after a exit/exec, there should be no other threads waiting for this lock, the threads should be simply killed. Only queued threads should wait for this lock at this point, since blocked threads are handled in set_should_die.
2020-02-18 12:28:28 +00:00
kill_all_threads();
Kernel: Add a Finalizer process to take care of dying processes. Instead of processes themselves getting scheduled to finish dying, let's have a Finalizer process that wakes up whenever someone is dying. This way we can do all kinds of lock-taking in process cleanup without risking reentering the scheduler.
2019-02-06 17:45:21 +00:00
}
Kernel+SystemMonitor: Expose amount of per-process dirty private memory Dirty private memory is all memory in non-inode-backed mappings that's process-private, meaning it's not shared with any other process. This patch exposes that number via SystemMonitor, giving us an idea of how much memory each process is responsible for all on its own.
2019-12-29 11:28:32 +00:00
size_t Process::amount_dirty_private() const
{
Kernel+SystemMonitor: Expose amount of per-process clean inode memory This is memory that's loaded from an inode (file) but not modified in memory, so still identical to what's on disk. This kind of memory can be freed and reloaded transparently from disk if needed.
2019-12-29 11:45:58 +00:00
// FIXME: This gets a bit more complicated for Regions sharing the same underlying VMObject.
// The main issue I'm thinking of is when the VMObject has physical pages that none of the Regions are mapping.
// That's probably a situation that needs to be looked at in general.
Kernel+SystemMonitor: Expose amount of per-process dirty private memory Dirty private memory is all memory in non-inode-backed mappings that's process-private, meaning it's not shared with any other process. This patch exposes that number via SystemMonitor, giving us an idea of how much memory each process is responsible for all on its own.
2019-12-29 11:28:32 +00:00
size_t amount = 0;
for (auto& region : m_regions) {
if (!region.is_shared())
amount += region.amount_dirty();
}
return amount;
}
Kernel+SystemMonitor: Expose amount of per-process clean inode memory This is memory that's loaded from an inode (file) but not modified in memory, so still identical to what's on disk. This kind of memory can be freed and reloaded transparently from disk if needed.
2019-12-29 11:45:58 +00:00
size_t Process::amount_clean_inode() const
{
Kernel: Fix harmless type miscast in Process::amount_clean_inode()
2020-03-01 10:23:23 +00:00
HashTable<const InodeVMObject*> vmobjects;
Kernel+SystemMonitor: Expose amount of per-process clean inode memory This is memory that's loaded from an inode (file) but not modified in memory, so still identical to what's on disk. This kind of memory can be freed and reloaded transparently from disk if needed.
2019-12-29 11:45:58 +00:00
for (auto& region : m_regions) {
if (region.vmobject().is_inode())
Kernel: Fix harmless type miscast in Process::amount_clean_inode()
2020-03-01 10:23:23 +00:00
vmobjects.set(&static_cast<const InodeVMObject&>(region.vmobject()));
Kernel+SystemMonitor: Expose amount of per-process clean inode memory This is memory that's loaded from an inode (file) but not modified in memory, so still identical to what's on disk. This kind of memory can be freed and reloaded transparently from disk if needed.
2019-12-29 11:45:58 +00:00
}
size_t amount = 0;
for (auto& vmobject : vmobjects)
amount += vmobject->amount_clean();
return amount;
}
Kernel: Add a /proc/all process table dump. This will be useful for implementing some process-related utilities.
2019-02-03 17:53:18 +00:00
size_t Process::amount_virtual() const
{
size_t amount = 0;
for (auto& region : m_regions) {
Kernel: Use NonnullRefPtrVector in parts of the kernel.
2019-06-27 11:34:28 +00:00
amount += region.size();
Kernel: Add a /proc/all process table dump. This will be useful for implementing some process-related utilities.
2019-02-03 17:53:18 +00:00
}
return amount;
}
size_t Process::amount_resident() const
{
// FIXME: This will double count if multiple regions use the same physical page.
size_t amount = 0;
for (auto& region : m_regions) {
Kernel: Use NonnullRefPtrVector in parts of the kernel.
2019-06-27 11:34:28 +00:00
amount += region.amount_resident();
Kernel: Add a /proc/all process table dump. This will be useful for implementing some process-related utilities.
2019-02-03 17:53:18 +00:00
}
return amount;
}
size_t Process::amount_shared() const
{
// FIXME: This will double count if multiple regions use the same physical page.
Change "retain" to "ref" in various comments.
2019-06-21 16:40:24 +00:00
// FIXME: It doesn't work at the moment, since it relies on PhysicalPage ref counts,
AK: Rename Retainable => RefCounted. (And various related renames that go along with it.)
2019-06-21 13:29:31 +00:00
// and each PhysicalPage is only reffed by its VMObject. This needs to be refactored
Change "retain" to "ref" in various comments.
2019-06-21 16:40:24 +00:00
// so that every Region contributes +1 ref to each of its PhysicalPages.
Kernel: Add a /proc/all process table dump. This will be useful for implementing some process-related utilities.
2019-02-03 17:53:18 +00:00
size_t amount = 0;
for (auto& region : m_regions) {
Kernel: Use NonnullRefPtrVector in parts of the kernel.
2019-06-27 11:34:28 +00:00
amount += region.amount_shared();
Kernel: Add a /proc/all process table dump. This will be useful for implementing some process-related utilities.
2019-02-03 17:53:18 +00:00
}
return amount;
}
Kernel: Add a Finalizer process to take care of dying processes. Instead of processes themselves getting scheduled to finish dying, let's have a Finalizer process that wakes up whenever someone is dying. This way we can do all kinds of lock-taking in process cleanup without risking reentering the scheduler.
2019-02-06 17:45:21 +00:00
Kernel: Start implementing purgeable memory support It's now possible to get purgeable memory by using mmap(MAP_PURGEABLE). Purgeable memory has a "volatile" flag that can be set using madvise(): - madvise(..., MADV_SET_VOLATILE) - madvise(..., MADV_SET_NONVOLATILE) When in the "volatile" state, the kernel may take away the underlying physical memory pages at any time, without notifying the owner. This gives you a guilt discount when caching very large things. :^) Setting a purgeable region to non-volatile will return whether or not the memory has been taken away by the kernel while being volatile. Basically, if madvise(..., MADV_SET_NONVOLATILE) returns 1, that means the memory was purged while volatile, and whatever was in that piece of memory needs to be reconstructed before use.
2019-12-09 18:12:38 +00:00
size_t Process::amount_purgeable_volatile() const
{
size_t amount = 0;
for (auto& region : m_regions) {
if (region.vmobject().is_purgeable() && static_cast<const PurgeableVMObject&>(region.vmobject()).is_volatile())
amount += region.amount_resident();
}
return amount;
}
size_t Process::amount_purgeable_nonvolatile() const
{
size_t amount = 0;
for (auto& region : m_regions) {
if (region.vmobject().is_purgeable() && !static_cast<const PurgeableVMObject&>(region.vmobject()).is_volatile())
amount += region.amount_resident();
}
return amount;
}
ping: Use pledge()
2020-01-11 19:48:43 +00:00
#define REQUIRE_PROMISE_FOR_SOCKET_DOMAIN(domain) \
do { \
if (domain == AF_INET) \
REQUIRE_PROMISE(inet); \
else if (domain == AF_LOCAL) \
REQUIRE_PROMISE(unix); \
} while (0)
Kernel: Begin implementing UNIX domain sockets.
2019-02-14 13:17:38 +00:00
int Process::sys$socket(int domain, int type, int protocol)
{
ping: Use pledge()
2020-01-11 19:48:43 +00:00
REQUIRE_PROMISE_FOR_SOCKET_DOMAIN(domain);
Kernel+ping: Only allow superuser to create SOCK_RAW sockets /bin/ping is now setuid-root, and will drop privileges immediately after opening a raw socket.
2019-12-31 00:42:34 +00:00
if ((type & SOCK_TYPE_MASK) == SOCK_RAW && !is_superuser())
return -EACCES;
Kernel: Use alloc_fd() more instead of walking fd list manually.
2019-04-06 12:54:32 +00:00
int fd = alloc_fd();
if (fd < 0)
return fd;
Kernel: Port more code to KResult and KResultOr<T>.
2019-03-06 21:14:31 +00:00
auto result = Socket::create(domain, type, protocol);
if (result.is_error())
return result.error();
Kernel: Rename "descriptor" to "description" where appropriate. Now that FileDescription is called that, variables of that type should not be called "descriptor". This is kinda wordy but we'll get used to it.
2019-06-13 20:03:04 +00:00
auto description = FileDescription::create(*result.value());
Kernel: read() and write() should fail with EBADF for wrong mode fd's It was previously possible to write to read-only file descriptors, and read from write-only file descriptors. All FileDescription objects now start out non-readable + non-writable, and whoever is creating them has to "manually" enable reading/writing by calling set_readable() and/or set_writable() on them.
2020-01-03 02:29:59 +00:00
description->set_readable(true);
description->set_writable(true);
Kernel: More sockets work. Fleshing out accept().
2019-02-14 14:17:30 +00:00
unsigned flags = 0;
if (type & SOCK_CLOEXEC)
Kernel: socket() with SOCK_CLOEXEC was setting the wrong fd flag. Turns out FD_CLOEXEC and O_CLOEXEC are different values. Silly mistake. I noticed that Terminal's shell process still had the Terminal's window server connection open, albeit in a broken state.
2019-02-17 09:41:37 +00:00
flags |= FD_CLOEXEC;
Kernel: More sockets work. Fleshing out accept().
2019-02-14 14:17:30 +00:00
if (type & SOCK_NONBLOCK)
Kernel: Rename "descriptor" to "description" where appropriate. Now that FileDescription is called that, variables of that type should not be called "descriptor". This is kinda wordy but we'll get used to it.
2019-06-13 20:03:04 +00:00
description->set_blocking(false);
m_fds[fd].set(move(description), flags);
Kernel: Begin implementing UNIX domain sockets.
2019-02-14 13:17:38 +00:00
return fd;
}
Kernel: Begin fleshing out bind() syscall.
2019-02-14 13:38:30 +00:00
int Process::sys$bind(int sockfd, const sockaddr* address, socklen_t address_length)
Kernel: Begin implementing UNIX domain sockets.
2019-02-14 13:17:38 +00:00
{
Kernel: Begin fleshing out bind() syscall.
2019-02-14 13:38:30 +00:00
if (!validate_read(address, address_length))
return -EFAULT;
Kernel: Make Process::file_description() vend a RefPtr<FileDescription> This encourages callers to strongly reference file descriptions while working with them. This fixes a use-after-free issue where one thread would close() an open fd while another thread was blocked on it becoming readable. Test: Kernel/uaf-close-while-blocked-in-read.cpp
2020-01-07 14:53:42 +00:00
auto description = file_description(sockfd);
Kernel: Rename "descriptor" to "description" where appropriate. Now that FileDescription is called that, variables of that type should not be called "descriptor". This is kinda wordy but we'll get used to it.
2019-06-13 20:03:04 +00:00
if (!description)
Kernel: Begin fleshing out bind() syscall.
2019-02-14 13:38:30 +00:00
return -EBADF;
Kernel: Rename "descriptor" to "description" where appropriate. Now that FileDescription is called that, variables of that type should not be called "descriptor". This is kinda wordy but we'll get used to it.
2019-06-13 20:03:04 +00:00
if (!description->is_socket())
Kernel: Begin fleshing out bind() syscall.
2019-02-14 13:38:30 +00:00
return -ENOTSOCK;
Kernel: Rename "descriptor" to "description" where appropriate. Now that FileDescription is called that, variables of that type should not be called "descriptor". This is kinda wordy but we'll get used to it.
2019-06-13 20:03:04 +00:00
auto& socket = *description->socket();
ping: Use pledge()
2020-01-11 19:48:43 +00:00
REQUIRE_PROMISE_FOR_SOCKET_DOMAIN(socket.domain());
Kernel: Port more code to KResult and KResultOr<T>.
2019-03-06 21:14:31 +00:00
return socket.bind(address, address_length);
Kernel: Begin implementing UNIX domain sockets.
2019-02-14 13:17:38 +00:00
}
int Process::sys$listen(int sockfd, int backlog)
{
AK: Make Vector use size_t for its size and capacity
2020-02-25 13:49:47 +00:00
if (backlog < 0)
return -EINVAL;
Kernel: Make Process::file_description() vend a RefPtr<FileDescription> This encourages callers to strongly reference file descriptions while working with them. This fixes a use-after-free issue where one thread would close() an open fd while another thread was blocked on it becoming readable. Test: Kernel/uaf-close-while-blocked-in-read.cpp
2020-01-07 14:53:42 +00:00
auto description = file_description(sockfd);
Kernel: Rename "descriptor" to "description" where appropriate. Now that FileDescription is called that, variables of that type should not be called "descriptor". This is kinda wordy but we'll get used to it.
2019-06-13 20:03:04 +00:00
if (!description)
Kernel: More sockets work. Fleshing out accept().
2019-02-14 14:17:30 +00:00
return -EBADF;
Kernel: Rename "descriptor" to "description" where appropriate. Now that FileDescription is called that, variables of that type should not be called "descriptor". This is kinda wordy but we'll get used to it.
2019-06-13 20:03:04 +00:00
if (!description->is_socket())
Kernel: More sockets work. Fleshing out accept().
2019-02-14 14:17:30 +00:00
return -ENOTSOCK;
Kernel: Rename "descriptor" to "description" where appropriate. Now that FileDescription is called that, variables of that type should not be called "descriptor". This is kinda wordy but we'll get used to it.
2019-06-13 20:03:04 +00:00
auto& socket = *description->socket();
ping: Use pledge()
2020-01-11 19:48:43 +00:00
REQUIRE_PROMISE_FOR_SOCKET_DOMAIN(socket.domain());
Kernel: listen() should fail with EINVAL for already-connected sockets This according to POSIX.
2019-11-27 15:01:22 +00:00
if (socket.is_connected())
return -EINVAL;
Kernel: Move socket role tracking to the Socket class itself This is more logical and allows us to solve the problem of non-blocking TCP sockets getting stuck in SocketRole::None. The only complication is that a single LocalSocket may be shared between two file descriptions (on the connect and accept sides), and should have two different roles depending from which side you look at it. To deal with it, Socket::role() is made a virtual method that accepts a file description, and LocalSocket internally tracks which FileDescription is the which one and returns a correct role.
2019-08-11 13:38:20 +00:00
return socket.listen(backlog);
Kernel: Begin implementing UNIX domain sockets.
2019-02-14 13:17:38 +00:00
}
Kernel: Remove SmapDisabler in sys$accept()
2020-02-16 07:20:54 +00:00
int Process::sys$accept(int accepting_socket_fd, sockaddr* user_address, socklen_t* user_address_size)
Kernel: Begin implementing UNIX domain sockets.
2019-02-14 13:17:38 +00:00
{
Kernel: Add "accept" pledge promise for accepting incoming connections This patch adds a new "accept" promise that allows you to call accept() on an already listening socket. This lets programs set up a socket for for listening and then dropping "inet" and/or "unix" so that only incoming (and existing) connections are allowed from that point on. No new outgoing connections or listening server sockets can be created. In addition to accept() it also allows getsockopt() with SOL_SOCKET and SO_PEERCRED, which is used to find the PID/UID/GID of the socket peer. This is used by our IPC library when creating shared buffers that should only be accessible to a specific peer process. This allows us to drop "unix" in WindowServer and LookupServer. :^) It also makes the debugging/introspection RPC sockets in CEventLoop based programs work again.
2020-01-17 10:12:06 +00:00
REQUIRE_PROMISE(accept);
Kernel: Remove SmapDisabler in sys$accept()
2020-02-16 07:20:54 +00:00
if (!validate_write_typed(user_address_size))
Kernel: More sockets work. Fleshing out accept().
2019-02-14 14:17:30 +00:00
return -EFAULT;
Kernel: Remove SmapDisabler in sys$accept()
2020-02-16 07:20:54 +00:00
socklen_t address_size = 0;
copy_from_user(&address_size, user_address_size);
if (!validate_write(user_address, address_size))
Kernel: More sockets work. Fleshing out accept().
2019-02-14 14:17:30 +00:00
return -EFAULT;
Kernel: Use alloc_fd() more instead of walking fd list manually.
2019-04-06 12:54:32 +00:00
int accepted_socket_fd = alloc_fd();
if (accepted_socket_fd < 0)
return accepted_socket_fd;
Kernel: Make Process::file_description() vend a RefPtr<FileDescription> This encourages callers to strongly reference file descriptions while working with them. This fixes a use-after-free issue where one thread would close() an open fd while another thread was blocked on it becoming readable. Test: Kernel/uaf-close-while-blocked-in-read.cpp
2020-01-07 14:53:42 +00:00
auto accepting_socket_description = file_description(accepting_socket_fd);
Kernel: Rename "descriptor" to "description" where appropriate. Now that FileDescription is called that, variables of that type should not be called "descriptor". This is kinda wordy but we'll get used to it.
2019-06-13 20:03:04 +00:00
if (!accepting_socket_description)
Kernel: More sockets work. Fleshing out accept().
2019-02-14 14:17:30 +00:00
return -EBADF;
Kernel: Rename "descriptor" to "description" where appropriate. Now that FileDescription is called that, variables of that type should not be called "descriptor". This is kinda wordy but we'll get used to it.
2019-06-13 20:03:04 +00:00
if (!accepting_socket_description->is_socket())
Kernel: More sockets work. Fleshing out accept().
2019-02-14 14:17:30 +00:00
return -ENOTSOCK;
Kernel: Rename "descriptor" to "description" where appropriate. Now that FileDescription is called that, variables of that type should not be called "descriptor". This is kinda wordy but we'll get used to it.
2019-06-13 20:03:04 +00:00
auto& socket = *accepting_socket_description->socket();
Kernel: More sockets work. Fleshing out accept().
2019-02-14 14:17:30 +00:00
if (!socket.can_accept()) {
Kernel: Add a new block state for accept() on a blocking socket Rather than asserting, which really ruins everyone's day.
2019-07-18 08:39:00 +00:00
if (accepting_socket_description->is_blocking()) {
Kernel: Replace "current" with Thread::current and Process::current Suggested by Sergey. The currently running Thread and Process are now Thread::current and Process::current respectively. :^)
2020-02-17 14:04:27 +00:00
if (Thread::current->block<Thread::AcceptBlocker>(*accepting_socket_description) != Thread::BlockResult::WokeNormally)
Kernel: Add a new block state for accept() on a blocking socket Rather than asserting, which really ruins everyone's day.
2019-07-18 08:39:00 +00:00
return -EINTR;
} else {
return -EAGAIN;
}
Kernel: More sockets work. Fleshing out accept().
2019-02-14 14:17:30 +00:00
}
WindowServer: Slurp all available client messages when checking them. We were reading one client message per client per event loop iteration. That was not very snappy. Make the sockets non-blocking and read() until there are no messages left. It would be even better to make as few calls to read() as possible to reduce context switching, but this is already a huge improvement.
2019-02-15 10:43:43 +00:00
auto accepted_socket = socket.accept();
ASSERT(accepted_socket);
Kernel: Remove SmapDisabler in sys$accept()
2020-02-16 07:20:54 +00:00
u8 address_buffer[sizeof(sockaddr_un)];
address_size = min(sizeof(sockaddr_un), static_cast<size_t>(address_size));
accepted_socket->get_peer_address((sockaddr*)address_buffer, &address_size);
copy_to_user(user_address, address_buffer, address_size);
copy_to_user(user_address_size, &address_size);
Kernel: Move socket role tracking to the Socket class itself This is more logical and allows us to solve the problem of non-blocking TCP sockets getting stuck in SocketRole::None. The only complication is that a single LocalSocket may be shared between two file descriptions (on the connect and accept sides), and should have two different roles depending from which side you look at it. To deal with it, Socket::role() is made a virtual method that accepts a file description, and LocalSocket internally tracks which FileDescription is the which one and returns a correct role.
2019-08-11 13:38:20 +00:00
auto accepted_socket_description = FileDescription::create(*accepted_socket);
Kernel: read() and write() should fail with EBADF for wrong mode fd's It was previously possible to write to read-only file descriptors, and read from write-only file descriptors. All FileDescription objects now start out non-readable + non-writable, and whoever is creating them has to "manually" enable reading/writing by calling set_readable() and/or set_writable() on them.
2020-01-03 02:29:59 +00:00
accepted_socket_description->set_readable(true);
accepted_socket_description->set_writable(true);
WindowServer: Slurp all available client messages when checking them. We were reading one client message per client per event loop iteration. That was not very snappy. Make the sockets non-blocking and read() until there are no messages left. It would be even better to make as few calls to read() as possible to reduce context switching, but this is already a huge improvement.
2019-02-15 10:43:43 +00:00
// NOTE: The accepted socket inherits fd flags from the accepting socket.
// I'm not sure if this matches other systems but it makes sense to me.
Kernel: Rename "descriptor" to "description" where appropriate. Now that FileDescription is called that, variables of that type should not be called "descriptor". This is kinda wordy but we'll get used to it.
2019-06-13 20:03:04 +00:00
accepted_socket_description->set_blocking(accepting_socket_description->is_blocking());
m_fds[accepted_socket_fd].set(move(accepted_socket_description), m_fds[accepting_socket_fd].flags);
Kernel: Delay moving accepted sockets to SetupState::Completed a bit Make sure we don't move accepted sockets to the Completed setup state until we've actually constructed a FileDescription for them. This is important, since this state transition will trigger connect() to unblock on the client side, and the client may try writing to the socket right away. This makes DNS lookups way more reliable since we don't just fail to write() right after connect()ing to LookupServer sometimes. :^)
2019-10-08 19:41:46 +00:00
// NOTE: Moving this state to Completed is what causes connect() to unblock on the client side.
accepted_socket->set_setup_state(Socket::SetupState::Completed);
WindowServer: Slurp all available client messages when checking them. We were reading one client message per client per event loop iteration. That was not very snappy. Make the sockets non-blocking and read() until there are no messages left. It would be even better to make as few calls to read() as possible to reduce context switching, but this is already a huge improvement.
2019-02-15 10:43:43 +00:00
return accepted_socket_fd;
Kernel: Begin implementing UNIX domain sockets.
2019-02-14 13:17:38 +00:00
}
Kernel: Remove SmapDisabler in sys$connect()
2020-02-28 12:20:26 +00:00
int Process::sys$connect(int sockfd, const sockaddr* user_address, socklen_t user_address_size)
Kernel: Begin implementing UNIX domain sockets.
2019-02-14 13:17:38 +00:00
{
Kernel: Remove SmapDisabler in sys$connect()
2020-02-28 12:20:26 +00:00
if (!validate_read(user_address, user_address_size))
Kernel: More work on sockets. Fleshing out connect().
2019-02-14 14:55:19 +00:00
return -EFAULT;
Kernel: Use alloc_fd() more instead of walking fd list manually.
2019-04-06 12:54:32 +00:00
int fd = alloc_fd();
if (fd < 0)
return fd;
Kernel: Make Process::file_description() vend a RefPtr<FileDescription> This encourages callers to strongly reference file descriptions while working with them. This fixes a use-after-free issue where one thread would close() an open fd while another thread was blocked on it becoming readable. Test: Kernel/uaf-close-while-blocked-in-read.cpp
2020-01-07 14:53:42 +00:00
auto description = file_description(sockfd);
Kernel: Rename "descriptor" to "description" where appropriate. Now that FileDescription is called that, variables of that type should not be called "descriptor". This is kinda wordy but we'll get used to it.
2019-06-13 20:03:04 +00:00
if (!description)
Kernel: More work on sockets. Fleshing out connect().
2019-02-14 14:55:19 +00:00
return -EBADF;
Kernel: Rename "descriptor" to "description" where appropriate. Now that FileDescription is called that, variables of that type should not be called "descriptor". This is kinda wordy but we'll get used to it.
2019-06-13 20:03:04 +00:00
if (!description->is_socket())
Kernel: More work on sockets. Fleshing out connect().
2019-02-14 14:55:19 +00:00
return -ENOTSOCK;
Kernel: Move socket role tracking to the Socket class itself This is more logical and allows us to solve the problem of non-blocking TCP sockets getting stuck in SocketRole::None. The only complication is that a single LocalSocket may be shared between two file descriptions (on the connect and accept sides), and should have two different roles depending from which side you look at it. To deal with it, Socket::role() is made a virtual method that accepts a file description, and LocalSocket internally tracks which FileDescription is the which one and returns a correct role.
2019-08-11 13:38:20 +00:00
Kernel: Rename "descriptor" to "description" where appropriate. Now that FileDescription is called that, variables of that type should not be called "descriptor". This is kinda wordy but we'll get used to it.
2019-06-13 20:03:04 +00:00
auto& socket = *description->socket();
ping: Use pledge()
2020-01-11 19:48:43 +00:00
REQUIRE_PROMISE_FOR_SOCKET_DOMAIN(socket.domain());
Kernel: Remove SmapDisabler in sys$connect()
2020-02-28 12:20:26 +00:00
u8 address[sizeof(sockaddr_un)];
size_t address_size = min(sizeof(address), static_cast<size_t>(user_address_size));
copy_from_user(address, user_address, address_size);
return socket.connect(*description, (const sockaddr*)address, address_size, description->is_blocking() ? ShouldBlock::Yes : ShouldBlock::No);
Port the WindowServer and LibGUI to communicate through local sockets. This is really cool! :^) Apps currently refuse to start if the WindowServer isn't listening on the socket in /wsportal. This makes sense, but I guess it would also be nice to have some sort of "wait for server on startup" mode. This has performance issues, and I'll work on those, but this stuff seems to actually work and I'm very happy with that.
2019-02-14 16:18:35 +00:00
}
Net: Add a basic sys$shutdown() implementation Calling shutdown prevents further reads and/or writes on a socket. We should do a few more things based on the type of socket, but this initial implementation just puts the basic mechanism in place. Work towards #428.
2020-02-07 23:52:33 +00:00
int Process::sys$shutdown(int sockfd, int how)
{
REQUIRE_PROMISE(stdio);
if (how & ~SHUT_RDWR)
return -EINVAL;
auto description = file_description(sockfd);
if (!description)
return -EBADF;
if (!description->is_socket())
return -ENOTSOCK;
auto& socket = *description->socket();
REQUIRE_PROMISE_FOR_SOCKET_DOMAIN(socket.domain());
return socket.shutdown(how);
}
Kernel: Use the Syscall string and buffer types more While I was updating syscalls to stop passing null-terminated strings, I added some helpful struct types: - StringArgument { const char*; size_t; } - ImmutableBuffer<Data, Size> { const Data*; Size; } - MutableBuffer<Data, Size> { Data*; Size; } The Process class has some convenience functions for validating and optionally extracting the contents from these structs: - get_syscall_path_argument(StringArgument) - validate_and_copy_string_from_user(StringArgument) - validate(ImmutableBuffer) - validate(MutableBuffer) There's still so much code around this and I'm wondering if we should generate most of it instead. Possible nice little project.
2020-01-11 11:47:47 +00:00
ssize_t Process::sys$sendto(const Syscall::SC_sendto_params* user_params)
Kernel+LibC+Userland: Start working on an IPv4 socket backend. The first userland networking program will be "ping" :^)
2019-03-12 14:51:42 +00:00
{
Kernel: Reduce pledge requirement for recvfrom()+sendto() to "stdio" Since these only operate on already-open sockets, we should treat them the same as we do read() and write() by putting them into "stdio".
2020-01-12 10:52:37 +00:00
REQUIRE_PROMISE(stdio);
Kernel: Use the Syscall string and buffer types more While I was updating syscalls to stop passing null-terminated strings, I added some helpful struct types: - StringArgument { const char*; size_t; } - ImmutableBuffer<Data, Size> { const Data*; Size; } - MutableBuffer<Data, Size> { Data*; Size; } The Process class has some convenience functions for validating and optionally extracting the contents from these structs: - get_syscall_path_argument(StringArgument) - validate_and_copy_string_from_user(StringArgument) - validate(ImmutableBuffer) - validate(MutableBuffer) There's still so much code around this and I'm wondering if we should generate most of it instead. Possible nice little project.
2020-01-11 11:47:47 +00:00
Syscall::SC_sendto_params params;
Kernel: Combine validate and copy of user mode pointers (#1069) Right now there is a significant amount of boiler plate code required to validate user mode parameters in syscalls. In an attempt to reduce this a bit, introduce validate_read_and_copy_typed which combines the usermode address check and does the copy internally if the validation passes. This cleans up a little bit of code from a significant amount of syscalls.
2020-01-13 10:19:18 +00:00
if (!validate_read_and_copy_typed(&params, user_params))
return -EFAULT;
Kernel: Start implementing x86 SMAP support Supervisor Mode Access Prevention (SMAP) is an x86 CPU feature that prevents the kernel from accessing userspace memory. With SMAP enabled, trying to read/write a userspace memory address while in the kernel will now generate a page fault. Since it's sometimes necessary to read/write userspace memory, there are two new instructions that quickly switch the protection on/off: STAC (disables protection) and CLAC (enables protection.) These are exposed in kernel code via the stac() and clac() helpers. There's also a SmapDisabler RAII object that can be used to ensure that you don't forget to re-enable protection before returning to userspace code. THis patch also adds copy_to_user(), copy_from_user() and memset_user() which are the "correct" way of doing things. These functions allow us to briefly disable protection for a specific purpose, and then turn it back on immediately after it's done. Going forward all kernel code should be moved to using these and all uses of SmapDisabler are to be considered FIXME's. Note that we're not realizing the full potential of this feature since I've used SmapDisabler quite liberally in this initial bring-up patch.
2020-01-05 17:00:15 +00:00
Kernel: Use the Syscall string and buffer types more While I was updating syscalls to stop passing null-terminated strings, I added some helpful struct types: - StringArgument { const char*; size_t; } - ImmutableBuffer<Data, Size> { const Data*; Size; } - MutableBuffer<Data, Size> { Data*; Size; } The Process class has some convenience functions for validating and optionally extracting the contents from these structs: - get_syscall_path_argument(StringArgument) - validate_and_copy_string_from_user(StringArgument) - validate(ImmutableBuffer) - validate(MutableBuffer) There's still so much code around this and I'm wondering if we should generate most of it instead. Possible nice little project.
2020-01-11 11:47:47 +00:00
int flags = params.flags;
const sockaddr* addr = params.addr;
socklen_t addr_length = params.addr_length;
Kernel+LibC+Userland: Start working on an IPv4 socket backend. The first userland networking program will be "ping" :^)
2019-03-12 14:51:42 +00:00
Kernel: Use the Syscall string and buffer types more While I was updating syscalls to stop passing null-terminated strings, I added some helpful struct types: - StringArgument { const char*; size_t; } - ImmutableBuffer<Data, Size> { const Data*; Size; } - MutableBuffer<Data, Size> { Data*; Size; } The Process class has some convenience functions for validating and optionally extracting the contents from these structs: - get_syscall_path_argument(StringArgument) - validate_and_copy_string_from_user(StringArgument) - validate(ImmutableBuffer) - validate(MutableBuffer) There's still so much code around this and I'm wondering if we should generate most of it instead. Possible nice little project.
2020-01-11 11:47:47 +00:00
if (!validate(params.data))
Kernel+LibC+Userland: Start working on an IPv4 socket backend. The first userland networking program will be "ping" :^)
2019-03-12 14:51:42 +00:00
return -EFAULT;
IPv4: More hacking on bringing up TCP support. This was a bit more complicated than I expected, but it's moving forward.
2019-03-13 22:14:30 +00:00
if (addr && !validate_read(addr, addr_length))
Kernel+LibC+Userland: Start working on an IPv4 socket backend. The first userland networking program will be "ping" :^)
2019-03-12 14:51:42 +00:00
return -EFAULT;
Kernel: Use the Syscall string and buffer types more While I was updating syscalls to stop passing null-terminated strings, I added some helpful struct types: - StringArgument { const char*; size_t; } - ImmutableBuffer<Data, Size> { const Data*; Size; } - MutableBuffer<Data, Size> { Data*; Size; } The Process class has some convenience functions for validating and optionally extracting the contents from these structs: - get_syscall_path_argument(StringArgument) - validate_and_copy_string_from_user(StringArgument) - validate(ImmutableBuffer) - validate(MutableBuffer) There's still so much code around this and I'm wondering if we should generate most of it instead. Possible nice little project.
2020-01-11 11:47:47 +00:00
auto description = file_description(params.sockfd);
Kernel: Rename "descriptor" to "description" where appropriate. Now that FileDescription is called that, variables of that type should not be called "descriptor". This is kinda wordy but we'll get used to it.
2019-06-13 20:03:04 +00:00
if (!description)
Kernel+LibC+Userland: Start working on an IPv4 socket backend. The first userland networking program will be "ping" :^)
2019-03-12 14:51:42 +00:00
return -EBADF;
Kernel: Rename "descriptor" to "description" where appropriate. Now that FileDescription is called that, variables of that type should not be called "descriptor". This is kinda wordy but we'll get used to it.
2019-06-13 20:03:04 +00:00
if (!description->is_socket())
Kernel+LibC+Userland: Start working on an IPv4 socket backend. The first userland networking program will be "ping" :^)
2019-03-12 14:51:42 +00:00
return -ENOTSOCK;
Kernel: Rename "descriptor" to "description" where appropriate. Now that FileDescription is called that, variables of that type should not be called "descriptor". This is kinda wordy but we'll get used to it.
2019-06-13 20:03:04 +00:00
auto& socket = *description->socket();
Net: Add a basic sys$shutdown() implementation Calling shutdown prevents further reads and/or writes on a socket. We should do a few more things based on the type of socket, but this initial implementation just puts the basic mechanism in place. Work towards #428.
2020-02-07 23:52:33 +00:00
if (socket.is_shut_down_for_writing())
return -EPIPE;
SmapDisabler disabler;
Kernel: Use the Syscall string and buffer types more While I was updating syscalls to stop passing null-terminated strings, I added some helpful struct types: - StringArgument { const char*; size_t; } - ImmutableBuffer<Data, Size> { const Data*; Size; } - MutableBuffer<Data, Size> { Data*; Size; } The Process class has some convenience functions for validating and optionally extracting the contents from these structs: - get_syscall_path_argument(StringArgument) - validate_and_copy_string_from_user(StringArgument) - validate(ImmutableBuffer) - validate(MutableBuffer) There's still so much code around this and I'm wondering if we should generate most of it instead. Possible nice little project.
2020-01-11 11:47:47 +00:00
return socket.sendto(*description, params.data.data, params.data.size, flags, addr, addr_length);
Kernel+LibC+Userland: Start working on an IPv4 socket backend. The first userland networking program will be "ping" :^)
2019-03-12 14:51:42 +00:00
}
Kernel: Use the Syscall string and buffer types more While I was updating syscalls to stop passing null-terminated strings, I added some helpful struct types: - StringArgument { const char*; size_t; } - ImmutableBuffer<Data, Size> { const Data*; Size; } - MutableBuffer<Data, Size> { Data*; Size; } The Process class has some convenience functions for validating and optionally extracting the contents from these structs: - get_syscall_path_argument(StringArgument) - validate_and_copy_string_from_user(StringArgument) - validate(ImmutableBuffer) - validate(MutableBuffer) There's still so much code around this and I'm wondering if we should generate most of it instead. Possible nice little project.
2020-01-11 11:47:47 +00:00
ssize_t Process::sys$recvfrom(const Syscall::SC_recvfrom_params* user_params)
Kernel+LibC+Userland: Yet more networking bringup hacking. All ICMP sockets now receive all ICMP packets. All this buffering is gonna need some limits and such.
2019-03-12 16:27:07 +00:00
{
Kernel: Reduce pledge requirement for recvfrom()+sendto() to "stdio" Since these only operate on already-open sockets, we should treat them the same as we do read() and write() by putting them into "stdio".
2020-01-12 10:52:37 +00:00
REQUIRE_PROMISE(stdio);
Kernel+LibC+Userland: Yet more networking bringup hacking. All ICMP sockets now receive all ICMP packets. All this buffering is gonna need some limits and such.
2019-03-12 16:27:07 +00:00
Kernel: Use the Syscall string and buffer types more While I was updating syscalls to stop passing null-terminated strings, I added some helpful struct types: - StringArgument { const char*; size_t; } - ImmutableBuffer<Data, Size> { const Data*; Size; } - MutableBuffer<Data, Size> { Data*; Size; } The Process class has some convenience functions for validating and optionally extracting the contents from these structs: - get_syscall_path_argument(StringArgument) - validate_and_copy_string_from_user(StringArgument) - validate(ImmutableBuffer) - validate(MutableBuffer) There's still so much code around this and I'm wondering if we should generate most of it instead. Possible nice little project.
2020-01-11 11:47:47 +00:00
Syscall::SC_recvfrom_params params;
Kernel: Combine validate and copy of user mode pointers (#1069) Right now there is a significant amount of boiler plate code required to validate user mode parameters in syscalls. In an attempt to reduce this a bit, introduce validate_read_and_copy_typed which combines the usermode address check and does the copy internally if the validation passes. This cleans up a little bit of code from a significant amount of syscalls.
2020-01-13 10:19:18 +00:00
if (!validate_read_and_copy_typed(&params, user_params))
return -EFAULT;
Kernel+LibC+Userland: Yet more networking bringup hacking. All ICMP sockets now receive all ICMP packets. All this buffering is gonna need some limits and such.
2019-03-12 16:27:07 +00:00
Kernel: Use the Syscall string and buffer types more While I was updating syscalls to stop passing null-terminated strings, I added some helpful struct types: - StringArgument { const char*; size_t; } - ImmutableBuffer<Data, Size> { const Data*; Size; } - MutableBuffer<Data, Size> { Data*; Size; } The Process class has some convenience functions for validating and optionally extracting the contents from these structs: - get_syscall_path_argument(StringArgument) - validate_and_copy_string_from_user(StringArgument) - validate(ImmutableBuffer) - validate(MutableBuffer) There's still so much code around this and I'm wondering if we should generate most of it instead. Possible nice little project.
2020-01-11 11:47:47 +00:00
int flags = params.flags;
sockaddr* addr = params.addr;
socklen_t* addr_length = params.addr_length;
Kernel: Oops, recvfrom() is not quite ready for SMAP protections yet
2020-01-11 12:03:44 +00:00
SmapDisabler disabler;
Kernel: Use the Syscall string and buffer types more While I was updating syscalls to stop passing null-terminated strings, I added some helpful struct types: - StringArgument { const char*; size_t; } - ImmutableBuffer<Data, Size> { const Data*; Size; } - MutableBuffer<Data, Size> { Data*; Size; } The Process class has some convenience functions for validating and optionally extracting the contents from these structs: - get_syscall_path_argument(StringArgument) - validate_and_copy_string_from_user(StringArgument) - validate(ImmutableBuffer) - validate(MutableBuffer) There's still so much code around this and I'm wondering if we should generate most of it instead. Possible nice little project.
2020-01-11 11:47:47 +00:00
if (!validate(params.buffer))
Kernel+LibC+Userland: Yet more networking bringup hacking. All ICMP sockets now receive all ICMP packets. All this buffering is gonna need some limits and such.
2019-03-12 16:27:07 +00:00
return -EFAULT;
IPv4: More hacking on bringing up TCP support. This was a bit more complicated than I expected, but it's moving forward.
2019-03-13 22:14:30 +00:00
if (addr_length) {
IPv4: Save the source address/port together with incoming packet payloads. We need the address/port to fill in the out-params in recvfrom(). It should now be more or less possible to create a UDP server. :^)
2019-05-04 01:27:50 +00:00
if (!validate_write_typed(addr_length))
IPv4: More hacking on bringing up TCP support. This was a bit more complicated than I expected, but it's moving forward.
2019-03-13 22:14:30 +00:00
return -EFAULT;
IPv4: Save the source address/port together with incoming packet payloads. We need the address/port to fill in the out-params in recvfrom(). It should now be more or less possible to create a UDP server. :^)
2019-05-04 01:27:50 +00:00
if (!validate_write(addr, *addr_length))
IPv4: More hacking on bringing up TCP support. This was a bit more complicated than I expected, but it's moving forward.
2019-03-13 22:14:30 +00:00
return -EFAULT;
} else if (addr) {
Kernel: Run clang-format on everything.
2019-06-07 09:43:58 +00:00
return -EINVAL;
IPv4: More hacking on bringing up TCP support. This was a bit more complicated than I expected, but it's moving forward.
2019-03-13 22:14:30 +00:00
}
Kernel: Use the Syscall string and buffer types more While I was updating syscalls to stop passing null-terminated strings, I added some helpful struct types: - StringArgument { const char*; size_t; } - ImmutableBuffer<Data, Size> { const Data*; Size; } - MutableBuffer<Data, Size> { Data*; Size; } The Process class has some convenience functions for validating and optionally extracting the contents from these structs: - get_syscall_path_argument(StringArgument) - validate_and_copy_string_from_user(StringArgument) - validate(ImmutableBuffer) - validate(MutableBuffer) There's still so much code around this and I'm wondering if we should generate most of it instead. Possible nice little project.
2020-01-11 11:47:47 +00:00
auto description = file_description(params.sockfd);
Kernel: Rename "descriptor" to "description" where appropriate. Now that FileDescription is called that, variables of that type should not be called "descriptor". This is kinda wordy but we'll get used to it.
2019-06-13 20:03:04 +00:00
if (!description)
Kernel+LibC+Userland: Yet more networking bringup hacking. All ICMP sockets now receive all ICMP packets. All this buffering is gonna need some limits and such.
2019-03-12 16:27:07 +00:00
return -EBADF;
Kernel: Rename "descriptor" to "description" where appropriate. Now that FileDescription is called that, variables of that type should not be called "descriptor". This is kinda wordy but we'll get used to it.
2019-06-13 20:03:04 +00:00
if (!description->is_socket())
Kernel+LibC+Userland: Yet more networking bringup hacking. All ICMP sockets now receive all ICMP packets. All this buffering is gonna need some limits and such.
2019-03-12 16:27:07 +00:00
return -ENOTSOCK;
Kernel: Rename "descriptor" to "description" where appropriate. Now that FileDescription is called that, variables of that type should not be called "descriptor". This is kinda wordy but we'll get used to it.
2019-06-13 20:03:04 +00:00
auto& socket = *description->socket();
Kernel: Add support for recv() with MSG_DONTWAIT. Passing this flag to recv() temporarily puts the file descriptor into non-blocking mode. Also implement LocalSocket::recv() as a simple forwarding to read().
2019-05-20 01:44:45 +00:00
Net: Add a basic sys$shutdown() implementation Calling shutdown prevents further reads and/or writes on a socket. We should do a few more things based on the type of socket, but this initial implementation just puts the basic mechanism in place. Work towards #428.
2020-02-07 23:52:33 +00:00
if (socket.is_shut_down_for_reading())
return 0;
Kernel: Rename "descriptor" to "description" where appropriate. Now that FileDescription is called that, variables of that type should not be called "descriptor". This is kinda wordy but we'll get used to it.
2019-06-13 20:03:04 +00:00
bool original_blocking = description->is_blocking();
Kernel: Add support for recv() with MSG_DONTWAIT. Passing this flag to recv() temporarily puts the file descriptor into non-blocking mode. Also implement LocalSocket::recv() as a simple forwarding to read().
2019-05-20 01:44:45 +00:00
if (flags & MSG_DONTWAIT)
Kernel: Rename "descriptor" to "description" where appropriate. Now that FileDescription is called that, variables of that type should not be called "descriptor". This is kinda wordy but we'll get used to it.
2019-06-13 20:03:04 +00:00
description->set_blocking(false);
Kernel: Add support for recv() with MSG_DONTWAIT. Passing this flag to recv() temporarily puts the file descriptor into non-blocking mode. Also implement LocalSocket::recv() as a simple forwarding to read().
2019-05-20 01:44:45 +00:00
Kernel: Use the Syscall string and buffer types more While I was updating syscalls to stop passing null-terminated strings, I added some helpful struct types: - StringArgument { const char*; size_t; } - ImmutableBuffer<Data, Size> { const Data*; Size; } - MutableBuffer<Data, Size> { Data*; Size; } The Process class has some convenience functions for validating and optionally extracting the contents from these structs: - get_syscall_path_argument(StringArgument) - validate_and_copy_string_from_user(StringArgument) - validate(ImmutableBuffer) - validate(MutableBuffer) There's still so much code around this and I'm wondering if we should generate most of it instead. Possible nice little project.
2020-01-11 11:47:47 +00:00
auto nrecv = socket.recvfrom(*description, params.buffer.data, params.buffer.size, flags, addr, addr_length);
Kernel: Add support for recv() with MSG_DONTWAIT. Passing this flag to recv() temporarily puts the file descriptor into non-blocking mode. Also implement LocalSocket::recv() as a simple forwarding to read().
2019-05-20 01:44:45 +00:00
if (flags & MSG_DONTWAIT)
Kernel: Rename "descriptor" to "description" where appropriate. Now that FileDescription is called that, variables of that type should not be called "descriptor". This is kinda wordy but we'll get used to it.
2019-06-13 20:03:04 +00:00
description->set_blocking(original_blocking);
Kernel: Add support for recv() with MSG_DONTWAIT. Passing this flag to recv() temporarily puts the file descriptor into non-blocking mode. Also implement LocalSocket::recv() as a simple forwarding to read().
2019-05-20 01:44:45 +00:00
return nrecv;
Kernel+LibC+Userland: Yet more networking bringup hacking. All ICMP sockets now receive all ICMP packets. All this buffering is gonna need some limits and such.
2019-03-12 16:27:07 +00:00
}
Kernel: Remove SmapDisablers in sys$getsockname() and sys$getpeername() Instead use the user/kernel copy helpers to only copy the minimum stuff needed from to/from userspace. Based on work started by Brian Gianforcaro.
2020-01-27 20:11:36 +00:00
template<bool sockname, typename Params>
int Process::get_sock_or_peer_name(const Params& params)
Kernel+LibC: Implement getsockname() syscall.
2019-05-19 17:55:27 +00:00
{
Kernel: Remove SmapDisablers in sys$getsockname() and sys$getpeername() Instead use the user/kernel copy helpers to only copy the minimum stuff needed from to/from userspace. Based on work started by Brian Gianforcaro.
2020-01-27 20:11:36 +00:00
socklen_t addrlen_value;
if (!validate_read_and_copy_typed(&addrlen_value, params.addrlen))
Kernel+LibC: Implement getsockname() syscall.
2019-05-19 17:55:27 +00:00
return -EFAULT;
Kernel: Remove SmapDisablers in sys$getsockname() and sys$getpeername() Instead use the user/kernel copy helpers to only copy the minimum stuff needed from to/from userspace. Based on work started by Brian Gianforcaro.
2020-01-27 20:11:36 +00:00
if (addrlen_value <= 0)
Kernel+LibC: Implement getsockname() syscall.
2019-05-19 17:55:27 +00:00
return -EINVAL;
Kernel: Remove SmapDisablers in sys$getsockname() and sys$getpeername() Instead use the user/kernel copy helpers to only copy the minimum stuff needed from to/from userspace. Based on work started by Brian Gianforcaro.
2020-01-27 20:11:36 +00:00
if (!validate_write(params.addr, addrlen_value))
Kernel+LibC: Implement getsockname() syscall.
2019-05-19 17:55:27 +00:00
return -EFAULT;
Kernel: Remove SmapDisablers in sys$getsockname() and sys$getpeername() Instead use the user/kernel copy helpers to only copy the minimum stuff needed from to/from userspace. Based on work started by Brian Gianforcaro.
2020-01-27 20:11:36 +00:00
if (!validate_write_typed(params.addrlen))
return -EFAULT;
auto description = file_description(params.sockfd);
Kernel: Rename "descriptor" to "description" where appropriate. Now that FileDescription is called that, variables of that type should not be called "descriptor". This is kinda wordy but we'll get used to it.
2019-06-13 20:03:04 +00:00
if (!description)
Kernel+LibC: Implement getsockname() syscall.
2019-05-19 17:55:27 +00:00
return -EBADF;
Kernel: Rename "descriptor" to "description" where appropriate. Now that FileDescription is called that, variables of that type should not be called "descriptor". This is kinda wordy but we'll get used to it.
2019-06-13 20:03:04 +00:00
if (!description->is_socket())
Kernel+LibC: Implement getsockname() syscall.
2019-05-19 17:55:27 +00:00
return -ENOTSOCK;
Kernel: Rename "descriptor" to "description" where appropriate. Now that FileDescription is called that, variables of that type should not be called "descriptor". This is kinda wordy but we'll get used to it.
2019-06-13 20:03:04 +00:00
auto& socket = *description->socket();
ping: Use pledge()
2020-01-11 19:48:43 +00:00
REQUIRE_PROMISE_FOR_SOCKET_DOMAIN(socket.domain());
Kernel: Add getpeername() syscall, and fix getsockname() behavior. We were copying the raw IPv4 addresses into the wrong part of sockaddr_in, and we didn't set sa_family or sa_port.
2019-05-20 18:33:03 +00:00
Kernel: Remove SmapDisablers in sys$getsockname() and sys$getpeername() Instead use the user/kernel copy helpers to only copy the minimum stuff needed from to/from userspace. Based on work started by Brian Gianforcaro.
2020-01-27 20:11:36 +00:00
u8 address_buffer[sizeof(sockaddr_un)];
addrlen_value = min(sizeof(sockaddr_un), static_cast<size_t>(addrlen_value));
Kernel: Truncate addresses stored by getsockname() and getpeername() If there's not enough space in the output buffer for the whole sockaddr we now simply truncate the address instead of returning EINVAL. This patch also makes getpeername() actually return the peer address rather than the local address.. :^)
2020-02-07 22:42:28 +00:00
if constexpr (sockname)
socket.get_local_address((sockaddr*)address_buffer, &addrlen_value);
else
socket.get_peer_address((sockaddr*)address_buffer, &addrlen_value);
Kernel: Remove SmapDisablers in sys$getsockname() and sys$getpeername() Instead use the user/kernel copy helpers to only copy the minimum stuff needed from to/from userspace. Based on work started by Brian Gianforcaro.
2020-01-27 20:11:36 +00:00
copy_to_user(params.addr, address_buffer, addrlen_value);
Kernel: Truncate addresses stored by getsockname() and getpeername() If there's not enough space in the output buffer for the whole sockaddr we now simply truncate the address instead of returning EINVAL. This patch also makes getpeername() actually return the peer address rather than the local address.. :^)
2020-02-07 22:42:28 +00:00
copy_to_user(params.addrlen, &addrlen_value);
Kernel: Add getpeername() syscall, and fix getsockname() behavior. We were copying the raw IPv4 addresses into the wrong part of sockaddr_in, and we didn't set sa_family or sa_port.
2019-05-20 18:33:03 +00:00
return 0;
}
Kernel: Remove SmapDisablers in sys$getsockname() and sys$getpeername() Instead use the user/kernel copy helpers to only copy the minimum stuff needed from to/from userspace. Based on work started by Brian Gianforcaro.
2020-01-27 20:11:36 +00:00
int Process::sys$getsockname(const Syscall::SC_getsockname_params* user_params)
Kernel: Add getpeername() syscall, and fix getsockname() behavior. We were copying the raw IPv4 addresses into the wrong part of sockaddr_in, and we didn't set sa_family or sa_port.
2019-05-20 18:33:03 +00:00
{
Kernel: Remove SmapDisablers in sys$getsockname() and sys$getpeername() Instead use the user/kernel copy helpers to only copy the minimum stuff needed from to/from userspace. Based on work started by Brian Gianforcaro.
2020-01-27 20:11:36 +00:00
Syscall::SC_getsockname_params params;
if (!validate_read_and_copy_typed(&params, user_params))
Kernel: Add getpeername() syscall, and fix getsockname() behavior. We were copying the raw IPv4 addresses into the wrong part of sockaddr_in, and we didn't set sa_family or sa_port.
2019-05-20 18:33:03 +00:00
return -EFAULT;
Kernel: Remove SmapDisablers in sys$getsockname() and sys$getpeername() Instead use the user/kernel copy helpers to only copy the minimum stuff needed from to/from userspace. Based on work started by Brian Gianforcaro.
2020-01-27 20:11:36 +00:00
return get_sock_or_peer_name<true>(params);
}
Kernel: Add getpeername() syscall, and fix getsockname() behavior. We were copying the raw IPv4 addresses into the wrong part of sockaddr_in, and we didn't set sa_family or sa_port.
2019-05-20 18:33:03 +00:00
Kernel: Remove SmapDisablers in sys$getsockname() and sys$getpeername() Instead use the user/kernel copy helpers to only copy the minimum stuff needed from to/from userspace. Based on work started by Brian Gianforcaro.
2020-01-27 20:11:36 +00:00
int Process::sys$getpeername(const Syscall::SC_getpeername_params* user_params)
{
Syscall::SC_getpeername_params params;
if (!validate_read_and_copy_typed(&params, user_params))
Kernel: Add getpeername() syscall, and fix getsockname() behavior. We were copying the raw IPv4 addresses into the wrong part of sockaddr_in, and we didn't set sa_family or sa_port.
2019-05-20 18:33:03 +00:00
return -EFAULT;
Kernel: Remove SmapDisablers in sys$getsockname() and sys$getpeername() Instead use the user/kernel copy helpers to only copy the minimum stuff needed from to/from userspace. Based on work started by Brian Gianforcaro.
2020-01-27 20:11:36 +00:00
return get_sock_or_peer_name<false>(params);
Kernel+LibC: Implement getsockname() syscall.
2019-05-19 17:55:27 +00:00
}
Kernel: Make sched_setparam() and sched_getparam() operate on threads Instead of operating on "some random thread in PID", these now operate on the thread with a specific TID. This matches other systems better.
2020-01-26 08:58:58 +00:00
int Process::sys$sched_setparam(int tid, const struct sched_param* param)
Kernel/LibC: Implement sched_* functionality to set/get process priority Right now, we allow anything inside a user to raise or lower any other process's priority. This feels simple enough to me. Linux disallows raising, but that's annoying in practice.
2019-05-29 21:20:51 +00:00
{
ping: Use pledge()
2020-01-11 19:48:43 +00:00
REQUIRE_PROMISE(proc);
Kernel/LibC: Implement sched_* functionality to set/get process priority Right now, we allow anything inside a user to raise or lower any other process's priority. This feels simple enough to me. Linux disallows raising, but that's annoying in practice.
2019-05-29 21:20:51 +00:00
if (!validate_read_typed(param))
return -EFAULT;
Kernel: Start implementing x86 SMAP support Supervisor Mode Access Prevention (SMAP) is an x86 CPU feature that prevents the kernel from accessing userspace memory. With SMAP enabled, trying to read/write a userspace memory address while in the kernel will now generate a page fault. Since it's sometimes necessary to read/write userspace memory, there are two new instructions that quickly switch the protection on/off: STAC (disables protection) and CLAC (enables protection.) These are exposed in kernel code via the stac() and clac() helpers. There's also a SmapDisabler RAII object that can be used to ensure that you don't forget to re-enable protection before returning to userspace code. THis patch also adds copy_to_user(), copy_from_user() and memset_user() which are the "correct" way of doing things. These functions allow us to briefly disable protection for a specific purpose, and then turn it back on immediately after it's done. Going forward all kernel code should be moved to using these and all uses of SmapDisabler are to be considered FIXME's. Note that we're not realizing the full potential of this feature since I've used SmapDisabler quite liberally in this initial bring-up patch.
2020-01-05 17:00:15 +00:00
int desired_priority;
Kernel: Use the templated copy_to/from_user() in more places These ensure that the "to" and "from" pointers have the same type, and also that we copy the correct number of bytes.
2020-01-20 12:38:31 +00:00
copy_from_user(&desired_priority, &param->sched_priority);
Kernel: Start implementing x86 SMAP support Supervisor Mode Access Prevention (SMAP) is an x86 CPU feature that prevents the kernel from accessing userspace memory. With SMAP enabled, trying to read/write a userspace memory address while in the kernel will now generate a page fault. Since it's sometimes necessary to read/write userspace memory, there are two new instructions that quickly switch the protection on/off: STAC (disables protection) and CLAC (enables protection.) These are exposed in kernel code via the stac() and clac() helpers. There's also a SmapDisabler RAII object that can be used to ensure that you don't forget to re-enable protection before returning to userspace code. THis patch also adds copy_to_user(), copy_from_user() and memset_user() which are the "correct" way of doing things. These functions allow us to briefly disable protection for a specific purpose, and then turn it back on immediately after it's done. Going forward all kernel code should be moved to using these and all uses of SmapDisabler are to be considered FIXME's. Note that we're not realizing the full potential of this feature since I've used SmapDisabler quite liberally in this initial bring-up patch.
2020-01-05 17:00:15 +00:00
Kernel/LibC: Implement sched_* functionality to set/get process priority Right now, we allow anything inside a user to raise or lower any other process's priority. This feels simple enough to me. Linux disallows raising, but that's annoying in practice.
2019-05-29 21:20:51 +00:00
InterruptDisabler disabler;
Kernel: Replace "current" with Thread::current and Process::current Suggested by Sergey. The currently running Thread and Process are now Thread::current and Process::current respectively. :^)
2020-02-17 14:04:27 +00:00
auto* peer = Thread::current;
Kernel: Make sched_setparam() and sched_getparam() operate on threads Instead of operating on "some random thread in PID", these now operate on the thread with a specific TID. This matches other systems better.
2020-01-26 08:58:58 +00:00
if (tid != 0)
peer = Thread::from_tid(tid);
Kernel/LibC: Implement sched_* functionality to set/get process priority Right now, we allow anything inside a user to raise or lower any other process's priority. This feels simple enough to me. Linux disallows raising, but that's annoying in practice.
2019-05-29 21:20:51 +00:00
if (!peer)
return -ESRCH;
Kernel: Make sched_setparam() and sched_getparam() operate on threads Instead of operating on "some random thread in PID", these now operate on the thread with a specific TID. This matches other systems better.
2020-01-26 08:58:58 +00:00
if (!is_superuser() && m_euid != peer->process().m_uid && m_uid != peer->process().m_uid)
Kernel/LibC: Implement sched_* functionality to set/get process priority Right now, we allow anything inside a user to raise or lower any other process's priority. This feels simple enough to me. Linux disallows raising, but that's annoying in practice.
2019-05-29 21:20:51 +00:00
return -EPERM;
Kernel: Start implementing x86 SMAP support Supervisor Mode Access Prevention (SMAP) is an x86 CPU feature that prevents the kernel from accessing userspace memory. With SMAP enabled, trying to read/write a userspace memory address while in the kernel will now generate a page fault. Since it's sometimes necessary to read/write userspace memory, there are two new instructions that quickly switch the protection on/off: STAC (disables protection) and CLAC (enables protection.) These are exposed in kernel code via the stac() and clac() helpers. There's also a SmapDisabler RAII object that can be used to ensure that you don't forget to re-enable protection before returning to userspace code. THis patch also adds copy_to_user(), copy_from_user() and memset_user() which are the "correct" way of doing things. These functions allow us to briefly disable protection for a specific purpose, and then turn it back on immediately after it's done. Going forward all kernel code should be moved to using these and all uses of SmapDisabler are to be considered FIXME's. Note that we're not realizing the full potential of this feature since I've used SmapDisabler quite liberally in this initial bring-up patch.
2020-01-05 17:00:15 +00:00
if (desired_priority < THREAD_PRIORITY_MIN || desired_priority > THREAD_PRIORITY_MAX)
Kernel/LibC: Implement sched_* functionality to set/get process priority Right now, we allow anything inside a user to raise or lower any other process's priority. This feels simple enough to me. Linux disallows raising, but that's annoying in practice.
2019-05-29 21:20:51 +00:00
return -EINVAL;
Kernel: Make sched_setparam() and sched_getparam() operate on threads Instead of operating on "some random thread in PID", these now operate on the thread with a specific TID. This matches other systems better.
2020-01-26 08:58:58 +00:00
peer->set_priority((u32)desired_priority);
Kernel/LibC: Implement sched_* functionality to set/get process priority Right now, we allow anything inside a user to raise or lower any other process's priority. This feels simple enough to me. Linux disallows raising, but that's annoying in practice.
2019-05-29 21:20:51 +00:00
return 0;
}
int Process::sys$sched_getparam(pid_t pid, struct sched_param* param)
{
ping: Use pledge()
2020-01-11 19:48:43 +00:00
REQUIRE_PROMISE(proc);
Kernel: Start implementing x86 SMAP support Supervisor Mode Access Prevention (SMAP) is an x86 CPU feature that prevents the kernel from accessing userspace memory. With SMAP enabled, trying to read/write a userspace memory address while in the kernel will now generate a page fault. Since it's sometimes necessary to read/write userspace memory, there are two new instructions that quickly switch the protection on/off: STAC (disables protection) and CLAC (enables protection.) These are exposed in kernel code via the stac() and clac() helpers. There's also a SmapDisabler RAII object that can be used to ensure that you don't forget to re-enable protection before returning to userspace code. THis patch also adds copy_to_user(), copy_from_user() and memset_user() which are the "correct" way of doing things. These functions allow us to briefly disable protection for a specific purpose, and then turn it back on immediately after it's done. Going forward all kernel code should be moved to using these and all uses of SmapDisabler are to be considered FIXME's. Note that we're not realizing the full potential of this feature since I've used SmapDisabler quite liberally in this initial bring-up patch.
2020-01-05 17:00:15 +00:00
if (!validate_write_typed(param))
Kernel/LibC: Implement sched_* functionality to set/get process priority Right now, we allow anything inside a user to raise or lower any other process's priority. This feels simple enough to me. Linux disallows raising, but that's annoying in practice.
2019-05-29 21:20:51 +00:00
return -EFAULT;
InterruptDisabler disabler;
Kernel: Replace "current" with Thread::current and Process::current Suggested by Sergey. The currently running Thread and Process are now Thread::current and Process::current respectively. :^)
2020-02-17 14:04:27 +00:00
auto* peer = Thread::current;
Kernel/LibC: Implement sched_* functionality to set/get process priority Right now, we allow anything inside a user to raise or lower any other process's priority. This feels simple enough to me. Linux disallows raising, but that's annoying in practice.
2019-05-29 21:20:51 +00:00
if (pid != 0)
Kernel: Make sched_setparam() and sched_getparam() operate on threads Instead of operating on "some random thread in PID", these now operate on the thread with a specific TID. This matches other systems better.
2020-01-26 08:58:58 +00:00
peer = Thread::from_tid(pid);
Kernel/LibC: Implement sched_* functionality to set/get process priority Right now, we allow anything inside a user to raise or lower any other process's priority. This feels simple enough to me. Linux disallows raising, but that's annoying in practice.
2019-05-29 21:20:51 +00:00
if (!peer)
return -ESRCH;
Kernel: Make sched_setparam() and sched_getparam() operate on threads Instead of operating on "some random thread in PID", these now operate on the thread with a specific TID. This matches other systems better.
2020-01-26 08:58:58 +00:00
if (!is_superuser() && m_euid != peer->process().m_uid && m_uid != peer->process().m_uid)
Kernel/LibC: Implement sched_* functionality to set/get process priority Right now, we allow anything inside a user to raise or lower any other process's priority. This feels simple enough to me. Linux disallows raising, but that's annoying in practice.
2019-05-29 21:20:51 +00:00
return -EPERM;
Kernel: Make sched_setparam() and sched_getparam() operate on threads Instead of operating on "some random thread in PID", these now operate on the thread with a specific TID. This matches other systems better.
2020-01-26 08:58:58 +00:00
int priority = peer->priority();
Kernel: Use the templated copy_to/from_user() in more places These ensure that the "to" and "from" pointers have the same type, and also that we copy the correct number of bytes.
2020-01-20 12:38:31 +00:00
copy_to_user(&param->sched_priority, &priority);
Kernel/LibC: Implement sched_* functionality to set/get process priority Right now, we allow anything inside a user to raise or lower any other process's priority. This feels simple enough to me. Linux disallows raising, but that's annoying in practice.
2019-05-29 21:20:51 +00:00
return 0;
}
Add support for socket send/receive timeouts. Only the receive timeout is hooked up yet. You can change the timeout by calling setsockopt(..., SOL_SOCKET, SO_RCVTIMEO, ...). Use this mechanism to make /bin/ping report timeouts.
2019-03-13 12:13:23 +00:00
int Process::sys$getsockopt(const Syscall::SC_getsockopt_params* params)
{
if (!validate_read_typed(params))
return -EFAULT;
Kernel: Use C++ structured bindings to bind syscall parameters Some syscalls have to pass parameters through a struct, since we can only fit 3 parameters with our calling convention. This patch makes use of C++ structured binding to clean up the places where we expand those parameters structs into local variables.
2019-11-10 14:32:59 +00:00
Kernel: Start implementing x86 SMAP support Supervisor Mode Access Prevention (SMAP) is an x86 CPU feature that prevents the kernel from accessing userspace memory. With SMAP enabled, trying to read/write a userspace memory address while in the kernel will now generate a page fault. Since it's sometimes necessary to read/write userspace memory, there are two new instructions that quickly switch the protection on/off: STAC (disables protection) and CLAC (enables protection.) These are exposed in kernel code via the stac() and clac() helpers. There's also a SmapDisabler RAII object that can be used to ensure that you don't forget to re-enable protection before returning to userspace code. THis patch also adds copy_to_user(), copy_from_user() and memset_user() which are the "correct" way of doing things. These functions allow us to briefly disable protection for a specific purpose, and then turn it back on immediately after it's done. Going forward all kernel code should be moved to using these and all uses of SmapDisabler are to be considered FIXME's. Note that we're not realizing the full potential of this feature since I've used SmapDisabler quite liberally in this initial bring-up patch.
2020-01-05 17:00:15 +00:00
SmapDisabler disabler;
Kernel: Fix bad TOCTOU pattern in syscalls that take a parameter struct Our syscall calling convention only allows passing up to 3 arguments in registers. For syscalls that take more arguments, we bake them into a struct and pass a pointer to that struct instead. When doing pointer validation, this is what we would do: 1) Validate the "params" struct 2) Validate "params->some_pointer" 3) ... other stuff ... 4) Use "params->some_pointer" Since the parameter struct is stored in userspace, it can be modified by userspace after validation has completed. This was a recurring pattern in many syscalls that was further hidden by me using structured binding declarations to give convenient local names to things in the parameter struct: auto& [some_pointer, ...] = *params; memcpy(some_pointer, ...); This devilishly makes "some_pointer" look like a local variable but it's actually more like an alias for "params->some_pointer" and will expand to a dereference when accessed! This patch fixes the issues by explicitly copying out each member from the parameter structs before validating them, and then never using the "param" pointers beyond that. Thanks to braindead for finding this bug! :^)
2020-01-05 08:13:00 +00:00
int sockfd = params->sockfd;
int level = params->level;
int option = params->option;
void* value = params->value;
socklen_t* value_size = params->value_size;
Add support for socket send/receive timeouts. Only the receive timeout is hooked up yet. You can change the timeout by calling setsockopt(..., SOL_SOCKET, SO_RCVTIMEO, ...). Use this mechanism to make /bin/ping report timeouts.
2019-03-13 12:13:23 +00:00
if (!validate_write_typed(value_size))
return -EFAULT;
if (!validate_write(value, *value_size))
return -EFAULT;
Kernel: Make Process::file_description() vend a RefPtr<FileDescription> This encourages callers to strongly reference file descriptions while working with them. This fixes a use-after-free issue where one thread would close() an open fd while another thread was blocked on it becoming readable. Test: Kernel/uaf-close-while-blocked-in-read.cpp
2020-01-07 14:53:42 +00:00
auto description = file_description(sockfd);
Kernel: Rename "descriptor" to "description" where appropriate. Now that FileDescription is called that, variables of that type should not be called "descriptor". This is kinda wordy but we'll get used to it.
2019-06-13 20:03:04 +00:00
if (!description)
Add support for socket send/receive timeouts. Only the receive timeout is hooked up yet. You can change the timeout by calling setsockopt(..., SOL_SOCKET, SO_RCVTIMEO, ...). Use this mechanism to make /bin/ping report timeouts.
2019-03-13 12:13:23 +00:00
return -EBADF;
Kernel: Rename "descriptor" to "description" where appropriate. Now that FileDescription is called that, variables of that type should not be called "descriptor". This is kinda wordy but we'll get used to it.
2019-06-13 20:03:04 +00:00
if (!description->is_socket())
Add support for socket send/receive timeouts. Only the receive timeout is hooked up yet. You can change the timeout by calling setsockopt(..., SOL_SOCKET, SO_RCVTIMEO, ...). Use this mechanism to make /bin/ping report timeouts.
2019-03-13 12:13:23 +00:00
return -ENOTSOCK;
Kernel: Rename "descriptor" to "description" where appropriate. Now that FileDescription is called that, variables of that type should not be called "descriptor". This is kinda wordy but we'll get used to it.
2019-06-13 20:03:04 +00:00
auto& socket = *description->socket();
Kernel: Add "accept" pledge promise for accepting incoming connections This patch adds a new "accept" promise that allows you to call accept() on an already listening socket. This lets programs set up a socket for for listening and then dropping "inet" and/or "unix" so that only incoming (and existing) connections are allowed from that point on. No new outgoing connections or listening server sockets can be created. In addition to accept() it also allows getsockopt() with SOL_SOCKET and SO_PEERCRED, which is used to find the PID/UID/GID of the socket peer. This is used by our IPC library when creating shared buffers that should only be accessible to a specific peer process. This allows us to drop "unix" in WindowServer and LookupServer. :^) It also makes the debugging/introspection RPC sockets in CEventLoop based programs work again.
2020-01-17 10:12:06 +00:00
if (has_promised(Pledge::accept) && socket.is_local() && level == SOL_SOCKET && option == SO_PEERCRED) {
// We make an exception for SOL_SOCKET::SO_PEERCRED on local sockets if you've pledged "accept"
} else {
REQUIRE_PROMISE_FOR_SOCKET_DOMAIN(socket.domain());
}
Kernel: Add getsockopt(SO_PEERCRED) for local sockets This sockopt gives you a struct with the PID, UID and GID of a socket's peer process.
2019-12-06 17:38:36 +00:00
return socket.getsockopt(*description, level, option, value, value_size);
Add support for socket send/receive timeouts. Only the receive timeout is hooked up yet. You can change the timeout by calling setsockopt(..., SOL_SOCKET, SO_RCVTIMEO, ...). Use this mechanism to make /bin/ping report timeouts.
2019-03-13 12:13:23 +00:00
}
int Process::sys$setsockopt(const Syscall::SC_setsockopt_params* params)
{
if (!validate_read_typed(params))
return -EFAULT;
Kernel: Use C++ structured bindings to bind syscall parameters Some syscalls have to pass parameters through a struct, since we can only fit 3 parameters with our calling convention. This patch makes use of C++ structured binding to clean up the places where we expand those parameters structs into local variables.
2019-11-10 14:32:59 +00:00
Kernel: Start implementing x86 SMAP support Supervisor Mode Access Prevention (SMAP) is an x86 CPU feature that prevents the kernel from accessing userspace memory. With SMAP enabled, trying to read/write a userspace memory address while in the kernel will now generate a page fault. Since it's sometimes necessary to read/write userspace memory, there are two new instructions that quickly switch the protection on/off: STAC (disables protection) and CLAC (enables protection.) These are exposed in kernel code via the stac() and clac() helpers. There's also a SmapDisabler RAII object that can be used to ensure that you don't forget to re-enable protection before returning to userspace code. THis patch also adds copy_to_user(), copy_from_user() and memset_user() which are the "correct" way of doing things. These functions allow us to briefly disable protection for a specific purpose, and then turn it back on immediately after it's done. Going forward all kernel code should be moved to using these and all uses of SmapDisabler are to be considered FIXME's. Note that we're not realizing the full potential of this feature since I've used SmapDisabler quite liberally in this initial bring-up patch.
2020-01-05 17:00:15 +00:00
SmapDisabler disabler;
Kernel: Fix bad TOCTOU pattern in syscalls that take a parameter struct Our syscall calling convention only allows passing up to 3 arguments in registers. For syscalls that take more arguments, we bake them into a struct and pass a pointer to that struct instead. When doing pointer validation, this is what we would do: 1) Validate the "params" struct 2) Validate "params->some_pointer" 3) ... other stuff ... 4) Use "params->some_pointer" Since the parameter struct is stored in userspace, it can be modified by userspace after validation has completed. This was a recurring pattern in many syscalls that was further hidden by me using structured binding declarations to give convenient local names to things in the parameter struct: auto& [some_pointer, ...] = *params; memcpy(some_pointer, ...); This devilishly makes "some_pointer" look like a local variable but it's actually more like an alias for "params->some_pointer" and will expand to a dereference when accessed! This patch fixes the issues by explicitly copying out each member from the parameter structs before validating them, and then never using the "param" pointers beyond that. Thanks to braindead for finding this bug! :^)
2020-01-05 08:13:00 +00:00
int sockfd = params->sockfd;
int level = params->level;
int option = params->option;
const void* value = params->value;
socklen_t value_size = params->value_size;
Add support for socket send/receive timeouts. Only the receive timeout is hooked up yet. You can change the timeout by calling setsockopt(..., SOL_SOCKET, SO_RCVTIMEO, ...). Use this mechanism to make /bin/ping report timeouts.
2019-03-13 12:13:23 +00:00
if (!validate_read(value, value_size))
return -EFAULT;
Kernel: Make Process::file_description() vend a RefPtr<FileDescription> This encourages callers to strongly reference file descriptions while working with them. This fixes a use-after-free issue where one thread would close() an open fd while another thread was blocked on it becoming readable. Test: Kernel/uaf-close-while-blocked-in-read.cpp
2020-01-07 14:53:42 +00:00
auto description = file_description(sockfd);
Kernel: Rename "descriptor" to "description" where appropriate. Now that FileDescription is called that, variables of that type should not be called "descriptor". This is kinda wordy but we'll get used to it.
2019-06-13 20:03:04 +00:00
if (!description)
Add support for socket send/receive timeouts. Only the receive timeout is hooked up yet. You can change the timeout by calling setsockopt(..., SOL_SOCKET, SO_RCVTIMEO, ...). Use this mechanism to make /bin/ping report timeouts.
2019-03-13 12:13:23 +00:00
return -EBADF;
Kernel: Rename "descriptor" to "description" where appropriate. Now that FileDescription is called that, variables of that type should not be called "descriptor". This is kinda wordy but we'll get used to it.
2019-06-13 20:03:04 +00:00
if (!description->is_socket())
Add support for socket send/receive timeouts. Only the receive timeout is hooked up yet. You can change the timeout by calling setsockopt(..., SOL_SOCKET, SO_RCVTIMEO, ...). Use this mechanism to make /bin/ping report timeouts.
2019-03-13 12:13:23 +00:00
return -ENOTSOCK;
Kernel: Rename "descriptor" to "description" where appropriate. Now that FileDescription is called that, variables of that type should not be called "descriptor". This is kinda wordy but we'll get used to it.
2019-06-13 20:03:04 +00:00
auto& socket = *description->socket();
ping: Use pledge()
2020-01-11 19:48:43 +00:00
REQUIRE_PROMISE_FOR_SOCKET_DOMAIN(socket.domain());
Add support for socket send/receive timeouts. Only the receive timeout is hooked up yet. You can change the timeout by calling setsockopt(..., SOL_SOCKET, SO_RCVTIMEO, ...). Use this mechanism to make /bin/ping report timeouts.
2019-03-13 12:13:23 +00:00
return socket.setsockopt(level, option, value, value_size);
}
Kernel: Add a simple shared memory API for two processes only. And use this to implement shared bitmaps between WindowServer and clients.
2019-02-16 11:13:43 +00:00
void Process::disown_all_shared_buffers()
{
LOCKER(shared_buffers().lock());
Sprinkle use of AK::Vector in various places. Some of these are less helpful than others. Avoiding a bunch of mallocs in the event loop wakeup code is definitely nice.
2019-04-20 12:02:19 +00:00
Vector<SharedBuffer*, 32> buffers_to_disown;
Kernel: Don't remove from SharedBuffer map while iterating it. This was causing a finalizer crash when handling a process that co-owned multiple shared buffers.
2019-02-20 20:31:52 +00:00
for (auto& it : shared_buffers().resource())
buffers_to_disown.append(it.value.ptr());
for (auto* shared_buffer : buffers_to_disown)
shared_buffer->disown(m_pid);
Kernel: Add a simple shared memory API for two processes only. And use this to implement shared bitmaps between WindowServer and clients.
2019-02-16 11:13:43 +00:00
}
Kernel+LibC: Rename shared buffer syscalls to use a prefix This feels a lot more consistent and Unixy: create_shared_buffer() => shbuf_create() share_buffer_with() => shbuf_allow_pid() share_buffer_globally() => shbuf_allow_all() get_shared_buffer() => shbuf_get() release_shared_buffer() => shbuf_release() seal_shared_buffer() => shbuf_seal() get_shared_buffer_size() => shbuf_get_size() Also, "shared_buffer_id" is shortened to "shbuf_id" all around.
2020-02-28 10:45:19 +00:00
int Process::sys$shbuf_create(int size, void** buffer)
Kernel: Add a simple shared memory API for two processes only. And use this to implement shared bitmaps between WindowServer and clients.
2019-02-16 11:13:43 +00:00
{
ping: Use pledge()
2020-01-11 19:48:43 +00:00
REQUIRE_PROMISE(shared_buffer);
Add a C++ helper class for working with shared buffers. This is a bit more comfortable than passing the shared buffer ID manually everywhere and keeping track of size etc.
2019-03-08 11:22:55 +00:00
if (!size || size < 0)
Kernel: Don't remove from SharedBuffer map while iterating it. This was causing a finalizer crash when handling a process that co-owned multiple shared buffers.
2019-02-20 20:31:52 +00:00
return -EINVAL;
size = PAGE_ROUND_UP(size);
Kernel: Add a simple shared memory API for two processes only. And use this to implement shared bitmaps between WindowServer and clients.
2019-02-16 11:13:43 +00:00
if (!validate_write_typed(buffer))
return -EFAULT;
Kernel: SharedBuffer sharing cleanup Rather than limiting it to two shared processes, store a Vector of references, so we can add more if we want. Makes the code a little more generic. No actual change to the syscall interface yet, so nothing takes advantage of this yet.
2019-07-15 18:38:41 +00:00
Kernel: Add a simple shared memory API for two processes only. And use this to implement shared bitmaps between WindowServer and clients.
2019-02-16 11:13:43 +00:00
LOCKER(shared_buffers().lock());
Kernel+LibC: Rename shared buffer syscalls to use a prefix This feels a lot more consistent and Unixy: create_shared_buffer() => shbuf_create() share_buffer_with() => shbuf_allow_pid() share_buffer_globally() => shbuf_allow_all() get_shared_buffer() => shbuf_get() release_shared_buffer() => shbuf_release() seal_shared_buffer() => shbuf_seal() get_shared_buffer_size() => shbuf_get_size() Also, "shared_buffer_id" is shortened to "shbuf_id" all around.
2020-02-28 10:45:19 +00:00
static int s_next_shbuf_id;
int shbuf_id = ++s_next_shbuf_id;
auto shared_buffer = make<SharedBuffer>(shbuf_id, size);
Kernel: SharedBuffer sharing cleanup Rather than limiting it to two shared processes, store a Vector of references, so we can add more if we want. Makes the code a little more generic. No actual change to the syscall interface yet, so nothing takes advantage of this yet.
2019-07-15 18:38:41 +00:00
shared_buffer->share_with(m_pid);
Kernel: Start implementing x86 SMAP support Supervisor Mode Access Prevention (SMAP) is an x86 CPU feature that prevents the kernel from accessing userspace memory. With SMAP enabled, trying to read/write a userspace memory address while in the kernel will now generate a page fault. Since it's sometimes necessary to read/write userspace memory, there are two new instructions that quickly switch the protection on/off: STAC (disables protection) and CLAC (enables protection.) These are exposed in kernel code via the stac() and clac() helpers. There's also a SmapDisabler RAII object that can be used to ensure that you don't forget to re-enable protection before returning to userspace code. THis patch also adds copy_to_user(), copy_from_user() and memset_user() which are the "correct" way of doing things. These functions allow us to briefly disable protection for a specific purpose, and then turn it back on immediately after it's done. Going forward all kernel code should be moved to using these and all uses of SmapDisabler are to be considered FIXME's. Note that we're not realizing the full potential of this feature since I've used SmapDisabler quite liberally in this initial bring-up patch.
2020-01-05 17:00:15 +00:00
void* address = shared_buffer->ref_for_process_and_get_address(*this);
Kernel: Remove SmapDisabler in sys$create_shared_buffer()
2020-02-18 13:12:39 +00:00
copy_to_user(buffer, &address);
Kernel: Fix all compiler warnings.
2019-06-22 14:22:34 +00:00
ASSERT((int)shared_buffer->size() >= size);
Move WindowServer to userspace. This is a monster patch that required changing a whole bunch of things. There are performance and stability issues all over the place, but it works. Pretty cool, I have to admit :^)
2019-02-16 23:13:47 +00:00
#ifdef SHARED_BUFFER_DEBUG
Kernel: Use klog() instead of kprintf() Also, duplicate data in dbg() and klog() calls were removed. In addition, leakage of virtual address to kernel log is prevented. This is done by replacing kprintf() calls to dbg() calls with the leaked data instead. Also, other kprintf() calls were replaced with klog().
2020-03-01 19:45:39 +00:00
klog() << "Created shared buffer " << shbuf_id << " @ " << buffer << " (" << size << " bytes, vmobject is " << shared_buffer->size() << ")";
Move WindowServer to userspace. This is a monster patch that required changing a whole bunch of things. There are performance and stability issues all over the place, but it works. Pretty cool, I have to admit :^)
2019-02-16 23:13:47 +00:00
#endif
Kernel+LibC: Rename shared buffer syscalls to use a prefix This feels a lot more consistent and Unixy: create_shared_buffer() => shbuf_create() share_buffer_with() => shbuf_allow_pid() share_buffer_globally() => shbuf_allow_all() get_shared_buffer() => shbuf_get() release_shared_buffer() => shbuf_release() seal_shared_buffer() => shbuf_seal() get_shared_buffer_size() => shbuf_get_size() Also, "shared_buffer_id" is shortened to "shbuf_id" all around.
2020-02-28 10:45:19 +00:00
shared_buffers().resource().set(shbuf_id, move(shared_buffer));
Kernel: SharedBuffer sharing cleanup Rather than limiting it to two shared processes, store a Vector of references, so we can add more if we want. Makes the code a little more generic. No actual change to the syscall interface yet, so nothing takes advantage of this yet.
2019-07-15 18:38:41 +00:00
Kernel+LibC: Rename shared buffer syscalls to use a prefix This feels a lot more consistent and Unixy: create_shared_buffer() => shbuf_create() share_buffer_with() => shbuf_allow_pid() share_buffer_globally() => shbuf_allow_all() get_shared_buffer() => shbuf_get() release_shared_buffer() => shbuf_release() seal_shared_buffer() => shbuf_seal() get_shared_buffer_size() => shbuf_get_size() Also, "shared_buffer_id" is shortened to "shbuf_id" all around.
2020-02-28 10:45:19 +00:00
return shbuf_id;
Kernel: Add a simple shared memory API for two processes only. And use this to implement shared bitmaps between WindowServer and clients.
2019-02-16 11:13:43 +00:00
}
Kernel+LibC: Rename shared buffer syscalls to use a prefix This feels a lot more consistent and Unixy: create_shared_buffer() => shbuf_create() share_buffer_with() => shbuf_allow_pid() share_buffer_globally() => shbuf_allow_all() get_shared_buffer() => shbuf_get() release_shared_buffer() => shbuf_release() seal_shared_buffer() => shbuf_seal() get_shared_buffer_size() => shbuf_get_size() Also, "shared_buffer_id" is shortened to "shbuf_id" all around.
2020-02-28 10:45:19 +00:00
int Process::sys$shbuf_allow_pid(int shbuf_id, pid_t peer_pid)
SharedBuffer: Split the creation and share steps This allows us to seal a buffer *before* anyone else has access to it (well, ok, the creating process still does, but you can't win them all). It also means that a SharedBuffer can be shared with multiple clients: all you need is to have access to it to share it on again.
2019-07-18 07:52:22 +00:00
{
ping: Use pledge()
2020-01-11 19:48:43 +00:00
REQUIRE_PROMISE(shared_buffer);
SharedBuffer: Split the creation and share steps This allows us to seal a buffer *before* anyone else has access to it (well, ok, the creating process still does, but you can't win them all). It also means that a SharedBuffer can be shared with multiple clients: all you need is to have access to it to share it on again.
2019-07-18 07:52:22 +00:00
if (!peer_pid || peer_pid < 0 || peer_pid == m_pid)
return -EINVAL;
LOCKER(shared_buffers().lock());
Kernel+LibC: Rename shared buffer syscalls to use a prefix This feels a lot more consistent and Unixy: create_shared_buffer() => shbuf_create() share_buffer_with() => shbuf_allow_pid() share_buffer_globally() => shbuf_allow_all() get_shared_buffer() => shbuf_get() release_shared_buffer() => shbuf_release() seal_shared_buffer() => shbuf_seal() get_shared_buffer_size() => shbuf_get_size() Also, "shared_buffer_id" is shortened to "shbuf_id" all around.
2020-02-28 10:45:19 +00:00
auto it = shared_buffers().resource().find(shbuf_id);
SharedBuffer: Split the creation and share steps This allows us to seal a buffer *before* anyone else has access to it (well, ok, the creating process still does, but you can't win them all). It also means that a SharedBuffer can be shared with multiple clients: all you need is to have access to it to share it on again.
2019-07-18 07:52:22 +00:00
if (it == shared_buffers().resource().end())
return -EINVAL;
auto& shared_buffer = *(*it).value;
Kernel: Disallow access to shared buffers we're not allowed to access. Unless we're on the share list, make all shared buffer related syscalls return EPERM.
2019-07-28 05:11:14 +00:00
if (!shared_buffer.is_shared_with(m_pid))
return -EPERM;
SharedBuffer: Split the creation and share steps This allows us to seal a buffer *before* anyone else has access to it (well, ok, the creating process still does, but you can't win them all). It also means that a SharedBuffer can be shared with multiple clients: all you need is to have access to it to share it on again.
2019-07-18 07:52:22 +00:00
{
InterruptDisabler disabler;
auto* peer = Process::from_pid(peer_pid);
if (!peer)
return -ESRCH;
}
shared_buffer.share_with(peer_pid);
return 0;
}
Kernel+LibC: Rename shared buffer syscalls to use a prefix This feels a lot more consistent and Unixy: create_shared_buffer() => shbuf_create() share_buffer_with() => shbuf_allow_pid() share_buffer_globally() => shbuf_allow_all() get_shared_buffer() => shbuf_get() release_shared_buffer() => shbuf_release() seal_shared_buffer() => shbuf_seal() get_shared_buffer_size() => shbuf_get_size() Also, "shared_buffer_id" is shortened to "shbuf_id" all around.
2020-02-28 10:45:19 +00:00
int Process::sys$shbuf_allow_all(int shbuf_id)
Kernel+ProcessManager: Let processes have an icon and show it in the table. Processes can now have an icon assigned, which is essentially a 16x16 RGBA32 bitmap exposed as a shared buffer ID. You set the icon ID by calling set_process_icon(int) and the icon ID will be exposed through /proc/all. To make this work, I added a mechanism for making shared buffers globally accessible. For safety reasons, each app seals the icon buffer before making it global. Right now the first call to GWindow::set_icon() is what determines the process icon. We'll probably change this in the future. :^)
2019-07-29 05:26:01 +00:00
{
ping: Use pledge()
2020-01-11 19:48:43 +00:00
REQUIRE_PROMISE(shared_buffer);
Kernel+ProcessManager: Let processes have an icon and show it in the table. Processes can now have an icon assigned, which is essentially a 16x16 RGBA32 bitmap exposed as a shared buffer ID. You set the icon ID by calling set_process_icon(int) and the icon ID will be exposed through /proc/all. To make this work, I added a mechanism for making shared buffers globally accessible. For safety reasons, each app seals the icon buffer before making it global. Right now the first call to GWindow::set_icon() is what determines the process icon. We'll probably change this in the future. :^)
2019-07-29 05:26:01 +00:00
LOCKER(shared_buffers().lock());
Kernel+LibC: Rename shared buffer syscalls to use a prefix This feels a lot more consistent and Unixy: create_shared_buffer() => shbuf_create() share_buffer_with() => shbuf_allow_pid() share_buffer_globally() => shbuf_allow_all() get_shared_buffer() => shbuf_get() release_shared_buffer() => shbuf_release() seal_shared_buffer() => shbuf_seal() get_shared_buffer_size() => shbuf_get_size() Also, "shared_buffer_id" is shortened to "shbuf_id" all around.
2020-02-28 10:45:19 +00:00
auto it = shared_buffers().resource().find(shbuf_id);
Kernel+ProcessManager: Let processes have an icon and show it in the table. Processes can now have an icon assigned, which is essentially a 16x16 RGBA32 bitmap exposed as a shared buffer ID. You set the icon ID by calling set_process_icon(int) and the icon ID will be exposed through /proc/all. To make this work, I added a mechanism for making shared buffers globally accessible. For safety reasons, each app seals the icon buffer before making it global. Right now the first call to GWindow::set_icon() is what determines the process icon. We'll probably change this in the future. :^)
2019-07-29 05:26:01 +00:00
if (it == shared_buffers().resource().end())
return -EINVAL;
auto& shared_buffer = *(*it).value;
if (!shared_buffer.is_shared_with(m_pid))
return -EPERM;
shared_buffer.share_globally();
return 0;
}
Kernel+LibC: Rename shared buffer syscalls to use a prefix This feels a lot more consistent and Unixy: create_shared_buffer() => shbuf_create() share_buffer_with() => shbuf_allow_pid() share_buffer_globally() => shbuf_allow_all() get_shared_buffer() => shbuf_get() release_shared_buffer() => shbuf_release() seal_shared_buffer() => shbuf_seal() get_shared_buffer_size() => shbuf_get_size() Also, "shared_buffer_id" is shortened to "shbuf_id" all around.
2020-02-28 10:45:19 +00:00
int Process::sys$shbuf_release(int shbuf_id)
Kernel: Add a simple shared memory API for two processes only. And use this to implement shared bitmaps between WindowServer and clients.
2019-02-16 11:13:43 +00:00
{
ping: Use pledge()
2020-01-11 19:48:43 +00:00
REQUIRE_PROMISE(shared_buffer);
Kernel: Add a simple shared memory API for two processes only. And use this to implement shared bitmaps between WindowServer and clients.
2019-02-16 11:13:43 +00:00
LOCKER(shared_buffers().lock());
Kernel+LibC: Rename shared buffer syscalls to use a prefix This feels a lot more consistent and Unixy: create_shared_buffer() => shbuf_create() share_buffer_with() => shbuf_allow_pid() share_buffer_globally() => shbuf_allow_all() get_shared_buffer() => shbuf_get() release_shared_buffer() => shbuf_release() seal_shared_buffer() => shbuf_seal() get_shared_buffer_size() => shbuf_get_size() Also, "shared_buffer_id" is shortened to "shbuf_id" all around.
2020-02-28 10:45:19 +00:00
auto it = shared_buffers().resource().find(shbuf_id);
Kernel: Add a simple shared memory API for two processes only. And use this to implement shared bitmaps between WindowServer and clients.
2019-02-16 11:13:43 +00:00
if (it == shared_buffers().resource().end())
return -EINVAL;
auto& shared_buffer = *(*it).value;
Kernel: Disallow access to shared buffers we're not allowed to access. Unless we're on the share list, make all shared buffer related syscalls return EPERM.
2019-07-28 05:11:14 +00:00
if (!shared_buffer.is_shared_with(m_pid))
return -EPERM;
Move WindowServer to userspace. This is a monster patch that required changing a whole bunch of things. There are performance and stability issues all over the place, but it works. Pretty cool, I have to admit :^)
2019-02-16 23:13:47 +00:00
#ifdef SHARED_BUFFER_DEBUG
Kernel: Use klog() instead of kprintf() Also, duplicate data in dbg() and klog() calls were removed. In addition, leakage of virtual address to kernel log is prevented. This is done by replacing kprintf() calls to dbg() calls with the leaked data instead. Also, other kprintf() calls were replaced with klog().
2020-03-01 19:45:39 +00:00
klog() << "Releasing shared buffer " << shbuf_id << ", buffer count: " << shared_buffers().resource().size();
Move WindowServer to userspace. This is a monster patch that required changing a whole bunch of things. There are performance and stability issues all over the place, but it works. Pretty cool, I have to admit :^)
2019-02-16 23:13:47 +00:00
#endif
SharedBuffer: Fix a denial of service It's a very bad idea to increment the refcount on behalf of another process. That process may (for either benign or evil reasons) not reference the SharedBuffer, and then we'll be stuck with loads of SharedBuffers until we OOM. Instead, increment the refcount when the buffer is mapped. That way, a buffer is only kept if *someone* has explicitly requested it via get_shared_buffer. Fixes #341
2019-07-19 15:46:21 +00:00
shared_buffer.deref_for_process(*this);
Kernel: Add a simple shared memory API for two processes only. And use this to implement shared bitmaps between WindowServer and clients.
2019-02-16 11:13:43 +00:00
return 0;
}
Kernel: Merge the shbuf_get_size() syscall into shbuf_get() Add an extra out-parameter to shbuf_get() that receives the size of the shared buffer. That way we don't need to make a separate syscall to get the size, which we always did immediately after.
2020-02-28 11:29:14 +00:00
void* Process::sys$shbuf_get(int shbuf_id, size_t* user_size)
Kernel: Add a simple shared memory API for two processes only. And use this to implement shared bitmaps between WindowServer and clients.
2019-02-16 11:13:43 +00:00
{
ping: Use pledge()
2020-01-11 19:48:43 +00:00
REQUIRE_PROMISE(shared_buffer);
Kernel: Merge the shbuf_get_size() syscall into shbuf_get() Add an extra out-parameter to shbuf_get() that receives the size of the shared buffer. That way we don't need to make a separate syscall to get the size, which we always did immediately after.
2020-02-28 11:29:14 +00:00
if (user_size && !validate_write_typed(user_size))
return (void*)-EFAULT;
Kernel: Add a simple shared memory API for two processes only. And use this to implement shared bitmaps between WindowServer and clients.
2019-02-16 11:13:43 +00:00
LOCKER(shared_buffers().lock());
Kernel+LibC: Rename shared buffer syscalls to use a prefix This feels a lot more consistent and Unixy: create_shared_buffer() => shbuf_create() share_buffer_with() => shbuf_allow_pid() share_buffer_globally() => shbuf_allow_all() get_shared_buffer() => shbuf_get() release_shared_buffer() => shbuf_release() seal_shared_buffer() => shbuf_seal() get_shared_buffer_size() => shbuf_get_size() Also, "shared_buffer_id" is shortened to "shbuf_id" all around.
2020-02-28 10:45:19 +00:00
auto it = shared_buffers().resource().find(shbuf_id);
Kernel: Add a simple shared memory API for two processes only. And use this to implement shared bitmaps between WindowServer and clients.
2019-02-16 11:13:43 +00:00
if (it == shared_buffers().resource().end())
return (void*)-EINVAL;
auto& shared_buffer = *(*it).value;
Kernel: SharedBuffer sharing cleanup Rather than limiting it to two shared processes, store a Vector of references, so we can add more if we want. Makes the code a little more generic. No actual change to the syscall interface yet, so nothing takes advantage of this yet.
2019-07-15 18:38:41 +00:00
if (!shared_buffer.is_shared_with(m_pid))
Kernel: Disallow access to shared buffers we're not allowed to access. Unless we're on the share list, make all shared buffer related syscalls return EPERM.
2019-07-28 05:11:14 +00:00
return (void*)-EPERM;
Move WindowServer to userspace. This is a monster patch that required changing a whole bunch of things. There are performance and stability issues all over the place, but it works. Pretty cool, I have to admit :^)
2019-02-16 23:13:47 +00:00
#ifdef SHARED_BUFFER_DEBUG
Kernel: Use klog() instead of kprintf() Also, duplicate data in dbg() and klog() calls were removed. In addition, leakage of virtual address to kernel log is prevented. This is done by replacing kprintf() calls to dbg() calls with the leaked data instead. Also, other kprintf() calls were replaced with klog().
2020-03-01 19:45:39 +00:00
klog() << "Retaining shared buffer " << shbuf_id << ", buffer count: " << shared_buffers().resource().size();
Move WindowServer to userspace. This is a monster patch that required changing a whole bunch of things. There are performance and stability issues all over the place, but it works. Pretty cool, I have to admit :^)
2019-02-16 23:13:47 +00:00
#endif
Kernel: Merge the shbuf_get_size() syscall into shbuf_get() Add an extra out-parameter to shbuf_get() that receives the size of the shared buffer. That way we don't need to make a separate syscall to get the size, which we always did immediately after.
2020-02-28 11:29:14 +00:00
if (user_size) {
size_t size = shared_buffer.size();
copy_to_user(user_size, &size);
}
SharedBuffer: Fix a denial of service It's a very bad idea to increment the refcount on behalf of another process. That process may (for either benign or evil reasons) not reference the SharedBuffer, and then we'll be stuck with loads of SharedBuffers until we OOM. Instead, increment the refcount when the buffer is mapped. That way, a buffer is only kept if *someone* has explicitly requested it via get_shared_buffer. Fixes #341
2019-07-19 15:46:21 +00:00
return shared_buffer.ref_for_process_and_get_address(*this);
Kernel: Add a simple shared memory API for two processes only. And use this to implement shared bitmaps between WindowServer and clients.
2019-02-16 11:13:43 +00:00
}
Kernel: Block a signal from being dispatched again until handler returns. We don't handle nesting yet, but this is a step in the right direction.
2019-03-05 09:34:08 +00:00
Kernel+LibC: Rename shared buffer syscalls to use a prefix This feels a lot more consistent and Unixy: create_shared_buffer() => shbuf_create() share_buffer_with() => shbuf_allow_pid() share_buffer_globally() => shbuf_allow_all() get_shared_buffer() => shbuf_get() release_shared_buffer() => shbuf_release() seal_shared_buffer() => shbuf_seal() get_shared_buffer_size() => shbuf_get_size() Also, "shared_buffer_id" is shortened to "shbuf_id" all around.
2020-02-28 10:45:19 +00:00
int Process::sys$shbuf_seal(int shbuf_id)
Add a C++ helper class for working with shared buffers. This is a bit more comfortable than passing the shared buffer ID manually everywhere and keeping track of size etc.
2019-03-08 11:22:55 +00:00
{
ping: Use pledge()
2020-01-11 19:48:43 +00:00
REQUIRE_PROMISE(shared_buffer);
Add a C++ helper class for working with shared buffers. This is a bit more comfortable than passing the shared buffer ID manually everywhere and keeping track of size etc.
2019-03-08 11:22:55 +00:00
LOCKER(shared_buffers().lock());
Kernel+LibC: Rename shared buffer syscalls to use a prefix This feels a lot more consistent and Unixy: create_shared_buffer() => shbuf_create() share_buffer_with() => shbuf_allow_pid() share_buffer_globally() => shbuf_allow_all() get_shared_buffer() => shbuf_get() release_shared_buffer() => shbuf_release() seal_shared_buffer() => shbuf_seal() get_shared_buffer_size() => shbuf_get_size() Also, "shared_buffer_id" is shortened to "shbuf_id" all around.
2020-02-28 10:45:19 +00:00
auto it = shared_buffers().resource().find(shbuf_id);
Add a C++ helper class for working with shared buffers. This is a bit more comfortable than passing the shared buffer ID manually everywhere and keeping track of size etc.
2019-03-08 11:22:55 +00:00
if (it == shared_buffers().resource().end())
return -EINVAL;
auto& shared_buffer = *(*it).value;
Kernel: SharedBuffer sharing cleanup Rather than limiting it to two shared processes, store a Vector of references, so we can add more if we want. Makes the code a little more generic. No actual change to the syscall interface yet, so nothing takes advantage of this yet.
2019-07-15 18:38:41 +00:00
if (!shared_buffer.is_shared_with(m_pid))
Kernel: Disallow access to shared buffers we're not allowed to access. Unless we're on the share list, make all shared buffer related syscalls return EPERM.
2019-07-28 05:11:14 +00:00
return -EPERM;
Add a C++ helper class for working with shared buffers. This is a bit more comfortable than passing the shared buffer ID manually everywhere and keeping track of size etc.
2019-03-08 11:22:55 +00:00
#ifdef SHARED_BUFFER_DEBUG
Kernel: Use klog() instead of kprintf() Also, duplicate data in dbg() and klog() calls were removed. In addition, leakage of virtual address to kernel log is prevented. This is done by replacing kprintf() calls to dbg() calls with the leaked data instead. Also, other kprintf() calls were replaced with klog().
2020-03-01 19:45:39 +00:00
klog() << "Sealing shared buffer " << shbuf_id;
Add a C++ helper class for working with shared buffers. This is a bit more comfortable than passing the shared buffer ID manually everywhere and keeping track of size etc.
2019-03-08 11:22:55 +00:00
#endif
shared_buffer.seal();
return 0;
}
Kernel+LibC: Rename shared buffer syscalls to use a prefix This feels a lot more consistent and Unixy: create_shared_buffer() => shbuf_create() share_buffer_with() => shbuf_allow_pid() share_buffer_globally() => shbuf_allow_all() get_shared_buffer() => shbuf_get() release_shared_buffer() => shbuf_release() seal_shared_buffer() => shbuf_seal() get_shared_buffer_size() => shbuf_get_size() Also, "shared_buffer_id" is shortened to "shbuf_id" all around.
2020-02-28 10:45:19 +00:00
int Process::sys$shbuf_set_volatile(int shbuf_id, bool state)
Kernel+LibC: Make all SharedBuffers purgeable (default: non-volatile) This patch makes SharedBuffer use a PurgeableVMObject as its underlying memory object. A new syscall is added to control the volatile flag of a SharedBuffer.
2019-12-09 19:06:47 +00:00
{
ping: Use pledge()
2020-01-11 19:48:43 +00:00
REQUIRE_PROMISE(shared_buffer);
Kernel+LibC: Make all SharedBuffers purgeable (default: non-volatile) This patch makes SharedBuffer use a PurgeableVMObject as its underlying memory object. A new syscall is added to control the volatile flag of a SharedBuffer.
2019-12-09 19:06:47 +00:00
LOCKER(shared_buffers().lock());
Kernel+LibC: Rename shared buffer syscalls to use a prefix This feels a lot more consistent and Unixy: create_shared_buffer() => shbuf_create() share_buffer_with() => shbuf_allow_pid() share_buffer_globally() => shbuf_allow_all() get_shared_buffer() => shbuf_get() release_shared_buffer() => shbuf_release() seal_shared_buffer() => shbuf_seal() get_shared_buffer_size() => shbuf_get_size() Also, "shared_buffer_id" is shortened to "shbuf_id" all around.
2020-02-28 10:45:19 +00:00
auto it = shared_buffers().resource().find(shbuf_id);
Kernel+LibC: Make all SharedBuffers purgeable (default: non-volatile) This patch makes SharedBuffer use a PurgeableVMObject as its underlying memory object. A new syscall is added to control the volatile flag of a SharedBuffer.
2019-12-09 19:06:47 +00:00
if (it == shared_buffers().resource().end())
return -EINVAL;
auto& shared_buffer = *(*it).value;
if (!shared_buffer.is_shared_with(m_pid))
return -EPERM;
#ifdef SHARED_BUFFER_DEBUG
Kernel: Use klog() instead of kprintf() Also, duplicate data in dbg() and klog() calls were removed. In addition, leakage of virtual address to kernel log is prevented. This is done by replacing kprintf() calls to dbg() calls with the leaked data instead. Also, other kprintf() calls were replaced with klog().
2020-03-01 19:45:39 +00:00
klog() << "Set shared buffer " << shbuf_id << " volatile: " << state;
Kernel+LibC: Make all SharedBuffers purgeable (default: non-volatile) This patch makes SharedBuffer use a PurgeableVMObject as its underlying memory object. A new syscall is added to control the volatile flag of a SharedBuffer.
2019-12-09 19:06:47 +00:00
#endif
if (!state) {
bool was_purged = shared_buffer.vmobject().was_purged();
shared_buffer.vmobject().set_volatile(state);
shared_buffer.vmobject().set_was_purged(false);
return was_purged ? 1 : 0;
}
shared_buffer.vmobject().set_volatile(true);
return 0;
}
AK: Rename the common integer typedefs to make it obvious what they are. These types can be picked up by including <AK/Types.h>: * u8, u16, u32, u64 (unsigned) * i8, i16, i32, i64 (signed)
2019-07-03 19:17:35 +00:00
void Process::terminate_due_to_signal(u8 signal)
Kernel: Introduce threads, and refactor everything in support of it. The scheduler now operates on threads, rather than on processes. Each process has a main thread, and can have any number of additional threads. The process exits when the main thread exits. This patch doesn't actually spawn any additional threads, it merely does all the plumbing needed to make it possible. :^)
2019-03-23 21:03:17 +00:00
{
ASSERT_INTERRUPTS_DISABLED();
ASSERT(signal < 32);
Kernel: Simplify some dbg() logging We don't have to log the process name/PID/TID, dbg() automatically adds that as a prefix to every line. Also we don't have to do .characters() on Strings passed to dbg() :^)
2020-02-29 11:51:44 +00:00
dbg() << "Terminating due to signal " << signal;
Kernel: Introduce threads, and refactor everything in support of it. The scheduler now operates on threads, rather than on processes. Each process has a main thread, and can have any number of additional threads. The process exits when the main thread exits. This patch doesn't actually spawn any additional threads, it merely does all the plumbing needed to make it possible. :^)
2019-03-23 21:03:17 +00:00
m_termination_status = 0;
m_termination_signal = signal;
die();
}
AK: Rename the common integer typedefs to make it obvious what they are. These types can be picked up by including <AK/Types.h>: * u8, u16, u32, u64 (unsigned) * i8, i16, i32, i64 (signed)
2019-07-03 19:17:35 +00:00
void Process::send_signal(u8 signal, Process* sender)
Kernel: Introduce threads, and refactor everything in support of it. The scheduler now operates on threads, rather than on processes. Each process has a main thread, and can have any number of additional threads. The process exits when the main thread exits. This patch doesn't actually spawn any additional threads, it merely does all the plumbing needed to make it possible. :^)
2019-03-23 21:03:17 +00:00
{
Kernel: Process::send_signal() should prefer main thread The main/first thread in a process always has the same TID as the PID.
2020-01-06 13:37:08 +00:00
InterruptDisabler disabler;
Kernel: Ignore signals sent to threadless (zombie) processes If a process doesn't have any threads left, it's in a zombie state and we can't meaningfully send signals to it. So just ignore them. Fixes #1313.
2020-02-27 10:03:21 +00:00
if (!m_thread_count)
return;
Kernel: Process::send_signal() should prefer main thread The main/first thread in a process always has the same TID as the PID.
2020-01-06 13:37:08 +00:00
auto* thread = Thread::from_tid(m_pid);
if (!thread)
thread = &any_thread();
thread->send_signal(signal, sender);
Kernel: Introduce threads, and refactor everything in support of it. The scheduler now operates on threads, rather than on processes. Each process has a main thread, and can have any number of additional threads. The process exits when the main thread exits. This patch doesn't actually spawn any additional threads, it merely does all the plumbing needed to make it possible. :^)
2019-03-23 21:03:17 +00:00
}
Kernel+LibC: Add a simple create_thread() syscall. It takes two parameters, a function pointer for the entry function, and a void* argument to be passed to that function on the new thread.
2019-03-23 21:59:08 +00:00
Kernel: Remove manual STAC/CLAC in create_thread()
2020-01-12 10:51:31 +00:00
int Process::sys$create_thread(void* (*entry)(void*), void* argument, const Syscall::SC_create_thread_params* user_params)
Kernel+LibC: Add a simple create_thread() syscall. It takes two parameters, a function pointer for the entry function, and a void* argument to be passed to that function on the new thread.
2019-03-23 21:59:08 +00:00
{
ping: Use pledge()
2020-01-11 19:48:43 +00:00
REQUIRE_PROMISE(thread);
Kernel+LibC: Add a simple create_thread() syscall. It takes two parameters, a function pointer for the entry function, and a void* argument to be passed to that function on the new thread.
2019-03-23 21:59:08 +00:00
if (!validate_read((const void*)entry, sizeof(void*)))
return -EFAULT;
Kernel+LibPthread: pthread_create handles pthread_attr_t Add an initial implementation of pthread attributes for: * detach state (joinable, detached) * schedule params (just priority) * guard page size (as skeleton) (requires kernel support maybe?) * stack size and user-provided stack location (4 or 8 MB only, must be aligned) Add some tests too, to the thread test program. Also, LibC: Move pthread declarations to sys/types.h, where they belong.
2019-11-18 03:08:10 +00:00
Kernel: Remove manual STAC/CLAC in create_thread()
2020-01-12 10:51:31 +00:00
Syscall::SC_create_thread_params params;
Kernel: Combine validate and copy of user mode pointers (#1069) Right now there is a significant amount of boiler plate code required to validate user mode parameters in syscalls. In an attempt to reduce this a bit, introduce validate_read_and_copy_typed which combines the usermode address check and does the copy internally if the validation passes. This cleans up a little bit of code from a significant amount of syscalls.
2020-01-13 10:19:18 +00:00
if (!validate_read_and_copy_typed(&params, user_params))
return -EFAULT;
Kernel: Remove manual STAC/CLAC in create_thread()
2020-01-12 10:51:31 +00:00
unsigned detach_state = params.m_detach_state;
int schedule_priority = params.m_schedule_priority;
void* stack_location = params.m_stack_location;
unsigned stack_size = params.m_stack_size;
Kernel: Start implementing x86 SMAP support Supervisor Mode Access Prevention (SMAP) is an x86 CPU feature that prevents the kernel from accessing userspace memory. With SMAP enabled, trying to read/write a userspace memory address while in the kernel will now generate a page fault. Since it's sometimes necessary to read/write userspace memory, there are two new instructions that quickly switch the protection on/off: STAC (disables protection) and CLAC (enables protection.) These are exposed in kernel code via the stac() and clac() helpers. There's also a SmapDisabler RAII object that can be used to ensure that you don't forget to re-enable protection before returning to userspace code. THis patch also adds copy_to_user(), copy_from_user() and memset_user() which are the "correct" way of doing things. These functions allow us to briefly disable protection for a specific purpose, and then turn it back on immediately after it's done. Going forward all kernel code should be moved to using these and all uses of SmapDisabler are to be considered FIXME's. Note that we're not realizing the full potential of this feature since I've used SmapDisabler quite liberally in this initial bring-up patch.
2020-01-05 17:00:15 +00:00
Kernel: Fix bad TOCTOU pattern in syscalls that take a parameter struct Our syscall calling convention only allows passing up to 3 arguments in registers. For syscalls that take more arguments, we bake them into a struct and pass a pointer to that struct instead. When doing pointer validation, this is what we would do: 1) Validate the "params" struct 2) Validate "params->some_pointer" 3) ... other stuff ... 4) Use "params->some_pointer" Since the parameter struct is stored in userspace, it can be modified by userspace after validation has completed. This was a recurring pattern in many syscalls that was further hidden by me using structured binding declarations to give convenient local names to things in the parameter struct: auto& [some_pointer, ...] = *params; memcpy(some_pointer, ...); This devilishly makes "some_pointer" look like a local variable but it's actually more like an alias for "params->some_pointer" and will expand to a dereference when accessed! This patch fixes the issues by explicitly copying out each member from the parameter structs before validating them, and then never using the "param" pointers beyond that. Thanks to braindead for finding this bug! :^)
2020-01-05 08:13:00 +00:00
if (!validate_write(stack_location, stack_size))
return -EFAULT;
u32 user_stack_address = reinterpret_cast<u32>(stack_location) + stack_size;
Kernel+LibPthread: pthread_create handles pthread_attr_t Add an initial implementation of pthread attributes for: * detach state (joinable, detached) * schedule params (just priority) * guard page size (as skeleton) (requires kernel support maybe?) * stack size and user-provided stack location (4 or 8 MB only, must be aligned) Add some tests too, to the thread test program. Also, LibC: Move pthread declarations to sys/types.h, where they belong.
2019-11-18 03:08:10 +00:00
if (!MM.validate_user_stack(*this, VirtualAddress(user_stack_address - 4)))
Kernel+LibPthread+LibC: Create secondary thread stacks in userspace Have pthread_create() allocate a stack and passing it to the kernel instead of this work happening in the kernel. The more of this we can do in userspace, the better. This patch also unexposes the raw create_thread() and exit_thread() syscalls since they are now only used by LibPthread anyway.
2019-11-17 16:28:17 +00:00
return -EFAULT;
Kernel+LibPthread: pthread_create handles pthread_attr_t Add an initial implementation of pthread attributes for: * detach state (joinable, detached) * schedule params (just priority) * guard page size (as skeleton) (requires kernel support maybe?) * stack size and user-provided stack location (4 or 8 MB only, must be aligned) Add some tests too, to the thread test program. Also, LibC: Move pthread declarations to sys/types.h, where they belong.
2019-11-18 03:08:10 +00:00
// FIXME: return EAGAIN if Thread::all_threads().size() is greater than PTHREAD_THREADS_MAX
Kernel: Fix bad TOCTOU pattern in syscalls that take a parameter struct Our syscall calling convention only allows passing up to 3 arguments in registers. For syscalls that take more arguments, we bake them into a struct and pass a pointer to that struct instead. When doing pointer validation, this is what we would do: 1) Validate the "params" struct 2) Validate "params->some_pointer" 3) ... other stuff ... 4) Use "params->some_pointer" Since the parameter struct is stored in userspace, it can be modified by userspace after validation has completed. This was a recurring pattern in many syscalls that was further hidden by me using structured binding declarations to give convenient local names to things in the parameter struct: auto& [some_pointer, ...] = *params; memcpy(some_pointer, ...); This devilishly makes "some_pointer" look like a local variable but it's actually more like an alias for "params->some_pointer" and will expand to a dereference when accessed! This patch fixes the issues by explicitly copying out each member from the parameter structs before validating them, and then never using the "param" pointers beyond that. Thanks to braindead for finding this bug! :^)
2020-01-05 08:13:00 +00:00
int requested_thread_priority = schedule_priority;
Kernel: Refactor scheduler to use dynamic thread priorities Threads now have numeric priorities with a base priority in the 1-99 range. Whenever a runnable thread is *not* scheduled, its effective priority is incremented by 1. This is tracked in Thread::m_extra_priority. The effective priority of a thread is m_priority + m_extra_priority. When a runnable thread *is* scheduled, its m_extra_priority is reset to zero and the effective priority returns to base. This means that lower-priority threads will always eventually get scheduled to run, once its effective priority becomes high enough to exceed the base priority of threads "above" it. The previous values for ThreadPriority (Low, Normal and High) are now replaced as follows: Low -> 10 Normal -> 30 High -> 50 In other words, it will take 20 ticks for a "Low" priority thread to get to "Normal" effective priority, and another 20 to reach "High". This is not perfect, and I've used some quite naive data structures, but I think the mechanism will allow us to build various new and interesting optimizations, and we can figure out better data structures later on. :^)
2019-12-30 17:46:17 +00:00
if (requested_thread_priority < THREAD_PRIORITY_MIN || requested_thread_priority > THREAD_PRIORITY_MAX)
Kernel+LibPthread: pthread_create handles pthread_attr_t Add an initial implementation of pthread attributes for: * detach state (joinable, detached) * schedule params (just priority) * guard page size (as skeleton) (requires kernel support maybe?) * stack size and user-provided stack location (4 or 8 MB only, must be aligned) Add some tests too, to the thread test program. Also, LibC: Move pthread declarations to sys/types.h, where they belong.
2019-11-18 03:08:10 +00:00
return -EINVAL;
Kernel: Fix bad TOCTOU pattern in syscalls that take a parameter struct Our syscall calling convention only allows passing up to 3 arguments in registers. For syscalls that take more arguments, we bake them into a struct and pass a pointer to that struct instead. When doing pointer validation, this is what we would do: 1) Validate the "params" struct 2) Validate "params->some_pointer" 3) ... other stuff ... 4) Use "params->some_pointer" Since the parameter struct is stored in userspace, it can be modified by userspace after validation has completed. This was a recurring pattern in many syscalls that was further hidden by me using structured binding declarations to give convenient local names to things in the parameter struct: auto& [some_pointer, ...] = *params; memcpy(some_pointer, ...); This devilishly makes "some_pointer" look like a local variable but it's actually more like an alias for "params->some_pointer" and will expand to a dereference when accessed! This patch fixes the issues by explicitly copying out each member from the parameter structs before validating them, and then never using the "param" pointers beyond that. Thanks to braindead for finding this bug! :^)
2020-01-05 08:13:00 +00:00
bool is_thread_joinable = (0 == detach_state);
Kernel+LibPthread: pthread_create handles pthread_attr_t Add an initial implementation of pthread attributes for: * detach state (joinable, detached) * schedule params (just priority) * guard page size (as skeleton) (requires kernel support maybe?) * stack size and user-provided stack location (4 or 8 MB only, must be aligned) Add some tests too, to the thread test program. Also, LibC: Move pthread declarations to sys/types.h, where they belong.
2019-11-18 03:08:10 +00:00
// FIXME: Do something with guard pages?
Kernel+LibC: Add a simple create_thread() syscall. It takes two parameters, a function pointer for the entry function, and a void* argument to be passed to that function on the new thread.
2019-03-23 21:59:08 +00:00
auto* thread = new Thread(*this);
Kernel+LibPthread: pthread_create handles pthread_attr_t Add an initial implementation of pthread attributes for: * detach state (joinable, detached) * schedule params (just priority) * guard page size (as skeleton) (requires kernel support maybe?) * stack size and user-provided stack location (4 or 8 MB only, must be aligned) Add some tests too, to the thread test program. Also, LibC: Move pthread declarations to sys/types.h, where they belong.
2019-11-18 03:08:10 +00:00
Kernel: Allow setting thread names The main thread of each kernel/user process will take the name of the process. Extra threads will get a fancy new name "ProcessName[<tid>]". Thread backtraces now list the thread name in addtion to tid. Add the thread name to /proc/all (should it get its own proc file?). Add two new syscalls, set_thread_name and get_thread_name.
2019-12-07 19:45:26 +00:00
// We know this thread is not the main_thread,
// So give it a unique name until the user calls $set_thread_name on it
// length + 4 to give space for our extra junk at the end
StringBuilder builder(m_name.length() + 4);
builder.append(m_name);
builder.appendf("[%d]", thread->tid());
thread->set_name(builder.to_string());
Kernel+LibPthread: pthread_create handles pthread_attr_t Add an initial implementation of pthread attributes for: * detach state (joinable, detached) * schedule params (just priority) * guard page size (as skeleton) (requires kernel support maybe?) * stack size and user-provided stack location (4 or 8 MB only, must be aligned) Add some tests too, to the thread test program. Also, LibC: Move pthread declarations to sys/types.h, where they belong.
2019-11-18 03:08:10 +00:00
thread->set_priority(requested_thread_priority);
thread->set_joinable(is_thread_joinable);
Kernel+LibC: Add a simple create_thread() syscall. It takes two parameters, a function pointer for the entry function, and a void* argument to be passed to that function on the new thread.
2019-03-23 21:59:08 +00:00
auto& tss = thread->tss();
AK: Add global FlatPtr typedef. It's u32 or u64, based on sizeof(void*) Use this instead of uintptr_t throughout the codebase. This makes it possible to pass a FlatPtr to something that has u32 and u64 overloads.
2020-03-08 09:36:51 +00:00
tss.eip = (FlatPtr)entry;
Kernel+LibC: Add a simple create_thread() syscall. It takes two parameters, a function pointer for the entry function, and a void* argument to be passed to that function on the new thread.
2019-03-23 21:59:08 +00:00
tss.eflags = 0x0202;
tss.cr3 = page_directory().cr3();
Kernel+LibPthread: pthread_create handles pthread_attr_t Add an initial implementation of pthread attributes for: * detach state (joinable, detached) * schedule params (just priority) * guard page size (as skeleton) (requires kernel support maybe?) * stack size and user-provided stack location (4 or 8 MB only, must be aligned) Add some tests too, to the thread test program. Also, LibC: Move pthread declarations to sys/types.h, where they belong.
2019-11-18 03:08:10 +00:00
tss.esp = user_stack_address;
Kernel+LibPthread+LibC: Create secondary thread stacks in userspace Have pthread_create() allocate a stack and passing it to the kernel instead of this work happening in the kernel. The more of this we can do in userspace, the better. This patch also unexposes the raw create_thread() and exit_thread() syscalls since they are now only used by LibPthread anyway.
2019-11-17 16:28:17 +00:00
// NOTE: The stack needs to be 16-byte aligned.
AK: Add global FlatPtr typedef. It's u32 or u64, based on sizeof(void*) Use this instead of uintptr_t throughout the codebase. This makes it possible to pass a FlatPtr to something that has u32 and u64 overloads.
2020-03-08 09:36:51 +00:00
thread->push_value_on_stack((FlatPtr)argument);
Kernel+LibPthread+LibC: Create secondary thread stacks in userspace Have pthread_create() allocate a stack and passing it to the kernel instead of this work happening in the kernel. The more of this we can do in userspace, the better. This patch also unexposes the raw create_thread() and exit_thread() syscalls since they are now only used by LibPthread anyway.
2019-11-17 16:28:17 +00:00
thread->push_value_on_stack(0);
Kernel: Support thread-local storage This patch adds support for TLS according to the x86 System V ABI. Each thread gets a thread-specific memory region, and the GS segment register always points _to a pointer_ to the thread-specific memory. In other words, to access thread-local variables, userspace programs start by dereferencing the pointer at [gs:0]. The Process keeps a master copy of the TLS segment that new threads should use, and when a new thread is created, they get a copy of it. It's basically whatever the PT_TLS program header in the ELF says.
2019-09-07 13:50:44 +00:00
thread->make_thread_specific_region({});
Kernel+LibC: Add a simple create_thread() syscall. It takes two parameters, a function pointer for the entry function, and a void* argument to be passed to that function on the new thread.
2019-03-23 21:59:08 +00:00
thread->set_state(Thread::State::Runnable);
Kernel: Make the create_thread() syscall return the new thread ID.
2019-07-14 08:17:58 +00:00
return thread->tid();
Kernel+LibC: Add a simple create_thread() syscall. It takes two parameters, a function pointer for the entry function, and a void* argument to be passed to that function on the new thread.
2019-03-23 21:59:08 +00:00
}
LibGUI+Kernel: Add a GLock class (userspace mutex.) It's basically a userspace port of the kernel's Lock class. Added gettid() and donate() syscalls to support the timeslice donation feature we already enjoyed in the kernel.
2019-03-25 12:03:49 +00:00
Kernel+LibPthread: Implement pthread_join() It's now possible to block until another thread in the same process has exited. We can also retrieve its exit value, which is whatever value it passed to pthread_exit(). :^)
2019-11-14 19:58:23 +00:00
void Process::sys$exit_thread(void* exit_value)
Kernel+LibC: Add exit_thread() syscall.
2019-04-29 13:17:20 +00:00
{
ping: Use pledge()
2020-01-11 19:48:43 +00:00
REQUIRE_PROMISE(thread);
Kernel: The exit_thread() syscall should unlock the big lock. Since exit_thread() never returns, it can't rely on the syscall trap handler to unlock the big lock before returning.
2019-04-29 13:56:25 +00:00
cli();
Kernel: Replace "current" with Thread::current and Process::current Suggested by Sergey. The currently running Thread and Process are now Thread::current and Process::current respectively. :^)
2020-02-17 14:04:27 +00:00
Thread::current->m_exit_value = exit_value;
Thread::current->set_should_die();
Kernel: Allow unlocking a held Lock with interrupts disabled This is needed to eliminate a race in Thread::wait_on() where we'd otherwise have to wait until after unlocking the process lock before we can disable interrupts.
2020-01-12 21:53:20 +00:00
big_lock().force_unlock_if_locked();
Kernel: Replace "current" with Thread::current and Process::current Suggested by Sergey. The currently running Thread and Process are now Thread::current and Process::current respectively. :^)
2020-02-17 14:04:27 +00:00
Thread::current->die_if_needed();
Kernel+LibC: Add exit_thread() syscall.
2019-04-29 13:17:20 +00:00
ASSERT_NOT_REACHED();
}
Kernel+LibPthread: Implement pthread_detach()
2019-12-07 13:47:00 +00:00
int Process::sys$detach_thread(int tid)
{
ping: Use pledge()
2020-01-11 19:48:43 +00:00
REQUIRE_PROMISE(thread);
Kernel: Disable interrupts while looking into the thread table There was a race window in a bunch of syscalls between calling Thread::from_tid() and checking if the found thread was in the same process as the calling thread. If the found thread object was destroyed at that point, there was a use-after-free that could be exploited by filling the kernel heap with something that looked like a thread object.
2020-01-27 12:48:54 +00:00
InterruptDisabler disabler;
Kernel: Use Thread::from_tid() in more places
2020-01-04 17:56:04 +00:00
auto* thread = Thread::from_tid(tid);
if (!thread || thread->pid() != pid())
Kernel+LibPthread: Implement pthread_detach()
2019-12-07 13:47:00 +00:00
return -ESRCH;
if (!thread->is_joinable())
return -EINVAL;
thread->set_joinable(false);
return 0;
}
Kernel+LibPthread: Implement pthread_join() It's now possible to block until another thread in the same process has exited. We can also retrieve its exit value, which is whatever value it passed to pthread_exit(). :^)
2019-11-14 19:58:23 +00:00
int Process::sys$join_thread(int tid, void** exit_value)
{
ping: Use pledge()
2020-01-11 19:48:43 +00:00
REQUIRE_PROMISE(thread);
Kernel+LibPthread: Implement pthread_join() It's now possible to block until another thread in the same process has exited. We can also retrieve its exit value, which is whatever value it passed to pthread_exit(). :^)
2019-11-14 19:58:23 +00:00
if (exit_value && !validate_write_typed(exit_value))
return -EFAULT;
Kernel: Disable interrupts while looking into the thread table There was a race window in a bunch of syscalls between calling Thread::from_tid() and checking if the found thread was in the same process as the calling thread. If the found thread object was destroyed at that point, there was a use-after-free that could be exploited by filling the kernel heap with something that looked like a thread object.
2020-01-27 12:48:54 +00:00
InterruptDisabler disabler;
Kernel: Use Thread::from_tid() in more places
2020-01-04 17:56:04 +00:00
auto* thread = Thread::from_tid(tid);
if (!thread || thread->pid() != pid())
Kernel+LibPthread: Implement pthread_join() It's now possible to block until another thread in the same process has exited. We can also retrieve its exit value, which is whatever value it passed to pthread_exit(). :^)
2019-11-14 19:58:23 +00:00
return -ESRCH;
Kernel: Replace "current" with Thread::current and Process::current Suggested by Sergey. The currently running Thread and Process are now Thread::current and Process::current respectively. :^)
2020-02-17 14:04:27 +00:00
if (thread == Thread::current)
Kernel+LibPthread: Implement pthread_join() It's now possible to block until another thread in the same process has exited. We can also retrieve its exit value, which is whatever value it passed to pthread_exit(). :^)
2019-11-14 19:58:23 +00:00
return -EDEADLK;
Kernel: Replace "current" with Thread::current and Process::current Suggested by Sergey. The currently running Thread and Process are now Thread::current and Process::current respectively. :^)
2020-02-17 14:04:27 +00:00
if (thread->m_joinee == Thread::current)
Kernel+LibPthread: Implement pthread_join() It's now possible to block until another thread in the same process has exited. We can also retrieve its exit value, which is whatever value it passed to pthread_exit(). :^)
2019-11-14 19:58:23 +00:00
return -EDEADLK;
Kernel: Replace "current" with Thread::current and Process::current Suggested by Sergey. The currently running Thread and Process are now Thread::current and Process::current respectively. :^)
2020-02-17 14:04:27 +00:00
ASSERT(thread->m_joiner != Thread::current);
Kernel+LibPthread: Implement pthread_join() It's now possible to block until another thread in the same process has exited. We can also retrieve its exit value, which is whatever value it passed to pthread_exit(). :^)
2019-11-14 19:58:23 +00:00
if (thread->m_joiner)
return -EINVAL;
Kernel+LibPthread: pthread_create handles pthread_attr_t Add an initial implementation of pthread attributes for: * detach state (joinable, detached) * schedule params (just priority) * guard page size (as skeleton) (requires kernel support maybe?) * stack size and user-provided stack location (4 or 8 MB only, must be aligned) Add some tests too, to the thread test program. Also, LibC: Move pthread declarations to sys/types.h, where they belong.
2019-11-18 03:08:10 +00:00
if (!thread->is_joinable())
return -EINVAL;
Kernel+LibPthread: Implement pthread_join() It's now possible to block until another thread in the same process has exited. We can also retrieve its exit value, which is whatever value it passed to pthread_exit(). :^)
2019-11-14 19:58:23 +00:00
Kernel: Move Thread::m_joinee_exit_value into the JoinBlocker There's no need for this to be a permanent Thread member. Just use a reference in the JoinBlocker instead.
2019-11-14 20:04:34 +00:00
void* joinee_exit_value = nullptr;
Kernel: Fix kernel null deref on process crash during join_thread() The join_thread() syscall is not supposed to be interruptible by signals, but it was. And since the process death mechanism piggybacked on signal interrupts, it was possible to interrupt a pthread_join() by killing the process that was doing it, leading to confusing due to some assumptions being made by Thread::finalize() for threads that have a pending joiner. This patch fixes the issue by making "interrupted by death" a distinct block result separate from "interrupted by signal". Then we handle that state in join_thread() and tidy things up so that thread finalization doesn't get confused by the pending joiner being gone. Test: Tests/Kernel/null-deref-crash-during-pthread_join.cpp
2020-01-10 18:15:01 +00:00
// NOTE: pthread_join() cannot be interrupted by signals. Only by death.
for (;;) {
Kernel: Replace "current" with Thread::current and Process::current Suggested by Sergey. The currently running Thread and Process are now Thread::current and Process::current respectively. :^)
2020-02-17 14:04:27 +00:00
auto result = Thread::current->block<Thread::JoinBlocker>(*thread, joinee_exit_value);
Kernel: Fix kernel null deref on process crash during join_thread() The join_thread() syscall is not supposed to be interruptible by signals, but it was. And since the process death mechanism piggybacked on signal interrupts, it was possible to interrupt a pthread_join() by killing the process that was doing it, leading to confusing due to some assumptions being made by Thread::finalize() for threads that have a pending joiner. This patch fixes the issue by making "interrupted by death" a distinct block result separate from "interrupted by signal". Then we handle that state in join_thread() and tidy things up so that thread finalization doesn't get confused by the pending joiner being gone. Test: Tests/Kernel/null-deref-crash-during-pthread_join.cpp
2020-01-10 18:15:01 +00:00
if (result == Thread::BlockResult::InterruptedByDeath) {
// NOTE: This cleans things up so that Thread::finalize() won't
// get confused about a missing joiner when finalizing the joinee.
Kernel: Fix ASSERTION failed in join_thread syscall set_interrupted_by_death was never called whenever a thread that had a joiner died, so the joiner remained with the joinee pointer there, resulting in an assertion fail in JoinBlocker: m_joinee pointed to a freed task, filled with garbage. Thread::current->m_joinee may not be valid after the unblock Properly return the joinee exit value to the joiner thread.
2020-02-27 06:40:40 +00:00
InterruptDisabler disabler_t;
if (Thread::current->m_joinee) {
Thread::current->m_joinee->m_joiner = nullptr;
Thread::current->m_joinee = nullptr;
}
break;
Kernel: Fix kernel null deref on process crash during join_thread() The join_thread() syscall is not supposed to be interruptible by signals, but it was. And since the process death mechanism piggybacked on signal interrupts, it was possible to interrupt a pthread_join() by killing the process that was doing it, leading to confusing due to some assumptions being made by Thread::finalize() for threads that have a pending joiner. This patch fixes the issue by making "interrupted by death" a distinct block result separate from "interrupted by signal". Then we handle that state in join_thread() and tidy things up so that thread finalization doesn't get confused by the pending joiner being gone. Test: Tests/Kernel/null-deref-crash-during-pthread_join.cpp
2020-01-10 18:15:01 +00:00
}
}
Kernel+LibPthread: Implement pthread_join() It's now possible to block until another thread in the same process has exited. We can also retrieve its exit value, which is whatever value it passed to pthread_exit(). :^)
2019-11-14 19:58:23 +00:00
// NOTE: 'thread' is very possibly deleted at this point. Clear it just to be safe.
thread = nullptr;
if (exit_value)
Kernel: Use the templated copy_to/from_user() in more places These ensure that the "to" and "from" pointers have the same type, and also that we copy the correct number of bytes.
2020-01-20 12:38:31 +00:00
copy_to_user(exit_value, &joinee_exit_value);
Kernel+LibPthread: Implement pthread_join() It's now possible to block until another thread in the same process has exited. We can also retrieve its exit value, which is whatever value it passed to pthread_exit(). :^)
2019-11-14 19:58:23 +00:00
return 0;
}
Kernel: Use the Syscall string and buffer types more While I was updating syscalls to stop passing null-terminated strings, I added some helpful struct types: - StringArgument { const char*; size_t; } - ImmutableBuffer<Data, Size> { const Data*; Size; } - MutableBuffer<Data, Size> { Data*; Size; } The Process class has some convenience functions for validating and optionally extracting the contents from these structs: - get_syscall_path_argument(StringArgument) - validate_and_copy_string_from_user(StringArgument) - validate(ImmutableBuffer) - validate(MutableBuffer) There's still so much code around this and I'm wondering if we should generate most of it instead. Possible nice little project.
2020-01-11 11:47:47 +00:00
int Process::sys$set_thread_name(int tid, const char* user_name, size_t user_name_length)
Kernel: Allow setting thread names The main thread of each kernel/user process will take the name of the process. Extra threads will get a fancy new name "ProcessName[<tid>]". Thread backtraces now list the thread name in addtion to tid. Add the thread name to /proc/all (should it get its own proc file?). Add two new syscalls, set_thread_name and get_thread_name.
2019-12-07 19:45:26 +00:00
{
ping: Use pledge()
2020-01-11 19:48:43 +00:00
REQUIRE_PROMISE(thread);
Kernel: Use the Syscall string and buffer types more While I was updating syscalls to stop passing null-terminated strings, I added some helpful struct types: - StringArgument { const char*; size_t; } - ImmutableBuffer<Data, Size> { const Data*; Size; } - MutableBuffer<Data, Size> { Data*; Size; } The Process class has some convenience functions for validating and optionally extracting the contents from these structs: - get_syscall_path_argument(StringArgument) - validate_and_copy_string_from_user(StringArgument) - validate(ImmutableBuffer) - validate(MutableBuffer) There's still so much code around this and I'm wondering if we should generate most of it instead. Possible nice little project.
2020-01-11 11:47:47 +00:00
auto name = validate_and_copy_string_from_user(user_name, user_name_length);
if (name.is_null())
Kernel: Allow setting thread names The main thread of each kernel/user process will take the name of the process. Extra threads will get a fancy new name "ProcessName[<tid>]". Thread backtraces now list the thread name in addtion to tid. Add the thread name to /proc/all (should it get its own proc file?). Add two new syscalls, set_thread_name and get_thread_name.
2019-12-07 19:45:26 +00:00
return -EFAULT;
const size_t max_thread_name_size = 64;
Kernel: Remove SmapDisablers in open(), openat() and set_thread_name() This patch introduces a helpful copy_string_from_user() function that takes a bounded null-terminated string from userspace memory and copies it into a String object.
2020-01-05 20:51:06 +00:00
if (name.length() > max_thread_name_size)
Kernel: Allow setting thread names The main thread of each kernel/user process will take the name of the process. Extra threads will get a fancy new name "ProcessName[<tid>]". Thread backtraces now list the thread name in addtion to tid. Add the thread name to /proc/all (should it get its own proc file?). Add two new syscalls, set_thread_name and get_thread_name.
2019-12-07 19:45:26 +00:00
return -EINVAL;
Kernel: Disable interrupts while looking into the thread table There was a race window in a bunch of syscalls between calling Thread::from_tid() and checking if the found thread was in the same process as the calling thread. If the found thread object was destroyed at that point, there was a use-after-free that could be exploited by filling the kernel heap with something that looked like a thread object.
2020-01-27 12:48:54 +00:00
InterruptDisabler disabler;
Kernel: Use Thread::from_tid() in more places
2020-01-04 17:56:04 +00:00
auto* thread = Thread::from_tid(tid);
if (!thread || thread->pid() != pid())
Kernel: Allow setting thread names The main thread of each kernel/user process will take the name of the process. Extra threads will get a fancy new name "ProcessName[<tid>]". Thread backtraces now list the thread name in addtion to tid. Add the thread name to /proc/all (should it get its own proc file?). Add two new syscalls, set_thread_name and get_thread_name.
2019-12-07 19:45:26 +00:00
return -ESRCH;
Kernel: Remove SmapDisablers in open(), openat() and set_thread_name() This patch introduces a helpful copy_string_from_user() function that takes a bounded null-terminated string from userspace memory and copies it into a String object.
2020-01-05 20:51:06 +00:00
thread->set_name(name);
Kernel: Allow setting thread names The main thread of each kernel/user process will take the name of the process. Extra threads will get a fancy new name "ProcessName[<tid>]". Thread backtraces now list the thread name in addtion to tid. Add the thread name to /proc/all (should it get its own proc file?). Add two new syscalls, set_thread_name and get_thread_name.
2019-12-07 19:45:26 +00:00
return 0;
}
Kernel: Use the Syscall string and buffer types more While I was updating syscalls to stop passing null-terminated strings, I added some helpful struct types: - StringArgument { const char*; size_t; } - ImmutableBuffer<Data, Size> { const Data*; Size; } - MutableBuffer<Data, Size> { Data*; Size; } The Process class has some convenience functions for validating and optionally extracting the contents from these structs: - get_syscall_path_argument(StringArgument) - validate_and_copy_string_from_user(StringArgument) - validate(ImmutableBuffer) - validate(MutableBuffer) There's still so much code around this and I'm wondering if we should generate most of it instead. Possible nice little project.
2020-01-11 11:47:47 +00:00
int Process::sys$get_thread_name(int tid, char* buffer, size_t buffer_size)
Kernel: Allow setting thread names The main thread of each kernel/user process will take the name of the process. Extra threads will get a fancy new name "ProcessName[<tid>]". Thread backtraces now list the thread name in addtion to tid. Add the thread name to /proc/all (should it get its own proc file?). Add two new syscalls, set_thread_name and get_thread_name.
2019-12-07 19:45:26 +00:00
{
ping: Use pledge()
2020-01-11 19:48:43 +00:00
REQUIRE_PROMISE(thread);
Kernel: Use the Syscall string and buffer types more While I was updating syscalls to stop passing null-terminated strings, I added some helpful struct types: - StringArgument { const char*; size_t; } - ImmutableBuffer<Data, Size> { const Data*; Size; } - MutableBuffer<Data, Size> { Data*; Size; } The Process class has some convenience functions for validating and optionally extracting the contents from these structs: - get_syscall_path_argument(StringArgument) - validate_and_copy_string_from_user(StringArgument) - validate(ImmutableBuffer) - validate(MutableBuffer) There's still so much code around this and I'm wondering if we should generate most of it instead. Possible nice little project.
2020-01-11 11:47:47 +00:00
if (buffer_size == 0)
Kernel: Allow setting thread names The main thread of each kernel/user process will take the name of the process. Extra threads will get a fancy new name "ProcessName[<tid>]". Thread backtraces now list the thread name in addtion to tid. Add the thread name to /proc/all (should it get its own proc file?). Add two new syscalls, set_thread_name and get_thread_name.
2019-12-07 19:45:26 +00:00
return -EINVAL;
if (!validate_write(buffer, buffer_size))
return -EFAULT;
Kernel: Disable interrupts while looking into the thread table There was a race window in a bunch of syscalls between calling Thread::from_tid() and checking if the found thread was in the same process as the calling thread. If the found thread object was destroyed at that point, there was a use-after-free that could be exploited by filling the kernel heap with something that looked like a thread object.
2020-01-27 12:48:54 +00:00
InterruptDisabler disabler;
Kernel: Use Thread::from_tid() in more places
2020-01-04 17:56:04 +00:00
auto* thread = Thread::from_tid(tid);
if (!thread || thread->pid() != pid())
Kernel: Allow setting thread names The main thread of each kernel/user process will take the name of the process. Extra threads will get a fancy new name "ProcessName[<tid>]". Thread backtraces now list the thread name in addtion to tid. Add the thread name to /proc/all (should it get its own proc file?). Add two new syscalls, set_thread_name and get_thread_name.
2019-12-07 19:45:26 +00:00
return -ESRCH;
Kernel: Start implementing x86 SMAP support Supervisor Mode Access Prevention (SMAP) is an x86 CPU feature that prevents the kernel from accessing userspace memory. With SMAP enabled, trying to read/write a userspace memory address while in the kernel will now generate a page fault. Since it's sometimes necessary to read/write userspace memory, there are two new instructions that quickly switch the protection on/off: STAC (disables protection) and CLAC (enables protection.) These are exposed in kernel code via the stac() and clac() helpers. There's also a SmapDisabler RAII object that can be used to ensure that you don't forget to re-enable protection before returning to userspace code. THis patch also adds copy_to_user(), copy_from_user() and memset_user() which are the "correct" way of doing things. These functions allow us to briefly disable protection for a specific purpose, and then turn it back on immediately after it's done. Going forward all kernel code should be moved to using these and all uses of SmapDisabler are to be considered FIXME's. Note that we're not realizing the full potential of this feature since I've used SmapDisabler quite liberally in this initial bring-up patch.
2020-01-05 17:00:15 +00:00
if (thread->name().length() + 1 > (size_t)buffer_size)
Kernel: Allow setting thread names The main thread of each kernel/user process will take the name of the process. Extra threads will get a fancy new name "ProcessName[<tid>]". Thread backtraces now list the thread name in addtion to tid. Add the thread name to /proc/all (should it get its own proc file?). Add two new syscalls, set_thread_name and get_thread_name.
2019-12-07 19:45:26 +00:00
return -ENAMETOOLONG;
Kernel: Start implementing x86 SMAP support Supervisor Mode Access Prevention (SMAP) is an x86 CPU feature that prevents the kernel from accessing userspace memory. With SMAP enabled, trying to read/write a userspace memory address while in the kernel will now generate a page fault. Since it's sometimes necessary to read/write userspace memory, there are two new instructions that quickly switch the protection on/off: STAC (disables protection) and CLAC (enables protection.) These are exposed in kernel code via the stac() and clac() helpers. There's also a SmapDisabler RAII object that can be used to ensure that you don't forget to re-enable protection before returning to userspace code. THis patch also adds copy_to_user(), copy_from_user() and memset_user() which are the "correct" way of doing things. These functions allow us to briefly disable protection for a specific purpose, and then turn it back on immediately after it's done. Going forward all kernel code should be moved to using these and all uses of SmapDisabler are to be considered FIXME's. Note that we're not realizing the full potential of this feature since I've used SmapDisabler quite liberally in this initial bring-up patch.
2020-01-05 17:00:15 +00:00
copy_to_user(buffer, thread->name().characters(), thread->name().length() + 1);
Kernel: Allow setting thread names The main thread of each kernel/user process will take the name of the process. Extra threads will get a fancy new name "ProcessName[<tid>]". Thread backtraces now list the thread name in addtion to tid. Add the thread name to /proc/all (should it get its own proc file?). Add two new syscalls, set_thread_name and get_thread_name.
2019-12-07 19:45:26 +00:00
return 0;
}
LibGUI+Kernel: Add a GLock class (userspace mutex.) It's basically a userspace port of the kernel's Lock class. Added gettid() and donate() syscalls to support the timeslice donation feature we already enjoyed in the kernel.
2019-03-25 12:03:49 +00:00
int Process::sys$gettid()
{
ping: Use pledge()
2020-01-11 19:48:43 +00:00
REQUIRE_PROMISE(stdio);
Kernel: Replace "current" with Thread::current and Process::current Suggested by Sergey. The currently running Thread and Process are now Thread::current and Process::current respectively. :^)
2020-02-17 14:04:27 +00:00
return Thread::current->tid();
LibGUI+Kernel: Add a GLock class (userspace mutex.) It's basically a userspace port of the kernel's Lock class. Added gettid() and donate() syscalls to support the timeslice donation feature we already enjoyed in the kernel.
2019-03-25 12:03:49 +00:00
}
int Process::sys$donate(int tid)
{
ping: Use pledge()
2020-01-11 19:48:43 +00:00
REQUIRE_PROMISE(stdio);
LibGUI+Kernel: Add a GLock class (userspace mutex.) It's basically a userspace port of the kernel's Lock class. Added gettid() and donate() syscalls to support the timeslice donation feature we already enjoyed in the kernel.
2019-03-25 12:03:49 +00:00
if (tid < 0)
return -EINVAL;
InterruptDisabler disabler;
Kernel: Use Thread::from_tid() in more places
2020-01-04 17:56:04 +00:00
auto* thread = Thread::from_tid(tid);
if (!thread || thread->pid() != pid())
return -ESRCH;
Scheduler::donate_to(thread, "sys$donate");
LibGUI+Kernel: Add a GLock class (userspace mutex.) It's basically a userspace port of the kernel's Lock class. Added gettid() and donate() syscalls to support the timeslice donation feature we already enjoyed in the kernel.
2019-03-25 12:03:49 +00:00
return 0;
}
Kernel+Userland: Add the rename() syscall along with a basic /bin/mv.
2019-04-07 21:35:26 +00:00
Kernel: Pass a parameter struct to rename()
2020-01-11 09:36:54 +00:00
int Process::sys$rename(const Syscall::SC_rename_params* user_params)
Kernel+Userland: Add the rename() syscall along with a basic /bin/mv.
2019-04-07 21:35:26 +00:00
{
ping: Use pledge()
2020-01-11 19:48:43 +00:00
REQUIRE_PROMISE(cpath);
Kernel: Pass a parameter struct to rename()
2020-01-11 09:36:54 +00:00
Syscall::SC_rename_params params;
Kernel: Combine validate and copy of user mode pointers (#1069) Right now there is a significant amount of boiler plate code required to validate user mode parameters in syscalls. In an attempt to reduce this a bit, introduce validate_read_and_copy_typed which combines the usermode address check and does the copy internally if the validation passes. This cleans up a little bit of code from a significant amount of syscalls.
2020-01-13 10:19:18 +00:00
if (!validate_read_and_copy_typed(&params, user_params))
return -EFAULT;
Kernel: Use the Syscall string and buffer types more While I was updating syscalls to stop passing null-terminated strings, I added some helpful struct types: - StringArgument { const char*; size_t; } - ImmutableBuffer<Data, Size> { const Data*; Size; } - MutableBuffer<Data, Size> { Data*; Size; } The Process class has some convenience functions for validating and optionally extracting the contents from these structs: - get_syscall_path_argument(StringArgument) - validate_and_copy_string_from_user(StringArgument) - validate(ImmutableBuffer) - validate(MutableBuffer) There's still so much code around this and I'm wondering if we should generate most of it instead. Possible nice little project.
2020-01-11 11:47:47 +00:00
auto old_path = get_syscall_path_argument(params.old_path);
Kernel: Pass a parameter struct to rename()
2020-01-11 09:36:54 +00:00
if (old_path.is_error())
return old_path.error();
Kernel: Use the Syscall string and buffer types more While I was updating syscalls to stop passing null-terminated strings, I added some helpful struct types: - StringArgument { const char*; size_t; } - ImmutableBuffer<Data, Size> { const Data*; Size; } - MutableBuffer<Data, Size> { Data*; Size; } The Process class has some convenience functions for validating and optionally extracting the contents from these structs: - get_syscall_path_argument(StringArgument) - validate_and_copy_string_from_user(StringArgument) - validate(ImmutableBuffer) - validate(MutableBuffer) There's still so much code around this and I'm wondering if we should generate most of it instead. Possible nice little project.
2020-01-11 11:47:47 +00:00
auto new_path = get_syscall_path_argument(params.new_path);
Kernel: Pass a parameter struct to rename()
2020-01-11 09:36:54 +00:00
if (new_path.is_error())
return new_path.error();
return VFS::the().rename(old_path.value(), new_path.value(), current_directory());
Kernel+Userland: Add the rename() syscall along with a basic /bin/mv.
2019-04-07 21:35:26 +00:00
}
Kernel+LibC: Add stubs for POSIX shared memory API. Specifically shm_open() and shm_unlink(). This patch just adds stubs.
2019-04-08 21:44:12 +00:00
Kernel: More work towards POSIX SHM, also add ftruncate().
2019-04-08 23:10:00 +00:00
int Process::sys$ftruncate(int fd, off_t length)
{
ping: Use pledge()
2020-01-11 19:48:43 +00:00
REQUIRE_PROMISE(stdio);
Kernel: Validate ftruncate(fd, length) syscall inputs - EINVAL if 'length' is negative - EBADF if 'fd' is not open for writing
2020-01-07 13:42:56 +00:00
if (length < 0)
return -EINVAL;
Kernel: Make Process::file_description() vend a RefPtr<FileDescription> This encourages callers to strongly reference file descriptions while working with them. This fixes a use-after-free issue where one thread would close() an open fd while another thread was blocked on it becoming readable. Test: Kernel/uaf-close-while-blocked-in-read.cpp
2020-01-07 14:53:42 +00:00
auto description = file_description(fd);
Kernel: Rename "descriptor" to "description" where appropriate. Now that FileDescription is called that, variables of that type should not be called "descriptor". This is kinda wordy but we'll get used to it.
2019-06-13 20:03:04 +00:00
if (!description)
Kernel: More work towards POSIX SHM, also add ftruncate().
2019-04-08 23:10:00 +00:00
return -EBADF;
Kernel: Validate ftruncate(fd, length) syscall inputs - EINVAL if 'length' is negative - EBADF if 'fd' is not open for writing
2020-01-07 13:42:56 +00:00
if (!description->is_writable())
return -EBADF;
Kernel: Make File::truncate() take a u64 No point in taking a signed type here. We validate at the syscall layer and then pass around a u64 from then on.
2020-02-08 11:07:04 +00:00
return description->truncate(static_cast<u64>(length));
Kernel: More work towards POSIX SHM, also add ftruncate().
2019-04-08 23:10:00 +00:00
}
Kernel: Add a systrace() syscall and implement /bin/strace using it. Calling systrace(pid) gives you a file descriptor with a stream of the syscalls made by a peer process. The process must be owned by the same UID who calls systrace(). :^)
2019-04-22 16:44:45 +00:00
Kernel: Make watch_file() syscall take path length as a size_t We don't care to handle negative path lengths anyway.
2020-01-06 10:12:29 +00:00
int Process::sys$watch_file(const char* user_path, size_t path_length)
Kernel: Add a mechanism for listening for changes to an inode. The syscall is quite simple: int watch_file(const char* path, int path_length); It returns a file descriptor referring to a "InodeWatcher" object in the kernel. It becomes readable whenever something changes about the inode. Currently this is implemented by hooking the "metadata dirty bit" in Inode which isn't perfect, but it's a start. :^)
2019-07-22 18:01:11 +00:00
{
ping: Use pledge()
2020-01-11 19:48:43 +00:00
REQUIRE_PROMISE(rpath);
Kernel: Use get_syscall_path_argument() for syscalls that take paths
2020-01-06 10:10:38 +00:00
auto path = get_syscall_path_argument(user_path, path_length);
if (path.is_error())
return path.error();
Kernel: Start implementing x86 SMAP support Supervisor Mode Access Prevention (SMAP) is an x86 CPU feature that prevents the kernel from accessing userspace memory. With SMAP enabled, trying to read/write a userspace memory address while in the kernel will now generate a page fault. Since it's sometimes necessary to read/write userspace memory, there are two new instructions that quickly switch the protection on/off: STAC (disables protection) and CLAC (enables protection.) These are exposed in kernel code via the stac() and clac() helpers. There's also a SmapDisabler RAII object that can be used to ensure that you don't forget to re-enable protection before returning to userspace code. THis patch also adds copy_to_user(), copy_from_user() and memset_user() which are the "correct" way of doing things. These functions allow us to briefly disable protection for a specific purpose, and then turn it back on immediately after it's done. Going forward all kernel code should be moved to using these and all uses of SmapDisabler are to be considered FIXME's. Note that we're not realizing the full potential of this feature since I've used SmapDisabler quite liberally in this initial bring-up patch.
2020-01-05 17:00:15 +00:00
Kernel: Use get_syscall_path_argument() for syscalls that take paths
2020-01-06 10:10:38 +00:00
auto custody_or_error = VFS::the().resolve_path(path.value(), current_directory());
Kernel: Add a mechanism for listening for changes to an inode. The syscall is quite simple: int watch_file(const char* path, int path_length); It returns a file descriptor referring to a "InodeWatcher" object in the kernel. It becomes readable whenever something changes about the inode. Currently this is implemented by hooking the "metadata dirty bit" in Inode which isn't perfect, but it's a start. :^)
2019-07-22 18:01:11 +00:00
if (custody_or_error.is_error())
return custody_or_error.error();
auto& custody = custody_or_error.value();
auto& inode = custody->inode();
Kernel+FileManager: Disallow watch_file() in unsupported file systems Currently only Ext2FS and TmpFS supports InodeWatchers. We now fail with ENOTSUPP if watch_file() is called on e.g ProcFS. This fixes an issue with FileManager chewing up all the CPU when /proc was opened. Watchers don't keep the watched Inode open, and when they close, the watcher FD will EOF. Since nothing else kept /proc open in FileManager, the watchers created for it would EOF immediately, causing a refresh over and over. Fixes #879.
2019-12-15 18:33:39 +00:00
if (!inode.fs().supports_watchers())
return -ENOTSUP;
Kernel: Add a mechanism for listening for changes to an inode. The syscall is quite simple: int watch_file(const char* path, int path_length); It returns a file descriptor referring to a "InodeWatcher" object in the kernel. It becomes readable whenever something changes about the inode. Currently this is implemented by hooking the "metadata dirty bit" in Inode which isn't perfect, but it's a start. :^)
2019-07-22 18:01:11 +00:00
int fd = alloc_fd();
if (fd < 0)
return fd;
m_fds[fd].set(FileDescription::create(*InodeWatcher::create(inode)));
Kernel: read() and write() should fail with EBADF for wrong mode fd's It was previously possible to write to read-only file descriptors, and read from write-only file descriptors. All FileDescription objects now start out non-readable + non-writable, and whoever is creating them has to "manually" enable reading/writing by calling set_readable() and/or set_writable() on them.
2020-01-03 02:29:59 +00:00
m_fds[fd].description->set_readable(true);
Kernel: Add a mechanism for listening for changes to an inode. The syscall is quite simple: int watch_file(const char* path, int path_length); It returns a file descriptor referring to a "InodeWatcher" object in the kernel. It becomes readable whenever something changes about the inode. Currently this is implemented by hooking the "metadata dirty bit" in Inode which isn't perfect, but it's a start. :^)
2019-07-22 18:01:11 +00:00
return fd;
}
Kernel: Only allow superuser to halt() the system (#342) Following the discussion in #334, shutdown must also have root-only run permissions.
2019-07-19 11:08:26 +00:00
int Process::sys$halt()
{
if (!is_superuser())
return -EPERM;
ping: Use pledge()
2020-01-11 19:48:43 +00:00
REQUIRE_NO_PROMISES;
Process: Use dbg() instead of dbgprintf() Also, fix a bad derefernce in sys$create_shared_buffer() method.
2020-02-24 22:13:33 +00:00
dbg() << "acquiring FS locks...";
Kernel: Only allow superuser to halt() the system (#342) Following the discussion in #334, shutdown must also have root-only run permissions.
2019-07-19 11:08:26 +00:00
FS::lock_all();
Process: Use dbg() instead of dbgprintf() Also, fix a bad derefernce in sys$create_shared_buffer() method.
2020-02-24 22:13:33 +00:00
dbg() << "syncing mounted filesystems...";
Kernel: Only allow superuser to halt() the system (#342) Following the discussion in #334, shutdown must also have root-only run permissions.
2019-07-19 11:08:26 +00:00
FS::sync();
Process: Use dbg() instead of dbgprintf() Also, fix a bad derefernce in sys$create_shared_buffer() method.
2020-02-24 22:13:33 +00:00
dbg() << "attempting system shutdown...";
Kernel: Only allow superuser to halt() the system (#342) Following the discussion in #334, shutdown must also have root-only run permissions.
2019-07-19 11:08:26 +00:00
IO::out16(0x604, 0x2000);
Kernel+LibC: Remove ESUCCESS There's no official ESUCCESS==0 errno code, and it keeps breaking the Lagom build when we use it, so let's just say 0 instead.
2020-04-10 10:58:27 +00:00
return 0;
Kernel: Only allow superuser to halt() the system (#342) Following the discussion in #334, shutdown must also have root-only run permissions.
2019-07-19 11:08:26 +00:00
}
Kernel+Userland: Addd reboot syscall (#334) Rolling with the theme of adding a dialog to shutdown the machine, it is probably nice to have a way to reboot the machine without performing a full system powerdown. A reboot program has been added to `/bin/` as well as a corresponding `syscall` (SC_reboot). This syscall works by attempting to pulse the 8042 keyboard controller. Note that this is NOT supported on new machines, and should only be a fallback until we have proper ACPI support. The implementation causes a triple fault in QEMU, which then restarts the system. The filesystems are locked and synchronized before this occurs, so there shouldn't be any corruption etctera.
2019-07-19 07:58:12 +00:00
int Process::sys$reboot()
{
if (!is_superuser())
return -EPERM;
ping: Use pledge()
2020-01-11 19:48:43 +00:00
REQUIRE_NO_PROMISES;
Process: Use dbg() instead of dbgprintf() Also, fix a bad derefernce in sys$create_shared_buffer() method.
2020-02-24 22:13:33 +00:00
dbg() << "acquiring FS locks...";
Kernel+Userland: Addd reboot syscall (#334) Rolling with the theme of adding a dialog to shutdown the machine, it is probably nice to have a way to reboot the machine without performing a full system powerdown. A reboot program has been added to `/bin/` as well as a corresponding `syscall` (SC_reboot). This syscall works by attempting to pulse the 8042 keyboard controller. Note that this is NOT supported on new machines, and should only be a fallback until we have proper ACPI support. The implementation causes a triple fault in QEMU, which then restarts the system. The filesystems are locked and synchronized before this occurs, so there shouldn't be any corruption etctera.
2019-07-19 07:58:12 +00:00
FS::lock_all();
Process: Use dbg() instead of dbgprintf() Also, fix a bad derefernce in sys$create_shared_buffer() method.
2020-02-24 22:13:33 +00:00
dbg() << "syncing mounted filesystems...";
Kernel+Userland: Addd reboot syscall (#334) Rolling with the theme of adding a dialog to shutdown the machine, it is probably nice to have a way to reboot the machine without performing a full system powerdown. A reboot program has been added to `/bin/` as well as a corresponding `syscall` (SC_reboot). This syscall works by attempting to pulse the 8042 keyboard controller. Note that this is NOT supported on new machines, and should only be a fallback until we have proper ACPI support. The implementation causes a triple fault in QEMU, which then restarts the system. The filesystems are locked and synchronized before this occurs, so there shouldn't be any corruption etctera.
2019-07-19 07:58:12 +00:00
FS::sync();
Kernel: Allow to reboot in ACPI via PCI or MMIO access Also, we determine if ACPI reboot is supported by checking the FADT flags' field.
2020-03-08 14:50:46 +00:00
dbg() << "attempting reboot via ACPI";
Kernel: Remove "non-operational" ACPI parser state If we don't support ACPI, just don't instantiate an ACPI parser. This is way less confusing than having a special parser class whose only purpose is to do nothing. We now search for the RSDP in ACPI::initialize() instead of letting the parser constructor do it. This allows us to defer the decision to create a parser until we're sure we can make a useful one.
2020-04-09 12:31:47 +00:00
if (ACPI::is_enabled())
ACPI::Parser::the()->try_acpi_reboot();
Process: Use dbg() instead of dbgprintf() Also, fix a bad derefernce in sys$create_shared_buffer() method.
2020-02-24 22:13:33 +00:00
dbg() << "attempting reboot via KB Controller...";
Kernel+Userland: Addd reboot syscall (#334) Rolling with the theme of adding a dialog to shutdown the machine, it is probably nice to have a way to reboot the machine without performing a full system powerdown. A reboot program has been added to `/bin/` as well as a corresponding `syscall` (SC_reboot). This syscall works by attempting to pulse the 8042 keyboard controller. Note that this is NOT supported on new machines, and should only be a fallback until we have proper ACPI support. The implementation causes a triple fault in QEMU, which then restarts the system. The filesystems are locked and synchronized before this occurs, so there shouldn't be any corruption etctera.
2019-07-19 07:58:12 +00:00
IO::out8(0x64, 0xFE);
Kernel+LibC: Remove ESUCCESS There's no official ESUCCESS==0 errno code, and it keeps breaking the Lagom build when we use it, so let's just say 0 instead.
2020-04-10 10:58:27 +00:00
return 0;
Kernel+Userland: Addd reboot syscall (#334) Rolling with the theme of adding a dialog to shutdown the machine, it is probably nice to have a way to reboot the machine without performing a full system powerdown. A reboot program has been added to `/bin/` as well as a corresponding `syscall` (SC_reboot). This syscall works by attempting to pulse the 8042 keyboard controller. Note that this is NOT supported on new machines, and should only be a fallback until we have proper ACPI support. The implementation causes a triple fault in QEMU, which then restarts the system. The filesystems are locked and synchronized before this occurs, so there shouldn't be any corruption etctera.
2019-07-19 07:58:12 +00:00
}
Kernel: Pass a parameter struct to mount() This was the last remaining syscall that took a null-terminated string and figured out how long it was by walking it in kernelspace *shudder*.
2020-01-11 09:46:21 +00:00
int Process::sys$mount(const Syscall::SC_mount_params* user_params)
Kernel: mount system call (#396) It is now possible to mount ext2 `DiskDevice` devices under Serenity on any folder in the root filesystem. Currently any user can do this with any permissions. There's a fair amount of assumptions made here too, that might not be too good, but can be worked on in the future. This is a good start to allow more dynamic operation under the OS itself. It is also currently impossible to unmount and such, and devices will fail to mount in Linux as the FS 'needs to be cleaned'. I'll work on getting `umount` done ASAP to rectify this (as well as working on less assumption-making in the mount syscall. We don't want to just be able to mount DiskDevices!). This could probably be fixed with some `-t` flag or something similar.
2019-08-02 13:18:47 +00:00
{
Kernel: Some improvements to the mount syscall - You must now have superuser privileges to use mount(). - We now verify that the mount point is a valid path first, before trying to find a filesystem on the specified device. - Convert some dbgprintf() to dbg().
2019-08-02 17:03:50 +00:00
if (!is_superuser())
return -EPERM;
ping: Use pledge()
2020-01-11 19:48:43 +00:00
REQUIRE_NO_PROMISES;
Kernel: Pass a parameter struct to mount() This was the last remaining syscall that took a null-terminated string and figured out how long it was by walking it in kernelspace *shudder*.
2020-01-11 09:46:21 +00:00
Syscall::SC_mount_params params;
Kernel: Combine validate and copy of user mode pointers (#1069) Right now there is a significant amount of boiler plate code required to validate user mode parameters in syscalls. In an attempt to reduce this a bit, introduce validate_read_and_copy_typed which combines the usermode address check and does the copy internally if the validation passes. This cleans up a little bit of code from a significant amount of syscalls.
2020-01-13 10:19:18 +00:00
if (!validate_read_and_copy_typed(&params, user_params))
return -EFAULT;
Kernel: Start implementing x86 SMAP support Supervisor Mode Access Prevention (SMAP) is an x86 CPU feature that prevents the kernel from accessing userspace memory. With SMAP enabled, trying to read/write a userspace memory address while in the kernel will now generate a page fault. Since it's sometimes necessary to read/write userspace memory, there are two new instructions that quickly switch the protection on/off: STAC (disables protection) and CLAC (enables protection.) These are exposed in kernel code via the stac() and clac() helpers. There's also a SmapDisabler RAII object that can be used to ensure that you don't forget to re-enable protection before returning to userspace code. THis patch also adds copy_to_user(), copy_from_user() and memset_user() which are the "correct" way of doing things. These functions allow us to briefly disable protection for a specific purpose, and then turn it back on immediately after it's done. Going forward all kernel code should be moved to using these and all uses of SmapDisabler are to be considered FIXME's. Note that we're not realizing the full potential of this feature since I've used SmapDisabler quite liberally in this initial bring-up patch.
2020-01-05 17:00:15 +00:00
Kernel & Userland: Allow to mount image files formatted with Ext2FS
2020-04-06 08:55:08 +00:00
auto source_fd = params.source_fd;
Kernel: Pass a parameter struct to mount() This was the last remaining syscall that took a null-terminated string and figured out how long it was by walking it in kernelspace *shudder*.
2020-01-11 09:46:21 +00:00
auto target = validate_and_copy_string_from_user(params.target);
auto fs_type = validate_and_copy_string_from_user(params.fs_type);
Kernel & Userland: Allow to mount image files formatted with Ext2FS
2020-04-06 08:55:08 +00:00
if (target.is_null() || fs_type.is_null())
Kernel: mount system call (#396) It is now possible to mount ext2 `DiskDevice` devices under Serenity on any folder in the root filesystem. Currently any user can do this with any permissions. There's a fair amount of assumptions made here too, that might not be too good, but can be worked on in the future. This is a good start to allow more dynamic operation under the OS itself. It is also currently impossible to unmount and such, and devices will fail to mount in Linux as the FS 'needs to be cleaned'. I'll work on getting `umount` done ASAP to rectify this (as well as working on less assumption-making in the mount syscall. We don't want to just be able to mount DiskDevices!). This could probably be fixed with some `-t` flag or something similar.
2019-08-02 13:18:47 +00:00
return -EFAULT;
Kernel & Userland: Allow to mount image files formatted with Ext2FS
2020-04-06 08:55:08 +00:00
auto description = file_description(source_fd);
if (!description.is_null())
dbg() << "mount " << fs_type << ": source fd " << source_fd << " @ " << target;
else
dbg() << "mount " << fs_type << " @ " << target;
Kernel: Some improvements to the mount syscall - You must now have superuser privileges to use mount(). - We now verify that the mount point is a valid path first, before trying to find a filesystem on the specified device. - Convert some dbgprintf() to dbg().
2019-08-02 17:03:50 +00:00
Kernel: Pass a parameter struct to mount() This was the last remaining syscall that took a null-terminated string and figured out how long it was by walking it in kernelspace *shudder*.
2020-01-11 09:46:21 +00:00
auto custody_or_error = VFS::the().resolve_path(target, current_directory());
Kernel: Some improvements to the mount syscall - You must now have superuser privileges to use mount(). - We now verify that the mount point is a valid path first, before trying to find a filesystem on the specified device. - Convert some dbgprintf() to dbg().
2019-08-02 17:03:50 +00:00
if (custody_or_error.is_error())
return custody_or_error.error();
Kernel: Pass a parameter struct to mount() This was the last remaining syscall that took a null-terminated string and figured out how long it was by walking it in kernelspace *shudder*.
2020-01-11 09:46:21 +00:00
auto& target_custody = custody_or_error.value();
Kernel: Some improvements to the mount syscall - You must now have superuser privileges to use mount(). - We now verify that the mount point is a valid path first, before trying to find a filesystem on the specified device. - Convert some dbgprintf() to dbg().
2019-08-02 17:03:50 +00:00
Kernel: Pass a parameter struct to mount() This was the last remaining syscall that took a null-terminated string and figured out how long it was by walking it in kernelspace *shudder*.
2020-01-11 09:46:21 +00:00
RefPtr<FS> fs;
Kernel: mount system call (#396) It is now possible to mount ext2 `DiskDevice` devices under Serenity on any folder in the root filesystem. Currently any user can do this with any permissions. There's a fair amount of assumptions made here too, that might not be too good, but can be worked on in the future. This is a good start to allow more dynamic operation under the OS itself. It is also currently impossible to unmount and such, and devices will fail to mount in Linux as the FS 'needs to be cleaned'. I'll work on getting `umount` done ASAP to rectify this (as well as working on less assumption-making in the mount syscall. We don't want to just be able to mount DiskDevices!). This could probably be fixed with some `-t` flag or something similar.
2019-08-02 13:18:47 +00:00
Kernel: Implement bind mounts You can now bind-mount files and directories. This essentially exposes an existing part of the file system in another place, and can be used as an alternative to symlinks or hardlinks. Here's an example of doing this: # mkdir /tmp/foo # mount /home/anon/myfile.txt /tmp/foo -o bind # cat /tmp/foo This is anon's file.
2020-01-11 16:08:35 +00:00
if (params.flags & MS_BIND) {
// We're doing a bind mount.
Kernel & Userland: Allow to mount image files formatted with Ext2FS
2020-04-06 08:55:08 +00:00
if (description.is_null())
return -EBADF;
ASSERT(description->custody());
return VFS::the().bind_mount(*description->custody(), target_custody, params.flags);
Kernel: Implement bind mounts You can now bind-mount files and directories. This essentially exposes an existing part of the file system in another place, and can be used as an alternative to symlinks or hardlinks. Here's an example of doing this: # mkdir /tmp/foo # mount /home/anon/myfile.txt /tmp/foo -o bind # cat /tmp/foo This is anon's file.
2020-01-11 16:08:35 +00:00
}
Kernel: Pass a parameter struct to mount() This was the last remaining syscall that took a null-terminated string and figured out how long it was by walking it in kernelspace *shudder*.
2020-01-11 09:46:21 +00:00
if (fs_type == "ext2" || fs_type == "Ext2FS") {
Kernel & Userland: Allow to mount image files formatted with Ext2FS
2020-04-06 08:55:08 +00:00
if (description.is_null())
return -EBADF;
ASSERT(description->custody());
if (!description->file().is_seekable()) {
dbg() << "mount: this is not a seekable file";
Kernel+LibC+Userland: Support mounting other kinds of filesystems
2019-08-15 16:13:56 +00:00
return -ENODEV;
}
Kernel: mount() should fail if the provided device is not a disk device In the future, we should allow mounting any block device. At the moment there is too much filesystem code that depends on the underlying device being a DiskDevice.
2019-08-02 17:30:30 +00:00
Kernel & Userland: Allow to mount image files formatted with Ext2FS
2020-04-06 08:55:08 +00:00
dbg() << "mount: attempting to mount " << description->absolute_path() << " on " << target;
Kernel+LibC+Userland: Support mounting other kinds of filesystems
2019-08-15 16:13:56 +00:00
Kernel & Userland: Allow to mount image files formatted with Ext2FS
2020-04-06 08:55:08 +00:00
fs = Ext2FS::create(*description);
Kernel: Pass a parameter struct to mount() This was the last remaining syscall that took a null-terminated string and figured out how long it was by walking it in kernelspace *shudder*.
2020-01-11 09:46:21 +00:00
} else if (fs_type == "proc" || fs_type == "ProcFS") {
Kernel+LibC+Userland: Support mounting other kinds of filesystems
2019-08-15 16:13:56 +00:00
fs = ProcFS::create();
Kernel: Pass a parameter struct to mount() This was the last remaining syscall that took a null-terminated string and figured out how long it was by walking it in kernelspace *shudder*.
2020-01-11 09:46:21 +00:00
} else if (fs_type == "devpts" || fs_type == "DevPtsFS") {
Kernel+LibC+Userland: Support mounting other kinds of filesystems
2019-08-15 16:13:56 +00:00
fs = DevPtsFS::create();
Kernel: Pass a parameter struct to mount() This was the last remaining syscall that took a null-terminated string and figured out how long it was by walking it in kernelspace *shudder*.
2020-01-11 09:46:21 +00:00
} else if (fs_type == "tmp" || fs_type == "TmpFS") {
Kernel+LibC+Userland: Support mounting other kinds of filesystems
2019-08-15 16:13:56 +00:00
fs = TmpFS::create();
Kernel: Pass a parameter struct to mount() This was the last remaining syscall that took a null-terminated string and figured out how long it was by walking it in kernelspace *shudder*.
2020-01-11 09:46:21 +00:00
} else {
Kernel+LibC+Userland: Support mounting other kinds of filesystems
2019-08-15 16:13:56 +00:00
return -ENODEV;
Kernel: Pass a parameter struct to mount() This was the last remaining syscall that took a null-terminated string and figured out how long it was by walking it in kernelspace *shudder*.
2020-01-11 09:46:21 +00:00
}
Kernel: mount system call (#396) It is now possible to mount ext2 `DiskDevice` devices under Serenity on any folder in the root filesystem. Currently any user can do this with any permissions. There's a fair amount of assumptions made here too, that might not be too good, but can be worked on in the future. This is a good start to allow more dynamic operation under the OS itself. It is also currently impossible to unmount and such, and devices will fail to mount in Linux as the FS 'needs to be cleaned'. I'll work on getting `umount` done ASAP to rectify this (as well as working on less assumption-making in the mount syscall. We don't want to just be able to mount DiskDevices!). This could probably be fixed with some `-t` flag or something similar.
2019-08-02 13:18:47 +00:00
Kernel+LibC+Userland: Support mounting other kinds of filesystems
2019-08-15 16:13:56 +00:00
if (!fs->initialize()) {
Kernel & Userland: Allow to mount image files formatted with Ext2FS
2020-04-06 08:55:08 +00:00
dbg() << "mount: failed to initialize " << fs_type << " filesystem, fd - " << source_fd;
Kernel: mount() should fail if the provided device is not a disk device In the future, we should allow mounting any block device. At the moment there is too much filesystem code that depends on the underlying device being a DiskDevice.
2019-08-02 17:30:30 +00:00
return -ENODEV;
Kernel: mount system call (#396) It is now possible to mount ext2 `DiskDevice` devices under Serenity on any folder in the root filesystem. Currently any user can do this with any permissions. There's a fair amount of assumptions made here too, that might not be too good, but can be worked on in the future. This is a good start to allow more dynamic operation under the OS itself. It is also currently impossible to unmount and such, and devices will fail to mount in Linux as the FS 'needs to be cleaned'. I'll work on getting `umount` done ASAP to rectify this (as well as working on less assumption-making in the mount syscall. We don't want to just be able to mount DiskDevices!). This could probably be fixed with some `-t` flag or something similar.
2019-08-02 13:18:47 +00:00
}
Kernel+LibC: Add support for mount flags At the moment, the actual flags are ignored, but we correctly propagate them all the way from the original mount() syscall to each custody that resides on the mounted FS.
2020-01-11 15:25:26 +00:00
auto result = VFS::the().mount(fs.release_nonnull(), target_custody, params.flags);
Kernel & Userland: Allow to mount image files formatted with Ext2FS
2020-04-06 08:55:08 +00:00
if (!description.is_null())
dbg() << "mount: successfully mounted " << description->absolute_path() << " on " << target;
else
dbg() << "mount: successfully mounted " << target;
Kernel: Some improvements to the mount syscall - You must now have superuser privileges to use mount(). - We now verify that the mount point is a valid path first, before trying to find a filesystem on the specified device. - Convert some dbgprintf() to dbg().
2019-08-02 17:03:50 +00:00
return result;
Kernel: mount system call (#396) It is now possible to mount ext2 `DiskDevice` devices under Serenity on any folder in the root filesystem. Currently any user can do this with any permissions. There's a fair amount of assumptions made here too, that might not be too good, but can be worked on in the future. This is a good start to allow more dynamic operation under the OS itself. It is also currently impossible to unmount and such, and devices will fail to mount in Linux as the FS 'needs to be cleaned'. I'll work on getting `umount` done ASAP to rectify this (as well as working on less assumption-making in the mount syscall. We don't want to just be able to mount DiskDevices!). This could probably be fixed with some `-t` flag or something similar.
2019-08-02 13:18:47 +00:00
}
Kernel: Take path+length in the unlink() and umount() syscalls
2020-01-09 11:41:15 +00:00
int Process::sys$umount(const char* user_mountpoint, size_t mountpoint_length)
Kernel: Added unmount ability to VFS It is now possible to unmount file systems from the VFS via `umount`. It works via looking up the `fsid` of the filesystem from the `Inode`'s metatdata so I'm not sure how fragile it is. It seems to work for now though as something to get us going.
2019-08-11 13:56:39 +00:00
{
if (!is_superuser())
return -EPERM;
ping: Use pledge()
2020-01-11 19:48:43 +00:00
REQUIRE_NO_PROMISES;
Kernel: Take path+length in the unlink() and umount() syscalls
2020-01-09 11:41:15 +00:00
if (!validate_read(user_mountpoint, mountpoint_length))
Kernel: Added unmount ability to VFS It is now possible to unmount file systems from the VFS via `umount`. It works via looking up the `fsid` of the filesystem from the `Inode`'s metatdata so I'm not sure how fragile it is. It seems to work for now though as something to get us going.
2019-08-11 13:56:39 +00:00
return -EFAULT;
Kernel: Take path+length in the unlink() and umount() syscalls
2020-01-09 11:41:15 +00:00
auto mountpoint = get_syscall_path_argument(user_mountpoint, mountpoint_length);
if (mountpoint.is_error())
return mountpoint.error();
auto metadata_or_error = VFS::the().lookup_metadata(mountpoint.value(), current_directory());
Kernel: Added unmount ability to VFS It is now possible to unmount file systems from the VFS via `umount`. It works via looking up the `fsid` of the filesystem from the `Inode`'s metatdata so I'm not sure how fragile it is. It seems to work for now though as something to get us going.
2019-08-11 13:56:39 +00:00
if (metadata_or_error.is_error())
return metadata_or_error.error();
Kernel: Do the umount() by the guest's root inode identifier It was previously possible to unmount a filesystem mounted on /mnt by doing e.g "umount /mnt/some/path".
2019-08-17 12:24:50 +00:00
auto guest_inode_id = metadata_or_error.value().inode;
return VFS::the().unmount(guest_inode_id);
Kernel: Added unmount ability to VFS It is now possible to unmount file systems from the VFS via `umount`. It works via looking up the `fsid` of the filesystem from the `Inode`'s metatdata so I'm not sure how fragile it is. It seems to work for now though as something to get us going.
2019-08-11 13:56:39 +00:00
}
Kernel: Rename FileDescriptor to FileDescription. After reading a bunch of POSIX specs, I've learned that a file descriptor is the number that refers to a file description, not the description itself. So this patch renames FileDescriptor to FileDescription, and Process now has FileDescription* file_description(int fd).
2019-06-07 07:36:51 +00:00
void Process::FileDescriptionAndFlags::clear()
Kernel: Make FIFO inherit from File.
2019-04-29 02:55:54 +00:00
{
Kernel: Rename "descriptor" to "description" where appropriate. Now that FileDescription is called that, variables of that type should not be called "descriptor". This is kinda wordy but we'll get used to it.
2019-06-13 20:03:04 +00:00
description = nullptr;
Kernel: Make FIFO inherit from File.
2019-04-29 02:55:54 +00:00
flags = 0;
}
AK: Rename the common integer typedefs to make it obvious what they are. These types can be picked up by including <AK/Types.h>: * u8, u16, u32, u64 (unsigned) * i8, i16, i32, i64 (signed)
2019-07-03 19:17:35 +00:00
void Process::FileDescriptionAndFlags::set(NonnullRefPtr<FileDescription>&& d, u32 f)
Kernel: Make FIFO inherit from File.
2019-04-29 02:55:54 +00:00
{
Kernel: Rename "descriptor" to "description" where appropriate. Now that FileDescription is called that, variables of that type should not be called "descriptor". This is kinda wordy but we'll get used to it.
2019-06-13 20:03:04 +00:00
description = move(d);
Kernel: Make FIFO inherit from File.
2019-04-29 02:55:54 +00:00
flags = f;
}
Kernel+Userland: Implement mknod() syscall and add a /bin/mknod program.
2019-05-03 20:59:58 +00:00
Kernel: Pass a parameter struct to mknod()
2020-01-11 09:27:37 +00:00
int Process::sys$mknod(const Syscall::SC_mknod_params* user_params)
Kernel+Userland: Implement mknod() syscall and add a /bin/mknod program.
2019-05-03 20:59:58 +00:00
{
ping: Use pledge()
2020-01-11 19:48:43 +00:00
REQUIRE_PROMISE(dpath);
Kernel: Pass a parameter struct to mknod()
2020-01-11 09:27:37 +00:00
Syscall::SC_mknod_params params;
Kernel: Combine validate and copy of user mode pointers (#1069) Right now there is a significant amount of boiler plate code required to validate user mode parameters in syscalls. In an attempt to reduce this a bit, introduce validate_read_and_copy_typed which combines the usermode address check and does the copy internally if the validation passes. This cleans up a little bit of code from a significant amount of syscalls.
2020-01-13 10:19:18 +00:00
if (!validate_read_and_copy_typed(&params, user_params))
return -EFAULT;
Kernel: Pass a parameter struct to mknod()
2020-01-11 09:27:37 +00:00
if (!is_superuser() && !is_regular_file(params.mode) && !is_fifo(params.mode) && !is_socket(params.mode))
return -EPERM;
Kernel: Use the Syscall string and buffer types more While I was updating syscalls to stop passing null-terminated strings, I added some helpful struct types: - StringArgument { const char*; size_t; } - ImmutableBuffer<Data, Size> { const Data*; Size; } - MutableBuffer<Data, Size> { Data*; Size; } The Process class has some convenience functions for validating and optionally extracting the contents from these structs: - get_syscall_path_argument(StringArgument) - validate_and_copy_string_from_user(StringArgument) - validate(ImmutableBuffer) - validate(MutableBuffer) There's still so much code around this and I'm wondering if we should generate most of it instead. Possible nice little project.
2020-01-11 11:47:47 +00:00
auto path = get_syscall_path_argument(params.path);
Kernel: Pass a parameter struct to mknod()
2020-01-11 09:27:37 +00:00
if (path.is_error())
return path.error();
return VFS::the().mknod(path.value(), params.mode & ~umask(), params.dev, current_directory());
Kernel+Userland: Implement mknod() syscall and add a /bin/mknod program.
2019-05-03 20:59:58 +00:00
}
Kernel+LibC: Add a dump_backtrace() syscall. This is very simple but already very useful. Now you're able to call to dump_backtrace() from anywhere userspace to get a nice symbolicated backtrace in the debugger output. :^)
2019-07-21 07:59:17 +00:00
int Process::sys$dump_backtrace()
{
dump_backtrace();
return 0;
}
Kernel+LibC: Add a dbgputch() syscall and use it for userspace dbgprintf(). The "stddbg" stream was a cute idea but we never ended up using it in practice, so let's simplify this and implement userspace dbgprintf() on top of a simple dbgputch() syscall instead. This makes debugging LibC startup a little bit easier. :^)
2019-07-21 17:45:31 +00:00
int Process::sys$dbgputch(u8 ch)
{
IO::out8(0xe9, ch);
return 0;
}
Kernel+LibC: Add a dbgputstr() syscall for sending strings to debug output. This is very handy for the DebugLogStream implementation, among others. :^)
2019-07-21 19:43:37 +00:00
int Process::sys$dbgputstr(const u8* characters, int length)
{
Kernel: Zero-length dbgputstr() should just return 0
2019-08-09 17:44:14 +00:00
if (!length)
return 0;
Kernel+LibC: Add a dbgputstr() syscall for sending strings to debug output. This is very handy for the DebugLogStream implementation, among others. :^)
2019-07-21 19:43:37 +00:00
if (!validate_read(characters, length))
return -EFAULT;
Kernel: Start implementing x86 SMAP support Supervisor Mode Access Prevention (SMAP) is an x86 CPU feature that prevents the kernel from accessing userspace memory. With SMAP enabled, trying to read/write a userspace memory address while in the kernel will now generate a page fault. Since it's sometimes necessary to read/write userspace memory, there are two new instructions that quickly switch the protection on/off: STAC (disables protection) and CLAC (enables protection.) These are exposed in kernel code via the stac() and clac() helpers. There's also a SmapDisabler RAII object that can be used to ensure that you don't forget to re-enable protection before returning to userspace code. THis patch also adds copy_to_user(), copy_from_user() and memset_user() which are the "correct" way of doing things. These functions allow us to briefly disable protection for a specific purpose, and then turn it back on immediately after it's done. Going forward all kernel code should be moved to using these and all uses of SmapDisabler are to be considered FIXME's. Note that we're not realizing the full potential of this feature since I've used SmapDisabler quite liberally in this initial bring-up patch.
2020-01-05 17:00:15 +00:00
SmapDisabler disabler;
Kernel+LibC: Add a dbgputstr() syscall for sending strings to debug output. This is very handy for the DebugLogStream implementation, among others. :^)
2019-07-21 19:43:37 +00:00
for (int i = 0; i < length; ++i)
IO::out8(0xe9, characters[i]);
return 0;
}
Kernel: Dump backtrace to debugger for DefaultSignalAction::DumpCore. This makes assertion failures generate backtraces again. Sorry to everyone who suffered from the lack of backtraces lately. :^) We share code with the /proc/PID/stack implementation. You can now get the current backtrace for a Thread via Thread::backtrace(), and all the traces for a Process via Process::backtrace().
2019-07-25 19:02:19 +00:00
Kernel: Use KBufferBuilder to build ProcFS files and backtraces This is not perfect as it uses a lot of VM, but since the buffers are supposed to be temporary it's not super terrible. This could be improved by giving back the unused VM to the kernel's RangeAllocator after finishing the buffer building.
2019-08-07 19:52:43 +00:00
KBuffer Process::backtrace(ProcessInspectionHandle& handle) const
Kernel: Dump backtrace to debugger for DefaultSignalAction::DumpCore. This makes assertion failures generate backtraces again. Sorry to everyone who suffered from the lack of backtraces lately. :^) We share code with the /proc/PID/stack implementation. You can now get the current backtrace for a Thread via Thread::backtrace(), and all the traces for a Process via Process::backtrace().
2019-07-25 19:02:19 +00:00
{
Kernel: Use KBufferBuilder to build ProcFS files and backtraces This is not perfect as it uses a lot of VM, but since the buffers are supposed to be temporary it's not super terrible. This could be improved by giving back the unused VM to the kernel's RangeAllocator after finishing the buffer building.
2019-08-07 19:52:43 +00:00
KBufferBuilder builder;
Kernel: Dump backtrace to debugger for DefaultSignalAction::DumpCore. This makes assertion failures generate backtraces again. Sorry to everyone who suffered from the lack of backtraces lately. :^) We share code with the /proc/PID/stack implementation. You can now get the current backtrace for a Thread via Thread::backtrace(), and all the traces for a Process via Process::backtrace().
2019-07-25 19:02:19 +00:00
for_each_thread([&](Thread& thread) {
Kernel: Allow setting thread names The main thread of each kernel/user process will take the name of the process. Extra threads will get a fancy new name "ProcessName[<tid>]". Thread backtraces now list the thread name in addtion to tid. Add the thread name to /proc/all (should it get its own proc file?). Add two new syscalls, set_thread_name and get_thread_name.
2019-12-07 19:45:26 +00:00
builder.appendf("Thread %d (%s):\n", thread.tid(), thread.name().characters());
Kernel: Dump backtrace to debugger for DefaultSignalAction::DumpCore. This makes assertion failures generate backtraces again. Sorry to everyone who suffered from the lack of backtraces lately. :^) We share code with the /proc/PID/stack implementation. You can now get the current backtrace for a Thread via Thread::backtrace(), and all the traces for a Process via Process::backtrace().
2019-07-25 19:02:19 +00:00
builder.append(thread.backtrace(handle));
return IterationDecision::Continue;
});
Kernel: Use KBufferBuilder to build ProcFS files and backtraces This is not perfect as it uses a lot of VM, but since the buffers are supposed to be temporary it's not super terrible. This could be improved by giving back the unused VM to the kernel's RangeAllocator after finishing the buffer building.
2019-08-07 19:52:43 +00:00
return builder.build();
Kernel: Dump backtrace to debugger for DefaultSignalAction::DumpCore. This makes assertion failures generate backtraces again. Sorry to everyone who suffered from the lack of backtraces lately. :^) We share code with the /proc/PID/stack implementation. You can now get the current backtrace for a Thread via Thread::backtrace(), and all the traces for a Process via Process::backtrace().
2019-07-25 19:02:19 +00:00
}
Kernel+ProcessManager: Let processes have an icon and show it in the table. Processes can now have an icon assigned, which is essentially a 16x16 RGBA32 bitmap exposed as a shared buffer ID. You set the icon ID by calling set_process_icon(int) and the icon ID will be exposed through /proc/all. To make this work, I added a mechanism for making shared buffers globally accessible. For safety reasons, each app seals the icon buffer before making it global. Right now the first call to GWindow::set_icon() is what determines the process icon. We'll probably change this in the future. :^)
2019-07-29 05:26:01 +00:00
int Process::sys$set_process_icon(int icon_id)
{
ping: Use pledge()
2020-01-11 19:48:43 +00:00
REQUIRE_PROMISE(shared_buffer);
Kernel+ProcessManager: Let processes have an icon and show it in the table. Processes can now have an icon assigned, which is essentially a 16x16 RGBA32 bitmap exposed as a shared buffer ID. You set the icon ID by calling set_process_icon(int) and the icon ID will be exposed through /proc/all. To make this work, I added a mechanism for making shared buffers globally accessible. For safety reasons, each app seals the icon buffer before making it global. Right now the first call to GWindow::set_icon() is what determines the process icon. We'll probably change this in the future. :^)
2019-07-29 05:26:01 +00:00
LOCKER(shared_buffers().lock());
auto it = shared_buffers().resource().find(icon_id);
if (it == shared_buffers().resource().end())
return -EINVAL;
auto& shared_buffer = *(*it).value;
if (!shared_buffer.is_shared_with(m_pid))
return -EPERM;
m_icon_id = icon_id;
return 0;
}
Kernel+LibC: Add get_process_name() syscall It does exactly what it sounds like: int get_process_name(char* buffer, int buffer_size);
2019-08-15 18:55:10 +00:00
int Process::sys$get_process_name(char* buffer, int buffer_size)
{
ping: Use pledge()
2020-01-11 19:48:43 +00:00
REQUIRE_PROMISE(stdio);
Kernel+LibC: Add get_process_name() syscall It does exactly what it sounds like: int get_process_name(char* buffer, int buffer_size);
2019-08-15 18:55:10 +00:00
if (buffer_size <= 0)
return -EINVAL;
if (!validate_write(buffer, buffer_size))
return -EFAULT;
Kernel: Start implementing x86 SMAP support Supervisor Mode Access Prevention (SMAP) is an x86 CPU feature that prevents the kernel from accessing userspace memory. With SMAP enabled, trying to read/write a userspace memory address while in the kernel will now generate a page fault. Since it's sometimes necessary to read/write userspace memory, there are two new instructions that quickly switch the protection on/off: STAC (disables protection) and CLAC (enables protection.) These are exposed in kernel code via the stac() and clac() helpers. There's also a SmapDisabler RAII object that can be used to ensure that you don't forget to re-enable protection before returning to userspace code. THis patch also adds copy_to_user(), copy_from_user() and memset_user() which are the "correct" way of doing things. These functions allow us to briefly disable protection for a specific purpose, and then turn it back on immediately after it's done. Going forward all kernel code should be moved to using these and all uses of SmapDisabler are to be considered FIXME's. Note that we're not realizing the full potential of this feature since I've used SmapDisabler quite liberally in this initial bring-up patch.
2020-01-05 17:00:15 +00:00
if (m_name.length() + 1 > (size_t)buffer_size)
Kernel+LibC: Add get_process_name() syscall It does exactly what it sounds like: int get_process_name(char* buffer, int buffer_size);
2019-08-15 18:55:10 +00:00
return -ENAMETOOLONG;
Kernel: Start implementing x86 SMAP support Supervisor Mode Access Prevention (SMAP) is an x86 CPU feature that prevents the kernel from accessing userspace memory. With SMAP enabled, trying to read/write a userspace memory address while in the kernel will now generate a page fault. Since it's sometimes necessary to read/write userspace memory, there are two new instructions that quickly switch the protection on/off: STAC (disables protection) and CLAC (enables protection.) These are exposed in kernel code via the stac() and clac() helpers. There's also a SmapDisabler RAII object that can be used to ensure that you don't forget to re-enable protection before returning to userspace code. THis patch also adds copy_to_user(), copy_from_user() and memset_user() which are the "correct" way of doing things. These functions allow us to briefly disable protection for a specific purpose, and then turn it back on immediately after it's done. Going forward all kernel code should be moved to using these and all uses of SmapDisabler are to be considered FIXME's. Note that we're not realizing the full potential of this feature since I've used SmapDisabler quite liberally in this initial bring-up patch.
2020-01-05 17:00:15 +00:00
copy_to_user(buffer, m_name.characters(), m_name.length() + 1);
Kernel+LibC: Add get_process_name() syscall It does exactly what it sounds like: int get_process_name(char* buffer, int buffer_size);
2019-08-15 18:55:10 +00:00
return 0;
}
Kernel: Add a Linux-style getrandom syscall The way it gets the entropy and blasts it to the buffer is pretty ugly IMHO, but it does work for now. (It should be replaced, by not truncating a u32.) It implements an (unused for now) flags argument, like Linux but instead of OpenBSD's. This is in case we want to distinguish between entropy sources or any other reason and have to implement a new syscall later. Of course, learn from Linux's struggles with entropy sourcing too.
2019-10-13 14:41:55 +00:00
// We don't use the flag yet, but we could use it for distinguishing
// random source like Linux, unlike the OpenBSD equivalent. However, if we
// do, we should be able of the caveats that Linux has dealt with.
int Process::sys$getrandom(void* buffer, size_t buffer_size, unsigned int flags __attribute__((unused)))
{
Kernel: Put some more syscalls in the "stdio" bucket yield() and get_kernel_info_page() seem like decent fits for "stdio".
2020-01-12 09:30:02 +00:00
REQUIRE_PROMISE(stdio);
Kernel: Add a Linux-style getrandom syscall The way it gets the entropy and blasts it to the buffer is pretty ugly IMHO, but it does work for now. (It should be replaced, by not truncating a u32.) It implements an (unused for now) flags argument, like Linux but instead of OpenBSD's. This is in case we want to distinguish between entropy sources or any other reason and have to implement a new syscall later. Of course, learn from Linux's struggles with entropy sourcing too.
2019-10-13 14:41:55 +00:00
if (buffer_size <= 0)
return -EINVAL;
if (!validate_write(buffer, buffer_size))
return -EFAULT;
Kernel: Use word-sized entropy as much as possible in syscall
2019-10-13 15:55:58 +00:00
Kernel: Fix SMAP violation in sys$getrandom()
2020-01-12 19:10:53 +00:00
SmapDisabler disabler;
Kernel: Add a more expressive API for getting random bytes We now have these API's in <Kernel/Random.h>: - get_fast_random_bytes(u8* buffer, size_t buffer_size) - get_good_random_bytes(u8* buffer, size_t buffer_size) - get_fast_random<T>() - get_good_random<T>() Internally they both use x86 RDRAND if available, otherwise they fall back to the same LCG we had in RandomDevice all along. The main purpose of this patch is to give kernel code a way to better express its needs for random data. Randomness is something that will require a lot more work, but this is hopefully a step in the right direction.
2020-01-03 11:36:30 +00:00
get_good_random_bytes((u8*)buffer, buffer_size);
Kernel: Add a Linux-style getrandom syscall The way it gets the entropy and blasts it to the buffer is pretty ugly IMHO, but it does work for now. (It should be replaced, by not truncating a u32.) It implements an (unused for now) flags argument, like Linux but instead of OpenBSD's. This is in case we want to distinguish between entropy sources or any other reason and have to implement a new syscall later. Of course, learn from Linux's struggles with entropy sourcing too.
2019-10-13 14:41:55 +00:00
return 0;
}
Kernel+LibC: Implement clock_gettime() and clock_nanosleep() Only the CLOCK_MONOTONIC clock is supported at the moment, and it only has millisecond precision. :^)
2019-11-02 18:34:06 +00:00
Kernel: Combine validate and copy of user mode pointers (#1069) Right now there is a significant amount of boiler plate code required to validate user mode parameters in syscalls. In an attempt to reduce this a bit, introduce validate_read_and_copy_typed which combines the usermode address check and does the copy internally if the validation passes. This cleans up a little bit of code from a significant amount of syscalls.
2020-01-13 10:19:18 +00:00
int Process::sys$setkeymap(const Syscall::SC_setkeymap_params* user_params)
Kernel: Implement the setkeymap() syscall.
2019-11-23 07:48:07 +00:00
{
if (!is_superuser())
return -EPERM;
ping: Use pledge()
2020-01-11 19:48:43 +00:00
REQUIRE_NO_PROMISES;
Kernel: Combine validate and copy of user mode pointers (#1069) Right now there is a significant amount of boiler plate code required to validate user mode parameters in syscalls. In an attempt to reduce this a bit, introduce validate_read_and_copy_typed which combines the usermode address check and does the copy internally if the validation passes. This cleans up a little bit of code from a significant amount of syscalls.
2020-01-13 10:19:18 +00:00
Syscall::SC_setkeymap_params params;
if (!validate_read_and_copy_typed(&params, user_params))
Kernel: Implement AltGr key support
2019-12-31 12:37:38 +00:00
return -EFAULT;
Kernel: Combine validate and copy of user mode pointers (#1069) Right now there is a significant amount of boiler plate code required to validate user mode parameters in syscalls. In an attempt to reduce this a bit, introduce validate_read_and_copy_typed which combines the usermode address check and does the copy internally if the validation passes. This cleans up a little bit of code from a significant amount of syscalls.
2020-01-13 10:19:18 +00:00
const char* map = params.map;
const char* shift_map = params.shift_map;
const char* alt_map = params.alt_map;
const char* altgr_map = params.altgr_map;
Kernel: Fix bad TOCTOU pattern in syscalls that take a parameter struct Our syscall calling convention only allows passing up to 3 arguments in registers. For syscalls that take more arguments, we bake them into a struct and pass a pointer to that struct instead. When doing pointer validation, this is what we would do: 1) Validate the "params" struct 2) Validate "params->some_pointer" 3) ... other stuff ... 4) Use "params->some_pointer" Since the parameter struct is stored in userspace, it can be modified by userspace after validation has completed. This was a recurring pattern in many syscalls that was further hidden by me using structured binding declarations to give convenient local names to things in the parameter struct: auto& [some_pointer, ...] = *params; memcpy(some_pointer, ...); This devilishly makes "some_pointer" look like a local variable but it's actually more like an alias for "params->some_pointer" and will expand to a dereference when accessed! This patch fixes the issues by explicitly copying out each member from the parameter structs before validating them, and then never using the "param" pointers beyond that. Thanks to braindead for finding this bug! :^)
2020-01-05 08:13:00 +00:00
if (!validate_read(map, 0x80))
Kernel: Implement AltGr key support
2019-12-31 12:37:38 +00:00
return -EFAULT;
Kernel: Fix bad TOCTOU pattern in syscalls that take a parameter struct Our syscall calling convention only allows passing up to 3 arguments in registers. For syscalls that take more arguments, we bake them into a struct and pass a pointer to that struct instead. When doing pointer validation, this is what we would do: 1) Validate the "params" struct 2) Validate "params->some_pointer" 3) ... other stuff ... 4) Use "params->some_pointer" Since the parameter struct is stored in userspace, it can be modified by userspace after validation has completed. This was a recurring pattern in many syscalls that was further hidden by me using structured binding declarations to give convenient local names to things in the parameter struct: auto& [some_pointer, ...] = *params; memcpy(some_pointer, ...); This devilishly makes "some_pointer" look like a local variable but it's actually more like an alias for "params->some_pointer" and will expand to a dereference when accessed! This patch fixes the issues by explicitly copying out each member from the parameter structs before validating them, and then never using the "param" pointers beyond that. Thanks to braindead for finding this bug! :^)
2020-01-05 08:13:00 +00:00
if (!validate_read(shift_map, 0x80))
Kernel: Implement the setkeymap() syscall.
2019-11-23 07:48:07 +00:00
return -EFAULT;
Kernel: Fix bad TOCTOU pattern in syscalls that take a parameter struct Our syscall calling convention only allows passing up to 3 arguments in registers. For syscalls that take more arguments, we bake them into a struct and pass a pointer to that struct instead. When doing pointer validation, this is what we would do: 1) Validate the "params" struct 2) Validate "params->some_pointer" 3) ... other stuff ... 4) Use "params->some_pointer" Since the parameter struct is stored in userspace, it can be modified by userspace after validation has completed. This was a recurring pattern in many syscalls that was further hidden by me using structured binding declarations to give convenient local names to things in the parameter struct: auto& [some_pointer, ...] = *params; memcpy(some_pointer, ...); This devilishly makes "some_pointer" look like a local variable but it's actually more like an alias for "params->some_pointer" and will expand to a dereference when accessed! This patch fixes the issues by explicitly copying out each member from the parameter structs before validating them, and then never using the "param" pointers beyond that. Thanks to braindead for finding this bug! :^)
2020-01-05 08:13:00 +00:00
if (!validate_read(alt_map, 0x80))
Kernel: Implement the setkeymap() syscall.
2019-11-23 07:48:07 +00:00
return -EFAULT;
Kernel: Fix bad TOCTOU pattern in syscalls that take a parameter struct Our syscall calling convention only allows passing up to 3 arguments in registers. For syscalls that take more arguments, we bake them into a struct and pass a pointer to that struct instead. When doing pointer validation, this is what we would do: 1) Validate the "params" struct 2) Validate "params->some_pointer" 3) ... other stuff ... 4) Use "params->some_pointer" Since the parameter struct is stored in userspace, it can be modified by userspace after validation has completed. This was a recurring pattern in many syscalls that was further hidden by me using structured binding declarations to give convenient local names to things in the parameter struct: auto& [some_pointer, ...] = *params; memcpy(some_pointer, ...); This devilishly makes "some_pointer" look like a local variable but it's actually more like an alias for "params->some_pointer" and will expand to a dereference when accessed! This patch fixes the issues by explicitly copying out each member from the parameter structs before validating them, and then never using the "param" pointers beyond that. Thanks to braindead for finding this bug! :^)
2020-01-05 08:13:00 +00:00
if (!validate_read(altgr_map, 0x80))
Kernel: Implement the setkeymap() syscall.
2019-11-23 07:48:07 +00:00
return -EFAULT;
Kernel: Fix SMAP in setkeymap syscall It looks like setkeymap was missed when the SMAP functionality was introduced. Disable SMAP only in the scope where we actually read the usermode addresses.
2020-01-13 09:26:20 +00:00
SmapDisabler disabler;
Kernel: Fix bad TOCTOU pattern in syscalls that take a parameter struct Our syscall calling convention only allows passing up to 3 arguments in registers. For syscalls that take more arguments, we bake them into a struct and pass a pointer to that struct instead. When doing pointer validation, this is what we would do: 1) Validate the "params" struct 2) Validate "params->some_pointer" 3) ... other stuff ... 4) Use "params->some_pointer" Since the parameter struct is stored in userspace, it can be modified by userspace after validation has completed. This was a recurring pattern in many syscalls that was further hidden by me using structured binding declarations to give convenient local names to things in the parameter struct: auto& [some_pointer, ...] = *params; memcpy(some_pointer, ...); This devilishly makes "some_pointer" look like a local variable but it's actually more like an alias for "params->some_pointer" and will expand to a dereference when accessed! This patch fixes the issues by explicitly copying out each member from the parameter structs before validating them, and then never using the "param" pointers beyond that. Thanks to braindead for finding this bug! :^)
2020-01-05 08:13:00 +00:00
KeyboardDevice::the().set_maps(map, shift_map, alt_map, altgr_map);
Kernel: Implement the setkeymap() syscall.
2019-11-23 07:48:07 +00:00
return 0;
}
Kernel: Remove SmapDisabler in sys$clock_gettime()
2020-02-16 07:13:11 +00:00
int Process::sys$clock_gettime(clockid_t clock_id, timespec* user_ts)
Kernel+LibC: Implement clock_gettime() and clock_nanosleep() Only the CLOCK_MONOTONIC clock is supported at the moment, and it only has millisecond precision. :^)
2019-11-02 18:34:06 +00:00
{
ping: Use pledge()
2020-01-11 19:48:43 +00:00
REQUIRE_PROMISE(stdio);
Kernel: Remove SmapDisabler in sys$clock_gettime()
2020-02-16 07:13:11 +00:00
if (!validate_write_typed(user_ts))
Kernel+LibC: Implement clock_gettime() and clock_nanosleep() Only the CLOCK_MONOTONIC clock is supported at the moment, and it only has millisecond precision. :^)
2019-11-02 18:34:06 +00:00
return -EFAULT;
Kernel: Remove SmapDisabler in sys$clock_gettime()
2020-02-16 07:13:11 +00:00
timespec ts;
memset(&ts, 0, sizeof(ts));
Kernel+LibC: Implement clock_gettime() and clock_nanosleep() Only the CLOCK_MONOTONIC clock is supported at the moment, and it only has millisecond precision. :^)
2019-11-02 18:34:06 +00:00
switch (clock_id) {
case CLOCK_MONOTONIC:
Kernel: Introduce the new Time management subsystem This new subsystem includes better abstractions of how time will be handled in the OS. We take advantage of the existing RTC timer to aid in keeping time synchronized. This is standing in contrast to how we handled time-keeping in the kernel, where the PIT was responsible for that function in addition to update the scheduler about ticks. With that new advantage, we can easily change the ticking dynamically and still keep the time synchronized. In the process context, we no longer use a fixed declaration of TICKS_PER_SECOND, but we call the TimeManagement singleton class to provide us the right value. This allows us to use dynamic ticking in the future, a feature known as tickless kernel. The scheduler no longer does by himself the calculation of real time (Unix time), and just calls the TimeManagment singleton class to provide the value. Also, we can use 2 new boot arguments: - the "time" boot argument accpets either the value "modern", or "legacy". If "modern" is specified, the time management subsystem will try to setup HPET. Otherwise, for "legacy" value, the time subsystem will revert to use the PIT & RTC, leaving HPET disabled. If this boot argument is not specified, the default pattern is to try to setup HPET. - the "hpet" boot argumet accepts either the value "periodic" or "nonperiodic". If "periodic" is specified, the HPET will scan for periodic timers, and will assert if none are found. If only one is found, that timer will be assigned for the time-keeping task. If more than one is found, both time-keeping task & scheduler-ticking task will be assigned to periodic timers. If this boot argument is not specified, the default pattern is to try to scan for HPET periodic timers. This boot argument has no effect if HPET is disabled. In hardware context, PIT & RealTimeClock classes are merely inheriting from the HardwareTimer class, and they allow to use the old i8254 (PIT) and RTC devices, managing them via IO ports. By default, the RTC will be programmed to a frequency of 1024Hz. The PIT will be programmed to a frequency close to 1000Hz. About HPET, depending if we need to scan for periodic timers or not, we try to set a frequency close to 1000Hz for the time-keeping timer and scheduler-ticking timer. Also, if possible, we try to enable the Legacy replacement feature of the HPET. This feature if exists, instructs the chipset to disconnect both i8254 (PIT) and RTC. This behavior is observable on QEMU, and was verified against the source code: https://github.com/qemu/qemu/commit/ce967e2f33861b0e17753f97fa4527b5943c94b6 The HPETComparator class is inheriting from HardwareTimer class, and is responsible for an individual HPET comparator, which is essentially a timer. Therefore, it needs to call the singleton HPET class to perform HPET-related operations. The new abstraction of Hardware timers brings an opportunity of more new features in the foreseeable future. For example, we can change the callback function of each hardware timer, thus it makes it possible to swap missions between hardware timers, or to allow to use a hardware timer for other temporary missions (e.g. calibrating the LAPIC timer, measuring the CPU frequency, etc).
2020-03-09 15:03:27 +00:00
ts.tv_sec = TimeManagement::the().seconds_since_boot();
ts.tv_nsec = TimeManagement::the().ticks_this_second() * 1000000;
break;
case CLOCK_REALTIME:
ts.tv_sec = TimeManagement::the().epoch_time();
ts.tv_nsec = TimeManagement::the().ticks_this_second() * 1000000;
Kernel+LibC: Implement clock_gettime() and clock_nanosleep() Only the CLOCK_MONOTONIC clock is supported at the moment, and it only has millisecond precision. :^)
2019-11-02 18:34:06 +00:00
break;
default:
return -EINVAL;
}
Kernel: Remove SmapDisabler in sys$clock_gettime()
2020-02-16 07:13:11 +00:00
copy_to_user(user_ts, &ts);
Kernel+LibC: Implement clock_gettime() and clock_nanosleep() Only the CLOCK_MONOTONIC clock is supported at the moment, and it only has millisecond precision. :^)
2019-11-02 18:34:06 +00:00
return 0;
}
Kernel: Add new syscall to allow changing the system date
2020-03-12 23:17:14 +00:00
int Process::sys$clock_settime(clockid_t clock_id, timespec* user_ts)
{
SmapDisabler disabler;
REQUIRE_PROMISE(stdio);
if (!validate_write_typed(user_ts))
return -EFAULT;
switch (clock_id) {
case CLOCK_REALTIME:
TimeManagement::the().set_epoch_time(user_ts->tv_sec);
break;
default:
return -EINVAL;
}
return 0;
}
Kernel: Remove SmapDisabler in clock_nanosleep()
2020-01-11 10:51:03 +00:00
int Process::sys$clock_nanosleep(const Syscall::SC_clock_nanosleep_params* user_params)
Kernel+LibC: Implement clock_gettime() and clock_nanosleep() Only the CLOCK_MONOTONIC clock is supported at the moment, and it only has millisecond precision. :^)
2019-11-02 18:34:06 +00:00
{
ping: Use pledge()
2020-01-11 19:48:43 +00:00
REQUIRE_PROMISE(stdio);
Kernel: Combine validate and copy of user mode pointers (#1069) Right now there is a significant amount of boiler plate code required to validate user mode parameters in syscalls. In an attempt to reduce this a bit, introduce validate_read_and_copy_typed which combines the usermode address check and does the copy internally if the validation passes. This cleans up a little bit of code from a significant amount of syscalls.
2020-01-13 10:19:18 +00:00
Kernel: Remove SmapDisabler in clock_nanosleep()
2020-01-11 10:51:03 +00:00
Syscall::SC_clock_nanosleep_params params;
Kernel: Combine validate and copy of user mode pointers (#1069) Right now there is a significant amount of boiler plate code required to validate user mode parameters in syscalls. In an attempt to reduce this a bit, introduce validate_read_and_copy_typed which combines the usermode address check and does the copy internally if the validation passes. This cleans up a little bit of code from a significant amount of syscalls.
2020-01-13 10:19:18 +00:00
if (!validate_read_and_copy_typed(&params, user_params))
return -EFAULT;
Kernel+LibC: Implement clock_gettime() and clock_nanosleep() Only the CLOCK_MONOTONIC clock is supported at the moment, and it only has millisecond precision. :^)
2019-11-02 18:34:06 +00:00
Kernel: Remove SmapDisabler in clock_nanosleep()
2020-01-11 10:51:03 +00:00
if (params.requested_sleep && !validate_read_typed(params.requested_sleep))
Kernel+LibC: Implement clock_gettime() and clock_nanosleep() Only the CLOCK_MONOTONIC clock is supported at the moment, and it only has millisecond precision. :^)
2019-11-02 18:34:06 +00:00
return -EFAULT;
Kernel: Remove SmapDisabler in clock_nanosleep()
2020-01-11 10:51:03 +00:00
timespec requested_sleep;
copy_from_user(&requested_sleep, params.requested_sleep);
if (params.remaining_sleep && !validate_write_typed(params.remaining_sleep))
Kernel+LibC: Implement clock_gettime() and clock_nanosleep() Only the CLOCK_MONOTONIC clock is supported at the moment, and it only has millisecond precision. :^)
2019-11-02 18:34:06 +00:00
return -EFAULT;
Kernel: Remove SmapDisabler in clock_nanosleep()
2020-01-11 10:51:03 +00:00
bool is_absolute = params.flags & TIMER_ABSTIME;
Kernel+LibC: Implement clock_gettime() and clock_nanosleep() Only the CLOCK_MONOTONIC clock is supported at the moment, and it only has millisecond precision. :^)
2019-11-02 18:34:06 +00:00
Kernel: Remove SmapDisabler in clock_nanosleep()
2020-01-11 10:51:03 +00:00
switch (params.clock_id) {
Kernel+LibC: Implement clock_gettime() and clock_nanosleep() Only the CLOCK_MONOTONIC clock is supported at the moment, and it only has millisecond precision. :^)
2019-11-02 18:34:06 +00:00
case CLOCK_MONOTONIC: {
u64 wakeup_time;
if (is_absolute) {
Kernel: Remove SmapDisabler in clock_nanosleep()
2020-01-11 10:51:03 +00:00
u64 time_to_wake = (requested_sleep.tv_sec * 1000 + requested_sleep.tv_nsec / 1000000);
Kernel: Replace "current" with Thread::current and Process::current Suggested by Sergey. The currently running Thread and Process are now Thread::current and Process::current respectively. :^)
2020-02-17 14:04:27 +00:00
wakeup_time = Thread::current->sleep_until(time_to_wake);
Kernel+LibC: Implement clock_gettime() and clock_nanosleep() Only the CLOCK_MONOTONIC clock is supported at the moment, and it only has millisecond precision. :^)
2019-11-02 18:34:06 +00:00
} else {
Kernel: Remove SmapDisabler in clock_nanosleep()
2020-01-11 10:51:03 +00:00
u32 ticks_to_sleep = (requested_sleep.tv_sec * 1000 + requested_sleep.tv_nsec / 1000000);
Kernel+LibC: Implement clock_gettime() and clock_nanosleep() Only the CLOCK_MONOTONIC clock is supported at the moment, and it only has millisecond precision. :^)
2019-11-02 18:34:06 +00:00
if (!ticks_to_sleep)
return 0;
Kernel: Replace "current" with Thread::current and Process::current Suggested by Sergey. The currently running Thread and Process are now Thread::current and Process::current respectively. :^)
2020-02-17 14:04:27 +00:00
wakeup_time = Thread::current->sleep(ticks_to_sleep);
Kernel+LibC: Implement clock_gettime() and clock_nanosleep() Only the CLOCK_MONOTONIC clock is supported at the moment, and it only has millisecond precision. :^)
2019-11-02 18:34:06 +00:00
}
if (wakeup_time > g_uptime) {
u32 ticks_left = wakeup_time - g_uptime;
Kernel: Remove SmapDisabler in clock_nanosleep()
2020-01-11 10:51:03 +00:00
if (!is_absolute && params.remaining_sleep) {
Kernel: Fix race in clock_nanosleep This is a complete fix of clock_nanosleep, because the thread holds the process lock again when returning from sleep()/sleep_until(). Therefore, no further concurrent invalidation can occur.
2020-03-03 04:12:39 +00:00
if (!validate_write_typed(params.remaining_sleep)) {
// This can happen because the lock is dropped while
// sleeping, thus giving other threads the opportunity
// to make the region unwritable.
return -EFAULT;
}
Kernel: Remove SmapDisabler in clock_nanosleep()
2020-01-11 10:51:03 +00:00
timespec remaining_sleep;
memset(&remaining_sleep, 0, sizeof(timespec));
Kernel: Introduce the new Time management subsystem This new subsystem includes better abstractions of how time will be handled in the OS. We take advantage of the existing RTC timer to aid in keeping time synchronized. This is standing in contrast to how we handled time-keeping in the kernel, where the PIT was responsible for that function in addition to update the scheduler about ticks. With that new advantage, we can easily change the ticking dynamically and still keep the time synchronized. In the process context, we no longer use a fixed declaration of TICKS_PER_SECOND, but we call the TimeManagement singleton class to provide us the right value. This allows us to use dynamic ticking in the future, a feature known as tickless kernel. The scheduler no longer does by himself the calculation of real time (Unix time), and just calls the TimeManagment singleton class to provide the value. Also, we can use 2 new boot arguments: - the "time" boot argument accpets either the value "modern", or "legacy". If "modern" is specified, the time management subsystem will try to setup HPET. Otherwise, for "legacy" value, the time subsystem will revert to use the PIT & RTC, leaving HPET disabled. If this boot argument is not specified, the default pattern is to try to setup HPET. - the "hpet" boot argumet accepts either the value "periodic" or "nonperiodic". If "periodic" is specified, the HPET will scan for periodic timers, and will assert if none are found. If only one is found, that timer will be assigned for the time-keeping task. If more than one is found, both time-keeping task & scheduler-ticking task will be assigned to periodic timers. If this boot argument is not specified, the default pattern is to try to scan for HPET periodic timers. This boot argument has no effect if HPET is disabled. In hardware context, PIT & RealTimeClock classes are merely inheriting from the HardwareTimer class, and they allow to use the old i8254 (PIT) and RTC devices, managing them via IO ports. By default, the RTC will be programmed to a frequency of 1024Hz. The PIT will be programmed to a frequency close to 1000Hz. About HPET, depending if we need to scan for periodic timers or not, we try to set a frequency close to 1000Hz for the time-keeping timer and scheduler-ticking timer. Also, if possible, we try to enable the Legacy replacement feature of the HPET. This feature if exists, instructs the chipset to disconnect both i8254 (PIT) and RTC. This behavior is observable on QEMU, and was verified against the source code: https://github.com/qemu/qemu/commit/ce967e2f33861b0e17753f97fa4527b5943c94b6 The HPETComparator class is inheriting from HardwareTimer class, and is responsible for an individual HPET comparator, which is essentially a timer. Therefore, it needs to call the singleton HPET class to perform HPET-related operations. The new abstraction of Hardware timers brings an opportunity of more new features in the foreseeable future. For example, we can change the callback function of each hardware timer, thus it makes it possible to swap missions between hardware timers, or to allow to use a hardware timer for other temporary missions (e.g. calibrating the LAPIC timer, measuring the CPU frequency, etc).
2020-03-09 15:03:27 +00:00
remaining_sleep.tv_sec = ticks_left / TimeManagement::the().ticks_per_second();
ticks_left -= remaining_sleep.tv_sec * TimeManagement::the().ticks_per_second();
Kernel: Remove SmapDisabler in clock_nanosleep()
2020-01-11 10:51:03 +00:00
remaining_sleep.tv_nsec = ticks_left * 1000000;
copy_to_user(params.remaining_sleep, &remaining_sleep);
Kernel+LibC: Implement clock_gettime() and clock_nanosleep() Only the CLOCK_MONOTONIC clock is supported at the moment, and it only has millisecond precision. :^)
2019-11-02 18:34:06 +00:00
}
return -EINTR;
}
return 0;
}
default:
return -EINVAL;
}
}
Kernel: Use a lookup table for syscalls Instead of the big ugly switch statement, build a lookup table using the syscall enumeration macro. This greatly simplifies the syscall implementation. :^)
2019-11-09 21:18:16 +00:00
int Process::sys$sync()
{
ping: Use pledge()
2020-01-11 19:48:43 +00:00
REQUIRE_PROMISE(stdio);
Kernel: Use a lookup table for syscalls Instead of the big ugly switch statement, build a lookup table using the syscall enumeration macro. This greatly simplifies the syscall implementation. :^)
2019-11-09 21:18:16 +00:00
VFS::the().sync();
return 0;
}
int Process::sys$yield()
{
Kernel: Put some more syscalls in the "stdio" bucket yield() and get_kernel_info_page() seem like decent fits for "stdio".
2020-01-12 09:30:02 +00:00
REQUIRE_PROMISE(stdio);
Kernel: Replace "current" with Thread::current and Process::current Suggested by Sergey. The currently running Thread and Process are now Thread::current and Process::current respectively. :^)
2020-02-17 14:04:27 +00:00
Thread::current->yield_without_holding_big_lock();
Kernel: Release the big process lock while yielding in sys$yield() Otherwise, a thread calling sched_yield() will prevent other threads in that process from entering the kernel.
2019-11-16 11:18:59 +00:00
return 0;
Kernel: Use a lookup table for syscalls Instead of the big ugly switch statement, build a lookup table using the syscall enumeration macro. This greatly simplifies the syscall implementation. :^)
2019-11-09 21:18:16 +00:00
}
int Process::sys$beep()
{
Kernel: Move PC speaker beep timing logic from scheduler to the syscall I don't know why I put this in the scheduler to begin with.. the caller can just block until the beeping is finished.
2019-12-26 21:31:26 +00:00
PCSpeaker::tone_on(440);
Kernel: Replace "current" with Thread::current and Process::current Suggested by Sergey. The currently running Thread and Process are now Thread::current and Process::current respectively. :^)
2020-02-17 14:04:27 +00:00
u64 wakeup_time = Thread::current->sleep(100);
Kernel: Move PC speaker beep timing logic from scheduler to the syscall I don't know why I put this in the scheduler to begin with.. the caller can just block until the beeping is finished.
2019-12-26 21:31:26 +00:00
PCSpeaker::tone_off();
if (wakeup_time > g_uptime)
return -EINTR;
Kernel: Use a lookup table for syscalls Instead of the big ugly switch statement, build a lookup table using the syscall enumeration macro. This greatly simplifies the syscall implementation. :^)
2019-11-09 21:18:16 +00:00
return 0;
}
Kernel: Implement very simple kernel module loading It's now possible to load a .o file into the kernel via a syscall. The kernel will perform all the necessary ELF relocations, and then call the "module_init" symbol in the loaded module.
2019-11-28 19:59:11 +00:00
Kernel: SMAP fixes for module_load() and module_unload() Remove SmapDisabler in module_load() + use get_syscall_path_argument(). Also fix a SMAP violation in module_unload().
2020-01-06 10:36:16 +00:00
int Process::sys$module_load(const char* user_path, size_t path_length)
Kernel: Implement very simple kernel module loading It's now possible to load a .o file into the kernel via a syscall. The kernel will perform all the necessary ELF relocations, and then call the "module_init" symbol in the loaded module.
2019-11-28 19:59:11 +00:00
{
if (!is_superuser())
return -EPERM;
Kernel: SMAP fixes for module_load() and module_unload() Remove SmapDisabler in module_load() + use get_syscall_path_argument(). Also fix a SMAP violation in module_unload().
2020-01-06 10:36:16 +00:00
ping: Use pledge()
2020-01-11 19:48:43 +00:00
REQUIRE_NO_PROMISES;
Kernel: SMAP fixes for module_load() and module_unload() Remove SmapDisabler in module_load() + use get_syscall_path_argument(). Also fix a SMAP violation in module_unload().
2020-01-06 10:36:16 +00:00
auto path = get_syscall_path_argument(user_path, path_length);
if (path.is_error())
return path.error();
Kernel: Pass correct permission flags when opening files Right now, permission flags passed to VFS::open() are effectively ignored, but that is going to change. * O_RDONLY is 0, but it's still nicer to pass it explicitly * POSIX says that binding a Unix socket to a symlink shall fail with EADDRINUSE
2020-01-18 22:04:48 +00:00
auto description_or_error = VFS::the().open(path.value(), O_RDONLY, 0, current_directory());
Kernel: Implement very simple kernel module loading It's now possible to load a .o file into the kernel via a syscall. The kernel will perform all the necessary ELF relocations, and then call the "module_init" symbol in the loaded module.
2019-11-28 19:59:11 +00:00
if (description_or_error.is_error())
return description_or_error.error();
auto& description = description_or_error.value();
auto payload = description->read_entire_file();
auto storage = KBuffer::create_with_size(payload.size());
memcpy(storage.data(), payload.data(), payload.size());
payload.clear();
LibELF: Move ELF classes into namespace ELF This is for consistency with other namespace changes that were made a while back to the other libraries :)
2020-04-11 18:24:07 +00:00
auto elf_image = make<ELF::Image>(storage.data(), storage.size());
Kernel: Implement very simple kernel module loading It's now possible to load a .o file into the kernel via a syscall. The kernel will perform all the necessary ELF relocations, and then call the "module_init" symbol in the loaded module.
2019-11-28 19:59:11 +00:00
if (!elf_image->parse())
return -ENOEXEC;
HashMap<String, u8*> section_storage_by_name;
auto module = make<Module>();
LibELF: Move ELF classes into namespace ELF This is for consistency with other namespace changes that were made a while back to the other libraries :)
2020-04-11 18:24:07 +00:00
elf_image->for_each_section_of_type(SHT_PROGBITS, [&](const ELF::Image::Section& section) {
Kernel: Ignore zero-length PROGBITS sections in sys$module_load()
2020-04-10 14:35:40 +00:00
if (!section.size())
return IterationDecision::Continue;
Kernel: Unbreak module loading (broke with NX bit changes) Modules are now mapped fully RWX. This can definitely be improved, but at least it unbreaks the feature for now.
2020-01-03 02:44:55 +00:00
auto section_storage = KBuffer::copy(section.raw_data(), section.size(), Region::Access::Read | Region::Access::Write | Region::Access::Execute);
Kernel: Implement very simple kernel module loading It's now possible to load a .o file into the kernel via a syscall. The kernel will perform all the necessary ELF relocations, and then call the "module_init" symbol in the loaded module.
2019-11-28 19:59:11 +00:00
section_storage_by_name.set(section.name(), section_storage.data());
module->sections.append(move(section_storage));
return IterationDecision::Continue;
});
Kernel: Fail module loading if any symbols can not be resolved
2019-12-24 03:09:18 +00:00
bool missing_symbols = false;
LibELF: Move ELF classes into namespace ELF This is for consistency with other namespace changes that were made a while back to the other libraries :)
2020-04-11 18:24:07 +00:00
elf_image->for_each_section_of_type(SHT_PROGBITS, [&](const ELF::Image::Section& section) {
Kernel: Ignore zero-length PROGBITS sections in sys$module_load()
2020-04-10 14:35:40 +00:00
if (!section.size())
return IterationDecision::Continue;
Kernel: Implement very simple kernel module loading It's now possible to load a .o file into the kernel via a syscall. The kernel will perform all the necessary ELF relocations, and then call the "module_init" symbol in the loaded module.
2019-11-28 19:59:11 +00:00
auto* section_storage = section_storage_by_name.get(section.name()).value_or(nullptr);
ASSERT(section_storage);
LibELF: Move ELF classes into namespace ELF This is for consistency with other namespace changes that were made a while back to the other libraries :)
2020-04-11 18:24:07 +00:00
section.relocations().for_each_relocation([&](const ELF::Image::Relocation& relocation) {
Kernel: Implement very simple kernel module loading It's now possible to load a .o file into the kernel via a syscall. The kernel will perform all the necessary ELF relocations, and then call the "module_init" symbol in the loaded module.
2019-11-28 19:59:11 +00:00
auto& patch_ptr = *reinterpret_cast<ptrdiff_t*>(section_storage + relocation.offset());
switch (relocation.type()) {
case R_386_PC32: {
// PC-relative relocation
dbg() << "PC-relative relocation: " << relocation.symbol().name();
Kernel: Allow modules to link against anything in kernel.map :^) We now use the symbols from kernel.map to link modules as they are loaded into the kernel. This is pretty fricken cool!
2019-11-28 20:30:20 +00:00
u32 symbol_address = address_for_kernel_symbol(relocation.symbol().name());
Kernel: Fail module loading if any symbols can not be resolved
2019-12-24 03:09:18 +00:00
if (symbol_address == 0)
missing_symbols = true;
Kernel: Implement very simple kernel module loading It's now possible to load a .o file into the kernel via a syscall. The kernel will perform all the necessary ELF relocations, and then call the "module_init" symbol in the loaded module.
2019-11-28 19:59:11 +00:00
dbg() << " Symbol address: " << (void*)symbol_address;
ptrdiff_t relative_offset = (char*)symbol_address - ((char*)&patch_ptr + 4);
patch_ptr = relative_offset;
break;
}
case R_386_32: // Absolute relocation
dbg() << "Absolute relocation: '" << relocation.symbol().name() << "' value:" << relocation.symbol().value() << ", index:" << relocation.symbol_index();
Kernel: Allow modules to link against anything in kernel.map :^) We now use the symbols from kernel.map to link modules as they are loaded into the kernel. This is pretty fricken cool!
2019-11-28 20:30:20 +00:00
if (relocation.symbol().bind() == STB_LOCAL) {
auto* section_storage_containing_symbol = section_storage_by_name.get(relocation.symbol().section().name()).value_or(nullptr);
ASSERT(section_storage_containing_symbol);
Kernel: Fail module loading if any symbols can not be resolved
2019-12-24 03:09:18 +00:00
u32 symbol_address = (ptrdiff_t)(section_storage_containing_symbol + relocation.symbol().value());
if (symbol_address == 0)
missing_symbols = true;
dbg() << " Symbol address: " << (void*)symbol_address;
patch_ptr += symbol_address;
Kernel: Allow modules to link against anything in kernel.map :^) We now use the symbols from kernel.map to link modules as they are loaded into the kernel. This is pretty fricken cool!
2019-11-28 20:30:20 +00:00
} else if (relocation.symbol().bind() == STB_GLOBAL) {
Kernel: Fail module loading if any symbols can not be resolved
2019-12-24 03:09:18 +00:00
u32 symbol_address = address_for_kernel_symbol(relocation.symbol().name());
if (symbol_address == 0)
missing_symbols = true;
dbg() << " Symbol address: " << (void*)symbol_address;
patch_ptr += symbol_address;
Kernel: Allow modules to link against anything in kernel.map :^) We now use the symbols from kernel.map to link modules as they are loaded into the kernel. This is pretty fricken cool!
2019-11-28 20:30:20 +00:00
} else {
ASSERT_NOT_REACHED();
}
Kernel: Implement very simple kernel module loading It's now possible to load a .o file into the kernel via a syscall. The kernel will perform all the necessary ELF relocations, and then call the "module_init" symbol in the loaded module.
2019-11-28 19:59:11 +00:00
break;
}
return IterationDecision::Continue;
});
return IterationDecision::Continue;
});
Kernel: Fail module loading if any symbols can not be resolved
2019-12-24 03:09:18 +00:00
if (missing_symbols)
Kernel: Do not return ENOENT for unresolved symbols ENOENT means "no such file or directory", not "no such symbol". Return EINVAL instead, as we already do in other cases.
2020-01-18 22:22:40 +00:00
return -EINVAL;
Kernel: Fail module loading if any symbols can not be resolved
2019-12-24 03:09:18 +00:00
Kernel: Implement very simple kernel module loading It's now possible to load a .o file into the kernel via a syscall. The kernel will perform all the necessary ELF relocations, and then call the "module_init" symbol in the loaded module.
2019-11-28 19:59:11 +00:00
auto* text_base = section_storage_by_name.get(".text").value_or(nullptr);
if (!text_base) {
dbg() << "No .text section found in module!";
return -EINVAL;
}
LibELF: Move ELF classes into namespace ELF This is for consistency with other namespace changes that were made a while back to the other libraries :)
2020-04-11 18:24:07 +00:00
elf_image->for_each_symbol([&](const ELF::Image::Symbol& symbol) {
Kernel: Implement very simple kernel module loading It's now possible to load a .o file into the kernel via a syscall. The kernel will perform all the necessary ELF relocations, and then call the "module_init" symbol in the loaded module.
2019-11-28 19:59:11 +00:00
dbg() << " - " << symbol.type() << " '" << symbol.name() << "' @ " << (void*)symbol.value() << ", size=" << symbol.size();
Kernel+LibELF: Don't blindly trust ELF symbol offsets in symbolication It was possible to craft a custom ELF executable that when symbolicated would cause the kernel to read from user-controlled addresses anywhere in memory. You could then fetch this memory via /proc/PID/stack We fix this by making ELFImage hand out StringView rather than raw const char* for symbol names. In case a symbol offset is outside the ELF image, you get a null StringView. :^) Test: Kernel/elf-symbolication-kernel-read-exploit.cpp
2020-01-16 21:04:44 +00:00
if (symbol.name() == "module_init") {
Kernel: Implement basic module unloading :^) Kernel modules can now be unloaded via a syscall. They get a chance to run some code of course. Before deallocating them, we call their "module_fini" symbol.
2019-11-28 20:07:22 +00:00
module->module_init = (ModuleInitPtr)(text_base + symbol.value());
Kernel+LibELF: Don't blindly trust ELF symbol offsets in symbolication It was possible to craft a custom ELF executable that when symbolicated would cause the kernel to read from user-controlled addresses anywhere in memory. You could then fetch this memory via /proc/PID/stack We fix this by making ELFImage hand out StringView rather than raw const char* for symbol names. In case a symbol offset is outside the ELF image, you get a null StringView. :^) Test: Kernel/elf-symbolication-kernel-read-exploit.cpp
2020-01-16 21:04:44 +00:00
} else if (symbol.name() == "module_fini") {
Kernel: Implement basic module unloading :^) Kernel modules can now be unloaded via a syscall. They get a chance to run some code of course. Before deallocating them, we call their "module_fini" symbol.
2019-11-28 20:07:22 +00:00
module->module_fini = (ModuleFiniPtr)(text_base + symbol.value());
Kernel+LibELF: Don't blindly trust ELF symbol offsets in symbolication It was possible to craft a custom ELF executable that when symbolicated would cause the kernel to read from user-controlled addresses anywhere in memory. You could then fetch this memory via /proc/PID/stack We fix this by making ELFImage hand out StringView rather than raw const char* for symbol names. In case a symbol offset is outside the ELF image, you get a null StringView. :^) Test: Kernel/elf-symbolication-kernel-read-exploit.cpp
2020-01-16 21:04:44 +00:00
} else if (symbol.name() == "module_name") {
Kernel: Have modules export their name in a "module_name" string This will show up in /proc/modules, and is also the name you can pass to the module_unload() syscall for unloading the module.
2019-11-29 20:31:17 +00:00
const u8* storage = section_storage_by_name.get(symbol.section().name()).value_or(nullptr);
if (storage)
module->name = String((const char*)(storage + symbol.value()));
Kernel: Implement very simple kernel module loading It's now possible to load a .o file into the kernel via a syscall. The kernel will perform all the necessary ELF relocations, and then call the "module_init" symbol in the loaded module.
2019-11-28 19:59:11 +00:00
}
return IterationDecision::Continue;
});
Kernel: Implement basic module unloading :^) Kernel modules can now be unloaded via a syscall. They get a chance to run some code of course. Before deallocating them, we call their "module_fini" symbol.
2019-11-28 20:07:22 +00:00
if (!module->module_init)
Kernel: Implement very simple kernel module loading It's now possible to load a .o file into the kernel via a syscall. The kernel will perform all the necessary ELF relocations, and then call the "module_init" symbol in the loaded module.
2019-11-28 19:59:11 +00:00
return -EINVAL;
Kernel: Disallow loading a module twice without explicitly unloading it This ensures that a module has the chance to run its cleanup functions before it's taken out of service.
2019-12-24 00:40:26 +00:00
if (g_modules->contains(module->name)) {
dbg() << "a module with the name " << module->name << " is already loaded; please unload it first";
return -EEXIST;
}
Kernel: Implement basic module unloading :^) Kernel modules can now be unloaded via a syscall. They get a chance to run some code of course. Before deallocating them, we call their "module_fini" symbol.
2019-11-28 20:07:22 +00:00
module->module_init();
Kernel: Implement very simple kernel module loading It's now possible to load a .o file into the kernel via a syscall. The kernel will perform all the necessary ELF relocations, and then call the "module_init" symbol in the loaded module.
2019-11-28 19:59:11 +00:00
auto name = module->name;
g_modules->set(name, move(module));
return 0;
}
Kernel: Use the Syscall string and buffer types more While I was updating syscalls to stop passing null-terminated strings, I added some helpful struct types: - StringArgument { const char*; size_t; } - ImmutableBuffer<Data, Size> { const Data*; Size; } - MutableBuffer<Data, Size> { Data*; Size; } The Process class has some convenience functions for validating and optionally extracting the contents from these structs: - get_syscall_path_argument(StringArgument) - validate_and_copy_string_from_user(StringArgument) - validate(ImmutableBuffer) - validate(MutableBuffer) There's still so much code around this and I'm wondering if we should generate most of it instead. Possible nice little project.
2020-01-11 11:47:47 +00:00
int Process::sys$module_unload(const char* user_name, size_t name_length)
Kernel: Implement very simple kernel module loading It's now possible to load a .o file into the kernel via a syscall. The kernel will perform all the necessary ELF relocations, and then call the "module_init" symbol in the loaded module.
2019-11-28 19:59:11 +00:00
{
if (!is_superuser())
return -EPERM;
Kernel: Implement basic module unloading :^) Kernel modules can now be unloaded via a syscall. They get a chance to run some code of course. Before deallocating them, we call their "module_fini" symbol.
2019-11-28 20:07:22 +00:00
ping: Use pledge()
2020-01-11 19:48:43 +00:00
REQUIRE_NO_PROMISES;
Kernel: Use the Syscall string and buffer types more While I was updating syscalls to stop passing null-terminated strings, I added some helpful struct types: - StringArgument { const char*; size_t; } - ImmutableBuffer<Data, Size> { const Data*; Size; } - MutableBuffer<Data, Size> { Data*; Size; } The Process class has some convenience functions for validating and optionally extracting the contents from these structs: - get_syscall_path_argument(StringArgument) - validate_and_copy_string_from_user(StringArgument) - validate(ImmutableBuffer) - validate(MutableBuffer) There's still so much code around this and I'm wondering if we should generate most of it instead. Possible nice little project.
2020-01-11 11:47:47 +00:00
auto module_name = validate_and_copy_string_from_user(user_name, name_length);
if (module_name.is_null())
return -EFAULT;
Kernel: SMAP fixes for module_load() and module_unload() Remove SmapDisabler in module_load() + use get_syscall_path_argument(). Also fix a SMAP violation in module_unload().
2020-01-06 10:36:16 +00:00
auto it = g_modules->find(module_name);
Kernel: Implement basic module unloading :^) Kernel modules can now be unloaded via a syscall. They get a chance to run some code of course. Before deallocating them, we call their "module_fini" symbol.
2019-11-28 20:07:22 +00:00
if (it == g_modules->end())
return -ENOENT;
if (it->value->module_fini)
it->value->module_fini();
g_modules->remove(it);
Kernel: Implement very simple kernel module loading It's now possible to load a .o file into the kernel via a syscall. The kernel will perform all the necessary ELF relocations, and then call the "module_init" symbol in the loaded module.
2019-11-28 19:59:11 +00:00
return 0;
}
Kernel: Implement a simple process time profiler The kernel now supports basic profiling of all the threads in a process by calling profiling_enable(pid_t). You finish the profiling by calling profiling_disable(pid_t). This all works by recording thread stacks when the timer interrupt fires and the current thread is in a process being profiled. Note that symbolication is deferred until profiling_disable() to avoid adding more noise than necessary to the profile. A simple "/bin/profile" command is included here that can be used to start/stop profiling like so: $ profile 10 on ... wait ... $ profile 10 off After a profile has been recorded, it can be fetched in /proc/profile There are various limits (or "bugs") on this mechanism at the moment: - Only one process can be profiled at a time. - We allocate 8MB for the samples, if you use more space, things will not work, and probably break a bit. - Things will probably fall apart if the profiled process dies during profiling, or while extracing /proc/profile
2019-12-11 19:36:56 +00:00
int Process::sys$profiling_enable(pid_t pid)
{
ping: Use pledge()
2020-01-11 19:48:43 +00:00
REQUIRE_NO_PROMISES;
Kernel: Implement a simple process time profiler The kernel now supports basic profiling of all the threads in a process by calling profiling_enable(pid_t). You finish the profiling by calling profiling_disable(pid_t). This all works by recording thread stacks when the timer interrupt fires and the current thread is in a process being profiled. Note that symbolication is deferred until profiling_disable() to avoid adding more noise than necessary to the profile. A simple "/bin/profile" command is included here that can be used to start/stop profiling like so: $ profile 10 on ... wait ... $ profile 10 off After a profile has been recorded, it can be fetched in /proc/profile There are various limits (or "bugs") on this mechanism at the moment: - Only one process can be profiled at a time. - We allocate 8MB for the samples, if you use more space, things will not work, and probably break a bit. - Things will probably fall apart if the profiled process dies during profiling, or while extracing /proc/profile
2019-12-11 19:36:56 +00:00
InterruptDisabler disabler;
auto* process = Process::from_pid(pid);
if (!process)
return -ESRCH;
Kernel: Don't allow profiling a dead process Work towards #1313.
2020-02-27 09:42:31 +00:00
if (process->is_dead())
return -ESRCH;
Kernel: Implement a simple process time profiler The kernel now supports basic profiling of all the threads in a process by calling profiling_enable(pid_t). You finish the profiling by calling profiling_disable(pid_t). This all works by recording thread stacks when the timer interrupt fires and the current thread is in a process being profiled. Note that symbolication is deferred until profiling_disable() to avoid adding more noise than necessary to the profile. A simple "/bin/profile" command is included here that can be used to start/stop profiling like so: $ profile 10 on ... wait ... $ profile 10 off After a profile has been recorded, it can be fetched in /proc/profile There are various limits (or "bugs") on this mechanism at the moment: - Only one process can be profiled at a time. - We allocate 8MB for the samples, if you use more space, things will not work, and probably break a bit. - Things will probably fall apart if the profiled process dies during profiling, or while extracing /proc/profile
2019-12-11 19:36:56 +00:00
if (!is_superuser() && process->uid() != m_uid)
return -EPERM;
Profiling::start(*process);
process->set_profiling(true);
return 0;
}
int Process::sys$profiling_disable(pid_t pid)
{
InterruptDisabler disabler;
auto* process = Process::from_pid(pid);
if (!process)
return -ESRCH;
if (!is_superuser() && process->uid() != m_uid)
return -EPERM;
process->set_profiling(false);
Profiling::stop();
return 0;
}
Kernel+LibC: Publish a "kernel info page" and use it for gettimeofday() This patch adds a single "kernel info page" that is mappable read-only by any process and contains the current time of day. This is then used to implement a version of gettimeofday() that doesn't have to make a syscall. To protect against race condition issues, the info page also has a serial number which is incremented whenever the kernel updates the contents of the page. Make sure to verify that the serial number is the same before and after reading the information you want from the page.
2019-12-15 20:29:26 +00:00
void* Process::sys$get_kernel_info_page()
{
Kernel: Put some more syscalls in the "stdio" bucket yield() and get_kernel_info_page() seem like decent fits for "stdio".
2020-01-12 09:30:02 +00:00
REQUIRE_PROMISE(stdio);
Kernel: Make sure the kernel info page is read-only for userspace To enforce this, we create two separate mappings of the same underlying physical page. A writable mapping for the kernel, and a read-only one for userspace (the one returned by sys$get_kernel_info_page.)
2019-12-15 21:21:28 +00:00
return s_info_page_address_for_userspace.as_ptr();
Kernel+LibC: Publish a "kernel info page" and use it for gettimeofday() This patch adds a single "kernel info page" that is mappable read-only by any process and contains the current time of day. This is then used to implement a version of gettimeofday() that doesn't have to make a syscall. To protect against race condition issues, the info page also has a serial number which is incremented whenever the kernel updates the contents of the page. Make sure to verify that the serial number is the same before and after reading the information you want from the page.
2019-12-15 20:29:26 +00:00
}
Kernel: Get rid of "main thread" concept The idea of all processes reliably having a main thread was nice in some ways, but cumbersome in others. More importantly, it didn't match up with POSIX thread semantics, so let's move away from it. This thread gets rid of Process::main_thread() and you now we just have a bunch of Thread objects floating around each Process. When the finalizer nukes the last Thread in a Process, it will also tear down the Process. There's a bunch of more things to fix around this, but this is where we get started :^)
2019-12-22 10:35:02 +00:00
Thread& Process::any_thread()
{
Thread* found_thread = nullptr;
for_each_thread([&](auto& thread) {
found_thread = &thread;
return IterationDecision::Break;
});
ASSERT(found_thread);
return *found_thread;
}
Kernel+LibPthread+LibC: Add a naive futex and use it for pthread_cond_t This patch implements a simple version of the futex (fast userspace mutex) API in the kernel and uses it to make the pthread_cond_t API's block instead of busily sched_yield(). An arbitrary userspace address is passed to the kernel as a "token" that identifies the futex and you can then FUTEX_WAIT and FUTEX_WAKE that specific userspace address. FUTEX_WAIT corresponds to pthread_cond_wait() and FUTEX_WAKE is used for pthread_cond_signal() and pthread_cond_broadcast(). I'm pretty sure I'm missing something in this implementation, but it's hopefully okay for a start. :^)
2019-12-22 20:29:47 +00:00
WaitQueue& Process::futex_queue(i32* userspace_address)
{
AK: Add global FlatPtr typedef. It's u32 or u64, based on sizeof(void*) Use this instead of uintptr_t throughout the codebase. This makes it possible to pass a FlatPtr to something that has u32 and u64 overloads.
2020-03-08 09:36:51 +00:00
auto& queue = m_futex_queues.ensure((FlatPtr)userspace_address);
Kernel+LibPthread+LibC: Add a naive futex and use it for pthread_cond_t This patch implements a simple version of the futex (fast userspace mutex) API in the kernel and uses it to make the pthread_cond_t API's block instead of busily sched_yield(). An arbitrary userspace address is passed to the kernel as a "token" that identifies the futex and you can then FUTEX_WAIT and FUTEX_WAKE that specific userspace address. FUTEX_WAIT corresponds to pthread_cond_wait() and FUTEX_WAKE is used for pthread_cond_signal() and pthread_cond_broadcast(). I'm pretty sure I'm missing something in this implementation, but it's hopefully okay for a start. :^)
2019-12-22 20:29:47 +00:00
if (!queue)
queue = make<WaitQueue>();
return *queue;
}
Kernel: Remove SmapDisabler in futex()
2020-01-06 10:44:15 +00:00
int Process::sys$futex(const Syscall::SC_futex_params* user_params)
Kernel+LibPthread+LibC: Add a naive futex and use it for pthread_cond_t This patch implements a simple version of the futex (fast userspace mutex) API in the kernel and uses it to make the pthread_cond_t API's block instead of busily sched_yield(). An arbitrary userspace address is passed to the kernel as a "token" that identifies the futex and you can then FUTEX_WAIT and FUTEX_WAKE that specific userspace address. FUTEX_WAIT corresponds to pthread_cond_wait() and FUTEX_WAKE is used for pthread_cond_signal() and pthread_cond_broadcast(). I'm pretty sure I'm missing something in this implementation, but it's hopefully okay for a start. :^)
2019-12-22 20:29:47 +00:00
{
Kernel: Require the "thread" pledge promise for futex()
2020-01-12 09:27:42 +00:00
REQUIRE_PROMISE(thread);
Kernel+LibPthread+LibC: Add a naive futex and use it for pthread_cond_t This patch implements a simple version of the futex (fast userspace mutex) API in the kernel and uses it to make the pthread_cond_t API's block instead of busily sched_yield(). An arbitrary userspace address is passed to the kernel as a "token" that identifies the futex and you can then FUTEX_WAIT and FUTEX_WAKE that specific userspace address. FUTEX_WAIT corresponds to pthread_cond_wait() and FUTEX_WAKE is used for pthread_cond_signal() and pthread_cond_broadcast(). I'm pretty sure I'm missing something in this implementation, but it's hopefully okay for a start. :^)
2019-12-22 20:29:47 +00:00
Kernel: Remove SmapDisabler in futex()
2020-01-06 10:44:15 +00:00
Syscall::SC_futex_params params;
Kernel: Combine validate and copy of user mode pointers (#1069) Right now there is a significant amount of boiler plate code required to validate user mode parameters in syscalls. In an attempt to reduce this a bit, introduce validate_read_and_copy_typed which combines the usermode address check and does the copy internally if the validation passes. This cleans up a little bit of code from a significant amount of syscalls.
2020-01-13 10:19:18 +00:00
if (!validate_read_and_copy_typed(&params, user_params))
return -EFAULT;
Kernel: Start implementing x86 SMAP support Supervisor Mode Access Prevention (SMAP) is an x86 CPU feature that prevents the kernel from accessing userspace memory. With SMAP enabled, trying to read/write a userspace memory address while in the kernel will now generate a page fault. Since it's sometimes necessary to read/write userspace memory, there are two new instructions that quickly switch the protection on/off: STAC (disables protection) and CLAC (enables protection.) These are exposed in kernel code via the stac() and clac() helpers. There's also a SmapDisabler RAII object that can be used to ensure that you don't forget to re-enable protection before returning to userspace code. THis patch also adds copy_to_user(), copy_from_user() and memset_user() which are the "correct" way of doing things. These functions allow us to briefly disable protection for a specific purpose, and then turn it back on immediately after it's done. Going forward all kernel code should be moved to using these and all uses of SmapDisabler are to be considered FIXME's. Note that we're not realizing the full potential of this feature since I've used SmapDisabler quite liberally in this initial bring-up patch.
2020-01-05 17:00:15 +00:00
Kernel: Remove SmapDisabler in futex()
2020-01-06 10:44:15 +00:00
i32* userspace_address = params.userspace_address;
int futex_op = params.futex_op;
i32 value = params.val;
const timespec* user_timeout = params.timeout;
Kernel+LibPthread+LibC: Add a naive futex and use it for pthread_cond_t This patch implements a simple version of the futex (fast userspace mutex) API in the kernel and uses it to make the pthread_cond_t API's block instead of busily sched_yield(). An arbitrary userspace address is passed to the kernel as a "token" that identifies the futex and you can then FUTEX_WAIT and FUTEX_WAKE that specific userspace address. FUTEX_WAIT corresponds to pthread_cond_wait() and FUTEX_WAKE is used for pthread_cond_signal() and pthread_cond_broadcast(). I'm pretty sure I'm missing something in this implementation, but it's hopefully okay for a start. :^)
2019-12-22 20:29:47 +00:00
if (!validate_read_typed(userspace_address))
return -EFAULT;
Kernel: Remove SmapDisabler in futex()
2020-01-06 10:44:15 +00:00
if (user_timeout && !validate_read_typed(user_timeout))
Kernel+LibPthread+LibC: Add a naive futex and use it for pthread_cond_t This patch implements a simple version of the futex (fast userspace mutex) API in the kernel and uses it to make the pthread_cond_t API's block instead of busily sched_yield(). An arbitrary userspace address is passed to the kernel as a "token" that identifies the futex and you can then FUTEX_WAIT and FUTEX_WAKE that specific userspace address. FUTEX_WAIT corresponds to pthread_cond_wait() and FUTEX_WAKE is used for pthread_cond_signal() and pthread_cond_broadcast(). I'm pretty sure I'm missing something in this implementation, but it's hopefully okay for a start. :^)
2019-12-22 20:29:47 +00:00
return -EFAULT;
Kernel: Remove SmapDisabler in futex()
2020-01-06 10:44:15 +00:00
timespec timeout { 0, 0 };
if (user_timeout)
Kernel: Use the templated copy_from_user where possible Now that the templated version of copy_from_user exists their is normally no reason to use the version which takes the number of bytes to copy. Move to the templated version where possible.
2020-01-13 07:00:35 +00:00
copy_from_user(&timeout, user_timeout);
Kernel: Remove SmapDisabler in futex()
2020-01-06 10:44:15 +00:00
i32 user_value;
Kernel+LibPthread+LibC: Add a naive futex and use it for pthread_cond_t This patch implements a simple version of the futex (fast userspace mutex) API in the kernel and uses it to make the pthread_cond_t API's block instead of busily sched_yield(). An arbitrary userspace address is passed to the kernel as a "token" that identifies the futex and you can then FUTEX_WAIT and FUTEX_WAKE that specific userspace address. FUTEX_WAIT corresponds to pthread_cond_wait() and FUTEX_WAKE is used for pthread_cond_signal() and pthread_cond_broadcast(). I'm pretty sure I'm missing something in this implementation, but it's hopefully okay for a start. :^)
2019-12-22 20:29:47 +00:00
switch (futex_op) {
case FUTEX_WAIT:
Kernel: Use the templated copy_from_user where possible Now that the templated version of copy_from_user exists their is normally no reason to use the version which takes the number of bytes to copy. Move to the templated version where possible.
2020-01-13 07:00:35 +00:00
copy_from_user(&user_value, userspace_address);
Kernel: Remove SmapDisabler in futex()
2020-01-06 10:44:15 +00:00
if (user_value != value)
Kernel+LibPthread+LibC: Add a naive futex and use it for pthread_cond_t This patch implements a simple version of the futex (fast userspace mutex) API in the kernel and uses it to make the pthread_cond_t API's block instead of busily sched_yield(). An arbitrary userspace address is passed to the kernel as a "token" that identifies the futex and you can then FUTEX_WAIT and FUTEX_WAKE that specific userspace address. FUTEX_WAIT corresponds to pthread_cond_wait() and FUTEX_WAKE is used for pthread_cond_signal() and pthread_cond_broadcast(). I'm pretty sure I'm missing something in this implementation, but it's hopefully okay for a start. :^)
2019-12-22 20:29:47 +00:00
return -EAGAIN;
// FIXME: This is supposed to be interruptible by a signal, but right now WaitQueue cannot be interrupted.
// FIXME: Support timeout!
Kernel: Replace "current" with Thread::current and Process::current Suggested by Sergey. The currently running Thread and Process are now Thread::current and Process::current respectively. :^)
2020-02-17 14:04:27 +00:00
Thread::current->wait_on(futex_queue(userspace_address));
Kernel+LibPthread+LibC: Add a naive futex and use it for pthread_cond_t This patch implements a simple version of the futex (fast userspace mutex) API in the kernel and uses it to make the pthread_cond_t API's block instead of busily sched_yield(). An arbitrary userspace address is passed to the kernel as a "token" that identifies the futex and you can then FUTEX_WAIT and FUTEX_WAKE that specific userspace address. FUTEX_WAIT corresponds to pthread_cond_wait() and FUTEX_WAKE is used for pthread_cond_signal() and pthread_cond_broadcast(). I'm pretty sure I'm missing something in this implementation, but it's hopefully okay for a start. :^)
2019-12-22 20:29:47 +00:00
break;
case FUTEX_WAKE:
if (value == 0)
return 0;
if (value == 1) {
futex_queue(userspace_address).wake_one();
} else {
// FIXME: Wake exactly (value) waiters.
futex_queue(userspace_address).wake_all();
}
break;
}
return 0;
}
Kernel: Add a basic thread boosting mechanism This patch introduces a syscall: int set_thread_boost(int tid, int amount) You can use this to add a permanent boost value to the effective thread priority of any thread with your UID (or any thread in the system if you are the superuser.) This is quite crude, but opens up some interesting opportunities. :^)
2019-12-30 18:23:13 +00:00
int Process::sys$set_thread_boost(int tid, int amount)
{
ping: Use pledge()
2020-01-11 19:48:43 +00:00
REQUIRE_PROMISE(proc);
Kernel: Add a basic thread boosting mechanism This patch introduces a syscall: int set_thread_boost(int tid, int amount) You can use this to add a permanent boost value to the effective thread priority of any thread with your UID (or any thread in the system if you are the superuser.) This is quite crude, but opens up some interesting opportunities. :^)
2019-12-30 18:23:13 +00:00
if (amount < 0 || amount > 20)
return -EINVAL;
InterruptDisabler disabler;
auto* thread = Thread::from_tid(tid);
if (!thread)
return -ESRCH;
if (thread->state() == Thread::State::Dead || thread->state() == Thread::State::Dying)
return -ESRCH;
if (!is_superuser() && thread->process().uid() != euid())
return -EPERM;
thread->set_priority_boost(amount);
return 0;
}
Kernel: Also add a process boosting mechanism Let's also have set_process_boost() for giving all threads in a process the same boost.
2019-12-30 19:10:00 +00:00
int Process::sys$set_process_boost(pid_t pid, int amount)
{
ping: Use pledge()
2020-01-11 19:48:43 +00:00
REQUIRE_PROMISE(proc);
Kernel: Also add a process boosting mechanism Let's also have set_process_boost() for giving all threads in a process the same boost.
2019-12-30 19:10:00 +00:00
if (amount < 0 || amount > 20)
return -EINVAL;
InterruptDisabler disabler;
auto* process = Process::from_pid(pid);
if (!process || process->is_dead())
return -ESRCH;
if (!is_superuser() && process->uid() != euid())
return -EPERM;
process->m_priority_boost = amount;
return 0;
}
Kernel: Add a basic chroot() syscall :^) The chroot() syscall now allows the superuser to isolate a process into a specific subtree of the filesystem. This is not strictly permanent, as it is also possible for a superuser to break *out* of a chroot, but it is a useful mechanism for isolating unprivileged processes. The VFS now uses the current process's root_directory() as the root for path resolution purposes. The root directory is stored as an uncached Custody in the Process object.
2020-01-10 22:14:04 +00:00
Kernel: Don't forget to copy & destroy root_directory_for_procfs Also, rename it to root_directory_relative_to_global_root.
2020-01-12 18:42:01 +00:00
int Process::sys$chroot(const char* user_path, size_t path_length, int mount_flags)
Kernel: Add a basic chroot() syscall :^) The chroot() syscall now allows the superuser to isolate a process into a specific subtree of the filesystem. This is not strictly permanent, as it is also possible for a superuser to break *out* of a chroot, but it is a useful mechanism for isolating unprivileged processes. The VFS now uses the current process's root_directory() as the root for path resolution purposes. The root directory is stored as an uncached Custody in the Process object.
2020-01-10 22:14:04 +00:00
{
if (!is_superuser())
return -EPERM;
ping: Use pledge()
2020-01-11 19:48:43 +00:00
REQUIRE_PROMISE(chroot);
Kernel: Add a basic chroot() syscall :^) The chroot() syscall now allows the superuser to isolate a process into a specific subtree of the filesystem. This is not strictly permanent, as it is also possible for a superuser to break *out* of a chroot, but it is a useful mechanism for isolating unprivileged processes. The VFS now uses the current process's root_directory() as the root for path resolution purposes. The root directory is stored as an uncached Custody in the Process object.
2020-01-10 22:14:04 +00:00
auto path = get_syscall_path_argument(user_path, path_length);
if (path.is_error())
return path.error();
auto directory_or_error = VFS::the().open_directory(path.value(), current_directory());
if (directory_or_error.is_error())
return directory_or_error.error();
Kernel+LibC: Add support for mount flags At the moment, the actual flags are ignored, but we correctly propagate them all the way from the original mount() syscall to each custody that resides on the mounted FS.
2020-01-11 15:25:26 +00:00
auto directory = directory_or_error.value();
Kernel+LibC: Allow passing mount flags to chroot() Since a chroot is in many ways similar to a separate root mount, we can also apply mount flags to it as if it was an actual mount. These flags will apply whenever the chrooted process accesses its root directory, but not when other processes access this same directory for the outside. Since it's common to chdir("/") immediately after chrooting (so that files accessed through the current directory inherit the same mount flags), this effectively allows one to apply additional limitations to a process confined inside a chroot. To this effect, sys$chroot() gains a mount_flags argument (exposed as chroot_with_mount_flags() in userspace) which can be set to all the same values as the flags argument for sys$mount(), and additionally to -1 to keep the flags set for that file system. Note that passing 0 as mount_flags will unset any flags that may have been set for the file system, not keep them.
2020-01-12 18:03:42 +00:00
m_root_directory_relative_to_global_root = directory;
int chroot_mount_flags = mount_flags == -1 ? directory->mount_flags() : mount_flags;
set_root_directory(Custody::create(nullptr, "", directory->inode(), chroot_mount_flags));
Kernel: Add a basic chroot() syscall :^) The chroot() syscall now allows the superuser to isolate a process into a specific subtree of the filesystem. This is not strictly permanent, as it is also possible for a superuser to break *out* of a chroot, but it is a useful mechanism for isolating unprivileged processes. The VFS now uses the current process's root_directory() as the root for path resolution purposes. The root directory is stored as an uncached Custody in the Process object.
2020-01-10 22:14:04 +00:00
return 0;
}
Custody& Process::root_directory()
{
if (!m_root_directory)
m_root_directory = VFS::the().root_custody();
return *m_root_directory;
}
Kernel: Don't forget to copy & destroy root_directory_for_procfs Also, rename it to root_directory_relative_to_global_root.
2020-01-12 18:42:01 +00:00
Custody& Process::root_directory_relative_to_global_root()
Kernel: Expose a process's filesystem root as a /proc/PID/root symlink In order to preserve the absolute path of the process root, we save the custody used by chroot() before stripping it to become the new "/". There's probably a better way to do this.
2020-01-10 22:48:44 +00:00
{
Kernel: Don't forget to copy & destroy root_directory_for_procfs Also, rename it to root_directory_relative_to_global_root.
2020-01-12 18:42:01 +00:00
if (!m_root_directory_relative_to_global_root)
m_root_directory_relative_to_global_root = root_directory();
return *m_root_directory_relative_to_global_root;
Kernel: Expose a process's filesystem root as a /proc/PID/root symlink In order to preserve the absolute path of the process root, we save the custody used by chroot() before stripping it to become the new "/". There's probably a better way to do this.
2020-01-10 22:48:44 +00:00
}
Kernel: Add a basic chroot() syscall :^) The chroot() syscall now allows the superuser to isolate a process into a specific subtree of the filesystem. This is not strictly permanent, as it is also possible for a superuser to break *out* of a chroot, but it is a useful mechanism for isolating unprivileged processes. The VFS now uses the current process's root_directory() as the root for path resolution purposes. The root directory is stored as an uncached Custody in the Process object.
2020-01-10 22:14:04 +00:00
void Process::set_root_directory(const Custody& root)
{
m_root_directory = root;
}
ping: Use pledge()
2020-01-11 19:48:43 +00:00
int Process::sys$pledge(const Syscall::SC_pledge_params* user_params)
{
Syscall::SC_pledge_params params;
Kernel: Combine validate and copy of user mode pointers (#1069) Right now there is a significant amount of boiler plate code required to validate user mode parameters in syscalls. In an attempt to reduce this a bit, introduce validate_read_and_copy_typed which combines the usermode address check and does the copy internally if the validation passes. This cleans up a little bit of code from a significant amount of syscalls.
2020-01-13 10:19:18 +00:00
if (!validate_read_and_copy_typed(&params, user_params))
return -EFAULT;
ping: Use pledge()
2020-01-11 19:48:43 +00:00
if (params.promises.length > 1024 || params.execpromises.length > 1024)
return -E2BIG;
String promises;
if (params.promises.characters) {
promises = validate_and_copy_string_from_user(params.promises);
if (promises.is_null())
return -EFAULT;
}
String execpromises;
if (params.execpromises.characters) {
execpromises = validate_and_copy_string_from_user(params.execpromises);
if (execpromises.is_null())
return -EFAULT;
}
auto parse_pledge = [&](auto& pledge_spec, u32& mask) {
auto parts = pledge_spec.split_view(' ');
for (auto& part : parts) {
#define __ENUMERATE_PLEDGE_PROMISE(x) \
if (part == #x) { \
mask |= (1u << (u32)Pledge::x); \
continue; \
}
ENUMERATE_PLEDGE_PROMISES
#undef __ENUMERATE_PLEDGE_PROMISE
if (part == "dns") {
// "dns" is an alias for "unix" since DNS queries go via LookupServer
mask |= (1u << (u32)Pledge::unix);
continue;
}
return false;
}
return true;
};
if (!promises.is_null()) {
u32 new_promises = 0;
if (!parse_pledge(promises, new_promises))
return -EINVAL;
Kernel: Clearing promises with pledge("") should fail Thanks Sergey for catching this brain-fart. :^)
2020-01-12 11:14:08 +00:00
if (m_promises && (!new_promises || new_promises & ~m_promises))
ping: Use pledge()
2020-01-11 19:48:43 +00:00
return -EPERM;
m_promises = new_promises;
}
if (!execpromises.is_null()) {
u32 new_execpromises = 0;
if (!parse_pledge(execpromises, new_execpromises))
return -EINVAL;
Kernel: Clearing promises with pledge("") should fail Thanks Sergey for catching this brain-fart. :^)
2020-01-12 11:14:08 +00:00
if (m_execpromises && (!new_execpromises || new_execpromises & ~m_execpromises))
ping: Use pledge()
2020-01-11 19:48:43 +00:00
return -EPERM;
m_execpromises = new_execpromises;
}
return 0;
}
Kernel: Add a Process::add_region() helper This is a private helper for adding a Region to Process::m_regions. It's just for convenience since it's a bit cumbersome to do this.
2020-01-19 15:25:38 +00:00
Region& Process::add_region(NonnullOwnPtr<Region> region)
{
auto* ptr = region.ptr();
m_regions.append(move(region));
return *ptr;
}
Kernel: Add a basic implementation of unveil() This syscall is a complement to pledge() and adds the same sort of incremental relinquishing of capabilities for filesystem access. The first call to unveil() will "drop a veil" on the process, and from now on, only unveiled parts of the filesystem are visible to it. Each call to unveil() specifies a path to either a directory or a file along with permissions for that path. The permissions are a combination of the following: - r: Read access (like the "rpath" promise) - w: Write access (like the "wpath" promise) - x: Execute access - c: Create/remove access (like the "cpath" promise) Attempts to open a path that has not been unveiled with fail with ENOENT. If the unveiled path lacks sufficient permissions, it will fail with EACCES. Like pledge(), subsequent calls to unveil() with the same path can only remove permissions, not add them. Once you call unveil(nullptr, nullptr), the veil is locked, and it's no longer possible to unveil any more paths for the process, ever. This concept comes from OpenBSD, and their implementation does various things differently, I'm sure. This is just a first implementation for SerenityOS, and we'll keep improving on it as we go. :^)
2020-01-20 21:12:04 +00:00
int Process::sys$unveil(const Syscall::SC_unveil_params* user_params)
{
Syscall::SC_unveil_params params;
if (!validate_read_and_copy_typed(&params, user_params))
return -EFAULT;
if (!params.path.characters && !params.permissions.characters) {
Kernel: Rename UnveilState to VeilState
2020-01-21 18:28:29 +00:00
m_veil_state = VeilState::Locked;
Kernel: Add a basic implementation of unveil() This syscall is a complement to pledge() and adds the same sort of incremental relinquishing of capabilities for filesystem access. The first call to unveil() will "drop a veil" on the process, and from now on, only unveiled parts of the filesystem are visible to it. Each call to unveil() specifies a path to either a directory or a file along with permissions for that path. The permissions are a combination of the following: - r: Read access (like the "rpath" promise) - w: Write access (like the "wpath" promise) - x: Execute access - c: Create/remove access (like the "cpath" promise) Attempts to open a path that has not been unveiled with fail with ENOENT. If the unveiled path lacks sufficient permissions, it will fail with EACCES. Like pledge(), subsequent calls to unveil() with the same path can only remove permissions, not add them. Once you call unveil(nullptr, nullptr), the veil is locked, and it's no longer possible to unveil any more paths for the process, ever. This concept comes from OpenBSD, and their implementation does various things differently, I'm sure. This is just a first implementation for SerenityOS, and we'll keep improving on it as we go. :^)
2020-01-20 21:12:04 +00:00
return 0;
}
Kernel: Rename UnveilState to VeilState
2020-01-21 18:28:29 +00:00
if (m_veil_state == VeilState::Locked)
Kernel: Add a basic implementation of unveil() This syscall is a complement to pledge() and adds the same sort of incremental relinquishing of capabilities for filesystem access. The first call to unveil() will "drop a veil" on the process, and from now on, only unveiled parts of the filesystem are visible to it. Each call to unveil() specifies a path to either a directory or a file along with permissions for that path. The permissions are a combination of the following: - r: Read access (like the "rpath" promise) - w: Write access (like the "wpath" promise) - x: Execute access - c: Create/remove access (like the "cpath" promise) Attempts to open a path that has not been unveiled with fail with ENOENT. If the unveiled path lacks sufficient permissions, it will fail with EACCES. Like pledge(), subsequent calls to unveil() with the same path can only remove permissions, not add them. Once you call unveil(nullptr, nullptr), the veil is locked, and it's no longer possible to unveil any more paths for the process, ever. This concept comes from OpenBSD, and their implementation does various things differently, I'm sure. This is just a first implementation for SerenityOS, and we'll keep improving on it as we go. :^)
2020-01-20 21:12:04 +00:00
return -EPERM;
if (!params.path.characters || !params.permissions.characters)
return -EINVAL;
if (params.permissions.length > 4)
return -EINVAL;
auto path = get_syscall_path_argument(params.path);
if (path.is_error())
return path.error();
if (path.value().is_empty() || path.value().characters()[0] != '/')
return -EINVAL;
Kernel: Resolve relative paths when there is a veil (#1474)
2020-03-19 08:57:34 +00:00
auto custody_or_error = VFS::the().resolve_path_without_veil(path.value(), root_directory());
if (custody_or_error.is_error())
// FIXME Should this be EINVAL?
return custody_or_error.error();
auto& custody = custody_or_error.value();
auto new_unveiled_path = custody->absolute_path();
Kernel: Add a basic implementation of unveil() This syscall is a complement to pledge() and adds the same sort of incremental relinquishing of capabilities for filesystem access. The first call to unveil() will "drop a veil" on the process, and from now on, only unveiled parts of the filesystem are visible to it. Each call to unveil() specifies a path to either a directory or a file along with permissions for that path. The permissions are a combination of the following: - r: Read access (like the "rpath" promise) - w: Write access (like the "wpath" promise) - x: Execute access - c: Create/remove access (like the "cpath" promise) Attempts to open a path that has not been unveiled with fail with ENOENT. If the unveiled path lacks sufficient permissions, it will fail with EACCES. Like pledge(), subsequent calls to unveil() with the same path can only remove permissions, not add them. Once you call unveil(nullptr, nullptr), the veil is locked, and it's no longer possible to unveil any more paths for the process, ever. This concept comes from OpenBSD, and their implementation does various things differently, I'm sure. This is just a first implementation for SerenityOS, and we'll keep improving on it as we go. :^)
2020-01-20 21:12:04 +00:00
auto permissions = validate_and_copy_string_from_user(params.permissions);
if (permissions.is_null())
return -EFAULT;
unsigned new_permissions = 0;
for (size_t i = 0; i < permissions.length(); ++i) {
switch (permissions[i]) {
case 'r':
new_permissions |= UnveiledPath::Access::Read;
break;
case 'w':
new_permissions |= UnveiledPath::Access::Write;
break;
case 'x':
new_permissions |= UnveiledPath::Access::Execute;
break;
case 'c':
new_permissions |= UnveiledPath::Access::CreateOrRemove;
break;
default:
return -EINVAL;
}
}
AK: Make Vector use size_t for its size and capacity
2020-02-25 13:49:47 +00:00
for (size_t i = 0; i < m_unveiled_paths.size(); ++i) {
Kernel: Add a basic implementation of unveil() This syscall is a complement to pledge() and adds the same sort of incremental relinquishing of capabilities for filesystem access. The first call to unveil() will "drop a veil" on the process, and from now on, only unveiled parts of the filesystem are visible to it. Each call to unveil() specifies a path to either a directory or a file along with permissions for that path. The permissions are a combination of the following: - r: Read access (like the "rpath" promise) - w: Write access (like the "wpath" promise) - x: Execute access - c: Create/remove access (like the "cpath" promise) Attempts to open a path that has not been unveiled with fail with ENOENT. If the unveiled path lacks sufficient permissions, it will fail with EACCES. Like pledge(), subsequent calls to unveil() with the same path can only remove permissions, not add them. Once you call unveil(nullptr, nullptr), the veil is locked, and it's no longer possible to unveil any more paths for the process, ever. This concept comes from OpenBSD, and their implementation does various things differently, I'm sure. This is just a first implementation for SerenityOS, and we'll keep improving on it as we go. :^)
2020-01-20 21:12:04 +00:00
auto& unveiled_path = m_unveiled_paths[i];
Kernel: Resolve relative paths when there is a veil (#1474)
2020-03-19 08:57:34 +00:00
if (unveiled_path.path == new_unveiled_path) {
Kernel: Add a basic implementation of unveil() This syscall is a complement to pledge() and adds the same sort of incremental relinquishing of capabilities for filesystem access. The first call to unveil() will "drop a veil" on the process, and from now on, only unveiled parts of the filesystem are visible to it. Each call to unveil() specifies a path to either a directory or a file along with permissions for that path. The permissions are a combination of the following: - r: Read access (like the "rpath" promise) - w: Write access (like the "wpath" promise) - x: Execute access - c: Create/remove access (like the "cpath" promise) Attempts to open a path that has not been unveiled with fail with ENOENT. If the unveiled path lacks sufficient permissions, it will fail with EACCES. Like pledge(), subsequent calls to unveil() with the same path can only remove permissions, not add them. Once you call unveil(nullptr, nullptr), the veil is locked, and it's no longer possible to unveil any more paths for the process, ever. This concept comes from OpenBSD, and their implementation does various things differently, I'm sure. This is just a first implementation for SerenityOS, and we'll keep improving on it as we go. :^)
2020-01-20 21:12:04 +00:00
if (new_permissions & ~unveiled_path.permissions)
return -EPERM;
unveiled_path.permissions = new_permissions;
return 0;
}
}
Kernel: Resolve relative paths when there is a veil (#1474)
2020-03-19 08:57:34 +00:00
m_unveiled_paths.append({ new_unveiled_path, new_permissions });
Kernel: Rename UnveilState to VeilState
2020-01-21 18:28:29 +00:00
ASSERT(m_veil_state != VeilState::Locked);
m_veil_state = VeilState::Dropped;
Kernel: Add a basic implementation of unveil() This syscall is a complement to pledge() and adds the same sort of incremental relinquishing of capabilities for filesystem access. The first call to unveil() will "drop a veil" on the process, and from now on, only unveiled parts of the filesystem are visible to it. Each call to unveil() specifies a path to either a directory or a file along with permissions for that path. The permissions are a combination of the following: - r: Read access (like the "rpath" promise) - w: Write access (like the "wpath" promise) - x: Execute access - c: Create/remove access (like the "cpath" promise) Attempts to open a path that has not been unveiled with fail with ENOENT. If the unveiled path lacks sufficient permissions, it will fail with EACCES. Like pledge(), subsequent calls to unveil() with the same path can only remove permissions, not add them. Once you call unveil(nullptr, nullptr), the veil is locked, and it's no longer possible to unveil any more paths for the process, ever. This concept comes from OpenBSD, and their implementation does various things differently, I'm sure. This is just a first implementation for SerenityOS, and we'll keep improving on it as we go. :^)
2020-01-20 21:12:04 +00:00
return 0;
}
Kernel: Start working on a syscall for logging performance events This patch introduces sys$perf_event() with two event types: - PERF_EVENT_MALLOC - PERF_EVENT_FREE After the first call to sys$perf_event(), a process will begin keeping these events in a buffer. When the process dies, that buffer will be written out to "perfcore" in the current directory unless that filename is already taken. This is probably not the best way to do this, but it's a start and will make it possible to start doing memory allocation profiling. :^)
2020-02-02 19:26:27 +00:00
AK: Add global FlatPtr typedef. It's u32 or u64, based on sizeof(void*) Use this instead of uintptr_t throughout the codebase. This makes it possible to pass a FlatPtr to something that has u32 and u64 overloads.
2020-03-08 09:36:51 +00:00
int Process::sys$perf_event(int type, FlatPtr arg1, FlatPtr arg2)
Kernel: Start working on a syscall for logging performance events This patch introduces sys$perf_event() with two event types: - PERF_EVENT_MALLOC - PERF_EVENT_FREE After the first call to sys$perf_event(), a process will begin keeping these events in a buffer. When the process dies, that buffer will be written out to "perfcore" in the current directory unless that filename is already taken. This is probably not the best way to do this, but it's a start and will make it possible to start doing memory allocation profiling. :^)
2020-02-02 19:26:27 +00:00
{
if (!m_perf_event_buffer)
m_perf_event_buffer = make<PerformanceEventBuffer>();
return m_perf_event_buffer->append(type, arg1, arg2);
}
Kernel: Move all code into the Kernel namespace
2020-02-16 00:27:42 +00:00
Kernel: Reduce header dependencies of Process and Thread
2020-02-16 01:01:42 +00:00
void Process::set_tty(TTY* tty)
{
m_tty = tty;
}
Kernel: Load executables on demand when symbolicating Previously we would map the entire executable of a program in its own address space (but make it unavailable to userspace code.) This patch removes that and changes the symbolication code to remap the executable on demand (and into the kernel's own address space instead of the process address space.) This opens up a couple of further simplifications that will follow.
2020-03-02 09:40:40 +00:00
OwnPtr<Process::ELFBundle> Process::elf_bundle() const
{
if (!m_executable)
return nullptr;
auto bundle = make<ELFBundle>();
ptrace: Add PT_SETREGS PT_SETTREGS sets the regsiters of the traced thread. It can only be used when the tracee is stopped. Also, refactor ptrace. The implementation was getting long and cluttered the alraedy large Process.cpp file. This commit moves the bulk of the implementation to Kernel/Ptrace.cpp, and factors out peek & poke to separate methods of the Process class.
2020-04-07 15:23:37 +00:00
if (!m_executable->inode().shared_vmobject()) {
return nullptr;
}
Kernel: Load executables on demand when symbolicating Previously we would map the entire executable of a program in its own address space (but make it unavailable to userspace code.) This patch removes that and changes the symbolication code to remap the executable on demand (and into the kernel's own address space instead of the process address space.) This opens up a couple of further simplifications that will follow.
2020-03-02 09:40:40 +00:00
ASSERT(m_executable->inode().shared_vmobject());
auto& vmobject = *m_executable->inode().shared_vmobject();
bundle->region = MM.allocate_kernel_region_with_vmobject(const_cast<SharedInodeVMObject&>(vmobject), vmobject.size(), "ELF bundle", Region::Access::Read);
if (!bundle->region)
return nullptr;
LibELF: Move ELF classes into namespace ELF This is for consistency with other namespace changes that were made a while back to the other libraries :)
2020-04-11 18:24:07 +00:00
bundle->elf_loader = make<ELF::Loader>(bundle->region->vaddr().as_ptr(), bundle->region->size());
Kernel: Load executables on demand when symbolicating Previously we would map the entire executable of a program in its own address space (but make it unavailable to userspace code.) This patch removes that and changes the symbolication code to remap the executable on demand (and into the kernel's own address space instead of the process address space.) This opens up a couple of further simplifications that will follow.
2020-03-02 09:40:40 +00:00
return bundle;
}
Kernel: Add sys$get_stack_bounds() for finding the stack base & size This will be useful when implementing conservative garbage collection.
2020-03-16 18:06:33 +00:00
int Process::sys$get_stack_bounds(FlatPtr* user_stack_base, size_t* user_stack_size)
{
if (!validate_write_typed(user_stack_base))
return -EFAULT;
if (!validate_write_typed(user_stack_size))
return -EFAULT;
FlatPtr stack_pointer = Thread::current->get_register_dump_from_stack().userspace_esp;
auto* stack_region = MM.region_from_vaddr(*this, VirtualAddress(stack_pointer));
if (!stack_region) {
ASSERT_NOT_REACHED();
return -EINVAL;
}
FlatPtr stack_base = stack_region->range().base().get();
size_t stack_size = stack_region->size();
copy_to_user(user_stack_base, &stack_base);
copy_to_user(user_stack_size, &stack_size);
return 0;
}
Kernel: Add 'ptrace' syscall This commit adds a basic implementation of the ptrace syscall, which allows one process (the tracer) to control another process (the tracee). While a process is being traced, it is stopped whenever a signal is received (other than SIGCONT). The tracer can start tracing another thread with PT_ATTACH, which causes the tracee to stop. From there, the tracer can use PT_CONTINUE to continue the execution of the tracee, or use other request codes (which haven't been implemented yet) to modify the state of the tracee. Additional request codes are PT_SYSCALL, which causes the tracee to continue exection but stop at the next entry or exit from a syscall, and PT_GETREGS which fethces the last saved register set of the tracee (can be used to inspect syscall arguments and return value). A special request code is PT_TRACE_ME, which is issued by the tracee and causes it to stop when it calls execve and wait for the tracer to attach.
2020-03-28 08:47:16 +00:00
int Process::sys$ptrace(const Syscall::SC_ptrace_params* user_params)
{
REQUIRE_PROMISE(proc);
Syscall::SC_ptrace_params params;
if (!validate_read_and_copy_typed(&params, user_params))
return -EFAULT;
ptrace: Add PT_SETREGS PT_SETTREGS sets the regsiters of the traced thread. It can only be used when the tracee is stopped. Also, refactor ptrace. The implementation was getting long and cluttered the alraedy large Process.cpp file. This commit moves the bulk of the implementation to Kernel/Ptrace.cpp, and factors out peek & poke to separate methods of the Process class.
2020-04-07 15:23:37 +00:00
auto result = Ptrace::handle_syscall(params, *this);
return result.is_error() ? result.error() : result.value();
Kernel: Add 'ptrace' syscall This commit adds a basic implementation of the ptrace syscall, which allows one process (the tracer) to control another process (the tracee). While a process is being traced, it is stopped whenever a signal is received (other than SIGCONT). The tracer can start tracing another thread with PT_ATTACH, which causes the tracee to stop. From there, the tracer can use PT_CONTINUE to continue the execution of the tracee, or use other request codes (which haven't been implemented yet) to modify the state of the tracee. Additional request codes are PT_SYSCALL, which causes the tracee to continue exection but stop at the next entry or exit from a syscall, and PT_GETREGS which fethces the last saved register set of the tracee (can be used to inspect syscall arguments and return value). A special request code is PT_TRACE_ME, which is issued by the tracee and causes it to stop when it calls execve and wait for the tracer to attach.
2020-03-28 08:47:16 +00:00
}
bool Process::has_tracee_thread(int tracer_pid) const
{
bool has_tracee = false;
for_each_thread([&](Thread& t) {
if (t.tracer() && t.tracer()->tracer_pid() == tracer_pid) {
has_tracee = true;
return IterationDecision::Break;
}
return IterationDecision::Continue;
});
return has_tracee;
}
ptrace: Add PT_SETREGS PT_SETTREGS sets the regsiters of the traced thread. It can only be used when the tracee is stopped. Also, refactor ptrace. The implementation was getting long and cluttered the alraedy large Process.cpp file. This commit moves the bulk of the implementation to Kernel/Ptrace.cpp, and factors out peek & poke to separate methods of the Process class.
2020-04-07 15:23:37 +00:00
KResultOr<u32> Process::peek_user_data(u32* address)
{
if (!MM.validate_user_read(*this, VirtualAddress(address), sizeof(u32))) {
Debugger: Add DebugSession The DebugSession class wraps the usage of Ptrace. It is intended to be used by cli & gui debugger programs. Also, call objdump for disassemly
2020-04-10 14:35:49 +00:00
dbg() << "Invalid address for peek_user_data: " << address;
ptrace: Add PT_SETREGS PT_SETTREGS sets the regsiters of the traced thread. It can only be used when the tracee is stopped. Also, refactor ptrace. The implementation was getting long and cluttered the alraedy large Process.cpp file. This commit moves the bulk of the implementation to Kernel/Ptrace.cpp, and factors out peek & poke to separate methods of the Process class.
2020-04-07 15:23:37 +00:00
return KResult(-EFAULT);
}
uint32_t result;
SmapDisabler dis;
// This function can be called from the context of another
// process that called PT_PEEK
ProcessPagingScope scope(*this);
result = *address;
return result;
}
KResult Process::poke_user_data(u32* address, u32 data)
{
// We validate for read (rather than write) because PT_POKE can write to readonly pages.
Debugger: Add DebugSession The DebugSession class wraps the usage of Ptrace. It is intended to be used by cli & gui debugger programs. Also, call objdump for disassemly
2020-04-10 14:35:49 +00:00
// So we effectively only care that the poke operation is trying to write to user pages.
ptrace: Add PT_SETREGS PT_SETTREGS sets the regsiters of the traced thread. It can only be used when the tracee is stopped. Also, refactor ptrace. The implementation was getting long and cluttered the alraedy large Process.cpp file. This commit moves the bulk of the implementation to Kernel/Ptrace.cpp, and factors out peek & poke to separate methods of the Process class.
2020-04-07 15:23:37 +00:00
if (!MM.validate_user_read(*this, VirtualAddress(address), sizeof(u32))) {
Debugger: Add DebugSession The DebugSession class wraps the usage of Ptrace. It is intended to be used by cli & gui debugger programs. Also, call objdump for disassemly
2020-04-10 14:35:49 +00:00
dbg() << "Invalid address for poke_user_data: " << address;
ptrace: Add PT_SETREGS PT_SETTREGS sets the regsiters of the traced thread. It can only be used when the tracee is stopped. Also, refactor ptrace. The implementation was getting long and cluttered the alraedy large Process.cpp file. This commit moves the bulk of the implementation to Kernel/Ptrace.cpp, and factors out peek & poke to separate methods of the Process class.
2020-04-07 15:23:37 +00:00
return KResult(-EFAULT);
}
ProcessPagingScope scope(*this);
Range range = { VirtualAddress(address), sizeof(u32) };
auto* region = region_containing(range);
ASSERT(region != nullptr);
if (region->is_shared()) {
// If the region is shared, we change its vmobject to a PrivateInodeVMObject
// to prevent the write operation from chaning any shared inode data
ASSERT(region->vmobject().is_shared_inode());
region->set_vmobject(PrivateInodeVMObject::create_with_inode(static_cast<SharedInodeVMObject&>(region->vmobject()).inode()));
region->set_shared(false);
}
const bool was_writable = region->is_writable();
if (!was_writable) //TODO refactor into scopeguard
{
region->set_writable(true);
region->remap();
}
{
SmapDisabler dis;
*address = data;
}
if (!was_writable) {
region->set_writable(false);
region->remap();
}
return KResult(KSuccess);
}
Kernel: Move all code into the Kernel namespace
2020-02-16 00:27:42 +00:00
}
Reference in a new issue Copy permalink