beenull/ladybird
1
0
Fork 0
mirror of https://github.com/LadybirdBrowser/ladybird.git synced 2024-11-23 08:00:20 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 6
ladybird/Kernel/Process.cpp

4739 lines
148 KiB
C++
Raw Normal View History

Meta: Add license header to source files As suggested by Joshua, this commit adds the 2-clause BSD license as a comment block to the top of every source file. For the first pass, I've just added myself for simplicity. I encourage everyone to add themselves as copyright holders of any file they've added or modified in some significant way. If I've added myself in error somewhere, feel free to replace it with the appropriate copyright holder instead. Going forward, all new source files should include a license header.
2020-01-18 08:38:21 +00:00
/*
* Copyright (c) 2018-2020, Andreas Kling <kling@serenityos.org>
* All rights reserved.
*
* Redistribution and use in source and binary forms, with or without
* modification, are permitted provided that the following conditions are met:
*
* 1. Redistributions of source code must retain the above copyright notice, this
* list of conditions and the following disclaimer.
*
* 2. Redistributions in binary form must reproduce the above copyright notice,
* this list of conditions and the following disclaimer in the documentation
* and/or other materials provided with the distribution.
*
* THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS"
* AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
* IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
* DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE
* FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
* DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR
* SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER
* CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY,
* OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
* OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
*/
Kernel: Enforce W^X between sys$mmap() and sys$execve() It's now an error to sys$mmap() a file as writable if it's currently mapped executable by anyone else. It's also an error to sys$execve() a file that's currently mapped writable by anyone else. This fixes a race condition vulnerability where one program could make modifications to an executable while another process was in the kernel, in the middle of exec'ing the same executable. Test: Kernel/elf-execve-mmap-race.cpp
2020-01-18 22:31:29 +00:00
#include <AK/Demangle.h>
Kernel: Add realpath syscall
2019-08-25 16:17:05 +00:00
#include <AK/FileSystemPath.h>
Kernel: Tighten up exec/do_exec and allow for PT_INTERP iterpreters This patch changes how exec() figures out which program image to actually load. Previously, we opened the path to our main executable in find_shebang_interpreter_for_executable, read the first page (or less, if the file was smaller) and then decided whether to recurse with the interpreter instead. We then then re-opened the main executable in do_exec. However, since we now want to parse the ELF header and Program Headers of an elf image before even doing any memory region work, we can change the way this whole process works. We open the file and read (up to) the first page in exec() itself, then pass just the page and the amount read to find_shebang_interpreter_for_executable. Since we now have that page and the FileDescription for the main executable handy, we can do a few things. First, validate the ELF header and ELF program headers for any shenanigans. ELF32 Little Endian i386 only, please. Second, we can grab the PT_INTERP interpreter from any ET_DYN files, and open that guy right away if it exists. Finally, we can pass the main executable's and optionally the PT_INTERP interpreter's file descriptions down to do_exec and not have to feel guilty about opening the file twice. In do_exec, we now have a choice. Are we going to load the main executable, or the interpreter? We could load both, but it'll be way easier for the inital pass on the RTLD if we only load the interpreter. Then it can load the main executable itself like any old shared object, just, the one with main in it :). Later on we can load both of them into memory and the RTLD can relocate itself before trying to do anything. The way it's written now the RTLD will get dibs on its requested virtual addresses being the actual virtual addresses.
2020-01-11 01:28:02 +00:00
#include <AK/ScopeGuard.h>
Kernel: Run clang-format on everything.
2019-06-07 09:43:58 +00:00
#include <AK/StdLibExtras.h>
Move WindowServer to userspace. This is a monster patch that required changing a whole bunch of things. There are performance and stability issues all over the place, but it works. Pretty cool, I have to admit :^)
2019-02-16 23:13:47 +00:00
#include <AK/StringBuilder.h>
Kernel: Fix timeout support in select The scheduler expects m_select_timeout to act as a deadline. That is, it should contain the time that a task should wake at -- but we were directly copying the time from userspace, which meant that it always returned virtually immediately. At the same time, fix CEventLoop to not rely on the broken select behavior by subtracting the current time from the time of the nearest timer.
2019-05-18 00:00:01 +00:00
#include <AK/Time.h>
Kernel: Run clang-format on everything.
2019-06-07 09:43:58 +00:00
#include <AK/Types.h>
Kernel: Move i386.{cpp,h} => Arch/i386/CPU.{cpp,h} There's a ton of work that would need to be done before we could spin up on another architecture, but let's at least try to separate things out a bit.
2019-06-07 18:02:01 +00:00
#include <Kernel/Arch/i386/CPU.h>
Kernel: Move i8253.cpp => Arch/i386/PIT.cpp
2019-07-09 12:23:12 +00:00
#include <Kernel/Arch/i386/PIT.h>
Kernel: Use a lookup table for syscalls Instead of the big ugly switch statement, build a lookup table using the syscall enumeration macro. This greatly simplifies the syscall implementation. :^)
2019-11-09 21:18:16 +00:00
#include <Kernel/Console.h>
Kernel: Implement the setkeymap() syscall.
2019-11-23 07:48:07 +00:00
#include <Kernel/Devices/KeyboardDevice.h>
Kernel: Implement very simple kernel module loading It's now possible to load a .o file into the kernel via a syscall. The kernel will perform all the necessary ELF relocations, and then call the "module_init" symbol in the loaded module.
2019-11-28 19:59:11 +00:00
#include <Kernel/Devices/NullDevice.h>
Kernel: Move PC speaker beep timing logic from scheduler to the syscall I don't know why I put this in the scheduler to begin with.. the caller can just block until the beeping is finished.
2019-12-26 21:31:26 +00:00
#include <Kernel/Devices/PCSpeaker.h>
Kernel: Add a Linux-style getrandom syscall The way it gets the entropy and blasts it to the buffer is pretty ugly IMHO, but it does work for now. (It should be replaced, by not truncating a u32.) It implements an (unused for now) flags argument, like Linux but instead of OpenBSD's. This is in case we want to distinguish between entropy sources or any other reason and have to implement a new syscall later. Of course, learn from Linux's struggles with entropy sourcing too.
2019-10-13 14:41:55 +00:00
#include <Kernel/Devices/RandomDevice.h>
FileSystem: Port most of the code over to using custodies. The current working directory is now stored as a custody. Likewise for a process executable file. This unbreaks /proc/PID/fd which has not been working since we made the filesystem bigger. This still needs a bunch of work, for instance when renaming or removing a file somewhere, we have to update the relevant custody links.
2019-05-30 16:58:59 +00:00
#include <Kernel/FileSystem/Custody.h>
Kernel+LibC+Userland: Support mounting other kinds of filesystems
2019-08-15 16:13:56 +00:00
#include <Kernel/FileSystem/DevPtsFS.h>
Kernel: Support partial munmap() You can now munmap() a part of a region. The kernel will then create one or two new regions around the "hole" and re-map them using the same physical pages as before. This goes towards fixing #175, but not all the way since we don't yet do munmap() across multiple mappings.
2019-08-29 18:57:02 +00:00
#include <Kernel/FileSystem/Ext2FileSystem.h>
Kernel: Run clang-format on everything.
2019-06-07 09:43:58 +00:00
#include <Kernel/FileSystem/FIFO.h>
#include <Kernel/FileSystem/FileDescription.h>
Kernel: Add a mechanism for listening for changes to an inode. The syscall is quite simple: int watch_file(const char* path, int path_length); It returns a file descriptor referring to a "InodeWatcher" object in the kernel. It becomes readable whenever something changes about the inode. Currently this is implemented by hooking the "metadata dirty bit" in Inode which isn't perfect, but it's a start. :^)
2019-07-22 18:01:11 +00:00
#include <Kernel/FileSystem/InodeWatcher.h>
Kernel: Support partial munmap() You can now munmap() a part of a region. The kernel will then create one or two new regions around the "hole" and re-map them using the same physical pages as before. This goes towards fixing #175, but not all the way since we don't yet do munmap() across multiple mappings.
2019-08-29 18:57:02 +00:00
#include <Kernel/FileSystem/ProcFS.h>
#include <Kernel/FileSystem/TmpFS.h>
Kernel: Run clang-format on everything.
2019-06-07 09:43:58 +00:00
#include <Kernel/FileSystem/VirtualFileSystem.h>
ELF: Fail layout when program header hooks return nullptr (#673) ELFLoader::layout() had a "failed" variable that was never set. This patch checks the return value of each hook (alloc/map section and tls) and fails the load if they return null. I also needed to patch Process so that the alloc_section_hook and map_section_hook actually return nullptr when allocating a region fails. Fixes #664 :)
2019-10-20 14:24:42 +00:00
#include <Kernel/Heap/kmalloc.h>
Kernel+Userland: Addd reboot syscall (#334) Rolling with the theme of adding a dialog to shutdown the machine, it is probably nice to have a way to reboot the machine without performing a full system powerdown. A reboot program has been added to `/bin/` as well as a corresponding `syscall` (SC_reboot). This syscall works by attempting to pulse the 8042 keyboard controller. Note that this is NOT supported on new machines, and should only be a fallback until we have proper ACPI support. The implementation causes a triple fault in QEMU, which then restarts the system. The filesystems are locked and synchronized before this occurs, so there shouldn't be any corruption etctera.
2019-07-19 07:58:12 +00:00
#include <Kernel/IO.h>
Kernel: Use KBufferBuilder to build ProcFS files and backtraces This is not perfect as it uses a lot of VM, but since the buffers are supposed to be temporary it's not super terrible. This could be improved by giving back the unused VM to the kernel's RangeAllocator after finishing the buffer building.
2019-08-07 19:52:43 +00:00
#include <Kernel/KBufferBuilder.h>
Kernel: Qualify a bunch of #include statements.
2019-06-07 17:29:34 +00:00
#include <Kernel/KSyms.h>
Kernel+LibC: Publish a "kernel info page" and use it for gettimeofday() This patch adds a single "kernel info page" that is mappable read-only by any process and contains the current time of day. This is then used to implement a version of gettimeofday() that doesn't have to make a syscall. To protect against race condition issues, the info page also has a serial number which is incremented whenever the kernel updates the contents of the page. Make sure to verify that the serial number is the same before and after reading the information you want from the page.
2019-12-15 20:29:26 +00:00
#include <Kernel/KernelInfoPage.h>
Kernel: Implement very simple kernel module loading It's now possible to load a .o file into the kernel via a syscall. The kernel will perform all the necessary ELF relocations, and then call the "module_init" symbol in the loaded module.
2019-11-28 19:59:11 +00:00
#include <Kernel/Module.h>
Kernel: Make better use of the multiboot info. Define the multiboot info struct properly so we don't have to grab at byte offsets in the memory access checker code. Also print kernel command line in init().
2019-06-02 07:50:18 +00:00
#include <Kernel/Multiboot.h>
Kernel: Run clang-format on everything.
2019-06-07 09:43:58 +00:00
#include <Kernel/Net/Socket.h>
Kernel: Qualify a bunch of #include statements.
2019-06-07 17:29:34 +00:00
#include <Kernel/Process.h>
Kernel: Run clang-format on everything.
2019-06-07 09:43:58 +00:00
#include <Kernel/ProcessTracer.h>
Kernel: Implement a simple process time profiler The kernel now supports basic profiling of all the threads in a process by calling profiling_enable(pid_t). You finish the profiling by calling profiling_disable(pid_t). This all works by recording thread stacks when the timer interrupt fires and the current thread is in a process being profiled. Note that symbolication is deferred until profiling_disable() to avoid adding more noise than necessary to the profile. A simple "/bin/profile" command is included here that can be used to start/stop profiling like so: $ profile 10 on ... wait ... $ profile 10 off After a profile has been recorded, it can be fetched in /proc/profile There are various limits (or "bugs") on this mechanism at the moment: - Only one process can be profiled at a time. - We allocate 8MB for the samples, if you use more space, things will not work, and probably break a bit. - Things will probably fall apart if the profiled process dies during profiling, or while extracing /proc/profile
2019-12-11 19:36:56 +00:00
#include <Kernel/Profiling.h>
Kernel: Qualify a bunch of #include statements.
2019-06-07 17:29:34 +00:00
#include <Kernel/RTC.h>
Kernel: Add a more expressive API for getting random bytes We now have these API's in <Kernel/Random.h>: - get_fast_random_bytes(u8* buffer, size_t buffer_size) - get_good_random_bytes(u8* buffer, size_t buffer_size) - get_fast_random<T>() - get_good_random<T>() Internally they both use x86 RDRAND if available, otherwise they fall back to the same LCG we had in RandomDevice all along. The main purpose of this patch is to give kernel code a way to better express its needs for random data. Randomness is something that will require a lot more work, but this is hopefully a step in the right direction.
2020-01-03 11:36:30 +00:00
#include <Kernel/Random.h>
Kernel: Qualify a bunch of #include statements.
2019-06-07 17:29:34 +00:00
#include <Kernel/Scheduler.h>
SharedBuffer: Fix deadlock on destroy We were locking the list of references, and then destroying the reference, which made things go a little crazy. It's more straightforward to just remove the per-reference lock: the syscalls all have to lock the full list anyway, so let's just do that and avoid the hassle. While I'm at it, also move the SharedBuffer code out to its own file as it's getting a little long and unwieldly, and Process.cpp is already huge.
2019-07-16 13:03:39 +00:00
#include <Kernel/SharedBuffer.h>
Kernel+Userland: Addd reboot syscall (#334) Rolling with the theme of adding a dialog to shutdown the machine, it is probably nice to have a way to reboot the machine without performing a full system powerdown. A reboot program has been added to `/bin/` as well as a corresponding `syscall` (SC_reboot). This syscall works by attempting to pulse the 8042 keyboard controller. Note that this is NOT supported on new machines, and should only be a fallback until we have proper ACPI support. The implementation causes a triple fault in QEMU, which then restarts the system. The filesystems are locked and synchronized before this occurs, so there shouldn't be any corruption etctera.
2019-07-19 07:58:12 +00:00
#include <Kernel/StdLib.h>
Kernel: Qualify a bunch of #include statements.
2019-06-07 17:29:34 +00:00
#include <Kernel/Syscall.h>
Kernel: Run clang-format on everything.
2019-06-07 09:43:58 +00:00
#include <Kernel/TTY/MasterPTY.h>
Kernel: Move E2BIG calculation from Thread to Process Thread::make_userspace_stack_for_main_thread is only ever called from Process::do_exec, after all the fun ELF loading and TSS setup has occured. The calculations in there that check if the combined argv + envp size will exceed the default stack size are not used in the rest of the stack setup. So, it should be safe to move this to the beginning of do_exec and bail early with -E2BIG, just like the man pages say. Additionally, advertise this limit in limits.h to be a good POSIX.1 citizen. :)
2019-10-20 16:11:40 +00:00
#include <Kernel/Thread.h>
Kernel: Split VMObject into two classes: Anonymous- and InodeVMObject InodeVMObject is a VMObject with an underlying Inode in the filesystem. AnonymousVMObject has no Inode. I'm happy that InodeVMObject::inode() can now return Inode& instead of VMObject::inode() return Inode*. :^)
2019-08-07 16:06:17 +00:00
#include <Kernel/VM/InodeVMObject.h>
Kernel: Start implementing purgeable memory support It's now possible to get purgeable memory by using mmap(MAP_PURGEABLE). Purgeable memory has a "volatile" flag that can be set using madvise(): - madvise(..., MADV_SET_VOLATILE) - madvise(..., MADV_SET_NONVOLATILE) When in the "volatile" state, the kernel may take away the underlying physical memory pages at any time, without notifying the owner. This gives you a guilt discount when caching very large things. :^) Setting a purgeable region to non-volatile will return whether or not the memory has been taken away by the kernel while being volatile. Basically, if madvise(..., MADV_SET_NONVOLATILE) returns 1, that means the memory was purged while volatile, and whatever was in that piece of memory needs to be reconstructed before use.
2019-12-09 18:12:38 +00:00
#include <Kernel/VM/PurgeableVMObject.h>
Kernel: Run clang-format on everything.
2019-06-07 09:43:58 +00:00
#include <LibC/errno_numbers.h>
Kernel: writev() should fail with EINVAL if total length > INT32_MAX
2020-01-02 12:01:41 +00:00
#include <LibC/limits.h>
Kernel: Run clang-format on everything.
2019-06-07 09:43:58 +00:00
#include <LibC/signal_numbers.h>
LibELF: Move AK/ELF/ into Libraries/LibELF/ Let's arrange things like this instead. It didn't feel right for all of the ELF handling code to live in AK.
2019-11-06 12:42:38 +00:00
#include <LibELF/ELFLoader.h>
Import the "gerbert" kernel I worked on earlier this year. It's a lot crappier than I remembered it. It's gonna need a lot of work.
2018-10-16 09:01:38 +00:00
Kernel: Finalizer should not go back to sleep if there's more to do Before putting itself back on the wait queue, the finalizer task will now check if there's more work to do, and if so, do it first. :^) This patch also puts a bunch of process/thread debug logging behind PROCESS_DEBUG and THREAD_DEBUG since it was unbearable to debug this stuff with all the spam.
2020-02-01 09:27:25 +00:00
//#define PROCESS_DEBUG
Kernel: Add the ability to debug poll/select independently of read/write
2019-05-19 08:24:28 +00:00
//#define DEBUG_POLL_SELECT
Lots of hacking: - Turn Keyboard into a CharacterDevice (85,1) at /dev/keyboard. - Implement MM::unmapRegionsForTask() and MM::unmapRegion() - Save SS correctly on interrupt. - Add a simple Spawn syscall for launching another process. - Move a bunch of IO syscall debug output behind DEBUG_IO. - Have ASSERT do a "cli" immediately when failing. This makes the output look proper every time. - Implement a bunch of syscalls in LibC. - Add a simple shell ("sh"). All it can do now is read a line of text from /dev/keyboard and then try launching the specified executable by calling spawn(). There are definitely bugs in here, but we're moving on forward.
2018-10-23 08:12:50 +00:00
//#define DEBUG_IO
Kernel: Put a bunch of debug spam behind #ifdefs.
2019-03-27 14:07:12 +00:00
//#define TASK_DEBUG
//#define FORK_DEBUG
Kernel+LibELF: Validate PT_LOAD and PT_TLS offsets before memcpy()'ing Before this, you could make the kernel copy memory from anywhere by setting up an ELF executable with a program header specifying file offsets outside the file. Since ELFImage didn't even know how large it was, we had no clue that we were copying things from outside the ELF. Fix this by adding a size field to ELFImage and validating program header ranges before memcpy()'ing to them. The ELF code is definitely going to need more validation and checking.
2020-01-06 20:04:57 +00:00
//#define EXEC_DEBUG
Kernel: SharedBuffer sharing cleanup Rather than limiting it to two shared processes, store a Vector of references, so we can add more if we want. Makes the code a little more generic. No actual change to the syscall interface yet, so nothing takes advantage of this yet.
2019-07-15 18:38:41 +00:00
//#define SIGNAL_DEBUG
Move WindowServer to userspace. This is a monster patch that required changing a whole bunch of things. There are performance and stability issues all over the place, but it works. Pretty cool, I have to admit :^)
2019-02-16 23:13:47 +00:00
//#define SHARED_BUFFER_DEBUG
Implement COW pages! :^) sys$fork() now clones all writable regions with per-page COW bits. The pages are then mapped read-only and we handle a PF by COWing the pages. This is quite delightful. Obviously there's lots of work to do still, and it needs better data structures, but the general concept works.
2018-11-05 12:48:07 +00:00
Kernel: Share the "return to ring 0/3 from signal" trampolines globally. Generate a special page containing the "return from signal" trampoline code on startup and then route signalled threads to it. This avoids a page allocation in every process that ever receives a signal.
2019-07-19 15:01:16 +00:00
static void create_signal_trampolines();
Kernel+LibC: Publish a "kernel info page" and use it for gettimeofday() This patch adds a single "kernel info page" that is mappable read-only by any process and contains the current time of day. This is then used to implement a version of gettimeofday() that doesn't have to make a syscall. To protect against race condition issues, the info page also has a serial number which is incremented whenever the kernel updates the contents of the page. Make sure to verify that the serial number is the same before and after reading the information you want from the page.
2019-12-15 20:29:26 +00:00
static void create_kernel_info_page();
Kernel: Share the "return to ring 0/3 from signal" trampolines globally. Generate a special page containing the "return from signal" trampoline code on startup and then route signalled threads to it. This avoids a page allocation in every process that ever receives a signal.
2019-07-19 15:01:16 +00:00
Import the "gerbert" kernel I worked on earlier this year. It's a lot crappier than I remembered it. It's gonna need a lot of work.
2018-10-16 09:01:38 +00:00
static pid_t next_pid;
Move the scheduler code to its own class. This is very mechanical.
2018-11-07 21:15:02 +00:00
InlineLinkedList<Process>* g_processes;
Add sys$gethostname and /bin/hostname
2018-10-26 07:54:29 +00:00
static String* s_hostname;
Kernel: Don't disable interrupts to access the system hostname.
2019-02-07 09:29:26 +00:00
static Lock* s_hostname_lock;
Kernel: Make sure the kernel info page is read-only for userspace To enforce this, we create two separate mappings of the same underlying physical page. A writable mapping for the kernel, and a read-only one for userspace (the one returned by sys$get_kernel_info_page.)
2019-12-15 21:21:28 +00:00
static VirtualAddress s_info_page_address_for_userspace;
static VirtualAddress s_info_page_address_for_kernel;
Kernel: Share the "return to ring 0/3 from signal" trampolines globally. Generate a special page containing the "return from signal" trampoline code on startup and then route signalled threads to it. This avoids a page allocation in every process that ever receives a signal.
2019-07-19 15:01:16 +00:00
VirtualAddress g_return_to_ring3_from_signal_trampoline;
Kernel: Implement very simple kernel module loading It's now possible to load a .o file into the kernel via a syscall. The kernel will perform all the necessary ELF relocations, and then call the "module_init" symbol in the loaded module.
2019-11-28 19:59:11 +00:00
HashMap<String, OwnPtr<Module>>* g_modules;
Add sys$uname() and a /bin/uname utility.
2018-10-26 12:56:21 +00:00
Kernel: Make TID's be unique PID's This is a little strange, but it's how I understand things should work. The first thread in a new process now has TID == PID. Additional threads subsequently spawned in that process all have unique TID's generated by the PID allocator. TIDs are now globally unique.
2019-12-22 10:51:24 +00:00
pid_t Process::allocate_pid()
{
InterruptDisabler disabler;
return next_pid++;
}
Process now maps regions immediately when they are allocated. This avoids having to do a separate MM.mapRegionsForTask() pass. Also, more Task => Process renaming that I apparently hadn't saved yet.
2018-11-01 12:15:46 +00:00
void Process::initialize()
Import the "gerbert" kernel I worked on earlier this year. It's a lot crappier than I remembered it. It's gonna need a lot of work.
2018-10-16 09:01:38 +00:00
{
Kernel: Implement very simple kernel module loading It's now possible to load a .o file into the kernel via a syscall. The kernel will perform all the necessary ELF relocations, and then call the "module_init" symbol in the loaded module.
2019-11-28 19:59:11 +00:00
g_modules = new HashMap<String, OwnPtr<Module>>;
Import the "gerbert" kernel I worked on earlier this year. It's a lot crappier than I remembered it. It's gonna need a lot of work.
2018-10-16 09:01:38 +00:00
next_pid = 0;
Move the scheduler code to its own class. This is very mechanical.
2018-11-07 21:15:02 +00:00
g_processes = new InlineLinkedList<Process>;
Tweak default hostname.
2018-11-16 23:23:39 +00:00
s_hostname = new String("courage");
Kernel: Don't disable interrupts to access the system hostname.
2019-02-07 09:29:26 +00:00
s_hostname_lock = new Lock;
Kernel: Share the "return to ring 0/3 from signal" trampolines globally. Generate a special page containing the "return from signal" trampoline code on startup and then route signalled threads to it. This avoids a page allocation in every process that ever receives a signal.
2019-07-19 15:01:16 +00:00
create_signal_trampolines();
Kernel+LibC: Publish a "kernel info page" and use it for gettimeofday() This patch adds a single "kernel info page" that is mappable read-only by any process and contains the current time of day. This is then used to implement a version of gettimeofday() that doesn't have to make a syscall. To protect against race condition issues, the info page also has a serial number which is incremented whenever the kernel updates the contents of the page. Make sure to verify that the serial number is the same before and after reading the information you want from the page.
2019-12-15 20:29:26 +00:00
create_kernel_info_page();
}
void Process::update_info_page_timestamp(const timeval& tv)
{
Kernel: Make sure the kernel info page is read-only for userspace To enforce this, we create two separate mappings of the same underlying physical page. A writable mapping for the kernel, and a read-only one for userspace (the one returned by sys$get_kernel_info_page.)
2019-12-15 21:21:28 +00:00
auto* info_page = (KernelInfoPage*)s_info_page_address_for_kernel.as_ptr();
Kernel+LibC: Publish a "kernel info page" and use it for gettimeofday() This patch adds a single "kernel info page" that is mappable read-only by any process and contains the current time of day. This is then used to implement a version of gettimeofday() that doesn't have to make a syscall. To protect against race condition issues, the info page also has a serial number which is incremented whenever the kernel updates the contents of the page. Make sure to verify that the serial number is the same before and after reading the information you want from the page.
2019-12-15 20:29:26 +00:00
info_page->serial++;
const_cast<timeval&>(info_page->now) = tv;
Basic ^C interrupt implementation. For testing, I made cat put itself into a new process group. This should eventually be done by sh between fork() and exec().
2018-11-02 13:06:48 +00:00
}
Kernel: Rewrite ProcFS. Now the filesystem is generated on-the-fly instead of manually adding and removing inodes as processes spawn and die. The code is convoluted and bloated as I wrote it while sleepless. However, it's still vastly better than the old ProcFS, so I'm committing it. I also added /proc/PID/fd/N symlinks for each of a process's open fd's.
2019-02-03 11:33:11 +00:00
Vector<pid_t> Process::all_pids()
{
Vector<pid_t> pids;
Kernel: Add a Finalizer process to take care of dying processes. Instead of processes themselves getting scheduled to finish dying, let's have a Finalizer process that wakes up whenever someone is dying. This way we can do all kinds of lock-taking in process cleanup without risking reentering the scheduler.
2019-02-06 17:45:21 +00:00
InterruptDisabler disabler;
AK: SinglyLinkedList::size_slow() should return size_t
2019-12-09 16:48:58 +00:00
pids.ensure_capacity((int)g_processes->size_slow());
Kernel: Use some more InlineLinkedList range-for iteration
2019-08-08 12:40:13 +00:00
for (auto& process : *g_processes)
pids.append(process.pid());
Kernel: Rewrite ProcFS. Now the filesystem is generated on-the-fly instead of manually adding and removing inodes as processes spawn and die. The code is convoluted and bloated as I wrote it while sleepless. However, it's still vastly better than the old ProcFS, so I'm committing it. I also added /proc/PID/fd/N symlinks for each of a process's open fd's.
2019-02-03 11:33:11 +00:00
return pids;
}
Big, possibly complete sweep of naming changes.
2019-01-31 16:31:23 +00:00
Vector<Process*> Process::all_processes()
Generate a basic /proc/summary file with some info about all tasks.
2018-10-23 10:44:46 +00:00
{
Process now maps regions immediately when they are allocated. This avoids having to do a separate MM.mapRegionsForTask() pass. Also, more Task => Process renaming that I apparently hadn't saved yet.
2018-11-01 12:15:46 +00:00
Vector<Process*> processes;
Kernel: Add a Finalizer process to take care of dying processes. Instead of processes themselves getting scheduled to finish dying, let's have a Finalizer process that wakes up whenever someone is dying. This way we can do all kinds of lock-taking in process cleanup without risking reentering the scheduler.
2019-02-06 17:45:21 +00:00
InterruptDisabler disabler;
AK: SinglyLinkedList::size_slow() should return size_t
2019-12-09 16:48:58 +00:00
processes.ensure_capacity((int)g_processes->size_slow());
Kernel: Use some more InlineLinkedList range-for iteration
2019-08-08 12:40:13 +00:00
for (auto& process : *g_processes)
processes.append(&process);
Process now maps regions immediately when they are allocated. This avoids having to do a separate MM.mapRegionsForTask() pass. Also, more Task => Process renaming that I apparently hadn't saved yet.
2018-11-01 12:15:46 +00:00
return processes;
Generate a basic /proc/summary file with some info about all tasks.
2018-10-23 10:44:46 +00:00
}
Add chown() syscall and a simple /bin/chown program.
2019-02-27 11:32:53 +00:00
bool Process::in_group(gid_t gid) const
{
Kernel: Don't include the process GID in the "extra GIDs" table Process::m_extra_gids is for supplementary GIDs only.
2020-01-02 22:45:52 +00:00
return m_gid == gid || m_extra_gids.contains(gid);
Add chown() syscall and a simple /bin/chown program.
2019-02-27 11:32:53 +00:00
}
Kernel: Rename LinearAddress => VirtualAddress.
2019-06-07 10:56:50 +00:00
Range Process::allocate_range(VirtualAddress vaddr, size_t size)
More paging stuff. The test userspace process now runs at linear address 0x300000 which is mapped to a dynamically allocated page from the MemoryManager. Cool!
2018-10-18 11:05:00 +00:00
{
Kernel: Rename LinearAddress => VirtualAddress.
2019-06-07 10:56:50 +00:00
vaddr.mask(PAGE_MASK);
Make GraphicsBitmaps be Region-backed when running in the kernel. This is a lot better than having them in kmalloc memory. I'm gonna need a way to keep track of which process owns which bitmap eventually, maybe through some sort of resource keying system. We'll see.
2019-01-12 23:27:25 +00:00
size = PAGE_ROUND_UP(size);
Kernel: Rename LinearAddress => VirtualAddress.
2019-06-07 10:56:50 +00:00
if (vaddr.is_null())
Kernel: Let PageDirectory own the associated RangeAllocator. Since we transition to a new PageDirectory on exec(), we need a matching RangeAllocator to go with the new directory. Instead of juggling this in Process and MemoryManager, simply attach the RangeAllocator to the PageDirectory instead. Fixes #61.
2019-05-20 02:46:29 +00:00
return page_directory().range_allocator().allocate_anywhere(size);
Kernel: Rename LinearAddress => VirtualAddress.
2019-06-07 10:56:50 +00:00
return page_directory().range_allocator().allocate_specific(vaddr, size);
Kernel: Factor out range allocation from Process::allocate_region*(). These functions were doing exactly the same thing for range allocation, so share that code in an allocate_range() helper. Region allocation will now also fail if range allocation fails, which means that mmap() can actually fail without falling apart. Exciting times!
2019-05-17 02:39:22 +00:00
}
Kernel: Implement a simple virtual address range allocator. This replaces the previous virtual address allocator which was basically just "m_next_address += size;" With this in place, virtual addresses can get reused, which cuts down on the number of page tables created. When we implement ASLR some day, we'll probably have to do page table deallocation, but for now page tables are only deallocated once the process dies.
2019-05-17 01:40:15 +00:00
Kernel: Make the Process allocate_region* API's understand "int prot". Instead of having to inspect 'prot' at every call site, make the Process API's take care of that so we can just pass it through.
2019-05-30 14:14:37 +00:00
static unsigned prot_to_region_access_flags(int prot)
{
unsigned access = 0;
if (prot & PROT_READ)
access |= Region::Access::Read;
if (prot & PROT_WRITE)
access |= Region::Access::Write;
if (prot & PROT_EXEC)
access |= Region::Access::Execute;
return access;
}
Kernel: Rename vmo => vmobject everywhere
2019-12-19 18:13:44 +00:00
Region& Process::allocate_split_region(const Region& source_region, const Range& range, size_t offset_in_vmobject)
Kernel: Support partial munmap() You can now munmap() a part of a region. The kernel will then create one or two new regions around the "hole" and re-map them using the same physical pages as before. This goes towards fixing #175, but not all the way since we don't yet do munmap() across multiple mappings.
2019-08-29 18:57:02 +00:00
{
Kernel: Preserve CoW bits when splitting VM regions
2020-01-25 16:57:10 +00:00
auto& region = add_region(Region::create_user_accessible(range, source_region.vmobject(), offset_in_vmobject, source_region.name(), source_region.access()));
Kernel: Copy "stack" and "mmap" bits when splitting a Region
2020-01-29 18:24:42 +00:00
region.set_mmap(source_region.is_mmap());
region.set_stack(source_region.is_stack());
Kernel: Preserve CoW bits when splitting VM regions
2020-01-25 16:57:10 +00:00
size_t page_offset_in_source_region = (offset_in_vmobject - source_region.offset_in_vmobject()) / PAGE_SIZE;
for (size_t i = 0; i < region.page_count(); ++i) {
if (source_region.should_cow(page_offset_in_source_region + i))
region.set_should_cow(i, true);
}
return region;
Kernel: Support partial munmap() You can now munmap() a part of a region. The kernel will then create one or two new regions around the "hole" and re-map them using the same physical pages as before. This goes towards fixing #175, but not all the way since we don't yet do munmap() across multiple mappings.
2019-08-29 18:57:02 +00:00
}
Kernel: Tweak some String&& => const String&. String&& is just not very practical. Also return const String& when the returned string is a member variable. The call site is free to make a copy if he wants, but otherwise we can avoid the retain count churn.
2019-06-07 18:58:12 +00:00
Region* Process::allocate_region(VirtualAddress vaddr, size_t size, const String& name, int prot, bool commit)
Kernel: Factor out range allocation from Process::allocate_region*(). These functions were doing exactly the same thing for range allocation, so share that code in an allocate_range() helper. Region allocation will now also fail if range allocation fails, which means that mmap() can actually fail without falling apart. Exciting times!
2019-05-17 02:39:22 +00:00
{
Kernel: Rename LinearAddress => VirtualAddress.
2019-06-07 10:56:50 +00:00
auto range = allocate_range(vaddr, size);
Kernel: Factor out range allocation from Process::allocate_region*(). These functions were doing exactly the same thing for range allocation, so share that code in an allocate_range() helper. Region allocation will now also fail if range allocation fails, which means that mmap() can actually fail without falling apart. Exciting times!
2019-05-17 02:39:22 +00:00
if (!range.is_valid())
return nullptr;
Kernel: Add a Process::add_region() helper This is a private helper for adding a Region to Process::m_regions. It's just for convenience since it's a bit cumbersome to do this.
2020-01-19 15:25:38 +00:00
auto& region = add_region(Region::create_user_accessible(range, name, prot_to_region_access_flags(prot)));
region.map(page_directory());
Kernel: Refactor Region/PageDirectory ownership model. Make PageDirectory retainable and have each Region co-own the PageDirectory they're mapped into. When unmapped, Region has no associated PageDirectory. This allows Region to automatically unmap itself when destroyed.
2019-01-22 04:01:00 +00:00
if (commit)
Kernel: Add a Process::add_region() helper This is a private helper for adding a Region to Process::m_regions. It's just for convenience since it's a bit cumbersome to do this.
2020-01-19 15:25:38 +00:00
region.commit();
return &region;
More paging stuff. The test userspace process now runs at linear address 0x300000 which is mapped to a dynamically allocated page from the MemoryManager. Cool!
2018-10-18 11:05:00 +00:00
}
Kernel: Track user accessibility per Region. Region now has is_user_accessible(), which informs the memory manager how to map these pages. Previously, we were just passing a "bool user_allowed" to various functions and I'm not at all sure that any of that was correct. All the Region constructors are now hidden, and you must go through one of these helpers to construct a region: - Region::create_user_accessible(...) - Region::create_kernel_only(...) That ensures that we don't accidentally create a Region without specifying user accessibility. :^)
2019-07-19 14:09:34 +00:00
Region* Process::allocate_file_backed_region(VirtualAddress vaddr, size_t size, NonnullRefPtr<Inode> inode, const String& name, int prot)
Support basic mmap'ing of a file! All right, we can now mmap() a file and it gets magically paged in from fs in response to an NP page fault. This is really cool :^) I need to refactor this to support sharing of read-only file-backed pages, but it's cool to just have something working.
2018-11-08 11:59:16 +00:00
{
Kernel: Rename LinearAddress => VirtualAddress.
2019-06-07 10:56:50 +00:00
auto range = allocate_range(vaddr, size);
Kernel: Factor out range allocation from Process::allocate_region*(). These functions were doing exactly the same thing for range allocation, so share that code in an allocate_range() helper. Region allocation will now also fail if range allocation fails, which means that mmap() can actually fail without falling apart. Exciting times!
2019-05-17 02:39:22 +00:00
if (!range.is_valid())
return nullptr;
Kernel: Add a Process::add_region() helper This is a private helper for adding a Region to Process::m_regions. It's just for convenience since it's a bit cumbersome to do this.
2020-01-19 15:25:38 +00:00
auto& region = add_region(Region::create_user_accessible(range, inode, name, prot_to_region_access_flags(prot)));
region.map(page_directory());
return &region;
Support basic mmap'ing of a file! All right, we can now mmap() a file and it gets magically paged in from fs in response to an NP page fault. This is really cool :^) I need to refactor this to support sharing of read-only file-backed pages, but it's cool to just have something working.
2018-11-08 11:59:16 +00:00
}
Kernel+LibELF: Enable SMAP protection during non-syscall exec() When loading a new executable, we now map the ELF image in kernel-only memory and parse it there. Then we use copy_to_user() when initializing writable regions with data from the executable. Note that the exec() syscall still disables SMAP protection and will require additional work. This patch only affects kernel-originated process spawns.
2020-01-10 05:57:18 +00:00
Region* Process::allocate_region_with_vmobject(VirtualAddress vaddr, size_t size, NonnullRefPtr<VMObject> vmobject, size_t offset_in_vmobject, const String& name, int prot, bool user_accessible)
Teach Process::exec() about the magic of file-backed VMO's. This is really sweet! :^) The four instances of /bin/sh spawned at startup now share their read-only text pages. There are problems and limitations here, and plenty of room for improvement. But it kinda works.
2018-11-08 20:20:09 +00:00
{
Kernel: Validate the requested range in allocate_region_with_vmobject()
2020-01-18 13:37:22 +00:00
size_t end_in_vmobject = offset_in_vmobject + size;
if (end_in_vmobject < offset_in_vmobject) {
dbgprintf("allocate_region_with_vmobject: Overflow (offset + size)\n");
return nullptr;
}
if (offset_in_vmobject >= vmobject->size()) {
dbgprintf("allocate_region_with_vmobject: Attempt to allocate a region with an offset past the end of its VMObject.\n");
return nullptr;
}
if (end_in_vmobject > vmobject->size()) {
dbgprintf("allocate_region_with_vmobject: Attempt to allocate a region with an end past the end of its VMObject.\n");
return nullptr;
}
Kernel: Rename LinearAddress => VirtualAddress.
2019-06-07 10:56:50 +00:00
auto range = allocate_range(vaddr, size);
Kernel: Factor out range allocation from Process::allocate_region*(). These functions were doing exactly the same thing for range allocation, so share that code in an allocate_range() helper. Region allocation will now also fail if range allocation fails, which means that mmap() can actually fail without falling apart. Exciting times!
2019-05-17 02:39:22 +00:00
if (!range.is_valid())
return nullptr;
Kernel: Rename vmo => vmobject everywhere
2019-12-19 18:13:44 +00:00
offset_in_vmobject &= PAGE_MASK;
Kernel: Add a Process::add_region() helper This is a private helper for adding a Region to Process::m_regions. It's just for convenience since it's a bit cumbersome to do this.
2020-01-19 15:25:38 +00:00
Region* region;
Kernel+LibELF: Enable SMAP protection during non-syscall exec() When loading a new executable, we now map the ELF image in kernel-only memory and parse it there. Then we use copy_to_user() when initializing writable regions with data from the executable. Note that the exec() syscall still disables SMAP protection and will require additional work. This patch only affects kernel-originated process spawns.
2020-01-10 05:57:18 +00:00
if (user_accessible)
Kernel: Add a Process::add_region() helper This is a private helper for adding a Region to Process::m_regions. It's just for convenience since it's a bit cumbersome to do this.
2020-01-19 15:25:38 +00:00
region = &add_region(Region::create_user_accessible(range, move(vmobject), offset_in_vmobject, name, prot_to_region_access_flags(prot)));
Kernel+LibELF: Enable SMAP protection during non-syscall exec() When loading a new executable, we now map the ELF image in kernel-only memory and parse it there. Then we use copy_to_user() when initializing writable regions with data from the executable. Note that the exec() syscall still disables SMAP protection and will require additional work. This patch only affects kernel-originated process spawns.
2020-01-10 05:57:18 +00:00
else
Kernel: Add a Process::add_region() helper This is a private helper for adding a Region to Process::m_regions. It's just for convenience since it's a bit cumbersome to do this.
2020-01-19 15:25:38 +00:00
region = &add_region(Region::create_kernel_only(range, move(vmobject), offset_in_vmobject, name, prot_to_region_access_flags(prot)));
region->map(page_directory());
return region;
Teach Process::exec() about the magic of file-backed VMO's. This is really sweet! :^) The four instances of /bin/sh spawned at startup now share their read-only text pages. There are problems and limitations here, and plenty of room for improvement. But it kinda works.
2018-11-08 20:20:09 +00:00
}
Use ELF program headers to load executables smarter. This turned out way better than the old code. ELF loading is now quite straightforward, and we don't need the weird concept of subregions anymore. Next step is to respect the is_writable flag.
2018-11-03 10:28:23 +00:00
bool Process::deallocate_region(Region& region)
Add simplified mmap() and munmap() syscalls.
2018-10-24 07:48:24 +00:00
{
Canonicalize the path used by sh. With a bunch of LibC work to support the feature. LibC now initializes AK::StringImpl by default. It's now fine to use AK in LibC/Userland! :^)
2018-10-28 08:36:21 +00:00
InterruptDisabler disabler;
Kernel: Add a 1-deep cache to Process::region_from_range() This simple cache gets hit over 70% of the time on "g++ Process.cpp" and shaves ~3% off the runtime.
2020-01-19 15:44:37 +00:00
if (m_region_lookup_cache.region == &region)
m_region_lookup_cache.region = nullptr;
More moving towards using signed types. I'm still feeling this out, but I am starting to like the general idea.
2019-02-25 21:06:55 +00:00
for (int i = 0; i < m_regions.size(); ++i) {
Kernel: Use NonnullRefPtrVector in parts of the kernel.
2019-06-27 11:34:28 +00:00
if (&m_regions[i] == &region) {
Kernel: Add a Process::add_region() helper This is a private helper for adding a Region to Process::m_regions. It's just for convenience since it's a bit cumbersome to do this.
2020-01-19 15:25:38 +00:00
m_regions.remove(i);
Add simplified mmap() and munmap() syscalls.
2018-10-24 07:48:24 +00:00
return true;
}
}
return false;
}
Kernel: Support partial munmap() You can now munmap() a part of a region. The kernel will then create one or two new regions around the "hole" and re-map them using the same physical pages as before. This goes towards fixing #175, but not all the way since we don't yet do munmap() across multiple mappings.
2019-08-29 18:57:02 +00:00
Region* Process::region_from_range(const Range& range)
{
Kernel: Add a 1-deep cache to Process::region_from_range() This simple cache gets hit over 70% of the time on "g++ Process.cpp" and shaves ~3% off the runtime.
2020-01-19 15:44:37 +00:00
if (m_region_lookup_cache.range == range && m_region_lookup_cache.region)
return m_region_lookup_cache.region;
Kernel: Support partial munmap() You can now munmap() a part of a region. The kernel will then create one or two new regions around the "hole" and re-map them using the same physical pages as before. This goes towards fixing #175, but not all the way since we don't yet do munmap() across multiple mappings.
2019-08-29 18:57:02 +00:00
size_t size = PAGE_ROUND_UP(range.size());
for (auto& region : m_regions) {
Kernel: Add a 1-deep cache to Process::region_from_range() This simple cache gets hit over 70% of the time on "g++ Process.cpp" and shaves ~3% off the runtime.
2020-01-19 15:44:37 +00:00
if (region.vaddr() == range.base() && region.size() == size) {
m_region_lookup_cache.range = range;
m_region_lookup_cache.region = &region;
Kernel: Support partial munmap() You can now munmap() a part of a region. The kernel will then create one or two new regions around the "hole" and re-map them using the same physical pages as before. This goes towards fixing #175, but not all the way since we don't yet do munmap() across multiple mappings.
2019-08-29 18:57:02 +00:00
return &region;
Kernel: Add a 1-deep cache to Process::region_from_range() This simple cache gets hit over 70% of the time on "g++ Process.cpp" and shaves ~3% off the runtime.
2020-01-19 15:44:37 +00:00
}
Kernel: Support partial munmap() You can now munmap() a part of a region. The kernel will then create one or two new regions around the "hole" and re-map them using the same physical pages as before. This goes towards fixing #175, but not all the way since we don't yet do munmap() across multiple mappings.
2019-08-29 18:57:02 +00:00
}
return nullptr;
}
Region* Process::region_containing(const Range& range)
Add simplified mmap() and munmap() syscalls.
2018-10-24 07:48:24 +00:00
{
for (auto& region : m_regions) {
Kernel: Support partial munmap() You can now munmap() a part of a region. The kernel will then create one or two new regions around the "hole" and re-map them using the same physical pages as before. This goes towards fixing #175, but not all the way since we don't yet do munmap() across multiple mappings.
2019-08-29 18:57:02 +00:00
if (region.contains(range))
Kernel: Use NonnullRefPtrVector in parts of the kernel.
2019-06-27 11:34:28 +00:00
return &region;
Add simplified mmap() and munmap() syscalls.
2018-10-24 07:48:24 +00:00
}
return nullptr;
}
Kernel: Pass name+length to set_mmap_name() and remove SmapDisabler
2020-01-06 10:56:59 +00:00
int Process::sys$set_mmap_name(const Syscall::SC_set_mmap_name_params* user_params)
Add sys$set_mmap_name and use it from LibC's malloc. It's nice to be able to identify mmap's in /proc/PID/vm.
2018-10-28 08:57:22 +00:00
{
ping: Use pledge()
2020-01-11 19:48:43 +00:00
REQUIRE_PROMISE(stdio);
Kernel: Pass name+length to set_mmap_name() and remove SmapDisabler
2020-01-06 10:56:59 +00:00
Syscall::SC_set_mmap_name_params params;
Kernel: Combine validate and copy of user mode pointers (#1069) Right now there is a significant amount of boiler plate code required to validate user mode parameters in syscalls. In an attempt to reduce this a bit, introduce validate_read_and_copy_typed which combines the usermode address check and does the copy internally if the validation passes. This cleans up a little bit of code from a significant amount of syscalls.
2020-01-13 10:19:18 +00:00
if (!validate_read_and_copy_typed(&params, user_params))
return -EFAULT;
Kernel: Pass name+length to set_mmap_name() and remove SmapDisabler
2020-01-06 10:56:59 +00:00
Kernel: Disallow mmap names longer than PATH_MAX
2020-01-18 10:34:53 +00:00
if (params.name.length > PATH_MAX)
return -ENAMETOOLONG;
Kernel: Use the Syscall string and buffer types more While I was updating syscalls to stop passing null-terminated strings, I added some helpful struct types: - StringArgument { const char*; size_t; } - ImmutableBuffer<Data, Size> { const Data*; Size; } - MutableBuffer<Data, Size> { Data*; Size; } The Process class has some convenience functions for validating and optionally extracting the contents from these structs: - get_syscall_path_argument(StringArgument) - validate_and_copy_string_from_user(StringArgument) - validate(ImmutableBuffer) - validate(MutableBuffer) There's still so much code around this and I'm wondering if we should generate most of it instead. Possible nice little project.
2020-01-11 11:47:47 +00:00
auto name = validate_and_copy_string_from_user(params.name);
if (name.is_null())
Kernel: Pass name+length to set_mmap_name() and remove SmapDisabler
2020-01-06 10:56:59 +00:00
return -EFAULT;
Kernel: Remove some unnecessary casts to uintptr_t VirtualAddress is constructible from uintptr_t and const void*. PhysicalAddress is constructible from uintptr_t but not const void*.
2020-01-20 12:06:41 +00:00
auto* region = region_from_range({ VirtualAddress(params.addr), params.size });
Add sys$set_mmap_name and use it from LibC's malloc. It's nice to be able to identify mmap's in /proc/PID/vm.
2018-10-28 08:57:22 +00:00
if (!region)
return -EINVAL;
Kernel: Mark mmap()-created regions with a special bit Then only allow regions with that bit to be manipulated via munmap() and mprotect(). This prevents messing with non-mmap()ed regions in a process's address space (stacks, shared buffers, ...)
2019-11-24 11:24:16 +00:00
if (!region->is_mmap())
return -EPERM;
Kernel: Pass name+length to set_mmap_name() and remove SmapDisabler
2020-01-06 10:56:59 +00:00
region->set_name(name);
Add sys$set_mmap_name and use it from LibC's malloc. It's nice to be able to identify mmap's in /proc/PID/vm.
2018-10-28 08:57:22 +00:00
return 0;
}
Kernel: Clarify the various input validity checks in mmap() Also share some validation logic between mmap() and mprotect().
2019-12-25 20:50:13 +00:00
static bool validate_mmap_prot(int prot, bool map_stack)
{
bool readable = prot & PROT_READ;
bool writable = prot & PROT_WRITE;
bool executable = prot & PROT_EXEC;
if (writable && executable)
return false;
if (map_stack) {
if (executable)
return false;
if (!readable || !writable)
return false;
}
return true;
}
Kernel: Validate PROT_READ and PROT_WRITE against underlying file This patch fixes some issues with the mmap() and mprotect() syscalls, neither of whom were checking the permission bits of the underlying files when mapping an inode MAP_SHARED. This made it possible to subvert execution of any running program by simply memory-mapping its executable and replacing some of the code. Test: Kernel/mmap-write-into-running-programs-executable-file.cpp
2020-01-07 18:29:18 +00:00
static bool validate_inode_mmap_prot(const Process& process, int prot, const Inode& inode)
{
auto metadata = inode.metadata();
if ((prot & PROT_WRITE) && !metadata.may_write(process))
return false;
if ((prot & PROT_READ) && !metadata.may_read(process))
return false;
Kernel: Enforce W^X between sys$mmap() and sys$execve() It's now an error to sys$mmap() a file as writable if it's currently mapped executable by anyone else. It's also an error to sys$execve() a file that's currently mapped writable by anyone else. This fixes a race condition vulnerability where one program could make modifications to an executable while another process was in the kernel, in the middle of exec'ing the same executable. Test: Kernel/elf-execve-mmap-race.cpp
2020-01-18 22:31:29 +00:00
InterruptDisabler disabler;
if (inode.vmobject()) {
if ((prot & PROT_EXEC) && inode.vmobject()->writable_mappings())
return false;
if ((prot & PROT_WRITE) && inode.vmobject()->executable_mappings())
return false;
}
Kernel: Validate PROT_READ and PROT_WRITE against underlying file This patch fixes some issues with the mmap() and mprotect() syscalls, neither of whom were checking the permission bits of the underlying files when mapping an inode MAP_SHARED. This made it possible to subvert execution of any running program by simply memory-mapping its executable and replacing some of the code. Test: Kernel/mmap-write-into-running-programs-executable-file.cpp
2020-01-07 18:29:18 +00:00
return true;
}
Kernel: sys$mprotect protects sub-regions as well as whole ones Split a region into two/three if the desired mprotect range is a strict subset of an existing region. We can then set the access bits on a new region that is just our desired range and add both the new desired subregion and the leftovers back to our page tables.
2019-12-30 20:11:25 +00:00
// Carve out a virtual address range from a region and return the two regions on either side
Vector<Region*, 2> Process::split_region_around_range(const Region& source_region, const Range& desired_range)
{
Range old_region_range = source_region.range();
auto remaining_ranges_after_unmap = old_region_range.carve(desired_range);
Kernel: Reject non-user address ranges in mmap/munmap/mprotect/madvise There's no valid reason to allow non-userspace address ranges in these system calls.
2020-01-30 20:46:45 +00:00
Kernel: sys$mprotect protects sub-regions as well as whole ones Split a region into two/three if the desired mprotect range is a strict subset of an existing region. We can then set the access bits on a new region that is just our desired range and add both the new desired subregion and the leftovers back to our page tables.
2019-12-30 20:11:25 +00:00
ASSERT(!remaining_ranges_after_unmap.is_empty());
auto make_replacement_region = [&](const Range& new_range) -> Region& {
ASSERT(new_range.base() >= old_region_range.base());
ASSERT(new_range.end() <= old_region_range.end());
size_t new_range_offset_in_vmobject = source_region.offset_in_vmobject() + (new_range.base().get() - old_region_range.base().get());
return allocate_split_region(source_region, new_range, new_range_offset_in_vmobject);
};
Vector<Region*, 2> new_regions;
for (auto& new_range : remaining_ranges_after_unmap) {
new_regions.unchecked_append(&make_replacement_region(new_range));
}
return new_regions;
}
Kernel: Pass name+length to mmap() and remove SmapDisabler
2020-01-06 11:04:55 +00:00
void* Process::sys$mmap(const Syscall::SC_mmap_params* user_params)
Add simplified mmap() and munmap() syscalls.
2018-10-24 07:48:24 +00:00
{
ping: Use pledge()
2020-01-11 19:48:43 +00:00
REQUIRE_PROMISE(stdio);
Kernel: Pass name+length to mmap() and remove SmapDisabler
2020-01-06 11:04:55 +00:00
Syscall::SC_mmap_params params;
Kernel: Combine validate and copy of user mode pointers (#1069) Right now there is a significant amount of boiler plate code required to validate user mode parameters in syscalls. In an attempt to reduce this a bit, introduce validate_read_and_copy_typed which combines the usermode address check and does the copy internally if the validation passes. This cleans up a little bit of code from a significant amount of syscalls.
2020-01-13 10:19:18 +00:00
if (!validate_read_and_copy_typed(&params, user_params))
return (void*)-EFAULT;
Kernel: Pass name+length to mmap() and remove SmapDisabler
2020-01-06 11:04:55 +00:00
void* addr = (void*)params.addr;
size_t size = params.size;
int prot = params.prot;
int flags = params.flags;
int fd = params.fd;
int offset = params.offset;
Kernel: Use C++ structured bindings to bind syscall parameters Some syscalls have to pass parameters through a struct, since we can only fit 3 parameters with our calling convention. This patch makes use of C++ structured binding to clean up the places where we expand those parameters structs into local variables.
2019-11-10 14:32:59 +00:00
Kernel: Reject non-user address ranges in mmap/munmap/mprotect/madvise There's no valid reason to allow non-userspace address ranges in these system calls.
2020-01-30 20:46:45 +00:00
if (!is_user_range(VirtualAddress(addr), size))
return (void*)-EFAULT;
Kernel: Use the Syscall string and buffer types more While I was updating syscalls to stop passing null-terminated strings, I added some helpful struct types: - StringArgument { const char*; size_t; } - ImmutableBuffer<Data, Size> { const Data*; Size; } - MutableBuffer<Data, Size> { Data*; Size; } The Process class has some convenience functions for validating and optionally extracting the contents from these structs: - get_syscall_path_argument(StringArgument) - validate_and_copy_string_from_user(StringArgument) - validate(ImmutableBuffer) - validate(MutableBuffer) There's still so much code around this and I'm wondering if we should generate most of it instead. Possible nice little project.
2020-01-11 11:47:47 +00:00
String name;
if (params.name.characters) {
Kernel: Disallow mmap names longer than PATH_MAX
2020-01-18 10:34:53 +00:00
if (params.name.length > PATH_MAX)
return (void*)-ENAMETOOLONG;
Kernel: Use the Syscall string and buffer types more While I was updating syscalls to stop passing null-terminated strings, I added some helpful struct types: - StringArgument { const char*; size_t; } - ImmutableBuffer<Data, Size> { const Data*; Size; } - MutableBuffer<Data, Size> { Data*; Size; } The Process class has some convenience functions for validating and optionally extracting the contents from these structs: - get_syscall_path_argument(StringArgument) - validate_and_copy_string_from_user(StringArgument) - validate(ImmutableBuffer) - validate(MutableBuffer) There's still so much code around this and I'm wondering if we should generate most of it instead. Possible nice little project.
2020-01-11 11:47:47 +00:00
name = validate_and_copy_string_from_user(params.name);
if (name.is_null())
return (void*)-EFAULT;
}
Kernel: Clarify the various input validity checks in mmap() Also share some validation logic between mmap() and mprotect().
2019-12-25 20:50:13 +00:00
Support basic mmap'ing of a file! All right, we can now mmap() a file and it gets magically paged in from fs in response to an NP page fault. This is really cool :^) I need to refactor this to support sharing of read-only file-backed pages, but it's cool to just have something working.
2018-11-08 11:59:16 +00:00
if (size == 0)
return (void*)-EINVAL;
Use uintptr_t instead of u32 when storing pointers as integers uintptr_t is 32-bit or 64-bit depending on the target platform. This will help us write pointer size agnostic code so that when the day comes that we want to do a 64-bit port, we'll be in better shape.
2020-01-20 12:06:14 +00:00
if ((uintptr_t)addr & ~PAGE_MASK)
Support basic mmap'ing of a file! All right, we can now mmap() a file and it gets magically paged in from fs in response to an NP page fault. This is really cool :^) I need to refactor this to support sharing of read-only file-backed pages, but it's cool to just have something working.
2018-11-08 11:59:16 +00:00
return (void*)-EINVAL;
Kernel: Clarify the various input validity checks in mmap() Also share some validation logic between mmap() and mprotect().
2019-12-25 20:50:13 +00:00
bool map_shared = flags & MAP_SHARED;
bool map_anonymous = flags & MAP_ANONYMOUS;
bool map_purgeable = flags & MAP_PURGEABLE;
bool map_private = flags & MAP_PRIVATE;
bool map_stack = flags & MAP_STACK;
Kernel: Retry mmap if MAP_FIXED is not in flags and addr is not 0 If an mmap fails to allocate a region, but the addr passed in was non-zero, non-fixed mmaps should attempt to allocate at any available virtual address.
2019-12-29 05:54:10 +00:00
bool map_fixed = flags & MAP_FIXED;
Kernel: Clarify the various input validity checks in mmap() Also share some validation logic between mmap() and mprotect().
2019-12-25 20:50:13 +00:00
if (map_shared && map_private)
Kernel: mmap() with both MAP_PRIVATE and MAP_SHARED is an error
2019-10-01 17:31:55 +00:00
return (void*)-EINVAL;
Kernel: Implement some basic stack pointer validation VM regions can now be marked as stack regions, which is then validated on syscall, and on page fault. If a thread is caught with its stack pointer pointing into anything that's *not* a Region with its stack bit set, we'll crash the whole process with SIGSTKFLT. Userspace must now allocate custom stacks by using mmap() with the new MAP_STACK flag. This mechanism was first introduced in OpenBSD, and now we have it too, yay! :^)
2019-11-17 11:11:43 +00:00
Kernel: Clarify the various input validity checks in mmap() Also share some validation logic between mmap() and mprotect().
2019-12-25 20:50:13 +00:00
if (!map_shared && !map_private)
Kernel: Don't allow mmap()/mprotect() to set up PROT_WRITE|PROT_EXEC ..but also allow mprotect() to set PROT_EXEC on a region, something we were just ignoring before.
2019-12-25 10:54:16 +00:00
return (void*)-EINVAL;
Kernel: Clarify the various input validity checks in mmap() Also share some validation logic between mmap() and mprotect().
2019-12-25 20:50:13 +00:00
if (!validate_mmap_prot(prot, map_stack))
Kernel: Implement some basic stack pointer validation VM regions can now be marked as stack regions, which is then validated on syscall, and on page fault. If a thread is caught with its stack pointer pointing into anything that's *not* a Region with its stack bit set, we'll crash the whole process with SIGSTKFLT. Userspace must now allocate custom stacks by using mmap() with the new MAP_STACK flag. This mechanism was first introduced in OpenBSD, and now we have it too, yay! :^)
2019-11-17 11:11:43 +00:00
return (void*)-EINVAL;
Kernel: Clarify the various input validity checks in mmap() Also share some validation logic between mmap() and mprotect().
2019-12-25 20:50:13 +00:00
if (map_stack && (!map_private || !map_anonymous))
Kernel: Implement some basic stack pointer validation VM regions can now be marked as stack regions, which is then validated on syscall, and on page fault. If a thread is caught with its stack pointer pointing into anything that's *not* a Region with its stack bit set, we'll crash the whole process with SIGSTKFLT. Userspace must now allocate custom stacks by using mmap() with the new MAP_STACK flag. This mechanism was first introduced in OpenBSD, and now we have it too, yay! :^)
2019-11-17 11:11:43 +00:00
return (void*)-EINVAL;
Kernel: Clarify the various input validity checks in mmap() Also share some validation logic between mmap() and mprotect().
2019-12-25 20:50:13 +00:00
Region* region = nullptr;
if (map_purgeable) {
Kernel: Start implementing purgeable memory support It's now possible to get purgeable memory by using mmap(MAP_PURGEABLE). Purgeable memory has a "volatile" flag that can be set using madvise(): - madvise(..., MADV_SET_VOLATILE) - madvise(..., MADV_SET_NONVOLATILE) When in the "volatile" state, the kernel may take away the underlying physical memory pages at any time, without notifying the owner. This gives you a guilt discount when caching very large things. :^) Setting a purgeable region to non-volatile will return whether or not the memory has been taken away by the kernel while being volatile. Basically, if madvise(..., MADV_SET_NONVOLATILE) returns 1, that means the memory was purged while volatile, and whatever was in that piece of memory needs to be reconstructed before use.
2019-12-09 18:12:38 +00:00
auto vmobject = PurgeableVMObject::create_with_size(size);
Kernel: Remove some unnecessary casts to uintptr_t VirtualAddress is constructible from uintptr_t and const void*. PhysicalAddress is constructible from uintptr_t but not const void*.
2020-01-20 12:06:41 +00:00
region = allocate_region_with_vmobject(VirtualAddress(addr), size, vmobject, 0, !name.is_null() ? name : "mmap (purgeable)", prot);
Kernel: Retry mmap if MAP_FIXED is not in flags and addr is not 0 If an mmap fails to allocate a region, but the addr passed in was non-zero, non-fixed mmaps should attempt to allocate at any available virtual address.
2019-12-29 05:54:10 +00:00
if (!region && (!map_fixed && addr != 0))
Kernel: Pass name+length to mmap() and remove SmapDisabler
2020-01-06 11:04:55 +00:00
region = allocate_region_with_vmobject({}, size, vmobject, 0, !name.is_null() ? name : "mmap (purgeable)", prot);
Kernel: Clarify the various input validity checks in mmap() Also share some validation logic between mmap() and mprotect().
2019-12-25 20:50:13 +00:00
} else if (map_anonymous) {
Kernel: Remove some unnecessary casts to uintptr_t VirtualAddress is constructible from uintptr_t and const void*. PhysicalAddress is constructible from uintptr_t but not const void*.
2020-01-20 12:06:41 +00:00
region = allocate_region(VirtualAddress(addr), size, !name.is_null() ? name : "mmap", prot, false);
Kernel: Retry mmap if MAP_FIXED is not in flags and addr is not 0 If an mmap fails to allocate a region, but the addr passed in was non-zero, non-fixed mmaps should attempt to allocate at any available virtual address.
2019-12-29 05:54:10 +00:00
if (!region && (!map_fixed && addr != 0))
Kernel: Pass name+length to mmap() and remove SmapDisabler
2020-01-06 11:04:55 +00:00
region = allocate_region({}, size, !name.is_null() ? name : "mmap", prot, false);
Kernel: Clarify the various input validity checks in mmap() Also share some validation logic between mmap() and mprotect().
2019-12-25 20:50:13 +00:00
} else {
if (offset < 0)
return (void*)-EINVAL;
if (static_cast<size_t>(offset) & ~PAGE_MASK)
return (void*)-EINVAL;
Kernel: mmap(..., MAP_PRIVATE, fd, offset) is not supported Make mmap return -ENOTSUP in this case to make sure users don't get confused and think they're using a private mapping when it's actually shared. It's currenlty not possible to open a file and mmap it MAP_PRIVATE, and change the perms of the private mapping to ones that don't match the permissions of the underlying file.
2020-01-09 04:28:11 +00:00
// FIXME: Implement MAP_PRIVATE for FileDescription-backed mmap
if (map_private)
return (void*)-ENOTSUP;
Kernel: Make Process::file_description() vend a RefPtr<FileDescription> This encourages callers to strongly reference file descriptions while working with them. This fixes a use-after-free issue where one thread would close() an open fd while another thread was blocked on it becoming readable. Test: Kernel/uaf-close-while-blocked-in-read.cpp
2020-01-07 14:53:42 +00:00
auto description = file_description(fd);
Kernel: Clarify the various input validity checks in mmap() Also share some validation logic between mmap() and mprotect().
2019-12-25 20:50:13 +00:00
if (!description)
return (void*)-EBADF;
Kernel: mmap() should fail with ENODEV for directories
2020-01-08 11:33:36 +00:00
if (description->is_directory())
return (void*)-ENODEV;
Kernel: Validate PROT_READ and PROT_WRITE against underlying file This patch fixes some issues with the mmap() and mprotect() syscalls, neither of whom were checking the permission bits of the underlying files when mapping an inode MAP_SHARED. This made it possible to subvert execution of any running program by simply memory-mapping its executable and replacing some of the code. Test: Kernel/mmap-write-into-running-programs-executable-file.cpp
2020-01-07 18:29:18 +00:00
if ((prot & PROT_READ) && !description->is_readable())
return (void*)-EACCES;
if ((prot & PROT_WRITE) && !description->is_writable())
return (void*)-EACCES;
if (description->inode()) {
if (!validate_inode_mmap_prot(*this, prot, *description->inode()))
return (void*)-EACCES;
}
Kernel: Remove some unnecessary casts to uintptr_t VirtualAddress is constructible from uintptr_t and const void*. PhysicalAddress is constructible from uintptr_t but not const void*.
2020-01-20 12:06:41 +00:00
auto region_or_error = description->mmap(*this, VirtualAddress(addr), static_cast<size_t>(offset), size, prot);
Kernel: Retry mmap if MAP_FIXED is not in flags and addr is not 0 If an mmap fails to allocate a region, but the addr passed in was non-zero, non-fixed mmaps should attempt to allocate at any available virtual address.
2019-12-29 05:54:10 +00:00
if (region_or_error.is_error()) {
// Fail if MAP_FIXED or address is 0, retry otherwise
if (map_fixed || addr == 0)
return (void*)(int)region_or_error.error();
region_or_error = description->mmap(*this, {}, static_cast<size_t>(offset), size, prot);
}
Kernel: Clarify the various input validity checks in mmap() Also share some validation logic between mmap() and mprotect().
2019-12-25 20:50:13 +00:00
if (region_or_error.is_error())
return (void*)(int)region_or_error.error();
region = region_or_error.value();
Kernel: Start implementing purgeable memory support It's now possible to get purgeable memory by using mmap(MAP_PURGEABLE). Purgeable memory has a "volatile" flag that can be set using madvise(): - madvise(..., MADV_SET_VOLATILE) - madvise(..., MADV_SET_NONVOLATILE) When in the "volatile" state, the kernel may take away the underlying physical memory pages at any time, without notifying the owner. This gives you a guilt discount when caching very large things. :^) Setting a purgeable region to non-volatile will return whether or not the memory has been taken away by the kernel while being volatile. Basically, if madvise(..., MADV_SET_NONVOLATILE) returns 1, that means the memory was purged while volatile, and whatever was in that piece of memory needs to be reconstructed before use.
2019-12-09 18:12:38 +00:00
}
Kernel: Clarify the various input validity checks in mmap() Also share some validation logic between mmap() and mprotect().
2019-12-25 20:50:13 +00:00
if (!region)
return (void*)-ENOMEM;
region->set_mmap(true);
if (map_shared)
Move WindowServer to userspace. This is a monster patch that required changing a whole bunch of things. There are performance and stability issues all over the place, but it works. Pretty cool, I have to admit :^)
2019-02-16 23:13:47 +00:00
region->set_shared(true);
Kernel: Clarify the various input validity checks in mmap() Also share some validation logic between mmap() and mprotect().
2019-12-25 20:50:13 +00:00
if (map_stack)
region->set_stack(true);
Kernel: Pass name+length to mmap() and remove SmapDisabler
2020-01-06 11:04:55 +00:00
if (!name.is_null())
LibC: Add mmap_with_name() that names the allocation immediately. This allows us to skip the separate call to set_mmap_name() in code that we control, e.g malloc() and GraphicsBitmap.
2019-05-19 13:54:56 +00:00
region->set_name(name);
Kernel: Rename LinearAddress => VirtualAddress.
2019-06-07 10:56:50 +00:00
return region->vaddr().as_ptr();
Add simplified mmap() and munmap() syscalls.
2018-10-24 07:48:24 +00:00
}
Process now maps regions immediately when they are allocated. This avoids having to do a separate MM.mapRegionsForTask() pass. Also, more Task => Process renaming that I apparently hadn't saved yet.
2018-11-01 12:15:46 +00:00
int Process::sys$munmap(void* addr, size_t size)
Add simplified mmap() and munmap() syscalls.
2018-10-24 07:48:24 +00:00
{
ping: Use pledge()
2020-01-11 19:48:43 +00:00
REQUIRE_PROMISE(stdio);
Kernel: Reject non-user address ranges in mmap/munmap/mprotect/madvise There's no valid reason to allow non-userspace address ranges in these system calls.
2020-01-30 20:46:45 +00:00
Kernel: Disallow empty ranges in munmap/mprotect/madvise
2020-01-30 20:55:49 +00:00
if (!size)
return -EINVAL;
Kernel: Reject non-user address ranges in mmap/munmap/mprotect/madvise There's no valid reason to allow non-userspace address ranges in these system calls.
2020-01-30 20:46:45 +00:00
if (!is_user_range(VirtualAddress(addr), size))
return -EFAULT;
Kernel: Remove some unnecessary casts to uintptr_t VirtualAddress is constructible from uintptr_t and const void*. PhysicalAddress is constructible from uintptr_t but not const void*.
2020-01-20 12:06:41 +00:00
Range range_to_unmap { VirtualAddress(addr), size };
Kernel: Support partial munmap() You can now munmap() a part of a region. The kernel will then create one or two new regions around the "hole" and re-map them using the same physical pages as before. This goes towards fixing #175, but not all the way since we don't yet do munmap() across multiple mappings.
2019-08-29 18:57:02 +00:00
if (auto* whole_region = region_from_range(range_to_unmap)) {
Kernel: Mark mmap()-created regions with a special bit Then only allow regions with that bit to be manipulated via munmap() and mprotect(). This prevents messing with non-mmap()ed regions in a process's address space (stacks, shared buffers, ...)
2019-11-24 11:24:16 +00:00
if (!whole_region->is_mmap())
return -EPERM;
Kernel: Support partial munmap() You can now munmap() a part of a region. The kernel will then create one or two new regions around the "hole" and re-map them using the same physical pages as before. This goes towards fixing #175, but not all the way since we don't yet do munmap() across multiple mappings.
2019-08-29 18:57:02 +00:00
bool success = deallocate_region(*whole_region);
ASSERT(success);
return 0;
}
if (auto* old_region = region_containing(range_to_unmap)) {
Kernel: Mark mmap()-created regions with a special bit Then only allow regions with that bit to be manipulated via munmap() and mprotect(). This prevents messing with non-mmap()ed regions in a process's address space (stacks, shared buffers, ...)
2019-11-24 11:24:16 +00:00
if (!old_region->is_mmap())
return -EPERM;
Kernel: sys$mprotect protects sub-regions as well as whole ones Split a region into two/three if the desired mprotect range is a strict subset of an existing region. We can then set the access bits on a new region that is just our desired range and add both the new desired subregion and the leftovers back to our page tables.
2019-12-30 20:11:25 +00:00
auto new_regions = split_region_around_range(*old_region, range_to_unmap);
Kernel: Fix partial munmap() deallocating still-in-use VM We were always returning the full VM range of the partially-unmapped Region to the range allocator. This caused us to re-use those addresses for subsequent VM allocations. This patch also skips creating a new VMObject in partial munmap(). Instead we just make split regions that point into the same VMObject. This fixes the mysterious GCC ICE on large C++ programs.
2019-09-27 18:17:41 +00:00
// We manually unmap the old region here, specifying that we *don't* want the VM deallocated.
Kernel: Move region map/unmap operations into the Region class The more Region can take care of itself, the better.
2019-11-03 19:37:03 +00:00
old_region->unmap(Region::ShouldDeallocateVirtualMemoryRange::No);
Kernel: Support partial munmap() You can now munmap() a part of a region. The kernel will then create one or two new regions around the "hole" and re-map them using the same physical pages as before. This goes towards fixing #175, but not all the way since we don't yet do munmap() across multiple mappings.
2019-08-29 18:57:02 +00:00
deallocate_region(*old_region);
Kernel: Fix partial munmap() deallocating still-in-use VM We were always returning the full VM range of the partially-unmapped Region to the range allocator. This caused us to re-use those addresses for subsequent VM allocations. This patch also skips creating a new VMObject in partial munmap(). Instead we just make split regions that point into the same VMObject. This fixes the mysterious GCC ICE on large C++ programs.
2019-09-27 18:17:41 +00:00
// Instead we give back the unwanted VM manually.
page_directory().range_allocator().deallocate(range_to_unmap);
Kernel: sys$mprotect protects sub-regions as well as whole ones Split a region into two/three if the desired mprotect range is a strict subset of an existing region. We can then set the access bits on a new region that is just our desired range and add both the new desired subregion and the leftovers back to our page tables.
2019-12-30 20:11:25 +00:00
// And finally we map the new region(s) using our page directory (they were just allocated and don't have one).
Kernel: Support partial munmap() You can now munmap() a part of a region. The kernel will then create one or two new regions around the "hole" and re-map them using the same physical pages as before. This goes towards fixing #175, but not all the way since we don't yet do munmap() across multiple mappings.
2019-08-29 18:57:02 +00:00
for (auto* new_region : new_regions) {
Kernel: Regions should be mapped into a PageDirectory, not a Process This patch changes the parameter to Region::map() to be a PageDirectory since that matches how we think about the memory model: Regions are views onto VMObjects, and are mapped into PageDirectories. Each Process has a PageDirectory. The kernel also has a PageDirectory.
2019-11-03 19:48:35 +00:00
new_region->map(page_directory());
Kernel: Support partial munmap() You can now munmap() a part of a region. The kernel will then create one or two new regions around the "hole" and re-map them using the same physical pages as before. This goes towards fixing #175, but not all the way since we don't yet do munmap() across multiple mappings.
2019-08-29 18:57:02 +00:00
}
return 0;
}
// FIXME: We should also support munmap() across multiple regions. (#175)
return -EINVAL;
Add simplified mmap() and munmap() syscalls.
2018-10-24 07:48:24 +00:00
}
Kernel+LibC+crash: Add mprotect() syscall This patch adds the mprotect() syscall to allow changing the protection flags for memory regions. We don't do any region splitting/merging yet, so this only works on whole mmap() regions. Added a "crash -r" flag to verify that we crash when you attempt to write to read-only memory. :^)
2019-08-12 17:33:24 +00:00
int Process::sys$mprotect(void* addr, size_t size, int prot)
{
ping: Use pledge()
2020-01-11 19:48:43 +00:00
REQUIRE_PROMISE(stdio);
Kernel: Reject non-user address ranges in mmap/munmap/mprotect/madvise There's no valid reason to allow non-userspace address ranges in these system calls.
2020-01-30 20:46:45 +00:00
Kernel: Disallow empty ranges in munmap/mprotect/madvise
2020-01-30 20:55:49 +00:00
if (!size)
return -EINVAL;
Kernel: Reject non-user address ranges in mmap/munmap/mprotect/madvise There's no valid reason to allow non-userspace address ranges in these system calls.
2020-01-30 20:46:45 +00:00
if (!is_user_range(VirtualAddress(addr), size))
return -EFAULT;
Kernel: Remove some unnecessary casts to uintptr_t VirtualAddress is constructible from uintptr_t and const void*. PhysicalAddress is constructible from uintptr_t but not const void*.
2020-01-20 12:06:41 +00:00
Range range_to_mprotect = { VirtualAddress(addr), size };
Kernel: sys$mprotect protects sub-regions as well as whole ones Split a region into two/three if the desired mprotect range is a strict subset of an existing region. We can then set the access bits on a new region that is just our desired range and add both the new desired subregion and the leftovers back to our page tables.
2019-12-30 20:11:25 +00:00
if (auto* whole_region = region_from_range(range_to_mprotect)) {
if (!whole_region->is_mmap())
return -EPERM;
if (!validate_mmap_prot(prot, whole_region->is_stack()))
return -EINVAL;
if (whole_region->access() == prot_to_region_access_flags(prot))
return 0;
Kernel: Validate PROT_READ and PROT_WRITE against underlying file This patch fixes some issues with the mmap() and mprotect() syscalls, neither of whom were checking the permission bits of the underlying files when mapping an inode MAP_SHARED. This made it possible to subvert execution of any running program by simply memory-mapping its executable and replacing some of the code. Test: Kernel/mmap-write-into-running-programs-executable-file.cpp
2020-01-07 18:29:18 +00:00
if (whole_region->vmobject().is_inode()
&& !validate_inode_mmap_prot(*this, prot, static_cast<const InodeVMObject&>(whole_region->vmobject()).inode())) {
return -EACCES;
}
Kernel: sys$mprotect protects sub-regions as well as whole ones Split a region into two/three if the desired mprotect range is a strict subset of an existing region. We can then set the access bits on a new region that is just our desired range and add both the new desired subregion and the leftovers back to our page tables.
2019-12-30 20:11:25 +00:00
whole_region->set_readable(prot & PROT_READ);
whole_region->set_writable(prot & PROT_WRITE);
whole_region->set_executable(prot & PROT_EXEC);
whole_region->remap();
return 0;
}
// Check if we can carve out the desired range from an existing region
if (auto* old_region = region_containing(range_to_mprotect)) {
if (!old_region->is_mmap())
return -EPERM;
if (!validate_mmap_prot(prot, old_region->is_stack()))
return -EINVAL;
if (old_region->access() == prot_to_region_access_flags(prot))
return 0;
Kernel: Validate PROT_READ and PROT_WRITE against underlying file This patch fixes some issues with the mmap() and mprotect() syscalls, neither of whom were checking the permission bits of the underlying files when mapping an inode MAP_SHARED. This made it possible to subvert execution of any running program by simply memory-mapping its executable and replacing some of the code. Test: Kernel/mmap-write-into-running-programs-executable-file.cpp
2020-01-07 18:29:18 +00:00
if (old_region->vmobject().is_inode()
&& !validate_inode_mmap_prot(*this, prot, static_cast<const InodeVMObject&>(old_region->vmobject()).inode())) {
return -EACCES;
}
Kernel: sys$mprotect protects sub-regions as well as whole ones Split a region into two/three if the desired mprotect range is a strict subset of an existing region. We can then set the access bits on a new region that is just our desired range and add both the new desired subregion and the leftovers back to our page tables.
2019-12-30 20:11:25 +00:00
// This vector is the region(s) adjacent to our range.
// We need to allocate a new region for the range we wanted to change permission bits on.
auto adjacent_regions = split_region_around_range(*old_region, range_to_mprotect);
size_t new_range_offset_in_vmobject = old_region->offset_in_vmobject() + (range_to_mprotect.base().get() - old_region->range().base().get());
auto& new_region = allocate_split_region(*old_region, range_to_mprotect, new_range_offset_in_vmobject);
new_region.set_readable(prot & PROT_READ);
new_region.set_writable(prot & PROT_WRITE);
new_region.set_executable(prot & PROT_EXEC);
// Unmap the old region here, specifying that we *don't* want the VM deallocated.
old_region->unmap(Region::ShouldDeallocateVirtualMemoryRange::No);
deallocate_region(*old_region);
// Map the new regions using our page directory (they were just allocated and don't have one).
for (auto* adjacent_region : adjacent_regions) {
adjacent_region->map(page_directory());
}
new_region.map(page_directory());
return 0;
}
// FIXME: We should also support mprotect() across multiple regions. (#175) (#964)
return -EINVAL;
Kernel+LibC+crash: Add mprotect() syscall This patch adds the mprotect() syscall to allow changing the protection flags for memory regions. We don't do any region splitting/merging yet, so this only works on whole mmap() regions. Added a "crash -r" flag to verify that we crash when you attempt to write to read-only memory. :^)
2019-08-12 17:33:24 +00:00
}
Kernel: Start implementing purgeable memory support It's now possible to get purgeable memory by using mmap(MAP_PURGEABLE). Purgeable memory has a "volatile" flag that can be set using madvise(): - madvise(..., MADV_SET_VOLATILE) - madvise(..., MADV_SET_NONVOLATILE) When in the "volatile" state, the kernel may take away the underlying physical memory pages at any time, without notifying the owner. This gives you a guilt discount when caching very large things. :^) Setting a purgeable region to non-volatile will return whether or not the memory has been taken away by the kernel while being volatile. Basically, if madvise(..., MADV_SET_NONVOLATILE) returns 1, that means the memory was purged while volatile, and whatever was in that piece of memory needs to be reconstructed before use.
2019-12-09 18:12:38 +00:00
int Process::sys$madvise(void* address, size_t size, int advice)
{
ping: Use pledge()
2020-01-11 19:48:43 +00:00
REQUIRE_PROMISE(stdio);
Kernel: Reject non-user address ranges in mmap/munmap/mprotect/madvise There's no valid reason to allow non-userspace address ranges in these system calls.
2020-01-30 20:46:45 +00:00
Kernel: Disallow empty ranges in munmap/mprotect/madvise
2020-01-30 20:55:49 +00:00
if (!size)
return -EINVAL;
Kernel: Reject non-user address ranges in mmap/munmap/mprotect/madvise There's no valid reason to allow non-userspace address ranges in these system calls.
2020-01-30 20:46:45 +00:00
if (!is_user_range(VirtualAddress(address), size))
return -EFAULT;
Kernel: Remove some unnecessary casts to uintptr_t VirtualAddress is constructible from uintptr_t and const void*. PhysicalAddress is constructible from uintptr_t but not const void*.
2020-01-20 12:06:41 +00:00
auto* region = region_from_range({ VirtualAddress(address), size });
Kernel: Start implementing purgeable memory support It's now possible to get purgeable memory by using mmap(MAP_PURGEABLE). Purgeable memory has a "volatile" flag that can be set using madvise(): - madvise(..., MADV_SET_VOLATILE) - madvise(..., MADV_SET_NONVOLATILE) When in the "volatile" state, the kernel may take away the underlying physical memory pages at any time, without notifying the owner. This gives you a guilt discount when caching very large things. :^) Setting a purgeable region to non-volatile will return whether or not the memory has been taken away by the kernel while being volatile. Basically, if madvise(..., MADV_SET_NONVOLATILE) returns 1, that means the memory was purged while volatile, and whatever was in that piece of memory needs to be reconstructed before use.
2019-12-09 18:12:38 +00:00
if (!region)
return -EINVAL;
if (!region->is_mmap())
return -EPERM;
if ((advice & MADV_SET_VOLATILE) && (advice & MADV_SET_NONVOLATILE))
return -EINVAL;
if (advice & MADV_SET_VOLATILE) {
if (!region->vmobject().is_purgeable())
return -EPERM;
auto& vmobject = static_cast<PurgeableVMObject&>(region->vmobject());
vmobject.set_volatile(true);
return 0;
}
if (advice & MADV_SET_NONVOLATILE) {
if (!region->vmobject().is_purgeable())
return -EPERM;
auto& vmobject = static_cast<PurgeableVMObject&>(region->vmobject());
Kernel: Ignore MADV_SET_NONVOLATILE if already non-volatile Just return 0 right away without changing any region flags.
2019-12-18 19:48:58 +00:00
if (!vmobject.is_volatile())
return 0;
Kernel: Start implementing purgeable memory support It's now possible to get purgeable memory by using mmap(MAP_PURGEABLE). Purgeable memory has a "volatile" flag that can be set using madvise(): - madvise(..., MADV_SET_VOLATILE) - madvise(..., MADV_SET_NONVOLATILE) When in the "volatile" state, the kernel may take away the underlying physical memory pages at any time, without notifying the owner. This gives you a guilt discount when caching very large things. :^) Setting a purgeable region to non-volatile will return whether or not the memory has been taken away by the kernel while being volatile. Basically, if madvise(..., MADV_SET_NONVOLATILE) returns 1, that means the memory was purged while volatile, and whatever was in that piece of memory needs to be reconstructed before use.
2019-12-09 18:12:38 +00:00
vmobject.set_volatile(false);
bool was_purged = vmobject.was_purged();
vmobject.set_was_purged(false);
return was_purged ? 1 : 0;
}
Kernel: Add MADV_GET_VOLATILE for checking the volatile flag Sometimes you might want to know if a purgeable region is volatile.
2019-12-18 19:48:24 +00:00
if (advice & MADV_GET_VOLATILE) {
if (!region->vmobject().is_purgeable())
return -EPERM;
auto& vmobject = static_cast<PurgeableVMObject&>(region->vmobject());
return vmobject.is_volatile() ? 0 : 1;
}
Kernel: Start implementing purgeable memory support It's now possible to get purgeable memory by using mmap(MAP_PURGEABLE). Purgeable memory has a "volatile" flag that can be set using madvise(): - madvise(..., MADV_SET_VOLATILE) - madvise(..., MADV_SET_NONVOLATILE) When in the "volatile" state, the kernel may take away the underlying physical memory pages at any time, without notifying the owner. This gives you a guilt discount when caching very large things. :^) Setting a purgeable region to non-volatile will return whether or not the memory has been taken away by the kernel while being volatile. Basically, if madvise(..., MADV_SET_NONVOLATILE) returns 1, that means the memory was purged while volatile, and whatever was in that piece of memory needs to be reconstructed before use.
2019-12-09 18:12:38 +00:00
return -EINVAL;
}
Kernel: Add a mode flag to sys$purge and allow purging clean inodes
2019-12-29 12:16:53 +00:00
int Process::sys$purge(int mode)
Kernel: Start implementing purgeable memory support It's now possible to get purgeable memory by using mmap(MAP_PURGEABLE). Purgeable memory has a "volatile" flag that can be set using madvise(): - madvise(..., MADV_SET_VOLATILE) - madvise(..., MADV_SET_NONVOLATILE) When in the "volatile" state, the kernel may take away the underlying physical memory pages at any time, without notifying the owner. This gives you a guilt discount when caching very large things. :^) Setting a purgeable region to non-volatile will return whether or not the memory has been taken away by the kernel while being volatile. Basically, if madvise(..., MADV_SET_NONVOLATILE) returns 1, that means the memory was purged while volatile, and whatever was in that piece of memory needs to be reconstructed before use.
2019-12-09 18:12:38 +00:00
{
ping: Use pledge()
2020-01-11 19:48:43 +00:00
REQUIRE_NO_PROMISES;
Kernel: Make the purge() syscall superuser-only I don't think we need to give unprivileged users access to what is essentially a kernel testing mechanism.
2020-01-02 12:37:23 +00:00
if (!is_superuser())
return -EPERM;
Kernel: Start implementing purgeable memory support It's now possible to get purgeable memory by using mmap(MAP_PURGEABLE). Purgeable memory has a "volatile" flag that can be set using madvise(): - madvise(..., MADV_SET_VOLATILE) - madvise(..., MADV_SET_NONVOLATILE) When in the "volatile" state, the kernel may take away the underlying physical memory pages at any time, without notifying the owner. This gives you a guilt discount when caching very large things. :^) Setting a purgeable region to non-volatile will return whether or not the memory has been taken away by the kernel while being volatile. Basically, if madvise(..., MADV_SET_NONVOLATILE) returns 1, that means the memory was purged while volatile, and whatever was in that piece of memory needs to be reconstructed before use.
2019-12-09 18:12:38 +00:00
int purged_page_count = 0;
Kernel: Add a mode flag to sys$purge and allow purging clean inodes
2019-12-29 12:16:53 +00:00
if (mode & PURGE_ALL_VOLATILE) {
NonnullRefPtrVector<PurgeableVMObject> vmobjects;
{
InterruptDisabler disabler;
MM.for_each_vmobject([&](auto& vmobject) {
if (vmobject.is_purgeable())
vmobjects.append(static_cast<PurgeableVMObject&>(vmobject));
return IterationDecision::Continue;
});
}
for (auto& vmobject : vmobjects) {
purged_page_count += vmobject.purge();
}
}
if (mode & PURGE_ALL_CLEAN_INODE) {
NonnullRefPtrVector<InodeVMObject> vmobjects;
{
InterruptDisabler disabler;
MM.for_each_vmobject([&](auto& vmobject) {
if (vmobject.is_inode())
vmobjects.append(static_cast<InodeVMObject&>(vmobject));
return IterationDecision::Continue;
});
}
for (auto& vmobject : vmobjects) {
purged_page_count += vmobject.release_all_clean_pages();
}
Kernel: Start implementing purgeable memory support It's now possible to get purgeable memory by using mmap(MAP_PURGEABLE). Purgeable memory has a "volatile" flag that can be set using madvise(): - madvise(..., MADV_SET_VOLATILE) - madvise(..., MADV_SET_NONVOLATILE) When in the "volatile" state, the kernel may take away the underlying physical memory pages at any time, without notifying the owner. This gives you a guilt discount when caching very large things. :^) Setting a purgeable region to non-volatile will return whether or not the memory has been taken away by the kernel while being volatile. Basically, if madvise(..., MADV_SET_NONVOLATILE) returns 1, that means the memory was purged while volatile, and whatever was in that piece of memory needs to be reconstructed before use.
2019-12-09 18:12:38 +00:00
}
return purged_page_count;
}
Kernel: Make syscalls that take a buffer size use ssize_t instead of size_t. Dealing with the unsigned overflow propagation here just seems unreasonably error prone. Let's limit ourselves to 2GB buffer sizes instead.
2019-02-25 20:19:57 +00:00
int Process::sys$gethostname(char* buffer, ssize_t size)
Add sys$gethostname and /bin/hostname
2018-10-26 07:54:29 +00:00
{
ping: Use pledge()
2020-01-11 19:48:43 +00:00
REQUIRE_PROMISE(stdio);
Kernel: Make syscalls that take a buffer size use ssize_t instead of size_t. Dealing with the unsigned overflow propagation here just seems unreasonably error prone. Let's limit ourselves to 2GB buffer sizes instead.
2019-02-25 20:19:57 +00:00
if (size < 0)
return -EINVAL;
Improve syscall address validation a bit.
2018-11-16 15:10:59 +00:00
if (!validate_write(buffer, size))
return -EFAULT;
Kernel: Don't disable interrupts to access the system hostname.
2019-02-07 09:29:26 +00:00
LOCKER(*s_hostname_lock);
AK: Use size_t for the length of strings Using int was a mistake. This patch changes String, StringImpl, StringView and StringBuilder to use size_t instead of int for lengths. Obviously a lot of code needs to change as a result of this.
2019-12-09 16:45:40 +00:00
if ((size_t)size < (s_hostname->length() + 1))
Add sys$gethostname and /bin/hostname
2018-10-26 07:54:29 +00:00
return -ENAMETOOLONG;
Kernel: Start implementing x86 SMAP support Supervisor Mode Access Prevention (SMAP) is an x86 CPU feature that prevents the kernel from accessing userspace memory. With SMAP enabled, trying to read/write a userspace memory address while in the kernel will now generate a page fault. Since it's sometimes necessary to read/write userspace memory, there are two new instructions that quickly switch the protection on/off: STAC (disables protection) and CLAC (enables protection.) These are exposed in kernel code via the stac() and clac() helpers. There's also a SmapDisabler RAII object that can be used to ensure that you don't forget to re-enable protection before returning to userspace code. THis patch also adds copy_to_user(), copy_from_user() and memset_user() which are the "correct" way of doing things. These functions allow us to briefly disable protection for a specific purpose, and then turn it back on immediately after it's done. Going forward all kernel code should be moved to using these and all uses of SmapDisabler are to be considered FIXME's. Note that we're not realizing the full potential of this feature since I've used SmapDisabler quite liberally in this initial bring-up patch.
2020-01-05 17:00:15 +00:00
copy_to_user(buffer, s_hostname->characters(), s_hostname->length() + 1);
Implement argc/argv support for spawned tasks. Celebrate the new functionality with a simple /bin/cat implementation. :^)
2018-10-26 09:16:56 +00:00
return 0;
Add sys$gethostname and /bin/hostname
2018-10-26 07:54:29 +00:00
}
Kernel: Merge Process::fork() into sys$fork() There was no good reason for this to be a separate function.
2019-12-19 18:07:41 +00:00
pid_t Process::sys$fork(RegisterDump& regs)
Implement fork()! This is quite cool! The syscall entry point plumbs the register dump down to sys$fork(), which uses it to set up the child process's TSS in order to resume execution right after the int 0x80 fork() call. :^) This works pretty well, although there is some problem with the kernel alias mappings used to clone the parent process's regions. If I disable the MM::release_page_directory() code, there's no problem. Probably there's a premature freeing of a physical page somehow.
2018-11-02 19:41:58 +00:00
{
ping: Use pledge()
2020-01-11 19:48:43 +00:00
REQUIRE_PROMISE(proc);
Kernel: Get rid of "main thread" concept The idea of all processes reliably having a main thread was nice in some ways, but cumbersome in others. More importantly, it didn't match up with POSIX thread semantics, so let's move away from it. This thread gets rid of Process::main_thread() and you now we just have a bunch of Thread objects floating around each Process. When the finalizer nukes the last Thread in a Process, it will also tear down the Process. There's a bunch of more things to fix around this, but this is where we get started :^)
2019-12-22 10:35:02 +00:00
Thread* child_first_thread = nullptr;
auto* child = new Process(child_first_thread, m_name, m_uid, m_gid, m_pid, m_ring, m_cwd, m_executable, m_tty, this);
Kernel: Add a basic chroot() syscall :^) The chroot() syscall now allows the superuser to isolate a process into a specific subtree of the filesystem. This is not strictly permanent, as it is also possible for a superuser to break *out* of a chroot, but it is a useful mechanism for isolating unprivileged processes. The VFS now uses the current process's root_directory() as the root for path resolution purposes. The root directory is stored as an uncached Custody in the Process object.
2020-01-10 22:14:04 +00:00
child->m_root_directory = m_root_directory;
Kernel: Don't forget to copy & destroy root_directory_for_procfs Also, rename it to root_directory_relative_to_global_root.
2020-01-12 18:42:01 +00:00
child->m_root_directory_relative_to_global_root = m_root_directory_relative_to_global_root;
Kernel: fork()ed children should inherit pledge promises :^) Update various places that now need wider promises as they are not reset by fork() anymore.
2020-01-11 22:19:30 +00:00
child->m_promises = m_promises;
child->m_execpromises = m_execpromises;
Kernel: Rename UnveilState to VeilState
2020-01-21 18:28:29 +00:00
child->m_veil_state = m_veil_state;
Kernel: Forked children should inherit unveil()'ed paths
2020-01-21 08:44:32 +00:00
child->m_unveiled_paths = m_unveiled_paths;
Kernel: Simplify Process constructor Move all the fork-specific inheritance logic to sys$fork(), and all the stuff for setting up stdio for non-fork ring 3 processes moves to Process::create_user_process(). Also: we were setting up the PGID, SID and umask twice. Also the code for copying the open file descriptors was overly complicated. Now it's just a simple Vector copy assignment. :^)
2020-01-25 12:50:54 +00:00
child->m_fds = m_fds;
child->m_sid = m_sid;
child->m_pgid = m_pgid;
child->m_umask = m_umask;
Some improvements to signals. - Add sigprocmask() and sigpending(). - Forked children inherit signal dispositions and masks. - Exec clears signal dispositions and masks.
2018-11-10 22:29:07 +00:00
Implement fork()! This is quite cool! The syscall entry point plumbs the register dump down to sys$fork(), which uses it to set up the child process's TSS in order to resume execution right after the int 0x80 fork() call. :^) This works pretty well, although there is some problem with the kernel alias mappings used to clone the parent process's regions. If I disable the MM::release_page_directory() code, there's no problem. Probably there's a premature freeing of a physical page somehow.
2018-11-02 19:41:58 +00:00
#ifdef FORK_DEBUG
dbgprintf("fork: child=%p\n", child);
#endif
for (auto& region : m_regions) {
#ifdef FORK_DEBUG
Kernel: Fix bitrotted FORK_DEBUG logging code
2019-09-27 11:57:35 +00:00
dbg() << "fork: cloning Region{" << &region << "} '" << region.name() << "' @ " << region.vaddr();
Implement fork()! This is quite cool! The syscall entry point plumbs the register dump down to sys$fork(), which uses it to set up the child process's TSS in order to resume execution right after the int 0x80 fork() call. :^) This works pretty well, although there is some problem with the kernel alias mappings used to clone the parent process's regions. If I disable the MM::release_page_directory() code, there's no problem. Probably there's a premature freeing of a physical page somehow.
2018-11-02 19:41:58 +00:00
#endif
Kernel: Add a Process::add_region() helper This is a private helper for adding a Region to Process::m_regions. It's just for convenience since it's a bit cumbersome to do this.
2020-01-19 15:25:38 +00:00
auto& child_region = child->add_region(region.clone());
child_region.map(child->page_directory());
Kernel: Support thread-local storage This patch adds support for TLS according to the x86 System V ABI. Each thread gets a thread-specific memory region, and the GS segment register always points _to a pointer_ to the thread-specific memory. In other words, to access thread-local variables, userspace programs start by dereferencing the pointer at [gs:0]. The Process keeps a master copy of the TLS segment that new threads should use, and when a new thread is created, they get a copy of it. It's basically whatever the PT_TLS program header in the ELF says.
2019-09-07 13:50:44 +00:00
if (&region == m_master_tls_region)
Kernel: Add a Process::add_region() helper This is a private helper for adding a Region to Process::m_regions. It's just for convenience since it's a bit cumbersome to do this.
2020-01-19 15:25:38 +00:00
child->m_master_tls_region = &child_region;
Implement fork()! This is quite cool! The syscall entry point plumbs the register dump down to sys$fork(), which uses it to set up the child process's TSS in order to resume execution right after the int 0x80 fork() call. :^) This works pretty well, although there is some problem with the kernel alias mappings used to clone the parent process's regions. If I disable the MM::release_page_directory() code, there's no problem. Probably there's a premature freeing of a physical page somehow.
2018-11-02 19:41:58 +00:00
}
Kernel: Don't include the process GID in the "extra GIDs" table Process::m_extra_gids is for supplementary GIDs only.
2020-01-02 22:45:52 +00:00
child->m_extra_gids = m_extra_gids;
Kernel: Clone Process::m_gids on fork() and hook up any framebuffer region.
2019-01-21 00:49:30 +00:00
Kernel: Get rid of "main thread" concept The idea of all processes reliably having a main thread was nice in some ways, but cumbersome in others. More importantly, it didn't match up with POSIX thread semantics, so let's move away from it. This thread gets rid of Process::main_thread() and you now we just have a bunch of Thread objects floating around each Process. When the finalizer nukes the last Thread in a Process, it will also tear down the Process. There's a bunch of more things to fix around this, but this is where we get started :^)
2019-12-22 10:35:02 +00:00
auto& child_tss = child_first_thread->m_tss;
Kernel: Introduce threads, and refactor everything in support of it. The scheduler now operates on threads, rather than on processes. Each process has a main thread, and can have any number of additional threads. The process exits when the main thread exits. This patch doesn't actually spawn any additional threads, it merely does all the plumbing needed to make it possible. :^)
2019-03-23 21:03:17 +00:00
child_tss.eax = 0; // fork() returns 0 in the child :^)
child_tss.ebx = regs.ebx;
child_tss.ecx = regs.ecx;
child_tss.edx = regs.edx;
child_tss.ebp = regs.ebp;
Kernel: Rename {ss,esp}_if_crossRing to userspace_{ss,esp} These were always so awkwardly named.
2020-01-09 17:02:01 +00:00
child_tss.esp = regs.userspace_esp;
Kernel: Introduce threads, and refactor everything in support of it. The scheduler now operates on threads, rather than on processes. Each process has a main thread, and can have any number of additional threads. The process exits when the main thread exits. This patch doesn't actually spawn any additional threads, it merely does all the plumbing needed to make it possible. :^)
2019-03-23 21:03:17 +00:00
child_tss.esi = regs.esi;
child_tss.edi = regs.edi;
child_tss.eflags = regs.eflags;
child_tss.eip = regs.eip;
child_tss.cs = regs.cs;
child_tss.ds = regs.ds;
child_tss.es = regs.es;
child_tss.fs = regs.fs;
child_tss.gs = regs.gs;
Kernel: Rename {ss,esp}_if_crossRing to userspace_{ss,esp} These were always so awkwardly named.
2020-01-09 17:02:01 +00:00
child_tss.ss = regs.userspace_ss;
Kernel: Implement lazy FPU state restore.
2019-01-25 06:52:44 +00:00
Implement fork()! This is quite cool! The syscall entry point plumbs the register dump down to sys$fork(), which uses it to set up the child process's TSS in order to resume execution right after the int 0x80 fork() call. :^) This works pretty well, although there is some problem with the kernel alias mappings used to clone the parent process's regions. If I disable the MM::release_page_directory() code, there's no problem. Probably there's a premature freeing of a physical page somehow.
2018-11-02 19:41:58 +00:00
#ifdef FORK_DEBUG
Kernel: Introduce threads, and refactor everything in support of it. The scheduler now operates on threads, rather than on processes. Each process has a main thread, and can have any number of additional threads. The process exits when the main thread exits. This patch doesn't actually spawn any additional threads, it merely does all the plumbing needed to make it possible. :^)
2019-03-23 21:03:17 +00:00
dbgprintf("fork: child will begin executing at %w:%x with stack %w:%x, kstack %w:%x\n", child_tss.cs, child_tss.eip, child_tss.ss, child_tss.esp, child_tss.ss0, child_tss.esp0);
Implement fork()! This is quite cool! The syscall entry point plumbs the register dump down to sys$fork(), which uses it to set up the child process's TSS in order to resume execution right after the int 0x80 fork() call. :^) This works pretty well, although there is some problem with the kernel alias mappings used to clone the parent process's regions. If I disable the MM::release_page_directory() code, there's no problem. Probably there's a premature freeing of a physical page somehow.
2018-11-02 19:41:58 +00:00
#endif
Fix some paging related bugs exposed by the spawn stress test. - Process::exec() needs to restore the original paging scope when called on a non-current process. - Add missing InterruptDisabler guards around g_processes access. - Only flush the TLB when modifying the active page tables.
2018-11-09 00:25:31 +00:00
{
InterruptDisabler disabler;
g_processes->prepend(child);
}
Implement fork()! This is quite cool! The syscall entry point plumbs the register dump down to sys$fork(), which uses it to set up the child process's TSS in order to resume execution right after the int 0x80 fork() call. :^) This works pretty well, although there is some problem with the kernel alias mappings used to clone the parent process's regions. If I disable the MM::release_page_directory() code, there's no problem. Probably there's a premature freeing of a physical page somehow.
2018-11-02 19:41:58 +00:00
#ifdef TASK_DEBUG
Kernel: Introduce threads, and refactor everything in support of it. The scheduler now operates on threads, rather than on processes. Each process has a main thread, and can have any number of additional threads. The process exits when the main thread exits. This patch doesn't actually spawn any additional threads, it merely does all the plumbing needed to make it possible. :^)
2019-03-23 21:03:17 +00:00
kprintf("Process %u (%s) forked from %u @ %p\n", child->pid(), child->name().characters(), m_pid, child_tss.eip);
Implement fork()! This is quite cool! The syscall entry point plumbs the register dump down to sys$fork(), which uses it to set up the child process's TSS in order to resume execution right after the int 0x80 fork() call. :^) This works pretty well, although there is some problem with the kernel alias mappings used to clone the parent process's regions. If I disable the MM::release_page_directory() code, there's no problem. Probably there's a premature freeing of a physical page somehow.
2018-11-02 19:41:58 +00:00
#endif
Kernel: Introduce threads, and refactor everything in support of it. The scheduler now operates on threads, rather than on processes. Each process has a main thread, and can have any number of additional threads. The process exits when the main thread exits. This patch doesn't actually spawn any additional threads, it merely does all the plumbing needed to make it possible. :^)
2019-03-23 21:03:17 +00:00
Kernel: Get rid of "main thread" concept The idea of all processes reliably having a main thread was nice in some ways, but cumbersome in others. More importantly, it didn't match up with POSIX thread semantics, so let's move away from it. This thread gets rid of Process::main_thread() and you now we just have a bunch of Thread objects floating around each Process. When the finalizer nukes the last Thread in a Process, it will also tear down the Process. There's a bunch of more things to fix around this, but this is where we get started :^)
2019-12-22 10:35:02 +00:00
child_first_thread->set_state(Thread::State::Skip1SchedulerPass);
Implement fork()! This is quite cool! The syscall entry point plumbs the register dump down to sys$fork(), which uses it to set up the child process's TSS in order to resume execution right after the int 0x80 fork() call. :^) This works pretty well, although there is some problem with the kernel alias mappings used to clone the parent process's regions. If I disable the MM::release_page_directory() code, there's no problem. Probably there's a premature freeing of a physical page somehow.
2018-11-02 19:41:58 +00:00
return child->pid();
}
Kernel: Tighten up exec/do_exec and allow for PT_INTERP iterpreters This patch changes how exec() figures out which program image to actually load. Previously, we opened the path to our main executable in find_shebang_interpreter_for_executable, read the first page (or less, if the file was smaller) and then decided whether to recurse with the interpreter instead. We then then re-opened the main executable in do_exec. However, since we now want to parse the ELF header and Program Headers of an elf image before even doing any memory region work, we can change the way this whole process works. We open the file and read (up to) the first page in exec() itself, then pass just the page and the amount read to find_shebang_interpreter_for_executable. Since we now have that page and the FileDescription for the main executable handy, we can do a few things. First, validate the ELF header and ELF program headers for any shenanigans. ELF32 Little Endian i386 only, please. Second, we can grab the PT_INTERP interpreter from any ET_DYN files, and open that guy right away if it exists. Finally, we can pass the main executable's and optionally the PT_INTERP interpreter's file descriptions down to do_exec and not have to feel guilty about opening the file twice. In do_exec, we now have a choice. Are we going to load the main executable, or the interpreter? We could load both, but it'll be way easier for the inital pass on the RTLD if we only load the interpreter. Then it can load the main executable itself like any old shared object, just, the one with main in it :). Later on we can load both of them into memory and the RTLD can relocate itself before trying to do anything. The way it's written now the RTLD will get dibs on its requested virtual addresses being the actual virtual addresses.
2020-01-11 01:28:02 +00:00
int Process::do_exec(NonnullRefPtr<FileDescription> main_program_description, Vector<String> arguments, Vector<String> environment, RefPtr<FileDescription> interpreter_description)
Implemented sys$execve(). It's really crufty, but it basically works!
2018-11-03 00:49:40 +00:00
{
Kernel: Increase default userspace stack size to 64 kilobytes.
2019-02-03 02:56:08 +00:00
ASSERT(is_ring3());
Kernel: Tighten up exec/do_exec and allow for PT_INTERP iterpreters This patch changes how exec() figures out which program image to actually load. Previously, we opened the path to our main executable in find_shebang_interpreter_for_executable, read the first page (or less, if the file was smaller) and then decided whether to recurse with the interpreter instead. We then then re-opened the main executable in do_exec. However, since we now want to parse the ELF header and Program Headers of an elf image before even doing any memory region work, we can change the way this whole process works. We open the file and read (up to) the first page in exec() itself, then pass just the page and the amount read to find_shebang_interpreter_for_executable. Since we now have that page and the FileDescription for the main executable handy, we can do a few things. First, validate the ELF header and ELF program headers for any shenanigans. ELF32 Little Endian i386 only, please. Second, we can grab the PT_INTERP interpreter from any ET_DYN files, and open that guy right away if it exists. Finally, we can pass the main executable's and optionally the PT_INTERP interpreter's file descriptions down to do_exec and not have to feel guilty about opening the file twice. In do_exec, we now have a choice. Are we going to load the main executable, or the interpreter? We could load both, but it'll be way easier for the inital pass on the RTLD if we only load the interpreter. Then it can load the main executable itself like any old shared object, just, the one with main in it :). Later on we can load both of them into memory and the RTLD can relocate itself before trying to do anything. The way it's written now the RTLD will get dibs on its requested virtual addresses being the actual virtual addresses.
2020-01-11 01:28:02 +00:00
auto path = main_program_description->absolute_path();
Kernel: Tidy up debug logging a little bit When using dbg() in the kernel, the output is automatically prefixed with [Process(PID:TID)]. This makes it a lot easier to understand which thread is generating the output. This patch also cleans up some common logging messages and removes the now-unnecessary "dbg() << *current << ..." pattern.
2020-01-21 15:14:39 +00:00
dbg() << "do_exec(" << path << ")";
Kernel: Introduce threads, and refactor everything in support of it. The scheduler now operates on threads, rather than on processes. Each process has a main thread, and can have any number of additional threads. The process exits when the main thread exits. This patch doesn't actually spawn any additional threads, it merely does all the plumbing needed to make it possible. :^)
2019-03-23 21:03:17 +00:00
// FIXME(Thread): Kill any threads the moment we commit to the exec().
Kernel: Process destruction should destroy all child threads. We were only destroying the main thread when a process died, leaving any secondary threads around. They couldn't run, but because they were still in the global thread list, strange things could happen since they had some now-stale pointers to their old process.
2019-04-23 20:17:01 +00:00
if (thread_count() != 1) {
dbgprintf("Gonna die because I have many threads! These are the threads:\n");
Kernel: Run clang-format on everything.
2019-06-07 09:43:58 +00:00
for_each_thread([](Thread& thread) {
Kernel: Process destruction should destroy all child threads. We were only destroying the main thread when a process died, leaving any secondary threads around. They couldn't run, but because they were still in the global thread list, strange things could happen since they had some now-stale pointers to their old process.
2019-04-23 20:17:01 +00:00
dbgprintf("Thread{%p}: TID=%d, PID=%d\n", &thread, thread.tid(), thread.pid());
return IterationDecision::Continue;
});
ASSERT(thread_count() == 1);
ASSERT_NOT_REACHED();
}
Kernel: Move E2BIG calculation from Thread to Process Thread::make_userspace_stack_for_main_thread is only ever called from Process::do_exec, after all the fun ELF loading and TSS setup has occured. The calculations in there that check if the combined argv + envp size will exceed the default stack size are not used in the rest of the stack setup. So, it should be safe to move this to the beginning of do_exec and bail early with -E2BIG, just like the man pages say. Additionally, advertise this limit in limits.h to be a good POSIX.1 citizen. :)
2019-10-20 16:11:40 +00:00
size_t total_blob_size = 0;
for (auto& a : arguments)
total_blob_size += a.length() + 1;
for (auto& e : environment)
total_blob_size += e.length() + 1;
size_t total_meta_size = sizeof(char*) * (arguments.size() + 1) + sizeof(char*) * (environment.size() + 1);
// FIXME: How much stack space does process startup need?
if ((total_blob_size + total_meta_size) >= Thread::default_userspace_stack_size)
return -E2BIG;
Implemented sys$execve(). It's really crufty, but it basically works!
2018-11-03 00:49:40 +00:00
auto parts = path.split('/');
Yet another pass of style fixes.
2018-12-21 01:10:45 +00:00
if (parts.is_empty())
Implemented sys$execve(). It's really crufty, but it basically works!
2018-11-03 00:49:40 +00:00
return -ENOENT;
Kernel: Enforce W^X between sys$mmap() and sys$execve() It's now an error to sys$mmap() a file as writable if it's currently mapped executable by anyone else. It's also an error to sys$execve() a file that's currently mapped writable by anyone else. This fixes a race condition vulnerability where one program could make modifications to an executable while another process was in the kernel, in the middle of exec'ing the same executable. Test: Kernel/elf-execve-mmap-race.cpp
2020-01-18 22:31:29 +00:00
RefPtr<InodeVMObject> vmobject;
if (interpreter_description) {
vmobject = InodeVMObject::create_with_inode(*interpreter_description->inode());
} else {
vmobject = InodeVMObject::create_with_inode(*main_program_description->inode());
}
if (static_cast<const InodeVMObject&>(*vmobject).writable_mappings()) {
dbg() << "Refusing to execute a write-mapped program";
return -ETXTBSY;
}
Let PageDirectory have a PhysicalPage for the PDB instead of being the PDB. This is more efficient than using the wasteful kmalloc_aligned() approach to allocation. It also allows much tighter encapsulation of the class.
2018-12-31 13:58:03 +00:00
auto old_page_directory = move(m_page_directory);
Kernel: Simplify PageDirectory swapping in sys$execve() Swap out both the PageDirectory and the Region list at the same time, instead of doing the Region list slightly later.
2020-01-19 15:05:42 +00:00
auto old_regions = move(m_regions);
Kernel: Add mapping from page directory base (PDB) to PageDirectory This allows the page fault code to find the owning PageDirectory and corresponding process for faulting regions. The mapping is implemented as a global hash map right now, which is definitely not optimal. We can come up with something better when it becomes necessary.
2019-08-06 09:19:16 +00:00
m_page_directory = PageDirectory::create_for_userspace(*this);
Fix some paging related bugs exposed by the spawn stress test. - Process::exec() needs to restore the original paging scope when called on a non-current process. - Add missing InterruptDisabler guards around g_processes access. - Only flush the TLB when modifying the active page tables.
2018-11-09 00:25:31 +00:00
#ifdef MM_DEBUG
Let PageDirectory have a PhysicalPage for the PDB instead of being the PDB. This is more efficient than using the wasteful kmalloc_aligned() approach to allocation. It also allows much tighter encapsulation of the class.
2018-12-31 13:58:03 +00:00
dbgprintf("Process %u exec: PD=%x created\n", pid(), m_page_directory.ptr());
Fix some paging related bugs exposed by the spawn stress test. - Process::exec() needs to restore the original paging scope when called on a non-current process. - Add missing InterruptDisabler guards around g_processes access. - Only flush the TLB when modifying the active page tables.
2018-11-09 00:25:31 +00:00
#endif
Kernel: Make ProcessPagingScope restore CR3 properly Instead of restoring CR3 to the current process's paging scope when a ProcessPagingScope goes out of scope, we now restore exactly whatever the CR3 value was when we created the ProcessPagingScope. This fixes breakage in situations where a process ends up with nested ProcessPagingScopes. This was making profiling very fragile, and with this change it's now possible to profile g++! :^)
2020-01-19 12:44:53 +00:00
MM.enter_process_paging_scope(*this);
Teach Process::exec() about the magic of file-backed VMO's. This is really sweet! :^) The four instances of /bin/sh spawned at startup now share their read-only text pages. There are problems and limitations here, and plenty of room for improvement. But it kinda works.
2018-11-08 20:20:09 +00:00
Kernel: Enforce W^X between sys$mmap() and sys$execve() It's now an error to sys$mmap() a file as writable if it's currently mapped executable by anyone else. It's also an error to sys$execve() a file that's currently mapped writable by anyone else. This fixes a race condition vulnerability where one program could make modifications to an executable while another process was in the kernel, in the middle of exec'ing the same executable. Test: Kernel/elf-execve-mmap-race.cpp
2020-01-18 22:31:29 +00:00
Region* region { nullptr };
Kernel: Tighten up exec/do_exec and allow for PT_INTERP iterpreters This patch changes how exec() figures out which program image to actually load. Previously, we opened the path to our main executable in find_shebang_interpreter_for_executable, read the first page (or less, if the file was smaller) and then decided whether to recurse with the interpreter instead. We then then re-opened the main executable in do_exec. However, since we now want to parse the ELF header and Program Headers of an elf image before even doing any memory region work, we can change the way this whole process works. We open the file and read (up to) the first page in exec() itself, then pass just the page and the amount read to find_shebang_interpreter_for_executable. Since we now have that page and the FileDescription for the main executable handy, we can do a few things. First, validate the ELF header and ELF program headers for any shenanigans. ELF32 Little Endian i386 only, please. Second, we can grab the PT_INTERP interpreter from any ET_DYN files, and open that guy right away if it exists. Finally, we can pass the main executable's and optionally the PT_INTERP interpreter's file descriptions down to do_exec and not have to feel guilty about opening the file twice. In do_exec, we now have a choice. Are we going to load the main executable, or the interpreter? We could load both, but it'll be way easier for the inital pass on the RTLD if we only load the interpreter. Then it can load the main executable itself like any old shared object, just, the one with main in it :). Later on we can load both of them into memory and the RTLD can relocate itself before trying to do anything. The way it's written now the RTLD will get dibs on its requested virtual addresses being the actual virtual addresses.
2020-01-11 01:28:02 +00:00
InodeMetadata loader_metadata;
// FIXME: Hoooo boy this is a hack if I ever saw one.
// This is the 'random' offset we're giving to our ET_DYN exectuables to start as.
// It also happens to be the static Virtual Addresss offset every static exectuable gets :)
// Without this, some assumptions by the ELF loading hooks below are severely broken.
// 0x08000000 is a verified random number chosen by random dice roll https://xkcd.com/221/
u32 totally_random_offset = interpreter_description ? 0x08000000 : 0;
Kernel: Enforce W^X between sys$mmap() and sys$execve() It's now an error to sys$mmap() a file as writable if it's currently mapped executable by anyone else. It's also an error to sys$execve() a file that's currently mapped writable by anyone else. This fixes a race condition vulnerability where one program could make modifications to an executable while another process was in the kernel, in the middle of exec'ing the same executable. Test: Kernel/elf-execve-mmap-race.cpp
2020-01-18 22:31:29 +00:00
// FIXME: We should be able to load both the PT_INTERP interpreter and the main program... once the RTLD is smart enough
if (interpreter_description) {
loader_metadata = interpreter_description->metadata();
region = allocate_region_with_vmobject(VirtualAddress(), loader_metadata.size, *vmobject, 0, interpreter_description->absolute_path(), PROT_READ, false);
// we don't need the interpreter file desciption after we've loaded (or not) it into memory
interpreter_description = nullptr;
} else {
Kernel: Tighten up exec/do_exec and allow for PT_INTERP iterpreters This patch changes how exec() figures out which program image to actually load. Previously, we opened the path to our main executable in find_shebang_interpreter_for_executable, read the first page (or less, if the file was smaller) and then decided whether to recurse with the interpreter instead. We then then re-opened the main executable in do_exec. However, since we now want to parse the ELF header and Program Headers of an elf image before even doing any memory region work, we can change the way this whole process works. We open the file and read (up to) the first page in exec() itself, then pass just the page and the amount read to find_shebang_interpreter_for_executable. Since we now have that page and the FileDescription for the main executable handy, we can do a few things. First, validate the ELF header and ELF program headers for any shenanigans. ELF32 Little Endian i386 only, please. Second, we can grab the PT_INTERP interpreter from any ET_DYN files, and open that guy right away if it exists. Finally, we can pass the main executable's and optionally the PT_INTERP interpreter's file descriptions down to do_exec and not have to feel guilty about opening the file twice. In do_exec, we now have a choice. Are we going to load the main executable, or the interpreter? We could load both, but it'll be way easier for the inital pass on the RTLD if we only load the interpreter. Then it can load the main executable itself like any old shared object, just, the one with main in it :). Later on we can load both of them into memory and the RTLD can relocate itself before trying to do anything. The way it's written now the RTLD will get dibs on its requested virtual addresses being the actual virtual addresses.
2020-01-11 01:28:02 +00:00
loader_metadata = main_program_description->metadata();
Kernel: Enforce W^X between sys$mmap() and sys$execve() It's now an error to sys$mmap() a file as writable if it's currently mapped executable by anyone else. It's also an error to sys$execve() a file that's currently mapped writable by anyone else. This fixes a race condition vulnerability where one program could make modifications to an executable while another process was in the kernel, in the middle of exec'ing the same executable. Test: Kernel/elf-execve-mmap-race.cpp
2020-01-18 22:31:29 +00:00
region = allocate_region_with_vmobject(VirtualAddress(), loader_metadata.size, *vmobject, 0, main_program_description->absolute_path(), PROT_READ, false);
}
Kernel: Tighten up exec/do_exec and allow for PT_INTERP iterpreters This patch changes how exec() figures out which program image to actually load. Previously, we opened the path to our main executable in find_shebang_interpreter_for_executable, read the first page (or less, if the file was smaller) and then decided whether to recurse with the interpreter instead. We then then re-opened the main executable in do_exec. However, since we now want to parse the ELF header and Program Headers of an elf image before even doing any memory region work, we can change the way this whole process works. We open the file and read (up to) the first page in exec() itself, then pass just the page and the amount read to find_shebang_interpreter_for_executable. Since we now have that page and the FileDescription for the main executable handy, we can do a few things. First, validate the ELF header and ELF program headers for any shenanigans. ELF32 Little Endian i386 only, please. Second, we can grab the PT_INTERP interpreter from any ET_DYN files, and open that guy right away if it exists. Finally, we can pass the main executable's and optionally the PT_INTERP interpreter's file descriptions down to do_exec and not have to feel guilty about opening the file twice. In do_exec, we now have a choice. Are we going to load the main executable, or the interpreter? We could load both, but it'll be way easier for the inital pass on the RTLD if we only load the interpreter. Then it can load the main executable itself like any old shared object, just, the one with main in it :). Later on we can load both of them into memory and the RTLD can relocate itself before trying to do anything. The way it's written now the RTLD will get dibs on its requested virtual addresses being the actual virtual addresses.
2020-01-11 01:28:02 +00:00
Kernel: Factor out range allocation from Process::allocate_region*(). These functions were doing exactly the same thing for range allocation, so share that code in an allocate_range() helper. Region allocation will now also fail if range allocation fails, which means that mmap() can actually fail without falling apart. Exciting times!
2019-05-17 02:39:22 +00:00
ASSERT(region);
Kernel: Refactor Region/PageDirectory ownership model. Make PageDirectory retainable and have each Region co-own the PageDirectory they're mapped into. When unmapped, Region has no associated PageDirectory. This allows Region to automatically unmap itself when destroyed.
2019-01-22 04:01:00 +00:00
Kernel: Make Region single-owner instead of ref-counted This simplifies the ownership model and makes Region easier to reason about. Userspace Regions are now primarily kept by Process::m_regions. Kernel Regions are kept in various OwnPtr<Regions>'s. Regions now only ever get unmapped when they are destroyed.
2019-09-27 12:19:07 +00:00
Region* master_tls_region { nullptr };
Kernel: Support thread-local storage This patch adds support for TLS according to the x86 System V ABI. Each thread gets a thread-specific memory region, and the GS segment register always points _to a pointer_ to the thread-specific memory. In other words, to access thread-local variables, userspace programs start by dereferencing the pointer at [gs:0]. The Process keeps a master copy of the TLS segment that new threads should use, and when a new thread is created, they get a copy of it. It's basically whatever the PT_TLS program header in the ELF says.
2019-09-07 13:50:44 +00:00
size_t master_tls_size = 0;
size_t master_tls_alignment = 0;
Kernel: Simplify PageDirectory swapping in sys$execve() Swap out both the PageDirectory and the Region list at the same time, instead of doing the Region list slightly later.
2020-01-19 15:05:42 +00:00
u32 entry_eip = 0;
Kernel: Support thread-local storage This patch adds support for TLS according to the x86 System V ABI. Each thread gets a thread-specific memory region, and the GS segment register always points _to a pointer_ to the thread-specific memory. In other words, to access thread-local variables, userspace programs start by dereferencing the pointer at [gs:0]. The Process keeps a master copy of the TLS segment that new threads should use, and when a new thread is created, they get a copy of it. It's basically whatever the PT_TLS program header in the ELF says.
2019-09-07 13:50:44 +00:00
Kernel: Symbolicate userspace backtraces using ELFLoader. Stash away the ELFLoader used to load an executable in Process so we can use it for symbolicating userspace addresses later on. This will make debugging userspace programs a lot nicer. :^)
2019-05-16 15:18:25 +00:00
OwnPtr<ELFLoader> loader;
Implemented sys$execve(). It's really crufty, but it basically works!
2018-11-03 00:49:40 +00:00
{
Kernel: Tighten up exec/do_exec and allow for PT_INTERP iterpreters This patch changes how exec() figures out which program image to actually load. Previously, we opened the path to our main executable in find_shebang_interpreter_for_executable, read the first page (or less, if the file was smaller) and then decided whether to recurse with the interpreter instead. We then then re-opened the main executable in do_exec. However, since we now want to parse the ELF header and Program Headers of an elf image before even doing any memory region work, we can change the way this whole process works. We open the file and read (up to) the first page in exec() itself, then pass just the page and the amount read to find_shebang_interpreter_for_executable. Since we now have that page and the FileDescription for the main executable handy, we can do a few things. First, validate the ELF header and ELF program headers for any shenanigans. ELF32 Little Endian i386 only, please. Second, we can grab the PT_INTERP interpreter from any ET_DYN files, and open that guy right away if it exists. Finally, we can pass the main executable's and optionally the PT_INTERP interpreter's file descriptions down to do_exec and not have to feel guilty about opening the file twice. In do_exec, we now have a choice. Are we going to load the main executable, or the interpreter? We could load both, but it'll be way easier for the inital pass on the RTLD if we only load the interpreter. Then it can load the main executable itself like any old shared object, just, the one with main in it :). Later on we can load both of them into memory and the RTLD can relocate itself before trying to do anything. The way it's written now the RTLD will get dibs on its requested virtual addresses being the actual virtual addresses.
2020-01-11 01:28:02 +00:00
ArmedScopeGuard rollback_regions_guard([&]() {
ASSERT(&current->process() == this);
Kernel: Make ProcessPagingScope restore CR3 properly Instead of restoring CR3 to the current process's paging scope when a ProcessPagingScope goes out of scope, we now restore exactly whatever the CR3 value was when we created the ProcessPagingScope. This fixes breakage in situations where a process ends up with nested ProcessPagingScopes. This was making profiling very fragile, and with this change it's now possible to profile g++! :^)
2020-01-19 12:44:53 +00:00
m_page_directory = move(old_page_directory);
Kernel: Tighten up exec/do_exec and allow for PT_INTERP iterpreters This patch changes how exec() figures out which program image to actually load. Previously, we opened the path to our main executable in find_shebang_interpreter_for_executable, read the first page (or less, if the file was smaller) and then decided whether to recurse with the interpreter instead. We then then re-opened the main executable in do_exec. However, since we now want to parse the ELF header and Program Headers of an elf image before even doing any memory region work, we can change the way this whole process works. We open the file and read (up to) the first page in exec() itself, then pass just the page and the amount read to find_shebang_interpreter_for_executable. Since we now have that page and the FileDescription for the main executable handy, we can do a few things. First, validate the ELF header and ELF program headers for any shenanigans. ELF32 Little Endian i386 only, please. Second, we can grab the PT_INTERP interpreter from any ET_DYN files, and open that guy right away if it exists. Finally, we can pass the main executable's and optionally the PT_INTERP interpreter's file descriptions down to do_exec and not have to feel guilty about opening the file twice. In do_exec, we now have a choice. Are we going to load the main executable, or the interpreter? We could load both, but it'll be way easier for the inital pass on the RTLD if we only load the interpreter. Then it can load the main executable itself like any old shared object, just, the one with main in it :). Later on we can load both of them into memory and the RTLD can relocate itself before trying to do anything. The way it's written now the RTLD will get dibs on its requested virtual addresses being the actual virtual addresses.
2020-01-11 01:28:02 +00:00
m_regions = move(old_regions);
Kernel: Make ProcessPagingScope restore CR3 properly Instead of restoring CR3 to the current process's paging scope when a ProcessPagingScope goes out of scope, we now restore exactly whatever the CR3 value was when we created the ProcessPagingScope. This fixes breakage in situations where a process ends up with nested ProcessPagingScopes. This was making profiling very fragile, and with this change it's now possible to profile g++! :^)
2020-01-19 12:44:53 +00:00
MM.enter_process_paging_scope(*this);
Kernel: Tighten up exec/do_exec and allow for PT_INTERP iterpreters This patch changes how exec() figures out which program image to actually load. Previously, we opened the path to our main executable in find_shebang_interpreter_for_executable, read the first page (or less, if the file was smaller) and then decided whether to recurse with the interpreter instead. We then then re-opened the main executable in do_exec. However, since we now want to parse the ELF header and Program Headers of an elf image before even doing any memory region work, we can change the way this whole process works. We open the file and read (up to) the first page in exec() itself, then pass just the page and the amount read to find_shebang_interpreter_for_executable. Since we now have that page and the FileDescription for the main executable handy, we can do a few things. First, validate the ELF header and ELF program headers for any shenanigans. ELF32 Little Endian i386 only, please. Second, we can grab the PT_INTERP interpreter from any ET_DYN files, and open that guy right away if it exists. Finally, we can pass the main executable's and optionally the PT_INTERP interpreter's file descriptions down to do_exec and not have to feel guilty about opening the file twice. In do_exec, we now have a choice. Are we going to load the main executable, or the interpreter? We could load both, but it'll be way easier for the inital pass on the RTLD if we only load the interpreter. Then it can load the main executable itself like any old shared object, just, the one with main in it :). Later on we can load both of them into memory and the RTLD can relocate itself before trying to do anything. The way it's written now the RTLD will get dibs on its requested virtual addresses being the actual virtual addresses.
2020-01-11 01:28:02 +00:00
});
loader = make<ELFLoader>(region->vaddr().as_ptr(), loader_metadata.size);
// Load the correct executable -- either interp or main program.
// FIXME: Once we actually load both interp and main, we'll need to be more clever about this.
// In that case, both will be ET_DYN objects, so they'll both be completely relocatable.
// That means, we can put them literally anywhere in User VM space (ASLR anyone?).
// ALSO FIXME: Reminder to really really fix that 'totally random offset' business.
ELF: Fail layout when program header hooks return nullptr (#673) ELFLoader::layout() had a "failed" variable that was never set. This patch checks the return value of each hook (alloc/map section and tls) and fails the load if they return null. I also needed to patch Process so that the alloc_section_hook and map_section_hook actually return nullptr when allocating a region fails. Fixes #664 :)
2019-10-20 14:24:42 +00:00
loader->map_section_hook = [&](VirtualAddress vaddr, size_t size, size_t alignment, size_t offset_in_image, bool is_readable, bool is_writable, bool is_executable, const String& name) -> u8* {
Teach Process::exec() about the magic of file-backed VMO's. This is really sweet! :^) The four instances of /bin/sh spawned at startup now share their read-only text pages. There are problems and limitations here, and plenty of room for improvement. But it kinda works.
2018-11-08 20:20:09 +00:00
ASSERT(size);
Fix all current build warnings in the kernel.
2018-11-09 09:03:21 +00:00
ASSERT(alignment == PAGE_SIZE);
Kernel: Make the Process allocate_region* API's understand "int prot". Instead of having to inspect 'prot' at every call site, make the Process API's take care of that so we can just pass it through.
2019-05-30 14:14:37 +00:00
int prot = 0;
if (is_readable)
prot |= PROT_READ;
if (is_writable)
prot |= PROT_WRITE;
if (is_executable)
prot |= PROT_EXEC;
Kernel: Enforce W^X between sys$mmap() and sys$execve() It's now an error to sys$mmap() a file as writable if it's currently mapped executable by anyone else. It's also an error to sys$execve() a file that's currently mapped writable by anyone else. This fixes a race condition vulnerability where one program could make modifications to an executable while another process was in the kernel, in the middle of exec'ing the same executable. Test: Kernel/elf-execve-mmap-race.cpp
2020-01-18 22:31:29 +00:00
if (auto* region = allocate_region_with_vmobject(vaddr.offset(totally_random_offset), size, *vmobject, offset_in_image, String(name), prot))
Kernel: Tighten up exec/do_exec and allow for PT_INTERP iterpreters This patch changes how exec() figures out which program image to actually load. Previously, we opened the path to our main executable in find_shebang_interpreter_for_executable, read the first page (or less, if the file was smaller) and then decided whether to recurse with the interpreter instead. We then then re-opened the main executable in do_exec. However, since we now want to parse the ELF header and Program Headers of an elf image before even doing any memory region work, we can change the way this whole process works. We open the file and read (up to) the first page in exec() itself, then pass just the page and the amount read to find_shebang_interpreter_for_executable. Since we now have that page and the FileDescription for the main executable handy, we can do a few things. First, validate the ELF header and ELF program headers for any shenanigans. ELF32 Little Endian i386 only, please. Second, we can grab the PT_INTERP interpreter from any ET_DYN files, and open that guy right away if it exists. Finally, we can pass the main executable's and optionally the PT_INTERP interpreter's file descriptions down to do_exec and not have to feel guilty about opening the file twice. In do_exec, we now have a choice. Are we going to load the main executable, or the interpreter? We could load both, but it'll be way easier for the inital pass on the RTLD if we only load the interpreter. Then it can load the main executable itself like any old shared object, just, the one with main in it :). Later on we can load both of them into memory and the RTLD can relocate itself before trying to do anything. The way it's written now the RTLD will get dibs on its requested virtual addresses being the actual virtual addresses.
2020-01-11 01:28:02 +00:00
return region->vaddr().as_ptr();
return nullptr;
Teach Process::exec() about the magic of file-backed VMO's. This is really sweet! :^) The four instances of /bin/sh spawned at startup now share their read-only text pages. There are problems and limitations here, and plenty of room for improvement. But it kinda works.
2018-11-08 20:20:09 +00:00
};
ELF: Fail layout when program header hooks return nullptr (#673) ELFLoader::layout() had a "failed" variable that was never set. This patch checks the return value of each hook (alloc/map section and tls) and fails the load if they return null. I also needed to patch Process so that the alloc_section_hook and map_section_hook actually return nullptr when allocating a region fails. Fixes #664 :)
2019-10-20 14:24:42 +00:00
loader->alloc_section_hook = [&](VirtualAddress vaddr, size_t size, size_t alignment, bool is_readable, bool is_writable, const String& name) -> u8* {
Use ELF program headers to load executables smarter. This turned out way better than the old code. ELF loading is now quite straightforward, and we don't need the weird concept of subregions anymore. Next step is to respect the is_writable flag.
2018-11-03 10:28:23 +00:00
ASSERT(size);
Fix all current build warnings in the kernel.
2018-11-09 09:03:21 +00:00
ASSERT(alignment == PAGE_SIZE);
Kernel: Make the Process allocate_region* API's understand "int prot". Instead of having to inspect 'prot' at every call site, make the Process API's take care of that so we can just pass it through.
2019-05-30 14:14:37 +00:00
int prot = 0;
if (is_readable)
prot |= PROT_READ;
if (is_writable)
prot |= PROT_WRITE;
Kernel: Use Vector::unstable_remove() in a couple of places
2020-01-15 18:25:27 +00:00
if (auto* region = allocate_region(vaddr.offset(totally_random_offset), size, String(name), prot))
Kernel: Tighten up exec/do_exec and allow for PT_INTERP iterpreters This patch changes how exec() figures out which program image to actually load. Previously, we opened the path to our main executable in find_shebang_interpreter_for_executable, read the first page (or less, if the file was smaller) and then decided whether to recurse with the interpreter instead. We then then re-opened the main executable in do_exec. However, since we now want to parse the ELF header and Program Headers of an elf image before even doing any memory region work, we can change the way this whole process works. We open the file and read (up to) the first page in exec() itself, then pass just the page and the amount read to find_shebang_interpreter_for_executable. Since we now have that page and the FileDescription for the main executable handy, we can do a few things. First, validate the ELF header and ELF program headers for any shenanigans. ELF32 Little Endian i386 only, please. Second, we can grab the PT_INTERP interpreter from any ET_DYN files, and open that guy right away if it exists. Finally, we can pass the main executable's and optionally the PT_INTERP interpreter's file descriptions down to do_exec and not have to feel guilty about opening the file twice. In do_exec, we now have a choice. Are we going to load the main executable, or the interpreter? We could load both, but it'll be way easier for the inital pass on the RTLD if we only load the interpreter. Then it can load the main executable itself like any old shared object, just, the one with main in it :). Later on we can load both of them into memory and the RTLD can relocate itself before trying to do anything. The way it's written now the RTLD will get dibs on its requested virtual addresses being the actual virtual addresses.
2020-01-11 01:28:02 +00:00
return region->vaddr().as_ptr();
return nullptr;
Implemented sys$execve(). It's really crufty, but it basically works!
2018-11-03 00:49:40 +00:00
};
Kernel: Tighten up exec/do_exec and allow for PT_INTERP iterpreters This patch changes how exec() figures out which program image to actually load. Previously, we opened the path to our main executable in find_shebang_interpreter_for_executable, read the first page (or less, if the file was smaller) and then decided whether to recurse with the interpreter instead. We then then re-opened the main executable in do_exec. However, since we now want to parse the ELF header and Program Headers of an elf image before even doing any memory region work, we can change the way this whole process works. We open the file and read (up to) the first page in exec() itself, then pass just the page and the amount read to find_shebang_interpreter_for_executable. Since we now have that page and the FileDescription for the main executable handy, we can do a few things. First, validate the ELF header and ELF program headers for any shenanigans. ELF32 Little Endian i386 only, please. Second, we can grab the PT_INTERP interpreter from any ET_DYN files, and open that guy right away if it exists. Finally, we can pass the main executable's and optionally the PT_INTERP interpreter's file descriptions down to do_exec and not have to feel guilty about opening the file twice. In do_exec, we now have a choice. Are we going to load the main executable, or the interpreter? We could load both, but it'll be way easier for the inital pass on the RTLD if we only load the interpreter. Then it can load the main executable itself like any old shared object, just, the one with main in it :). Later on we can load both of them into memory and the RTLD can relocate itself before trying to do anything. The way it's written now the RTLD will get dibs on its requested virtual addresses being the actual virtual addresses.
2020-01-11 01:28:02 +00:00
// FIXME: Move TLS region allocation to userspace: LibC and the dynamic loader.
// LibC if we end up with a statically linked executable, and the
// dynamic loader so that it can create new TLS blocks for each shared libarary
// that gets loaded as part of DT_NEEDED processing, and via dlopen()
// If that doesn't happen quickly, at least pass the location of the TLS region
// some ELF Auxilliary Vector so the loader can use it/create new ones as necessary.
Kernel: Support thread-local storage This patch adds support for TLS according to the x86 System V ABI. Each thread gets a thread-specific memory region, and the GS segment register always points _to a pointer_ to the thread-specific memory. In other words, to access thread-local variables, userspace programs start by dereferencing the pointer at [gs:0]. The Process keeps a master copy of the TLS segment that new threads should use, and when a new thread is created, they get a copy of it. It's basically whatever the PT_TLS program header in the ELF says.
2019-09-07 13:50:44 +00:00
loader->tls_section_hook = [&](size_t size, size_t alignment) {
ASSERT(size);
master_tls_region = allocate_region({}, size, String(), PROT_READ | PROT_WRITE);
master_tls_size = size;
master_tls_alignment = alignment;
return master_tls_region->vaddr().as_ptr();
};
Kernel: Symbolicate userspace backtraces using ELFLoader. Stash away the ELFLoader used to load an executable in Process so we can use it for symbolicating userspace addresses later on. This will make debugging userspace programs a lot nicer. :^)
2019-05-16 15:18:25 +00:00
bool success = loader->load();
Kernel: Tighten up exec/do_exec and allow for PT_INTERP iterpreters This patch changes how exec() figures out which program image to actually load. Previously, we opened the path to our main executable in find_shebang_interpreter_for_executable, read the first page (or less, if the file was smaller) and then decided whether to recurse with the interpreter instead. We then then re-opened the main executable in do_exec. However, since we now want to parse the ELF header and Program Headers of an elf image before even doing any memory region work, we can change the way this whole process works. We open the file and read (up to) the first page in exec() itself, then pass just the page and the amount read to find_shebang_interpreter_for_executable. Since we now have that page and the FileDescription for the main executable handy, we can do a few things. First, validate the ELF header and ELF program headers for any shenanigans. ELF32 Little Endian i386 only, please. Second, we can grab the PT_INTERP interpreter from any ET_DYN files, and open that guy right away if it exists. Finally, we can pass the main executable's and optionally the PT_INTERP interpreter's file descriptions down to do_exec and not have to feel guilty about opening the file twice. In do_exec, we now have a choice. Are we going to load the main executable, or the interpreter? We could load both, but it'll be way easier for the inital pass on the RTLD if we only load the interpreter. Then it can load the main executable itself like any old shared object, just, the one with main in it :). Later on we can load both of them into memory and the RTLD can relocate itself before trying to do anything. The way it's written now the RTLD will get dibs on its requested virtual addresses being the actual virtual addresses.
2020-01-11 01:28:02 +00:00
if (!success) {
Kernel: Load ELF executable pages lazily when possible. This currently only works for "normal" processes created by fork(). It does not work for create_user_process() processes spawned by the kernel, as those are a bit special during construction.
2019-03-27 03:01:15 +00:00
kprintf("do_exec: Failure loading %s\n", path.characters());
Implemented sys$execve(). It's really crufty, but it basically works!
2018-11-03 00:49:40 +00:00
return -ENOEXEC;
}
Kernel: Tighten up exec/do_exec and allow for PT_INTERP iterpreters This patch changes how exec() figures out which program image to actually load. Previously, we opened the path to our main executable in find_shebang_interpreter_for_executable, read the first page (or less, if the file was smaller) and then decided whether to recurse with the interpreter instead. We then then re-opened the main executable in do_exec. However, since we now want to parse the ELF header and Program Headers of an elf image before even doing any memory region work, we can change the way this whole process works. We open the file and read (up to) the first page in exec() itself, then pass just the page and the amount read to find_shebang_interpreter_for_executable. Since we now have that page and the FileDescription for the main executable handy, we can do a few things. First, validate the ELF header and ELF program headers for any shenanigans. ELF32 Little Endian i386 only, please. Second, we can grab the PT_INTERP interpreter from any ET_DYN files, and open that guy right away if it exists. Finally, we can pass the main executable's and optionally the PT_INTERP interpreter's file descriptions down to do_exec and not have to feel guilty about opening the file twice. In do_exec, we now have a choice. Are we going to load the main executable, or the interpreter? We could load both, but it'll be way easier for the inital pass on the RTLD if we only load the interpreter. Then it can load the main executable itself like any old shared object, just, the one with main in it :). Later on we can load both of them into memory and the RTLD can relocate itself before trying to do anything. The way it's written now the RTLD will get dibs on its requested virtual addresses being the actual virtual addresses.
2020-01-11 01:28:02 +00:00
// FIXME: Validate that this virtual address is within executable region,
// instead of just non-null. You could totally have a DSO with entry point of
// the beginning of the text segement.
if (!loader->entry().offset(totally_random_offset).get()) {
Kernel: Enforce W^X between sys$mmap() and sys$execve() It's now an error to sys$mmap() a file as writable if it's currently mapped executable by anyone else. It's also an error to sys$execve() a file that's currently mapped writable by anyone else. This fixes a race condition vulnerability where one program could make modifications to an executable while another process was in the kernel, in the middle of exec'ing the same executable. Test: Kernel/elf-execve-mmap-race.cpp
2020-01-18 22:31:29 +00:00
kprintf("do_exec: Failure loading %s, entry pointer is invalid! (%p)\n", path.characters(), loader->entry().offset(totally_random_offset).get());
Kernel: Tighten up exec/do_exec and allow for PT_INTERP iterpreters This patch changes how exec() figures out which program image to actually load. Previously, we opened the path to our main executable in find_shebang_interpreter_for_executable, read the first page (or less, if the file was smaller) and then decided whether to recurse with the interpreter instead. We then then re-opened the main executable in do_exec. However, since we now want to parse the ELF header and Program Headers of an elf image before even doing any memory region work, we can change the way this whole process works. We open the file and read (up to) the first page in exec() itself, then pass just the page and the amount read to find_shebang_interpreter_for_executable. Since we now have that page and the FileDescription for the main executable handy, we can do a few things. First, validate the ELF header and ELF program headers for any shenanigans. ELF32 Little Endian i386 only, please. Second, we can grab the PT_INTERP interpreter from any ET_DYN files, and open that guy right away if it exists. Finally, we can pass the main executable's and optionally the PT_INTERP interpreter's file descriptions down to do_exec and not have to feel guilty about opening the file twice. In do_exec, we now have a choice. Are we going to load the main executable, or the interpreter? We could load both, but it'll be way easier for the inital pass on the RTLD if we only load the interpreter. Then it can load the main executable itself like any old shared object, just, the one with main in it :). Later on we can load both of them into memory and the RTLD can relocate itself before trying to do anything. The way it's written now the RTLD will get dibs on its requested virtual addresses being the actual virtual addresses.
2020-01-11 01:28:02 +00:00
return -ENOEXEC;
}
rollback_regions_guard.disarm();
Implemented sys$execve(). It's really crufty, but it basically works!
2018-11-03 00:49:40 +00:00
Kernel: Do a bit more of do_exec() before disabling interrupts. We definitely need to replace m_executable before clearing interrupts, since otherwise we might call ~Custody() which would make it assert in locking. Also avoid calling FileDescriptor::metadata() repeatedly and just cache the result from the first call. I also added a comment at the point where we've decided to commit to the new executable and follow through with the swap.
2019-05-31 05:02:43 +00:00
// NOTE: At this point, we've committed to the new executable.
Kernel: Tighten up exec/do_exec and allow for PT_INTERP iterpreters This patch changes how exec() figures out which program image to actually load. Previously, we opened the path to our main executable in find_shebang_interpreter_for_executable, read the first page (or less, if the file was smaller) and then decided whether to recurse with the interpreter instead. We then then re-opened the main executable in do_exec. However, since we now want to parse the ELF header and Program Headers of an elf image before even doing any memory region work, we can change the way this whole process works. We open the file and read (up to) the first page in exec() itself, then pass just the page and the amount read to find_shebang_interpreter_for_executable. Since we now have that page and the FileDescription for the main executable handy, we can do a few things. First, validate the ELF header and ELF program headers for any shenanigans. ELF32 Little Endian i386 only, please. Second, we can grab the PT_INTERP interpreter from any ET_DYN files, and open that guy right away if it exists. Finally, we can pass the main executable's and optionally the PT_INTERP interpreter's file descriptions down to do_exec and not have to feel guilty about opening the file twice. In do_exec, we now have a choice. Are we going to load the main executable, or the interpreter? We could load both, but it'll be way easier for the inital pass on the RTLD if we only load the interpreter. Then it can load the main executable itself like any old shared object, just, the one with main in it :). Later on we can load both of them into memory and the RTLD can relocate itself before trying to do anything. The way it's written now the RTLD will get dibs on its requested virtual addresses being the actual virtual addresses.
2020-01-11 01:28:02 +00:00
entry_eip = loader->entry().offset(totally_random_offset).get();
Kernel+LibELF: Validate PT_LOAD and PT_TLS offsets before memcpy()'ing Before this, you could make the kernel copy memory from anywhere by setting up an ELF executable with a program header specifying file offsets outside the file. Since ELFImage didn't even know how large it was, we had no clue that we were copying things from outside the ELF. Fix this by adding a size field to ELFImage and validating program header ranges before memcpy()'ing to them. The ELF code is definitely going to need more validation and checking.
2020-01-06 20:04:57 +00:00
#ifdef EXEC_DEBUG
kprintf("Memory layout after ELF load:");
dump_regions();
#endif
Implemented sys$execve(). It's really crufty, but it basically works!
2018-11-03 00:49:40 +00:00
}
Kernel: Symbolicate userspace backtraces using ELFLoader. Stash away the ELFLoader used to load an executable in Process so we can use it for symbolicating userspace addresses later on. This will make debugging userspace programs a lot nicer. :^)
2019-05-16 15:18:25 +00:00
m_elf_loader = move(loader);
Kernel: Tighten up exec/do_exec and allow for PT_INTERP iterpreters This patch changes how exec() figures out which program image to actually load. Previously, we opened the path to our main executable in find_shebang_interpreter_for_executable, read the first page (or less, if the file was smaller) and then decided whether to recurse with the interpreter instead. We then then re-opened the main executable in do_exec. However, since we now want to parse the ELF header and Program Headers of an elf image before even doing any memory region work, we can change the way this whole process works. We open the file and read (up to) the first page in exec() itself, then pass just the page and the amount read to find_shebang_interpreter_for_executable. Since we now have that page and the FileDescription for the main executable handy, we can do a few things. First, validate the ELF header and ELF program headers for any shenanigans. ELF32 Little Endian i386 only, please. Second, we can grab the PT_INTERP interpreter from any ET_DYN files, and open that guy right away if it exists. Finally, we can pass the main executable's and optionally the PT_INTERP interpreter's file descriptions down to do_exec and not have to feel guilty about opening the file twice. In do_exec, we now have a choice. Are we going to load the main executable, or the interpreter? We could load both, but it'll be way easier for the inital pass on the RTLD if we only load the interpreter. Then it can load the main executable itself like any old shared object, just, the one with main in it :). Later on we can load both of them into memory and the RTLD can relocate itself before trying to do anything. The way it's written now the RTLD will get dibs on its requested virtual addresses being the actual virtual addresses.
2020-01-11 01:28:02 +00:00
m_executable = main_program_description->custody();
Kernel: Do a bit more of do_exec() before disabling interrupts. We definitely need to replace m_executable before clearing interrupts, since otherwise we might call ~Custody() which would make it assert in locking. Also avoid calling FileDescriptor::metadata() repeatedly and just cache the result from the first call. I also added a comment at the point where we've decided to commit to the new executable and follow through with the swap.
2019-05-31 05:02:43 +00:00
ping: Use pledge()
2020-01-11 19:48:43 +00:00
m_promises = m_execpromises;
Kernel: Rename UnveilState to VeilState
2020-01-21 18:28:29 +00:00
m_veil_state = VeilState::None;
Kernel: Clear unveiled state on exec()
2020-01-21 09:46:31 +00:00
m_unveiled_paths.clear();
Kernel: Support thread-local storage This patch adds support for TLS according to the x86 System V ABI. Each thread gets a thread-specific memory region, and the GS segment register always points _to a pointer_ to the thread-specific memory. In other words, to access thread-local variables, userspace programs start by dereferencing the pointer at [gs:0]. The Process keeps a master copy of the TLS segment that new threads should use, and when a new thread is created, they get a copy of it. It's basically whatever the PT_TLS program header in the ELF says.
2019-09-07 13:50:44 +00:00
// Copy of the master TLS region that we will clone for new threads
Kernel: Make Region single-owner instead of ref-counted This simplifies the ownership model and makes Region easier to reason about. Userspace Regions are now primarily kept by Process::m_regions. Kernel Regions are kept in various OwnPtr<Regions>'s. Regions now only ever get unmapped when they are destroyed.
2019-09-27 12:19:07 +00:00
m_master_tls_region = master_tls_region;
Kernel: Support thread-local storage This patch adds support for TLS according to the x86 System V ABI. Each thread gets a thread-specific memory region, and the GS segment register always points _to a pointer_ to the thread-specific memory. In other words, to access thread-local variables, userspace programs start by dereferencing the pointer at [gs:0]. The Process keeps a master copy of the TLS segment that new threads should use, and when a new thread is created, they get a copy of it. It's basically whatever the PT_TLS program header in the ELF says.
2019-09-07 13:50:44 +00:00
Kernel: Tighten up exec/do_exec and allow for PT_INTERP iterpreters This patch changes how exec() figures out which program image to actually load. Previously, we opened the path to our main executable in find_shebang_interpreter_for_executable, read the first page (or less, if the file was smaller) and then decided whether to recurse with the interpreter instead. We then then re-opened the main executable in do_exec. However, since we now want to parse the ELF header and Program Headers of an elf image before even doing any memory region work, we can change the way this whole process works. We open the file and read (up to) the first page in exec() itself, then pass just the page and the amount read to find_shebang_interpreter_for_executable. Since we now have that page and the FileDescription for the main executable handy, we can do a few things. First, validate the ELF header and ELF program headers for any shenanigans. ELF32 Little Endian i386 only, please. Second, we can grab the PT_INTERP interpreter from any ET_DYN files, and open that guy right away if it exists. Finally, we can pass the main executable's and optionally the PT_INTERP interpreter's file descriptions down to do_exec and not have to feel guilty about opening the file twice. In do_exec, we now have a choice. Are we going to load the main executable, or the interpreter? We could load both, but it'll be way easier for the inital pass on the RTLD if we only load the interpreter. Then it can load the main executable itself like any old shared object, just, the one with main in it :). Later on we can load both of them into memory and the RTLD can relocate itself before trying to do anything. The way it's written now the RTLD will get dibs on its requested virtual addresses being the actual virtual addresses.
2020-01-11 01:28:02 +00:00
auto main_program_metadata = main_program_description->metadata();
if (!(main_program_description->custody()->mount_flags() & MS_NOSUID)) {
if (main_program_metadata.is_setuid())
m_euid = main_program_metadata.uid;
if (main_program_metadata.is_setgid())
m_egid = main_program_metadata.gid;
Kernel+LibC: Implement a few mount flags We now support these mount flags: * MS_NODEV: disallow opening any devices from this file system * MS_NOEXEC: disallow executing any executables from this file system * MS_NOSUID: ignore set-user-id bits on executables from this file system The fourth flag, MS_BIND, is defined, but currently ignored.
2020-01-11 15:45:38 +00:00
}
Kernel: Symbolicate userspace backtraces using ELFLoader. Stash away the ELFLoader used to load an executable in Process so we can use it for symbolicating userspace addresses later on. This will make debugging userspace programs a lot nicer. :^)
2019-05-16 15:18:25 +00:00
Kernel: Introduce threads, and refactor everything in support of it. The scheduler now operates on threads, rather than on processes. Each process has a main thread, and can have any number of additional threads. The process exits when the main thread exits. This patch doesn't actually spawn any additional threads, it merely does all the plumbing needed to make it possible. :^)
2019-03-23 21:03:17 +00:00
current->set_default_signal_dispositions();
current->m_signal_mask = 0;
current->m_pending_signals = 0;
Some improvements to signals. - Add sigprocmask() and sigpending(). - Forked children inherit signal dispositions and masks. - Exec clears signal dispositions and masks.
2018-11-10 22:29:07 +00:00
Kernel: Drop futex queues/state on exec() This state is not meaningful to the new process image so just drop it.
2020-01-17 15:07:20 +00:00
m_futex_queues.clear();
More moving towards using signed types. I'm still feeling this out, but I am starting to like the general idea.
2019-02-25 21:06:55 +00:00
for (int i = 0; i < m_fds.size(); ++i) {
Add close-on-exec flag for file descriptors. I was surprised to find that dup()'ed fds don't share the close-on-exec flag. That means it has to be stored separately from the FileDescriptor object.
2018-11-13 00:36:31 +00:00
auto& daf = m_fds[i];
Kernel: Rename "descriptor" to "description" where appropriate. Now that FileDescription is called that, variables of that type should not be called "descriptor". This is kinda wordy but we'll get used to it.
2019-06-13 20:03:04 +00:00
if (daf.description && daf.flags & FD_CLOEXEC) {
daf.description->close();
Kernel: Run clang-format on everything.
2019-06-07 09:43:58 +00:00
daf = {};
Add close-on-exec flag for file descriptors. I was surprised to find that dup()'ed fds don't share the close-on-exec flag. That means it has to be stored separately from the FileDescriptor object.
2018-11-13 00:36:31 +00:00
}
}
Kernel: Get rid of "main thread" concept The idea of all processes reliably having a main thread was nice in some ways, but cumbersome in others. More importantly, it didn't match up with POSIX thread semantics, so let's move away from it. This thread gets rid of Process::main_thread() and you now we just have a bunch of Thread objects floating around each Process. When the finalizer nukes the last Thread in a Process, it will also tear down the Process. There's a bunch of more things to fix around this, but this is where we get started :^)
2019-12-22 10:35:02 +00:00
Thread* new_main_thread = nullptr;
if (&current->process() == this) {
new_main_thread = current;
} else {
for_each_thread([&](auto& thread) {
new_main_thread = &thread;
return IterationDecision::Break;
});
}
ASSERT(new_main_thread);
Kernel: Fix intermittent assertion failure in sys$exec() While setting up the main thread stack for a new process, we'd incur some zero-fill page faults. This was to be expected, since we allocate a huge stack but lazily populate it with physical pages. The problem is that page fault handlers may enable interrupts in order to grab a VMObject lock (or to page in from an inode.) During exec(), a process is reorganizing itself and will be in a very unrunnable state if the scheduler should interrupt it and then later ask it to run again. Which is exactly what happens if the process gets pre-empted while the new stack's zero-fill page fault grabs the lock. This patch fixes the issue by creating new main thread stacks before disabling interrupts and going into the critical part of exec().
2019-12-18 22:03:23 +00:00
// NOTE: We create the new stack before disabling interrupts since it will zero-fault
// and we don't want to deal with faults after this point.
Kernel: Get rid of "main thread" concept The idea of all processes reliably having a main thread was nice in some ways, but cumbersome in others. More importantly, it didn't match up with POSIX thread semantics, so let's move away from it. This thread gets rid of Process::main_thread() and you now we just have a bunch of Thread objects floating around each Process. When the finalizer nukes the last Thread in a Process, it will also tear down the Process. There's a bunch of more things to fix around this, but this is where we get started :^)
2019-12-22 10:35:02 +00:00
u32 new_userspace_esp = new_main_thread->make_userspace_stack_for_main_thread(move(arguments), move(environment));
Kernel: Fix intermittent assertion failure in sys$exec() While setting up the main thread stack for a new process, we'd incur some zero-fill page faults. This was to be expected, since we allocate a huge stack but lazily populate it with physical pages. The problem is that page fault handlers may enable interrupts in order to grab a VMObject lock (or to page in from an inode.) During exec(), a process is reorganizing itself and will be in a very unrunnable state if the scheduler should interrupt it and then later ask it to run again. Which is exactly what happens if the process gets pre-empted while the new stack's zero-fill page fault grabs the lock. This patch fixes the issue by creating new main thread stacks before disabling interrupts and going into the critical part of exec().
2019-12-18 22:03:23 +00:00
Fix race condition in exec(). ...also hook up sys$fstat in the syscall dispatcher.
2018-11-16 23:52:29 +00:00
// We cli() manually here because we don't want to get interrupted between do_exec() and Schedule::yield().
// The reason is that the task redirection we've set up above will be clobbered by the timer IRQ.
// If we used an InterruptDisabler that sti()'d on exit, we might timer tick'd too soon in exec().
Kernel: Introduce threads, and refactor everything in support of it. The scheduler now operates on threads, rather than on processes. Each process has a main thread, and can have any number of additional threads. The process exits when the main thread exits. This patch doesn't actually spawn any additional threads, it merely does all the plumbing needed to make it possible. :^)
2019-03-23 21:03:17 +00:00
if (&current->process() == this)
Kernel: Various stability improvements. - Don't cli() in Process::do_exec() unless current is execing. Eventually this should go away once the scheduler is less retarded in the face of interrupts. - Improved memory access validation for ring0 processes. We now look at the kernel ELF header to determine if an access is appropriate. :^) It's very hackish but also kinda neat. - Have Process::die() put the process into a new "Dying" state where it can still get scheduled but no signals will be dispatched. This way we can keep executing in die() but won't get our EIP hijacked by signal dispatch. The main problem here was that die() wanted to take various locks.
2019-02-06 16:28:14 +00:00
cli();
Fix race condition in exec(). ...also hook up sys$fstat in the syscall dispatcher.
2018-11-16 23:52:29 +00:00
Kernel: Fix intermittent assertion failure in sys$exec() While setting up the main thread stack for a new process, we'd incur some zero-fill page faults. This was to be expected, since we allocate a huge stack but lazily populate it with physical pages. The problem is that page fault handlers may enable interrupts in order to grab a VMObject lock (or to page in from an inode.) During exec(), a process is reorganizing itself and will be in a very unrunnable state if the scheduler should interrupt it and then later ask it to run again. Which is exactly what happens if the process gets pre-empted while the new stack's zero-fill page fault grabs the lock. This patch fixes the issue by creating new main thread stacks before disabling interrupts and going into the critical part of exec().
2019-12-18 22:03:23 +00:00
// NOTE: Be careful to not trigger any page faults below!
Kernel: Get rid of "main thread" concept The idea of all processes reliably having a main thread was nice in some ways, but cumbersome in others. More importantly, it didn't match up with POSIX thread semantics, so let's move away from it. This thread gets rid of Process::main_thread() and you now we just have a bunch of Thread objects floating around each Process. When the finalizer nukes the last Thread in a Process, it will also tear down the Process. There's a bunch of more things to fix around this, but this is where we get started :^)
2019-12-22 10:35:02 +00:00
Scheduler::prepare_to_modify_tss(*new_main_thread);
Implemented sys$execve(). It's really crufty, but it basically works!
2018-11-03 00:49:40 +00:00
Coding style fixes in AK.
2019-01-19 21:53:05 +00:00
m_name = parts.take_last();
Kernel: Get rid of "main thread" concept The idea of all processes reliably having a main thread was nice in some ways, but cumbersome in others. More importantly, it didn't match up with POSIX thread semantics, so let's move away from it. This thread gets rid of Process::main_thread() and you now we just have a bunch of Thread objects floating around each Process. When the finalizer nukes the last Thread in a Process, it will also tear down the Process. There's a bunch of more things to fix around this, but this is where we get started :^)
2019-12-22 10:35:02 +00:00
new_main_thread->set_name(m_name);
auto& tss = new_main_thread->m_tss;
Implemented sys$execve(). It's really crufty, but it basically works!
2018-11-03 00:49:40 +00:00
Kernel: Get rid of "main thread" concept The idea of all processes reliably having a main thread was nice in some ways, but cumbersome in others. More importantly, it didn't match up with POSIX thread semantics, so let's move away from it. This thread gets rid of Process::main_thread() and you now we just have a bunch of Thread objects floating around each Process. When the finalizer nukes the last Thread in a Process, it will also tear down the Process. There's a bunch of more things to fix around this, but this is where we get started :^)
2019-12-22 10:35:02 +00:00
u32 old_esp0 = tss.esp0;
Kernel: Introduce threads, and refactor everything in support of it. The scheduler now operates on threads, rather than on processes. Each process has a main thread, and can have any number of additional threads. The process exits when the main thread exits. This patch doesn't actually spawn any additional threads, it merely does all the plumbing needed to make it possible. :^)
2019-03-23 21:03:17 +00:00
Kernel: Support thread-local storage This patch adds support for TLS according to the x86 System V ABI. Each thread gets a thread-specific memory region, and the GS segment register always points _to a pointer_ to the thread-specific memory. In other words, to access thread-local variables, userspace programs start by dereferencing the pointer at [gs:0]. The Process keeps a master copy of the TLS segment that new threads should use, and when a new thread is created, they get a copy of it. It's basically whatever the PT_TLS program header in the ELF says.
2019-09-07 13:50:44 +00:00
m_master_tls_size = master_tls_size;
m_master_tls_alignment = master_tls_alignment;
Kernel: Get rid of "main thread" concept The idea of all processes reliably having a main thread was nice in some ways, but cumbersome in others. More importantly, it didn't match up with POSIX thread semantics, so let's move away from it. This thread gets rid of Process::main_thread() and you now we just have a bunch of Thread objects floating around each Process. When the finalizer nukes the last Thread in a Process, it will also tear down the Process. There's a bunch of more things to fix around this, but this is where we get started :^)
2019-12-22 10:35:02 +00:00
new_main_thread->make_thread_specific_region({});
memset(&tss, 0, sizeof(TSS32));
Kernel: Prevent executing I/O instructions in userspace All threads were running with iomapbase=0 in their TSS, which the CPU interprets as "there's an I/O permission bitmap starting at offset 0 into my TSS". Because of that, any bits that were 1 inside the TSS would allow the thread to execute I/O instructions on the port with that bit index. Fix this by always setting the iomapbase to sizeof(TSS32), and also setting the TSS descriptor's limit to sizeof(TSS32), effectively making the I/O permissions bitmap zero-length. This should make it no longer possible to do I/O from userspace. :^)
2020-01-01 16:26:25 +00:00
tss.iomapbase = sizeof(TSS32);
Kernel: Get rid of "main thread" concept The idea of all processes reliably having a main thread was nice in some ways, but cumbersome in others. More importantly, it didn't match up with POSIX thread semantics, so let's move away from it. This thread gets rid of Process::main_thread() and you now we just have a bunch of Thread objects floating around each Process. When the finalizer nukes the last Thread in a Process, it will also tear down the Process. There's a bunch of more things to fix around this, but this is where we get started :^)
2019-12-22 10:35:02 +00:00
tss.eflags = 0x0202;
tss.eip = entry_eip;
tss.cs = 0x1b;
tss.ds = 0x23;
tss.es = 0x23;
tss.fs = 0x23;
tss.gs = thread_specific_selector() | 3;
tss.ss = 0x23;
tss.cr3 = page_directory().cr3();
tss.esp = new_userspace_esp;
tss.ss0 = 0x10;
tss.esp0 = old_esp0;
tss.ss2 = m_pid;
Implemented sys$execve(). It's really crufty, but it basically works!
2018-11-03 00:49:40 +00:00
#ifdef TASK_DEBUG
Kernel: Get rid of "main thread" concept The idea of all processes reliably having a main thread was nice in some ways, but cumbersome in others. More importantly, it didn't match up with POSIX thread semantics, so let's move away from it. This thread gets rid of Process::main_thread() and you now we just have a bunch of Thread objects floating around each Process. When the finalizer nukes the last Thread in a Process, it will also tear down the Process. There's a bunch of more things to fix around this, but this is where we get started :^)
2019-12-22 10:35:02 +00:00
kprintf("Process %u (%s) exec'd %s @ %p\n", pid(), name().characters(), path.characters(), tss.eip);
Implemented sys$execve(). It's really crufty, but it basically works!
2018-11-03 00:49:40 +00:00
#endif
Kernel: Get rid of "main thread" concept The idea of all processes reliably having a main thread was nice in some ways, but cumbersome in others. More importantly, it didn't match up with POSIX thread semantics, so let's move away from it. This thread gets rid of Process::main_thread() and you now we just have a bunch of Thread objects floating around each Process. When the finalizer nukes the last Thread in a Process, it will also tear down the Process. There's a bunch of more things to fix around this, but this is where we get started :^)
2019-12-22 10:35:02 +00:00
new_main_thread->set_state(Thread::State::Skip1SchedulerPass);
Kernel: Allow unlocking a held Lock with interrupts disabled This is needed to eliminate a race in Thread::wait_on() where we'd otherwise have to wait until after unlocking the process lock before we can disable interrupts.
2020-01-12 21:53:20 +00:00
big_lock().force_unlock_if_locked();
Okay, now *actually* plug the leaks in exec(). I didn't even put the { } properly around everything that would leak. Let's make sure this works correctly by splitting out the work into a helper called do_exec().
2018-11-09 16:59:14 +00:00
return 0;
}
Kernel: Tighten up exec/do_exec and allow for PT_INTERP iterpreters This patch changes how exec() figures out which program image to actually load. Previously, we opened the path to our main executable in find_shebang_interpreter_for_executable, read the first page (or less, if the file was smaller) and then decided whether to recurse with the interpreter instead. We then then re-opened the main executable in do_exec. However, since we now want to parse the ELF header and Program Headers of an elf image before even doing any memory region work, we can change the way this whole process works. We open the file and read (up to) the first page in exec() itself, then pass just the page and the amount read to find_shebang_interpreter_for_executable. Since we now have that page and the FileDescription for the main executable handy, we can do a few things. First, validate the ELF header and ELF program headers for any shenanigans. ELF32 Little Endian i386 only, please. Second, we can grab the PT_INTERP interpreter from any ET_DYN files, and open that guy right away if it exists. Finally, we can pass the main executable's and optionally the PT_INTERP interpreter's file descriptions down to do_exec and not have to feel guilty about opening the file twice. In do_exec, we now have a choice. Are we going to load the main executable, or the interpreter? We could load both, but it'll be way easier for the inital pass on the RTLD if we only load the interpreter. Then it can load the main executable itself like any old shared object, just, the one with main in it :). Later on we can load both of them into memory and the RTLD can relocate itself before trying to do anything. The way it's written now the RTLD will get dibs on its requested virtual addresses being the actual virtual addresses.
2020-01-11 01:28:02 +00:00
static KResultOr<Vector<String>> find_shebang_interpreter_for_executable(const char first_page[], int nread)
Kernel: Implement shebang executables ("#!/bin/sh") This patch makes it possible to *run* text files that start with the characters "#!" followed by an interpreter. I've tested this with both the Serenity built-in shell and the Bash shell, and it works as expected. :^)
2019-09-15 09:47:21 +00:00
{
Kernel: Support passing arguments in shebangged scripts Add the ability to both pass arguments to scripts with shebangs (./script argument1 argument2) and to specify them in the shebang line (#!/usr/local/bin/bash -x -e) Fixes #585
2019-10-27 09:42:07 +00:00
int word_start = 2;
int word_length = 0;
Kernel: Implement shebang executables ("#!/bin/sh") This patch makes it possible to *run* text files that start with the characters "#!" followed by an interpreter. I've tested this with both the Serenity built-in shell and the Bash shell, and it works as expected. :^)
2019-09-15 09:47:21 +00:00
if (nread > 2 && first_page[0] == '#' && first_page[1] == '!') {
Kernel: Support passing arguments in shebangged scripts Add the ability to both pass arguments to scripts with shebangs (./script argument1 argument2) and to specify them in the shebang line (#!/usr/local/bin/bash -x -e) Fixes #585
2019-10-27 09:42:07 +00:00
Vector<String> interpreter_words;
Kernel: Implement shebang executables ("#!/bin/sh") This patch makes it possible to *run* text files that start with the characters "#!" followed by an interpreter. I've tested this with both the Serenity built-in shell and the Bash shell, and it works as expected. :^)
2019-09-15 09:47:21 +00:00
for (int i = 2; i < nread; ++i) {
if (first_page[i] == '\n') {
break;
}
Kernel: Support passing arguments in shebangged scripts Add the ability to both pass arguments to scripts with shebangs (./script argument1 argument2) and to specify them in the shebang line (#!/usr/local/bin/bash -x -e) Fixes #585
2019-10-27 09:42:07 +00:00
if (first_page[i] != ' ') {
++word_length;
}
if (first_page[i] == ' ') {
if (word_length > 0) {
interpreter_words.append(String(&first_page[word_start], word_length));
}
word_length = 0;
word_start = i + 1;
}
Kernel: Implement shebang executables ("#!/bin/sh") This patch makes it possible to *run* text files that start with the characters "#!" followed by an interpreter. I've tested this with both the Serenity built-in shell and the Bash shell, and it works as expected. :^)
2019-09-15 09:47:21 +00:00
}
Kernel: Support passing arguments in shebangged scripts Add the ability to both pass arguments to scripts with shebangs (./script argument1 argument2) and to specify them in the shebang line (#!/usr/local/bin/bash -x -e) Fixes #585
2019-10-27 09:42:07 +00:00
if (word_length > 0)
interpreter_words.append(String(&first_page[word_start], word_length));
if (!interpreter_words.is_empty())
return interpreter_words;
Kernel: Implement shebang executables ("#!/bin/sh") This patch makes it possible to *run* text files that start with the characters "#!" followed by an interpreter. I've tested this with both the Serenity built-in shell and the Bash shell, and it works as expected. :^)
2019-09-15 09:47:21 +00:00
}
return KResult(-ENOEXEC);
}
Kernel: Tighten up exec/do_exec and allow for PT_INTERP iterpreters This patch changes how exec() figures out which program image to actually load. Previously, we opened the path to our main executable in find_shebang_interpreter_for_executable, read the first page (or less, if the file was smaller) and then decided whether to recurse with the interpreter instead. We then then re-opened the main executable in do_exec. However, since we now want to parse the ELF header and Program Headers of an elf image before even doing any memory region work, we can change the way this whole process works. We open the file and read (up to) the first page in exec() itself, then pass just the page and the amount read to find_shebang_interpreter_for_executable. Since we now have that page and the FileDescription for the main executable handy, we can do a few things. First, validate the ELF header and ELF program headers for any shenanigans. ELF32 Little Endian i386 only, please. Second, we can grab the PT_INTERP interpreter from any ET_DYN files, and open that guy right away if it exists. Finally, we can pass the main executable's and optionally the PT_INTERP interpreter's file descriptions down to do_exec and not have to feel guilty about opening the file twice. In do_exec, we now have a choice. Are we going to load the main executable, or the interpreter? We could load both, but it'll be way easier for the inital pass on the RTLD if we only load the interpreter. Then it can load the main executable itself like any old shared object, just, the one with main in it :). Later on we can load both of them into memory and the RTLD can relocate itself before trying to do anything. The way it's written now the RTLD will get dibs on its requested virtual addresses being the actual virtual addresses.
2020-01-11 01:28:02 +00:00
KResultOr<NonnullRefPtr<FileDescription>> Process::find_elf_interpreter_for_executable(const String& path, char (&first_page)[PAGE_SIZE], int nread, size_t file_size)
{
if (nread < (int)sizeof(Elf32_Ehdr))
return KResult(-ENOEXEC);
auto elf_header = (Elf32_Ehdr*)first_page;
if (!ELFImage::validate_elf_header(*elf_header, file_size)) {
dbgprintf("%s(%d) exec(%s): File has invalid ELF header\n", m_name.characters(), m_pid, path.characters());
return KResult(-ENOEXEC);
}
// Not using KResultOr here because we'll want to do the same thing in userspace in the RTLD
String interpreter_path;
if (!ELFImage::validate_program_headers(*elf_header, file_size, (u8*)first_page, nread, interpreter_path)) {
dbgprintf("%s(%d) exec(%s): File has invalid ELF Program headers\n", m_name.characters(), m_pid, path.characters());
return KResult(-ENOEXEC);
}
if (!interpreter_path.is_empty()) {
// Programs with an interpreter better be relocatable executables or we don't know what to do...
if (elf_header->e_type != ET_DYN)
return KResult(-ENOEXEC);
dbgprintf("%s(%d) exec(%s): Using program interpreter %s\n", m_name.characters(), m_pid, path.characters(), interpreter_path.characters());
auto interp_result = VFS::the().open(interpreter_path, O_EXEC, 0, current_directory());
if (interp_result.is_error()) {
dbgprintf("%s(%d) exec(%s): Unable to open program interpreter %s\n", m_name.characters(), m_pid, path.characters(), interpreter_path.characters());
return interp_result.error();
}
auto interpreter_description = interp_result.value();
auto interp_metadata = interpreter_description->metadata();
ASSERT(interpreter_description->inode());
// Validate the program interpreter as a valid elf binary.
// If your program interpreter is a #! file or something, it's time to stop playing games :)
if (interp_metadata.size < (int)sizeof(Elf32_Ehdr))
return KResult(-ENOEXEC);
memset(first_page, 0, sizeof(first_page));
nread = interpreter_description->read((u8*)&first_page, sizeof(first_page));
if (nread < (int)sizeof(Elf32_Ehdr))
return KResult(-ENOEXEC);
elf_header = (Elf32_Ehdr*)first_page;
if (!ELFImage::validate_elf_header(*elf_header, interp_metadata.size)) {
dbgprintf("%s(%d) exec(%s): Interpreter (%s) has invalid ELF header\n", m_name.characters(), m_pid, path.characters(), interpreter_description->absolute_path().characters());
return KResult(-ENOEXEC);
}
// Not using KResultOr here because we'll want to do the same thing in userspace in the RTLD
String interpreter_interpreter_path;
if (!ELFImage::validate_program_headers(*elf_header, interp_metadata.size, (u8*)first_page, nread, interpreter_interpreter_path)) {
dbgprintf("%s(%d) exec(%s): Interpreter (%s) has invalid ELF Program headers\n", m_name.characters(), m_pid, path.characters(), interpreter_description->absolute_path().characters());
return KResult(-ENOEXEC);
}
if (!interpreter_interpreter_path.is_empty()) {
dbgprintf("%s(%d) exec(%s): Interpreter (%s) has its own interpreter (%s)! No thank you!\n",
m_name.characters(), m_pid, path.characters(), interpreter_description->absolute_path().characters(), interpreter_interpreter_path.characters());
return KResult(-ELOOP);
}
return interpreter_description;
}
if (elf_header->e_type != ET_EXEC) {
// We can't exec an ET_REL, that's just an object file from the compiler
// If it's ET_DYN with no PT_INTERP, then we can't load it properly either
return KResult(-ENOEXEC);
}
// No interpreter, but, path refers to a valid elf image
return KResult(KSuccess);
}
int Process::exec(String path, Vector<String> arguments, Vector<String> environment, int recursion_depth)
Okay, now *actually* plug the leaks in exec(). I didn't even put the { } properly around everything that would leak. Let's make sure this works correctly by splitting out the work into a helper called do_exec().
2018-11-09 16:59:14 +00:00
{
Kernel: Tighten up exec/do_exec and allow for PT_INTERP iterpreters This patch changes how exec() figures out which program image to actually load. Previously, we opened the path to our main executable in find_shebang_interpreter_for_executable, read the first page (or less, if the file was smaller) and then decided whether to recurse with the interpreter instead. We then then re-opened the main executable in do_exec. However, since we now want to parse the ELF header and Program Headers of an elf image before even doing any memory region work, we can change the way this whole process works. We open the file and read (up to) the first page in exec() itself, then pass just the page and the amount read to find_shebang_interpreter_for_executable. Since we now have that page and the FileDescription for the main executable handy, we can do a few things. First, validate the ELF header and ELF program headers for any shenanigans. ELF32 Little Endian i386 only, please. Second, we can grab the PT_INTERP interpreter from any ET_DYN files, and open that guy right away if it exists. Finally, we can pass the main executable's and optionally the PT_INTERP interpreter's file descriptions down to do_exec and not have to feel guilty about opening the file twice. In do_exec, we now have a choice. Are we going to load the main executable, or the interpreter? We could load both, but it'll be way easier for the inital pass on the RTLD if we only load the interpreter. Then it can load the main executable itself like any old shared object, just, the one with main in it :). Later on we can load both of them into memory and the RTLD can relocate itself before trying to do anything. The way it's written now the RTLD will get dibs on its requested virtual addresses being the actual virtual addresses.
2020-01-11 01:28:02 +00:00
if (recursion_depth > 2) {
dbgprintf("%s(%d) exec(%s): SHENANIGANS! recursed too far trying to find #! interpreter\n", m_name.characters(), m_pid, path.characters());
return -ELOOP;
}
// Open the file to check what kind of binary format it is
// Currently supported formats:
// - #! interpreted file
// - ELF32
// * ET_EXEC binary that just gets loaded
// * ET_DYN binary that requires a program interpreter
//
auto result = VFS::the().open(path, O_EXEC, 0, current_directory());
if (result.is_error())
return result.error();
auto description = result.value();
auto metadata = description->metadata();
// Always gonna need at least 3 bytes. these are for #!X
if (metadata.size < 3)
return -ENOEXEC;
ASSERT(description->inode());
// Read the first page of the program into memory so we can validate the binfmt of it
char first_page[PAGE_SIZE];
int nread = description->read((u8*)&first_page, sizeof(first_page));
// 1) #! interpreted file
auto shebang_result = find_shebang_interpreter_for_executable(first_page, nread);
if (!shebang_result.is_error()) {
Vector<String> new_arguments(shebang_result.value());
Kernel: Support passing arguments in shebangged scripts Add the ability to both pass arguments to scripts with shebangs (./script argument1 argument2) and to specify them in the shebang line (#!/usr/local/bin/bash -x -e) Fixes #585
2019-10-27 09:42:07 +00:00
new_arguments.append(path);
arguments.remove(0);
new_arguments.append(move(arguments));
Kernel: Tighten up exec/do_exec and allow for PT_INTERP iterpreters This patch changes how exec() figures out which program image to actually load. Previously, we opened the path to our main executable in find_shebang_interpreter_for_executable, read the first page (or less, if the file was smaller) and then decided whether to recurse with the interpreter instead. We then then re-opened the main executable in do_exec. However, since we now want to parse the ELF header and Program Headers of an elf image before even doing any memory region work, we can change the way this whole process works. We open the file and read (up to) the first page in exec() itself, then pass just the page and the amount read to find_shebang_interpreter_for_executable. Since we now have that page and the FileDescription for the main executable handy, we can do a few things. First, validate the ELF header and ELF program headers for any shenanigans. ELF32 Little Endian i386 only, please. Second, we can grab the PT_INTERP interpreter from any ET_DYN files, and open that guy right away if it exists. Finally, we can pass the main executable's and optionally the PT_INTERP interpreter's file descriptions down to do_exec and not have to feel guilty about opening the file twice. In do_exec, we now have a choice. Are we going to load the main executable, or the interpreter? We could load both, but it'll be way easier for the inital pass on the RTLD if we only load the interpreter. Then it can load the main executable itself like any old shared object, just, the one with main in it :). Later on we can load both of them into memory and the RTLD can relocate itself before trying to do anything. The way it's written now the RTLD will get dibs on its requested virtual addresses being the actual virtual addresses.
2020-01-11 01:28:02 +00:00
return exec(shebang_result.value().first(), move(new_arguments), move(environment), ++recursion_depth);
Kernel: Support passing arguments in shebangged scripts Add the ability to both pass arguments to scripts with shebangs (./script argument1 argument2) and to specify them in the shebang line (#!/usr/local/bin/bash -x -e) Fixes #585
2019-10-27 09:42:07 +00:00
}
Kernel: Implement shebang executables ("#!/bin/sh") This patch makes it possible to *run* text files that start with the characters "#!" followed by an interpreter. I've tested this with both the Serenity built-in shell and the Bash shell, and it works as expected. :^)
2019-09-15 09:47:21 +00:00
Kernel: Tighten up exec/do_exec and allow for PT_INTERP iterpreters This patch changes how exec() figures out which program image to actually load. Previously, we opened the path to our main executable in find_shebang_interpreter_for_executable, read the first page (or less, if the file was smaller) and then decided whether to recurse with the interpreter instead. We then then re-opened the main executable in do_exec. However, since we now want to parse the ELF header and Program Headers of an elf image before even doing any memory region work, we can change the way this whole process works. We open the file and read (up to) the first page in exec() itself, then pass just the page and the amount read to find_shebang_interpreter_for_executable. Since we now have that page and the FileDescription for the main executable handy, we can do a few things. First, validate the ELF header and ELF program headers for any shenanigans. ELF32 Little Endian i386 only, please. Second, we can grab the PT_INTERP interpreter from any ET_DYN files, and open that guy right away if it exists. Finally, we can pass the main executable's and optionally the PT_INTERP interpreter's file descriptions down to do_exec and not have to feel guilty about opening the file twice. In do_exec, we now have a choice. Are we going to load the main executable, or the interpreter? We could load both, but it'll be way easier for the inital pass on the RTLD if we only load the interpreter. Then it can load the main executable itself like any old shared object, just, the one with main in it :). Later on we can load both of them into memory and the RTLD can relocate itself before trying to do anything. The way it's written now the RTLD will get dibs on its requested virtual addresses being the actual virtual addresses.
2020-01-11 01:28:02 +00:00
// #2) ELF32 for i386
auto elf_result = find_elf_interpreter_for_executable(path, first_page, nread, metadata.size);
RefPtr<FileDescription> interpreter_description;
// We're getting either an interpreter, an error, or KSuccess (i.e. no interpreter but file checks out)
if (!elf_result.is_error())
interpreter_description = elf_result.value();
else if (elf_result.error().is_error())
return elf_result.error();
Okay, now *actually* plug the leaks in exec(). I didn't even put the { } properly around everything that would leak. Let's make sure this works correctly by splitting out the work into a helper called do_exec().
2018-11-09 16:59:14 +00:00
// The bulk of exec() is done by do_exec(), which ensures that all locals
// are cleaned up by the time we yield-teleport below.
Kernel: Tighten up exec/do_exec and allow for PT_INTERP iterpreters This patch changes how exec() figures out which program image to actually load. Previously, we opened the path to our main executable in find_shebang_interpreter_for_executable, read the first page (or less, if the file was smaller) and then decided whether to recurse with the interpreter instead. We then then re-opened the main executable in do_exec. However, since we now want to parse the ELF header and Program Headers of an elf image before even doing any memory region work, we can change the way this whole process works. We open the file and read (up to) the first page in exec() itself, then pass just the page and the amount read to find_shebang_interpreter_for_executable. Since we now have that page and the FileDescription for the main executable handy, we can do a few things. First, validate the ELF header and ELF program headers for any shenanigans. ELF32 Little Endian i386 only, please. Second, we can grab the PT_INTERP interpreter from any ET_DYN files, and open that guy right away if it exists. Finally, we can pass the main executable's and optionally the PT_INTERP interpreter's file descriptions down to do_exec and not have to feel guilty about opening the file twice. In do_exec, we now have a choice. Are we going to load the main executable, or the interpreter? We could load both, but it'll be way easier for the inital pass on the RTLD if we only load the interpreter. Then it can load the main executable itself like any old shared object, just, the one with main in it :). Later on we can load both of them into memory and the RTLD can relocate itself before trying to do anything. The way it's written now the RTLD will get dibs on its requested virtual addresses being the actual virtual addresses.
2020-01-11 01:28:02 +00:00
int rc = do_exec(move(description), move(arguments), move(environment), move(interpreter_description));
Okay, now *actually* plug the leaks in exec(). I didn't even put the { } properly around everything that would leak. Let's make sure this works correctly by splitting out the work into a helper called do_exec().
2018-11-09 16:59:14 +00:00
if (rc < 0)
return rc;
Finally unbreak the colonel process and make it the true idle process.
2018-11-07 22:13:38 +00:00
Kernel: Introduce threads, and refactor everything in support of it. The scheduler now operates on threads, rather than on processes. Each process has a main thread, and can have any number of additional threads. The process exits when the main thread exits. This patch doesn't actually spawn any additional threads, it merely does all the plumbing needed to make it possible. :^)
2019-03-23 21:03:17 +00:00
if (&current->process() == this) {
Fix some paging related bugs exposed by the spawn stress test. - Process::exec() needs to restore the original paging scope when called on a non-current process. - Add missing InterruptDisabler guards around g_processes access. - Only flush the TLB when modifying the active page tables.
2018-11-09 00:25:31 +00:00
Scheduler::yield();
Fix VMO leak in Process::exec(). Gotta make sure things get cleaned up before we yield-teleport in exec(). Also VMOs and regions are now viewable through /proc/mm and /proc/regions.
2018-11-08 21:24:02 +00:00
ASSERT_NOT_REACHED();
Finally unbreak the colonel process and make it the true idle process.
2018-11-07 22:13:38 +00:00
}
Implemented sys$execve(). It's really crufty, but it basically works!
2018-11-03 00:49:40 +00:00
return 0;
}
Kernel: Enable SMAP protection during the execve() syscall The userspace execve() wrapper now measures all the strings and puts them in a neat and tidy structure on the stack. This way we know exactly how much to copy in the kernel, and we don't have to use the SMAP-violating validate_read_str(). :^)
2020-01-10 11:20:36 +00:00
int Process::sys$execve(const Syscall::SC_execve_params* user_params)
Factor out the "non-syscall" parts of sys$execve() into exec(). ..to prepare for sharing code with createUserProcess().
2018-11-03 09:20:23 +00:00
{
ping: Use pledge()
2020-01-11 19:48:43 +00:00
REQUIRE_PROMISE(exec);
Kernel: Fix String leaks in exec(). When the kernel performs a successful exec(), whatever was on the kernel stack for that process before goes away. For this reason, we need to make sure we don't have any stack objects holding onto kmalloc memory.
2019-02-17 09:18:25 +00:00
// NOTE: Be extremely careful with allocating any kernel memory in exec().
// On success, the kernel stack will be lost.
Kernel: Enable SMAP protection during the execve() syscall The userspace execve() wrapper now measures all the strings and puts them in a neat and tidy structure on the stack. This way we know exactly how much to copy in the kernel, and we don't have to use the SMAP-violating validate_read_str(). :^)
2020-01-10 11:20:36 +00:00
Syscall::SC_execve_params params;
Kernel: Combine validate and copy of user mode pointers (#1069) Right now there is a significant amount of boiler plate code required to validate user mode parameters in syscalls. In an attempt to reduce this a bit, introduce validate_read_and_copy_typed which combines the usermode address check and does the copy internally if the validation passes. This cleans up a little bit of code from a significant amount of syscalls.
2020-01-13 10:19:18 +00:00
if (!validate_read_and_copy_typed(&params, user_params))
Kernel: Enable SMAP protection during the execve() syscall The userspace execve() wrapper now measures all the strings and puts them in a neat and tidy structure on the stack. This way we know exactly how much to copy in the kernel, and we don't have to use the SMAP-violating validate_read_str(). :^)
2020-01-10 11:20:36 +00:00
return -EFAULT;
if (params.arguments.length > ARG_MAX || params.environment.length > ARG_MAX)
return -E2BIG;
Kernel: Use get_syscall_path_argument() in sys$execve() Paths passed to sys$execve() should certainly be subject to all the usual path validation checks.
2020-01-18 10:43:28 +00:00
String path;
{
auto path_arg = get_syscall_path_argument(params.path);
if (path_arg.is_error())
return path_arg.error();
path = path_arg.value();
}
Kernel: Enable SMAP protection during the execve() syscall The userspace execve() wrapper now measures all the strings and puts them in a neat and tidy structure on the stack. This way we know exactly how much to copy in the kernel, and we don't have to use the SMAP-violating validate_read_str(). :^)
2020-01-10 11:20:36 +00:00
auto copy_user_strings = [&](const auto& list, auto& output) {
if (!list.length)
return true;
if (!validate_read_typed(list.strings, list.length))
return false;
Kernel: Rename Syscall::SyscallString => Syscall::StringArgument
2020-01-10 19:15:58 +00:00
Vector<Syscall::StringArgument, 32> strings;
Kernel: Enable SMAP protection during the execve() syscall The userspace execve() wrapper now measures all the strings and puts them in a neat and tidy structure on the stack. This way we know exactly how much to copy in the kernel, and we don't have to use the SMAP-violating validate_read_str(). :^)
2020-01-10 11:20:36 +00:00
strings.resize(list.length);
Kernel: Rename Syscall::SyscallString => Syscall::StringArgument
2020-01-10 19:15:58 +00:00
copy_from_user(strings.data(), list.strings, list.length * sizeof(Syscall::StringArgument));
Kernel: Enable SMAP protection during the execve() syscall The userspace execve() wrapper now measures all the strings and puts them in a neat and tidy structure on the stack. This way we know exactly how much to copy in the kernel, and we don't have to use the SMAP-violating validate_read_str(). :^)
2020-01-10 11:20:36 +00:00
for (size_t i = 0; i < list.length; ++i) {
Kernel: Allow empty strings in validate_and_copy_string_from_user() Sergey pointed out that we should just allow empty strings everywhere.
2020-01-25 13:14:11 +00:00
auto string = validate_and_copy_string_from_user(strings[i]);
if (string.is_null())
Kernel: Enable SMAP protection during the execve() syscall The userspace execve() wrapper now measures all the strings and puts them in a neat and tidy structure on the stack. This way we know exactly how much to copy in the kernel, and we don't have to use the SMAP-violating validate_read_str(). :^)
2020-01-10 11:20:36 +00:00
return false;
Kernel: Allow empty strings in validate_and_copy_string_from_user() Sergey pointed out that we should just allow empty strings everywhere.
2020-01-25 13:14:11 +00:00
output.append(move(string));
Factor out the "non-syscall" parts of sys$execve() into exec(). ..to prepare for sharing code with createUserProcess().
2018-11-03 09:20:23 +00:00
}
Kernel: Enable SMAP protection during the execve() syscall The userspace execve() wrapper now measures all the strings and puts them in a neat and tidy structure on the stack. This way we know exactly how much to copy in the kernel, and we don't have to use the SMAP-violating validate_read_str(). :^)
2020-01-10 11:20:36 +00:00
return true;
};
Factor out the "non-syscall" parts of sys$execve() into exec(). ..to prepare for sharing code with createUserProcess().
2018-11-03 09:20:23 +00:00
Vector<String> arguments;
Kernel: Enable SMAP protection during the execve() syscall The userspace execve() wrapper now measures all the strings and puts them in a neat and tidy structure on the stack. This way we know exactly how much to copy in the kernel, and we don't have to use the SMAP-violating validate_read_str(). :^)
2020-01-10 11:20:36 +00:00
if (!copy_user_strings(params.arguments, arguments))
return -EFAULT;
Kernel: Fix String leaks in exec(). When the kernel performs a successful exec(), whatever was on the kernel stack for that process before goes away. For this reason, we need to make sure we don't have any stack objects holding onto kmalloc memory.
2019-02-17 09:18:25 +00:00
Vector<String> environment;
Kernel: Enable SMAP protection during the execve() syscall The userspace execve() wrapper now measures all the strings and puts them in a neat and tidy structure on the stack. This way we know exactly how much to copy in the kernel, and we don't have to use the SMAP-violating validate_read_str(). :^)
2020-01-10 11:20:36 +00:00
if (!copy_user_strings(params.environment, environment))
return -EFAULT;
Factor out the "non-syscall" parts of sys$execve() into exec(). ..to prepare for sharing code with createUserProcess().
2018-11-03 09:20:23 +00:00
Kernel: Fix String leaks in exec(). When the kernel performs a successful exec(), whatever was on the kernel stack for that process before goes away. For this reason, we need to make sure we don't have any stack objects holding onto kmalloc memory.
2019-02-17 09:18:25 +00:00
int rc = exec(move(path), move(arguments), move(environment));
Finally unbreak the colonel process and make it the true idle process.
2018-11-07 22:13:38 +00:00
ASSERT(rc < 0); // We should never continue after a successful exec!
Share code between spawn() and exec() implementations. Okay, now there's only one ELF loading client in the process launch code.
2018-11-03 09:49:13 +00:00
return rc;
Factor out the "non-syscall" parts of sys$execve() into exec(). ..to prepare for sharing code with createUserProcess().
2018-11-03 09:20:23 +00:00
}
Kernel: Get rid of "main thread" concept The idea of all processes reliably having a main thread was nice in some ways, but cumbersome in others. More importantly, it didn't match up with POSIX thread semantics, so let's move away from it. This thread gets rid of Process::main_thread() and you now we just have a bunch of Thread objects floating around each Process. When the finalizer nukes the last Thread in a Process, it will also tear down the Process. There's a bunch of more things to fix around this, but this is where we get started :^)
2019-12-22 10:35:02 +00:00
Process* Process::create_user_process(Thread*& first_thread, const String& path, uid_t uid, gid_t gid, pid_t parent_pid, int& error, Vector<String>&& arguments, Vector<String>&& environment, TTY* tty)
Launching an arbitrary ELF executable from disk works! :^) This is so cool! It's a bit messy now with two Task constructors, but eventually they should fold into a single constructor somehow.
2018-10-22 13:42:39 +00:00
{
auto parts = path.split('/');
Yet another pass of style fixes.
2018-12-21 01:10:45 +00:00
if (arguments.is_empty()) {
Share code between spawn() and exec() implementations. Okay, now there's only one ELF loading client in the process launch code.
2018-11-03 09:49:13 +00:00
arguments.append(parts.last());
Implement errno in LibC. This also meant I had to implement BSS (SHT_NOBITS) sections in ELFLoader. I also added an strerror() so we can print out what the errors are.
2018-10-25 10:06:00 +00:00
}
AK: Rename RetainPtr => RefPtr and Retained => NonnullRefPtr.
2019-06-21 16:37:47 +00:00
RefPtr<Custody> cwd;
Kernel: Add a basic chroot() syscall :^) The chroot() syscall now allows the superuser to isolate a process into a specific subtree of the filesystem. This is not strictly permanent, as it is also possible for a superuser to break *out* of a chroot, but it is a useful mechanism for isolating unprivileged processes. The VFS now uses the current process's root_directory() as the root for path resolution purposes. The root directory is stored as an uncached Custody in the Process object.
2020-01-10 22:14:04 +00:00
RefPtr<Custody> root;
Implement sys$chdir() and teach sh+ls to cd around and browse different dirs.
2018-10-26 12:24:11 +00:00
{
InterruptDisabler disabler;
Kernel: Add a basic chroot() syscall :^) The chroot() syscall now allows the superuser to isolate a process into a specific subtree of the filesystem. This is not strictly permanent, as it is also possible for a superuser to break *out* of a chroot, but it is a useful mechanism for isolating unprivileged processes. The VFS now uses the current process's root_directory() as the root for path resolution purposes. The root directory is stored as an uncached Custody in the Process object.
2020-01-10 22:14:04 +00:00
if (auto* parent = Process::from_pid(parent_pid)) {
Kernel: Remove use of copy_ref() in favor of regular RefPtr copies. This is obviously more readable. If we ever run into a situation where ref count churn is actually causing trouble in the future, we can deal with it then. For now, let's keep it simple. :^)
2019-07-11 13:38:47 +00:00
cwd = parent->m_cwd;
Kernel: Add a basic chroot() syscall :^) The chroot() syscall now allows the superuser to isolate a process into a specific subtree of the filesystem. This is not strictly permanent, as it is also possible for a superuser to break *out* of a chroot, but it is a useful mechanism for isolating unprivileged processes. The VFS now uses the current process's root_directory() as the root for path resolution purposes. The root directory is stored as an uncached Custody in the Process object.
2020-01-10 22:14:04 +00:00
root = parent->m_root_directory;
}
Add some basic field width support to printf(). Use it to make "ls" output a bit better. Also sys$spawn now fails with EACCES if the path is not a file that's executable by the current uid/gid.
2018-10-27 14:43:03 +00:00
}
Get rid of Vnode concept. We already have an abstraction between Process and Inode/CharacterDevice/FIFO and it's called FileDescriptor. :^)
2019-01-16 11:57:07 +00:00
Share code between spawn() and exec() implementations. Okay, now there's only one ELF loading client in the process launch code.
2018-11-03 09:49:13 +00:00
if (!cwd)
FileSystem: Port most of the code over to using custodies. The current working directory is now stored as a custody. Likewise for a process executable file. This unbreaks /proc/PID/fd which has not been working since we made the filesystem bigger. This still needs a bunch of work, for instance when renaming or removing a file somewhere, we have to update the relevant custody links.
2019-05-30 16:58:59 +00:00
cwd = VFS::the().root_custody();
Add some basic field width support to printf(). Use it to make "ls" output a bit better. Also sys$spawn now fails with EACCES if the path is not a file that's executable by the current uid/gid.
2018-10-27 14:43:03 +00:00
Kernel: Add a basic chroot() syscall :^) The chroot() syscall now allows the superuser to isolate a process into a specific subtree of the filesystem. This is not strictly permanent, as it is also possible for a superuser to break *out* of a chroot, but it is a useful mechanism for isolating unprivileged processes. The VFS now uses the current process's root_directory() as the root for path resolution purposes. The root directory is stored as an uncached Custody in the Process object.
2020-01-10 22:14:04 +00:00
if (!root)
root = VFS::the().root_custody();
Kernel: Get rid of "main thread" concept The idea of all processes reliably having a main thread was nice in some ways, but cumbersome in others. More importantly, it didn't match up with POSIX thread semantics, so let's move away from it. This thread gets rid of Process::main_thread() and you now we just have a bunch of Thread objects floating around each Process. When the finalizer nukes the last Thread in a Process, it will also tear down the Process. There's a bunch of more things to fix around this, but this is where we get started :^)
2019-12-22 10:35:02 +00:00
auto* process = new Process(first_thread, parts.take_last(), uid, gid, parent_pid, Ring3, move(cwd), nullptr, tty);
Kernel: Simplify Process constructor Move all the fork-specific inheritance logic to sys$fork(), and all the stuff for setting up stdio for non-fork ring 3 processes moves to Process::create_user_process(). Also: we were setting up the PGID, SID and umask twice. Also the code for copying the open file descriptors was overly complicated. Now it's just a simple Vector copy assignment. :^)
2020-01-25 12:50:54 +00:00
process->m_fds.resize(m_max_open_file_descriptors);
auto& device_to_use_as_tty = tty ? (CharacterDevice&)*tty : NullDevice::the();
Kernel: Only open a single description for stdio in non-fork processes
2020-01-25 16:05:02 +00:00
auto description = device_to_use_as_tty.open(O_RDWR).value();
process->m_fds[0].set(*description);
process->m_fds[1].set(*description);
process->m_fds[2].set(*description);
Implement argc/argv support for spawned tasks. Celebrate the new functionality with a simple /bin/cat implementation. :^)
2018-10-26 09:16:56 +00:00
Share code between spawn() and exec() implementations. Okay, now there's only one ELF loading client in the process launch code.
2018-11-03 09:49:13 +00:00
error = process->exec(path, move(arguments), move(environment));
Process::create_user_process() shouldn't leak a process if exec() fails.
2018-12-26 20:04:27 +00:00
if (error != 0) {
delete process;
Launching an arbitrary ELF executable from disk works! :^) This is so cool! It's a bit messy now with two Task constructors, but eventually they should fold into a single constructor somehow.
2018-10-22 13:42:39 +00:00
return nullptr;
Process::create_user_process() shouldn't leak a process if exec() fails.
2018-12-26 20:04:27 +00:00
}
More work on per-process page directories. It basically works now! I spent some time stuck on a problem where processes would clobber each other's stacks. Took me a moment to figure out that their stacks were allocated in the sub-4MB linear address range which is shared between all processes. Oops!
2018-11-01 10:30:48 +00:00
Fix some paging related bugs exposed by the spawn stress test. - Process::exec() needs to restore the original paging scope when called on a non-current process. - Add missing InterruptDisabler guards around g_processes access. - Only flush the TLB when modifying the active page tables.
2018-11-09 00:25:31 +00:00
{
InterruptDisabler disabler;
g_processes->prepend(process);
}
Add a simplified waitpid() so that sh can wait on spawned commands.
2018-10-23 22:20:34 +00:00
#ifdef TASK_DEBUG
Kernel: Get rid of "main thread" concept The idea of all processes reliably having a main thread was nice in some ways, but cumbersome in others. More importantly, it didn't match up with POSIX thread semantics, so let's move away from it. This thread gets rid of Process::main_thread() and you now we just have a bunch of Thread objects floating around each Process. When the finalizer nukes the last Thread in a Process, it will also tear down the Process. There's a bunch of more things to fix around this, but this is where we get started :^)
2019-12-22 10:35:02 +00:00
kprintf("Process %u (%s) spawned @ %p\n", process->pid(), process->name().characters(), first_thread->tss().eip);
Add a simplified waitpid() so that sh can wait on spawned commands.
2018-10-23 22:20:34 +00:00
#endif
Implement errno in LibC. This also meant I had to implement BSS (SHT_NOBITS) sections in ELFLoader. I also added an strerror() so we can print out what the errors are.
2018-10-25 10:06:00 +00:00
error = 0;
Share code between spawn() and exec() implementations. Okay, now there's only one ELF loading client in the process launch code.
2018-11-03 09:49:13 +00:00
return process;
Launching an arbitrary ELF executable from disk works! :^) This is so cool! It's a bit messy now with two Task constructors, but eventually they should fold into a single constructor somehow.
2018-10-22 13:42:39 +00:00
}
Kernel: Get rid of "main thread" concept The idea of all processes reliably having a main thread was nice in some ways, but cumbersome in others. More importantly, it didn't match up with POSIX thread semantics, so let's move away from it. This thread gets rid of Process::main_thread() and you now we just have a bunch of Thread objects floating around each Process. When the finalizer nukes the last Thread in a Process, it will also tear down the Process. There's a bunch of more things to fix around this, but this is where we get started :^)
2019-12-22 10:35:02 +00:00
Process* Process::create_kernel_process(Thread*& first_thread, String&& name, void (*e)())
Unify the Task constructors. There's now Task::create() and Task::createKernelTask().
2018-10-25 09:15:17 +00:00
{
Kernel: Get rid of "main thread" concept The idea of all processes reliably having a main thread was nice in some ways, but cumbersome in others. More importantly, it didn't match up with POSIX thread semantics, so let's move away from it. This thread gets rid of Process::main_thread() and you now we just have a bunch of Thread objects floating around each Process. When the finalizer nukes the last Thread in a Process, it will also tear down the Process. There's a bunch of more things to fix around this, but this is where we get started :^)
2019-12-22 10:35:02 +00:00
auto* process = new Process(first_thread, move(name), (uid_t)0, (gid_t)0, (pid_t)0, Ring0);
Use uintptr_t instead of u32 when storing pointers as integers uintptr_t is 32-bit or 64-bit depending on the target platform. This will help us write pointer size agnostic code so that when the day comes that we want to do a 64-bit port, we'll be in better shape.
2020-01-20 12:06:14 +00:00
first_thread->tss().eip = (uintptr_t)e;
Unify the Task constructors. There's now Task::create() and Task::createKernelTask().
2018-10-25 09:15:17 +00:00
Process now maps regions immediately when they are allocated. This avoids having to do a separate MM.mapRegionsForTask() pass. Also, more Task => Process renaming that I apparently hadn't saved yet.
2018-11-01 12:15:46 +00:00
if (process->pid() != 0) {
Kernel: Introduce threads, and refactor everything in support of it. The scheduler now operates on threads, rather than on processes. Each process has a main thread, and can have any number of additional threads. The process exits when the main thread exits. This patch doesn't actually spawn any additional threads, it merely does all the plumbing needed to make it possible. :^)
2019-03-23 21:03:17 +00:00
InterruptDisabler disabler;
g_processes->prepend(process);
Unify the Task constructors. There's now Task::create() and Task::createKernelTask().
2018-10-25 09:15:17 +00:00
#ifdef TASK_DEBUG
Kernel: Get rid of "main thread" concept The idea of all processes reliably having a main thread was nice in some ways, but cumbersome in others. More importantly, it didn't match up with POSIX thread semantics, so let's move away from it. This thread gets rid of Process::main_thread() and you now we just have a bunch of Thread objects floating around each Process. When the finalizer nukes the last Thread in a Process, it will also tear down the Process. There's a bunch of more things to fix around this, but this is where we get started :^)
2019-12-22 10:35:02 +00:00
kprintf("Kernel process %u (%s) spawned @ %p\n", process->pid(), process->name().characters(), first_thread->tss().eip);
Unify the Task constructors. There's now Task::create() and Task::createKernelTask().
2018-10-25 09:15:17 +00:00
#endif
}
Kernel: Get rid of "main thread" concept The idea of all processes reliably having a main thread was nice in some ways, but cumbersome in others. More importantly, it didn't match up with POSIX thread semantics, so let's move away from it. This thread gets rid of Process::main_thread() and you now we just have a bunch of Thread objects floating around each Process. When the finalizer nukes the last Thread in a Process, it will also tear down the Process. There's a bunch of more things to fix around this, but this is where we get started :^)
2019-12-22 10:35:02 +00:00
first_thread->set_state(Thread::State::Runnable);
Process now maps regions immediately when they are allocated. This avoids having to do a separate MM.mapRegionsForTask() pass. Also, more Task => Process renaming that I apparently hadn't saved yet.
2018-11-01 12:15:46 +00:00
return process;
Unify the Task constructors. There's now Task::create() and Task::createKernelTask().
2018-10-25 09:15:17 +00:00
}
Kernel: Get rid of "main thread" concept The idea of all processes reliably having a main thread was nice in some ways, but cumbersome in others. More importantly, it didn't match up with POSIX thread semantics, so let's move away from it. This thread gets rid of Process::main_thread() and you now we just have a bunch of Thread objects floating around each Process. When the finalizer nukes the last Thread in a Process, it will also tear down the Process. There's a bunch of more things to fix around this, but this is where we get started :^)
2019-12-22 10:35:02 +00:00
Process::Process(Thread*& first_thread, const String& name, uid_t uid, gid_t gid, pid_t ppid, RingLevel ring, RefPtr<Custody> cwd, RefPtr<Custody> executable, TTY* tty, Process* fork_parent)
Launching an arbitrary ELF executable from disk works! :^) This is so cool! It's a bit messy now with two Task constructors, but eventually they should fold into a single constructor somehow.
2018-10-22 13:42:39 +00:00
: m_name(move(name))
Kernel: Make TID's be unique PID's This is a little strange, but it's how I understand things should work. The first thread in a new process now has TID == PID. Additional threads subsequently spawned in that process all have unique TID's generated by the PID allocator. TIDs are now globally unique.
2019-12-22 10:51:24 +00:00
, m_pid(allocate_pid())
Launching an arbitrary ELF executable from disk works! :^) This is so cool! It's a bit messy now with two Task constructors, but eventually they should fold into a single constructor somehow.
2018-10-22 13:42:39 +00:00
, m_uid(uid)
, m_gid(gid)
Add geteuid() and getegid(). There's no support for set-uid or set-gid executables yet so these don't actually do anything. It's just nice to get the boilerplate stuff in.
2018-11-05 14:04:19 +00:00
, m_euid(uid)
, m_egid(gid)
Unify the Task constructors. There's now Task::create() and Task::createKernelTask().
2018-10-25 09:15:17 +00:00
, m_ring(ring)
Kernel: Rename Process::cwd_custody() to Process::current_directory(). ...and executable_custody() to just executable().
2019-05-30 18:23:50 +00:00
, m_executable(move(executable))
, m_cwd(move(cwd))
Start working on virtual consoles/TTYs. This is a mess right now, but I'd rather commit as I go.
2018-10-30 12:59:29 +00:00
, m_tty(tty)
Add getppid().
2018-11-06 12:33:06 +00:00
, m_ppid(ppid)
Launching an arbitrary ELF executable from disk works! :^) This is so cool! It's a bit messy now with two Task constructors, but eventually they should fold into a single constructor somehow.
2018-10-22 13:42:39 +00:00
{
Kernel: Finalizer should not go back to sleep if there's more to do Before putting itself back on the wait queue, the finalizer task will now check if there's more work to do, and if so, do it first. :^) This patch also puts a bunch of process/thread debug logging behind PROCESS_DEBUG and THREAD_DEBUG since it was unbearable to debug this stuff with all the spam.
2020-02-01 09:27:25 +00:00
#ifdef PROCESS_DEBUG
Kernel: Tidy up debug logging a little bit When using dbg() in the kernel, the output is automatically prefixed with [Process(PID:TID)]. This makes it a lot easier to understand which thread is generating the output. This patch also cleans up some common logging messages and removes the now-unnecessary "dbg() << *current << ..." pattern.
2020-01-21 15:14:39 +00:00
dbg() << "Created new process " << m_name << "(" << m_pid << ")";
Kernel: Finalizer should not go back to sleep if there's more to do Before putting itself back on the wait queue, the finalizer task will now check if there's more work to do, and if so, do it first. :^) This patch also puts a bunch of process/thread debug logging behind PROCESS_DEBUG and THREAD_DEBUG since it was unbearable to debug this stuff with all the spam.
2020-02-01 09:27:25 +00:00
#endif
Kernel: Introduce threads, and refactor everything in support of it. The scheduler now operates on threads, rather than on processes. Each process has a main thread, and can have any number of additional threads. The process exits when the main thread exits. This patch doesn't actually spawn any additional threads, it merely does all the plumbing needed to make it possible. :^)
2019-03-23 21:03:17 +00:00
Kernel: Add mapping from page directory base (PDB) to PageDirectory This allows the page fault code to find the owning PageDirectory and corresponding process for faulting regions. The mapping is implemented as a global hash map right now, which is definitely not optimal. We can come up with something better when it becomes necessary.
2019-08-06 09:19:16 +00:00
m_page_directory = PageDirectory::create_for_userspace(*this, fork_parent ? &fork_parent->page_directory().range_allocator() : nullptr);
Kernel: Introduce threads, and refactor everything in support of it. The scheduler now operates on threads, rather than on processes. Each process has a main thread, and can have any number of additional threads. The process exits when the main thread exits. This patch doesn't actually spawn any additional threads, it merely does all the plumbing needed to make it possible. :^)
2019-03-23 21:03:17 +00:00
#ifdef MM_DEBUG
dbgprintf("Process %u ctor: PD=%x created\n", pid(), m_page_directory.ptr());
#endif
Kernel: Ignore SIGCHLD by default. Also use an enum for the rather-confusing return value in dispatch_signal(). I will go through the rest of the signals and set them up with the appropriate default dispositions at some other point.
2019-02-04 13:06:38 +00:00
Implement fork()! This is quite cool! The syscall entry point plumbs the register dump down to sys$fork(), which uses it to set up the child process's TSS in order to resume execution right after the int 0x80 fork() call. :^) This works pretty well, although there is some problem with the kernel alias mappings used to clone the parent process's regions. If I disable the MM::release_page_directory() code, there's no problem. Probably there's a premature freeing of a physical page somehow.
2018-11-02 19:41:58 +00:00
if (fork_parent) {
Kernel: Simplify Process constructor Move all the fork-specific inheritance logic to sys$fork(), and all the stuff for setting up stdio for non-fork ring 3 processes moves to Process::create_user_process(). Also: we were setting up the PGID, SID and umask twice. Also the code for copying the open file descriptors was overly complicated. Now it's just a simple Vector copy assignment. :^)
2020-01-25 12:50:54 +00:00
// NOTE: fork() doesn't clone all threads; the thread that called fork() becomes the only thread in the new process.
first_thread = current->clone(*this);
Implement fork()! This is quite cool! The syscall entry point plumbs the register dump down to sys$fork(), which uses it to set up the child process's TSS in order to resume execution right after the int 0x80 fork() call. :^) This works pretty well, although there is some problem with the kernel alias mappings used to clone the parent process's regions. If I disable the MM::release_page_directory() code, there's no problem. Probably there's a premature freeing of a physical page somehow.
2018-11-02 19:41:58 +00:00
} else {
Kernel: Simplify Process constructor Move all the fork-specific inheritance logic to sys$fork(), and all the stuff for setting up stdio for non-fork ring 3 processes moves to Process::create_user_process(). Also: we were setting up the PGID, SID and umask twice. Also the code for copying the open file descriptors was overly complicated. Now it's just a simple Vector copy assignment. :^)
2020-01-25 12:50:54 +00:00
// NOTE: This non-forked code path is only taken when the kernel creates a process "manually" (at boot.)
first_thread = new Thread(*this);
Kernel: Respect the process umask in open() and mkdir().
2019-02-22 01:39:13 +00:00
}
Import the "gerbert" kernel I worked on earlier this year. It's a lot crappier than I remembered it. It's gonna need a lot of work.
2018-10-16 09:01:38 +00:00
}
Process now maps regions immediately when they are allocated. This avoids having to do a separate MM.mapRegionsForTask() pass. Also, more Task => Process renaming that I apparently hadn't saved yet.
2018-11-01 12:15:46 +00:00
Process::~Process()
Import the "gerbert" kernel I worked on earlier this year. It's a lot crappier than I remembered it. It's gonna need a lot of work.
2018-10-16 09:01:38 +00:00
{
Kernel: Get rid of "main thread" concept The idea of all processes reliably having a main thread was nice in some ways, but cumbersome in others. More importantly, it didn't match up with POSIX thread semantics, so let's move away from it. This thread gets rid of Process::main_thread() and you now we just have a bunch of Thread objects floating around each Process. When the finalizer nukes the last Thread in a Process, it will also tear down the Process. There's a bunch of more things to fix around this, but this is where we get started :^)
2019-12-22 10:35:02 +00:00
ASSERT(thread_count() == 0);
Add Regions concept to Task.
2018-10-18 12:53:00 +00:00
}
Big, possibly complete sweep of naming changes.
2019-01-31 16:31:23 +00:00
void Process::dump_regions()
Add Regions concept to Task.
2018-10-18 12:53:00 +00:00
{
Process now maps regions immediately when they are allocated. This avoids having to do a separate MM.mapRegionsForTask() pass. Also, more Task => Process renaming that I apparently hadn't saved yet.
2018-11-01 12:15:46 +00:00
kprintf("Process %s(%u) regions:\n", name().characters(), pid());
Kernel: Show region access bits (R/W/X) in crash dump region lists It's pretty helpful to be able to see the various access bits for each region in a crash dump. :^)
2019-08-12 17:37:28 +00:00
kprintf("BEGIN END SIZE ACCESS NAME\n");
Add Regions concept to Task.
2018-10-18 12:53:00 +00:00
for (auto& region : m_regions) {
Kernel: Start implementing purgeable memory support It's now possible to get purgeable memory by using mmap(MAP_PURGEABLE). Purgeable memory has a "volatile" flag that can be set using madvise(): - madvise(..., MADV_SET_VOLATILE) - madvise(..., MADV_SET_NONVOLATILE) When in the "volatile" state, the kernel may take away the underlying physical memory pages at any time, without notifying the owner. This gives you a guilt discount when caching very large things. :^) Setting a purgeable region to non-volatile will return whether or not the memory has been taken away by the kernel while being volatile. Basically, if madvise(..., MADV_SET_NONVOLATILE) returns 1, that means the memory was purged while volatile, and whatever was in that piece of memory needs to be reconstructed before use.
2019-12-09 18:12:38 +00:00
kprintf("%08x -- %08x %08x %c%c%c%c%c%c %s\n",
Kernel: Use NonnullRefPtrVector in parts of the kernel.
2019-06-27 11:34:28 +00:00
region.vaddr().get(),
region.vaddr().offset(region.size() - 1).get(),
region.size(),
Kernel: Show region access bits (R/W/X) in crash dump region lists It's pretty helpful to be able to see the various access bits for each region in a crash dump. :^)
2019-08-12 17:37:28 +00:00
region.is_readable() ? 'R' : ' ',
region.is_writable() ? 'W' : ' ',
region.is_executable() ? 'X' : ' ',
Kernel: Implement some basic stack pointer validation VM regions can now be marked as stack regions, which is then validated on syscall, and on page fault. If a thread is caught with its stack pointer pointing into anything that's *not* a Region with its stack bit set, we'll crash the whole process with SIGSTKFLT. Userspace must now allocate custom stacks by using mmap() with the new MAP_STACK flag. This mechanism was first introduced in OpenBSD, and now we have it too, yay! :^)
2019-11-17 11:11:43 +00:00
region.is_shared() ? 'S' : ' ',
region.is_stack() ? 'T' : ' ',
Kernel: Start implementing purgeable memory support It's now possible to get purgeable memory by using mmap(MAP_PURGEABLE). Purgeable memory has a "volatile" flag that can be set using madvise(): - madvise(..., MADV_SET_VOLATILE) - madvise(..., MADV_SET_NONVOLATILE) When in the "volatile" state, the kernel may take away the underlying physical memory pages at any time, without notifying the owner. This gives you a guilt discount when caching very large things. :^) Setting a purgeable region to non-volatile will return whether or not the memory has been taken away by the kernel while being volatile. Basically, if madvise(..., MADV_SET_NONVOLATILE) returns 1, that means the memory was purged while volatile, and whatever was in that piece of memory needs to be reconstructed before use.
2019-12-09 18:12:38 +00:00
region.vmobject().is_purgeable() ? 'P' : ' ',
Kernel: Use NonnullRefPtrVector in parts of the kernel.
2019-06-27 11:34:28 +00:00
region.name().characters());
Add Regions concept to Task.
2018-10-18 12:53:00 +00:00
}
Kernel: Always dump kernel regions when dumping process regions
2020-01-18 07:34:28 +00:00
MM.dump_kernel_regions();
Import the "gerbert" kernel I worked on earlier this year. It's a lot crappier than I remembered it. It's gonna need a lot of work.
2018-10-16 09:01:38 +00:00
}
Process now maps regions immediately when they are allocated. This avoids having to do a separate MM.mapRegionsForTask() pass. Also, more Task => Process renaming that I apparently hadn't saved yet.
2018-11-01 12:15:46 +00:00
void Process::sys$exit(int status)
Add a sys$exit and make init_stage2 call it when finished.
2018-10-22 09:43:55 +00:00
{
cli();
Add a simplified waitpid() so that sh can wait on spawned commands.
2018-10-23 22:20:34 +00:00
#ifdef TASK_DEBUG
Add a sys$exit and make init_stage2 call it when finished.
2018-10-22 09:43:55 +00:00
kprintf("sys$exit: %s(%u) exit with status %d\n", name().characters(), pid(), status);
Add a simplified waitpid() so that sh can wait on spawned commands.
2018-10-23 22:20:34 +00:00
#endif
Add a sys$exit and make init_stage2 call it when finished.
2018-10-22 09:43:55 +00:00
Kernel: Don't dump backtrace on successful exits This was getting really annoying.
2020-01-12 15:27:24 +00:00
if (status != 0)
dump_backtrace();
Kernel: Dump backtrace on exit() syscall. This makes assertion failures a lot more pleasant to investigate.
2019-05-06 19:48:48 +00:00
Rework process states to make a bit more sense. Processes are either alive (with many substates), dead or forgiven. A dead process is forgiven when the parent waitpid()s on it. Dead orphans are also forgiven. There's a lot of work to be done around this.
2018-11-07 17:30:59 +00:00
m_termination_status = status;
m_termination_signal = 0;
Kernel: Add a Finalizer process to take care of dying processes. Instead of processes themselves getting scheduled to finish dying, let's have a Finalizer process that wakes up whenever someone is dying. This way we can do all kinds of lock-taking in process cleanup without risking reentering the scheduler.
2019-02-06 17:45:21 +00:00
die();
Kernel: Unwind kernel stacks before dying While executing in the kernel, a thread can acquire various resources that need cleanup, such as locks and references to RefCounted objects. This cleanup normally happens on the exit path, such as in destructors for various RAII guards. But we weren't calling those exit paths when killing threads that have been executing in the kernel, such as threads blocked on reading or sleeping, thus causing leaks. This commit changes how killing threads works. Now, instead of killing a thread directly, one is supposed to call thread->set_should_die(), which will unblock it and make it unwind the stack if it is blocked in the kernel. Then, just before returning to the userspace, the thread will automatically die.
2019-11-14 15:46:01 +00:00
current->die_if_needed();
Move the scheduler code to its own class. This is very mechanical.
2018-11-07 21:15:02 +00:00
ASSERT_NOT_REACHED();
Add a sys$exit and make init_stage2 call it when finished.
2018-10-22 09:43:55 +00:00
}
Kernel: Stop hardcoding syscall in signal trampoline. We now no longer hardcode the sigreturn syscall in the signal trampoline. Because of the way inline asm inputs work, I've had to enclose the trampoline in the function signal_trampoline_dummy.
2019-09-17 13:41:42 +00:00
void signal_trampoline_dummy(void)
{
// The trampoline preserves the current eax, pushes the signal code and
// then calls the signal handler. We do this because, when interrupting a
// blocking syscall, that syscall may return some special error code in eax;
// This error code would likely be overwritten by the signal handler, so it's
// neccessary to preserve it here.
asm(
".intel_syntax noprefix\n"
"asm_signal_trampoline:\n"
"push ebp\n"
"mov ebp, esp\n"
"push eax\n" // we have to store eax 'cause it might be the return value from a syscall
"sub esp, 4\n" // align the stack to 16 bytes
"mov eax, [ebp+12]\n" // push the signal code
"push eax\n"
"call [ebp+8]\n" // call the signal handler
"add esp, 8\n"
"mov eax, %P0\n"
"int 0x82\n" // sigreturn syscall
"asm_signal_trampoline_end:\n"
".att_syntax" ::"i"(Syscall::SC_sigreturn));
}
Kernel: Use user stack for signal handlers. This commit drastically changes how signals are handled. In the case that an unblocked thread is signaled it works much in the same way as previously. However, when a blocking syscall is interrupted, we set up the signal trampoline on the user stack, complete the blocking syscall, return down the kernel stack and then jump to the handler. This means that from the kernel stack's perspective, we only ever get one system call deep. The signal trampoline has also been changed in order to properly store the return value from system calls. This is necessary due to the new way we exit from signaled system calls.
2019-09-04 13:14:54 +00:00
extern "C" void asm_signal_trampoline(void);
extern "C" void asm_signal_trampoline_end(void);
Kernel: Share the "return to ring 0/3 from signal" trampolines globally. Generate a special page containing the "return from signal" trampoline code on startup and then route signalled threads to it. This avoids a page allocation in every process that ever receives a signal.
2019-07-19 15:01:16 +00:00
void create_signal_trampolines()
Kernel: More signal handling improvements. Finally fixed the weird flaky crashing when resizing Terminal windows. It was because we were dispatching a signal to "current" from the scheduler. Yet another thing I dislike about even having a "current" process while we're in the scheduler. Not sure yet how to fix this. Let the signal handler's kernel stack be a kmalloc() allocation for now. Once we can do allocation of consecutive physical pages in the supervisor memory region, we can use that for all types of kernel stacks.
2019-03-05 11:50:55 +00:00
{
Kernel: Share the "return to ring 0/3 from signal" trampolines globally. Generate a special page containing the "return from signal" trampoline code on startup and then route signalled threads to it. This avoids a page allocation in every process that ever receives a signal.
2019-07-19 15:01:16 +00:00
InterruptDisabler disabler;
// NOTE: We leak this region.
Kernel: Change Region allocation helpers We now can create a cacheable Region, so when map() is called, if a Region is cacheable then all the virtual memory space being allocated to it will be marked as not cache disabled. In addition to that, OS components can create a Region that will be mapped to a specific physical address by using the appropriate helper method.
2020-01-09 21:29:31 +00:00
auto* trampoline_region = MM.allocate_user_accessible_kernel_region(PAGE_SIZE, "Signal trampolines", Region::Access::Read | Region::Access::Write | Region::Access::Execute, false).leak_ptr();
Kernel: Share the "return to ring 0/3 from signal" trampolines globally. Generate a special page containing the "return from signal" trampoline code on startup and then route signalled threads to it. This avoids a page allocation in every process that ever receives a signal.
2019-07-19 15:01:16 +00:00
g_return_to_ring3_from_signal_trampoline = trampoline_region->vaddr();
Kernel: Use user stack for signal handlers. This commit drastically changes how signals are handled. In the case that an unblocked thread is signaled it works much in the same way as previously. However, when a blocking syscall is interrupted, we set up the signal trampoline on the user stack, complete the blocking syscall, return down the kernel stack and then jump to the handler. This means that from the kernel stack's perspective, we only ever get one system call deep. The signal trampoline has also been changed in order to properly store the return value from system calls. This is necessary due to the new way we exit from signaled system calls.
2019-09-04 13:14:54 +00:00
u8* trampoline = (u8*)asm_signal_trampoline;
u8* trampoline_end = (u8*)asm_signal_trampoline_end;
size_t trampoline_size = trampoline_end - trampoline;
Kernel: Assert that copy_to/from_user() are called with user addresses This will panic the kernel immediately if these functions are misused so we can catch it and fix the misuse. This patch fixes a couple of misuses: - create_signal_trampolines() writes to a user-accessible page above the 3GB address mark. We should really get rid of this page but that's a whole other thing. - CoW faults need to use copy_from_user rather than copy_to_user since it's the *source* pointer that points to user memory. - Inode faults need to use memcpy rather than copy_to_user since we're copying a kernel stack buffer into a quickmapped page. This should make the copy_to/from_user() functions slightly less useful for exploitation. Before this, they were essentially just glorified memcpy() with SMAP disabled. :^)
2020-01-19 08:14:14 +00:00
{
SmapDisabler disabler;
u8* code_ptr = (u8*)trampoline_region->vaddr().as_ptr();
memcpy(code_ptr, trampoline, trampoline_size);
}
Kernel: Share the "return to ring 0/3 from signal" trampolines globally. Generate a special page containing the "return from signal" trampoline code on startup and then route signalled threads to it. This avoids a page allocation in every process that ever receives a signal.
2019-07-19 15:01:16 +00:00
trampoline_region->set_writable(false);
Kernel: Teach Region how to remap itself Now remapping (i.e flushing kernel metadata to the CPU page tables) is done by simply calling Region::remap().
2019-11-03 19:59:54 +00:00
trampoline_region->remap();
Kernel: More signal handling improvements. Finally fixed the weird flaky crashing when resizing Terminal windows. It was because we were dispatching a signal to "current" from the scheduler. Yet another thing I dislike about even having a "current" process while we're in the scheduler. Not sure yet how to fix this. Let the signal handler's kernel stack be a kmalloc() allocation for now. Once we can do allocation of consecutive physical pages in the supervisor memory region, we can use that for all types of kernel stacks.
2019-03-05 11:50:55 +00:00
}
Kernel+LibC: Publish a "kernel info page" and use it for gettimeofday() This patch adds a single "kernel info page" that is mappable read-only by any process and contains the current time of day. This is then used to implement a version of gettimeofday() that doesn't have to make a syscall. To protect against race condition issues, the info page also has a serial number which is incremented whenever the kernel updates the contents of the page. Make sure to verify that the serial number is the same before and after reading the information you want from the page.
2019-12-15 20:29:26 +00:00
void create_kernel_info_page()
{
Kernel: Make kernel memory regions be non-executable by default From now on, you'll have to request executable memory specifically if you want some.
2019-12-25 21:41:34 +00:00
auto* info_page_region_for_userspace = MM.allocate_user_accessible_kernel_region(PAGE_SIZE, "Kernel info page", Region::Access::Read).leak_ptr();
auto* info_page_region_for_kernel = MM.allocate_kernel_region_with_vmobject(info_page_region_for_userspace->vmobject(), PAGE_SIZE, "Kernel info page", Region::Access::Read | Region::Access::Write).leak_ptr();
Kernel: Make sure the kernel info page is read-only for userspace To enforce this, we create two separate mappings of the same underlying physical page. A writable mapping for the kernel, and a read-only one for userspace (the one returned by sys$get_kernel_info_page.)
2019-12-15 21:21:28 +00:00
s_info_page_address_for_userspace = info_page_region_for_userspace->vaddr();
s_info_page_address_for_kernel = info_page_region_for_kernel->vaddr();
memset(s_info_page_address_for_kernel.as_ptr(), 0, PAGE_SIZE);
Kernel+LibC: Publish a "kernel info page" and use it for gettimeofday() This patch adds a single "kernel info page" that is mappable read-only by any process and contains the current time of day. This is then used to implement a version of gettimeofday() that doesn't have to make a syscall. To protect against race condition issues, the info page also has a serial number which is incremented whenever the kernel updates the contents of the page. Make sure to verify that the serial number is the same before and after reading the information you want from the page.
2019-12-15 20:29:26 +00:00
}
Kernel: Use user stack for signal handlers. This commit drastically changes how signals are handled. In the case that an unblocked thread is signaled it works much in the same way as previously. However, when a blocking syscall is interrupted, we set up the signal trampoline on the user stack, complete the blocking syscall, return down the kernel stack and then jump to the handler. This means that from the kernel stack's perspective, we only ever get one system call deep. The signal trampoline has also been changed in order to properly store the return value from system calls. This is necessary due to the new way we exit from signaled system calls.
2019-09-04 13:14:54 +00:00
int Process::sys$sigreturn(RegisterDump& registers)
Implement sending signals to blocked-in-kernel processes. This is dirty but pretty cool! If we have a pending, unmasked signal for a process that's blocked inside the kernel, we set up alternate stacks for that process and unblock it to execute the signal handler. A slightly different return trampoline is used here: since we need to get back into the kernel, a dedicated syscall is used (sys$sigreturn.) This restores the TSS contents of the process to the state it was in while we were originally blocking in the kernel. NOTE: There's currently only one "kernel resume TSS" so signal nesting definitely won't work.
2018-11-07 20:19:47 +00:00
{
Kernel: Add sigreturn() to "stdio" with all the other signal syscalls
2020-01-12 09:32:56 +00:00
REQUIRE_PROMISE(stdio);
Kernel: Start implementing x86 SMAP support Supervisor Mode Access Prevention (SMAP) is an x86 CPU feature that prevents the kernel from accessing userspace memory. With SMAP enabled, trying to read/write a userspace memory address while in the kernel will now generate a page fault. Since it's sometimes necessary to read/write userspace memory, there are two new instructions that quickly switch the protection on/off: STAC (disables protection) and CLAC (enables protection.) These are exposed in kernel code via the stac() and clac() helpers. There's also a SmapDisabler RAII object that can be used to ensure that you don't forget to re-enable protection before returning to userspace code. THis patch also adds copy_to_user(), copy_from_user() and memset_user() which are the "correct" way of doing things. These functions allow us to briefly disable protection for a specific purpose, and then turn it back on immediately after it's done. Going forward all kernel code should be moved to using these and all uses of SmapDisabler are to be considered FIXME's. Note that we're not realizing the full potential of this feature since I've used SmapDisabler quite liberally in this initial bring-up patch.
2020-01-05 17:00:15 +00:00
SmapDisabler disabler;
Kernel: Use user stack for signal handlers. This commit drastically changes how signals are handled. In the case that an unblocked thread is signaled it works much in the same way as previously. However, when a blocking syscall is interrupted, we set up the signal trampoline on the user stack, complete the blocking syscall, return down the kernel stack and then jump to the handler. This means that from the kernel stack's perspective, we only ever get one system call deep. The signal trampoline has also been changed in order to properly store the return value from system calls. This is necessary due to the new way we exit from signaled system calls.
2019-09-04 13:14:54 +00:00
//Here, we restore the state pushed by dispatch signal and asm_signal_trampoline.
Kernel: Rename {ss,esp}_if_crossRing to userspace_{ss,esp} These were always so awkwardly named.
2020-01-09 17:02:01 +00:00
u32* stack_ptr = (u32*)registers.userspace_esp;
Kernel: Use user stack for signal handlers. This commit drastically changes how signals are handled. In the case that an unblocked thread is signaled it works much in the same way as previously. However, when a blocking syscall is interrupted, we set up the signal trampoline on the user stack, complete the blocking syscall, return down the kernel stack and then jump to the handler. This means that from the kernel stack's perspective, we only ever get one system call deep. The signal trampoline has also been changed in order to properly store the return value from system calls. This is necessary due to the new way we exit from signaled system calls.
2019-09-04 13:14:54 +00:00
u32 smuggled_eax = *stack_ptr;
//pop the stored eax, ebp, return address, handler and signal code
stack_ptr += 5;
current->m_signal_mask = *stack_ptr;
stack_ptr++;
Kernel: Add exception_code to RegisterDump. Added the exception_code field to RegisterDump, removing the need for RegisterDumpWithExceptionCode. To accomplish this, I had to push a dummy exception code during some interrupt entries to properly pad out the RegisterDump. Note that we also needed to change some code in sys$sigreturn to deal with the new RegisterDump layout.
2019-10-04 14:31:34 +00:00
//pop edi, esi, ebp, esp, ebx, edx, ecx and eax
Use uintptr_t instead of u32 when storing pointers as integers uintptr_t is 32-bit or 64-bit depending on the target platform. This will help us write pointer size agnostic code so that when the day comes that we want to do a 64-bit port, we'll be in better shape.
2020-01-20 12:06:14 +00:00
memcpy(&registers.edi, stack_ptr, 8 * sizeof(uintptr_t));
Kernel: Add exception_code to RegisterDump. Added the exception_code field to RegisterDump, removing the need for RegisterDumpWithExceptionCode. To accomplish this, I had to push a dummy exception code during some interrupt entries to properly pad out the RegisterDump. Note that we also needed to change some code in sys$sigreturn to deal with the new RegisterDump layout.
2019-10-04 14:31:34 +00:00
stack_ptr += 8;
registers.eip = *stack_ptr;
stack_ptr++;
Kernel: Use user stack for signal handlers. This commit drastically changes how signals are handled. In the case that an unblocked thread is signaled it works much in the same way as previously. However, when a blocking syscall is interrupted, we set up the signal trampoline on the user stack, complete the blocking syscall, return down the kernel stack and then jump to the handler. This means that from the kernel stack's perspective, we only ever get one system call deep. The signal trampoline has also been changed in order to properly store the return value from system calls. This is necessary due to the new way we exit from signaled system calls.
2019-09-04 13:14:54 +00:00
registers.eflags = *stack_ptr;
stack_ptr++;
Kernel: Rename {ss,esp}_if_crossRing to userspace_{ss,esp} These were always so awkwardly named.
2020-01-09 17:02:01 +00:00
registers.userspace_esp = registers.esp;
Kernel: Use user stack for signal handlers. This commit drastically changes how signals are handled. In the case that an unblocked thread is signaled it works much in the same way as previously. However, when a blocking syscall is interrupted, we set up the signal trampoline on the user stack, complete the blocking syscall, return down the kernel stack and then jump to the handler. This means that from the kernel stack's perspective, we only ever get one system call deep. The signal trampoline has also been changed in order to properly store the return value from system calls. This is necessary due to the new way we exit from signaled system calls.
2019-09-04 13:14:54 +00:00
return smuggled_eax;
Add some basic signal support. It only works for sending a signal to a process that's in userspace code. We implement reception by synthesizing a PUSHA+PUSHF in the receiving process (operating on values in the TSS.) The TSS CS:EIP is then rerouted to the signal handler and a tiny return trampoline is constructed in a dedicated region in the receiving process. Also hacked up /bin/kill to be able to send arbitrary signals (kill -N PID)
2018-11-06 09:46:40 +00:00
}
AK: Rename the common integer typedefs to make it obvious what they are. These types can be picked up by including <AK/Types.h>: * u8, u16, u32, u64 (unsigned) * i8, i16, i32, i64 (signed)
2019-07-03 19:17:35 +00:00
void Process::crash(int signal, u32 eip)
Actually destroy tasks after they crash.
2018-10-17 22:26:30 +00:00
{
Add a few more InterruptDisablers.
2018-10-25 08:33:10 +00:00
ASSERT_INTERRUPTS_DISABLED();
Kernel: Introduce threads, and refactor everything in support of it. The scheduler now operates on threads, rather than on processes. Each process has a main thread, and can have any number of additional threads. The process exits when the main thread exits. This patch doesn't actually spawn any additional threads, it merely does all the plumbing needed to make it possible. :^)
2019-03-23 21:03:17 +00:00
ASSERT(!is_dead());
Kernel: Unwind kernel stacks before dying While executing in the kernel, a thread can acquire various resources that need cleanup, such as locks and references to RefCounted objects. This cleanup normally happens on the exit path, such as in destructors for various RAII guards. But we weren't calling those exit paths when killing threads that have been executing in the kernel, such as threads blocked on reading or sleeping, thus causing leaks. This commit changes how killing threads works. Now, instead of killing a thread directly, one is supposed to call thread->set_should_die(), which will unblock it and make it unwind the stack if it is blocked in the kernel. Then, just before returning to the userspace, the thread will automatically die.
2019-11-14 15:46:01 +00:00
ASSERT(&current->process() == this);
IPv4: More hacking on bringing up TCP support. This was a bit more complicated than I expected, but it's moving forward.
2019-03-13 22:14:30 +00:00
Kernel: Symbolicate kernel EIP on process crash Process::crash() was assuming that EIP was always inside the ELF binary of the program, but it could also be in the kernel.
2020-01-18 13:38:39 +00:00
if (eip >= 0xc0000000 && ksyms_ready) {
auto* ksym = ksymbolicate(eip);
dbgprintf("\033[31;1m%p %s +%d\033[0m\n", eip, ksym ? demangle(ksym->name).characters() : "(k?)", ksym ? eip - ksym->address : 0);
} else if (m_elf_loader) {
Kernel: Symbolicate the crash address too, not just the call stack. Also print it in shiny red to make it extra easy to spot. :^) Fixes #244.
2019-06-19 16:50:02 +00:00
dbgprintf("\033[31;1m%p %s\033[0m\n", eip, m_elf_loader->symbolicate(eip).characters());
Kernel: Symbolicate kernel EIP on process crash Process::crash() was assuming that EIP was always inside the ELF binary of the program, but it could also be in the kernel.
2020-01-18 13:38:39 +00:00
} else {
dbgprintf("\033[31;1m%p (?)\033[0m\n", eip);
}
Kernel: Always dump_backtrace() on process crash.
2019-05-16 17:49:48 +00:00
dump_backtrace();
Kernel: Send more specific signals when crashing due to CPU exceptions. - For division by zero, send SIGFPE. - For illegal instruction, send SIGILL. - For the rest, default to SIGSEGV.
2019-05-26 00:08:51 +00:00
m_termination_signal = signal;
Big, possibly complete sweep of naming changes.
2019-01-31 16:31:23 +00:00
dump_regions();
Process: Dump regions when a ring0 process crashes.
2019-02-08 08:45:53 +00:00
ASSERT(is_ring3());
Deallocate PTY's when they close. This required a fair bit of plumbing. The CharacterDevice::close() virtual will now be closed by ~FileDescriptor(), allowing device implementations to do custom cleanup at that point. One big problem remains: if the master PTY is closed before the slave PTY, we go into crashy land.
2019-01-30 17:26:19 +00:00
die();
Kernel: Unwind kernel stacks before dying While executing in the kernel, a thread can acquire various resources that need cleanup, such as locks and references to RefCounted objects. This cleanup normally happens on the exit path, such as in destructors for various RAII guards. But we weren't calling those exit paths when killing threads that have been executing in the kernel, such as threads blocked on reading or sleeping, thus causing leaks. This commit changes how killing threads works. Now, instead of killing a thread directly, one is supposed to call thread->set_should_die(), which will unblock it and make it unwind the stack if it is blocked in the kernel. Then, just before returning to the userspace, the thread will automatically die.
2019-11-14 15:46:01 +00:00
// We can not return from here, as there is nowhere
// to unwind to, so die right away.
current->die_if_needed();
Move the scheduler code to its own class. This is very mechanical.
2018-11-07 21:15:02 +00:00
ASSERT_NOT_REACHED();
Actually destroy tasks after they crash.
2018-10-17 22:26:30 +00:00
}
Some refactor and style tweaks.
2018-11-07 20:38:18 +00:00
Process* Process::from_pid(pid_t pid)
Import the "gerbert" kernel I worked on earlier this year. It's a lot crappier than I remembered it. It's gonna need a lot of work.
2018-10-16 09:01:38 +00:00
{
Add ASSERT_INTERRUPTS_DISABLED in Task::fromPID().
2018-10-26 13:11:29 +00:00
ASSERT_INTERRUPTS_DISABLED();
Kernel: Use some more InlineLinkedList range-for iteration
2019-08-08 12:40:13 +00:00
for (auto& process : *g_processes) {
if (process.pid() == pid)
return &process;
Import the "gerbert" kernel I worked on earlier this year. It's a lot crappier than I remembered it. It's gonna need a lot of work.
2018-10-16 09:01:38 +00:00
}
return nullptr;
}
Kernel: Make Process::file_description() vend a RefPtr<FileDescription> This encourages callers to strongly reference file descriptions while working with them. This fixes a use-after-free issue where one thread would close() an open fd while another thread was blocked on it becoming readable. Test: Kernel/uaf-close-while-blocked-in-read.cpp
2020-01-07 14:53:42 +00:00
RefPtr<FileDescription> Process::file_description(int fd) const
Rename FileHandle to FileDescriptor.
2018-11-07 10:37:54 +00:00
{
if (fd < 0)
return nullptr;
More moving towards using signed types. I'm still feeling this out, but I am starting to like the general idea.
2019-02-25 21:06:55 +00:00
if (fd < m_fds.size())
Kernel: Rename "descriptor" to "description" where appropriate. Now that FileDescription is called that, variables of that type should not be called "descriptor". This is kinda wordy but we'll get used to it.
2019-06-13 20:03:04 +00:00
return m_fds[fd].description.ptr();
Import the "gerbert" kernel I worked on earlier this year. It's a lot crappier than I remembered it. It's gonna need a lot of work.
2018-10-16 09:01:38 +00:00
return nullptr;
}
Kernel: Expose blocking and cloexec fd flags in ProcFS
2019-09-28 20:00:38 +00:00
int Process::fd_flags(int fd) const
{
if (fd < 0)
return -1;
if (fd < m_fds.size())
return m_fds[fd].flags;
return -1;
}
Kernel: Make syscalls that take a buffer size use ssize_t instead of size_t. Dealing with the unsigned overflow propagation here just seems unreasonably error prone. Let's limit ourselves to 2GB buffer sizes instead.
2019-02-25 20:19:57 +00:00
ssize_t Process::sys$get_dir_entries(int fd, void* buffer, ssize_t size)
Lots of hacking to make a very simple "ls" utility. I added a dead-simple malloc that only allows allocations < 4096 bytes. It just forwards the request to mmap() every time. I also added simplified versions of opendir() and readdir().
2018-10-24 10:43:52 +00:00
{
ping: Use pledge()
2020-01-11 19:48:43 +00:00
REQUIRE_PROMISE(stdio);
Kernel: Make syscalls that take a buffer size use ssize_t instead of size_t. Dealing with the unsigned overflow propagation here just seems unreasonably error prone. Let's limit ourselves to 2GB buffer sizes instead.
2019-02-25 20:19:57 +00:00
if (size < 0)
return -EINVAL;
Improve syscall address validation a bit.
2018-11-16 15:10:59 +00:00
if (!validate_write(buffer, size))
return -EFAULT;
Kernel: Make Process::file_description() vend a RefPtr<FileDescription> This encourages callers to strongly reference file descriptions while working with them. This fixes a use-after-free issue where one thread would close() an open fd while another thread was blocked on it becoming readable. Test: Kernel/uaf-close-while-blocked-in-read.cpp
2020-01-07 14:53:42 +00:00
auto description = file_description(fd);
Kernel: Rename "descriptor" to "description" where appropriate. Now that FileDescription is called that, variables of that type should not be called "descriptor". This is kinda wordy but we'll get used to it.
2019-06-13 20:03:04 +00:00
if (!description)
Add sys$ttyname_r and ttyname_r() + ttyname(). And print a greeting when sh starts up so we know which TTY we're on.
2018-10-30 21:03:02 +00:00
return -EBADF;
AK: Rename the common integer typedefs to make it obvious what they are. These types can be picked up by including <AK/Types.h>: * u8, u16, u32, u64 (unsigned) * i8, i16, i32, i64 (signed)
2019-07-03 19:17:35 +00:00
return description->get_dir_entries((u8*)buffer, size);
Lots of hacking to make a very simple "ls" utility. I added a dead-simple malloc that only allows allocations < 4096 bytes. It just forwards the request to mmap() every time. I also added simplified versions of opendir() and readdir().
2018-10-24 10:43:52 +00:00
}
Process now maps regions immediately when they are allocated. This avoids having to do a separate MM.mapRegionsForTask() pass. Also, more Task => Process renaming that I apparently hadn't saved yet.
2018-11-01 12:15:46 +00:00
int Process::sys$lseek(int fd, off_t offset, int whence)
Import the "gerbert" kernel I worked on earlier this year. It's a lot crappier than I remembered it. It's gonna need a lot of work.
2018-10-16 09:01:38 +00:00
{
ping: Use pledge()
2020-01-11 19:48:43 +00:00
REQUIRE_PROMISE(stdio);
Kernel: Make Process::file_description() vend a RefPtr<FileDescription> This encourages callers to strongly reference file descriptions while working with them. This fixes a use-after-free issue where one thread would close() an open fd while another thread was blocked on it becoming readable. Test: Kernel/uaf-close-while-blocked-in-read.cpp
2020-01-07 14:53:42 +00:00
auto description = file_description(fd);
Kernel: Rename "descriptor" to "description" where appropriate. Now that FileDescription is called that, variables of that type should not be called "descriptor". This is kinda wordy but we'll get used to it.
2019-06-13 20:03:04 +00:00
if (!description)
Enough compatibility work to make figlet build and run! I ran out of steam writing library routines and imported two BSD-licensed libc routines: sscanf() and getopt(). I will most likely rewrite them sooner or later. For now I just wanted to see figlet running.
2018-10-31 16:50:43 +00:00
return -EBADF;
Kernel: Rename "descriptor" to "description" where appropriate. Now that FileDescription is called that, variables of that type should not be called "descriptor". This is kinda wordy but we'll get used to it.
2019-06-13 20:03:04 +00:00
return description->seek(offset, whence);
Import the "gerbert" kernel I worked on earlier this year. It's a lot crappier than I remembered it. It's gonna need a lot of work.
2018-10-16 09:01:38 +00:00
}
Kernel: Make syscalls that take a buffer size use ssize_t instead of size_t. Dealing with the unsigned overflow propagation here just seems unreasonably error prone. Let's limit ourselves to 2GB buffer sizes instead.
2019-02-25 20:19:57 +00:00
int Process::sys$ttyname_r(int fd, char* buffer, ssize_t size)
Add sys$ttyname_r and ttyname_r() + ttyname(). And print a greeting when sh starts up so we know which TTY we're on.
2018-10-30 21:03:02 +00:00
{
ping: Use pledge()
2020-01-11 19:48:43 +00:00
REQUIRE_PROMISE(tty);
Kernel: Make syscalls that take a buffer size use ssize_t instead of size_t. Dealing with the unsigned overflow propagation here just seems unreasonably error prone. Let's limit ourselves to 2GB buffer sizes instead.
2019-02-25 20:19:57 +00:00
if (size < 0)
return -EINVAL;
Improve syscall address validation a bit.
2018-11-16 15:10:59 +00:00
if (!validate_write(buffer, size))
return -EFAULT;
Kernel: Make Process::file_description() vend a RefPtr<FileDescription> This encourages callers to strongly reference file descriptions while working with them. This fixes a use-after-free issue where one thread would close() an open fd while another thread was blocked on it becoming readable. Test: Kernel/uaf-close-while-blocked-in-read.cpp
2020-01-07 14:53:42 +00:00
auto description = file_description(fd);
Kernel: Rename "descriptor" to "description" where appropriate. Now that FileDescription is called that, variables of that type should not be called "descriptor". This is kinda wordy but we'll get used to it.
2019-06-13 20:03:04 +00:00
if (!description)
Add sys$ttyname_r and ttyname_r() + ttyname(). And print a greeting when sh starts up so we know which TTY we're on.
2018-10-30 21:03:02 +00:00
return -EBADF;
Kernel: Rename "descriptor" to "description" where appropriate. Now that FileDescription is called that, variables of that type should not be called "descriptor". This is kinda wordy but we'll get used to it.
2019-06-13 20:03:04 +00:00
if (!description->is_tty())
Add sys$ttyname_r and ttyname_r() + ttyname(). And print a greeting when sh starts up so we know which TTY we're on.
2018-10-30 21:03:02 +00:00
return -ENOTTY;
Kernel: Start implementing x86 SMAP support Supervisor Mode Access Prevention (SMAP) is an x86 CPU feature that prevents the kernel from accessing userspace memory. With SMAP enabled, trying to read/write a userspace memory address while in the kernel will now generate a page fault. Since it's sometimes necessary to read/write userspace memory, there are two new instructions that quickly switch the protection on/off: STAC (disables protection) and CLAC (enables protection.) These are exposed in kernel code via the stac() and clac() helpers. There's also a SmapDisabler RAII object that can be used to ensure that you don't forget to re-enable protection before returning to userspace code. THis patch also adds copy_to_user(), copy_from_user() and memset_user() which are the "correct" way of doing things. These functions allow us to briefly disable protection for a specific purpose, and then turn it back on immediately after it's done. Going forward all kernel code should be moved to using these and all uses of SmapDisabler are to be considered FIXME's. Note that we're not realizing the full potential of this feature since I've used SmapDisabler quite liberally in this initial bring-up patch.
2020-01-05 17:00:15 +00:00
String tty_name = description->tty()->tty_name();
AK: Use size_t for the length of strings Using int was a mistake. This patch changes String, StringImpl, StringView and StringBuilder to use size_t instead of int for lengths. Obviously a lot of code needs to change as a result of this.
2019-12-09 16:45:40 +00:00
if ((size_t)size < tty_name.length() + 1)
Add sys$ttyname_r and ttyname_r() + ttyname(). And print a greeting when sh starts up so we know which TTY we're on.
2018-10-30 21:03:02 +00:00
return -ERANGE;
Kernel: Start implementing x86 SMAP support Supervisor Mode Access Prevention (SMAP) is an x86 CPU feature that prevents the kernel from accessing userspace memory. With SMAP enabled, trying to read/write a userspace memory address while in the kernel will now generate a page fault. Since it's sometimes necessary to read/write userspace memory, there are two new instructions that quickly switch the protection on/off: STAC (disables protection) and CLAC (enables protection.) These are exposed in kernel code via the stac() and clac() helpers. There's also a SmapDisabler RAII object that can be used to ensure that you don't forget to re-enable protection before returning to userspace code. THis patch also adds copy_to_user(), copy_from_user() and memset_user() which are the "correct" way of doing things. These functions allow us to briefly disable protection for a specific purpose, and then turn it back on immediately after it's done. Going forward all kernel code should be moved to using these and all uses of SmapDisabler are to be considered FIXME's. Note that we're not realizing the full potential of this feature since I've used SmapDisabler quite liberally in this initial bring-up patch.
2020-01-05 17:00:15 +00:00
copy_to_user(buffer, tty_name.characters(), tty_name.length() + 1);
Add sys$ttyname_r and ttyname_r() + ttyname(). And print a greeting when sh starts up so we know which TTY we're on.
2018-10-30 21:03:02 +00:00
return 0;
}
Kernel: Make syscalls that take a buffer size use ssize_t instead of size_t. Dealing with the unsigned overflow propagation here just seems unreasonably error prone. Let's limit ourselves to 2GB buffer sizes instead.
2019-02-25 20:19:57 +00:00
int Process::sys$ptsname_r(int fd, char* buffer, ssize_t size)
Add basic PTY support. For now, there are four hard-coded PTYs: /dev/pt{m,s}[0123] Use this in the Terminal to open a pty pair and spawn a shell.
2019-01-15 05:30:19 +00:00
{
ping: Use pledge()
2020-01-11 19:48:43 +00:00
REQUIRE_PROMISE(tty);
Kernel: Make syscalls that take a buffer size use ssize_t instead of size_t. Dealing with the unsigned overflow propagation here just seems unreasonably error prone. Let's limit ourselves to 2GB buffer sizes instead.
2019-02-25 20:19:57 +00:00
if (size < 0)
return -EINVAL;
Add basic PTY support. For now, there are four hard-coded PTYs: /dev/pt{m,s}[0123] Use this in the Terminal to open a pty pair and spawn a shell.
2019-01-15 05:30:19 +00:00
if (!validate_write(buffer, size))
return -EFAULT;
Kernel: Make Process::file_description() vend a RefPtr<FileDescription> This encourages callers to strongly reference file descriptions while working with them. This fixes a use-after-free issue where one thread would close() an open fd while another thread was blocked on it becoming readable. Test: Kernel/uaf-close-while-blocked-in-read.cpp
2020-01-07 14:53:42 +00:00
auto description = file_description(fd);
Kernel: Rename "descriptor" to "description" where appropriate. Now that FileDescription is called that, variables of that type should not be called "descriptor". This is kinda wordy but we'll get used to it.
2019-06-13 20:03:04 +00:00
if (!description)
Add basic PTY support. For now, there are four hard-coded PTYs: /dev/pt{m,s}[0123] Use this in the Terminal to open a pty pair and spawn a shell.
2019-01-15 05:30:19 +00:00
return -EBADF;
Kernel: Rename "descriptor" to "description" where appropriate. Now that FileDescription is called that, variables of that type should not be called "descriptor". This is kinda wordy but we'll get used to it.
2019-06-13 20:03:04 +00:00
auto* master_pty = description->master_pty();
Add basic PTY support. For now, there are four hard-coded PTYs: /dev/pt{m,s}[0123] Use this in the Terminal to open a pty pair and spawn a shell.
2019-01-15 05:30:19 +00:00
if (!master_pty)
return -ENOTTY;
auto pts_name = master_pty->pts_name();
AK: Use size_t for the length of strings Using int was a mistake. This patch changes String, StringImpl, StringView and StringBuilder to use size_t instead of int for lengths. Obviously a lot of code needs to change as a result of this.
2019-12-09 16:45:40 +00:00
if ((size_t)size < pts_name.length() + 1)
Add basic PTY support. For now, there are four hard-coded PTYs: /dev/pt{m,s}[0123] Use this in the Terminal to open a pty pair and spawn a shell.
2019-01-15 05:30:19 +00:00
return -ERANGE;
Kernel: Start implementing x86 SMAP support Supervisor Mode Access Prevention (SMAP) is an x86 CPU feature that prevents the kernel from accessing userspace memory. With SMAP enabled, trying to read/write a userspace memory address while in the kernel will now generate a page fault. Since it's sometimes necessary to read/write userspace memory, there are two new instructions that quickly switch the protection on/off: STAC (disables protection) and CLAC (enables protection.) These are exposed in kernel code via the stac() and clac() helpers. There's also a SmapDisabler RAII object that can be used to ensure that you don't forget to re-enable protection before returning to userspace code. THis patch also adds copy_to_user(), copy_from_user() and memset_user() which are the "correct" way of doing things. These functions allow us to briefly disable protection for a specific purpose, and then turn it back on immediately after it's done. Going forward all kernel code should be moved to using these and all uses of SmapDisabler are to be considered FIXME's. Note that we're not realizing the full potential of this feature since I've used SmapDisabler quite liberally in this initial bring-up patch.
2020-01-05 17:00:15 +00:00
copy_to_user(buffer, pts_name.characters(), pts_name.length() + 1);
Add basic PTY support. For now, there are four hard-coded PTYs: /dev/pt{m,s}[0123] Use this in the Terminal to open a pty pair and spawn a shell.
2019-01-15 05:30:19 +00:00
return 0;
}
Kernel: Add a writev() syscall for writing multiple buffers in one go. We then use this immediately in the WindowServer/LibGUI communication in order to send both message + optional "extra data" with a single syscall.
2019-05-10 01:19:25 +00:00
ssize_t Process::sys$writev(int fd, const struct iovec* iov, int iov_count)
Virtual consoles kinda work! We now make three VirtualConsoles at boot: tty0, tty1, and tty2. We launch an instance of /bin/sh in each one. You switch between them with Alt+1/2/3 How very very cool :^)
2018-10-30 14:33:37 +00:00
{
ping: Use pledge()
2020-01-11 19:48:43 +00:00
REQUIRE_PROMISE(stdio);
Kernel: Add a writev() syscall for writing multiple buffers in one go. We then use this immediately in the WindowServer/LibGUI communication in order to send both message + optional "extra data" with a single syscall.
2019-05-10 01:19:25 +00:00
if (iov_count < 0)
Kernel: Make syscalls that take a buffer size use ssize_t instead of size_t. Dealing with the unsigned overflow propagation here just seems unreasonably error prone. Let's limit ourselves to 2GB buffer sizes instead.
2019-02-25 20:19:57 +00:00
return -EINVAL;
Kernel: Add a writev() syscall for writing multiple buffers in one go. We then use this immediately in the WindowServer/LibGUI communication in order to send both message + optional "extra data" with a single syscall.
2019-05-10 01:19:25 +00:00
if (!validate_read_typed(iov, iov_count))
Improve syscall address validation a bit.
2018-11-16 15:10:59 +00:00
return -EFAULT;
Kernel: Add a writev() syscall for writing multiple buffers in one go. We then use this immediately in the WindowServer/LibGUI communication in order to send both message + optional "extra data" with a single syscall.
2019-05-10 01:19:25 +00:00
Kernel: writev() should fail with EINVAL if total length > INT32_MAX
2020-01-02 12:01:41 +00:00
u64 total_length = 0;
Kernel: Add missing iovec base validation for writev() syscall We were forgetting to validate the base pointers of iovecs passed into the writev() syscall. Thanks to braindead for finding this bug! :^)
2020-01-05 09:16:19 +00:00
Vector<iovec, 32> vecs;
Kernel: Make writev() work again Vector::ensure_capacity() makes sure the underlying vector buffer can contain all the data, but it doesn't update the Vector::size(). As a result, writev() would simply collect all the buffers to write, and then do nothing.
2020-01-26 09:10:15 +00:00
vecs.resize(iov_count);
Kernel: Fix SMAP violation in writev() syscall
2020-01-05 18:20:08 +00:00
copy_from_user(vecs.data(), iov, iov_count * sizeof(iovec));
for (auto& vec : vecs) {
if (!validate_read(vec.iov_base, vec.iov_len))
Kernel: Add missing iovec base validation for writev() syscall We were forgetting to validate the base pointers of iovecs passed into the writev() syscall. Thanks to braindead for finding this bug! :^)
2020-01-05 09:16:19 +00:00
return -EFAULT;
Kernel: Fix SMAP violation in writev() syscall
2020-01-05 18:20:08 +00:00
total_length += vec.iov_len;
Kernel: writev() should fail with EINVAL if total length > INT32_MAX
2020-01-02 12:01:41 +00:00
if (total_length > INT32_MAX)
return -EINVAL;
}
Kernel: Add a writev() syscall for writing multiple buffers in one go. We then use this immediately in the WindowServer/LibGUI communication in order to send both message + optional "extra data" with a single syscall.
2019-05-10 01:19:25 +00:00
Kernel: Make Process::file_description() vend a RefPtr<FileDescription> This encourages callers to strongly reference file descriptions while working with them. This fixes a use-after-free issue where one thread would close() an open fd while another thread was blocked on it becoming readable. Test: Kernel/uaf-close-while-blocked-in-read.cpp
2020-01-07 14:53:42 +00:00
auto description = file_description(fd);
Kernel: Rename "descriptor" to "description" where appropriate. Now that FileDescription is called that, variables of that type should not be called "descriptor". This is kinda wordy but we'll get used to it.
2019-06-13 20:03:04 +00:00
if (!description)
Virtual consoles kinda work! We now make three VirtualConsoles at boot: tty0, tty1, and tty2. We launch an instance of /bin/sh in each one. You switch between them with Alt+1/2/3 How very very cool :^)
2018-10-30 14:33:37 +00:00
return -EBADF;
Kernel: Add a writev() syscall for writing multiple buffers in one go. We then use this immediately in the WindowServer/LibGUI communication in order to send both message + optional "extra data" with a single syscall.
2019-05-10 01:19:25 +00:00
Kernel: read() and write() should fail with EBADF for wrong mode fd's It was previously possible to write to read-only file descriptors, and read from write-only file descriptors. All FileDescription objects now start out non-readable + non-writable, and whoever is creating them has to "manually" enable reading/writing by calling set_readable() and/or set_writable() on them.
2020-01-03 02:29:59 +00:00
if (!description->is_writable())
return -EBADF;
Kernel: Add a writev() syscall for writing multiple buffers in one go. We then use this immediately in the WindowServer/LibGUI communication in order to send both message + optional "extra data" with a single syscall.
2019-05-10 01:19:25 +00:00
int nwritten = 0;
Kernel: Add missing iovec base validation for writev() syscall We were forgetting to validate the base pointers of iovecs passed into the writev() syscall. Thanks to braindead for finding this bug! :^)
2020-01-05 09:16:19 +00:00
for (auto& vec : vecs) {
int rc = do_write(*description, (const u8*)vec.iov_base, vec.iov_len);
Kernel: Add a writev() syscall for writing multiple buffers in one go. We then use this immediately in the WindowServer/LibGUI communication in order to send both message + optional "extra data" with a single syscall.
2019-05-10 01:19:25 +00:00
if (rc < 0) {
if (nwritten == 0)
return rc;
return nwritten;
}
nwritten += rc;
}
return nwritten;
}
AK: Rename the common integer typedefs to make it obvious what they are. These types can be picked up by including <AK/Types.h>: * u8, u16, u32, u64 (unsigned) * i8, i16, i32, i64 (signed)
2019-07-03 19:17:35 +00:00
ssize_t Process::do_write(FileDescription& description, const u8* data, int data_size)
Kernel: Add a writev() syscall for writing multiple buffers in one go. We then use this immediately in the WindowServer/LibGUI communication in order to send both message + optional "extra data" with a single syscall.
2019-05-10 01:19:25 +00:00
{
Add primitive FIFO and hook it up to sys$pipe(). It's now possible to do this in bash: cat kernel.map | fgrep List This is very cool! :^)
2018-11-12 00:28:46 +00:00
ssize_t nwritten = 0;
Kernel: Rename "descriptor" to "description" where appropriate. Now that FileDescription is called that, variables of that type should not be called "descriptor". This is kinda wordy but we'll get used to it.
2019-06-13 20:03:04 +00:00
if (!description.is_blocking()) {
if (!description.can_write())
Kernel: Check can_write for blocking write This way the socket write buffer sizes are respected, and things that exceed them get sent EAGAIN.
2019-05-19 08:25:05 +00:00
return -EAGAIN;
}
Kernel: Add a writev() syscall for writing multiple buffers in one go. We then use this immediately in the WindowServer/LibGUI communication in order to send both message + optional "extra data" with a single syscall.
2019-05-10 01:19:25 +00:00
Kernel: Rename "descriptor" to "description" where appropriate. Now that FileDescription is called that, variables of that type should not be called "descriptor". This is kinda wordy but we'll get used to it.
2019-06-13 20:03:04 +00:00
if (description.should_append()) {
Kernel: Support O_APPEND As per the manpage, this acts as a transparent lseek() before write.
2019-05-25 23:18:04 +00:00
#ifdef IO_DEBUG
dbgprintf("seeking to end (O_APPEND)\n");
#endif
Kernel: Rename "descriptor" to "description" where appropriate. Now that FileDescription is called that, variables of that type should not be called "descriptor". This is kinda wordy but we'll get used to it.
2019-06-13 20:03:04 +00:00
description.seek(0, SEEK_END);
Kernel: Support O_APPEND As per the manpage, this acts as a transparent lseek() before write.
2019-05-25 23:18:04 +00:00
}
Kernel: Add a writev() syscall for writing multiple buffers in one go. We then use this immediately in the WindowServer/LibGUI communication in order to send both message + optional "extra data" with a single syscall.
2019-05-10 01:19:25 +00:00
while (nwritten < data_size) {
Add primitive FIFO and hook it up to sys$pipe(). It's now possible to do this in bash: cat kernel.map | fgrep List This is very cool! :^)
2018-11-12 00:28:46 +00:00
#ifdef IO_DEBUG
Kernel: Add a writev() syscall for writing multiple buffers in one go. We then use this immediately in the WindowServer/LibGUI communication in order to send both message + optional "extra data" with a single syscall.
2019-05-10 01:19:25 +00:00
dbgprintf("while %u < %u\n", nwritten, size);
Add primitive FIFO and hook it up to sys$pipe(). It's now possible to do this in bash: cat kernel.map | fgrep List This is very cool! :^)
2018-11-12 00:28:46 +00:00
#endif
Kernel: Rename "descriptor" to "description" where appropriate. Now that FileDescription is called that, variables of that type should not be called "descriptor". This is kinda wordy but we'll get used to it.
2019-06-13 20:03:04 +00:00
if (!description.can_write()) {
Add primitive FIFO and hook it up to sys$pipe(). It's now possible to do this in bash: cat kernel.map | fgrep List This is very cool! :^)
2018-11-12 00:28:46 +00:00
#ifdef IO_DEBUG
Kernel: Add a writev() syscall for writing multiple buffers in one go. We then use this immediately in the WindowServer/LibGUI communication in order to send both message + optional "extra data" with a single syscall.
2019-05-10 01:19:25 +00:00
dbgprintf("block write on %d\n", fd);
Add primitive FIFO and hook it up to sys$pipe(). It's now possible to do this in bash: cat kernel.map | fgrep List This is very cool! :^)
2018-11-12 00:28:46 +00:00
#endif
Kernel: Fix kernel null deref on process crash during join_thread() The join_thread() syscall is not supposed to be interruptible by signals, but it was. And since the process death mechanism piggybacked on signal interrupts, it was possible to interrupt a pthread_join() by killing the process that was doing it, leading to confusing due to some assumptions being made by Thread::finalize() for threads that have a pending joiner. This patch fixes the issue by making "interrupted by death" a distinct block result separate from "interrupted by signal". Then we handle that state in join_thread() and tidy things up so that thread finalization doesn't get confused by the pending joiner being gone. Test: Tests/Kernel/null-deref-crash-during-pthread_join.cpp
2020-01-10 18:15:01 +00:00
if (current->block<Thread::WriteBlocker>(description) != Thread::BlockResult::WokeNormally) {
Thread: Return a result from block() indicating why the block terminated And use this to return EINTR in various places; some of which we were not handling properly before. This might expose a few bugs in userspace, but should be more compatible with other POSIX systems, and is certainly a little cleaner.
2019-07-20 09:05:52 +00:00
if (nwritten == 0)
return -EINTR;
}
Kernel: Add a writev() syscall for writing multiple buffers in one go. We then use this immediately in the WindowServer/LibGUI communication in order to send both message + optional "extra data" with a single syscall.
2019-05-10 01:19:25 +00:00
}
Kernel: Rename "descriptor" to "description" where appropriate. Now that FileDescription is called that, variables of that type should not be called "descriptor". This is kinda wordy but we'll get used to it.
2019-06-13 20:03:04 +00:00
ssize_t rc = description.write(data + nwritten, data_size - nwritten);
Add primitive FIFO and hook it up to sys$pipe(). It's now possible to do this in bash: cat kernel.map | fgrep List This is very cool! :^)
2018-11-12 00:28:46 +00:00
#ifdef IO_DEBUG
Kernel: Add a writev() syscall for writing multiple buffers in one go. We then use this immediately in the WindowServer/LibGUI communication in order to send both message + optional "extra data" with a single syscall.
2019-05-10 01:19:25 +00:00
dbgprintf(" -> write returned %d\n", rc);
Add primitive FIFO and hook it up to sys$pipe(). It's now possible to do this in bash: cat kernel.map | fgrep List This is very cool! :^)
2018-11-12 00:28:46 +00:00
#endif
Kernel: Add a writev() syscall for writing multiple buffers in one go. We then use this immediately in the WindowServer/LibGUI communication in order to send both message + optional "extra data" with a single syscall.
2019-05-10 01:19:25 +00:00
if (rc < 0) {
// FIXME: Support returning partial nwritten with errno.
ASSERT(nwritten == 0);
return rc;
Add primitive FIFO and hook it up to sys$pipe(). It's now possible to do this in bash: cat kernel.map | fgrep List This is very cool! :^)
2018-11-12 00:28:46 +00:00
}
Kernel: Add a writev() syscall for writing multiple buffers in one go. We then use this immediately in the WindowServer/LibGUI communication in order to send both message + optional "extra data" with a single syscall.
2019-05-10 01:19:25 +00:00
if (rc == 0)
break;
nwritten += rc;
Add primitive FIFO and hook it up to sys$pipe(). It's now possible to do this in bash: cat kernel.map | fgrep List This is very cool! :^)
2018-11-12 00:28:46 +00:00
}
Kernel: Add a writev() syscall for writing multiple buffers in one go. We then use this immediately in the WindowServer/LibGUI communication in order to send both message + optional "extra data" with a single syscall.
2019-05-10 01:19:25 +00:00
return nwritten;
}
AK: Rename the common integer typedefs to make it obvious what they are. These types can be picked up by including <AK/Types.h>: * u8, u16, u32, u64 (unsigned) * i8, i16, i32, i64 (signed)
2019-07-03 19:17:35 +00:00
ssize_t Process::sys$write(int fd, const u8* data, ssize_t size)
Kernel: Add a writev() syscall for writing multiple buffers in one go. We then use this immediately in the WindowServer/LibGUI communication in order to send both message + optional "extra data" with a single syscall.
2019-05-10 01:19:25 +00:00
{
ping: Use pledge()
2020-01-11 19:48:43 +00:00
REQUIRE_PROMISE(stdio);
Kernel: Add a writev() syscall for writing multiple buffers in one go. We then use this immediately in the WindowServer/LibGUI communication in order to send both message + optional "extra data" with a single syscall.
2019-05-10 01:19:25 +00:00
if (size < 0)
return -EINVAL;
if (size == 0)
return 0;
if (!validate_read(data, size))
return -EFAULT;
#ifdef DEBUG_IO
dbgprintf("%s(%u): sys$write(%d, %p, %u)\n", name().characters(), pid(), fd, data, size);
#endif
Kernel: Make Process::file_description() vend a RefPtr<FileDescription> This encourages callers to strongly reference file descriptions while working with them. This fixes a use-after-free issue where one thread would close() an open fd while another thread was blocked on it becoming readable. Test: Kernel/uaf-close-while-blocked-in-read.cpp
2020-01-07 14:53:42 +00:00
auto description = file_description(fd);
Kernel: Rename "descriptor" to "description" where appropriate. Now that FileDescription is called that, variables of that type should not be called "descriptor". This is kinda wordy but we'll get used to it.
2019-06-13 20:03:04 +00:00
if (!description)
Kernel: Add a writev() syscall for writing multiple buffers in one go. We then use this immediately in the WindowServer/LibGUI communication in order to send both message + optional "extra data" with a single syscall.
2019-05-10 01:19:25 +00:00
return -EBADF;
Kernel: read() and write() should fail with EBADF for wrong mode fd's It was previously possible to write to read-only file descriptors, and read from write-only file descriptors. All FileDescription objects now start out non-readable + non-writable, and whoever is creating them has to "manually" enable reading/writing by calling set_readable() and/or set_writable() on them.
2020-01-03 02:29:59 +00:00
if (!description->is_writable())
return -EBADF;
Kernel: Don't interrupt short writes Remove explicit checking for pending signals from writing code paths, since this is handled automatically when blocking, and should not happen if the write() call is "short", i.e. doesn't block. All the other syscalls already work like this. Fixes https://github.com/SerenityOS/serenity/issues/797
2019-11-19 12:33:08 +00:00
return do_write(*description, data, size);
Virtual consoles kinda work! We now make three VirtualConsoles at boot: tty0, tty1, and tty2. We launch an instance of /bin/sh in each one. You switch between them with Alt+1/2/3 How very very cool :^)
2018-10-30 14:33:37 +00:00
}
AK: Rename the common integer typedefs to make it obvious what they are. These types can be picked up by including <AK/Types.h>: * u8, u16, u32, u64 (unsigned) * i8, i16, i32, i64 (signed)
2019-07-03 19:17:35 +00:00
ssize_t Process::sys$read(int fd, u8* buffer, ssize_t size)
Import the "gerbert" kernel I worked on earlier this year. It's a lot crappier than I remembered it. It's gonna need a lot of work.
2018-10-16 09:01:38 +00:00
{
ping: Use pledge()
2020-01-11 19:48:43 +00:00
REQUIRE_PROMISE(stdio);
Kernel: Make syscalls that take a buffer size use ssize_t instead of size_t. Dealing with the unsigned overflow propagation here just seems unreasonably error prone. Let's limit ourselves to 2GB buffer sizes instead.
2019-02-25 20:19:57 +00:00
if (size < 0)
return -EINVAL;
Kernel: "Succeed" quietly for zero-length read() and write().
2019-04-27 14:17:24 +00:00
if (size == 0)
return 0;
Kernel: Make syscalls that take a buffer size use ssize_t instead of size_t. Dealing with the unsigned overflow propagation here just seems unreasonably error prone. Let's limit ourselves to 2GB buffer sizes instead.
2019-02-25 20:19:57 +00:00
if (!validate_write(buffer, size))
Improve syscall address validation a bit.
2018-11-16 15:10:59 +00:00
return -EFAULT;
Lots of hacking: - Turn Keyboard into a CharacterDevice (85,1) at /dev/keyboard. - Implement MM::unmapRegionsForTask() and MM::unmapRegion() - Save SS correctly on interrupt. - Add a simple Spawn syscall for launching another process. - Move a bunch of IO syscall debug output behind DEBUG_IO. - Have ASSERT do a "cli" immediately when failing. This makes the output look proper every time. - Implement a bunch of syscalls in LibC. - Add a simple shell ("sh"). All it can do now is read a line of text from /dev/keyboard and then try launching the specified executable by calling spawn(). There are definitely bugs in here, but we're moving on forward.
2018-10-23 08:12:50 +00:00
#ifdef DEBUG_IO
Kernel: Make syscalls that take a buffer size use ssize_t instead of size_t. Dealing with the unsigned overflow propagation here just seems unreasonably error prone. Let's limit ourselves to 2GB buffer sizes instead.
2019-02-25 20:19:57 +00:00
dbgprintf("%s(%u) sys$read(%d, %p, %u)\n", name().characters(), pid(), fd, buffer, size);
Lots of hacking: - Turn Keyboard into a CharacterDevice (85,1) at /dev/keyboard. - Implement MM::unmapRegionsForTask() and MM::unmapRegion() - Save SS correctly on interrupt. - Add a simple Spawn syscall for launching another process. - Move a bunch of IO syscall debug output behind DEBUG_IO. - Have ASSERT do a "cli" immediately when failing. This makes the output look proper every time. - Implement a bunch of syscalls in LibC. - Add a simple shell ("sh"). All it can do now is read a line of text from /dev/keyboard and then try launching the specified executable by calling spawn(). There are definitely bugs in here, but we're moving on forward.
2018-10-23 08:12:50 +00:00
#endif
Kernel: Make Process::file_description() vend a RefPtr<FileDescription> This encourages callers to strongly reference file descriptions while working with them. This fixes a use-after-free issue where one thread would close() an open fd while another thread was blocked on it becoming readable. Test: Kernel/uaf-close-while-blocked-in-read.cpp
2020-01-07 14:53:42 +00:00
auto description = file_description(fd);
Kernel: Rename "descriptor" to "description" where appropriate. Now that FileDescription is called that, variables of that type should not be called "descriptor". This is kinda wordy but we'll get used to it.
2019-06-13 20:03:04 +00:00
if (!description)
Virtual consoles kinda work! We now make three VirtualConsoles at boot: tty0, tty1, and tty2. We launch an instance of /bin/sh in each one. You switch between them with Alt+1/2/3 How very very cool :^)
2018-10-30 14:33:37 +00:00
return -EBADF;
Kernel: read() and write() should fail with EBADF for wrong mode fd's It was previously possible to write to read-only file descriptors, and read from write-only file descriptors. All FileDescription objects now start out non-readable + non-writable, and whoever is creating them has to "manually" enable reading/writing by calling set_readable() and/or set_writable() on them.
2020-01-03 02:29:59 +00:00
if (!description->is_readable())
return -EBADF;
Kernel: Return error when attempting to read from a directory. We now return EISDIR whenever a program attempts to call sys$read on a directory. Previously, attempting to read a directory could either return junk data or, in the case of /proc/, cause a kernel panic.
2019-10-24 13:46:31 +00:00
if (description->is_directory())
return -EISDIR;
Kernel: Rename "descriptor" to "description" where appropriate. Now that FileDescription is called that, variables of that type should not be called "descriptor". This is kinda wordy but we'll get used to it.
2019-06-13 20:03:04 +00:00
if (description->is_blocking()) {
if (!description->can_read()) {
Kernel: Fix kernel null deref on process crash during join_thread() The join_thread() syscall is not supposed to be interruptible by signals, but it was. And since the process death mechanism piggybacked on signal interrupts, it was possible to interrupt a pthread_join() by killing the process that was doing it, leading to confusing due to some assumptions being made by Thread::finalize() for threads that have a pending joiner. This patch fixes the issue by making "interrupted by death" a distinct block result separate from "interrupted by signal". Then we handle that state in join_thread() and tidy things up so that thread finalization doesn't get confused by the pending joiner being gone. Test: Tests/Kernel/null-deref-crash-during-pthread_join.cpp
2020-01-10 18:15:01 +00:00
if (current->block<Thread::ReadBlocker>(*description) != Thread::BlockResult::WokeNormally)
Implement sending signals to blocked-in-kernel processes. This is dirty but pretty cool! If we have a pending, unmasked signal for a process that's blocked inside the kernel, we set up alternate stacks for that process and unblock it to execute the signal handler. A slightly different return trampoline is used here: since we need to get back into the kernel, a dedicated syscall is used (sys$sigreturn.) This restores the TSS contents of the process to the state it was in while we were originally blocking in the kernel. NOTE: There's currently only one "kernel resume TSS" so signal nesting definitely won't work.
2018-11-07 20:19:47 +00:00
return -EINTR;
Kernel: read()/write() should respect timeouts when used on a sockets Move timeout management to the ReadBlocker and WriteBlocker classes. Also get rid of the specialized ReceiveBlocker since it no longer does anything that ReadBlocker can't do.
2020-01-26 16:54:23 +00:00
if (!description->can_read())
return -EAGAIN;
Implement a basic way for read() to block. FileHandle gets a hasDataAvailableForRead() getter. If this returns true in sys$read(), the task will block(BlockedRead) + yield. The fd blocked on is stored in Task::m_fdBlockedOnRead. The scheduler then looks at the state of that fd during the unblock phase. This makes "sh" restful. :^) There's still some problem with the kernel not surviving the colonel task getting scheduled. I need to figure that out and fix it.
2018-10-25 11:07:59 +00:00
}
}
Kernel: Rename "descriptor" to "description" where appropriate. Now that FileDescription is called that, variables of that type should not be called "descriptor". This is kinda wordy but we'll get used to it.
2019-06-13 20:03:04 +00:00
return description->read(buffer, size);
Import the "gerbert" kernel I worked on earlier this year. It's a lot crappier than I remembered it. It's gonna need a lot of work.
2018-10-16 09:01:38 +00:00
}
Process now maps regions immediately when they are allocated. This avoids having to do a separate MM.mapRegionsForTask() pass. Also, more Task => Process renaming that I apparently hadn't saved yet.
2018-11-01 12:15:46 +00:00
int Process::sys$close(int fd)
Import the "gerbert" kernel I worked on earlier this year. It's a lot crappier than I remembered it. It's gonna need a lot of work.
2018-10-16 09:01:38 +00:00
{
ping: Use pledge()
2020-01-11 19:48:43 +00:00
REQUIRE_PROMISE(stdio);
Kernel: Make Process::file_description() vend a RefPtr<FileDescription> This encourages callers to strongly reference file descriptions while working with them. This fixes a use-after-free issue where one thread would close() an open fd while another thread was blocked on it becoming readable. Test: Kernel/uaf-close-while-blocked-in-read.cpp
2020-01-07 14:53:42 +00:00
auto description = file_description(fd);
WindowServer: Port to the new IPC system This patch introduces code generation for the WindowServer IPC with its clients. The client/server endpoints are defined by the two .ipc files in Servers/WindowServer/: WindowServer.ipc and WindowClient.ipc It now becomes significantly easier to add features and capabilities to WindowServer since you don't have to know nearly as much about all the intricate paths that IPC messages take between LibGUI and WSWindow. The new system also uses significantly less IPC bandwidth since we're now doing packed serialization instead of passing fixed-sized structs of ~600 bytes for each message. Some repaint coalescing optimizations are lost in this conversion and we'll need to look at how to implement those in the new world. The old CoreIPC::Client::Connection and CoreIPC::Server::Connection classes are removed by this patch and replaced by use of ConnectionNG, which will be renamed eventually. Goodbye, old WindowServer IPC. You served us well :^)
2019-12-02 08:33:37 +00:00
#ifdef DEBUG_IO
Kernel: Use the Syscall string and buffer types more While I was updating syscalls to stop passing null-terminated strings, I added some helpful struct types: - StringArgument { const char*; size_t; } - ImmutableBuffer<Data, Size> { const Data*; Size; } - MutableBuffer<Data, Size> { Data*; Size; } The Process class has some convenience functions for validating and optionally extracting the contents from these structs: - get_syscall_path_argument(StringArgument) - validate_and_copy_string_from_user(StringArgument) - validate(ImmutableBuffer) - validate(MutableBuffer) There's still so much code around this and I'm wondering if we should generate most of it instead. Possible nice little project.
2020-01-11 11:47:47 +00:00
dbgprintf("%s(%u) sys$close(%d) %p\n", name().characters(), pid(), fd, description.ptr());
WindowServer: Port to the new IPC system This patch introduces code generation for the WindowServer IPC with its clients. The client/server endpoints are defined by the two .ipc files in Servers/WindowServer/: WindowServer.ipc and WindowClient.ipc It now becomes significantly easier to add features and capabilities to WindowServer since you don't have to know nearly as much about all the intricate paths that IPC messages take between LibGUI and WSWindow. The new system also uses significantly less IPC bandwidth since we're now doing packed serialization instead of passing fixed-sized structs of ~600 bytes for each message. Some repaint coalescing optimizations are lost in this conversion and we'll need to look at how to implement those in the new world. The old CoreIPC::Client::Connection and CoreIPC::Server::Connection classes are removed by this patch and replaced by use of ConnectionNG, which will be renamed eventually. Goodbye, old WindowServer IPC. You served us well :^)
2019-12-02 08:33:37 +00:00
#endif
Kernel: Rename "descriptor" to "description" where appropriate. Now that FileDescription is called that, variables of that type should not be called "descriptor". This is kinda wordy but we'll get used to it.
2019-06-13 20:03:04 +00:00
if (!description)
Add sys$ttyname_r and ttyname_r() + ttyname(). And print a greeting when sh starts up so we know which TTY we're on.
2018-10-30 21:03:02 +00:00
return -EBADF;
Kernel: Rename "descriptor" to "description" where appropriate. Now that FileDescription is called that, variables of that type should not be called "descriptor". This is kinda wordy but we'll get used to it.
2019-06-13 20:03:04 +00:00
int rc = description->close();
Kernel: Run clang-format on everything.
2019-06-07 09:43:58 +00:00
m_fds[fd] = {};
Add a /proc/PID/fds text files that lists all the fds open in a process.
2018-11-01 13:00:28 +00:00
return rc;
Import the "gerbert" kernel I worked on earlier this year. It's a lot crappier than I remembered it. It's gonna need a lot of work.
2018-10-16 09:01:38 +00:00
}
Kernel: Make utime() take path+length, remove SmapDisabler
2020-01-06 11:23:30 +00:00
int Process::sys$utime(const char* user_path, size_t path_length, const utimbuf* user_buf)
Implement utime() along with a naive /bin/touch. This synchronous approach to inodes is silly, obviously. I need to rework it so that the in-memory CoreInode object is the canonical inode, and then we just need a sync() that flushes pending changes to disk.
2018-12-19 20:14:55 +00:00
{
ping: Use pledge()
2020-01-11 19:48:43 +00:00
REQUIRE_PROMISE(fattr);
Kernel: Make utime() take path+length, remove SmapDisabler
2020-01-06 11:23:30 +00:00
if (user_buf && !validate_read_typed(user_buf))
Implement utime() along with a naive /bin/touch. This synchronous approach to inodes is silly, obviously. I need to rework it so that the in-memory CoreInode object is the canonical inode, and then we just need a sync() that flushes pending changes to disk.
2018-12-19 20:14:55 +00:00
return -EFAULT;
Kernel: Make utime() take path+length, remove SmapDisabler
2020-01-06 11:23:30 +00:00
auto path = get_syscall_path_argument(user_path, path_length);
if (path.is_error())
return path.error();
utimbuf buf;
if (user_buf) {
Kernel: Use the templated copy_from_user where possible Now that the templated version of copy_from_user exists their is normally no reason to use the version which takes the number of bytes to copy. Move to the templated version where possible.
2020-01-13 07:00:35 +00:00
copy_from_user(&buf, user_buf);
Implement utime() along with a naive /bin/touch. This synchronous approach to inodes is silly, obviously. I need to rework it so that the in-memory CoreInode object is the canonical inode, and then we just need a sync() that flushes pending changes to disk.
2018-12-19 20:14:55 +00:00
} else {
Kernel: Make utime() take path+length, remove SmapDisabler
2020-01-06 11:23:30 +00:00
auto now = kgettimeofday();
buf = { now.tv_sec, now.tv_sec };
Implement utime() along with a naive /bin/touch. This synchronous approach to inodes is silly, obviously. I need to rework it so that the in-memory CoreInode object is the canonical inode, and then we just need a sync() that flushes pending changes to disk.
2018-12-19 20:14:55 +00:00
}
Kernel: Make utime() take path+length, remove SmapDisabler
2020-01-06 11:23:30 +00:00
return VFS::the().utime(path.value(), current_directory(), buf.actime, buf.modtime);
Implement utime() along with a naive /bin/touch. This synchronous approach to inodes is silly, obviously. I need to rework it so that the in-memory CoreInode object is the canonical inode, and then we just need a sync() that flushes pending changes to disk.
2018-12-19 20:14:55 +00:00
}
Kernel: Make access() take path+length Also, let's return EFAULT for nullptr at the LibC layer. We can't do all bad addresses this way, but we can at least do null. :^)
2020-01-06 09:43:53 +00:00
int Process::sys$access(const char* user_path, size_t path_length, int mode)
A bunch of compat work (mostly stubs but some real implementations, too.) Another pass at getting bash-1.14.7 to build. Not that many symbols remain.
2018-11-10 23:20:53 +00:00
{
ping: Use pledge()
2020-01-11 19:48:43 +00:00
REQUIRE_PROMISE(rpath);
Kernel: Use get_syscall_path_argument() for syscalls that take paths
2020-01-06 10:10:38 +00:00
auto path = get_syscall_path_argument(user_path, path_length);
if (path.is_error())
return path.error();
return VFS::the().access(path.value(), mode, current_directory());
A bunch of compat work (mostly stubs but some real implementations, too.) Another pass at getting bash-1.14.7 to build. Not that many symbols remain.
2018-11-10 23:20:53 +00:00
}
AK: Rename the common integer typedefs to make it obvious what they are. These types can be picked up by including <AK/Types.h>: * u8, u16, u32, u64 (unsigned) * i8, i16, i32, i64 (signed)
2019-07-03 19:17:35 +00:00
int Process::sys$fcntl(int fd, int cmd, u32 arg)
Stub out a bunch more functions to get closer to that sweet bash build.
2018-11-11 09:38:33 +00:00
{
ping: Use pledge()
2020-01-11 19:48:43 +00:00
REQUIRE_PROMISE(stdio);
Kernel: Put fcntl() debug spam behind DEBUG_IO
2020-01-12 08:59:04 +00:00
#ifdef DEBUG_IO
Rage hacking to get bash to run. It finally runs. So cool! :^)
2018-11-11 14:36:40 +00:00
dbgprintf("sys$fcntl: fd=%d, cmd=%d, arg=%u\n", fd, cmd, arg);
Kernel: Put fcntl() debug spam behind DEBUG_IO
2020-01-12 08:59:04 +00:00
#endif
Kernel: Make Process::file_description() vend a RefPtr<FileDescription> This encourages callers to strongly reference file descriptions while working with them. This fixes a use-after-free issue where one thread would close() an open fd while another thread was blocked on it becoming readable. Test: Kernel/uaf-close-while-blocked-in-read.cpp
2020-01-07 14:53:42 +00:00
auto description = file_description(fd);
Kernel: Rename "descriptor" to "description" where appropriate. Now that FileDescription is called that, variables of that type should not be called "descriptor". This is kinda wordy but we'll get used to it.
2019-06-13 20:03:04 +00:00
if (!description)
Stub out a bunch more functions to get closer to that sweet bash build.
2018-11-11 09:38:33 +00:00
return -EBADF;
Kernel: Rename FileDescriptor to FileDescription. After reading a bunch of POSIX specs, I've learned that a file descriptor is the number that refers to a file description, not the description itself. So this patch renames FileDescriptor to FileDescription, and Process now has FileDescription* file_description(int fd).
2019-06-07 07:36:51 +00:00
// NOTE: The FD flags are not shared between FileDescription objects.
Add close-on-exec flag for file descriptors. I was surprised to find that dup()'ed fds don't share the close-on-exec flag. That means it has to be stored separately from the FileDescriptor object.
2018-11-13 00:36:31 +00:00
// This means that dup() doesn't copy the FD_CLOEXEC flag!
Rage hacking to get bash to run. It finally runs. So cool! :^)
2018-11-11 14:36:40 +00:00
switch (cmd) {
Add fcntl() F_DUPFD which is slightly different from dup2().
2018-11-16 21:14:40 +00:00
case F_DUPFD: {
int arg_fd = (int)arg;
if (arg_fd < 0)
return -EINVAL;
Kernel: Use alloc_fd() more instead of walking fd list manually.
2019-04-06 12:54:32 +00:00
int new_fd = alloc_fd(arg_fd);
if (new_fd < 0)
return new_fd;
Kernel: Rename "descriptor" to "description" where appropriate. Now that FileDescription is called that, variables of that type should not be called "descriptor". This is kinda wordy but we'll get used to it.
2019-06-13 20:03:04 +00:00
m_fds[new_fd].set(*description);
Kernel: Return new fd from sys$fcntl(F_DUPFD) This fixes GNU Bash getting confused after performing a redirection.
2020-01-20 12:15:24 +00:00
return new_fd;
Add fcntl() F_DUPFD which is slightly different from dup2().
2018-11-16 21:14:40 +00:00
}
Rage hacking to get bash to run. It finally runs. So cool! :^)
2018-11-11 14:36:40 +00:00
case F_GETFD:
Add close-on-exec flag for file descriptors. I was surprised to find that dup()'ed fds don't share the close-on-exec flag. That means it has to be stored separately from the FileDescriptor object.
2018-11-13 00:36:31 +00:00
return m_fds[fd].flags;
Rage hacking to get bash to run. It finally runs. So cool! :^)
2018-11-11 14:36:40 +00:00
case F_SETFD:
Add close-on-exec flag for file descriptors. I was surprised to find that dup()'ed fds don't share the close-on-exec flag. That means it has to be stored separately from the FileDescriptor object.
2018-11-13 00:36:31 +00:00
m_fds[fd].flags = arg;
break;
Rage hacking to get bash to run. It finally runs. So cool! :^)
2018-11-11 14:36:40 +00:00
case F_GETFL:
Kernel: Rename "descriptor" to "description" where appropriate. Now that FileDescription is called that, variables of that type should not be called "descriptor". This is kinda wordy but we'll get used to it.
2019-06-13 20:03:04 +00:00
return description->file_flags();
Rage hacking to get bash to run. It finally runs. So cool! :^)
2018-11-11 14:36:40 +00:00
case F_SETFL:
Kernel: Rename "descriptor" to "description" where appropriate. Now that FileDescription is called that, variables of that type should not be called "descriptor". This is kinda wordy but we'll get used to it.
2019-06-13 20:03:04 +00:00
description->set_file_flags(arg);
Add close-on-exec flag for file descriptors. I was surprised to find that dup()'ed fds don't share the close-on-exec flag. That means it has to be stored separately from the FileDescriptor object.
2018-11-13 00:36:31 +00:00
break;
Rage hacking to get bash to run. It finally runs. So cool! :^)
2018-11-11 14:36:40 +00:00
default:
ASSERT_NOT_REACHED();
}
return 0;
Stub out a bunch more functions to get closer to that sweet bash build.
2018-11-11 09:38:33 +00:00
}
Kernel: Get rid of Unix namespace. This is no longer needed as the Kernel can stand on its own legs now and there won't be any conflict with host system data types.
2019-01-23 05:53:01 +00:00
int Process::sys$fstat(int fd, stat* statbuf)
A bunch of compat work (mostly stubs but some real implementations, too.) Another pass at getting bash-1.14.7 to build. Not that many symbols remain.
2018-11-10 23:20:53 +00:00
{
ping: Use pledge()
2020-01-11 19:48:43 +00:00
REQUIRE_PROMISE(stdio);
Add templated helpers for read/write validation, and one for strings, too.
2018-11-16 15:23:39 +00:00
if (!validate_write_typed(statbuf))
Improve syscall address validation a bit.
2018-11-16 15:10:59 +00:00
return -EFAULT;
Kernel: Make Process::file_description() vend a RefPtr<FileDescription> This encourages callers to strongly reference file descriptions while working with them. This fixes a use-after-free issue where one thread would close() an open fd while another thread was blocked on it becoming readable. Test: Kernel/uaf-close-while-blocked-in-read.cpp
2020-01-07 14:53:42 +00:00
auto description = file_description(fd);
Kernel: Rename "descriptor" to "description" where appropriate. Now that FileDescription is called that, variables of that type should not be called "descriptor". This is kinda wordy but we'll get used to it.
2019-06-13 20:03:04 +00:00
if (!description)
A bunch of compat work (mostly stubs but some real implementations, too.) Another pass at getting bash-1.14.7 to build. Not that many symbols remain.
2018-11-10 23:20:53 +00:00
return -EBADF;
Kernel: Rename "descriptor" to "description" where appropriate. Now that FileDescription is called that, variables of that type should not be called "descriptor". This is kinda wordy but we'll get used to it.
2019-06-13 20:03:04 +00:00
return description->fstat(*statbuf);
A bunch of compat work (mostly stubs but some real implementations, too.) Another pass at getting bash-1.14.7 to build. Not that many symbols remain.
2018-11-10 23:20:53 +00:00
}
Kernel: Remove SmapDisablers in stat() and lstat()
2020-01-06 11:13:48 +00:00
int Process::sys$lstat(const char* user_path, size_t path_length, stat* user_statbuf)
Add an lstat() syscall and use it to make "ls" nicer.
2018-10-24 11:19:36 +00:00
{
ping: Use pledge()
2020-01-11 19:48:43 +00:00
REQUIRE_PROMISE(rpath);
Kernel: Remove SmapDisablers in stat() and lstat()
2020-01-06 11:13:48 +00:00
if (!validate_write_typed(user_statbuf))
Improve syscall address validation a bit.
2018-11-16 15:10:59 +00:00
return -EFAULT;
Kernel: Use get_syscall_path_argument() for syscalls that take paths
2020-01-06 10:10:38 +00:00
auto path = get_syscall_path_argument(user_path, path_length);
if (path.is_error())
return path.error();
auto metadata_or_error = VFS::the().lookup_metadata(path.value(), current_directory(), O_NOFOLLOW_NOERROR);
Kernel: Generalize VFS metadata lookup and use it in mount() and stat() Refactored VFS::stat() into VFS::lookup_metadata(), which can now be used for general VFS metadata lookup by path.
2019-08-02 17:23:23 +00:00
if (metadata_or_error.is_error())
return metadata_or_error.error();
Kernel: Remove SmapDisablers in stat() and lstat()
2020-01-06 11:13:48 +00:00
stat statbuf;
auto result = metadata_or_error.value().stat(statbuf);
if (result.is_error())
return result;
Kernel: Use the templated copy_to/from_user() in more places These ensure that the "to" and "from" pointers have the same type, and also that we copy the correct number of bytes.
2020-01-20 12:38:31 +00:00
copy_to_user(user_statbuf, &statbuf);
Kernel: Remove SmapDisablers in stat() and lstat()
2020-01-06 11:13:48 +00:00
return 0;
Add an lstat() syscall and use it to make "ls" nicer.
2018-10-24 11:19:36 +00:00
}
Kernel: Remove SmapDisablers in stat() and lstat()
2020-01-06 11:13:48 +00:00
int Process::sys$stat(const char* user_path, size_t path_length, stat* user_statbuf)
More LibC portability work while trying to get figlet building.
2018-10-31 09:14:56 +00:00
{
ping: Use pledge()
2020-01-11 19:48:43 +00:00
REQUIRE_PROMISE(rpath);
Kernel: Remove SmapDisablers in stat() and lstat()
2020-01-06 11:13:48 +00:00
if (!validate_write_typed(user_statbuf))
Improve syscall address validation a bit.
2018-11-16 15:10:59 +00:00
return -EFAULT;
Kernel: Use get_syscall_path_argument() for syscalls that take paths
2020-01-06 10:10:38 +00:00
auto path = get_syscall_path_argument(user_path, path_length);
if (path.is_error())
return path.error();
auto metadata_or_error = VFS::the().lookup_metadata(path.value(), current_directory());
Kernel: Generalize VFS metadata lookup and use it in mount() and stat() Refactored VFS::stat() into VFS::lookup_metadata(), which can now be used for general VFS metadata lookup by path.
2019-08-02 17:23:23 +00:00
if (metadata_or_error.is_error())
return metadata_or_error.error();
Kernel: Remove SmapDisablers in stat() and lstat()
2020-01-06 11:13:48 +00:00
stat statbuf;
auto result = metadata_or_error.value().stat(statbuf);
if (result.is_error())
return result;
Kernel: Use the templated copy_to/from_user() in more places These ensure that the "to" and "from" pointers have the same type, and also that we copy the correct number of bytes.
2020-01-20 12:38:31 +00:00
copy_to_user(user_statbuf, &statbuf);
Kernel: Remove SmapDisablers in stat() and lstat()
2020-01-06 11:13:48 +00:00
return 0;
More LibC portability work while trying to get figlet building.
2018-10-31 09:14:56 +00:00
}
Kernel: Pass characters+length to readlink() Note that I'm developing some helper types in the Syscall namespace as I go here. Once I settle on some nice types, I will convert all the other syscalls to use them as well.
2020-01-10 19:13:23 +00:00
template<typename DataType, typename SizeType>
bool Process::validate(const Syscall::MutableBufferArgument<DataType, SizeType>& buffer)
Add basic symlink support. - sys$readlink + readlink() - Add a /proc/PID/exe symlink to the process's executable. - Print symlink contents in ls output. - Some work on plumbing options into VFS::open().
2018-10-28 13:11:51 +00:00
{
Kernel: Pass characters+length to readlink() Note that I'm developing some helper types in the Syscall namespace as I go here. Once I settle on some nice types, I will convert all the other syscalls to use them as well.
2020-01-10 19:13:23 +00:00
return validate_write(buffer.data, buffer.size);
}
Kernel: Use the Syscall string and buffer types more While I was updating syscalls to stop passing null-terminated strings, I added some helpful struct types: - StringArgument { const char*; size_t; } - ImmutableBuffer<Data, Size> { const Data*; Size; } - MutableBuffer<Data, Size> { Data*; Size; } The Process class has some convenience functions for validating and optionally extracting the contents from these structs: - get_syscall_path_argument(StringArgument) - validate_and_copy_string_from_user(StringArgument) - validate(ImmutableBuffer) - validate(MutableBuffer) There's still so much code around this and I'm wondering if we should generate most of it instead. Possible nice little project.
2020-01-11 11:47:47 +00:00
template<typename DataType, typename SizeType>
bool Process::validate(const Syscall::ImmutableBufferArgument<DataType, SizeType>& buffer)
{
return validate_read(buffer.data, buffer.size);
}
String Process::validate_and_copy_string_from_user(const char* user_characters, size_t user_length) const
Kernel: Pass characters+length to link()
2020-01-10 20:26:47 +00:00
{
Kernel: Add a basic implementation of unveil() This syscall is a complement to pledge() and adds the same sort of incremental relinquishing of capabilities for filesystem access. The first call to unveil() will "drop a veil" on the process, and from now on, only unveiled parts of the filesystem are visible to it. Each call to unveil() specifies a path to either a directory or a file along with permissions for that path. The permissions are a combination of the following: - r: Read access (like the "rpath" promise) - w: Write access (like the "wpath" promise) - x: Execute access - c: Create/remove access (like the "cpath" promise) Attempts to open a path that has not been unveiled with fail with ENOENT. If the unveiled path lacks sufficient permissions, it will fail with EACCES. Like pledge(), subsequent calls to unveil() with the same path can only remove permissions, not add them. Once you call unveil(nullptr, nullptr), the veil is locked, and it's no longer possible to unveil any more paths for the process, ever. This concept comes from OpenBSD, and their implementation does various things differently, I'm sure. This is just a first implementation for SerenityOS, and we'll keep improving on it as we go. :^)
2020-01-20 21:12:04 +00:00
if (user_length == 0)
return String::empty();
Kernel: Allow empty strings in validate_and_copy_string_from_user() Sergey pointed out that we should just allow empty strings everywhere.
2020-01-25 13:14:11 +00:00
if (!user_characters)
return {};
Kernel: Use the Syscall string and buffer types more While I was updating syscalls to stop passing null-terminated strings, I added some helpful struct types: - StringArgument { const char*; size_t; } - ImmutableBuffer<Data, Size> { const Data*; Size; } - MutableBuffer<Data, Size> { Data*; Size; } The Process class has some convenience functions for validating and optionally extracting the contents from these structs: - get_syscall_path_argument(StringArgument) - validate_and_copy_string_from_user(StringArgument) - validate(ImmutableBuffer) - validate(MutableBuffer) There's still so much code around this and I'm wondering if we should generate most of it instead. Possible nice little project.
2020-01-11 11:47:47 +00:00
if (!validate_read(user_characters, user_length))
Kernel: Pass characters+length to link()
2020-01-10 20:26:47 +00:00
return {};
SmapDisabler disabler;
Kernel: Use the Syscall string and buffer types more While I was updating syscalls to stop passing null-terminated strings, I added some helpful struct types: - StringArgument { const char*; size_t; } - ImmutableBuffer<Data, Size> { const Data*; Size; } - MutableBuffer<Data, Size> { Data*; Size; } The Process class has some convenience functions for validating and optionally extracting the contents from these structs: - get_syscall_path_argument(StringArgument) - validate_and_copy_string_from_user(StringArgument) - validate(ImmutableBuffer) - validate(MutableBuffer) There's still so much code around this and I'm wondering if we should generate most of it instead. Possible nice little project.
2020-01-11 11:47:47 +00:00
size_t measured_length = strnlen(user_characters, user_length);
return String(user_characters, measured_length);
}
String Process::validate_and_copy_string_from_user(const Syscall::StringArgument& string) const
{
return validate_and_copy_string_from_user(string.characters, string.length);
Kernel: Pass characters+length to link()
2020-01-10 20:26:47 +00:00
}
Kernel: Pass characters+length to readlink() Note that I'm developing some helper types in the Syscall namespace as I go here. Once I settle on some nice types, I will convert all the other syscalls to use them as well.
2020-01-10 19:13:23 +00:00
int Process::sys$readlink(const Syscall::SC_readlink_params* user_params)
{
ping: Use pledge()
2020-01-11 19:48:43 +00:00
REQUIRE_PROMISE(rpath);
Kernel: Combine validate and copy of user mode pointers (#1069) Right now there is a significant amount of boiler plate code required to validate user mode parameters in syscalls. In an attempt to reduce this a bit, introduce validate_read_and_copy_typed which combines the usermode address check and does the copy internally if the validation passes. This cleans up a little bit of code from a significant amount of syscalls.
2020-01-13 10:19:18 +00:00
Kernel: Pass characters+length to readlink() Note that I'm developing some helper types in the Syscall namespace as I go here. Once I settle on some nice types, I will convert all the other syscalls to use them as well.
2020-01-10 19:13:23 +00:00
Syscall::SC_readlink_params params;
Kernel: Combine validate and copy of user mode pointers (#1069) Right now there is a significant amount of boiler plate code required to validate user mode parameters in syscalls. In an attempt to reduce this a bit, introduce validate_read_and_copy_typed which combines the usermode address check and does the copy internally if the validation passes. This cleans up a little bit of code from a significant amount of syscalls.
2020-01-13 10:19:18 +00:00
if (!validate_read_and_copy_typed(&params, user_params))
return -EFAULT;
Kernel: Pass characters+length to readlink() Note that I'm developing some helper types in the Syscall namespace as I go here. Once I settle on some nice types, I will convert all the other syscalls to use them as well.
2020-01-10 19:13:23 +00:00
if (!validate(params.buffer))
Improve syscall address validation a bit.
2018-11-16 15:10:59 +00:00
return -EFAULT;
Add basic symlink support. - sys$readlink + readlink() - Add a /proc/PID/exe symlink to the process's executable. - Print symlink contents in ls output. - Some work on plumbing options into VFS::open().
2018-10-28 13:11:51 +00:00
Kernel: Use the Syscall string and buffer types more While I was updating syscalls to stop passing null-terminated strings, I added some helpful struct types: - StringArgument { const char*; size_t; } - ImmutableBuffer<Data, Size> { const Data*; Size; } - MutableBuffer<Data, Size> { Data*; Size; } The Process class has some convenience functions for validating and optionally extracting the contents from these structs: - get_syscall_path_argument(StringArgument) - validate_and_copy_string_from_user(StringArgument) - validate(ImmutableBuffer) - validate(MutableBuffer) There's still so much code around this and I'm wondering if we should generate most of it instead. Possible nice little project.
2020-01-11 11:47:47 +00:00
auto path = get_syscall_path_argument(params.path);
Kernel: Pass characters+length to readlink() Note that I'm developing some helper types in the Syscall namespace as I go here. Once I settle on some nice types, I will convert all the other syscalls to use them as well.
2020-01-10 19:13:23 +00:00
if (path.is_error())
return path.error();
auto result = VFS::the().open(path.value(), O_RDONLY | O_NOFOLLOW_NOERROR, 0, current_directory());
Kernel: Port more code to KResult and KResultOr<T>.
2019-03-06 21:14:31 +00:00
if (result.is_error())
return result.error();
Kernel: Rename "descriptor" to "description" where appropriate. Now that FileDescription is called that, variables of that type should not be called "descriptor". This is kinda wordy but we'll get used to it.
2019-06-13 20:03:04 +00:00
auto description = result.value();
Add basic symlink support. - sys$readlink + readlink() - Add a /proc/PID/exe symlink to the process's executable. - Print symlink contents in ls output. - Some work on plumbing options into VFS::open().
2018-10-28 13:11:51 +00:00
Kernel: Rename "descriptor" to "description" where appropriate. Now that FileDescription is called that, variables of that type should not be called "descriptor". This is kinda wordy but we'll get used to it.
2019-06-13 20:03:04 +00:00
if (!description->metadata().is_symlink())
Add basic symlink support. - sys$readlink + readlink() - Add a /proc/PID/exe symlink to the process's executable. - Print symlink contents in ls output. - Some work on plumbing options into VFS::open().
2018-10-28 13:11:51 +00:00
return -EINVAL;
Kernel: Rename "descriptor" to "description" where appropriate. Now that FileDescription is called that, variables of that type should not be called "descriptor". This is kinda wordy but we'll get used to it.
2019-06-13 20:03:04 +00:00
auto contents = description->read_entire_file();
Add basic symlink support. - sys$readlink + readlink() - Add a /proc/PID/exe symlink to the process's executable. - Print symlink contents in ls output. - Some work on plumbing options into VFS::open().
2018-10-28 13:11:51 +00:00
if (!contents)
return -EIO; // FIXME: Get a more detailed error from VFS.
Kernel: Pass characters+length to readlink() Note that I'm developing some helper types in the Syscall namespace as I go here. Once I settle on some nice types, I will convert all the other syscalls to use them as well.
2020-01-10 19:13:23 +00:00
auto link_target = String::copy(contents);
if (link_target.length() + 1 > params.buffer.size)
return -ENAMETOOLONG;
copy_to_user(params.buffer.data, link_target.characters(), link_target.length() + 1);
Kernel: sys$readlink() should return the number of bytes written out
2020-01-27 20:47:30 +00:00
return link_target.length() + 1;
Add basic symlink support. - sys$readlink + readlink() - Add a /proc/PID/exe symlink to the process's executable. - Print symlink contents in ls output. - Some work on plumbing options into VFS::open().
2018-10-28 13:11:51 +00:00
}
Kernel: Make chdir() take path+length
2020-01-05 21:06:25 +00:00
int Process::sys$chdir(const char* user_path, size_t path_length)
Add a "pwd" utility to userland. It's implemented as a separate process. How cute is that. Tasks now have a current working directory. Spawned tasks inherit their parent task's working directory. Currently everyone just uses "/" as there's no way to chdir().
2018-10-24 12:28:22 +00:00
{
ping: Use pledge()
2020-01-11 19:48:43 +00:00
REQUIRE_PROMISE(rpath);
Kernel: Use get_syscall_path_argument() for syscalls that take paths
2020-01-06 10:10:38 +00:00
auto path = get_syscall_path_argument(user_path, path_length);
if (path.is_error())
return path.error();
auto directory_or_error = VFS::the().open_directory(path.value(), current_directory());
Kernel: Support chdir() to a directory that's executable but not readable. Also the superuser should be allowed to resolve any possible path without getting tripped up by EACCES.
2019-03-01 22:54:07 +00:00
if (directory_or_error.is_error())
return directory_or_error.error();
Kernel: Rename Process::cwd_custody() to Process::current_directory(). ...and executable_custody() to just executable().
2019-05-30 18:23:50 +00:00
m_cwd = *directory_or_error.value();
Add a "pwd" utility to userland. It's implemented as a separate process. How cute is that. Tasks now have a current working directory. Spawned tasks inherit their parent task's working directory. Currently everyone just uses "/" as there's no way to chdir().
2018-10-24 12:28:22 +00:00
return 0;
}
Kernel: Implement fchdir syscall The fchdir() function is equivalent to chdir() except that the directory that is to be the new current working directory is specified by a file descriptor.
2019-09-11 23:18:25 +00:00
int Process::sys$fchdir(int fd)
{
ping: Use pledge()
2020-01-11 19:48:43 +00:00
REQUIRE_PROMISE(stdio);
Kernel: Make Process::file_description() vend a RefPtr<FileDescription> This encourages callers to strongly reference file descriptions while working with them. This fixes a use-after-free issue where one thread would close() an open fd while another thread was blocked on it becoming readable. Test: Kernel/uaf-close-while-blocked-in-read.cpp
2020-01-07 14:53:42 +00:00
auto description = file_description(fd);
Kernel: Implement fchdir syscall The fchdir() function is equivalent to chdir() except that the directory that is to be the new current working directory is specified by a file descriptor.
2019-09-11 23:18:25 +00:00
if (!description)
return -EBADF;
if (!description->is_directory())
ELF: Fail layout when program header hooks return nullptr (#673) ELFLoader::layout() had a "failed" variable that was never set. This patch checks the return value of each hook (alloc/map section and tls) and fails the load if they return null. I also needed to patch Process so that the alloc_section_hook and map_section_hook actually return nullptr when allocating a region fails. Fixes #664 :)
2019-10-20 14:24:42 +00:00
return -ENOTDIR;
Kernel: Implement fchdir syscall The fchdir() function is equivalent to chdir() except that the directory that is to be the new current working directory is specified by a file descriptor.
2019-09-11 23:18:25 +00:00
Kernel: fchdir() should fail for non-searchable directories So sayeth POSIX.
2019-09-13 12:35:18 +00:00
if (!description->metadata().may_execute(*this))
return -EACCES;
Kernel: Implement fchdir syscall The fchdir() function is equivalent to chdir() except that the directory that is to be the new current working directory is specified by a file descriptor.
2019-09-11 23:18:25 +00:00
m_cwd = description->custody();
return 0;
}
Kernel: Make syscalls that take a buffer size use ssize_t instead of size_t. Dealing with the unsigned overflow propagation here just seems unreasonably error prone. Let's limit ourselves to 2GB buffer sizes instead.
2019-02-25 20:19:57 +00:00
int Process::sys$getcwd(char* buffer, ssize_t size)
Implement sys$chdir() and teach sh+ls to cd around and browse different dirs.
2018-10-26 12:24:11 +00:00
{
ping: Use pledge()
2020-01-11 19:48:43 +00:00
REQUIRE_PROMISE(rpath);
Kernel: Make syscalls that take a buffer size use ssize_t instead of size_t. Dealing with the unsigned overflow propagation here just seems unreasonably error prone. Let's limit ourselves to 2GB buffer sizes instead.
2019-02-25 20:19:57 +00:00
if (size < 0)
return -EINVAL;
Improve syscall address validation a bit.
2018-11-16 15:10:59 +00:00
if (!validate_write(buffer, size))
return -EFAULT;
Kernel: Rename Process::cwd_custody() to Process::current_directory(). ...and executable_custody() to just executable().
2019-05-30 18:23:50 +00:00
auto path = current_directory().absolute_path();
AK: Use size_t for the length of strings Using int was a mistake. This patch changes String, StringImpl, StringView and StringBuilder to use size_t instead of int for lengths. Obviously a lot of code needs to change as a result of this.
2019-12-09 16:45:40 +00:00
if ((size_t)size < path.length() + 1)
Implement sys$getcwd properly. Also fixed broken strcpy that didn't copy the null terminator.
2018-10-29 23:06:31 +00:00
return -ERANGE;
Kernel: Start implementing x86 SMAP support Supervisor Mode Access Prevention (SMAP) is an x86 CPU feature that prevents the kernel from accessing userspace memory. With SMAP enabled, trying to read/write a userspace memory address while in the kernel will now generate a page fault. Since it's sometimes necessary to read/write userspace memory, there are two new instructions that quickly switch the protection on/off: STAC (disables protection) and CLAC (enables protection.) These are exposed in kernel code via the stac() and clac() helpers. There's also a SmapDisabler RAII object that can be used to ensure that you don't forget to re-enable protection before returning to userspace code. THis patch also adds copy_to_user(), copy_from_user() and memset_user() which are the "correct" way of doing things. These functions allow us to briefly disable protection for a specific purpose, and then turn it back on immediately after it's done. Going forward all kernel code should be moved to using these and all uses of SmapDisabler are to be considered FIXME's. Note that we're not realizing the full potential of this feature since I've used SmapDisabler quite liberally in this initial bring-up patch.
2020-01-05 17:00:15 +00:00
copy_to_user(buffer, path.characters(), path.length() + 1);
Rage hacking to get bash to run. It finally runs. So cool! :^)
2018-11-11 14:36:40 +00:00
return 0;
Implement sys$chdir() and teach sh+ls to cd around and browse different dirs.
2018-10-26 12:24:11 +00:00
}
Kernel: And some more KResult/KResultOr<T> porting work.
2019-03-06 21:30:13 +00:00
int Process::number_of_open_file_descriptors() const
Preallocate the maximum number of FileHandle pointers (fds) in every process. This could even use a more specific data structure since it doesn't need the grow/shrink capabilities of a vector.
2018-11-01 12:39:28 +00:00
{
Kernel: And some more KResult/KResultOr<T> porting work.
2019-03-06 21:30:13 +00:00
int count = 0;
Kernel: Rename "descriptor" to "description" where appropriate. Now that FileDescription is called that, variables of that type should not be called "descriptor". This is kinda wordy but we'll get used to it.
2019-06-13 20:03:04 +00:00
for (auto& description : m_fds) {
if (description)
Preallocate the maximum number of FileHandle pointers (fds) in every process. This could even use a more specific data structure since it doesn't need the grow/shrink capabilities of a vector.
2018-11-01 12:39:28 +00:00
++count;
}
return count;
}
Kernel: Remove SmapDisablers in open(), openat() and set_thread_name() This patch introduces a helpful copy_string_from_user() function that takes a bounded null-terminated string from userspace memory and copies it into a String object.
2020-01-05 20:51:06 +00:00
int Process::sys$open(const Syscall::SC_open_params* user_params)
Import the "gerbert" kernel I worked on earlier this year. It's a lot crappier than I remembered it. It's gonna need a lot of work.
2018-10-16 09:01:38 +00:00
{
Kernel: Combine validate and copy of user mode pointers (#1069) Right now there is a significant amount of boiler plate code required to validate user mode parameters in syscalls. In an attempt to reduce this a bit, introduce validate_read_and_copy_typed which combines the usermode address check and does the copy internally if the validation passes. This cleans up a little bit of code from a significant amount of syscalls.
2020-01-13 10:19:18 +00:00
Syscall::SC_open_params params;
if (!validate_read_and_copy_typed(&params, user_params))
Kernel: Have the open() syscall take an explicit path length parameter. Instead of computing the path length inside the syscall handler, let the caller do that work. This allows us to implement to new variants of open() and creat(), called open_with_path_length() and creat_with_path_length(). These are suitable for use with e.g StringView.
2019-07-08 18:01:49 +00:00
return -EFAULT;
Kernel: Start implementing x86 SMAP support Supervisor Mode Access Prevention (SMAP) is an x86 CPU feature that prevents the kernel from accessing userspace memory. With SMAP enabled, trying to read/write a userspace memory address while in the kernel will now generate a page fault. Since it's sometimes necessary to read/write userspace memory, there are two new instructions that quickly switch the protection on/off: STAC (disables protection) and CLAC (enables protection.) These are exposed in kernel code via the stac() and clac() helpers. There's also a SmapDisabler RAII object that can be used to ensure that you don't forget to re-enable protection before returning to userspace code. THis patch also adds copy_to_user(), copy_from_user() and memset_user() which are the "correct" way of doing things. These functions allow us to briefly disable protection for a specific purpose, and then turn it back on immediately after it's done. Going forward all kernel code should be moved to using these and all uses of SmapDisabler are to be considered FIXME's. Note that we're not realizing the full potential of this feature since I've used SmapDisabler quite liberally in this initial bring-up patch.
2020-01-05 17:00:15 +00:00
Kernel: Remove SmapDisablers in open(), openat() and set_thread_name() This patch introduces a helpful copy_string_from_user() function that takes a bounded null-terminated string from userspace memory and copies it into a String object.
2020-01-05 20:51:06 +00:00
int dirfd = params.dirfd;
int options = params.options;
u16 mode = params.mode;
Kernel: Fix bad TOCTOU pattern in syscalls that take a parameter struct Our syscall calling convention only allows passing up to 3 arguments in registers. For syscalls that take more arguments, we bake them into a struct and pass a pointer to that struct instead. When doing pointer validation, this is what we would do: 1) Validate the "params" struct 2) Validate "params->some_pointer" 3) ... other stuff ... 4) Use "params->some_pointer" Since the parameter struct is stored in userspace, it can be modified by userspace after validation has completed. This was a recurring pattern in many syscalls that was further hidden by me using structured binding declarations to give convenient local names to things in the parameter struct: auto& [some_pointer, ...] = *params; memcpy(some_pointer, ...); This devilishly makes "some_pointer" look like a local variable but it's actually more like an alias for "params->some_pointer" and will expand to a dereference when accessed! This patch fixes the issues by explicitly copying out each member from the parameter structs before validating them, and then never using the "param" pointers beyond that. Thanks to braindead for finding this bug! :^)
2020-01-05 08:13:00 +00:00
Kernel: Don't allow userspace to sys$open() literal symlinks The O_NOFOLLOW_NOERROR is an internal kernel mechanism used for the implementation of sys$readlink() and sys$lstat(). There is no reason to allow userspace to open symlinks directly.
2020-01-15 20:19:26 +00:00
if (options & O_NOFOLLOW_NOERROR)
return -EINVAL;
Kernel: Add a basic implementation of unveil() This syscall is a complement to pledge() and adds the same sort of incremental relinquishing of capabilities for filesystem access. The first call to unveil() will "drop a veil" on the process, and from now on, only unveiled parts of the filesystem are visible to it. Each call to unveil() specifies a path to either a directory or a file along with permissions for that path. The permissions are a combination of the following: - r: Read access (like the "rpath" promise) - w: Write access (like the "wpath" promise) - x: Execute access - c: Create/remove access (like the "cpath" promise) Attempts to open a path that has not been unveiled with fail with ENOENT. If the unveiled path lacks sufficient permissions, it will fail with EACCES. Like pledge(), subsequent calls to unveil() with the same path can only remove permissions, not add them. Once you call unveil(nullptr, nullptr), the veil is locked, and it's no longer possible to unveil any more paths for the process, ever. This concept comes from OpenBSD, and their implementation does various things differently, I'm sure. This is just a first implementation for SerenityOS, and we'll keep improving on it as we go. :^)
2020-01-20 21:12:04 +00:00
if (options & O_UNLINK_INTERNAL)
return -EINVAL;
Kernel: Make O_RDONLY non-zero Sergey suggested that having a non-zero O_RDONLY would make some things less confusing, and it seems like he's right about that. We can now easily check read/write permissions separately instead of dancing around with the bits. This patch also fixes unveil() validation for O_RDWR which previously forgot to check for "r" permission.
2020-01-21 12:14:26 +00:00
if (options & O_WRONLY)
ping: Use pledge()
2020-01-11 19:48:43 +00:00
REQUIRE_PROMISE(wpath);
Kernel: Make O_RDONLY non-zero Sergey suggested that having a non-zero O_RDONLY would make some things less confusing, and it seems like he's right about that. We can now easily check read/write permissions separately instead of dancing around with the bits. This patch also fixes unveil() validation for O_RDWR which previously forgot to check for "r" permission.
2020-01-21 12:14:26 +00:00
else if (options & O_RDONLY)
ping: Use pledge()
2020-01-11 19:48:43 +00:00
REQUIRE_PROMISE(rpath);
if (options & O_CREAT)
REQUIRE_PROMISE(cpath);
Kernel: open() and openat() should ignore non-permission bits in mode
2020-01-08 12:59:22 +00:00
// Ignore everything except permission bits.
mode &= 04777;
Kernel: Use the Syscall string and buffer types more While I was updating syscalls to stop passing null-terminated strings, I added some helpful struct types: - StringArgument { const char*; size_t; } - ImmutableBuffer<Data, Size> { const Data*; Size; } - MutableBuffer<Data, Size> { Data*; Size; } The Process class has some convenience functions for validating and optionally extracting the contents from these structs: - get_syscall_path_argument(StringArgument) - validate_and_copy_string_from_user(StringArgument) - validate(ImmutableBuffer) - validate(MutableBuffer) There's still so much code around this and I'm wondering if we should generate most of it instead. Possible nice little project.
2020-01-11 11:47:47 +00:00
auto path = get_syscall_path_argument(params.path);
if (path.is_error())
return path.error();
Kernel+LibC: Implement the openat() syscall POSIX's openat() is very similar to open(), except you also provide a file descriptor referring to a directory from which relative paths should be resolved. Passing it the magical fd number AT_FDCWD means "resolve from current directory" (which is indeed also what open() normally does.) This fixes libarchive's bsdtar, since it was trying to do something extremely wrong in the absence of openat() support. The issue has recently been fixed upstream in libarchive: https://github.com/libarchive/libarchive/issues/1239 However, we should have openat() support anyway, so I went ahead and implemented it. :^) Fixes #748.
2019-11-10 12:47:02 +00:00
#ifdef DEBUG_IO
Kernel+LibC: Unify sys$open() and sys$openat() The syscall is now called sys$open(), but it behaves like the old sys$openat(). In userspace, open_with_path_length() is made a wrapper over openat_with_path_length().
2020-01-17 18:48:44 +00:00
dbgprintf("%s(%u) sys$open(%d, \"%s\")\n", dirfd, name().characters(), pid(), path.value().characters());
Kernel+LibC: Implement the openat() syscall POSIX's openat() is very similar to open(), except you also provide a file descriptor referring to a directory from which relative paths should be resolved. Passing it the magical fd number AT_FDCWD means "resolve from current directory" (which is indeed also what open() normally does.) This fixes libarchive's bsdtar, since it was trying to do something extremely wrong in the absence of openat() support. The issue has recently been fixed upstream in libarchive: https://github.com/libarchive/libarchive/issues/1239 However, we should have openat() support anyway, so I went ahead and implemented it. :^) Fixes #748.
2019-11-10 12:47:02 +00:00
#endif
Kernel: Use alloc_fd() more instead of walking fd list manually.
2019-04-06 12:54:32 +00:00
int fd = alloc_fd();
if (fd < 0)
return fd;
Kernel+LibC: Implement the openat() syscall POSIX's openat() is very similar to open(), except you also provide a file descriptor referring to a directory from which relative paths should be resolved. Passing it the magical fd number AT_FDCWD means "resolve from current directory" (which is indeed also what open() normally does.) This fixes libarchive's bsdtar, since it was trying to do something extremely wrong in the absence of openat() support. The issue has recently been fixed upstream in libarchive: https://github.com/libarchive/libarchive/issues/1239 However, we should have openat() support anyway, so I went ahead and implemented it. :^) Fixes #748.
2019-11-10 12:47:02 +00:00
RefPtr<Custody> base;
if (dirfd == AT_FDCWD) {
base = current_directory();
} else {
Kernel: Make Process::file_description() vend a RefPtr<FileDescription> This encourages callers to strongly reference file descriptions while working with them. This fixes a use-after-free issue where one thread would close() an open fd while another thread was blocked on it becoming readable. Test: Kernel/uaf-close-while-blocked-in-read.cpp
2020-01-07 14:53:42 +00:00
auto base_description = file_description(dirfd);
Kernel+LibC: Implement the openat() syscall POSIX's openat() is very similar to open(), except you also provide a file descriptor referring to a directory from which relative paths should be resolved. Passing it the magical fd number AT_FDCWD means "resolve from current directory" (which is indeed also what open() normally does.) This fixes libarchive's bsdtar, since it was trying to do something extremely wrong in the absence of openat() support. The issue has recently been fixed upstream in libarchive: https://github.com/libarchive/libarchive/issues/1239 However, we should have openat() support anyway, so I went ahead and implemented it. :^) Fixes #748.
2019-11-10 12:47:02 +00:00
if (!base_description)
return -EBADF;
if (!base_description->is_directory())
return -ENOTDIR;
if (!base_description->custody())
return -EINVAL;
base = base_description->custody();
}
Kernel: Use the Syscall string and buffer types more While I was updating syscalls to stop passing null-terminated strings, I added some helpful struct types: - StringArgument { const char*; size_t; } - ImmutableBuffer<Data, Size> { const Data*; Size; } - MutableBuffer<Data, Size> { Data*; Size; } The Process class has some convenience functions for validating and optionally extracting the contents from these structs: - get_syscall_path_argument(StringArgument) - validate_and_copy_string_from_user(StringArgument) - validate(ImmutableBuffer) - validate(MutableBuffer) There's still so much code around this and I'm wondering if we should generate most of it instead. Possible nice little project.
2020-01-11 11:47:47 +00:00
auto result = VFS::the().open(path.value(), options, mode & ~umask(), *base);
Kernel: Port more code to KResult and KResultOr<T>.
2019-03-06 21:14:31 +00:00
if (result.is_error())
return result.error();
Kernel: Rename "descriptor" to "description" where appropriate. Now that FileDescription is called that, variables of that type should not be called "descriptor". This is kinda wordy but we'll get used to it.
2019-06-13 20:03:04 +00:00
auto description = result.value();
AK: Rename the common integer typedefs to make it obvious what they are. These types can be picked up by including <AK/Types.h>: * u8, u16, u32, u64 (unsigned) * i8, i16, i32, i64 (signed)
2019-07-03 19:17:35 +00:00
u32 fd_flags = (options & O_CLOEXEC) ? FD_CLOEXEC : 0;
Kernel: Rename "descriptor" to "description" where appropriate. Now that FileDescription is called that, variables of that type should not be called "descriptor". This is kinda wordy but we'll get used to it.
2019-06-13 20:03:04 +00:00
m_fds[fd].set(move(description), fd_flags);
Add per-task limit for open fd's. Hard-coded at 16 for now.
2018-10-26 12:30:13 +00:00
return fd;
Import the "gerbert" kernel I worked on earlier this year. It's a lot crappier than I remembered it. It's gonna need a lot of work.
2018-10-16 09:01:38 +00:00
}
Kernel: Use alloc_fd() more instead of walking fd list manually.
2019-04-06 12:54:32 +00:00
int Process::alloc_fd(int first_candidate_fd)
Add primitive FIFO and hook it up to sys$pipe(). It's now possible to do this in bash: cat kernel.map | fgrep List This is very cool! :^)
2018-11-12 00:28:46 +00:00
{
Kernel: Use alloc_fd() more instead of walking fd list manually.
2019-04-06 12:54:32 +00:00
for (int i = first_candidate_fd; i < (int)m_max_open_file_descriptors; ++i) {
Kernel: Misc tweaks
2020-01-20 12:18:54 +00:00
if (!m_fds[i])
return i;
Add primitive FIFO and hook it up to sys$pipe(). It's now possible to do this in bash: cat kernel.map | fgrep List This is very cool! :^)
2018-11-12 00:28:46 +00:00
}
Kernel: Misc tweaks
2020-01-20 12:18:54 +00:00
return -EMFILE;
Add primitive FIFO and hook it up to sys$pipe(). It's now possible to do this in bash: cat kernel.map | fgrep List This is very cool! :^)
2018-11-12 00:28:46 +00:00
}
Kernel+LibC: Support passing O_CLOEXEC to pipe() In the userspace, this mimics the Linux pipe2() syscall; in the kernel, the Process::sys$pipe() now always accepts a flags argument, the no-argument pipe() syscall is now a userspace wrapper over pipe2().
2019-08-05 12:29:05 +00:00
int Process::sys$pipe(int pipefd[2], int flags)
A bunch of compat work (mostly stubs but some real implementations, too.) Another pass at getting bash-1.14.7 to build. Not that many symbols remain.
2018-11-10 23:20:53 +00:00
{
ping: Use pledge()
2020-01-11 19:48:43 +00:00
REQUIRE_PROMISE(stdio);
Add templated helpers for read/write validation, and one for strings, too.
2018-11-16 15:23:39 +00:00
if (!validate_write_typed(pipefd))
Improve syscall address validation a bit.
2018-11-16 15:10:59 +00:00
return -EFAULT;
Add primitive FIFO and hook it up to sys$pipe(). It's now possible to do this in bash: cat kernel.map | fgrep List This is very cool! :^)
2018-11-12 00:28:46 +00:00
if (number_of_open_file_descriptors() + 2 > max_open_file_descriptors())
return -EMFILE;
Kernel+LibC: Support passing O_CLOEXEC to pipe() In the userspace, this mimics the Linux pipe2() syscall; in the kernel, the Process::sys$pipe() now always accepts a flags argument, the no-argument pipe() syscall is now a userspace wrapper over pipe2().
2019-08-05 12:29:05 +00:00
// Reject flags other than O_CLOEXEC.
if ((flags & O_CLOEXEC) != flags)
return -EINVAL;
u32 fd_flags = (flags & O_CLOEXEC) ? FD_CLOEXEC : 0;
Kernel: Make it possible to look up FIFO's by ID. This will be useful when implementing the /proc/PID/fd/N links where N is a file descriptor referring to a FIFO.
2019-04-25 11:52:07 +00:00
auto fifo = FIFO::create(m_uid);
Add primitive FIFO and hook it up to sys$pipe(). It's now possible to do this in bash: cat kernel.map | fgrep List This is very cool! :^)
2018-11-12 00:28:46 +00:00
int reader_fd = alloc_fd();
Kernel+LibC: Support passing O_CLOEXEC to pipe() In the userspace, this mimics the Linux pipe2() syscall; in the kernel, the Process::sys$pipe() now always accepts a flags argument, the no-argument pipe() syscall is now a userspace wrapper over pipe2().
2019-08-05 12:29:05 +00:00
m_fds[reader_fd].set(fifo->open_direction(FIFO::Direction::Reader), fd_flags);
Kernel: read() and write() should fail with EBADF for wrong mode fd's It was previously possible to write to read-only file descriptors, and read from write-only file descriptors. All FileDescription objects now start out non-readable + non-writable, and whoever is creating them has to "manually" enable reading/writing by calling set_readable() and/or set_writable() on them.
2020-01-03 02:29:59 +00:00
m_fds[reader_fd].description->set_readable(true);
Kernel: Use the templated copy_to/from_user() in more places These ensure that the "to" and "from" pointers have the same type, and also that we copy the correct number of bytes.
2020-01-20 12:38:31 +00:00
copy_to_user(&pipefd[0], &reader_fd);
Add primitive FIFO and hook it up to sys$pipe(). It's now possible to do this in bash: cat kernel.map | fgrep List This is very cool! :^)
2018-11-12 00:28:46 +00:00
int writer_fd = alloc_fd();
Kernel+LibC: Support passing O_CLOEXEC to pipe() In the userspace, this mimics the Linux pipe2() syscall; in the kernel, the Process::sys$pipe() now always accepts a flags argument, the no-argument pipe() syscall is now a userspace wrapper over pipe2().
2019-08-05 12:29:05 +00:00
m_fds[writer_fd].set(fifo->open_direction(FIFO::Direction::Writer), fd_flags);
Kernel: read() and write() should fail with EBADF for wrong mode fd's It was previously possible to write to read-only file descriptors, and read from write-only file descriptors. All FileDescription objects now start out non-readable + non-writable, and whoever is creating them has to "manually" enable reading/writing by calling set_readable() and/or set_writable() on them.
2020-01-03 02:29:59 +00:00
m_fds[writer_fd].description->set_writable(true);
Kernel: Use the templated copy_to/from_user() in more places These ensure that the "to" and "from" pointers have the same type, and also that we copy the correct number of bytes.
2020-01-20 12:38:31 +00:00
copy_to_user(&pipefd[1], &writer_fd);
Add primitive FIFO and hook it up to sys$pipe(). It's now possible to do this in bash: cat kernel.map | fgrep List This is very cool! :^)
2018-11-12 00:28:46 +00:00
return 0;
A bunch of compat work (mostly stubs but some real implementations, too.) Another pass at getting bash-1.14.7 to build. Not that many symbols remain.
2018-11-10 23:20:53 +00:00
}
int Process::sys$killpg(int pgrp, int signum)
{
ping: Use pledge()
2020-01-11 19:48:43 +00:00
REQUIRE_PROMISE(proc);
A bunch of compat work (mostly stubs but some real implementations, too.) Another pass at getting bash-1.14.7 to build. Not that many symbols remain.
2018-11-10 23:20:53 +00:00
if (signum < 1 || signum >= 32)
return -EINVAL;
Kernel: Implement the killpg() syscall
2019-11-14 16:16:30 +00:00
if (pgrp < 0)
return -EINVAL;
InterruptDisabler disabler;
return do_killpg(pgrp, signum);
A bunch of compat work (mostly stubs but some real implementations, too.) Another pass at getting bash-1.14.7 to build. Not that many symbols remain.
2018-11-10 23:20:53 +00:00
}
Kernel+Userland: Implement setuid() and setgid() and add /bin/su Also show setuid and setgid bits in "ls -l" output. :^)
2019-02-21 22:35:07 +00:00
int Process::sys$setuid(uid_t uid)
A bunch of compat work (mostly stubs but some real implementations, too.) Another pass at getting bash-1.14.7 to build. Not that many symbols remain.
2018-11-10 23:20:53 +00:00
{
ping: Use pledge()
2020-01-11 19:48:43 +00:00
REQUIRE_PROMISE(id);
Kernel+Userland: Implement setuid() and setgid() and add /bin/su Also show setuid and setgid bits in "ls -l" output. :^)
2019-02-21 22:35:07 +00:00
if (uid != m_uid && !is_superuser())
return -EPERM;
m_uid = uid;
m_euid = uid;
return 0;
A bunch of compat work (mostly stubs but some real implementations, too.) Another pass at getting bash-1.14.7 to build. Not that many symbols remain.
2018-11-10 23:20:53 +00:00
}
Kernel+Userland: Implement setuid() and setgid() and add /bin/su Also show setuid and setgid bits in "ls -l" output. :^)
2019-02-21 22:35:07 +00:00
int Process::sys$setgid(gid_t gid)
A bunch of compat work (mostly stubs but some real implementations, too.) Another pass at getting bash-1.14.7 to build. Not that many symbols remain.
2018-11-10 23:20:53 +00:00
{
ping: Use pledge()
2020-01-11 19:48:43 +00:00
REQUIRE_PROMISE(id);
Kernel+Userland: Implement setuid() and setgid() and add /bin/su Also show setuid and setgid bits in "ls -l" output. :^)
2019-02-21 22:35:07 +00:00
if (gid != m_gid && !is_superuser())
return -EPERM;
m_gid = gid;
m_egid = gid;
return 0;
A bunch of compat work (mostly stubs but some real implementations, too.) Another pass at getting bash-1.14.7 to build. Not that many symbols remain.
2018-11-10 23:20:53 +00:00
}
unsigned Process::sys$alarm(unsigned seconds)
{
ping: Use pledge()
2020-01-11 19:48:43 +00:00
REQUIRE_PROMISE(stdio);
Kernel: Implement the alarm() syscall.
2019-06-07 09:30:07 +00:00
unsigned previous_alarm_remaining = 0;
if (m_alarm_deadline && m_alarm_deadline > g_uptime) {
previous_alarm_remaining = (m_alarm_deadline - g_uptime) / TICKS_PER_SECOND;
}
if (!seconds) {
m_alarm_deadline = 0;
return previous_alarm_remaining;
}
m_alarm_deadline = g_uptime + seconds * TICKS_PER_SECOND;
return previous_alarm_remaining;
A bunch of compat work (mostly stubs but some real implementations, too.) Another pass at getting bash-1.14.7 to build. Not that many symbols remain.
2018-11-10 23:20:53 +00:00
}
Process now maps regions immediately when they are allocated. This avoids having to do a separate MM.mapRegionsForTask() pass. Also, more Task => Process renaming that I apparently hadn't saved yet.
2018-11-01 12:15:46 +00:00
int Process::sys$uname(utsname* buf)
Add sys$uname() and a /bin/uname utility.
2018-10-26 12:56:21 +00:00
{
ping: Use pledge()
2020-01-11 19:48:43 +00:00
REQUIRE_PROMISE(stdio);
Add templated helpers for read/write validation, and one for strings, too.
2018-11-16 15:23:39 +00:00
if (!validate_write_typed(buf))
Improve syscall address validation a bit.
2018-11-16 15:10:59 +00:00
return -EFAULT;
Kernel: Don't disable interrupts to access the system hostname.
2019-02-07 09:29:26 +00:00
LOCKER(*s_hostname_lock);
Kernel: Start implementing x86 SMAP support Supervisor Mode Access Prevention (SMAP) is an x86 CPU feature that prevents the kernel from accessing userspace memory. With SMAP enabled, trying to read/write a userspace memory address while in the kernel will now generate a page fault. Since it's sometimes necessary to read/write userspace memory, there are two new instructions that quickly switch the protection on/off: STAC (disables protection) and CLAC (enables protection.) These are exposed in kernel code via the stac() and clac() helpers. There's also a SmapDisabler RAII object that can be used to ensure that you don't forget to re-enable protection before returning to userspace code. THis patch also adds copy_to_user(), copy_from_user() and memset_user() which are the "correct" way of doing things. These functions allow us to briefly disable protection for a specific purpose, and then turn it back on immediately after it's done. Going forward all kernel code should be moved to using these and all uses of SmapDisabler are to be considered FIXME's. Note that we're not realizing the full potential of this feature since I've used SmapDisabler quite liberally in this initial bring-up patch.
2020-01-05 17:00:15 +00:00
if (s_hostname->length() + 1 > sizeof(utsname::nodename))
return -ENAMETOOLONG;
copy_to_user(buf->sysname, "SerenityOS", 11);
copy_to_user(buf->release, "1.0-dev", 8);
copy_to_user(buf->version, "FIXME", 6);
copy_to_user(buf->machine, "i686", 5);
copy_to_user(buf->nodename, s_hostname->characters(), s_hostname->length() + 1);
Add sys$uname() and a /bin/uname utility.
2018-10-26 12:56:21 +00:00
return 0;
}
Kernel: Implement the killpg() syscall
2019-11-14 16:16:30 +00:00
KResult Process::do_kill(Process& process, int signal)
{
// FIXME: Allow sending SIGCONT to everyone in the process group.
// FIXME: Should setuid processes have some special treatment here?
if (!is_superuser() && m_euid != process.m_uid && m_uid != process.m_uid)
return KResult(-EPERM);
if (process.is_ring0() && signal == SIGKILL) {
kprintf("%s(%u) attempted to send SIGKILL to ring 0 process %s(%u)\n", name().characters(), m_pid, process.name().characters(), process.pid());
return KResult(-EPERM);
}
Kernel: kill() with signal 0 should not actually send anything Also kill() with pid 0 should send to everyone in the same process group as the calling process.
2020-01-03 01:01:45 +00:00
if (signal != 0)
process.send_signal(signal, this);
Kernel: Implement the killpg() syscall
2019-11-14 16:16:30 +00:00
return KSuccess;
}
KResult Process::do_killpg(pid_t pgrp, int signal)
{
ASSERT(pgrp >= 0);
// Send the signal to all processes in the given group.
if (pgrp == 0) {
// Send the signal to our own pgrp.
pgrp = pgid();
}
bool group_was_empty = true;
bool any_succeeded = false;
KResult error = KSuccess;
Process::for_each_in_pgrp(pgrp, [&](auto& process) {
group_was_empty = false;
KResult res = do_kill(process, signal);
if (res.is_success())
any_succeeded = true;
else
error = res;
return IterationDecision::Continue;
});
if (group_was_empty)
return KResult(-ESRCH);
if (any_succeeded)
return KSuccess;
return error;
}
Basic ^C interrupt implementation. For testing, I made cat put itself into a new process group. This should eventually be done by sh between fork() and exec().
2018-11-02 13:06:48 +00:00
int Process::sys$kill(pid_t pid, int signal)
Import the "gerbert" kernel I worked on earlier this year. It's a lot crappier than I remembered it. It's gonna need a lot of work.
2018-10-16 09:01:38 +00:00
{
Kernel: Only require "stdio" pledge for sending signals to self This should match what OpenBSD does. Sending a signal to yourself seems basically harmless.
2020-01-19 07:50:55 +00:00
if (pid == m_pid)
REQUIRE_PROMISE(stdio);
else
REQUIRE_PROMISE(proc);
Kernel: Only allow sending signals to process you own.
2019-02-28 10:45:45 +00:00
if (signal < 0 || signal >= 32)
return -EINVAL;
Kernel: Remove unnecessary logic in kill() and killpg() syscalls As Sergey pointed out, do_killpg() already interprets PID 0 as the PGID of the calling process.
2020-01-03 11:58:59 +00:00
if (pid <= 0)
Kernel: Implement the killpg() syscall
2019-11-14 16:16:30 +00:00
return do_killpg(-pid, signal);
Import the "gerbert" kernel I worked on earlier this year. It's a lot crappier than I remembered it. It's gonna need a lot of work.
2018-10-16 09:01:38 +00:00
if (pid == -1) {
// FIXME: Send to all processes.
Kernel: kill() with signal 0 should not actually send anything Also kill() with pid 0 should send to everyone in the same process group as the calling process.
2020-01-03 01:01:45 +00:00
return -ENOTIMPL;
Import the "gerbert" kernel I worked on earlier this year. It's a lot crappier than I remembered it. It's gonna need a lot of work.
2018-10-16 09:01:38 +00:00
}
Kernel: kill() syscall should support sending a signal to yourself.
2019-02-28 08:44:48 +00:00
if (pid == m_pid) {
Kernel: kill() with signal 0 should not actually send anything Also kill() with pid 0 should send to everyone in the same process group as the calling process.
2020-01-03 01:01:45 +00:00
if (signal == 0)
return 0;
if (!current->should_ignore_signal(signal)) {
current->send_signal(signal, this);
(void)current->block<Thread::SemiPermanentBlocker>(Thread::SemiPermanentBlocker::Reason::Signal);
}
Kernel: kill() syscall should support sending a signal to yourself.
2019-02-28 08:44:48 +00:00
return 0;
}
Kernel: Only allow sending signals to process you own.
2019-02-28 10:45:45 +00:00
InterruptDisabler disabler;
auto* peer = Process::from_pid(pid);
Implement basic sys$kill() and add a /bin/kill All it can do right now is send SIGKILL which just murders the target task.
2018-10-31 00:06:57 +00:00
if (!peer)
return -ESRCH;
Kernel: Implement the killpg() syscall
2019-11-14 16:16:30 +00:00
return do_kill(*peer, signal);
Import the "gerbert" kernel I worked on earlier this year. It's a lot crappier than I remembered it. It's gonna need a lot of work.
2018-10-16 09:01:38 +00:00
}
Get nyancat nyanning in Serenity. I found a cute program that renders an animated nyancat in the terminal. This patch adds enough hackery to get it working correctly. :^)
2019-02-03 15:11:28 +00:00
int Process::sys$usleep(useconds_t usec)
{
ping: Use pledge()
2020-01-11 19:48:43 +00:00
REQUIRE_PROMISE(stdio);
Get nyancat nyanning in Serenity. I found a cute program that renders an animated nyancat in the terminal. This patch adds enough hackery to get it working correctly. :^)
2019-02-03 15:11:28 +00:00
if (!usec)
return 0;
Kernel: Port sleep to ThreadBlocker
2019-07-18 15:26:11 +00:00
u64 wakeup_time = current->sleep(usec / 1000);
Kernel: If a process is interrupted during usleep(), return -EINTR
2019-11-06 20:01:44 +00:00
if (wakeup_time > g_uptime)
return -EINTR;
Get nyancat nyanning in Serenity. I found a cute program that renders an animated nyancat in the terminal. This patch adds enough hackery to get it working correctly. :^)
2019-02-03 15:11:28 +00:00
return 0;
}
Process now maps regions immediately when they are allocated. This avoids having to do a separate MM.mapRegionsForTask() pass. Also, more Task => Process renaming that I apparently hadn't saved yet.
2018-11-01 12:15:46 +00:00
int Process::sys$sleep(unsigned seconds)
Add a "sleep" syscall that sleeps for N seconds.
2018-10-25 11:53:49 +00:00
{
ping: Use pledge()
2020-01-11 19:48:43 +00:00
REQUIRE_PROMISE(stdio);
Add a "sleep" syscall that sleeps for N seconds.
2018-10-25 11:53:49 +00:00
if (!seconds)
return 0;
Kernel: Port sleep to ThreadBlocker
2019-07-18 15:26:11 +00:00
u64 wakeup_time = current->sleep(seconds * TICKS_PER_SECOND);
if (wakeup_time > g_uptime) {
u32 ticks_left_until_original_wakeup_time = wakeup_time - g_uptime;
Implement sending signals to blocked-in-kernel processes. This is dirty but pretty cool! If we have a pending, unmasked signal for a process that's blocked inside the kernel, we set up alternate stacks for that process and unblock it to execute the signal handler. A slightly different return trampoline is used here: since we need to get back into the kernel, a dedicated syscall is used (sys$sigreturn.) This restores the TSS contents of the process to the state it was in while we were originally blocking in the kernel. NOTE: There's currently only one "kernel resume TSS" so signal nesting definitely won't work.
2018-11-07 20:19:47 +00:00
return ticks_left_until_original_wakeup_time / TICKS_PER_SECOND;
}
Add a "sleep" syscall that sleeps for N seconds.
2018-10-25 11:53:49 +00:00
return 0;
}
Kernel: Tidy up sys$select() to make it more readable.
2019-06-06 15:46:41 +00:00
timeval kgettimeofday()
Add support for socket send/receive timeouts. Only the receive timeout is hooked up yet. You can change the timeout by calling setsockopt(..., SOL_SOCKET, SO_RCVTIMEO, ...). Use this mechanism to make /bin/ping report timeouts.
2019-03-13 12:13:23 +00:00
{
Kernel: Make sure the kernel info page is read-only for userspace To enforce this, we create two separate mappings of the same underlying physical page. A writable mapping for the kernel, and a read-only one for userspace (the one returned by sys$get_kernel_info_page.)
2019-12-15 21:21:28 +00:00
return const_cast<const timeval&>(((KernelInfoPage*)s_info_page_address_for_kernel.as_ptr())->now);
Kernel: Tidy up sys$select() to make it more readable.
2019-06-06 15:46:41 +00:00
}
void kgettimeofday(timeval& tv)
{
tv = kgettimeofday();
Add support for socket send/receive timeouts. Only the receive timeout is hooked up yet. You can change the timeout by calling setsockopt(..., SOL_SOCKET, SO_RCVTIMEO, ...). Use this mechanism to make /bin/ping report timeouts.
2019-03-13 12:13:23 +00:00
}
Process now maps regions immediately when they are allocated. This avoids having to do a separate MM.mapRegionsForTask() pass. Also, more Task => Process renaming that I apparently hadn't saved yet.
2018-11-01 12:15:46 +00:00
int Process::sys$gettimeofday(timeval* tv)
Add gettimeofday() syscall and LibC wrappers gettimeofday() and time(). This only has second accuracy right now, I'll work out subseconds later.
2018-10-25 15:29:49 +00:00
{
ping: Use pledge()
2020-01-11 19:48:43 +00:00
REQUIRE_PROMISE(stdio);
Add templated helpers for read/write validation, and one for strings, too.
2018-11-16 15:23:39 +00:00
if (!validate_write_typed(tv))
Improve syscall address validation a bit.
2018-11-16 15:10:59 +00:00
return -EFAULT;
Kernel+LibC: Publish a "kernel info page" and use it for gettimeofday() This patch adds a single "kernel info page" that is mappable read-only by any process and contains the current time of day. This is then used to implement a version of gettimeofday() that doesn't have to make a syscall. To protect against race condition issues, the info page also has a serial number which is incremented whenever the kernel updates the contents of the page. Make sure to verify that the serial number is the same before and after reading the information you want from the page.
2019-12-15 20:29:26 +00:00
*tv = kgettimeofday();
Add gettimeofday() syscall and LibC wrappers gettimeofday() and time(). This only has second accuracy right now, I'll work out subseconds later.
2018-10-25 15:29:49 +00:00
return 0;
}
Process now maps regions immediately when they are allocated. This avoids having to do a separate MM.mapRegionsForTask() pass. Also, more Task => Process renaming that I apparently hadn't saved yet.
2018-11-01 12:15:46 +00:00
uid_t Process::sys$getuid()
Import the "gerbert" kernel I worked on earlier this year. It's a lot crappier than I remembered it. It's gonna need a lot of work.
2018-10-16 09:01:38 +00:00
{
ping: Use pledge()
2020-01-11 19:48:43 +00:00
REQUIRE_PROMISE(stdio);
Import the "gerbert" kernel I worked on earlier this year. It's a lot crappier than I remembered it. It's gonna need a lot of work.
2018-10-16 09:01:38 +00:00
return m_uid;
}
Process now maps regions immediately when they are allocated. This avoids having to do a separate MM.mapRegionsForTask() pass. Also, more Task => Process renaming that I apparently hadn't saved yet.
2018-11-01 12:15:46 +00:00
gid_t Process::sys$getgid()
Add getgid() and getpid() syscalls. Prep for LibC.
2018-10-22 11:55:11 +00:00
{
ping: Use pledge()
2020-01-11 19:48:43 +00:00
REQUIRE_PROMISE(stdio);
Add getgid() and getpid() syscalls. Prep for LibC.
2018-10-22 11:55:11 +00:00
return m_gid;
}
Add geteuid() and getegid(). There's no support for set-uid or set-gid executables yet so these don't actually do anything. It's just nice to get the boilerplate stuff in.
2018-11-05 14:04:19 +00:00
uid_t Process::sys$geteuid()
{
ping: Use pledge()
2020-01-11 19:48:43 +00:00
REQUIRE_PROMISE(stdio);
Add geteuid() and getegid(). There's no support for set-uid or set-gid executables yet so these don't actually do anything. It's just nice to get the boilerplate stuff in.
2018-11-05 14:04:19 +00:00
return m_euid;
}
gid_t Process::sys$getegid()
{
ping: Use pledge()
2020-01-11 19:48:43 +00:00
REQUIRE_PROMISE(stdio);
Add geteuid() and getegid(). There's no support for set-uid or set-gid executables yet so these don't actually do anything. It's just nice to get the boilerplate stuff in.
2018-11-05 14:04:19 +00:00
return m_egid;
}
Process now maps regions immediately when they are allocated. This avoids having to do a separate MM.mapRegionsForTask() pass. Also, more Task => Process renaming that I apparently hadn't saved yet.
2018-11-01 12:15:46 +00:00
pid_t Process::sys$getpid()
Add getgid() and getpid() syscalls. Prep for LibC.
2018-10-22 11:55:11 +00:00
{
ping: Use pledge()
2020-01-11 19:48:43 +00:00
REQUIRE_PROMISE(stdio);
Add getgid() and getpid() syscalls. Prep for LibC.
2018-10-22 11:55:11 +00:00
return m_pid;
}
Add getppid().
2018-11-06 12:33:06 +00:00
pid_t Process::sys$getppid()
{
ping: Use pledge()
2020-01-11 19:48:43 +00:00
REQUIRE_PROMISE(stdio);
Add getppid().
2018-11-06 12:33:06 +00:00
return m_ppid;
}
Add umask().
2018-11-06 12:40:23 +00:00
mode_t Process::sys$umask(mode_t mask)
{
ping: Use pledge()
2020-01-11 19:48:43 +00:00
REQUIRE_PROMISE(stdio);
Add umask().
2018-11-06 12:40:23 +00:00
auto old_mask = m_umask;
Kernel: Respect the process umask in open() and mkdir().
2019-02-22 01:39:13 +00:00
m_umask = mask & 0777;
Add umask().
2018-11-06 12:40:23 +00:00
return old_mask;
}
Kernel+LibC: Add sys$waitid(), and make sys$waitpid() wrap it sys$waitid() takes an explicit description of whether it's waiting for a single process with the given PID, all of the children, a group, etc., and returns its info as a siginfo_t. It also doesn't automatically imply WEXITED, which clears up the confusion in the kernel.
2020-02-05 16:42:43 +00:00
siginfo_t Process::reap(Process& process)
Get rid of the undertaker and have waitpid() be the reaper. For dead orphans, the scheduler calls reap().
2018-11-07 22:59:49 +00:00
{
Kernel+LibC: Add sys$waitid(), and make sys$waitpid() wrap it sys$waitid() takes an explicit description of whether it's waiting for a single process with the given PID, all of the children, a group, etc., and returns its info as a siginfo_t. It also doesn't automatically imply WEXITED, which clears up the confusion in the kernel.
2020-02-05 16:42:43 +00:00
siginfo_t siginfo;
Kernel: memset() all siginfo_t structs after creating them
2020-02-06 13:12:20 +00:00
memset(&siginfo, 0, sizeof(siginfo));
Kernel+LibC: Add sys$waitid(), and make sys$waitpid() wrap it sys$waitid() takes an explicit description of whether it's waiting for a single process with the given PID, all of the children, a group, etc., and returns its info as a siginfo_t. It also doesn't automatically imply WEXITED, which clears up the confusion in the kernel.
2020-02-05 16:42:43 +00:00
siginfo.si_signo = SIGCHLD;
siginfo.si_pid = process.pid();
siginfo.si_uid = process.uid();
if (process.m_termination_signal) {
siginfo.si_status = process.m_termination_signal;
siginfo.si_code = CLD_KILLED;
} else {
siginfo.si_status = process.m_termination_status;
siginfo.si_code = CLD_EXITED;
}
Kernel: Don't disable interrupts during Process destruction.
2019-03-27 13:38:32 +00:00
{
InterruptDisabler disabler;
Implement basic support for times(). The kernel now bills processes for time spent in kernelspace and userspace separately. The accounting is forwarded to the parent process in reap(). This makes the "time" builtin in bash work.
2018-12-03 00:12:26 +00:00
Kernel: Don't disable interrupts during Process destruction.
2019-03-27 13:38:32 +00:00
if (process.ppid()) {
auto* parent = Process::from_pid(process.ppid());
if (parent) {
parent->m_ticks_in_user_for_dead_children += process.m_ticks_in_user + process.m_ticks_in_user_for_dead_children;
parent->m_ticks_in_kernel_for_dead_children += process.m_ticks_in_kernel + process.m_ticks_in_kernel_for_dead_children;
}
Destroy all remaining windows in a process when it dies.
2019-01-30 18:35:38 +00:00
}
Implement basic support for times(). The kernel now bills processes for time spent in kernelspace and userspace separately. The accounting is forwarded to the parent process in reap(). This makes the "time" builtin in bash work.
2018-12-03 00:12:26 +00:00
Kernel: Finalizer should not go back to sleep if there's more to do Before putting itself back on the wait queue, the finalizer task will now check if there's more work to do, and if so, do it first. :^) This patch also puts a bunch of process/thread debug logging behind PROCESS_DEBUG and THREAD_DEBUG since it was unbearable to debug this stuff with all the spam.
2020-02-01 09:27:25 +00:00
#ifdef PROCESS_DEBUG
Kernel: Tidy up debug logging a little bit When using dbg() in the kernel, the output is automatically prefixed with [Process(PID:TID)]. This makes it a lot easier to understand which thread is generating the output. This patch also cleans up some common logging messages and removes the now-unnecessary "dbg() << *current << ..." pattern.
2020-01-21 15:14:39 +00:00
dbg() << "Reaping process " << process;
Kernel: Finalizer should not go back to sleep if there's more to do Before putting itself back on the wait queue, the finalizer task will now check if there's more work to do, and if so, do it first. :^) This patch also puts a bunch of process/thread debug logging behind PROCESS_DEBUG and THREAD_DEBUG since it was unbearable to debug this stuff with all the spam.
2020-02-01 09:27:25 +00:00
#endif
Kernel: Don't disable interrupts during Process destruction.
2019-03-27 13:38:32 +00:00
ASSERT(process.is_dead());
g_processes->remove(&process);
}
Fix some paging related bugs exposed by the spawn stress test. - Process::exec() needs to restore the original paging scope when called on a non-current process. - Add missing InterruptDisabler guards around g_processes access. - Only flush the TLB when modifying the active page tables.
2018-11-09 00:25:31 +00:00
delete &process;
Kernel+LibC: Add sys$waitid(), and make sys$waitpid() wrap it sys$waitid() takes an explicit description of whether it's waiting for a single process with the given PID, all of the children, a group, etc., and returns its info as a siginfo_t. It also doesn't automatically imply WEXITED, which clears up the confusion in the kernel.
2020-02-05 16:42:43 +00:00
return siginfo;
Get rid of the undertaker and have waitpid() be the reaper. For dead orphans, the scheduler calls reap().
2018-11-07 22:59:49 +00:00
}
Kernel+LibC: Add sys$waitid(), and make sys$waitpid() wrap it sys$waitid() takes an explicit description of whether it's waiting for a single process with the given PID, all of the children, a group, etc., and returns its info as a siginfo_t. It also doesn't automatically imply WEXITED, which clears up the confusion in the kernel.
2020-02-05 16:42:43 +00:00
KResultOr<siginfo_t> Process::do_waitid(idtype_t idtype, int id, int options)
Add a simplified waitpid() so that sh can wait on spawned commands.
2018-10-23 22:20:34 +00:00
{
Kernel+LibC: Add sys$waitid(), and make sys$waitpid() wrap it sys$waitid() takes an explicit description of whether it's waiting for a single process with the given PID, all of the children, a group, etc., and returns its info as a siginfo_t. It also doesn't automatically imply WEXITED, which clears up the confusion in the kernel.
2020-02-05 16:42:43 +00:00
if (idtype == P_PID) {
Get rid of the undertaker and have waitpid() be the reaper. For dead orphans, the scheduler calls reap().
2018-11-07 22:59:49 +00:00
InterruptDisabler disabler;
Kernel+LibC: Add sys$waitid(), and make sys$waitpid() wrap it sys$waitid() takes an explicit description of whether it's waiting for a single process with the given PID, all of the children, a group, etc., and returns its info as a siginfo_t. It also doesn't automatically imply WEXITED, which clears up the confusion in the kernel.
2020-02-05 16:42:43 +00:00
if (idtype == P_PID && !Process::from_pid(id))
return KResult(-ECHILD);
Get rid of the undertaker and have waitpid() be the reaper. For dead orphans, the scheduler calls reap().
2018-11-07 22:59:49 +00:00
}
Make bash-2.05b build with minimal changes. This is really neat. :^)
2018-11-16 23:11:08 +00:00
if (options & WNOHANG) {
Kernel: Add support for the WSTOPPED flag to the waitpid() syscall. This makes waitpid() return when a child process is stopped via a signal. Use this in Shell to catch stopped children and return control to the command line. :^) Fixes #298.
2019-07-14 09:35:49 +00:00
// FIXME: Figure out what WNOHANG should do with stopped children.
Kernel+LibC: Add sys$waitid(), and make sys$waitpid() wrap it sys$waitid() takes an explicit description of whether it's waiting for a single process with the given PID, all of the children, a group, etc., and returns its info as a siginfo_t. It also doesn't automatically imply WEXITED, which clears up the confusion in the kernel.
2020-02-05 16:42:43 +00:00
if (idtype == P_ALL) {
Make bash-2.05b build with minimal changes. This is really neat. :^)
2018-11-16 23:11:08 +00:00
InterruptDisabler disabler;
Kernel: memset() all siginfo_t structs after creating them
2020-02-06 13:12:20 +00:00
siginfo_t siginfo;
memset(&siginfo, 0, sizeof(siginfo));
Kernel+LibC: Add sys$waitid(), and make sys$waitpid() wrap it sys$waitid() takes an explicit description of whether it's waiting for a single process with the given PID, all of the children, a group, etc., and returns its info as a siginfo_t. It also doesn't automatically imply WEXITED, which clears up the confusion in the kernel.
2020-02-05 16:42:43 +00:00
for_each_child([&siginfo](Process& process) {
if (process.is_dead())
siginfo = reap(process);
Kernel: Add support for the WSTOPPED flag to the waitpid() syscall. This makes waitpid() return when a child process is stopped via a signal. Use this in Shell to catch stopped children and return control to the command line. :^) Fixes #298.
2019-07-14 09:35:49 +00:00
return IterationDecision::Continue;
Make bash-2.05b build with minimal changes. This is really neat. :^)
2018-11-16 23:11:08 +00:00
});
Kernel+LibC: Add sys$waitid(), and make sys$waitpid() wrap it sys$waitid() takes an explicit description of whether it's waiting for a single process with the given PID, all of the children, a group, etc., and returns its info as a siginfo_t. It also doesn't automatically imply WEXITED, which clears up the confusion in the kernel.
2020-02-05 16:42:43 +00:00
return siginfo;
} else if (idtype == P_PID) {
More compat work towards porting vim. It now builds and runs in the small-featureset configuration. :^)
2019-02-26 23:02:01 +00:00
InterruptDisabler disabler;
Kernel+LibC: Add sys$waitid(), and make sys$waitpid() wrap it sys$waitid() takes an explicit description of whether it's waiting for a single process with the given PID, all of the children, a group, etc., and returns its info as a siginfo_t. It also doesn't automatically imply WEXITED, which clears up the confusion in the kernel.
2020-02-05 16:42:43 +00:00
auto* waitee_process = Process::from_pid(id);
Make bash-2.05b build with minimal changes. This is really neat. :^)
2018-11-16 23:11:08 +00:00
if (!waitee_process)
Kernel+LibC: Add sys$waitid(), and make sys$waitpid() wrap it sys$waitid() takes an explicit description of whether it's waiting for a single process with the given PID, all of the children, a group, etc., and returns its info as a siginfo_t. It also doesn't automatically imply WEXITED, which clears up the confusion in the kernel.
2020-02-05 16:42:43 +00:00
return KResult(-ECHILD);
if (waitee_process->is_dead())
return reap(*waitee_process);
} else {
// FIXME: Implement other PID specs.
return KResult(-EINVAL);
Make bash-2.05b build with minimal changes. This is really neat. :^)
2018-11-16 23:11:08 +00:00
}
}
Kernel+LibC: Add sys$waitid(), and make sys$waitpid() wrap it sys$waitid() takes an explicit description of whether it's waiting for a single process with the given PID, all of the children, a group, etc., and returns its info as a siginfo_t. It also doesn't automatically imply WEXITED, which clears up the confusion in the kernel.
2020-02-05 16:42:43 +00:00
pid_t waitee_pid;
// FIXME: WaitBlocker should support idtype/id specs directly.
if (idtype == P_ALL) {
waitee_pid = -1;
} else if (idtype == P_PID) {
waitee_pid = id;
} else {
// FIXME: Implement other PID specs.
return KResult(-EINVAL);
}
Kernel: Fix kernel null deref on process crash during join_thread() The join_thread() syscall is not supposed to be interruptible by signals, but it was. And since the process death mechanism piggybacked on signal interrupts, it was possible to interrupt a pthread_join() by killing the process that was doing it, leading to confusing due to some assumptions being made by Thread::finalize() for threads that have a pending joiner. This patch fixes the issue by making "interrupted by death" a distinct block result separate from "interrupted by signal". Then we handle that state in join_thread() and tidy things up so that thread finalization doesn't get confused by the pending joiner being gone. Test: Tests/Kernel/null-deref-crash-during-pthread_join.cpp
2020-01-10 18:15:01 +00:00
if (current->block<Thread::WaitBlocker>(options, waitee_pid) != Thread::BlockResult::WokeNormally)
Kernel+LibC: Add sys$waitid(), and make sys$waitpid() wrap it sys$waitid() takes an explicit description of whether it's waiting for a single process with the given PID, all of the children, a group, etc., and returns its info as a siginfo_t. It also doesn't automatically imply WEXITED, which clears up the confusion in the kernel.
2020-02-05 16:42:43 +00:00
return KResult(-EINTR);
Kernel: Add support for the WSTOPPED flag to the waitpid() syscall. This makes waitpid() return when a child process is stopped via a signal. Use this in Shell to catch stopped children and return control to the command line. :^) Fixes #298.
2019-07-14 09:35:49 +00:00
InterruptDisabler disabler;
// NOTE: If waitee was -1, m_waitee_pid will have been filled in by the scheduler.
Kernel: Port wait to ThreadBlocker
2019-07-18 16:05:19 +00:00
Process* waitee_process = Process::from_pid(waitee_pid);
Kernel: waitpid() should unblock and -ECHILD if SIG_IGN reaps child
2019-09-08 11:54:48 +00:00
if (!waitee_process)
Kernel+LibC: Add sys$waitid(), and make sys$waitpid() wrap it sys$waitid() takes an explicit description of whether it's waiting for a single process with the given PID, all of the children, a group, etc., and returns its info as a siginfo_t. It also doesn't automatically imply WEXITED, which clears up the confusion in the kernel.
2020-02-05 16:42:43 +00:00
return KResult(-ECHILD);
Kernel: waitpid() should unblock and -ECHILD if SIG_IGN reaps child
2019-09-08 11:54:48 +00:00
Fix some paging related bugs exposed by the spawn stress test. - Process::exec() needs to restore the original paging scope when called on a non-current process. - Add missing InterruptDisabler guards around g_processes access. - Only flush the TLB when modifying the active page tables.
2018-11-09 00:25:31 +00:00
ASSERT(waitee_process);
Kernel: Add support for the WSTOPPED flag to the waitpid() syscall. This makes waitpid() return when a child process is stopped via a signal. Use this in Shell to catch stopped children and return control to the command line. :^) Fixes #298.
2019-07-14 09:35:49 +00:00
if (waitee_process->is_dead()) {
Kernel+LibC: Add sys$waitid(), and make sys$waitpid() wrap it sys$waitid() takes an explicit description of whether it's waiting for a single process with the given PID, all of the children, a group, etc., and returns its info as a siginfo_t. It also doesn't automatically imply WEXITED, which clears up the confusion in the kernel.
2020-02-05 16:42:43 +00:00
return reap(*waitee_process);
Kernel: Add support for the WSTOPPED flag to the waitpid() syscall. This makes waitpid() return when a child process is stopped via a signal. Use this in Shell to catch stopped children and return control to the command line. :^) Fixes #298.
2019-07-14 09:35:49 +00:00
} else {
Kernel: sys$waitpid() only needs the waitee thread in the stopped case If the waitee process is dead, we don't need to inspect the thread. This fixes an issue with sys$waitpid() failing before reap() since dead processes will have no remaining threads alive.
2020-01-27 20:20:58 +00:00
auto* waitee_thread = Thread::from_tid(waitee_pid);
if (!waitee_thread)
Kernel+LibC: Add sys$waitid(), and make sys$waitpid() wrap it sys$waitid() takes an explicit description of whether it's waiting for a single process with the given PID, all of the children, a group, etc., and returns its info as a siginfo_t. It also doesn't automatically imply WEXITED, which clears up the confusion in the kernel.
2020-02-05 16:42:43 +00:00
return KResult(-ECHILD);
Kernel: Expose the signal that stopped a thread via sys$waitpid()
2020-01-27 19:47:10 +00:00
ASSERT(waitee_thread->state() == Thread::State::Stopped);
Kernel+LibC: Add sys$waitid(), and make sys$waitpid() wrap it sys$waitid() takes an explicit description of whether it's waiting for a single process with the given PID, all of the children, a group, etc., and returns its info as a siginfo_t. It also doesn't automatically imply WEXITED, which clears up the confusion in the kernel.
2020-02-05 16:42:43 +00:00
siginfo_t siginfo;
Kernel: memset() all siginfo_t structs after creating them
2020-02-06 13:12:20 +00:00
memset(&siginfo, 0, sizeof(siginfo));
Kernel+LibC: Add sys$waitid(), and make sys$waitpid() wrap it sys$waitid() takes an explicit description of whether it's waiting for a single process with the given PID, all of the children, a group, etc., and returns its info as a siginfo_t. It also doesn't automatically imply WEXITED, which clears up the confusion in the kernel.
2020-02-05 16:42:43 +00:00
siginfo.si_signo = SIGCHLD;
siginfo.si_pid = waitee_process->pid();
siginfo.si_uid = waitee_process->uid();
siginfo.si_status = CLD_STOPPED;
siginfo.si_code = waitee_thread->m_stop_signal;
return siginfo;
Kernel: Add support for the WSTOPPED flag to the waitpid() syscall. This makes waitpid() return when a child process is stopped via a signal. Use this in Shell to catch stopped children and return control to the command line. :^) Fixes #298.
2019-07-14 09:35:49 +00:00
}
Kernel+LibC: Add sys$waitid(), and make sys$waitpid() wrap it sys$waitid() takes an explicit description of whether it's waiting for a single process with the given PID, all of the children, a group, etc., and returns its info as a siginfo_t. It also doesn't automatically imply WEXITED, which clears up the confusion in the kernel.
2020-02-05 16:42:43 +00:00
}
pid_t Process::sys$waitid(const Syscall::SC_waitid_params* user_params)
{
REQUIRE_PROMISE(stdio);
Kernel: The waitpid() syscall was not storing to "wstatus" in all cases
2020-01-06 13:31:54 +00:00
Kernel+LibC: Add sys$waitid(), and make sys$waitpid() wrap it sys$waitid() takes an explicit description of whether it's waiting for a single process with the given PID, all of the children, a group, etc., and returns its info as a siginfo_t. It also doesn't automatically imply WEXITED, which clears up the confusion in the kernel.
2020-02-05 16:42:43 +00:00
Syscall::SC_waitid_params params;
if (!validate_read_and_copy_typed(&params, user_params))
return -EFAULT;
if (!validate_write_typed(params.infop))
return -EFAULT;
Kernel: Put sys$waitid() debug logging behind PROCESS_DEBUG
2020-02-05 18:14:56 +00:00
#ifdef PROCESS_DEBUG
Kernel+LibC: Add sys$waitid(), and make sys$waitpid() wrap it sys$waitid() takes an explicit description of whether it's waiting for a single process with the given PID, all of the children, a group, etc., and returns its info as a siginfo_t. It also doesn't automatically imply WEXITED, which clears up the confusion in the kernel.
2020-02-05 16:42:43 +00:00
dbg() << "sys$waitid(" << params.idtype << ", " << params.id << ", " << params.infop << ", " << params.options << ")";
Kernel: Put sys$waitid() debug logging behind PROCESS_DEBUG
2020-02-05 18:14:56 +00:00
#endif
Kernel+LibC: Add sys$waitid(), and make sys$waitpid() wrap it sys$waitid() takes an explicit description of whether it's waiting for a single process with the given PID, all of the children, a group, etc., and returns its info as a siginfo_t. It also doesn't automatically imply WEXITED, which clears up the confusion in the kernel.
2020-02-05 16:42:43 +00:00
auto siginfo_or_error = do_waitid(static_cast<idtype_t>(params.idtype), params.id, params.options);
if (siginfo_or_error.is_error())
return siginfo_or_error.error();
copy_to_user(params.infop, &siginfo_or_error.value());
return 0;
Import the "gerbert" kernel I worked on earlier this year. It's a lot crappier than I remembered it. It's gonna need a lot of work.
2018-10-16 09:01:38 +00:00
}
Kernel: Address validation helpers should take size_t, not ssize_t
2020-01-29 17:31:15 +00:00
bool Process::validate_read_from_kernel(VirtualAddress vaddr, size_t size) const
Greatly improve /proc/PID/stack by tracing the ebp frame chain. I also added a generator cache to FileHandle. This way, multiple reads to a generated file (i.e in a synthfs) can transparently handle multiple calls to read() without the contents changing between calls. The cache is discarded at EOF (or when the FileHandle is destroyed.)
2018-10-26 22:14:24 +00:00
{
Kernel: Rename LinearAddress => VirtualAddress.
2019-06-07 10:56:50 +00:00
if (vaddr.is_null())
Kernel: Make validate_read_from_kernel() return early for nullptr checks. Null pointers are always invalid, so don't bother going through all the various checks for them.
2019-04-15 21:48:31 +00:00
return false;
Kernel: Validate the full range of user memory passed to syscalls We now validate the full range of userspace memory passed into syscalls instead of just checking that the first and last byte of the memory are in process-owned regions. This fixes an issue where it was possible to avoid rejection of invalid addresses that sat between two valid ones, simply by passing a valid address and a size large enough to put the end of the range at another valid address. I added a little test utility that tries to provoke EFAULT in various ways to help verify this. I'm sure we can think of more ways to test this but it's at least a start. :^) Thanks to mozjag for pointing out that this code was still lacking! Incidentally this also makes backtraces work again. Fixes #989.
2020-01-02 01:09:25 +00:00
return MM.validate_kernel_read(*this, vaddr, size);
Greatly improve /proc/PID/stack by tracing the ebp frame chain. I also added a generator cache to FileHandle. This way, multiple reads to a generated file (i.e in a synthfs) can transparently handle multiple calls to read() without the contents changing between calls. The cache is discarded at EOF (or when the FileHandle is destroyed.)
2018-10-26 22:14:24 +00:00
}
Kernel: Address validation helpers should take size_t, not ssize_t
2020-01-29 17:31:15 +00:00
bool Process::validate_read(const void* address, size_t size) const
Reimplement tcsetattr/tcgetattr as ioctls.
2018-11-16 14:41:48 +00:00
{
Kernel: Fix incorrect EFAULTs when syscall would write into COW pages.
2019-01-25 00:39:15 +00:00
if (!size)
return false;
Kernel: Never validate access to the kmalloc memory range Memory validation is used to verify that user syscalls are allowed to access a given memory range. Ring 0 threads never make syscalls, and so will never end up in validation anyway. The reason we were allowing kmalloc memory accesses is because kernel thread stacks used to be allocated in kmalloc memory. Since that's no longer the case, we can stop making exceptions for kmalloc in the validation code.
2020-01-27 11:43:21 +00:00
return MM.validate_user_read(*this, VirtualAddress(address), size);
Reimplement tcsetattr/tcgetattr as ioctls.
2018-11-16 14:41:48 +00:00
}
Kernel: Address validation helpers should take size_t, not ssize_t
2020-01-29 17:31:15 +00:00
bool Process::validate_write(void* address, size_t size) const
Reimplement tcsetattr/tcgetattr as ioctls.
2018-11-16 14:41:48 +00:00
{
Kernel: Fix incorrect EFAULTs when syscall would write into COW pages.
2019-01-25 00:39:15 +00:00
if (!size)
return false;
Kernel: Never validate access to the kmalloc memory range Memory validation is used to verify that user syscalls are allowed to access a given memory range. Ring 0 threads never make syscalls, and so will never end up in validation anyway. The reason we were allowing kmalloc memory accesses is because kernel thread stacks used to be allocated in kmalloc memory. Since that's no longer the case, we can stop making exceptions for kmalloc in the validation code.
2020-01-27 11:43:21 +00:00
return MM.validate_user_write(*this, VirtualAddress(address), size);
Reimplement tcsetattr/tcgetattr as ioctls.
2018-11-16 14:41:48 +00:00
}
Start working on sessions and process groups.
2018-11-02 11:56:51 +00:00
pid_t Process::sys$getsid(pid_t pid)
{
ping: Use pledge()
2020-01-11 19:48:43 +00:00
REQUIRE_PROMISE(stdio);
Start working on sessions and process groups.
2018-11-02 11:56:51 +00:00
if (pid == 0)
return m_sid;
InterruptDisabler disabler;
Some refactor and style tweaks.
2018-11-07 20:38:18 +00:00
auto* process = Process::from_pid(pid);
Start working on sessions and process groups.
2018-11-02 11:56:51 +00:00
if (!process)
return -ESRCH;
if (m_sid != process->m_sid)
return -EPERM;
return process->m_sid;
}
pid_t Process::sys$setsid()
{
ping: Use pledge()
2020-01-11 19:48:43 +00:00
REQUIRE_PROMISE(proc);
Start working on sessions and process groups.
2018-11-02 11:56:51 +00:00
InterruptDisabler disabler;
bool found_process_with_same_pgid_as_my_pid = false;
Kernel: Run clang-format on everything.
2019-06-07 09:43:58 +00:00
Process::for_each_in_pgrp(pid(), [&](auto&) {
Some refactor and style tweaks.
2018-11-07 20:38:18 +00:00
found_process_with_same_pgid_as_my_pid = true;
Kernel: Use IteratorDecision in Process::for_each_in_pgrp()
2019-08-22 19:12:55 +00:00
return IterationDecision::Break;
Start working on sessions and process groups.
2018-11-02 11:56:51 +00:00
});
if (found_process_with_same_pgid_as_my_pid)
return -EPERM;
m_sid = m_pid;
m_pgid = m_pid;
Kernel: Make sys$setsid() clear the calling process's controlling TTY
2020-01-25 13:53:48 +00:00
m_tty = nullptr;
Start working on sessions and process groups.
2018-11-02 11:56:51 +00:00
return m_sid;
}
pid_t Process::sys$getpgid(pid_t pid)
{
ping: Use pledge()
2020-01-11 19:48:43 +00:00
REQUIRE_PROMISE(stdio);
Start working on sessions and process groups.
2018-11-02 11:56:51 +00:00
if (pid == 0)
return m_pgid;
InterruptDisabler disabler; // FIXME: Use a ProcessHandle
Some refactor and style tweaks.
2018-11-07 20:38:18 +00:00
auto* process = Process::from_pid(pid);
Start working on sessions and process groups.
2018-11-02 11:56:51 +00:00
if (!process)
return -ESRCH;
return process->m_pgid;
}
pid_t Process::sys$getpgrp()
{
ping: Use pledge()
2020-01-11 19:48:43 +00:00
REQUIRE_PROMISE(stdio);
Start working on sessions and process groups.
2018-11-02 11:56:51 +00:00
return m_pgid;
}
static pid_t get_sid_from_pgid(pid_t pgid)
{
InterruptDisabler disabler;
Some refactor and style tweaks.
2018-11-07 20:38:18 +00:00
auto* group_leader = Process::from_pid(pgid);
Start working on sessions and process groups.
2018-11-02 11:56:51 +00:00
if (!group_leader)
return -1;
return group_leader->sid();
}
int Process::sys$setpgid(pid_t specified_pid, pid_t specified_pgid)
{
ping: Use pledge()
2020-01-11 19:48:43 +00:00
REQUIRE_PROMISE(proc);
Start working on sessions and process groups.
2018-11-02 11:56:51 +00:00
InterruptDisabler disabler; // FIXME: Use a ProcessHandle
pid_t pid = specified_pid ? specified_pid : m_pid;
Kernel: Add some missing error checks to the setpgid() syscall
2020-01-02 18:40:04 +00:00
if (specified_pgid < 0) {
// The value of the pgid argument is less than 0, or is not a value supported by the implementation.
Start working on sessions and process groups.
2018-11-02 11:56:51 +00:00
return -EINVAL;
Kernel: Add some missing error checks to the setpgid() syscall
2020-01-02 18:40:04 +00:00
}
Some refactor and style tweaks.
2018-11-07 20:38:18 +00:00
auto* process = Process::from_pid(pid);
Start working on sessions and process groups.
2018-11-02 11:56:51 +00:00
if (!process)
return -ESRCH;
Kernel: Add some missing error checks to the setpgid() syscall
2020-01-02 18:40:04 +00:00
if (process != this && process->ppid() != m_pid) {
// The value of the pid argument does not match the process ID
// of the calling process or of a child process of the calling process.
return -ESRCH;
}
if (process->pid() == process->sid()) {
// The process indicated by the pid argument is a session leader.
return -EPERM;
}
if (process->ppid() == m_pid && process->sid() != sid()) {
// The value of the pid argument matches the process ID of a child
// process of the calling process and the child process is not in
// the same session as the calling process.
return -EPERM;
}
Start working on sessions and process groups.
2018-11-02 11:56:51 +00:00
pid_t new_pgid = specified_pgid ? specified_pgid : process->m_pid;
pid_t current_sid = get_sid_from_pgid(process->m_pgid);
pid_t new_sid = get_sid_from_pgid(new_pgid);
if (current_sid != new_sid) {
// Can't move a process between sessions.
return -EPERM;
}
// FIXME: There are more EPERM conditions to check for here..
process->m_pgid = new_pgid;
return 0;
}
Add tcsetpgrp()+tcgetpgrp(). One more step on the path to being able to ^C a runaway process. :^)
2018-11-02 12:14:25 +00:00
Add ioctl() and reimplement tcsetpgrp/tcsetpgrp as ioctls.
2018-11-16 12:11:21 +00:00
int Process::sys$ioctl(int fd, unsigned request, unsigned arg)
Add tcsetpgrp()+tcgetpgrp(). One more step on the path to being able to ^C a runaway process. :^)
2018-11-02 12:14:25 +00:00
{
Kernel: Make Process::file_description() vend a RefPtr<FileDescription> This encourages callers to strongly reference file descriptions while working with them. This fixes a use-after-free issue where one thread would close() an open fd while another thread was blocked on it becoming readable. Test: Kernel/uaf-close-while-blocked-in-read.cpp
2020-01-07 14:53:42 +00:00
auto description = file_description(fd);
Kernel: Rename "descriptor" to "description" where appropriate. Now that FileDescription is called that, variables of that type should not be called "descriptor". This is kinda wordy but we'll get used to it.
2019-06-13 20:03:04 +00:00
if (!description)
Add tcsetpgrp()+tcgetpgrp(). One more step on the path to being able to ^C a runaway process. :^)
2018-11-02 12:14:25 +00:00
return -EBADF;
Kernel: Start implementing x86 SMAP support Supervisor Mode Access Prevention (SMAP) is an x86 CPU feature that prevents the kernel from accessing userspace memory. With SMAP enabled, trying to read/write a userspace memory address while in the kernel will now generate a page fault. Since it's sometimes necessary to read/write userspace memory, there are two new instructions that quickly switch the protection on/off: STAC (disables protection) and CLAC (enables protection.) These are exposed in kernel code via the stac() and clac() helpers. There's also a SmapDisabler RAII object that can be used to ensure that you don't forget to re-enable protection before returning to userspace code. THis patch also adds copy_to_user(), copy_from_user() and memset_user() which are the "correct" way of doing things. These functions allow us to briefly disable protection for a specific purpose, and then turn it back on immediately after it's done. Going forward all kernel code should be moved to using these and all uses of SmapDisabler are to be considered FIXME's. Note that we're not realizing the full potential of this feature since I've used SmapDisabler quite liberally in this initial bring-up patch.
2020-01-05 17:00:15 +00:00
SmapDisabler disabler;
Kernel: Rename "descriptor" to "description" where appropriate. Now that FileDescription is called that, variables of that type should not be called "descriptor". This is kinda wordy but we'll get used to it.
2019-06-13 20:03:04 +00:00
return description->file().ioctl(*description, request, arg);
Add tcsetpgrp()+tcgetpgrp(). One more step on the path to being able to ^C a runaway process. :^)
2018-11-02 12:14:25 +00:00
}
More work towards getting bash to build. Implemented some syscalls: dup(), dup2(), getdtablesize(). FileHandle is now a retainable, since that's needed for dup()'ed fd's. I didn't really test any of this beyond a basic smoke check.
2018-11-05 18:01:22 +00:00
int Process::sys$getdtablesize()
{
ping: Use pledge()
2020-01-11 19:48:43 +00:00
REQUIRE_PROMISE(stdio);
More work towards getting bash to build. Implemented some syscalls: dup(), dup2(), getdtablesize(). FileHandle is now a retainable, since that's needed for dup()'ed fd's. I didn't really test any of this beyond a basic smoke check.
2018-11-05 18:01:22 +00:00
return m_max_open_file_descriptors;
}
int Process::sys$dup(int old_fd)
{
ping: Use pledge()
2020-01-11 19:48:43 +00:00
REQUIRE_PROMISE(stdio);
Kernel: Make Process::file_description() vend a RefPtr<FileDescription> This encourages callers to strongly reference file descriptions while working with them. This fixes a use-after-free issue where one thread would close() an open fd while another thread was blocked on it becoming readable. Test: Kernel/uaf-close-while-blocked-in-read.cpp
2020-01-07 14:53:42 +00:00
auto description = file_description(old_fd);
Kernel: Rename "descriptor" to "description" where appropriate. Now that FileDescription is called that, variables of that type should not be called "descriptor". This is kinda wordy but we'll get used to it.
2019-06-13 20:03:04 +00:00
if (!description)
More work towards getting bash to build. Implemented some syscalls: dup(), dup2(), getdtablesize(). FileHandle is now a retainable, since that's needed for dup()'ed fd's. I didn't really test any of this beyond a basic smoke check.
2018-11-05 18:01:22 +00:00
return -EBADF;
Kernel: Misc tweaks
2020-01-20 12:18:54 +00:00
int new_fd = alloc_fd();
Kernel: Use alloc_fd() more instead of walking fd list manually.
2019-04-06 12:54:32 +00:00
if (new_fd < 0)
return new_fd;
Kernel: Rename "descriptor" to "description" where appropriate. Now that FileDescription is called that, variables of that type should not be called "descriptor". This is kinda wordy but we'll get used to it.
2019-06-13 20:03:04 +00:00
m_fds[new_fd].set(*description);
More work towards getting bash to build. Implemented some syscalls: dup(), dup2(), getdtablesize(). FileHandle is now a retainable, since that's needed for dup()'ed fd's. I didn't really test any of this beyond a basic smoke check.
2018-11-05 18:01:22 +00:00
return new_fd;
}
int Process::sys$dup2(int old_fd, int new_fd)
{
ping: Use pledge()
2020-01-11 19:48:43 +00:00
REQUIRE_PROMISE(stdio);
Kernel: Make Process::file_description() vend a RefPtr<FileDescription> This encourages callers to strongly reference file descriptions while working with them. This fixes a use-after-free issue where one thread would close() an open fd while another thread was blocked on it becoming readable. Test: Kernel/uaf-close-while-blocked-in-read.cpp
2020-01-07 14:53:42 +00:00
auto description = file_description(old_fd);
Kernel: Rename "descriptor" to "description" where appropriate. Now that FileDescription is called that, variables of that type should not be called "descriptor". This is kinda wordy but we'll get used to it.
2019-06-13 20:03:04 +00:00
if (!description)
More work towards getting bash to build. Implemented some syscalls: dup(), dup2(), getdtablesize(). FileHandle is now a retainable, since that's needed for dup()'ed fd's. I didn't really test any of this beyond a basic smoke check.
2018-11-05 18:01:22 +00:00
return -EBADF;
Kernel: Use alloc_fd() more instead of walking fd list manually.
2019-04-06 12:54:32 +00:00
if (new_fd < 0 || new_fd >= m_max_open_file_descriptors)
return -EINVAL;
Kernel: Rename "descriptor" to "description" where appropriate. Now that FileDescription is called that, variables of that type should not be called "descriptor". This is kinda wordy but we'll get used to it.
2019-06-13 20:03:04 +00:00
m_fds[new_fd].set(*description);
More work towards getting bash to build. Implemented some syscalls: dup(), dup2(), getdtablesize(). FileHandle is now a retainable, since that's needed for dup()'ed fd's. I didn't really test any of this beyond a basic smoke check.
2018-11-05 18:01:22 +00:00
return new_fd;
}
Add some basic signal support. It only works for sending a signal to a process that's in userspace code. We implement reception by synthesizing a PUSHA+PUSHF in the receiving process (operating on values in the TSS.) The TSS CS:EIP is then rerouted to the signal handler and a tiny return trampoline is constructed in a dedicated region in the receiving process. Also hacked up /bin/kill to be able to send arbitrary signals (kill -N PID)
2018-11-06 09:46:40 +00:00
Kernel: Get rid of Unix namespace. This is no longer needed as the Kernel can stand on its own legs now and there won't be any conflict with host system data types.
2019-01-23 05:53:01 +00:00
int Process::sys$sigprocmask(int how, const sigset_t* set, sigset_t* old_set)
Some improvements to signals. - Add sigprocmask() and sigpending(). - Forked children inherit signal dispositions and masks. - Exec clears signal dispositions and masks.
2018-11-10 22:29:07 +00:00
{
ping: Use pledge()
2020-01-11 19:48:43 +00:00
REQUIRE_PROMISE(stdio);
Rage hacking to get bash to run. It finally runs. So cool! :^)
2018-11-11 14:36:40 +00:00
if (old_set) {
Kernel: sigpending() and sigprocmask() should validate memory writes.
2019-02-21 20:33:52 +00:00
if (!validate_write_typed(old_set))
Improve syscall address validation a bit.
2018-11-16 15:10:59 +00:00
return -EFAULT;
Kernel: Use the templated copy_to/from_user() in more places These ensure that the "to" and "from" pointers have the same type, and also that we copy the correct number of bytes.
2020-01-20 12:38:31 +00:00
copy_to_user(old_set, &current->m_signal_mask);
Rage hacking to get bash to run. It finally runs. So cool! :^)
2018-11-11 14:36:40 +00:00
}
if (set) {
Add templated helpers for read/write validation, and one for strings, too.
2018-11-16 15:23:39 +00:00
if (!validate_read_typed(set))
Improve syscall address validation a bit.
2018-11-16 15:10:59 +00:00
return -EFAULT;
Kernel: Start implementing x86 SMAP support Supervisor Mode Access Prevention (SMAP) is an x86 CPU feature that prevents the kernel from accessing userspace memory. With SMAP enabled, trying to read/write a userspace memory address while in the kernel will now generate a page fault. Since it's sometimes necessary to read/write userspace memory, there are two new instructions that quickly switch the protection on/off: STAC (disables protection) and CLAC (enables protection.) These are exposed in kernel code via the stac() and clac() helpers. There's also a SmapDisabler RAII object that can be used to ensure that you don't forget to re-enable protection before returning to userspace code. THis patch also adds copy_to_user(), copy_from_user() and memset_user() which are the "correct" way of doing things. These functions allow us to briefly disable protection for a specific purpose, and then turn it back on immediately after it's done. Going forward all kernel code should be moved to using these and all uses of SmapDisabler are to be considered FIXME's. Note that we're not realizing the full potential of this feature since I've used SmapDisabler quite liberally in this initial bring-up patch.
2020-01-05 17:00:15 +00:00
sigset_t set_value;
Kernel: Use the templated copy_from_user where possible Now that the templated version of copy_from_user exists their is normally no reason to use the version which takes the number of bytes to copy. Move to the templated version where possible.
2020-01-13 07:00:35 +00:00
copy_from_user(&set_value, set);
Rage hacking to get bash to run. It finally runs. So cool! :^)
2018-11-11 14:36:40 +00:00
switch (how) {
case SIG_BLOCK:
Kernel: Start implementing x86 SMAP support Supervisor Mode Access Prevention (SMAP) is an x86 CPU feature that prevents the kernel from accessing userspace memory. With SMAP enabled, trying to read/write a userspace memory address while in the kernel will now generate a page fault. Since it's sometimes necessary to read/write userspace memory, there are two new instructions that quickly switch the protection on/off: STAC (disables protection) and CLAC (enables protection.) These are exposed in kernel code via the stac() and clac() helpers. There's also a SmapDisabler RAII object that can be used to ensure that you don't forget to re-enable protection before returning to userspace code. THis patch also adds copy_to_user(), copy_from_user() and memset_user() which are the "correct" way of doing things. These functions allow us to briefly disable protection for a specific purpose, and then turn it back on immediately after it's done. Going forward all kernel code should be moved to using these and all uses of SmapDisabler are to be considered FIXME's. Note that we're not realizing the full potential of this feature since I've used SmapDisabler quite liberally in this initial bring-up patch.
2020-01-05 17:00:15 +00:00
current->m_signal_mask &= ~set_value;
Rage hacking to get bash to run. It finally runs. So cool! :^)
2018-11-11 14:36:40 +00:00
break;
case SIG_UNBLOCK:
Kernel: Start implementing x86 SMAP support Supervisor Mode Access Prevention (SMAP) is an x86 CPU feature that prevents the kernel from accessing userspace memory. With SMAP enabled, trying to read/write a userspace memory address while in the kernel will now generate a page fault. Since it's sometimes necessary to read/write userspace memory, there are two new instructions that quickly switch the protection on/off: STAC (disables protection) and CLAC (enables protection.) These are exposed in kernel code via the stac() and clac() helpers. There's also a SmapDisabler RAII object that can be used to ensure that you don't forget to re-enable protection before returning to userspace code. THis patch also adds copy_to_user(), copy_from_user() and memset_user() which are the "correct" way of doing things. These functions allow us to briefly disable protection for a specific purpose, and then turn it back on immediately after it's done. Going forward all kernel code should be moved to using these and all uses of SmapDisabler are to be considered FIXME's. Note that we're not realizing the full potential of this feature since I've used SmapDisabler quite liberally in this initial bring-up patch.
2020-01-05 17:00:15 +00:00
current->m_signal_mask |= set_value;
Rage hacking to get bash to run. It finally runs. So cool! :^)
2018-11-11 14:36:40 +00:00
break;
case SIG_SETMASK:
Kernel: Start implementing x86 SMAP support Supervisor Mode Access Prevention (SMAP) is an x86 CPU feature that prevents the kernel from accessing userspace memory. With SMAP enabled, trying to read/write a userspace memory address while in the kernel will now generate a page fault. Since it's sometimes necessary to read/write userspace memory, there are two new instructions that quickly switch the protection on/off: STAC (disables protection) and CLAC (enables protection.) These are exposed in kernel code via the stac() and clac() helpers. There's also a SmapDisabler RAII object that can be used to ensure that you don't forget to re-enable protection before returning to userspace code. THis patch also adds copy_to_user(), copy_from_user() and memset_user() which are the "correct" way of doing things. These functions allow us to briefly disable protection for a specific purpose, and then turn it back on immediately after it's done. Going forward all kernel code should be moved to using these and all uses of SmapDisabler are to be considered FIXME's. Note that we're not realizing the full potential of this feature since I've used SmapDisabler quite liberally in this initial bring-up patch.
2020-01-05 17:00:15 +00:00
current->m_signal_mask = set_value;
Rage hacking to get bash to run. It finally runs. So cool! :^)
2018-11-11 14:36:40 +00:00
break;
default:
return -EINVAL;
}
Some improvements to signals. - Add sigprocmask() and sigpending(). - Forked children inherit signal dispositions and masks. - Exec clears signal dispositions and masks.
2018-11-10 22:29:07 +00:00
}
return 0;
}
Kernel: Get rid of Unix namespace. This is no longer needed as the Kernel can stand on its own legs now and there won't be any conflict with host system data types.
2019-01-23 05:53:01 +00:00
int Process::sys$sigpending(sigset_t* set)
Some improvements to signals. - Add sigprocmask() and sigpending(). - Forked children inherit signal dispositions and masks. - Exec clears signal dispositions and masks.
2018-11-10 22:29:07 +00:00
{
ping: Use pledge()
2020-01-11 19:48:43 +00:00
REQUIRE_PROMISE(stdio);
Kernel: sigpending() and sigprocmask() should validate memory writes.
2019-02-21 20:33:52 +00:00
if (!validate_write_typed(set))
Improve syscall address validation a bit.
2018-11-16 15:10:59 +00:00
return -EFAULT;
Kernel: Use the templated copy_to/from_user() in more places These ensure that the "to" and "from" pointers have the same type, and also that we copy the correct number of bytes.
2020-01-20 12:38:31 +00:00
copy_to_user(set, &current->m_pending_signals);
Some improvements to signals. - Add sigprocmask() and sigpending(). - Forked children inherit signal dispositions and masks. - Exec clears signal dispositions and masks.
2018-11-10 22:29:07 +00:00
return 0;
}
Kernel: Get rid of Unix namespace. This is no longer needed as the Kernel can stand on its own legs now and there won't be any conflict with host system data types.
2019-01-23 05:53:01 +00:00
int Process::sys$sigaction(int signum, const sigaction* act, sigaction* old_act)
Add some basic signal support. It only works for sending a signal to a process that's in userspace code. We implement reception by synthesizing a PUSHA+PUSHF in the receiving process (operating on values in the TSS.) The TSS CS:EIP is then rerouted to the signal handler and a tiny return trampoline is constructed in a dedicated region in the receiving process. Also hacked up /bin/kill to be able to send arbitrary signals (kill -N PID)
2018-11-06 09:46:40 +00:00
{
ping: Use pledge()
2020-01-11 19:48:43 +00:00
REQUIRE_PROMISE(stdio);
Let sys$sigaction() fail if called with SIGKILL or SIGSTOP.
2018-12-24 21:22:19 +00:00
if (signum < 1 || signum >= 32 || signum == SIGKILL || signum == SIGSTOP)
Add some basic signal support. It only works for sending a signal to a process that's in userspace code. We implement reception by synthesizing a PUSHA+PUSHF in the receiving process (operating on values in the TSS.) The TSS CS:EIP is then rerouted to the signal handler and a tiny return trampoline is constructed in a dedicated region in the receiving process. Also hacked up /bin/kill to be able to send arbitrary signals (kill -N PID)
2018-11-06 09:46:40 +00:00
return -EINVAL;
Add templated helpers for read/write validation, and one for strings, too.
2018-11-16 15:23:39 +00:00
if (!validate_read_typed(act))
Improve syscall address validation a bit.
2018-11-16 15:10:59 +00:00
return -EFAULT;
Kernel: Remove a bunch of unnecessary InterruptDisablers.
2019-02-07 10:24:09 +00:00
InterruptDisabler disabler; // FIXME: This should use a narrower lock. Maybe a way to ignore signals temporarily?
Kernel: Introduce threads, and refactor everything in support of it. The scheduler now operates on threads, rather than on processes. Each process has a main thread, and can have any number of additional threads. The process exits when the main thread exits. This patch doesn't actually spawn any additional threads, it merely does all the plumbing needed to make it possible. :^)
2019-03-23 21:03:17 +00:00
auto& action = current->m_signal_action_data[signum];
Fix sys$sigaction() to return the old action metadata if requested.
2018-11-07 09:48:44 +00:00
if (old_act) {
Add templated helpers for read/write validation, and one for strings, too.
2018-11-16 15:23:39 +00:00
if (!validate_write_typed(old_act))
Improve syscall address validation a bit.
2018-11-16 15:10:59 +00:00
return -EFAULT;
Kernel: Use the templated copy_to/from_user() in more places These ensure that the "to" and "from" pointers have the same type, and also that we copy the correct number of bytes.
2020-01-20 12:38:31 +00:00
copy_to_user(&old_act->sa_flags, &action.flags);
Kernel: Start implementing x86 SMAP support Supervisor Mode Access Prevention (SMAP) is an x86 CPU feature that prevents the kernel from accessing userspace memory. With SMAP enabled, trying to read/write a userspace memory address while in the kernel will now generate a page fault. Since it's sometimes necessary to read/write userspace memory, there are two new instructions that quickly switch the protection on/off: STAC (disables protection) and CLAC (enables protection.) These are exposed in kernel code via the stac() and clac() helpers. There's also a SmapDisabler RAII object that can be used to ensure that you don't forget to re-enable protection before returning to userspace code. THis patch also adds copy_to_user(), copy_from_user() and memset_user() which are the "correct" way of doing things. These functions allow us to briefly disable protection for a specific purpose, and then turn it back on immediately after it's done. Going forward all kernel code should be moved to using these and all uses of SmapDisabler are to be considered FIXME's. Note that we're not realizing the full potential of this feature since I've used SmapDisabler quite liberally in this initial bring-up patch.
2020-01-05 17:00:15 +00:00
copy_to_user(&old_act->sa_sigaction, &action.handler_or_sigaction, sizeof(action.handler_or_sigaction));
Fix sys$sigaction() to return the old action metadata if requested.
2018-11-07 09:48:44 +00:00
}
Kernel: Use the templated copy_from_user where possible Now that the templated version of copy_from_user exists their is normally no reason to use the version which takes the number of bytes to copy. Move to the templated version where possible.
2020-01-13 07:00:35 +00:00
copy_from_user(&action.flags, &act->sa_flags);
Kernel: Use the templated copy_to/from_user() in more places These ensure that the "to" and "from" pointers have the same type, and also that we copy the correct number of bytes.
2020-01-20 12:38:31 +00:00
copy_from_user(&action.handler_or_sigaction, &act->sa_sigaction, sizeof(action.handler_or_sigaction));
Add some basic signal support. It only works for sending a signal to a process that's in userspace code. We implement reception by synthesizing a PUSHA+PUSHF in the receiving process (operating on values in the TSS.) The TSS CS:EIP is then rerouted to the signal handler and a tiny return trampoline is constructed in a dedicated region in the receiving process. Also hacked up /bin/kill to be able to send arbitrary signals (kill -N PID)
2018-11-06 09:46:40 +00:00
return 0;
}
Add some basic setgroups(), getgroups() and initgroups(). Also teach /bin/id to print the user's supplemental groups.
2018-11-07 00:38:51 +00:00
More moving towards using signed types. I'm still feeling this out, but I am starting to like the general idea.
2019-02-25 21:06:55 +00:00
int Process::sys$getgroups(ssize_t count, gid_t* gids)
Add some basic setgroups(), getgroups() and initgroups(). Also teach /bin/id to print the user's supplemental groups.
2018-11-07 00:38:51 +00:00
{
ping: Use pledge()
2020-01-11 19:48:43 +00:00
REQUIRE_PROMISE(stdio);
Add some basic setgroups(), getgroups() and initgroups(). Also teach /bin/id to print the user's supplemental groups.
2018-11-07 00:38:51 +00:00
if (count < 0)
return -EINVAL;
if (!count)
Kernel: Don't include the process GID in the "extra GIDs" table Process::m_extra_gids is for supplementary GIDs only.
2020-01-02 22:45:52 +00:00
return m_extra_gids.size();
if (count != (int)m_extra_gids.size())
Add some basic setgroups(), getgroups() and initgroups(). Also teach /bin/id to print the user's supplemental groups.
2018-11-07 00:38:51 +00:00
return -EINVAL;
Kernel: Don't include the process GID in the "extra GIDs" table Process::m_extra_gids is for supplementary GIDs only.
2020-01-02 22:45:52 +00:00
if (!validate_write_typed(gids, m_extra_gids.size()))
Improve syscall address validation a bit.
2018-11-16 15:10:59 +00:00
return -EFAULT;
Add some basic setgroups(), getgroups() and initgroups(). Also teach /bin/id to print the user's supplemental groups.
2018-11-07 00:38:51 +00:00
size_t i = 0;
Kernel: Start implementing x86 SMAP support Supervisor Mode Access Prevention (SMAP) is an x86 CPU feature that prevents the kernel from accessing userspace memory. With SMAP enabled, trying to read/write a userspace memory address while in the kernel will now generate a page fault. Since it's sometimes necessary to read/write userspace memory, there are two new instructions that quickly switch the protection on/off: STAC (disables protection) and CLAC (enables protection.) These are exposed in kernel code via the stac() and clac() helpers. There's also a SmapDisabler RAII object that can be used to ensure that you don't forget to re-enable protection before returning to userspace code. THis patch also adds copy_to_user(), copy_from_user() and memset_user() which are the "correct" way of doing things. These functions allow us to briefly disable protection for a specific purpose, and then turn it back on immediately after it's done. Going forward all kernel code should be moved to using these and all uses of SmapDisabler are to be considered FIXME's. Note that we're not realizing the full potential of this feature since I've used SmapDisabler quite liberally in this initial bring-up patch.
2020-01-05 17:00:15 +00:00
SmapDisabler disabler;
Kernel: Don't include the process GID in the "extra GIDs" table Process::m_extra_gids is for supplementary GIDs only.
2020-01-02 22:45:52 +00:00
for (auto gid : m_extra_gids)
Add some basic setgroups(), getgroups() and initgroups(). Also teach /bin/id to print the user's supplemental groups.
2018-11-07 00:38:51 +00:00
gids[i++] = gid;
return 0;
}
More moving towards using signed types. I'm still feeling this out, but I am starting to like the general idea.
2019-02-25 21:06:55 +00:00
int Process::sys$setgroups(ssize_t count, const gid_t* gids)
Add some basic setgroups(), getgroups() and initgroups(). Also teach /bin/id to print the user's supplemental groups.
2018-11-07 00:38:51 +00:00
{
ping: Use pledge()
2020-01-11 19:48:43 +00:00
REQUIRE_PROMISE(id);
More moving towards using signed types. I'm still feeling this out, but I am starting to like the general idea.
2019-02-25 21:06:55 +00:00
if (count < 0)
return -EINVAL;
Kernel+Userland: Implement setuid() and setgid() and add /bin/su Also show setuid and setgid bits in "ls -l" output. :^)
2019-02-21 22:35:07 +00:00
if (!is_superuser())
Add some basic setgroups(), getgroups() and initgroups(). Also teach /bin/id to print the user's supplemental groups.
2018-11-07 00:38:51 +00:00
return -EPERM;
Kernel: Allow setgroups() to drop all groups with nullptr Previously we'd EFAULT for setgroups(0, nullptr), but we can just as well tolerate it if someone wants to drop groups without a pointer.
2020-01-04 12:47:54 +00:00
if (count && !validate_read(gids, count))
Improve syscall address validation a bit.
2018-11-16 15:10:59 +00:00
return -EFAULT;
Kernel: Don't include the process GID in the "extra GIDs" table Process::m_extra_gids is for supplementary GIDs only.
2020-01-02 22:45:52 +00:00
m_extra_gids.clear();
Kernel: Start implementing x86 SMAP support Supervisor Mode Access Prevention (SMAP) is an x86 CPU feature that prevents the kernel from accessing userspace memory. With SMAP enabled, trying to read/write a userspace memory address while in the kernel will now generate a page fault. Since it's sometimes necessary to read/write userspace memory, there are two new instructions that quickly switch the protection on/off: STAC (disables protection) and CLAC (enables protection.) These are exposed in kernel code via the stac() and clac() helpers. There's also a SmapDisabler RAII object that can be used to ensure that you don't forget to re-enable protection before returning to userspace code. THis patch also adds copy_to_user(), copy_from_user() and memset_user() which are the "correct" way of doing things. These functions allow us to briefly disable protection for a specific purpose, and then turn it back on immediately after it's done. Going forward all kernel code should be moved to using these and all uses of SmapDisabler are to be considered FIXME's. Note that we're not realizing the full potential of this feature since I've used SmapDisabler quite liberally in this initial bring-up patch.
2020-01-05 17:00:15 +00:00
SmapDisabler disabler;
Kernel: Don't include the process GID in the "extra GIDs" table Process::m_extra_gids is for supplementary GIDs only.
2020-01-02 22:45:52 +00:00
for (int i = 0; i < count; ++i) {
if (gids[i] == m_gid)
continue;
m_extra_gids.set(gids[i]);
}
Add some basic setgroups(), getgroups() and initgroups(). Also teach /bin/id to print the user's supplemental groups.
2018-11-07 00:38:51 +00:00
return 0;
}
Finally hook up the mkdir code to a syscall. Added a /bin/mkdir that makes directories. How very neat :^) There are various limitations because of missing functionality.
2018-11-18 13:57:41 +00:00
Kernel: Pass path+length to mkdir(), rmdir() and chmod()
2020-01-06 10:05:59 +00:00
int Process::sys$mkdir(const char* user_path, size_t path_length, mode_t mode)
Finally hook up the mkdir code to a syscall. Added a /bin/mkdir that makes directories. How very neat :^) There are various limitations because of missing functionality.
2018-11-18 13:57:41 +00:00
{
ping: Use pledge()
2020-01-11 19:48:43 +00:00
REQUIRE_PROMISE(cpath);
Kernel: Pass path+length to mkdir(), rmdir() and chmod()
2020-01-06 10:05:59 +00:00
auto path = get_syscall_path_argument(user_path, path_length);
if (path.is_error())
return path.error();
return VFS::the().mkdir(path.value(), mode & ~umask(), current_directory());
Finally hook up the mkdir code to a syscall. Added a /bin/mkdir that makes directories. How very neat :^) There are various limitations because of missing functionality.
2018-11-18 13:57:41 +00:00
}
Implement basic support for times(). The kernel now bills processes for time spent in kernelspace and userspace separately. The accounting is forwarded to the parent process in reap(). This makes the "time" builtin in bash work.
2018-12-03 00:12:26 +00:00
Kernel: Make realpath() take path+length, get rid of SmapDisabler
2020-01-06 10:32:25 +00:00
int Process::sys$realpath(const Syscall::SC_realpath_params* user_params)
Kernel: Add realpath syscall
2019-08-25 16:17:05 +00:00
{
ping: Use pledge()
2020-01-11 19:48:43 +00:00
REQUIRE_PROMISE(rpath);
Kernel: Add realpath syscall
2019-08-25 16:17:05 +00:00
Kernel: Make realpath() take path+length, get rid of SmapDisabler
2020-01-06 10:32:25 +00:00
Syscall::SC_realpath_params params;
Kernel: Combine validate and copy of user mode pointers (#1069) Right now there is a significant amount of boiler plate code required to validate user mode parameters in syscalls. In an attempt to reduce this a bit, introduce validate_read_and_copy_typed which combines the usermode address check and does the copy internally if the validation passes. This cleans up a little bit of code from a significant amount of syscalls.
2020-01-13 10:19:18 +00:00
if (!validate_read_and_copy_typed(&params, user_params))
return -EFAULT;
Kernel: Make realpath() take path+length, get rid of SmapDisabler
2020-01-06 10:32:25 +00:00
Kernel: Use the Syscall string and buffer types more While I was updating syscalls to stop passing null-terminated strings, I added some helpful struct types: - StringArgument { const char*; size_t; } - ImmutableBuffer<Data, Size> { const Data*; Size; } - MutableBuffer<Data, Size> { Data*; Size; } The Process class has some convenience functions for validating and optionally extracting the contents from these structs: - get_syscall_path_argument(StringArgument) - validate_and_copy_string_from_user(StringArgument) - validate(ImmutableBuffer) - validate(MutableBuffer) There's still so much code around this and I'm wondering if we should generate most of it instead. Possible nice little project.
2020-01-11 11:47:47 +00:00
if (!validate_write(params.buffer.data, params.buffer.size))
Kernel: Add realpath syscall
2019-08-25 16:17:05 +00:00
return -EFAULT;
Kernel: Use the Syscall string and buffer types more While I was updating syscalls to stop passing null-terminated strings, I added some helpful struct types: - StringArgument { const char*; size_t; } - ImmutableBuffer<Data, Size> { const Data*; Size; } - MutableBuffer<Data, Size> { Data*; Size; } The Process class has some convenience functions for validating and optionally extracting the contents from these structs: - get_syscall_path_argument(StringArgument) - validate_and_copy_string_from_user(StringArgument) - validate(ImmutableBuffer) - validate(MutableBuffer) There's still so much code around this and I'm wondering if we should generate most of it instead. Possible nice little project.
2020-01-11 11:47:47 +00:00
auto path = get_syscall_path_argument(params.path);
Kernel: Make realpath() take path+length, get rid of SmapDisabler
2020-01-06 10:32:25 +00:00
if (path.is_error())
return path.error();
auto custody_or_error = VFS::the().resolve_path(path.value(), current_directory());
Kernel: Add realpath syscall
2019-08-25 16:17:05 +00:00
if (custody_or_error.is_error())
return custody_or_error.error();
auto& custody = custody_or_error.value();
Kernel: Remove the use of FileSystemPath in sys$realpath() Now that VFS::resolve_path() canonicalizes paths automatically, we don't need to do that here anymore.
2020-01-15 11:05:49 +00:00
auto absolute_path = custody->absolute_path();
Kernel: Add realpath syscall
2019-08-25 16:17:05 +00:00
Kernel: Remove the use of FileSystemPath in sys$realpath() Now that VFS::resolve_path() canonicalizes paths automatically, we don't need to do that here anymore.
2020-01-15 11:05:49 +00:00
if (absolute_path.length() + 1 > params.buffer.size)
Kernel: Make realpath() take path+length, get rid of SmapDisabler
2020-01-06 10:32:25 +00:00
return -ENAMETOOLONG;
Kernel: Remove the use of FileSystemPath in sys$realpath() Now that VFS::resolve_path() canonicalizes paths automatically, we don't need to do that here anymore.
2020-01-15 11:05:49 +00:00
copy_to_user(params.buffer.data, absolute_path.characters(), absolute_path.length() + 1);
Kernel: Add realpath syscall
2019-08-25 16:17:05 +00:00
return 0;
};
Kernel: Get rid of Unix namespace. This is no longer needed as the Kernel can stand on its own legs now and there won't be any conflict with host system data types.
2019-01-23 05:53:01 +00:00
clock_t Process::sys$times(tms* times)
Implement basic support for times(). The kernel now bills processes for time spent in kernelspace and userspace separately. The accounting is forwarded to the parent process in reap(). This makes the "time" builtin in bash work.
2018-12-03 00:12:26 +00:00
{
ping: Use pledge()
2020-01-11 19:48:43 +00:00
REQUIRE_PROMISE(stdio);
Implement basic support for times(). The kernel now bills processes for time spent in kernelspace and userspace separately. The accounting is forwarded to the parent process in reap(). This makes the "time" builtin in bash work.
2018-12-03 00:12:26 +00:00
if (!validate_write_typed(times))
return -EFAULT;
Kernel: Use the templated copy_to/from_user() in more places These ensure that the "to" and "from" pointers have the same type, and also that we copy the correct number of bytes.
2020-01-20 12:38:31 +00:00
copy_to_user(&times->tms_utime, &m_ticks_in_user);
copy_to_user(&times->tms_stime, &m_ticks_in_kernel);
copy_to_user(&times->tms_cutime, &m_ticks_in_user_for_dead_children);
copy_to_user(&times->tms_cstime, &m_ticks_in_kernel_for_dead_children);
Kernel: Make the times() syscall return something other than 0. Based on the description I read, this syscall doesn't seem completely reasonable, but let's at least return a number that is likely to change between invocations in case somebody depends on that happening.
2019-05-17 18:19:29 +00:00
return g_uptime & 0x7fffffff;
Implement basic support for times(). The kernel now bills processes for time spent in kernelspace and userspace separately. The accounting is forwarded to the parent process in reap(). This makes the "time" builtin in bash work.
2018-12-03 00:12:26 +00:00
}
Switch into 1024x768x32bpp VESA LFB mode at boot. This is going to be pretty cool once I can hook up the Widgets/ code to it.
2019-01-09 01:29:11 +00:00
Implement basic support for POSIX-style select(). Now we can block on both the PTY *and* the GUI event stream in Terminal.
2019-01-15 22:12:20 +00:00
int Process::sys$select(const Syscall::SC_select_params* params)
{
ping: Use pledge()
2020-01-11 19:48:43 +00:00
REQUIRE_PROMISE(stdio);
Kernel: Tidy up sys$select() to make it more readable.
2019-06-06 15:46:41 +00:00
// FIXME: Return -EINVAL if timeout is invalid.
Implement basic support for POSIX-style select(). Now we can block on both the PTY *and* the GUI event stream in Terminal.
2019-01-15 22:12:20 +00:00
if (!validate_read_typed(params))
return -EFAULT;
Kernel: Use C++ structured bindings to bind syscall parameters Some syscalls have to pass parameters through a struct, since we can only fit 3 parameters with our calling convention. This patch makes use of C++ structured binding to clean up the places where we expand those parameters structs into local variables.
2019-11-10 14:32:59 +00:00
Kernel: Start implementing x86 SMAP support Supervisor Mode Access Prevention (SMAP) is an x86 CPU feature that prevents the kernel from accessing userspace memory. With SMAP enabled, trying to read/write a userspace memory address while in the kernel will now generate a page fault. Since it's sometimes necessary to read/write userspace memory, there are two new instructions that quickly switch the protection on/off: STAC (disables protection) and CLAC (enables protection.) These are exposed in kernel code via the stac() and clac() helpers. There's also a SmapDisabler RAII object that can be used to ensure that you don't forget to re-enable protection before returning to userspace code. THis patch also adds copy_to_user(), copy_from_user() and memset_user() which are the "correct" way of doing things. These functions allow us to briefly disable protection for a specific purpose, and then turn it back on immediately after it's done. Going forward all kernel code should be moved to using these and all uses of SmapDisabler are to be considered FIXME's. Note that we're not realizing the full potential of this feature since I've used SmapDisabler quite liberally in this initial bring-up patch.
2020-01-05 17:00:15 +00:00
SmapDisabler disabler;
Kernel: Fix bad TOCTOU pattern in syscalls that take a parameter struct Our syscall calling convention only allows passing up to 3 arguments in registers. For syscalls that take more arguments, we bake them into a struct and pass a pointer to that struct instead. When doing pointer validation, this is what we would do: 1) Validate the "params" struct 2) Validate "params->some_pointer" 3) ... other stuff ... 4) Use "params->some_pointer" Since the parameter struct is stored in userspace, it can be modified by userspace after validation has completed. This was a recurring pattern in many syscalls that was further hidden by me using structured binding declarations to give convenient local names to things in the parameter struct: auto& [some_pointer, ...] = *params; memcpy(some_pointer, ...); This devilishly makes "some_pointer" look like a local variable but it's actually more like an alias for "params->some_pointer" and will expand to a dereference when accessed! This patch fixes the issues by explicitly copying out each member from the parameter structs before validating them, and then never using the "param" pointers beyond that. Thanks to braindead for finding this bug! :^)
2020-01-05 08:13:00 +00:00
int nfds = params->nfds;
fd_set* readfds = params->readfds;
fd_set* writefds = params->writefds;
fd_set* exceptfds = params->exceptfds;
timeval* timeout = params->timeout;
Kernel: Use C++ structured bindings to bind syscall parameters Some syscalls have to pass parameters through a struct, since we can only fit 3 parameters with our calling convention. This patch makes use of C++ structured binding to clean up the places where we expand those parameters structs into local variables.
2019-11-10 14:32:59 +00:00
if (writefds && !validate_write_typed(writefds))
Implement basic support for POSIX-style select(). Now we can block on both the PTY *and* the GUI event stream in Terminal.
2019-01-15 22:12:20 +00:00
return -EFAULT;
Kernel: Use C++ structured bindings to bind syscall parameters Some syscalls have to pass parameters through a struct, since we can only fit 3 parameters with our calling convention. This patch makes use of C++ structured binding to clean up the places where we expand those parameters structs into local variables.
2019-11-10 14:32:59 +00:00
if (readfds && !validate_write_typed(readfds))
Implement basic support for POSIX-style select(). Now we can block on both the PTY *and* the GUI event stream in Terminal.
2019-01-15 22:12:20 +00:00
return -EFAULT;
Kernel: Use C++ structured bindings to bind syscall parameters Some syscalls have to pass parameters through a struct, since we can only fit 3 parameters with our calling convention. This patch makes use of C++ structured binding to clean up the places where we expand those parameters structs into local variables.
2019-11-10 14:32:59 +00:00
if (exceptfds && !validate_write_typed(exceptfds))
Implement basic support for POSIX-style select(). Now we can block on both the PTY *and* the GUI event stream in Terminal.
2019-01-15 22:12:20 +00:00
return -EFAULT;
Kernel: Use C++ structured bindings to bind syscall parameters Some syscalls have to pass parameters through a struct, since we can only fit 3 parameters with our calling convention. This patch makes use of C++ structured binding to clean up the places where we expand those parameters structs into local variables.
2019-11-10 14:32:59 +00:00
if (timeout && !validate_read_typed(timeout))
Implement basic support for POSIX-style select(). Now we can block on both the PTY *and* the GUI event stream in Terminal.
2019-01-15 22:12:20 +00:00
return -EFAULT;
Kernel: Use C++ structured bindings to bind syscall parameters Some syscalls have to pass parameters through a struct, since we can only fit 3 parameters with our calling convention. This patch makes use of C++ structured binding to clean up the places where we expand those parameters structs into local variables.
2019-11-10 14:32:59 +00:00
if (nfds < 0)
Kernel: Tidy up sys$select() to make it more readable.
2019-06-06 15:46:41 +00:00
return -EINVAL;
Implement basic support for POSIX-style select(). Now we can block on both the PTY *and* the GUI event stream in Terminal.
2019-01-15 22:12:20 +00:00
Kernel: Use C++ structured bindings to bind syscall parameters Some syscalls have to pass parameters through a struct, since we can only fit 3 parameters with our calling convention. This patch makes use of C++ structured binding to clean up the places where we expand those parameters structs into local variables.
2019-11-10 14:32:59 +00:00
timeval computed_timeout;
Kernel: Port select to ThreadBlocker
2019-07-18 15:39:49 +00:00
bool select_has_timeout = false;
Kernel: Use C++ structured bindings to bind syscall parameters Some syscalls have to pass parameters through a struct, since we can only fit 3 parameters with our calling convention. This patch makes use of C++ structured binding to clean up the places where we expand those parameters structs into local variables.
2019-11-10 14:32:59 +00:00
if (timeout && (timeout->tv_sec || timeout->tv_usec)) {
timeval_add(kgettimeofday(), *timeout, computed_timeout);
Kernel: Port select to ThreadBlocker
2019-07-18 15:39:49 +00:00
select_has_timeout = true;
Implement event loop timers. GObjects can now register a timer with the GEventLoop. This will eventually cause GTimerEvents to be dispatched to the GObject. This needed a few supporting changes in the kernel: - The PIT now ticks 1000 times/sec. - select() now supports an arbitrary timeout. - gettimeofday() now returns something in the tv_usec field. With these changes, the clock window in guitest2 finally ticks on its own.
2019-02-01 02:50:06 +00:00
}
Implement basic support for POSIX-style select(). Now we can block on both the PTY *and* the GUI event stream in Terminal.
2019-01-15 22:12:20 +00:00
Kernel: Avoid allocations for Select vectors by using inline capacity Good tip by Andreas :)
2019-07-19 07:04:12 +00:00
Thread::SelectBlocker::FDVector rfds;
Thread::SelectBlocker::FDVector wfds;
Thread::SelectBlocker::FDVector efds;
Kernel: Port select to ThreadBlocker
2019-07-18 15:39:49 +00:00
Kernel: Run clang-format on everything.
2019-06-07 09:43:58 +00:00
auto transfer_fds = [&](auto* fds, auto& vector) -> int {
Kernel: Make sure to clear FD sets when preparing for a select NULL sets can happen, and we don't want to incorrectly return FDs which aren't in the set too.
2019-05-18 00:00:54 +00:00
vector.clear_with_capacity();
Kernel: Tidy up sys$select() to make it more readable.
2019-06-06 15:46:41 +00:00
if (!fds)
Kernel: select() should fail with EBADF if any set contains an invalid fd.
2019-01-30 18:01:31 +00:00
return 0;
Kernel: Fix bad TOCTOU pattern in syscalls that take a parameter struct Our syscall calling convention only allows passing up to 3 arguments in registers. For syscalls that take more arguments, we bake them into a struct and pass a pointer to that struct instead. When doing pointer validation, this is what we would do: 1) Validate the "params" struct 2) Validate "params->some_pointer" 3) ... other stuff ... 4) Use "params->some_pointer" Since the parameter struct is stored in userspace, it can be modified by userspace after validation has completed. This was a recurring pattern in many syscalls that was further hidden by me using structured binding declarations to give convenient local names to things in the parameter struct: auto& [some_pointer, ...] = *params; memcpy(some_pointer, ...); This devilishly makes "some_pointer" look like a local variable but it's actually more like an alias for "params->some_pointer" and will expand to a dereference when accessed! This patch fixes the issues by explicitly copying out each member from the parameter structs before validating them, and then never using the "param" pointers beyond that. Thanks to braindead for finding this bug! :^)
2020-01-05 08:13:00 +00:00
for (int fd = 0; fd < nfds; ++fd) {
Kernel: Tidy up sys$select() to make it more readable.
2019-06-06 15:46:41 +00:00
if (FD_ISSET(fd, fds)) {
WindowServer: Port to the new IPC system This patch introduces code generation for the WindowServer IPC with its clients. The client/server endpoints are defined by the two .ipc files in Servers/WindowServer/: WindowServer.ipc and WindowClient.ipc It now becomes significantly easier to add features and capabilities to WindowServer since you don't have to know nearly as much about all the intricate paths that IPC messages take between LibGUI and WSWindow. The new system also uses significantly less IPC bandwidth since we're now doing packed serialization instead of passing fixed-sized structs of ~600 bytes for each message. Some repaint coalescing optimizations are lost in this conversion and we'll need to look at how to implement those in the new world. The old CoreIPC::Client::Connection and CoreIPC::Server::Connection classes are removed by this patch and replaced by use of ConnectionNG, which will be renamed eventually. Goodbye, old WindowServer IPC. You served us well :^)
2019-12-02 08:33:37 +00:00
if (!file_description(fd)) {
Kernel: Tidy up debug logging a little bit When using dbg() in the kernel, the output is automatically prefixed with [Process(PID:TID)]. This makes it a lot easier to understand which thread is generating the output. This patch also cleans up some common logging messages and removes the now-unnecessary "dbg() << *current << ..." pattern.
2020-01-21 15:14:39 +00:00
dbg() << "sys$select: Bad fd number " << fd;
Kernel: select() should fail with EBADF if any set contains an invalid fd.
2019-01-30 18:01:31 +00:00
return -EBADF;
WindowServer: Port to the new IPC system This patch introduces code generation for the WindowServer IPC with its clients. The client/server endpoints are defined by the two .ipc files in Servers/WindowServer/: WindowServer.ipc and WindowClient.ipc It now becomes significantly easier to add features and capabilities to WindowServer since you don't have to know nearly as much about all the intricate paths that IPC messages take between LibGUI and WSWindow. The new system also uses significantly less IPC bandwidth since we're now doing packed serialization instead of passing fixed-sized structs of ~600 bytes for each message. Some repaint coalescing optimizations are lost in this conversion and we'll need to look at how to implement those in the new world. The old CoreIPC::Client::Connection and CoreIPC::Server::Connection classes are removed by this patch and replaced by use of ConnectionNG, which will be renamed eventually. Goodbye, old WindowServer IPC. You served us well :^)
2019-12-02 08:33:37 +00:00
}
Kernel: Tidy up sys$select() to make it more readable.
2019-06-06 15:46:41 +00:00
vector.append(fd);
Kernel: select() should fail with EBADF if any set contains an invalid fd.
2019-01-30 18:01:31 +00:00
}
Implement basic support for POSIX-style select(). Now we can block on both the PTY *and* the GUI event stream in Terminal.
2019-01-15 22:12:20 +00:00
}
Kernel: select() should fail with EBADF if any set contains an invalid fd.
2019-01-30 18:01:31 +00:00
return 0;
Implement basic support for POSIX-style select(). Now we can block on both the PTY *and* the GUI event stream in Terminal.
2019-01-15 22:12:20 +00:00
};
Kernel: Use C++ structured bindings to bind syscall parameters Some syscalls have to pass parameters through a struct, since we can only fit 3 parameters with our calling convention. This patch makes use of C++ structured binding to clean up the places where we expand those parameters structs into local variables.
2019-11-10 14:32:59 +00:00
if (int error = transfer_fds(writefds, wfds))
Kernel: select() should fail with EBADF if any set contains an invalid fd.
2019-01-30 18:01:31 +00:00
return error;
Kernel: Use C++ structured bindings to bind syscall parameters Some syscalls have to pass parameters through a struct, since we can only fit 3 parameters with our calling convention. This patch makes use of C++ structured binding to clean up the places where we expand those parameters structs into local variables.
2019-11-10 14:32:59 +00:00
if (int error = transfer_fds(readfds, rfds))
Kernel: select() should fail with EBADF if any set contains an invalid fd.
2019-01-30 18:01:31 +00:00
return error;
Kernel: Use C++ structured bindings to bind syscall parameters Some syscalls have to pass parameters through a struct, since we can only fit 3 parameters with our calling convention. This patch makes use of C++ structured binding to clean up the places where we expand those parameters structs into local variables.
2019-11-10 14:32:59 +00:00
if (int error = transfer_fds(exceptfds, efds))
More compat work towards porting vim. It now builds and runs in the small-featureset configuration. :^)
2019-02-26 23:02:01 +00:00
return error;
Implement basic support for POSIX-style select(). Now we can block on both the PTY *and* the GUI event stream in Terminal.
2019-01-15 22:12:20 +00:00
Kernel: Add the ability to debug poll/select independently of read/write
2019-05-19 08:24:28 +00:00
#if defined(DEBUG_IO) || defined(DEBUG_POLL_SELECT)
Kernel: Use C++ structured bindings to bind syscall parameters Some syscalls have to pass parameters through a struct, since we can only fit 3 parameters with our calling convention. This patch makes use of C++ structured binding to clean up the places where we expand those parameters structs into local variables.
2019-11-10 14:32:59 +00:00
dbgprintf("%s<%u> selecting on (read:%u, write:%u), timeout=%p\n", name().characters(), pid(), rfds.size(), wfds.size(), timeout);
Rework WindowServer to use select() in its main event loop. The system can finally idle without burning CPU. :^) There are some issues with scheduling making the mouse cursor sloppy and unresponsive that need to be dealt with.
2019-01-16 16:20:58 +00:00
#endif
Kernel: Use C++ structured bindings to bind syscall parameters Some syscalls have to pass parameters through a struct, since we can only fit 3 parameters with our calling convention. This patch makes use of C++ structured binding to clean up the places where we expand those parameters structs into local variables.
2019-11-10 14:32:59 +00:00
if (!timeout || select_has_timeout) {
Kernel: Fix kernel null deref on process crash during join_thread() The join_thread() syscall is not supposed to be interruptible by signals, but it was. And since the process death mechanism piggybacked on signal interrupts, it was possible to interrupt a pthread_join() by killing the process that was doing it, leading to confusing due to some assumptions being made by Thread::finalize() for threads that have a pending joiner. This patch fixes the issue by making "interrupted by death" a distinct block result separate from "interrupted by signal". Then we handle that state in join_thread() and tidy things up so that thread finalization doesn't get confused by the pending joiner being gone. Test: Tests/Kernel/null-deref-crash-during-pthread_join.cpp
2020-01-10 18:15:01 +00:00
if (current->block<Thread::SelectBlocker>(computed_timeout, select_has_timeout, rfds, wfds, efds) != Thread::BlockResult::WokeNormally)
Process: Fix select/poll EINTR Check for EINTR before doing anything with the passed sets, otherwise we zero them out which means a re-call with the same sets won't work.
2019-07-21 11:31:20 +00:00
return -EINTR;
}
Implement basic support for POSIX-style select(). Now we can block on both the PTY *and* the GUI event stream in Terminal.
2019-01-15 22:12:20 +00:00
Kernel: Tidy up sys$select() to make it more readable.
2019-06-06 15:46:41 +00:00
int marked_fd_count = 0;
Kernel: Run clang-format on everything.
2019-06-07 09:43:58 +00:00
auto mark_fds = [&](auto* fds, auto& vector, auto should_mark) {
Kernel: Tidy up sys$select() to make it more readable.
2019-06-06 15:46:41 +00:00
if (!fds)
return;
FD_ZERO(fds);
for (int fd : vector) {
Kernel: Make Process::file_description() vend a RefPtr<FileDescription> This encourages callers to strongly reference file descriptions while working with them. This fixes a use-after-free issue where one thread would close() an open fd while another thread was blocked on it becoming readable. Test: Kernel/uaf-close-while-blocked-in-read.cpp
2020-01-07 14:53:42 +00:00
if (auto description = file_description(fd); description && should_mark(*description)) {
Kernel: Tidy up sys$select() to make it more readable.
2019-06-06 15:46:41 +00:00
FD_SET(fd, fds);
++marked_fd_count;
Implement basic support for POSIX-style select(). Now we can block on both the PTY *and* the GUI event stream in Terminal.
2019-01-15 22:12:20 +00:00
}
}
Kernel: Tidy up sys$select() to make it more readable.
2019-06-06 15:46:41 +00:00
};
Kernel: Use C++ structured bindings to bind syscall parameters Some syscalls have to pass parameters through a struct, since we can only fit 3 parameters with our calling convention. This patch makes use of C++ structured binding to clean up the places where we expand those parameters structs into local variables.
2019-11-10 14:32:59 +00:00
mark_fds(readfds, rfds, [](auto& description) { return description.can_read(); });
mark_fds(writefds, wfds, [](auto& description) { return description.can_write(); });
// FIXME: We should also mark exceptfds as appropriate.
Thread: Return a result from block() indicating why the block terminated And use this to return EINTR in various places; some of which we were not handling properly before. This might expose a few bugs in userspace, but should be more compatible with other POSIX systems, and is certainly a little cleaner.
2019-07-20 09:05:52 +00:00
Kernel: Tidy up sys$select() to make it more readable.
2019-06-06 15:46:41 +00:00
return marked_fd_count;
Implement basic support for POSIX-style select(). Now we can block on both the PTY *and* the GUI event stream in Terminal.
2019-01-15 22:12:20 +00:00
}
Rework WindowServer to use select() in its main event loop. The system can finally idle without burning CPU. :^) There are some issues with scheduling making the mouse cursor sloppy and unresponsive that need to be dealt with.
2019-01-16 16:20:58 +00:00
Stub out poll() syscall and LibC wrapper.
2019-01-23 06:27:41 +00:00
int Process::sys$poll(pollfd* fds, int nfds, int timeout)
{
ping: Use pledge()
2020-01-11 19:48:43 +00:00
REQUIRE_PROMISE(stdio);
Stub out poll() syscall and LibC wrapper.
2019-01-23 06:27:41 +00:00
if (!validate_read_typed(fds))
return -EFAULT;
Kernel: Implement a limited version of POSIX poll().
2019-01-23 07:03:31 +00:00
Kernel: Start implementing x86 SMAP support Supervisor Mode Access Prevention (SMAP) is an x86 CPU feature that prevents the kernel from accessing userspace memory. With SMAP enabled, trying to read/write a userspace memory address while in the kernel will now generate a page fault. Since it's sometimes necessary to read/write userspace memory, there are two new instructions that quickly switch the protection on/off: STAC (disables protection) and CLAC (enables protection.) These are exposed in kernel code via the stac() and clac() helpers. There's also a SmapDisabler RAII object that can be used to ensure that you don't forget to re-enable protection before returning to userspace code. THis patch also adds copy_to_user(), copy_from_user() and memset_user() which are the "correct" way of doing things. These functions allow us to briefly disable protection for a specific purpose, and then turn it back on immediately after it's done. Going forward all kernel code should be moved to using these and all uses of SmapDisabler are to be considered FIXME's. Note that we're not realizing the full potential of this feature since I've used SmapDisabler quite liberally in this initial bring-up patch.
2020-01-05 17:00:15 +00:00
SmapDisabler disabler;
Kernel: Avoid allocations for Select vectors by using inline capacity Good tip by Andreas :)
2019-07-19 07:04:12 +00:00
Thread::SelectBlocker::FDVector rfds;
Thread::SelectBlocker::FDVector wfds;
Kernel: Port select to ThreadBlocker
2019-07-18 15:39:49 +00:00
Kernel: Implement a limited version of POSIX poll().
2019-01-23 07:03:31 +00:00
for (int i = 0; i < nfds; ++i) {
if (fds[i].events & POLLIN)
Kernel: Port select to ThreadBlocker
2019-07-18 15:39:49 +00:00
rfds.append(fds[i].fd);
Kernel: Implement a limited version of POSIX poll().
2019-01-23 07:03:31 +00:00
if (fds[i].events & POLLOUT)
Kernel: Port select to ThreadBlocker
2019-07-18 15:39:49 +00:00
wfds.append(fds[i].fd);
Kernel: Implement a limited version of POSIX poll().
2019-01-23 07:03:31 +00:00
}
Kernel: Port select to ThreadBlocker
2019-07-18 15:39:49 +00:00
timeval actual_timeout;
bool has_timeout = false;
Kernel: Fix poll() with timeout
2019-05-18 01:59:48 +00:00
if (timeout >= 0) {
// poll is in ms, we want s/us.
struct timeval tvtimeout;
tvtimeout.tv_sec = 0;
while (timeout >= 1000) {
tvtimeout.tv_sec += 1;
timeout -= 1000;
}
tvtimeout.tv_usec = timeout * 1000;
Kernel: Port select to ThreadBlocker
2019-07-18 15:39:49 +00:00
timeval_add(kgettimeofday(), tvtimeout, actual_timeout);
has_timeout = true;
Kernel: Fix poll() with timeout
2019-05-18 01:59:48 +00:00
}
Kernel: Add the ability to debug poll/select independently of read/write
2019-05-19 08:24:28 +00:00
#if defined(DEBUG_IO) || defined(DEBUG_POLL_SELECT)
Kernel: Port select to ThreadBlocker
2019-07-18 15:39:49 +00:00
dbgprintf("%s<%u> polling on (read:%u, write:%u), timeout=%d\n", name().characters(), pid(), rfds.size(), wfds.size(), timeout);
Kernel: Add the ability to debug poll/select independently of read/write
2019-05-19 08:24:28 +00:00
#endif
Kernel: mount system call (#396) It is now possible to mount ext2 `DiskDevice` devices under Serenity on any folder in the root filesystem. Currently any user can do this with any permissions. There's a fair amount of assumptions made here too, that might not be too good, but can be worked on in the future. This is a good start to allow more dynamic operation under the OS itself. It is also currently impossible to unmount and such, and devices will fail to mount in Linux as the FS 'needs to be cleaned'. I'll work on getting `umount` done ASAP to rectify this (as well as working on less assumption-making in the mount syscall. We don't want to just be able to mount DiskDevices!). This could probably be fixed with some `-t` flag or something similar.
2019-08-02 13:18:47 +00:00
if (has_timeout || timeout < 0) {
Kernel: Fix kernel null deref on process crash during join_thread() The join_thread() syscall is not supposed to be interruptible by signals, but it was. And since the process death mechanism piggybacked on signal interrupts, it was possible to interrupt a pthread_join() by killing the process that was doing it, leading to confusing due to some assumptions being made by Thread::finalize() for threads that have a pending joiner. This patch fixes the issue by making "interrupted by death" a distinct block result separate from "interrupted by signal". Then we handle that state in join_thread() and tidy things up so that thread finalization doesn't get confused by the pending joiner being gone. Test: Tests/Kernel/null-deref-crash-during-pthread_join.cpp
2020-01-10 18:15:01 +00:00
if (current->block<Thread::SelectBlocker>(actual_timeout, has_timeout, rfds, wfds, Thread::SelectBlocker::FDVector()) != Thread::BlockResult::WokeNormally)
Process: Fix select/poll EINTR Check for EINTR before doing anything with the passed sets, otherwise we zero them out which means a re-call with the same sets won't work.
2019-07-21 11:31:20 +00:00
return -EINTR;
}
Kernel: Implement a limited version of POSIX poll().
2019-01-23 07:03:31 +00:00
int fds_with_revents = 0;
for (int i = 0; i < nfds; ++i) {
Kernel: Make Process::file_description() vend a RefPtr<FileDescription> This encourages callers to strongly reference file descriptions while working with them. This fixes a use-after-free issue where one thread would close() an open fd while another thread was blocked on it becoming readable. Test: Kernel/uaf-close-while-blocked-in-read.cpp
2020-01-07 14:53:42 +00:00
auto description = file_description(fds[i].fd);
Kernel: Rename "descriptor" to "description" where appropriate. Now that FileDescription is called that, variables of that type should not be called "descriptor". This is kinda wordy but we'll get used to it.
2019-06-13 20:03:04 +00:00
if (!description) {
Kernel: Implement a limited version of POSIX poll().
2019-01-23 07:03:31 +00:00
fds[i].revents = POLLNVAL;
continue;
}
fds[i].revents = 0;
Kernel: Rename "descriptor" to "description" where appropriate. Now that FileDescription is called that, variables of that type should not be called "descriptor". This is kinda wordy but we'll get used to it.
2019-06-13 20:03:04 +00:00
if (fds[i].events & POLLIN && description->can_read())
Kernel: Implement a limited version of POSIX poll().
2019-01-23 07:03:31 +00:00
fds[i].revents |= POLLIN;
Kernel: Rename "descriptor" to "description" where appropriate. Now that FileDescription is called that, variables of that type should not be called "descriptor". This is kinda wordy but we'll get used to it.
2019-06-13 20:03:04 +00:00
if (fds[i].events & POLLOUT && description->can_write())
Kernel: Implement a limited version of POSIX poll().
2019-01-23 07:03:31 +00:00
fds[i].revents |= POLLOUT;
if (fds[i].revents)
++fds_with_revents;
}
return fds_with_revents;
Stub out poll() syscall and LibC wrapper.
2019-01-23 06:27:41 +00:00
}
Kernel: Rename Process::cwd_custody() to Process::current_directory(). ...and executable_custody() to just executable().
2019-05-30 18:23:50 +00:00
Custody& Process::current_directory()
Rework WindowServer to use select() in its main event loop. The system can finally idle without burning CPU. :^) There are some issues with scheduling making the mouse cursor sloppy and unresponsive that need to be dealt with.
2019-01-16 16:20:58 +00:00
{
Kernel: Rename Process::cwd_custody() to Process::current_directory(). ...and executable_custody() to just executable().
2019-05-30 18:23:50 +00:00
if (!m_cwd)
m_cwd = VFS::the().root_custody();
return *m_cwd;
Rework WindowServer to use select() in its main event loop. The system can finally idle without burning CPU. :^) There are some issues with scheduling making the mouse cursor sloppy and unresponsive that need to be dealt with.
2019-01-16 16:20:58 +00:00
}
Add unlink() syscall and /bin/rm. This patch adds most of the plumbing for working file deletion in Ext2FS. Directory entries are removed and inode link counts updated. We don't yet update the inode or block bitmaps, I will do that separately.
2019-01-22 06:03:44 +00:00
Kernel: Pass characters+length to link()
2020-01-10 20:26:47 +00:00
int Process::sys$link(const Syscall::SC_link_params* user_params)
Kernel: Add link() syscall to create hard links. This accidentally grew into a little bit of VFS cleanup as well. Also add a simple /bin/ln implementation to exercise it.
2019-02-21 12:26:40 +00:00
{
ping: Use pledge()
2020-01-11 19:48:43 +00:00
REQUIRE_PROMISE(cpath);
Kernel: Pass characters+length to link()
2020-01-10 20:26:47 +00:00
Syscall::SC_link_params params;
Kernel: Combine validate and copy of user mode pointers (#1069) Right now there is a significant amount of boiler plate code required to validate user mode parameters in syscalls. In an attempt to reduce this a bit, introduce validate_read_and_copy_typed which combines the usermode address check and does the copy internally if the validation passes. This cleans up a little bit of code from a significant amount of syscalls.
2020-01-13 10:19:18 +00:00
if (!validate_read_and_copy_typed(&params, user_params))
return -EFAULT;
Kernel: Pass characters+length to link()
2020-01-10 20:26:47 +00:00
auto old_path = validate_and_copy_string_from_user(params.old_path);
auto new_path = validate_and_copy_string_from_user(params.new_path);
if (old_path.is_null() || new_path.is_null())
Kernel: Add link() syscall to create hard links. This accidentally grew into a little bit of VFS cleanup as well. Also add a simple /bin/ln implementation to exercise it.
2019-02-21 12:26:40 +00:00
return -EFAULT;
Kernel: Pass characters+length to link()
2020-01-10 20:26:47 +00:00
return VFS::the().link(old_path, new_path, current_directory());
Kernel: Add link() syscall to create hard links. This accidentally grew into a little bit of VFS cleanup as well. Also add a simple /bin/ln implementation to exercise it.
2019-02-21 12:26:40 +00:00
}
Kernel: Take path+length in the unlink() and umount() syscalls
2020-01-09 11:41:15 +00:00
int Process::sys$unlink(const char* user_path, size_t path_length)
Add unlink() syscall and /bin/rm. This patch adds most of the plumbing for working file deletion in Ext2FS. Directory entries are removed and inode link counts updated. We don't yet update the inode or block bitmaps, I will do that separately.
2019-01-22 06:03:44 +00:00
{
ping: Use pledge()
2020-01-11 19:48:43 +00:00
REQUIRE_PROMISE(cpath);
Kernel: Take path+length in the unlink() and umount() syscalls
2020-01-09 11:41:15 +00:00
if (!validate_read(user_path, path_length))
return -EFAULT;
auto path = get_syscall_path_argument(user_path, path_length);
if (path.is_error())
return path.error();
return VFS::the().unlink(path.value(), current_directory());
Add unlink() syscall and /bin/rm. This patch adds most of the plumbing for working file deletion in Ext2FS. Directory entries are removed and inode link counts updated. We don't yet update the inode or block bitmaps, I will do that separately.
2019-01-22 06:03:44 +00:00
}
Terminal: Redraw entire line if any of its characters are dirty. This means we only have to do one fill_rect() per line and the whole process ends up being ~10% faster than before. Also added a read_tsc() syscall to give userspace access to the TSC.
2019-01-25 01:09:29 +00:00
Kernel: Pass a parameter struct to symlink()
2020-01-11 09:31:33 +00:00
int Process::sys$symlink(const Syscall::SC_symlink_params* user_params)
Kernel+Userland: Add symlink() syscall and add "-s" flag to /bin/ln. It's now possible to create symbolic links! :^) This exposed an issue in Ext2FS where we'd write uninitialized data past the end of an inode's content. Fix this by zeroing out the tail end of the last block in a file.
2019-03-02 00:50:34 +00:00
{
ping: Use pledge()
2020-01-11 19:48:43 +00:00
REQUIRE_PROMISE(cpath);
Kernel: Pass a parameter struct to symlink()
2020-01-11 09:31:33 +00:00
Syscall::SC_symlink_params params;
Kernel: Combine validate and copy of user mode pointers (#1069) Right now there is a significant amount of boiler plate code required to validate user mode parameters in syscalls. In an attempt to reduce this a bit, introduce validate_read_and_copy_typed which combines the usermode address check and does the copy internally if the validation passes. This cleans up a little bit of code from a significant amount of syscalls.
2020-01-13 10:19:18 +00:00
if (!validate_read_and_copy_typed(&params, user_params))
return -EFAULT;
Kernel: Use the Syscall string and buffer types more While I was updating syscalls to stop passing null-terminated strings, I added some helpful struct types: - StringArgument { const char*; size_t; } - ImmutableBuffer<Data, Size> { const Data*; Size; } - MutableBuffer<Data, Size> { Data*; Size; } The Process class has some convenience functions for validating and optionally extracting the contents from these structs: - get_syscall_path_argument(StringArgument) - validate_and_copy_string_from_user(StringArgument) - validate(ImmutableBuffer) - validate(MutableBuffer) There's still so much code around this and I'm wondering if we should generate most of it instead. Possible nice little project.
2020-01-11 11:47:47 +00:00
auto target = get_syscall_path_argument(params.target);
Kernel: Pass a parameter struct to symlink()
2020-01-11 09:31:33 +00:00
if (target.is_error())
return target.error();
Kernel: Use the Syscall string and buffer types more While I was updating syscalls to stop passing null-terminated strings, I added some helpful struct types: - StringArgument { const char*; size_t; } - ImmutableBuffer<Data, Size> { const Data*; Size; } - MutableBuffer<Data, Size> { Data*; Size; } The Process class has some convenience functions for validating and optionally extracting the contents from these structs: - get_syscall_path_argument(StringArgument) - validate_and_copy_string_from_user(StringArgument) - validate(ImmutableBuffer) - validate(MutableBuffer) There's still so much code around this and I'm wondering if we should generate most of it instead. Possible nice little project.
2020-01-11 11:47:47 +00:00
auto linkpath = get_syscall_path_argument(params.linkpath);
Kernel: Pass a parameter struct to symlink()
2020-01-11 09:31:33 +00:00
if (linkpath.is_error())
return linkpath.error();
return VFS::the().symlink(target.value(), linkpath.value(), current_directory());
Kernel+Userland: Add symlink() syscall and add "-s" flag to /bin/ln. It's now possible to create symbolic links! :^) This exposed an issue in Ext2FS where we'd write uninitialized data past the end of an inode's content. Fix this by zeroing out the tail end of the last block in a file.
2019-03-02 00:50:34 +00:00
}
Kernel: Use the Syscall string and buffer types more While I was updating syscalls to stop passing null-terminated strings, I added some helpful struct types: - StringArgument { const char*; size_t; } - ImmutableBuffer<Data, Size> { const Data*; Size; } - MutableBuffer<Data, Size> { Data*; Size; } The Process class has some convenience functions for validating and optionally extracting the contents from these structs: - get_syscall_path_argument(StringArgument) - validate_and_copy_string_from_user(StringArgument) - validate(ImmutableBuffer) - validate(MutableBuffer) There's still so much code around this and I'm wondering if we should generate most of it instead. Possible nice little project.
2020-01-11 11:47:47 +00:00
KResultOr<String> Process::get_syscall_path_argument(const char* user_path, size_t path_length) const
Add support for removing directories. It's really only supported in Ext2FS since SynthFS doesn't really want you mucking around with its files. This is pretty neat though :^) I ran into some trouble with HashMap while working on this but opted to work around it and leave that for a separate investigation.
2019-01-28 03:16:01 +00:00
{
Kernel: Pass path+length to mkdir(), rmdir() and chmod()
2020-01-06 10:05:59 +00:00
if (path_length == 0)
return KResult(-EINVAL);
if (path_length > PATH_MAX)
return KResult(-ENAMETOOLONG);
if (!validate_read(user_path, path_length))
return KResult(-EFAULT);
return copy_string_from_user(user_path, path_length);
Add support for removing directories. It's really only supported in Ext2FS since SynthFS doesn't really want you mucking around with its files. This is pretty neat though :^) I ran into some trouble with HashMap while working on this but opted to work around it and leave that for a separate investigation.
2019-01-28 03:16:01 +00:00
}
Kernel: Use the Syscall string and buffer types more While I was updating syscalls to stop passing null-terminated strings, I added some helpful struct types: - StringArgument { const char*; size_t; } - ImmutableBuffer<Data, Size> { const Data*; Size; } - MutableBuffer<Data, Size> { Data*; Size; } The Process class has some convenience functions for validating and optionally extracting the contents from these structs: - get_syscall_path_argument(StringArgument) - validate_and_copy_string_from_user(StringArgument) - validate(ImmutableBuffer) - validate(MutableBuffer) There's still so much code around this and I'm wondering if we should generate most of it instead. Possible nice little project.
2020-01-11 11:47:47 +00:00
KResultOr<String> Process::get_syscall_path_argument(const Syscall::StringArgument& path) const
{
return get_syscall_path_argument(path.characters, path.length);
}
Kernel: Pass path+length to mkdir(), rmdir() and chmod()
2020-01-06 10:05:59 +00:00
int Process::sys$rmdir(const char* user_path, size_t path_length)
Implement basic chmod() syscall and /bin/chmod helper. Only raw octal modes are supported right now. This patch also changes mode_t from 32-bit to 16-bit to match the on-disk type used by Ext2FS. I also ran into EPERM being errno=0 which was confusing, so I inserted an ESUCCESS in its place.
2019-01-29 03:55:08 +00:00
{
ping: Use pledge()
2020-01-11 19:48:43 +00:00
REQUIRE_PROMISE(cpath);
Kernel: Pass path+length to mkdir(), rmdir() and chmod()
2020-01-06 10:05:59 +00:00
auto path = get_syscall_path_argument(user_path, path_length);
if (path.is_error())
return path.error();
return VFS::the().rmdir(path.value(), current_directory());
}
int Process::sys$chmod(const char* user_path, size_t path_length, mode_t mode)
{
ping: Use pledge()
2020-01-11 19:48:43 +00:00
REQUIRE_PROMISE(fattr);
Kernel: Pass path+length to mkdir(), rmdir() and chmod()
2020-01-06 10:05:59 +00:00
auto path = get_syscall_path_argument(user_path, path_length);
if (path.is_error())
return path.error();
return VFS::the().chmod(path.value(), mode, current_directory());
Implement basic chmod() syscall and /bin/chmod helper. Only raw octal modes are supported right now. This patch also changes mode_t from 32-bit to 16-bit to match the on-disk type used by Ext2FS. I also ran into EPERM being errno=0 which was confusing, so I inserted an ESUCCESS in its place.
2019-01-29 03:55:08 +00:00
}
Deallocate PTY's when they close. This required a fair bit of plumbing. The CharacterDevice::close() virtual will now be closed by ~FileDescriptor(), allowing device implementations to do custom cleanup at that point. One big problem remains: if the master PTY is closed before the slave PTY, we go into crashy land.
2019-01-30 17:26:19 +00:00
Kernel+Userland: Implement fchmod() syscall and use it to improve /bin/cp. /bin/cp will now copy the permission bits from source to destination. :^)
2019-03-01 09:39:19 +00:00
int Process::sys$fchmod(int fd, mode_t mode)
{
ping: Use pledge()
2020-01-11 19:48:43 +00:00
REQUIRE_PROMISE(fattr);
Kernel: Make Process::file_description() vend a RefPtr<FileDescription> This encourages callers to strongly reference file descriptions while working with them. This fixes a use-after-free issue where one thread would close() an open fd while another thread was blocked on it becoming readable. Test: Kernel/uaf-close-while-blocked-in-read.cpp
2020-01-07 14:53:42 +00:00
auto description = file_description(fd);
Kernel: Rename "descriptor" to "description" where appropriate. Now that FileDescription is called that, variables of that type should not be called "descriptor". This is kinda wordy but we'll get used to it.
2019-06-13 20:03:04 +00:00
if (!description)
Kernel+Userland: Implement fchmod() syscall and use it to improve /bin/cp. /bin/cp will now copy the permission bits from source to destination. :^)
2019-03-01 09:39:19 +00:00
return -EBADF;
Kernel: Allow fchmod() and fchown() on pre-bind() local sockets In order to ensure a specific owner and mode when the local socket filesystem endpoint is instantiated, we need to be able to call fchmod() and fchown() on a socket fd between socket() and bind(). This is because until we call bind(), there is no filesystem inode for the socket yet.
2020-01-03 19:14:56 +00:00
return description->chmod(mode);
Kernel+Userland: Implement fchmod() syscall and use it to improve /bin/cp. /bin/cp will now copy the permission bits from source to destination. :^)
2019-03-01 09:39:19 +00:00
}
Kernel: Add fchown() syscall.
2019-06-01 18:31:36 +00:00
int Process::sys$fchown(int fd, uid_t uid, gid_t gid)
{
ping: Use pledge()
2020-01-11 19:48:43 +00:00
REQUIRE_PROMISE(chown);
Kernel: Make Process::file_description() vend a RefPtr<FileDescription> This encourages callers to strongly reference file descriptions while working with them. This fixes a use-after-free issue where one thread would close() an open fd while another thread was blocked on it becoming readable. Test: Kernel/uaf-close-while-blocked-in-read.cpp
2020-01-07 14:53:42 +00:00
auto description = file_description(fd);
Kernel: Rename "descriptor" to "description" where appropriate. Now that FileDescription is called that, variables of that type should not be called "descriptor". This is kinda wordy but we'll get used to it.
2019-06-13 20:03:04 +00:00
if (!description)
Kernel: Add fchown() syscall.
2019-06-01 18:31:36 +00:00
return -EBADF;
Kernel: Rename "descriptor" to "description" where appropriate. Now that FileDescription is called that, variables of that type should not be called "descriptor". This is kinda wordy but we'll get used to it.
2019-06-13 20:03:04 +00:00
return description->chown(uid, gid);
Kernel: Add fchown() syscall.
2019-06-01 18:31:36 +00:00
}
Kernel: Pass a parameter struct to chown()
2020-01-11 09:17:08 +00:00
int Process::sys$chown(const Syscall::SC_chown_params* user_params)
Add chown() syscall and a simple /bin/chown program.
2019-02-27 11:32:53 +00:00
{
ping: Use pledge()
2020-01-11 19:48:43 +00:00
REQUIRE_PROMISE(chown);
Kernel: Pass a parameter struct to chown()
2020-01-11 09:17:08 +00:00
Syscall::SC_chown_params params;
Kernel: Combine validate and copy of user mode pointers (#1069) Right now there is a significant amount of boiler plate code required to validate user mode parameters in syscalls. In an attempt to reduce this a bit, introduce validate_read_and_copy_typed which combines the usermode address check and does the copy internally if the validation passes. This cleans up a little bit of code from a significant amount of syscalls.
2020-01-13 10:19:18 +00:00
if (!validate_read_and_copy_typed(&params, user_params))
return -EFAULT;
Kernel: Use the Syscall string and buffer types more While I was updating syscalls to stop passing null-terminated strings, I added some helpful struct types: - StringArgument { const char*; size_t; } - ImmutableBuffer<Data, Size> { const Data*; Size; } - MutableBuffer<Data, Size> { Data*; Size; } The Process class has some convenience functions for validating and optionally extracting the contents from these structs: - get_syscall_path_argument(StringArgument) - validate_and_copy_string_from_user(StringArgument) - validate(ImmutableBuffer) - validate(MutableBuffer) There's still so much code around this and I'm wondering if we should generate most of it instead. Possible nice little project.
2020-01-11 11:47:47 +00:00
auto path = get_syscall_path_argument(params.path);
Kernel: Pass a parameter struct to chown()
2020-01-11 09:17:08 +00:00
if (path.is_error())
return path.error();
return VFS::the().chown(path.value(), params.uid, params.gid, current_directory());
Add chown() syscall and a simple /bin/chown program.
2019-02-27 11:32:53 +00:00
}
Kernel: Add a Finalizer process to take care of dying processes. Instead of processes themselves getting scheduled to finish dying, let's have a Finalizer process that wakes up whenever someone is dying. This way we can do all kinds of lock-taking in process cleanup without risking reentering the scheduler.
2019-02-06 17:45:21 +00:00
void Process::finalize()
Deallocate PTY's when they close. This required a fair bit of plumbing. The CharacterDevice::close() virtual will now be closed by ~FileDescriptor(), allowing device implementations to do custom cleanup at that point. One big problem remains: if the master PTY is closed before the slave PTY, we go into crashy land.
2019-01-30 17:26:19 +00:00
{
Kernel: Add a Finalizer process to take care of dying processes. Instead of processes themselves getting scheduled to finish dying, let's have a Finalizer process that wakes up whenever someone is dying. This way we can do all kinds of lock-taking in process cleanup without risking reentering the scheduler.
2019-02-06 17:45:21 +00:00
ASSERT(current == g_finalizer);
Kernel: Finalizer should not go back to sleep if there's more to do Before putting itself back on the wait queue, the finalizer task will now check if there's more work to do, and if so, do it first. :^) This patch also puts a bunch of process/thread debug logging behind PROCESS_DEBUG and THREAD_DEBUG since it was unbearable to debug this stuff with all the spam.
2020-02-01 09:27:25 +00:00
#ifdef PROCESS_DEBUG
Kernel: Tidy up debug logging a little bit When using dbg() in the kernel, the output is automatically prefixed with [Process(PID:TID)]. This makes it a lot easier to understand which thread is generating the output. This patch also cleans up some common logging messages and removes the now-unnecessary "dbg() << *current << ..." pattern.
2020-01-21 15:14:39 +00:00
dbg() << "Finalizing process " << *this;
Kernel: Finalizer should not go back to sleep if there's more to do Before putting itself back on the wait queue, the finalizer task will now check if there's more work to do, and if so, do it first. :^) This patch also puts a bunch of process/thread debug logging behind PROCESS_DEBUG and THREAD_DEBUG since it was unbearable to debug this stuff with all the spam.
2020-02-01 09:27:25 +00:00
#endif
Kernel: Various stability improvements. - Don't cli() in Process::do_exec() unless current is execing. Eventually this should go away once the scheduler is less retarded in the face of interrupts. - Improved memory access validation for ring0 processes. We now look at the kernel ELF header to determine if an access is appropriate. :^) It's very hackish but also kinda neat. - Have Process::die() put the process into a new "Dying" state where it can still get scheduled but no signals will be dispatched. This way we can keep executing in die() but won't get our EIP hijacked by signal dispatch. The main problem here was that die() wanted to take various locks.
2019-02-06 16:28:14 +00:00
Kernel: Start working on a syscall for logging performance events This patch introduces sys$perf_event() with two event types: - PERF_EVENT_MALLOC - PERF_EVENT_FREE After the first call to sys$perf_event(), a process will begin keeping these events in a buffer. When the process dies, that buffer will be written out to "perfcore" in the current directory unless that filename is already taken. This is probably not the best way to do this, but it's a start and will make it possible to start doing memory allocation profiling. :^)
2020-02-02 19:26:27 +00:00
if (m_perf_event_buffer) {
auto description_or_error = VFS::the().open("perfcore", O_CREAT | O_EXCL, 0400, current_directory(), UidAndGid { m_uid, m_gid });
if (!description_or_error.is_error()) {
auto& description = description_or_error.value();
auto json = m_perf_event_buffer->to_json(m_pid, m_executable ? m_executable->absolute_path() : "");
description->write(json.data(), json.size());
}
}
Deallocate PTY's when they close. This required a fair bit of plumbing. The CharacterDevice::close() virtual will now be closed by ~FileDescriptor(), allowing device implementations to do custom cleanup at that point. One big problem remains: if the master PTY is closed before the slave PTY, we go into crashy land.
2019-01-30 17:26:19 +00:00
m_fds.clear();
Kernel: Process should disassociate from its TTY when it dies. Just because we die doesn't mean we got waited on yet, so keeping around a dangling TTY pointer is just asking for trouble.
2019-02-04 09:21:15 +00:00
m_tty = nullptr;
Kernel: Process finalization should release cwd and executable custodies. Since Process destruction happens with interrupts disabled, it's not safe to still hold custodies at that point. Drop them in finalization.
2019-05-31 05:19:54 +00:00
m_executable = nullptr;
m_cwd = nullptr;
Kernel: Add a basic chroot() syscall :^) The chroot() syscall now allows the superuser to isolate a process into a specific subtree of the filesystem. This is not strictly permanent, as it is also possible for a superuser to break *out* of a chroot, but it is a useful mechanism for isolating unprivileged processes. The VFS now uses the current process's root_directory() as the root for path resolution purposes. The root directory is stored as an uncached Custody in the Process object.
2020-01-10 22:14:04 +00:00
m_root_directory = nullptr;
Kernel: Don't forget to copy & destroy root_directory_for_procfs Also, rename it to root_directory_relative_to_global_root.
2020-01-12 18:42:01 +00:00
m_root_directory_relative_to_global_root = nullptr;
Kernel: Discard a process's ELFLoader on finalization. We don't need after that point, and throwing it out might free up some cached data used for backtraces.
2019-05-31 06:03:58 +00:00
m_elf_loader = nullptr;
Kernel: Add a simple shared memory API for two processes only. And use this to implement shared bitmaps between WindowServer and clients.
2019-02-16 11:13:43 +00:00
disown_all_shared_buffers();
Kernel: Add a Finalizer process to take care of dying processes. Instead of processes themselves getting scheduled to finish dying, let's have a Finalizer process that wakes up whenever someone is dying. This way we can do all kinds of lock-taking in process cleanup without risking reentering the scheduler.
2019-02-06 17:45:21 +00:00
{
InterruptDisabler disabler;
Kernel: Send SIGCHLD to the thread with same PID as my PPID Instead of delivering SIGCHLD to "any thread" in the process with PPID, send it to the thread with the same TID as my PPID.
2020-01-06 13:34:28 +00:00
if (auto* parent_thread = Thread::from_tid(m_ppid)) {
if (parent_thread->m_signal_action_data[SIGCHLD].flags & SA_NOCLDWAIT) {
Kernel: Don't send SIGCHLD to parent process if he has SA_NOCLDWAIT set. Just transfer ownership of the dead process to the colonel and let the scheduler reap it on next iteration.
2019-03-01 14:47:07 +00:00
// NOTE: If the parent doesn't care about this process, let it go.
m_ppid = 0;
} else {
Kernel: Send SIGCHLD to the thread with same PID as my PPID Instead of delivering SIGCHLD to "any thread" in the process with PPID, send it to the thread with the same TID as my PPID.
2020-01-06 13:34:28 +00:00
parent_thread->send_signal(SIGCHLD, this);
Kernel: Don't send SIGCHLD to parent process if he has SA_NOCLDWAIT set. Just transfer ownership of the dead process to the colonel and let the scheduler reap it on next iteration.
2019-03-01 14:47:07 +00:00
}
Kernel: Add a Finalizer process to take care of dying processes. Instead of processes themselves getting scheduled to finish dying, let's have a Finalizer process that wakes up whenever someone is dying. This way we can do all kinds of lock-taking in process cleanup without risking reentering the scheduler.
2019-02-06 17:45:21 +00:00
}
Kernel: Process should send SIGCHLD to its parent when it dies.
2019-02-04 12:30:03 +00:00
}
Kernel: Fix broken destruction order for Process/Thread.
2019-03-24 00:20:35 +00:00
m_dead = true;
Deallocate PTY's when they close. This required a fair bit of plumbing. The CharacterDevice::close() virtual will now be closed by ~FileDescriptor(), allowing device implementations to do custom cleanup at that point. One big problem remains: if the master PTY is closed before the slave PTY, we go into crashy land.
2019-01-30 17:26:19 +00:00
}
Kernel: Add a /proc/all process table dump. This will be useful for implementing some process-related utilities.
2019-02-03 17:53:18 +00:00
Kernel: Add a Finalizer process to take care of dying processes. Instead of processes themselves getting scheduled to finish dying, let's have a Finalizer process that wakes up whenever someone is dying. This way we can do all kinds of lock-taking in process cleanup without risking reentering the scheduler.
2019-02-06 17:45:21 +00:00
void Process::die()
{
Kernel: Process should release its TTY immediately on exit Don't wait for someone to wait() on a dead process before releasing its TTY object. This fixes the child process death detection used by the Terminal application, which relies on getting an EOF on the master PTY in order to know it's time to wait() on the child process. :^)
2019-11-10 07:49:23 +00:00
// Let go of the TTY, otherwise a slave PTY may keep the master PTY from
// getting an EOF when the last process using the slave PTY dies.
// If the master PTY owner relies on an EOF to know when to wait() on a
// slave owner, we have to allow the PTY pair to be torn down.
m_tty = nullptr;
Kernel: Add a systrace() syscall and implement /bin/strace using it. Calling systrace(pid) gives you a file descriptor with a stream of the syscalls made by a peer process. The process must be owned by the same UID who calls systrace(). :^)
2019-04-22 16:44:45 +00:00
if (m_tracer)
m_tracer->set_dead();
Kernel: Introduce threads, and refactor everything in support of it. The scheduler now operates on threads, rather than on processes. Each process has a main thread, and can have any number of additional threads. The process exits when the main thread exits. This patch doesn't actually spawn any additional threads, it merely does all the plumbing needed to make it possible. :^)
2019-03-23 21:03:17 +00:00
{
Kernel: Unwind kernel stacks before dying While executing in the kernel, a thread can acquire various resources that need cleanup, such as locks and references to RefCounted objects. This cleanup normally happens on the exit path, such as in destructors for various RAII guards. But we weren't calling those exit paths when killing threads that have been executing in the kernel, such as threads blocked on reading or sleeping, thus causing leaks. This commit changes how killing threads works. Now, instead of killing a thread directly, one is supposed to call thread->set_should_die(), which will unblock it and make it unwind the stack if it is blocked in the kernel. Then, just before returning to the userspace, the thread will automatically die.
2019-11-14 15:46:01 +00:00
// Tell the threads to unwind and die.
Kernel: Introduce threads, and refactor everything in support of it. The scheduler now operates on threads, rather than on processes. Each process has a main thread, and can have any number of additional threads. The process exits when the main thread exits. This patch doesn't actually spawn any additional threads, it merely does all the plumbing needed to make it possible. :^)
2019-03-23 21:03:17 +00:00
InterruptDisabler disabler;
Kernel: Run clang-format on everything.
2019-06-07 09:43:58 +00:00
for_each_thread([](Thread& thread) {
Kernel: Unwind kernel stacks before dying While executing in the kernel, a thread can acquire various resources that need cleanup, such as locks and references to RefCounted objects. This cleanup normally happens on the exit path, such as in destructors for various RAII guards. But we weren't calling those exit paths when killing threads that have been executing in the kernel, such as threads blocked on reading or sleeping, thus causing leaks. This commit changes how killing threads works. Now, instead of killing a thread directly, one is supposed to call thread->set_should_die(), which will unblock it and make it unwind the stack if it is blocked in the kernel. Then, just before returning to the userspace, the thread will automatically die.
2019-11-14 15:46:01 +00:00
thread.set_should_die();
Kernel: Introduce threads, and refactor everything in support of it. The scheduler now operates on threads, rather than on processes. Each process has a main thread, and can have any number of additional threads. The process exits when the main thread exits. This patch doesn't actually spawn any additional threads, it merely does all the plumbing needed to make it possible. :^)
2019-03-23 21:03:17 +00:00
return IterationDecision::Continue;
});
}
Kernel: Add a Finalizer process to take care of dying processes. Instead of processes themselves getting scheduled to finish dying, let's have a Finalizer process that wakes up whenever someone is dying. This way we can do all kinds of lock-taking in process cleanup without risking reentering the scheduler.
2019-02-06 17:45:21 +00:00
}
Kernel+SystemMonitor: Expose amount of per-process dirty private memory Dirty private memory is all memory in non-inode-backed mappings that's process-private, meaning it's not shared with any other process. This patch exposes that number via SystemMonitor, giving us an idea of how much memory each process is responsible for all on its own.
2019-12-29 11:28:32 +00:00
size_t Process::amount_dirty_private() const
{
Kernel+SystemMonitor: Expose amount of per-process clean inode memory This is memory that's loaded from an inode (file) but not modified in memory, so still identical to what's on disk. This kind of memory can be freed and reloaded transparently from disk if needed.
2019-12-29 11:45:58 +00:00
// FIXME: This gets a bit more complicated for Regions sharing the same underlying VMObject.
// The main issue I'm thinking of is when the VMObject has physical pages that none of the Regions are mapping.
// That's probably a situation that needs to be looked at in general.
Kernel+SystemMonitor: Expose amount of per-process dirty private memory Dirty private memory is all memory in non-inode-backed mappings that's process-private, meaning it's not shared with any other process. This patch exposes that number via SystemMonitor, giving us an idea of how much memory each process is responsible for all on its own.
2019-12-29 11:28:32 +00:00
size_t amount = 0;
for (auto& region : m_regions) {
if (!region.is_shared())
amount += region.amount_dirty();
}
return amount;
}
Kernel+SystemMonitor: Expose amount of per-process clean inode memory This is memory that's loaded from an inode (file) but not modified in memory, so still identical to what's on disk. This kind of memory can be freed and reloaded transparently from disk if needed.
2019-12-29 11:45:58 +00:00
size_t Process::amount_clean_inode() const
{
HashTable<const InodeVMObject*> vmobjects;
for (auto& region : m_regions) {
if (region.vmobject().is_inode())
vmobjects.set(&static_cast<const InodeVMObject&>(region.vmobject()));
}
size_t amount = 0;
for (auto& vmobject : vmobjects)
amount += vmobject->amount_clean();
return amount;
}
Kernel: Add a /proc/all process table dump. This will be useful for implementing some process-related utilities.
2019-02-03 17:53:18 +00:00
size_t Process::amount_virtual() const
{
size_t amount = 0;
for (auto& region : m_regions) {
Kernel: Use NonnullRefPtrVector in parts of the kernel.
2019-06-27 11:34:28 +00:00
amount += region.size();
Kernel: Add a /proc/all process table dump. This will be useful for implementing some process-related utilities.
2019-02-03 17:53:18 +00:00
}
return amount;
}
size_t Process::amount_resident() const
{
// FIXME: This will double count if multiple regions use the same physical page.
size_t amount = 0;
for (auto& region : m_regions) {
Kernel: Use NonnullRefPtrVector in parts of the kernel.
2019-06-27 11:34:28 +00:00
amount += region.amount_resident();
Kernel: Add a /proc/all process table dump. This will be useful for implementing some process-related utilities.
2019-02-03 17:53:18 +00:00
}
return amount;
}
size_t Process::amount_shared() const
{
// FIXME: This will double count if multiple regions use the same physical page.
Change "retain" to "ref" in various comments.
2019-06-21 16:40:24 +00:00
// FIXME: It doesn't work at the moment, since it relies on PhysicalPage ref counts,
AK: Rename Retainable => RefCounted. (And various related renames that go along with it.)
2019-06-21 13:29:31 +00:00
// and each PhysicalPage is only reffed by its VMObject. This needs to be refactored
Change "retain" to "ref" in various comments.
2019-06-21 16:40:24 +00:00
// so that every Region contributes +1 ref to each of its PhysicalPages.
Kernel: Add a /proc/all process table dump. This will be useful for implementing some process-related utilities.
2019-02-03 17:53:18 +00:00
size_t amount = 0;
for (auto& region : m_regions) {
Kernel: Use NonnullRefPtrVector in parts of the kernel.
2019-06-27 11:34:28 +00:00
amount += region.amount_shared();
Kernel: Add a /proc/all process table dump. This will be useful for implementing some process-related utilities.
2019-02-03 17:53:18 +00:00
}
return amount;
}
Kernel: Add a Finalizer process to take care of dying processes. Instead of processes themselves getting scheduled to finish dying, let's have a Finalizer process that wakes up whenever someone is dying. This way we can do all kinds of lock-taking in process cleanup without risking reentering the scheduler.
2019-02-06 17:45:21 +00:00
Kernel: Start implementing purgeable memory support It's now possible to get purgeable memory by using mmap(MAP_PURGEABLE). Purgeable memory has a "volatile" flag that can be set using madvise(): - madvise(..., MADV_SET_VOLATILE) - madvise(..., MADV_SET_NONVOLATILE) When in the "volatile" state, the kernel may take away the underlying physical memory pages at any time, without notifying the owner. This gives you a guilt discount when caching very large things. :^) Setting a purgeable region to non-volatile will return whether or not the memory has been taken away by the kernel while being volatile. Basically, if madvise(..., MADV_SET_NONVOLATILE) returns 1, that means the memory was purged while volatile, and whatever was in that piece of memory needs to be reconstructed before use.
2019-12-09 18:12:38 +00:00
size_t Process::amount_purgeable_volatile() const
{
size_t amount = 0;
for (auto& region : m_regions) {
if (region.vmobject().is_purgeable() && static_cast<const PurgeableVMObject&>(region.vmobject()).is_volatile())
amount += region.amount_resident();
}
return amount;
}
size_t Process::amount_purgeable_nonvolatile() const
{
size_t amount = 0;
for (auto& region : m_regions) {
if (region.vmobject().is_purgeable() && !static_cast<const PurgeableVMObject&>(region.vmobject()).is_volatile())
amount += region.amount_resident();
}
return amount;
}
ping: Use pledge()
2020-01-11 19:48:43 +00:00
#define REQUIRE_PROMISE_FOR_SOCKET_DOMAIN(domain) \
do { \
if (domain == AF_INET) \
REQUIRE_PROMISE(inet); \
else if (domain == AF_LOCAL) \
REQUIRE_PROMISE(unix); \
} while (0)
Kernel: Begin implementing UNIX domain sockets.
2019-02-14 13:17:38 +00:00
int Process::sys$socket(int domain, int type, int protocol)
{
ping: Use pledge()
2020-01-11 19:48:43 +00:00
REQUIRE_PROMISE_FOR_SOCKET_DOMAIN(domain);
Kernel+ping: Only allow superuser to create SOCK_RAW sockets /bin/ping is now setuid-root, and will drop privileges immediately after opening a raw socket.
2019-12-31 00:42:34 +00:00
if ((type & SOCK_TYPE_MASK) == SOCK_RAW && !is_superuser())
return -EACCES;
Kernel: Use alloc_fd() more instead of walking fd list manually.
2019-04-06 12:54:32 +00:00
int fd = alloc_fd();
if (fd < 0)
return fd;
Kernel: Port more code to KResult and KResultOr<T>.
2019-03-06 21:14:31 +00:00
auto result = Socket::create(domain, type, protocol);
if (result.is_error())
return result.error();
Kernel: Rename "descriptor" to "description" where appropriate. Now that FileDescription is called that, variables of that type should not be called "descriptor". This is kinda wordy but we'll get used to it.
2019-06-13 20:03:04 +00:00
auto description = FileDescription::create(*result.value());
Kernel: read() and write() should fail with EBADF for wrong mode fd's It was previously possible to write to read-only file descriptors, and read from write-only file descriptors. All FileDescription objects now start out non-readable + non-writable, and whoever is creating them has to "manually" enable reading/writing by calling set_readable() and/or set_writable() on them.
2020-01-03 02:29:59 +00:00
description->set_readable(true);
description->set_writable(true);
Kernel: More sockets work. Fleshing out accept().
2019-02-14 14:17:30 +00:00
unsigned flags = 0;
if (type & SOCK_CLOEXEC)
Kernel: socket() with SOCK_CLOEXEC was setting the wrong fd flag. Turns out FD_CLOEXEC and O_CLOEXEC are different values. Silly mistake. I noticed that Terminal's shell process still had the Terminal's window server connection open, albeit in a broken state.
2019-02-17 09:41:37 +00:00
flags |= FD_CLOEXEC;
Kernel: More sockets work. Fleshing out accept().
2019-02-14 14:17:30 +00:00
if (type & SOCK_NONBLOCK)
Kernel: Rename "descriptor" to "description" where appropriate. Now that FileDescription is called that, variables of that type should not be called "descriptor". This is kinda wordy but we'll get used to it.
2019-06-13 20:03:04 +00:00
description->set_blocking(false);
m_fds[fd].set(move(description), flags);
Kernel: Begin implementing UNIX domain sockets.
2019-02-14 13:17:38 +00:00
return fd;
}
Kernel: Begin fleshing out bind() syscall.
2019-02-14 13:38:30 +00:00
int Process::sys$bind(int sockfd, const sockaddr* address, socklen_t address_length)
Kernel: Begin implementing UNIX domain sockets.
2019-02-14 13:17:38 +00:00
{
Kernel: Begin fleshing out bind() syscall.
2019-02-14 13:38:30 +00:00
if (!validate_read(address, address_length))
return -EFAULT;
Kernel: Make Process::file_description() vend a RefPtr<FileDescription> This encourages callers to strongly reference file descriptions while working with them. This fixes a use-after-free issue where one thread would close() an open fd while another thread was blocked on it becoming readable. Test: Kernel/uaf-close-while-blocked-in-read.cpp
2020-01-07 14:53:42 +00:00
auto description = file_description(sockfd);
Kernel: Rename "descriptor" to "description" where appropriate. Now that FileDescription is called that, variables of that type should not be called "descriptor". This is kinda wordy but we'll get used to it.
2019-06-13 20:03:04 +00:00
if (!description)
Kernel: Begin fleshing out bind() syscall.
2019-02-14 13:38:30 +00:00
return -EBADF;
Kernel: Rename "descriptor" to "description" where appropriate. Now that FileDescription is called that, variables of that type should not be called "descriptor". This is kinda wordy but we'll get used to it.
2019-06-13 20:03:04 +00:00
if (!description->is_socket())
Kernel: Begin fleshing out bind() syscall.
2019-02-14 13:38:30 +00:00
return -ENOTSOCK;
Kernel: Rename "descriptor" to "description" where appropriate. Now that FileDescription is called that, variables of that type should not be called "descriptor". This is kinda wordy but we'll get used to it.
2019-06-13 20:03:04 +00:00
auto& socket = *description->socket();
ping: Use pledge()
2020-01-11 19:48:43 +00:00
REQUIRE_PROMISE_FOR_SOCKET_DOMAIN(socket.domain());
Kernel: Port more code to KResult and KResultOr<T>.
2019-03-06 21:14:31 +00:00
return socket.bind(address, address_length);
Kernel: Begin implementing UNIX domain sockets.
2019-02-14 13:17:38 +00:00
}
int Process::sys$listen(int sockfd, int backlog)
{
Kernel: Make Process::file_description() vend a RefPtr<FileDescription> This encourages callers to strongly reference file descriptions while working with them. This fixes a use-after-free issue where one thread would close() an open fd while another thread was blocked on it becoming readable. Test: Kernel/uaf-close-while-blocked-in-read.cpp
2020-01-07 14:53:42 +00:00
auto description = file_description(sockfd);
Kernel: Rename "descriptor" to "description" where appropriate. Now that FileDescription is called that, variables of that type should not be called "descriptor". This is kinda wordy but we'll get used to it.
2019-06-13 20:03:04 +00:00
if (!description)
Kernel: More sockets work. Fleshing out accept().
2019-02-14 14:17:30 +00:00
return -EBADF;
Kernel: Rename "descriptor" to "description" where appropriate. Now that FileDescription is called that, variables of that type should not be called "descriptor". This is kinda wordy but we'll get used to it.
2019-06-13 20:03:04 +00:00
if (!description->is_socket())
Kernel: More sockets work. Fleshing out accept().
2019-02-14 14:17:30 +00:00
return -ENOTSOCK;
Kernel: Rename "descriptor" to "description" where appropriate. Now that FileDescription is called that, variables of that type should not be called "descriptor". This is kinda wordy but we'll get used to it.
2019-06-13 20:03:04 +00:00
auto& socket = *description->socket();
ping: Use pledge()
2020-01-11 19:48:43 +00:00
REQUIRE_PROMISE_FOR_SOCKET_DOMAIN(socket.domain());
Kernel: listen() should fail with EINVAL for already-connected sockets This according to POSIX.
2019-11-27 15:01:22 +00:00
if (socket.is_connected())
return -EINVAL;
Kernel: Move socket role tracking to the Socket class itself This is more logical and allows us to solve the problem of non-blocking TCP sockets getting stuck in SocketRole::None. The only complication is that a single LocalSocket may be shared between two file descriptions (on the connect and accept sides), and should have two different roles depending from which side you look at it. To deal with it, Socket::role() is made a virtual method that accepts a file description, and LocalSocket internally tracks which FileDescription is the which one and returns a correct role.
2019-08-11 13:38:20 +00:00
return socket.listen(backlog);
Kernel: Begin implementing UNIX domain sockets.
2019-02-14 13:17:38 +00:00
}
WindowServer: Slurp all available client messages when checking them. We were reading one client message per client per event loop iteration. That was not very snappy. Make the sockets non-blocking and read() until there are no messages left. It would be even better to make as few calls to read() as possible to reduce context switching, but this is already a huge improvement.
2019-02-15 10:43:43 +00:00
int Process::sys$accept(int accepting_socket_fd, sockaddr* address, socklen_t* address_size)
Kernel: Begin implementing UNIX domain sockets.
2019-02-14 13:17:38 +00:00
{
Kernel: Add "accept" pledge promise for accepting incoming connections This patch adds a new "accept" promise that allows you to call accept() on an already listening socket. This lets programs set up a socket for for listening and then dropping "inet" and/or "unix" so that only incoming (and existing) connections are allowed from that point on. No new outgoing connections or listening server sockets can be created. In addition to accept() it also allows getsockopt() with SOL_SOCKET and SO_PEERCRED, which is used to find the PID/UID/GID of the socket peer. This is used by our IPC library when creating shared buffers that should only be accessible to a specific peer process. This allows us to drop "unix" in WindowServer and LookupServer. :^) It also makes the debugging/introspection RPC sockets in CEventLoop based programs work again.
2020-01-17 10:12:06 +00:00
REQUIRE_PROMISE(accept);
Kernel: More sockets work. Fleshing out accept().
2019-02-14 14:17:30 +00:00
if (!validate_write_typed(address_size))
return -EFAULT;
Kernel: Start implementing x86 SMAP support Supervisor Mode Access Prevention (SMAP) is an x86 CPU feature that prevents the kernel from accessing userspace memory. With SMAP enabled, trying to read/write a userspace memory address while in the kernel will now generate a page fault. Since it's sometimes necessary to read/write userspace memory, there are two new instructions that quickly switch the protection on/off: STAC (disables protection) and CLAC (enables protection.) These are exposed in kernel code via the stac() and clac() helpers. There's also a SmapDisabler RAII object that can be used to ensure that you don't forget to re-enable protection before returning to userspace code. THis patch also adds copy_to_user(), copy_from_user() and memset_user() which are the "correct" way of doing things. These functions allow us to briefly disable protection for a specific purpose, and then turn it back on immediately after it's done. Going forward all kernel code should be moved to using these and all uses of SmapDisabler are to be considered FIXME's. Note that we're not realizing the full potential of this feature since I've used SmapDisabler quite liberally in this initial bring-up patch.
2020-01-05 17:00:15 +00:00
SmapDisabler disabler;
Kernel: More sockets work. Fleshing out accept().
2019-02-14 14:17:30 +00:00
if (!validate_write(address, *address_size))
return -EFAULT;
Kernel: Use alloc_fd() more instead of walking fd list manually.
2019-04-06 12:54:32 +00:00
int accepted_socket_fd = alloc_fd();
if (accepted_socket_fd < 0)
return accepted_socket_fd;
Kernel: Make Process::file_description() vend a RefPtr<FileDescription> This encourages callers to strongly reference file descriptions while working with them. This fixes a use-after-free issue where one thread would close() an open fd while another thread was blocked on it becoming readable. Test: Kernel/uaf-close-while-blocked-in-read.cpp
2020-01-07 14:53:42 +00:00
auto accepting_socket_description = file_description(accepting_socket_fd);
Kernel: Rename "descriptor" to "description" where appropriate. Now that FileDescription is called that, variables of that type should not be called "descriptor". This is kinda wordy but we'll get used to it.
2019-06-13 20:03:04 +00:00
if (!accepting_socket_description)
Kernel: More sockets work. Fleshing out accept().
2019-02-14 14:17:30 +00:00
return -EBADF;
Kernel: Rename "descriptor" to "description" where appropriate. Now that FileDescription is called that, variables of that type should not be called "descriptor". This is kinda wordy but we'll get used to it.
2019-06-13 20:03:04 +00:00
if (!accepting_socket_description->is_socket())
Kernel: More sockets work. Fleshing out accept().
2019-02-14 14:17:30 +00:00
return -ENOTSOCK;
Kernel: Rename "descriptor" to "description" where appropriate. Now that FileDescription is called that, variables of that type should not be called "descriptor". This is kinda wordy but we'll get used to it.
2019-06-13 20:03:04 +00:00
auto& socket = *accepting_socket_description->socket();
Kernel: More sockets work. Fleshing out accept().
2019-02-14 14:17:30 +00:00
if (!socket.can_accept()) {
Kernel: Add a new block state for accept() on a blocking socket Rather than asserting, which really ruins everyone's day.
2019-07-18 08:39:00 +00:00
if (accepting_socket_description->is_blocking()) {
Kernel: Fix kernel null deref on process crash during join_thread() The join_thread() syscall is not supposed to be interruptible by signals, but it was. And since the process death mechanism piggybacked on signal interrupts, it was possible to interrupt a pthread_join() by killing the process that was doing it, leading to confusing due to some assumptions being made by Thread::finalize() for threads that have a pending joiner. This patch fixes the issue by making "interrupted by death" a distinct block result separate from "interrupted by signal". Then we handle that state in join_thread() and tidy things up so that thread finalization doesn't get confused by the pending joiner being gone. Test: Tests/Kernel/null-deref-crash-during-pthread_join.cpp
2020-01-10 18:15:01 +00:00
if (current->block<Thread::AcceptBlocker>(*accepting_socket_description) != Thread::BlockResult::WokeNormally)
Kernel: Add a new block state for accept() on a blocking socket Rather than asserting, which really ruins everyone's day.
2019-07-18 08:39:00 +00:00
return -EINTR;
} else {
return -EAGAIN;
}
Kernel: More sockets work. Fleshing out accept().
2019-02-14 14:17:30 +00:00
}
WindowServer: Slurp all available client messages when checking them. We were reading one client message per client per event loop iteration. That was not very snappy. Make the sockets non-blocking and read() until there are no messages left. It would be even better to make as few calls to read() as possible to reduce context switching, but this is already a huge improvement.
2019-02-15 10:43:43 +00:00
auto accepted_socket = socket.accept();
ASSERT(accepted_socket);
Kernel: Truncate addresses stored by getsockname() and getpeername() If there's not enough space in the output buffer for the whole sockaddr we now simply truncate the address instead of returning EINVAL. This patch also makes getpeername() actually return the peer address rather than the local address.. :^)
2020-02-07 22:42:28 +00:00
accepted_socket->get_peer_address(address, address_size);
Kernel: Move socket role tracking to the Socket class itself This is more logical and allows us to solve the problem of non-blocking TCP sockets getting stuck in SocketRole::None. The only complication is that a single LocalSocket may be shared between two file descriptions (on the connect and accept sides), and should have two different roles depending from which side you look at it. To deal with it, Socket::role() is made a virtual method that accepts a file description, and LocalSocket internally tracks which FileDescription is the which one and returns a correct role.
2019-08-11 13:38:20 +00:00
auto accepted_socket_description = FileDescription::create(*accepted_socket);
Kernel: read() and write() should fail with EBADF for wrong mode fd's It was previously possible to write to read-only file descriptors, and read from write-only file descriptors. All FileDescription objects now start out non-readable + non-writable, and whoever is creating them has to "manually" enable reading/writing by calling set_readable() and/or set_writable() on them.
2020-01-03 02:29:59 +00:00
accepted_socket_description->set_readable(true);
accepted_socket_description->set_writable(true);
WindowServer: Slurp all available client messages when checking them. We were reading one client message per client per event loop iteration. That was not very snappy. Make the sockets non-blocking and read() until there are no messages left. It would be even better to make as few calls to read() as possible to reduce context switching, but this is already a huge improvement.
2019-02-15 10:43:43 +00:00
// NOTE: The accepted socket inherits fd flags from the accepting socket.
// I'm not sure if this matches other systems but it makes sense to me.
Kernel: Rename "descriptor" to "description" where appropriate. Now that FileDescription is called that, variables of that type should not be called "descriptor". This is kinda wordy but we'll get used to it.
2019-06-13 20:03:04 +00:00
accepted_socket_description->set_blocking(accepting_socket_description->is_blocking());
m_fds[accepted_socket_fd].set(move(accepted_socket_description), m_fds[accepting_socket_fd].flags);
Kernel: Delay moving accepted sockets to SetupState::Completed a bit Make sure we don't move accepted sockets to the Completed setup state until we've actually constructed a FileDescription for them. This is important, since this state transition will trigger connect() to unblock on the client side, and the client may try writing to the socket right away. This makes DNS lookups way more reliable since we don't just fail to write() right after connect()ing to LookupServer sometimes. :^)
2019-10-08 19:41:46 +00:00
// NOTE: Moving this state to Completed is what causes connect() to unblock on the client side.
accepted_socket->set_setup_state(Socket::SetupState::Completed);
WindowServer: Slurp all available client messages when checking them. We were reading one client message per client per event loop iteration. That was not very snappy. Make the sockets non-blocking and read() until there are no messages left. It would be even better to make as few calls to read() as possible to reduce context switching, but this is already a huge improvement.
2019-02-15 10:43:43 +00:00
return accepted_socket_fd;
Kernel: Begin implementing UNIX domain sockets.
2019-02-14 13:17:38 +00:00
}
Kernel: More work on sockets. Fleshing out connect().
2019-02-14 14:55:19 +00:00
int Process::sys$connect(int sockfd, const sockaddr* address, socklen_t address_size)
Kernel: Begin implementing UNIX domain sockets.
2019-02-14 13:17:38 +00:00
{
Kernel: More work on sockets. Fleshing out connect().
2019-02-14 14:55:19 +00:00
if (!validate_read(address, address_size))
return -EFAULT;
Kernel: Use alloc_fd() more instead of walking fd list manually.
2019-04-06 12:54:32 +00:00
int fd = alloc_fd();
if (fd < 0)
return fd;
Kernel: Make Process::file_description() vend a RefPtr<FileDescription> This encourages callers to strongly reference file descriptions while working with them. This fixes a use-after-free issue where one thread would close() an open fd while another thread was blocked on it becoming readable. Test: Kernel/uaf-close-while-blocked-in-read.cpp
2020-01-07 14:53:42 +00:00
auto description = file_description(sockfd);
Kernel: Rename "descriptor" to "description" where appropriate. Now that FileDescription is called that, variables of that type should not be called "descriptor". This is kinda wordy but we'll get used to it.
2019-06-13 20:03:04 +00:00
if (!description)
Kernel: More work on sockets. Fleshing out connect().
2019-02-14 14:55:19 +00:00
return -EBADF;
Kernel: Rename "descriptor" to "description" where appropriate. Now that FileDescription is called that, variables of that type should not be called "descriptor". This is kinda wordy but we'll get used to it.
2019-06-13 20:03:04 +00:00
if (!description->is_socket())
Kernel: More work on sockets. Fleshing out connect().
2019-02-14 14:55:19 +00:00
return -ENOTSOCK;
Kernel: Move socket role tracking to the Socket class itself This is more logical and allows us to solve the problem of non-blocking TCP sockets getting stuck in SocketRole::None. The only complication is that a single LocalSocket may be shared between two file descriptions (on the connect and accept sides), and should have two different roles depending from which side you look at it. To deal with it, Socket::role() is made a virtual method that accepts a file description, and LocalSocket internally tracks which FileDescription is the which one and returns a correct role.
2019-08-11 13:38:20 +00:00
Kernel: Rename "descriptor" to "description" where appropriate. Now that FileDescription is called that, variables of that type should not be called "descriptor". This is kinda wordy but we'll get used to it.
2019-06-13 20:03:04 +00:00
auto& socket = *description->socket();
ping: Use pledge()
2020-01-11 19:48:43 +00:00
REQUIRE_PROMISE_FOR_SOCKET_DOMAIN(socket.domain());
Kernel: Start implementing x86 SMAP support Supervisor Mode Access Prevention (SMAP) is an x86 CPU feature that prevents the kernel from accessing userspace memory. With SMAP enabled, trying to read/write a userspace memory address while in the kernel will now generate a page fault. Since it's sometimes necessary to read/write userspace memory, there are two new instructions that quickly switch the protection on/off: STAC (disables protection) and CLAC (enables protection.) These are exposed in kernel code via the stac() and clac() helpers. There's also a SmapDisabler RAII object that can be used to ensure that you don't forget to re-enable protection before returning to userspace code. THis patch also adds copy_to_user(), copy_from_user() and memset_user() which are the "correct" way of doing things. These functions allow us to briefly disable protection for a specific purpose, and then turn it back on immediately after it's done. Going forward all kernel code should be moved to using these and all uses of SmapDisabler are to be considered FIXME's. Note that we're not realizing the full potential of this feature since I've used SmapDisabler quite liberally in this initial bring-up patch.
2020-01-05 17:00:15 +00:00
SmapDisabler disabler;
Kernel: Move socket role tracking to the Socket class itself This is more logical and allows us to solve the problem of non-blocking TCP sockets getting stuck in SocketRole::None. The only complication is that a single LocalSocket may be shared between two file descriptions (on the connect and accept sides), and should have two different roles depending from which side you look at it. To deal with it, Socket::role() is made a virtual method that accepts a file description, and LocalSocket internally tracks which FileDescription is the which one and returns a correct role.
2019-08-11 13:38:20 +00:00
return socket.connect(*description, address, address_size, description->is_blocking() ? ShouldBlock::Yes : ShouldBlock::No);
Port the WindowServer and LibGUI to communicate through local sockets. This is really cool! :^) Apps currently refuse to start if the WindowServer isn't listening on the socket in /wsportal. This makes sense, but I guess it would also be nice to have some sort of "wait for server on startup" mode. This has performance issues, and I'll work on those, but this stuff seems to actually work and I'm very happy with that.
2019-02-14 16:18:35 +00:00
}
Net: Add a basic sys$shutdown() implementation Calling shutdown prevents further reads and/or writes on a socket. We should do a few more things based on the type of socket, but this initial implementation just puts the basic mechanism in place. Work towards #428.
2020-02-07 23:52:33 +00:00
int Process::sys$shutdown(int sockfd, int how)
{
REQUIRE_PROMISE(stdio);
if (how & ~SHUT_RDWR)
return -EINVAL;
auto description = file_description(sockfd);
if (!description)
return -EBADF;
if (!description->is_socket())
return -ENOTSOCK;
auto& socket = *description->socket();
REQUIRE_PROMISE_FOR_SOCKET_DOMAIN(socket.domain());
return socket.shutdown(how);
}
Kernel: Use the Syscall string and buffer types more While I was updating syscalls to stop passing null-terminated strings, I added some helpful struct types: - StringArgument { const char*; size_t; } - ImmutableBuffer<Data, Size> { const Data*; Size; } - MutableBuffer<Data, Size> { Data*; Size; } The Process class has some convenience functions for validating and optionally extracting the contents from these structs: - get_syscall_path_argument(StringArgument) - validate_and_copy_string_from_user(StringArgument) - validate(ImmutableBuffer) - validate(MutableBuffer) There's still so much code around this and I'm wondering if we should generate most of it instead. Possible nice little project.
2020-01-11 11:47:47 +00:00
ssize_t Process::sys$sendto(const Syscall::SC_sendto_params* user_params)
Kernel+LibC+Userland: Start working on an IPv4 socket backend. The first userland networking program will be "ping" :^)
2019-03-12 14:51:42 +00:00
{
Kernel: Reduce pledge requirement for recvfrom()+sendto() to "stdio" Since these only operate on already-open sockets, we should treat them the same as we do read() and write() by putting them into "stdio".
2020-01-12 10:52:37 +00:00
REQUIRE_PROMISE(stdio);
Kernel: Use the Syscall string and buffer types more While I was updating syscalls to stop passing null-terminated strings, I added some helpful struct types: - StringArgument { const char*; size_t; } - ImmutableBuffer<Data, Size> { const Data*; Size; } - MutableBuffer<Data, Size> { Data*; Size; } The Process class has some convenience functions for validating and optionally extracting the contents from these structs: - get_syscall_path_argument(StringArgument) - validate_and_copy_string_from_user(StringArgument) - validate(ImmutableBuffer) - validate(MutableBuffer) There's still so much code around this and I'm wondering if we should generate most of it instead. Possible nice little project.
2020-01-11 11:47:47 +00:00
Syscall::SC_sendto_params params;
Kernel: Combine validate and copy of user mode pointers (#1069) Right now there is a significant amount of boiler plate code required to validate user mode parameters in syscalls. In an attempt to reduce this a bit, introduce validate_read_and_copy_typed which combines the usermode address check and does the copy internally if the validation passes. This cleans up a little bit of code from a significant amount of syscalls.
2020-01-13 10:19:18 +00:00
if (!validate_read_and_copy_typed(&params, user_params))
return -EFAULT;
Kernel: Start implementing x86 SMAP support Supervisor Mode Access Prevention (SMAP) is an x86 CPU feature that prevents the kernel from accessing userspace memory. With SMAP enabled, trying to read/write a userspace memory address while in the kernel will now generate a page fault. Since it's sometimes necessary to read/write userspace memory, there are two new instructions that quickly switch the protection on/off: STAC (disables protection) and CLAC (enables protection.) These are exposed in kernel code via the stac() and clac() helpers. There's also a SmapDisabler RAII object that can be used to ensure that you don't forget to re-enable protection before returning to userspace code. THis patch also adds copy_to_user(), copy_from_user() and memset_user() which are the "correct" way of doing things. These functions allow us to briefly disable protection for a specific purpose, and then turn it back on immediately after it's done. Going forward all kernel code should be moved to using these and all uses of SmapDisabler are to be considered FIXME's. Note that we're not realizing the full potential of this feature since I've used SmapDisabler quite liberally in this initial bring-up patch.
2020-01-05 17:00:15 +00:00
Kernel: Use the Syscall string and buffer types more While I was updating syscalls to stop passing null-terminated strings, I added some helpful struct types: - StringArgument { const char*; size_t; } - ImmutableBuffer<Data, Size> { const Data*; Size; } - MutableBuffer<Data, Size> { Data*; Size; } The Process class has some convenience functions for validating and optionally extracting the contents from these structs: - get_syscall_path_argument(StringArgument) - validate_and_copy_string_from_user(StringArgument) - validate(ImmutableBuffer) - validate(MutableBuffer) There's still so much code around this and I'm wondering if we should generate most of it instead. Possible nice little project.
2020-01-11 11:47:47 +00:00
int flags = params.flags;
const sockaddr* addr = params.addr;
socklen_t addr_length = params.addr_length;
Kernel+LibC+Userland: Start working on an IPv4 socket backend. The first userland networking program will be "ping" :^)
2019-03-12 14:51:42 +00:00
Kernel: Use the Syscall string and buffer types more While I was updating syscalls to stop passing null-terminated strings, I added some helpful struct types: - StringArgument { const char*; size_t; } - ImmutableBuffer<Data, Size> { const Data*; Size; } - MutableBuffer<Data, Size> { Data*; Size; } The Process class has some convenience functions for validating and optionally extracting the contents from these structs: - get_syscall_path_argument(StringArgument) - validate_and_copy_string_from_user(StringArgument) - validate(ImmutableBuffer) - validate(MutableBuffer) There's still so much code around this and I'm wondering if we should generate most of it instead. Possible nice little project.
2020-01-11 11:47:47 +00:00
if (!validate(params.data))
Kernel+LibC+Userland: Start working on an IPv4 socket backend. The first userland networking program will be "ping" :^)
2019-03-12 14:51:42 +00:00
return -EFAULT;
IPv4: More hacking on bringing up TCP support. This was a bit more complicated than I expected, but it's moving forward.
2019-03-13 22:14:30 +00:00
if (addr && !validate_read(addr, addr_length))
Kernel+LibC+Userland: Start working on an IPv4 socket backend. The first userland networking program will be "ping" :^)
2019-03-12 14:51:42 +00:00
return -EFAULT;
Kernel: Use the Syscall string and buffer types more While I was updating syscalls to stop passing null-terminated strings, I added some helpful struct types: - StringArgument { const char*; size_t; } - ImmutableBuffer<Data, Size> { const Data*; Size; } - MutableBuffer<Data, Size> { Data*; Size; } The Process class has some convenience functions for validating and optionally extracting the contents from these structs: - get_syscall_path_argument(StringArgument) - validate_and_copy_string_from_user(StringArgument) - validate(ImmutableBuffer) - validate(MutableBuffer) There's still so much code around this and I'm wondering if we should generate most of it instead. Possible nice little project.
2020-01-11 11:47:47 +00:00
auto description = file_description(params.sockfd);
Kernel: Rename "descriptor" to "description" where appropriate. Now that FileDescription is called that, variables of that type should not be called "descriptor". This is kinda wordy but we'll get used to it.
2019-06-13 20:03:04 +00:00
if (!description)
Kernel+LibC+Userland: Start working on an IPv4 socket backend. The first userland networking program will be "ping" :^)
2019-03-12 14:51:42 +00:00
return -EBADF;
Kernel: Rename "descriptor" to "description" where appropriate. Now that FileDescription is called that, variables of that type should not be called "descriptor". This is kinda wordy but we'll get used to it.
2019-06-13 20:03:04 +00:00
if (!description->is_socket())
Kernel+LibC+Userland: Start working on an IPv4 socket backend. The first userland networking program will be "ping" :^)
2019-03-12 14:51:42 +00:00
return -ENOTSOCK;
Kernel: Rename "descriptor" to "description" where appropriate. Now that FileDescription is called that, variables of that type should not be called "descriptor". This is kinda wordy but we'll get used to it.
2019-06-13 20:03:04 +00:00
auto& socket = *description->socket();
Net: Add a basic sys$shutdown() implementation Calling shutdown prevents further reads and/or writes on a socket. We should do a few more things based on the type of socket, but this initial implementation just puts the basic mechanism in place. Work towards #428.
2020-02-07 23:52:33 +00:00
if (socket.is_shut_down_for_writing())
return -EPIPE;
SmapDisabler disabler;
Kernel: Use the Syscall string and buffer types more While I was updating syscalls to stop passing null-terminated strings, I added some helpful struct types: - StringArgument { const char*; size_t; } - ImmutableBuffer<Data, Size> { const Data*; Size; } - MutableBuffer<Data, Size> { Data*; Size; } The Process class has some convenience functions for validating and optionally extracting the contents from these structs: - get_syscall_path_argument(StringArgument) - validate_and_copy_string_from_user(StringArgument) - validate(ImmutableBuffer) - validate(MutableBuffer) There's still so much code around this and I'm wondering if we should generate most of it instead. Possible nice little project.
2020-01-11 11:47:47 +00:00
return socket.sendto(*description, params.data.data, params.data.size, flags, addr, addr_length);
Kernel+LibC+Userland: Start working on an IPv4 socket backend. The first userland networking program will be "ping" :^)
2019-03-12 14:51:42 +00:00
}
Kernel: Use the Syscall string and buffer types more While I was updating syscalls to stop passing null-terminated strings, I added some helpful struct types: - StringArgument { const char*; size_t; } - ImmutableBuffer<Data, Size> { const Data*; Size; } - MutableBuffer<Data, Size> { Data*; Size; } The Process class has some convenience functions for validating and optionally extracting the contents from these structs: - get_syscall_path_argument(StringArgument) - validate_and_copy_string_from_user(StringArgument) - validate(ImmutableBuffer) - validate(MutableBuffer) There's still so much code around this and I'm wondering if we should generate most of it instead. Possible nice little project.
2020-01-11 11:47:47 +00:00
ssize_t Process::sys$recvfrom(const Syscall::SC_recvfrom_params* user_params)
Kernel+LibC+Userland: Yet more networking bringup hacking. All ICMP sockets now receive all ICMP packets. All this buffering is gonna need some limits and such.
2019-03-12 16:27:07 +00:00
{
Kernel: Reduce pledge requirement for recvfrom()+sendto() to "stdio" Since these only operate on already-open sockets, we should treat them the same as we do read() and write() by putting them into "stdio".
2020-01-12 10:52:37 +00:00
REQUIRE_PROMISE(stdio);
Kernel+LibC+Userland: Yet more networking bringup hacking. All ICMP sockets now receive all ICMP packets. All this buffering is gonna need some limits and such.
2019-03-12 16:27:07 +00:00
Kernel: Use the Syscall string and buffer types more While I was updating syscalls to stop passing null-terminated strings, I added some helpful struct types: - StringArgument { const char*; size_t; } - ImmutableBuffer<Data, Size> { const Data*; Size; } - MutableBuffer<Data, Size> { Data*; Size; } The Process class has some convenience functions for validating and optionally extracting the contents from these structs: - get_syscall_path_argument(StringArgument) - validate_and_copy_string_from_user(StringArgument) - validate(ImmutableBuffer) - validate(MutableBuffer) There's still so much code around this and I'm wondering if we should generate most of it instead. Possible nice little project.
2020-01-11 11:47:47 +00:00
Syscall::SC_recvfrom_params params;
Kernel: Combine validate and copy of user mode pointers (#1069) Right now there is a significant amount of boiler plate code required to validate user mode parameters in syscalls. In an attempt to reduce this a bit, introduce validate_read_and_copy_typed which combines the usermode address check and does the copy internally if the validation passes. This cleans up a little bit of code from a significant amount of syscalls.
2020-01-13 10:19:18 +00:00
if (!validate_read_and_copy_typed(&params, user_params))
return -EFAULT;
Kernel+LibC+Userland: Yet more networking bringup hacking. All ICMP sockets now receive all ICMP packets. All this buffering is gonna need some limits and such.
2019-03-12 16:27:07 +00:00
Kernel: Use the Syscall string and buffer types more While I was updating syscalls to stop passing null-terminated strings, I added some helpful struct types: - StringArgument { const char*; size_t; } - ImmutableBuffer<Data, Size> { const Data*; Size; } - MutableBuffer<Data, Size> { Data*; Size; } The Process class has some convenience functions for validating and optionally extracting the contents from these structs: - get_syscall_path_argument(StringArgument) - validate_and_copy_string_from_user(StringArgument) - validate(ImmutableBuffer) - validate(MutableBuffer) There's still so much code around this and I'm wondering if we should generate most of it instead. Possible nice little project.
2020-01-11 11:47:47 +00:00
int flags = params.flags;
sockaddr* addr = params.addr;
socklen_t* addr_length = params.addr_length;
Kernel: Oops, recvfrom() is not quite ready for SMAP protections yet
2020-01-11 12:03:44 +00:00
SmapDisabler disabler;
Kernel: Use the Syscall string and buffer types more While I was updating syscalls to stop passing null-terminated strings, I added some helpful struct types: - StringArgument { const char*; size_t; } - ImmutableBuffer<Data, Size> { const Data*; Size; } - MutableBuffer<Data, Size> { Data*; Size; } The Process class has some convenience functions for validating and optionally extracting the contents from these structs: - get_syscall_path_argument(StringArgument) - validate_and_copy_string_from_user(StringArgument) - validate(ImmutableBuffer) - validate(MutableBuffer) There's still so much code around this and I'm wondering if we should generate most of it instead. Possible nice little project.
2020-01-11 11:47:47 +00:00
if (!validate(params.buffer))
Kernel+LibC+Userland: Yet more networking bringup hacking. All ICMP sockets now receive all ICMP packets. All this buffering is gonna need some limits and such.
2019-03-12 16:27:07 +00:00
return -EFAULT;
IPv4: More hacking on bringing up TCP support. This was a bit more complicated than I expected, but it's moving forward.
2019-03-13 22:14:30 +00:00
if (addr_length) {
IPv4: Save the source address/port together with incoming packet payloads. We need the address/port to fill in the out-params in recvfrom(). It should now be more or less possible to create a UDP server. :^)
2019-05-04 01:27:50 +00:00
if (!validate_write_typed(addr_length))
IPv4: More hacking on bringing up TCP support. This was a bit more complicated than I expected, but it's moving forward.
2019-03-13 22:14:30 +00:00
return -EFAULT;
IPv4: Save the source address/port together with incoming packet payloads. We need the address/port to fill in the out-params in recvfrom(). It should now be more or less possible to create a UDP server. :^)
2019-05-04 01:27:50 +00:00
if (!validate_write(addr, *addr_length))
IPv4: More hacking on bringing up TCP support. This was a bit more complicated than I expected, but it's moving forward.
2019-03-13 22:14:30 +00:00
return -EFAULT;
} else if (addr) {
Kernel: Run clang-format on everything.
2019-06-07 09:43:58 +00:00
return -EINVAL;
IPv4: More hacking on bringing up TCP support. This was a bit more complicated than I expected, but it's moving forward.
2019-03-13 22:14:30 +00:00
}
Kernel: Use the Syscall string and buffer types more While I was updating syscalls to stop passing null-terminated strings, I added some helpful struct types: - StringArgument { const char*; size_t; } - ImmutableBuffer<Data, Size> { const Data*; Size; } - MutableBuffer<Data, Size> { Data*; Size; } The Process class has some convenience functions for validating and optionally extracting the contents from these structs: - get_syscall_path_argument(StringArgument) - validate_and_copy_string_from_user(StringArgument) - validate(ImmutableBuffer) - validate(MutableBuffer) There's still so much code around this and I'm wondering if we should generate most of it instead. Possible nice little project.
2020-01-11 11:47:47 +00:00
auto description = file_description(params.sockfd);
Kernel: Rename "descriptor" to "description" where appropriate. Now that FileDescription is called that, variables of that type should not be called "descriptor". This is kinda wordy but we'll get used to it.
2019-06-13 20:03:04 +00:00
if (!description)
Kernel+LibC+Userland: Yet more networking bringup hacking. All ICMP sockets now receive all ICMP packets. All this buffering is gonna need some limits and such.
2019-03-12 16:27:07 +00:00
return -EBADF;
Kernel: Rename "descriptor" to "description" where appropriate. Now that FileDescription is called that, variables of that type should not be called "descriptor". This is kinda wordy but we'll get used to it.
2019-06-13 20:03:04 +00:00
if (!description->is_socket())
Kernel+LibC+Userland: Yet more networking bringup hacking. All ICMP sockets now receive all ICMP packets. All this buffering is gonna need some limits and such.
2019-03-12 16:27:07 +00:00
return -ENOTSOCK;
Kernel: Rename "descriptor" to "description" where appropriate. Now that FileDescription is called that, variables of that type should not be called "descriptor". This is kinda wordy but we'll get used to it.
2019-06-13 20:03:04 +00:00
auto& socket = *description->socket();
Kernel: Add support for recv() with MSG_DONTWAIT. Passing this flag to recv() temporarily puts the file descriptor into non-blocking mode. Also implement LocalSocket::recv() as a simple forwarding to read().
2019-05-20 01:44:45 +00:00
Net: Add a basic sys$shutdown() implementation Calling shutdown prevents further reads and/or writes on a socket. We should do a few more things based on the type of socket, but this initial implementation just puts the basic mechanism in place. Work towards #428.
2020-02-07 23:52:33 +00:00
if (socket.is_shut_down_for_reading())
return 0;
Kernel: Rename "descriptor" to "description" where appropriate. Now that FileDescription is called that, variables of that type should not be called "descriptor". This is kinda wordy but we'll get used to it.
2019-06-13 20:03:04 +00:00
bool original_blocking = description->is_blocking();
Kernel: Add support for recv() with MSG_DONTWAIT. Passing this flag to recv() temporarily puts the file descriptor into non-blocking mode. Also implement LocalSocket::recv() as a simple forwarding to read().
2019-05-20 01:44:45 +00:00
if (flags & MSG_DONTWAIT)
Kernel: Rename "descriptor" to "description" where appropriate. Now that FileDescription is called that, variables of that type should not be called "descriptor". This is kinda wordy but we'll get used to it.
2019-06-13 20:03:04 +00:00
description->set_blocking(false);
Kernel: Add support for recv() with MSG_DONTWAIT. Passing this flag to recv() temporarily puts the file descriptor into non-blocking mode. Also implement LocalSocket::recv() as a simple forwarding to read().
2019-05-20 01:44:45 +00:00
Kernel: Use the Syscall string and buffer types more While I was updating syscalls to stop passing null-terminated strings, I added some helpful struct types: - StringArgument { const char*; size_t; } - ImmutableBuffer<Data, Size> { const Data*; Size; } - MutableBuffer<Data, Size> { Data*; Size; } The Process class has some convenience functions for validating and optionally extracting the contents from these structs: - get_syscall_path_argument(StringArgument) - validate_and_copy_string_from_user(StringArgument) - validate(ImmutableBuffer) - validate(MutableBuffer) There's still so much code around this and I'm wondering if we should generate most of it instead. Possible nice little project.
2020-01-11 11:47:47 +00:00
auto nrecv = socket.recvfrom(*description, params.buffer.data, params.buffer.size, flags, addr, addr_length);
Kernel: Add support for recv() with MSG_DONTWAIT. Passing this flag to recv() temporarily puts the file descriptor into non-blocking mode. Also implement LocalSocket::recv() as a simple forwarding to read().
2019-05-20 01:44:45 +00:00
if (flags & MSG_DONTWAIT)
Kernel: Rename "descriptor" to "description" where appropriate. Now that FileDescription is called that, variables of that type should not be called "descriptor". This is kinda wordy but we'll get used to it.
2019-06-13 20:03:04 +00:00
description->set_blocking(original_blocking);
Kernel: Add support for recv() with MSG_DONTWAIT. Passing this flag to recv() temporarily puts the file descriptor into non-blocking mode. Also implement LocalSocket::recv() as a simple forwarding to read().
2019-05-20 01:44:45 +00:00
return nrecv;
Kernel+LibC+Userland: Yet more networking bringup hacking. All ICMP sockets now receive all ICMP packets. All this buffering is gonna need some limits and such.
2019-03-12 16:27:07 +00:00
}
Kernel: Remove SmapDisablers in sys$getsockname() and sys$getpeername() Instead use the user/kernel copy helpers to only copy the minimum stuff needed from to/from userspace. Based on work started by Brian Gianforcaro.
2020-01-27 20:11:36 +00:00
template<bool sockname, typename Params>
int Process::get_sock_or_peer_name(const Params& params)
Kernel+LibC: Implement getsockname() syscall.
2019-05-19 17:55:27 +00:00
{
Kernel: Remove SmapDisablers in sys$getsockname() and sys$getpeername() Instead use the user/kernel copy helpers to only copy the minimum stuff needed from to/from userspace. Based on work started by Brian Gianforcaro.
2020-01-27 20:11:36 +00:00
socklen_t addrlen_value;
if (!validate_read_and_copy_typed(&addrlen_value, params.addrlen))
Kernel+LibC: Implement getsockname() syscall.
2019-05-19 17:55:27 +00:00
return -EFAULT;
Kernel: Remove SmapDisablers in sys$getsockname() and sys$getpeername() Instead use the user/kernel copy helpers to only copy the minimum stuff needed from to/from userspace. Based on work started by Brian Gianforcaro.
2020-01-27 20:11:36 +00:00
if (addrlen_value <= 0)
Kernel+LibC: Implement getsockname() syscall.
2019-05-19 17:55:27 +00:00
return -EINVAL;
Kernel: Remove SmapDisablers in sys$getsockname() and sys$getpeername() Instead use the user/kernel copy helpers to only copy the minimum stuff needed from to/from userspace. Based on work started by Brian Gianforcaro.
2020-01-27 20:11:36 +00:00
if (!validate_write(params.addr, addrlen_value))
Kernel+LibC: Implement getsockname() syscall.
2019-05-19 17:55:27 +00:00
return -EFAULT;
Kernel: Remove SmapDisablers in sys$getsockname() and sys$getpeername() Instead use the user/kernel copy helpers to only copy the minimum stuff needed from to/from userspace. Based on work started by Brian Gianforcaro.
2020-01-27 20:11:36 +00:00
if (!validate_write_typed(params.addrlen))
return -EFAULT;
auto description = file_description(params.sockfd);
Kernel: Rename "descriptor" to "description" where appropriate. Now that FileDescription is called that, variables of that type should not be called "descriptor". This is kinda wordy but we'll get used to it.
2019-06-13 20:03:04 +00:00
if (!description)
Kernel+LibC: Implement getsockname() syscall.
2019-05-19 17:55:27 +00:00
return -EBADF;
Kernel: Rename "descriptor" to "description" where appropriate. Now that FileDescription is called that, variables of that type should not be called "descriptor". This is kinda wordy but we'll get used to it.
2019-06-13 20:03:04 +00:00
if (!description->is_socket())
Kernel+LibC: Implement getsockname() syscall.
2019-05-19 17:55:27 +00:00
return -ENOTSOCK;
Kernel: Rename "descriptor" to "description" where appropriate. Now that FileDescription is called that, variables of that type should not be called "descriptor". This is kinda wordy but we'll get used to it.
2019-06-13 20:03:04 +00:00
auto& socket = *description->socket();
ping: Use pledge()
2020-01-11 19:48:43 +00:00
REQUIRE_PROMISE_FOR_SOCKET_DOMAIN(socket.domain());
Kernel: Add getpeername() syscall, and fix getsockname() behavior. We were copying the raw IPv4 addresses into the wrong part of sockaddr_in, and we didn't set sa_family or sa_port.
2019-05-20 18:33:03 +00:00
Kernel: Remove SmapDisablers in sys$getsockname() and sys$getpeername() Instead use the user/kernel copy helpers to only copy the minimum stuff needed from to/from userspace. Based on work started by Brian Gianforcaro.
2020-01-27 20:11:36 +00:00
u8 address_buffer[sizeof(sockaddr_un)];
addrlen_value = min(sizeof(sockaddr_un), static_cast<size_t>(addrlen_value));
Kernel: Truncate addresses stored by getsockname() and getpeername() If there's not enough space in the output buffer for the whole sockaddr we now simply truncate the address instead of returning EINVAL. This patch also makes getpeername() actually return the peer address rather than the local address.. :^)
2020-02-07 22:42:28 +00:00
if constexpr (sockname)
socket.get_local_address((sockaddr*)address_buffer, &addrlen_value);
else
socket.get_peer_address((sockaddr*)address_buffer, &addrlen_value);
Kernel: Remove SmapDisablers in sys$getsockname() and sys$getpeername() Instead use the user/kernel copy helpers to only copy the minimum stuff needed from to/from userspace. Based on work started by Brian Gianforcaro.
2020-01-27 20:11:36 +00:00
copy_to_user(params.addr, address_buffer, addrlen_value);
Kernel: Truncate addresses stored by getsockname() and getpeername() If there's not enough space in the output buffer for the whole sockaddr we now simply truncate the address instead of returning EINVAL. This patch also makes getpeername() actually return the peer address rather than the local address.. :^)
2020-02-07 22:42:28 +00:00
copy_to_user(params.addrlen, &addrlen_value);
Kernel: Add getpeername() syscall, and fix getsockname() behavior. We were copying the raw IPv4 addresses into the wrong part of sockaddr_in, and we didn't set sa_family or sa_port.
2019-05-20 18:33:03 +00:00
return 0;
}
Kernel: Remove SmapDisablers in sys$getsockname() and sys$getpeername() Instead use the user/kernel copy helpers to only copy the minimum stuff needed from to/from userspace. Based on work started by Brian Gianforcaro.
2020-01-27 20:11:36 +00:00
int Process::sys$getsockname(const Syscall::SC_getsockname_params* user_params)
Kernel: Add getpeername() syscall, and fix getsockname() behavior. We were copying the raw IPv4 addresses into the wrong part of sockaddr_in, and we didn't set sa_family or sa_port.
2019-05-20 18:33:03 +00:00
{
Kernel: Remove SmapDisablers in sys$getsockname() and sys$getpeername() Instead use the user/kernel copy helpers to only copy the minimum stuff needed from to/from userspace. Based on work started by Brian Gianforcaro.
2020-01-27 20:11:36 +00:00
Syscall::SC_getsockname_params params;
if (!validate_read_and_copy_typed(&params, user_params))
Kernel: Add getpeername() syscall, and fix getsockname() behavior. We were copying the raw IPv4 addresses into the wrong part of sockaddr_in, and we didn't set sa_family or sa_port.
2019-05-20 18:33:03 +00:00
return -EFAULT;
Kernel: Remove SmapDisablers in sys$getsockname() and sys$getpeername() Instead use the user/kernel copy helpers to only copy the minimum stuff needed from to/from userspace. Based on work started by Brian Gianforcaro.
2020-01-27 20:11:36 +00:00
return get_sock_or_peer_name<true>(params);
}
Kernel: Add getpeername() syscall, and fix getsockname() behavior. We were copying the raw IPv4 addresses into the wrong part of sockaddr_in, and we didn't set sa_family or sa_port.
2019-05-20 18:33:03 +00:00
Kernel: Remove SmapDisablers in sys$getsockname() and sys$getpeername() Instead use the user/kernel copy helpers to only copy the minimum stuff needed from to/from userspace. Based on work started by Brian Gianforcaro.
2020-01-27 20:11:36 +00:00
int Process::sys$getpeername(const Syscall::SC_getpeername_params* user_params)
{
Syscall::SC_getpeername_params params;
if (!validate_read_and_copy_typed(&params, user_params))
Kernel: Add getpeername() syscall, and fix getsockname() behavior. We were copying the raw IPv4 addresses into the wrong part of sockaddr_in, and we didn't set sa_family or sa_port.
2019-05-20 18:33:03 +00:00
return -EFAULT;
Kernel: Remove SmapDisablers in sys$getsockname() and sys$getpeername() Instead use the user/kernel copy helpers to only copy the minimum stuff needed from to/from userspace. Based on work started by Brian Gianforcaro.
2020-01-27 20:11:36 +00:00
return get_sock_or_peer_name<false>(params);
Kernel+LibC: Implement getsockname() syscall.
2019-05-19 17:55:27 +00:00
}
Kernel: Make sched_setparam() and sched_getparam() operate on threads Instead of operating on "some random thread in PID", these now operate on the thread with a specific TID. This matches other systems better.
2020-01-26 08:58:58 +00:00
int Process::sys$sched_setparam(int tid, const struct sched_param* param)
Kernel/LibC: Implement sched_* functionality to set/get process priority Right now, we allow anything inside a user to raise or lower any other process's priority. This feels simple enough to me. Linux disallows raising, but that's annoying in practice.
2019-05-29 21:20:51 +00:00
{
ping: Use pledge()
2020-01-11 19:48:43 +00:00
REQUIRE_PROMISE(proc);
Kernel/LibC: Implement sched_* functionality to set/get process priority Right now, we allow anything inside a user to raise or lower any other process's priority. This feels simple enough to me. Linux disallows raising, but that's annoying in practice.
2019-05-29 21:20:51 +00:00
if (!validate_read_typed(param))
return -EFAULT;
Kernel: Start implementing x86 SMAP support Supervisor Mode Access Prevention (SMAP) is an x86 CPU feature that prevents the kernel from accessing userspace memory. With SMAP enabled, trying to read/write a userspace memory address while in the kernel will now generate a page fault. Since it's sometimes necessary to read/write userspace memory, there are two new instructions that quickly switch the protection on/off: STAC (disables protection) and CLAC (enables protection.) These are exposed in kernel code via the stac() and clac() helpers. There's also a SmapDisabler RAII object that can be used to ensure that you don't forget to re-enable protection before returning to userspace code. THis patch also adds copy_to_user(), copy_from_user() and memset_user() which are the "correct" way of doing things. These functions allow us to briefly disable protection for a specific purpose, and then turn it back on immediately after it's done. Going forward all kernel code should be moved to using these and all uses of SmapDisabler are to be considered FIXME's. Note that we're not realizing the full potential of this feature since I've used SmapDisabler quite liberally in this initial bring-up patch.
2020-01-05 17:00:15 +00:00
int desired_priority;
Kernel: Use the templated copy_to/from_user() in more places These ensure that the "to" and "from" pointers have the same type, and also that we copy the correct number of bytes.
2020-01-20 12:38:31 +00:00
copy_from_user(&desired_priority, &param->sched_priority);
Kernel: Start implementing x86 SMAP support Supervisor Mode Access Prevention (SMAP) is an x86 CPU feature that prevents the kernel from accessing userspace memory. With SMAP enabled, trying to read/write a userspace memory address while in the kernel will now generate a page fault. Since it's sometimes necessary to read/write userspace memory, there are two new instructions that quickly switch the protection on/off: STAC (disables protection) and CLAC (enables protection.) These are exposed in kernel code via the stac() and clac() helpers. There's also a SmapDisabler RAII object that can be used to ensure that you don't forget to re-enable protection before returning to userspace code. THis patch also adds copy_to_user(), copy_from_user() and memset_user() which are the "correct" way of doing things. These functions allow us to briefly disable protection for a specific purpose, and then turn it back on immediately after it's done. Going forward all kernel code should be moved to using these and all uses of SmapDisabler are to be considered FIXME's. Note that we're not realizing the full potential of this feature since I've used SmapDisabler quite liberally in this initial bring-up patch.
2020-01-05 17:00:15 +00:00
Kernel/LibC: Implement sched_* functionality to set/get process priority Right now, we allow anything inside a user to raise or lower any other process's priority. This feels simple enough to me. Linux disallows raising, but that's annoying in practice.
2019-05-29 21:20:51 +00:00
InterruptDisabler disabler;
Kernel: Make sched_setparam() and sched_getparam() operate on threads Instead of operating on "some random thread in PID", these now operate on the thread with a specific TID. This matches other systems better.
2020-01-26 08:58:58 +00:00
auto* peer = current;
if (tid != 0)
peer = Thread::from_tid(tid);
Kernel/LibC: Implement sched_* functionality to set/get process priority Right now, we allow anything inside a user to raise or lower any other process's priority. This feels simple enough to me. Linux disallows raising, but that's annoying in practice.
2019-05-29 21:20:51 +00:00
if (!peer)
return -ESRCH;
Kernel: Make sched_setparam() and sched_getparam() operate on threads Instead of operating on "some random thread in PID", these now operate on the thread with a specific TID. This matches other systems better.
2020-01-26 08:58:58 +00:00
if (!is_superuser() && m_euid != peer->process().m_uid && m_uid != peer->process().m_uid)
Kernel/LibC: Implement sched_* functionality to set/get process priority Right now, we allow anything inside a user to raise or lower any other process's priority. This feels simple enough to me. Linux disallows raising, but that's annoying in practice.
2019-05-29 21:20:51 +00:00
return -EPERM;
Kernel: Start implementing x86 SMAP support Supervisor Mode Access Prevention (SMAP) is an x86 CPU feature that prevents the kernel from accessing userspace memory. With SMAP enabled, trying to read/write a userspace memory address while in the kernel will now generate a page fault. Since it's sometimes necessary to read/write userspace memory, there are two new instructions that quickly switch the protection on/off: STAC (disables protection) and CLAC (enables protection.) These are exposed in kernel code via the stac() and clac() helpers. There's also a SmapDisabler RAII object that can be used to ensure that you don't forget to re-enable protection before returning to userspace code. THis patch also adds copy_to_user(), copy_from_user() and memset_user() which are the "correct" way of doing things. These functions allow us to briefly disable protection for a specific purpose, and then turn it back on immediately after it's done. Going forward all kernel code should be moved to using these and all uses of SmapDisabler are to be considered FIXME's. Note that we're not realizing the full potential of this feature since I've used SmapDisabler quite liberally in this initial bring-up patch.
2020-01-05 17:00:15 +00:00
if (desired_priority < THREAD_PRIORITY_MIN || desired_priority > THREAD_PRIORITY_MAX)
Kernel/LibC: Implement sched_* functionality to set/get process priority Right now, we allow anything inside a user to raise or lower any other process's priority. This feels simple enough to me. Linux disallows raising, but that's annoying in practice.
2019-05-29 21:20:51 +00:00
return -EINVAL;
Kernel: Make sched_setparam() and sched_getparam() operate on threads Instead of operating on "some random thread in PID", these now operate on the thread with a specific TID. This matches other systems better.
2020-01-26 08:58:58 +00:00
peer->set_priority((u32)desired_priority);
Kernel/LibC: Implement sched_* functionality to set/get process priority Right now, we allow anything inside a user to raise or lower any other process's priority. This feels simple enough to me. Linux disallows raising, but that's annoying in practice.
2019-05-29 21:20:51 +00:00
return 0;
}
int Process::sys$sched_getparam(pid_t pid, struct sched_param* param)
{
ping: Use pledge()
2020-01-11 19:48:43 +00:00
REQUIRE_PROMISE(proc);
Kernel: Start implementing x86 SMAP support Supervisor Mode Access Prevention (SMAP) is an x86 CPU feature that prevents the kernel from accessing userspace memory. With SMAP enabled, trying to read/write a userspace memory address while in the kernel will now generate a page fault. Since it's sometimes necessary to read/write userspace memory, there are two new instructions that quickly switch the protection on/off: STAC (disables protection) and CLAC (enables protection.) These are exposed in kernel code via the stac() and clac() helpers. There's also a SmapDisabler RAII object that can be used to ensure that you don't forget to re-enable protection before returning to userspace code. THis patch also adds copy_to_user(), copy_from_user() and memset_user() which are the "correct" way of doing things. These functions allow us to briefly disable protection for a specific purpose, and then turn it back on immediately after it's done. Going forward all kernel code should be moved to using these and all uses of SmapDisabler are to be considered FIXME's. Note that we're not realizing the full potential of this feature since I've used SmapDisabler quite liberally in this initial bring-up patch.
2020-01-05 17:00:15 +00:00
if (!validate_write_typed(param))
Kernel/LibC: Implement sched_* functionality to set/get process priority Right now, we allow anything inside a user to raise or lower any other process's priority. This feels simple enough to me. Linux disallows raising, but that's annoying in practice.
2019-05-29 21:20:51 +00:00
return -EFAULT;
InterruptDisabler disabler;
Kernel: Make sched_setparam() and sched_getparam() operate on threads Instead of operating on "some random thread in PID", these now operate on the thread with a specific TID. This matches other systems better.
2020-01-26 08:58:58 +00:00
auto* peer = current;
Kernel/LibC: Implement sched_* functionality to set/get process priority Right now, we allow anything inside a user to raise or lower any other process's priority. This feels simple enough to me. Linux disallows raising, but that's annoying in practice.
2019-05-29 21:20:51 +00:00
if (pid != 0)
Kernel: Make sched_setparam() and sched_getparam() operate on threads Instead of operating on "some random thread in PID", these now operate on the thread with a specific TID. This matches other systems better.
2020-01-26 08:58:58 +00:00
peer = Thread::from_tid(pid);
Kernel/LibC: Implement sched_* functionality to set/get process priority Right now, we allow anything inside a user to raise or lower any other process's priority. This feels simple enough to me. Linux disallows raising, but that's annoying in practice.
2019-05-29 21:20:51 +00:00
if (!peer)
return -ESRCH;
Kernel: Make sched_setparam() and sched_getparam() operate on threads Instead of operating on "some random thread in PID", these now operate on the thread with a specific TID. This matches other systems better.
2020-01-26 08:58:58 +00:00
if (!is_superuser() && m_euid != peer->process().m_uid && m_uid != peer->process().m_uid)
Kernel/LibC: Implement sched_* functionality to set/get process priority Right now, we allow anything inside a user to raise or lower any other process's priority. This feels simple enough to me. Linux disallows raising, but that's annoying in practice.
2019-05-29 21:20:51 +00:00
return -EPERM;
Kernel: Make sched_setparam() and sched_getparam() operate on threads Instead of operating on "some random thread in PID", these now operate on the thread with a specific TID. This matches other systems better.
2020-01-26 08:58:58 +00:00
int priority = peer->priority();
Kernel: Use the templated copy_to/from_user() in more places These ensure that the "to" and "from" pointers have the same type, and also that we copy the correct number of bytes.
2020-01-20 12:38:31 +00:00
copy_to_user(&param->sched_priority, &priority);
Kernel/LibC: Implement sched_* functionality to set/get process priority Right now, we allow anything inside a user to raise or lower any other process's priority. This feels simple enough to me. Linux disallows raising, but that's annoying in practice.
2019-05-29 21:20:51 +00:00
return 0;
}
Add support for socket send/receive timeouts. Only the receive timeout is hooked up yet. You can change the timeout by calling setsockopt(..., SOL_SOCKET, SO_RCVTIMEO, ...). Use this mechanism to make /bin/ping report timeouts.
2019-03-13 12:13:23 +00:00
int Process::sys$getsockopt(const Syscall::SC_getsockopt_params* params)
{
if (!validate_read_typed(params))
return -EFAULT;
Kernel: Use C++ structured bindings to bind syscall parameters Some syscalls have to pass parameters through a struct, since we can only fit 3 parameters with our calling convention. This patch makes use of C++ structured binding to clean up the places where we expand those parameters structs into local variables.
2019-11-10 14:32:59 +00:00
Kernel: Start implementing x86 SMAP support Supervisor Mode Access Prevention (SMAP) is an x86 CPU feature that prevents the kernel from accessing userspace memory. With SMAP enabled, trying to read/write a userspace memory address while in the kernel will now generate a page fault. Since it's sometimes necessary to read/write userspace memory, there are two new instructions that quickly switch the protection on/off: STAC (disables protection) and CLAC (enables protection.) These are exposed in kernel code via the stac() and clac() helpers. There's also a SmapDisabler RAII object that can be used to ensure that you don't forget to re-enable protection before returning to userspace code. THis patch also adds copy_to_user(), copy_from_user() and memset_user() which are the "correct" way of doing things. These functions allow us to briefly disable protection for a specific purpose, and then turn it back on immediately after it's done. Going forward all kernel code should be moved to using these and all uses of SmapDisabler are to be considered FIXME's. Note that we're not realizing the full potential of this feature since I've used SmapDisabler quite liberally in this initial bring-up patch.
2020-01-05 17:00:15 +00:00
SmapDisabler disabler;
Kernel: Fix bad TOCTOU pattern in syscalls that take a parameter struct Our syscall calling convention only allows passing up to 3 arguments in registers. For syscalls that take more arguments, we bake them into a struct and pass a pointer to that struct instead. When doing pointer validation, this is what we would do: 1) Validate the "params" struct 2) Validate "params->some_pointer" 3) ... other stuff ... 4) Use "params->some_pointer" Since the parameter struct is stored in userspace, it can be modified by userspace after validation has completed. This was a recurring pattern in many syscalls that was further hidden by me using structured binding declarations to give convenient local names to things in the parameter struct: auto& [some_pointer, ...] = *params; memcpy(some_pointer, ...); This devilishly makes "some_pointer" look like a local variable but it's actually more like an alias for "params->some_pointer" and will expand to a dereference when accessed! This patch fixes the issues by explicitly copying out each member from the parameter structs before validating them, and then never using the "param" pointers beyond that. Thanks to braindead for finding this bug! :^)
2020-01-05 08:13:00 +00:00
int sockfd = params->sockfd;
int level = params->level;
int option = params->option;
void* value = params->value;
socklen_t* value_size = params->value_size;
Add support for socket send/receive timeouts. Only the receive timeout is hooked up yet. You can change the timeout by calling setsockopt(..., SOL_SOCKET, SO_RCVTIMEO, ...). Use this mechanism to make /bin/ping report timeouts.
2019-03-13 12:13:23 +00:00
if (!validate_write_typed(value_size))
return -EFAULT;
if (!validate_write(value, *value_size))
return -EFAULT;
Kernel: Make Process::file_description() vend a RefPtr<FileDescription> This encourages callers to strongly reference file descriptions while working with them. This fixes a use-after-free issue where one thread would close() an open fd while another thread was blocked on it becoming readable. Test: Kernel/uaf-close-while-blocked-in-read.cpp
2020-01-07 14:53:42 +00:00
auto description = file_description(sockfd);
Kernel: Rename "descriptor" to "description" where appropriate. Now that FileDescription is called that, variables of that type should not be called "descriptor". This is kinda wordy but we'll get used to it.
2019-06-13 20:03:04 +00:00
if (!description)
Add support for socket send/receive timeouts. Only the receive timeout is hooked up yet. You can change the timeout by calling setsockopt(..., SOL_SOCKET, SO_RCVTIMEO, ...). Use this mechanism to make /bin/ping report timeouts.
2019-03-13 12:13:23 +00:00
return -EBADF;
Kernel: Rename "descriptor" to "description" where appropriate. Now that FileDescription is called that, variables of that type should not be called "descriptor". This is kinda wordy but we'll get used to it.
2019-06-13 20:03:04 +00:00
if (!description->is_socket())
Add support for socket send/receive timeouts. Only the receive timeout is hooked up yet. You can change the timeout by calling setsockopt(..., SOL_SOCKET, SO_RCVTIMEO, ...). Use this mechanism to make /bin/ping report timeouts.
2019-03-13 12:13:23 +00:00
return -ENOTSOCK;
Kernel: Rename "descriptor" to "description" where appropriate. Now that FileDescription is called that, variables of that type should not be called "descriptor". This is kinda wordy but we'll get used to it.
2019-06-13 20:03:04 +00:00
auto& socket = *description->socket();
Kernel: Add "accept" pledge promise for accepting incoming connections This patch adds a new "accept" promise that allows you to call accept() on an already listening socket. This lets programs set up a socket for for listening and then dropping "inet" and/or "unix" so that only incoming (and existing) connections are allowed from that point on. No new outgoing connections or listening server sockets can be created. In addition to accept() it also allows getsockopt() with SOL_SOCKET and SO_PEERCRED, which is used to find the PID/UID/GID of the socket peer. This is used by our IPC library when creating shared buffers that should only be accessible to a specific peer process. This allows us to drop "unix" in WindowServer and LookupServer. :^) It also makes the debugging/introspection RPC sockets in CEventLoop based programs work again.
2020-01-17 10:12:06 +00:00
if (has_promised(Pledge::accept) && socket.is_local() && level == SOL_SOCKET && option == SO_PEERCRED) {
// We make an exception for SOL_SOCKET::SO_PEERCRED on local sockets if you've pledged "accept"
} else {
REQUIRE_PROMISE_FOR_SOCKET_DOMAIN(socket.domain());
}
Kernel: Add getsockopt(SO_PEERCRED) for local sockets This sockopt gives you a struct with the PID, UID and GID of a socket's peer process.
2019-12-06 17:38:36 +00:00
return socket.getsockopt(*description, level, option, value, value_size);
Add support for socket send/receive timeouts. Only the receive timeout is hooked up yet. You can change the timeout by calling setsockopt(..., SOL_SOCKET, SO_RCVTIMEO, ...). Use this mechanism to make /bin/ping report timeouts.
2019-03-13 12:13:23 +00:00
}
int Process::sys$setsockopt(const Syscall::SC_setsockopt_params* params)
{
if (!validate_read_typed(params))
return -EFAULT;
Kernel: Use C++ structured bindings to bind syscall parameters Some syscalls have to pass parameters through a struct, since we can only fit 3 parameters with our calling convention. This patch makes use of C++ structured binding to clean up the places where we expand those parameters structs into local variables.
2019-11-10 14:32:59 +00:00
Kernel: Start implementing x86 SMAP support Supervisor Mode Access Prevention (SMAP) is an x86 CPU feature that prevents the kernel from accessing userspace memory. With SMAP enabled, trying to read/write a userspace memory address while in the kernel will now generate a page fault. Since it's sometimes necessary to read/write userspace memory, there are two new instructions that quickly switch the protection on/off: STAC (disables protection) and CLAC (enables protection.) These are exposed in kernel code via the stac() and clac() helpers. There's also a SmapDisabler RAII object that can be used to ensure that you don't forget to re-enable protection before returning to userspace code. THis patch also adds copy_to_user(), copy_from_user() and memset_user() which are the "correct" way of doing things. These functions allow us to briefly disable protection for a specific purpose, and then turn it back on immediately after it's done. Going forward all kernel code should be moved to using these and all uses of SmapDisabler are to be considered FIXME's. Note that we're not realizing the full potential of this feature since I've used SmapDisabler quite liberally in this initial bring-up patch.
2020-01-05 17:00:15 +00:00
SmapDisabler disabler;
Kernel: Fix bad TOCTOU pattern in syscalls that take a parameter struct Our syscall calling convention only allows passing up to 3 arguments in registers. For syscalls that take more arguments, we bake them into a struct and pass a pointer to that struct instead. When doing pointer validation, this is what we would do: 1) Validate the "params" struct 2) Validate "params->some_pointer" 3) ... other stuff ... 4) Use "params->some_pointer" Since the parameter struct is stored in userspace, it can be modified by userspace after validation has completed. This was a recurring pattern in many syscalls that was further hidden by me using structured binding declarations to give convenient local names to things in the parameter struct: auto& [some_pointer, ...] = *params; memcpy(some_pointer, ...); This devilishly makes "some_pointer" look like a local variable but it's actually more like an alias for "params->some_pointer" and will expand to a dereference when accessed! This patch fixes the issues by explicitly copying out each member from the parameter structs before validating them, and then never using the "param" pointers beyond that. Thanks to braindead for finding this bug! :^)
2020-01-05 08:13:00 +00:00
int sockfd = params->sockfd;
int level = params->level;
int option = params->option;
const void* value = params->value;
socklen_t value_size = params->value_size;
Add support for socket send/receive timeouts. Only the receive timeout is hooked up yet. You can change the timeout by calling setsockopt(..., SOL_SOCKET, SO_RCVTIMEO, ...). Use this mechanism to make /bin/ping report timeouts.
2019-03-13 12:13:23 +00:00
if (!validate_read(value, value_size))
return -EFAULT;
Kernel: Make Process::file_description() vend a RefPtr<FileDescription> This encourages callers to strongly reference file descriptions while working with them. This fixes a use-after-free issue where one thread would close() an open fd while another thread was blocked on it becoming readable. Test: Kernel/uaf-close-while-blocked-in-read.cpp
2020-01-07 14:53:42 +00:00
auto description = file_description(sockfd);
Kernel: Rename "descriptor" to "description" where appropriate. Now that FileDescription is called that, variables of that type should not be called "descriptor". This is kinda wordy but we'll get used to it.
2019-06-13 20:03:04 +00:00
if (!description)
Add support for socket send/receive timeouts. Only the receive timeout is hooked up yet. You can change the timeout by calling setsockopt(..., SOL_SOCKET, SO_RCVTIMEO, ...). Use this mechanism to make /bin/ping report timeouts.
2019-03-13 12:13:23 +00:00
return -EBADF;
Kernel: Rename "descriptor" to "description" where appropriate. Now that FileDescription is called that, variables of that type should not be called "descriptor". This is kinda wordy but we'll get used to it.
2019-06-13 20:03:04 +00:00
if (!description->is_socket())
Add support for socket send/receive timeouts. Only the receive timeout is hooked up yet. You can change the timeout by calling setsockopt(..., SOL_SOCKET, SO_RCVTIMEO, ...). Use this mechanism to make /bin/ping report timeouts.
2019-03-13 12:13:23 +00:00
return -ENOTSOCK;
Kernel: Rename "descriptor" to "description" where appropriate. Now that FileDescription is called that, variables of that type should not be called "descriptor". This is kinda wordy but we'll get used to it.
2019-06-13 20:03:04 +00:00
auto& socket = *description->socket();
ping: Use pledge()
2020-01-11 19:48:43 +00:00
REQUIRE_PROMISE_FOR_SOCKET_DOMAIN(socket.domain());
Add support for socket send/receive timeouts. Only the receive timeout is hooked up yet. You can change the timeout by calling setsockopt(..., SOL_SOCKET, SO_RCVTIMEO, ...). Use this mechanism to make /bin/ping report timeouts.
2019-03-13 12:13:23 +00:00
return socket.setsockopt(level, option, value, value_size);
}
Kernel: Add a simple shared memory API for two processes only. And use this to implement shared bitmaps between WindowServer and clients.
2019-02-16 11:13:43 +00:00
void Process::disown_all_shared_buffers()
{
LOCKER(shared_buffers().lock());
Sprinkle use of AK::Vector in various places. Some of these are less helpful than others. Avoiding a bunch of mallocs in the event loop wakeup code is definitely nice.
2019-04-20 12:02:19 +00:00
Vector<SharedBuffer*, 32> buffers_to_disown;
Kernel: Don't remove from SharedBuffer map while iterating it. This was causing a finalizer crash when handling a process that co-owned multiple shared buffers.
2019-02-20 20:31:52 +00:00
for (auto& it : shared_buffers().resource())
buffers_to_disown.append(it.value.ptr());
for (auto* shared_buffer : buffers_to_disown)
shared_buffer->disown(m_pid);
Kernel: Add a simple shared memory API for two processes only. And use this to implement shared bitmaps between WindowServer and clients.
2019-02-16 11:13:43 +00:00
}
SharedBuffer: Split the creation and share steps This allows us to seal a buffer *before* anyone else has access to it (well, ok, the creating process still does, but you can't win them all). It also means that a SharedBuffer can be shared with multiple clients: all you need is to have access to it to share it on again.
2019-07-18 07:52:22 +00:00
int Process::sys$create_shared_buffer(int size, void** buffer)
Kernel: Add a simple shared memory API for two processes only. And use this to implement shared bitmaps between WindowServer and clients.
2019-02-16 11:13:43 +00:00
{
ping: Use pledge()
2020-01-11 19:48:43 +00:00
REQUIRE_PROMISE(shared_buffer);
Add a C++ helper class for working with shared buffers. This is a bit more comfortable than passing the shared buffer ID manually everywhere and keeping track of size etc.
2019-03-08 11:22:55 +00:00
if (!size || size < 0)
Kernel: Don't remove from SharedBuffer map while iterating it. This was causing a finalizer crash when handling a process that co-owned multiple shared buffers.
2019-02-20 20:31:52 +00:00
return -EINVAL;
size = PAGE_ROUND_UP(size);
Kernel: Add a simple shared memory API for two processes only. And use this to implement shared bitmaps between WindowServer and clients.
2019-02-16 11:13:43 +00:00
if (!validate_write_typed(buffer))
return -EFAULT;
Kernel: SharedBuffer sharing cleanup Rather than limiting it to two shared processes, store a Vector of references, so we can add more if we want. Makes the code a little more generic. No actual change to the syscall interface yet, so nothing takes advantage of this yet.
2019-07-15 18:38:41 +00:00
Kernel: Add a simple shared memory API for two processes only. And use this to implement shared bitmaps between WindowServer and clients.
2019-02-16 11:13:43 +00:00
LOCKER(shared_buffers().lock());
SharedBuffer: Fix deadlock on destroy We were locking the list of references, and then destroying the reference, which made things go a little crazy. It's more straightforward to just remove the per-reference lock: the syscalls all have to lock the full list anyway, so let's just do that and avoid the hassle. While I'm at it, also move the SharedBuffer code out to its own file as it's getting a little long and unwieldly, and Process.cpp is already huge.
2019-07-16 13:03:39 +00:00
static int s_next_shared_buffer_id;
Kernel: Add a simple shared memory API for two processes only. And use this to implement shared bitmaps between WindowServer and clients.
2019-02-16 11:13:43 +00:00
int shared_buffer_id = ++s_next_shared_buffer_id;
Kernel: SharedBuffer sharing cleanup Rather than limiting it to two shared processes, store a Vector of references, so we can add more if we want. Makes the code a little more generic. No actual change to the syscall interface yet, so nothing takes advantage of this yet.
2019-07-15 18:38:41 +00:00
auto shared_buffer = make<SharedBuffer>(shared_buffer_id, size);
shared_buffer->share_with(m_pid);
Kernel: Start implementing x86 SMAP support Supervisor Mode Access Prevention (SMAP) is an x86 CPU feature that prevents the kernel from accessing userspace memory. With SMAP enabled, trying to read/write a userspace memory address while in the kernel will now generate a page fault. Since it's sometimes necessary to read/write userspace memory, there are two new instructions that quickly switch the protection on/off: STAC (disables protection) and CLAC (enables protection.) These are exposed in kernel code via the stac() and clac() helpers. There's also a SmapDisabler RAII object that can be used to ensure that you don't forget to re-enable protection before returning to userspace code. THis patch also adds copy_to_user(), copy_from_user() and memset_user() which are the "correct" way of doing things. These functions allow us to briefly disable protection for a specific purpose, and then turn it back on immediately after it's done. Going forward all kernel code should be moved to using these and all uses of SmapDisabler are to be considered FIXME's. Note that we're not realizing the full potential of this feature since I've used SmapDisabler quite liberally in this initial bring-up patch.
2020-01-05 17:00:15 +00:00
void* address = shared_buffer->ref_for_process_and_get_address(*this);
{
SmapDisabler disabler;
*buffer = address;
}
Kernel: Fix all compiler warnings.
2019-06-22 14:22:34 +00:00
ASSERT((int)shared_buffer->size() >= size);
Move WindowServer to userspace. This is a monster patch that required changing a whole bunch of things. There are performance and stability issues all over the place, but it works. Pretty cool, I have to admit :^)
2019-02-16 23:13:47 +00:00
#ifdef SHARED_BUFFER_DEBUG
Kernel: Rename vmo => vmobject everywhere
2019-12-19 18:13:44 +00:00
kprintf("%s(%u): Created shared buffer %d @ %p (%u bytes, vmobject is %u)\n", name().characters(), pid(), shared_buffer_id, *buffer, size, shared_buffer->size());
Move WindowServer to userspace. This is a monster patch that required changing a whole bunch of things. There are performance and stability issues all over the place, but it works. Pretty cool, I have to admit :^)
2019-02-16 23:13:47 +00:00
#endif
Kernel: Add a simple shared memory API for two processes only. And use this to implement shared bitmaps between WindowServer and clients.
2019-02-16 11:13:43 +00:00
shared_buffers().resource().set(shared_buffer_id, move(shared_buffer));
Kernel: SharedBuffer sharing cleanup Rather than limiting it to two shared processes, store a Vector of references, so we can add more if we want. Makes the code a little more generic. No actual change to the syscall interface yet, so nothing takes advantage of this yet.
2019-07-15 18:38:41 +00:00
Kernel: Add a simple shared memory API for two processes only. And use this to implement shared bitmaps between WindowServer and clients.
2019-02-16 11:13:43 +00:00
return shared_buffer_id;
}
SharedBuffer: Split the creation and share steps This allows us to seal a buffer *before* anyone else has access to it (well, ok, the creating process still does, but you can't win them all). It also means that a SharedBuffer can be shared with multiple clients: all you need is to have access to it to share it on again.
2019-07-18 07:52:22 +00:00
int Process::sys$share_buffer_with(int shared_buffer_id, pid_t peer_pid)
{
ping: Use pledge()
2020-01-11 19:48:43 +00:00
REQUIRE_PROMISE(shared_buffer);
SharedBuffer: Split the creation and share steps This allows us to seal a buffer *before* anyone else has access to it (well, ok, the creating process still does, but you can't win them all). It also means that a SharedBuffer can be shared with multiple clients: all you need is to have access to it to share it on again.
2019-07-18 07:52:22 +00:00
if (!peer_pid || peer_pid < 0 || peer_pid == m_pid)
return -EINVAL;
LOCKER(shared_buffers().lock());
auto it = shared_buffers().resource().find(shared_buffer_id);
if (it == shared_buffers().resource().end())
return -EINVAL;
auto& shared_buffer = *(*it).value;
Kernel: Disallow access to shared buffers we're not allowed to access. Unless we're on the share list, make all shared buffer related syscalls return EPERM.
2019-07-28 05:11:14 +00:00
if (!shared_buffer.is_shared_with(m_pid))
return -EPERM;
SharedBuffer: Split the creation and share steps This allows us to seal a buffer *before* anyone else has access to it (well, ok, the creating process still does, but you can't win them all). It also means that a SharedBuffer can be shared with multiple clients: all you need is to have access to it to share it on again.
2019-07-18 07:52:22 +00:00
{
InterruptDisabler disabler;
auto* peer = Process::from_pid(peer_pid);
if (!peer)
return -ESRCH;
}
shared_buffer.share_with(peer_pid);
return 0;
}
Kernel+ProcessManager: Let processes have an icon and show it in the table. Processes can now have an icon assigned, which is essentially a 16x16 RGBA32 bitmap exposed as a shared buffer ID. You set the icon ID by calling set_process_icon(int) and the icon ID will be exposed through /proc/all. To make this work, I added a mechanism for making shared buffers globally accessible. For safety reasons, each app seals the icon buffer before making it global. Right now the first call to GWindow::set_icon() is what determines the process icon. We'll probably change this in the future. :^)
2019-07-29 05:26:01 +00:00
int Process::sys$share_buffer_globally(int shared_buffer_id)
{
ping: Use pledge()
2020-01-11 19:48:43 +00:00
REQUIRE_PROMISE(shared_buffer);
Kernel+ProcessManager: Let processes have an icon and show it in the table. Processes can now have an icon assigned, which is essentially a 16x16 RGBA32 bitmap exposed as a shared buffer ID. You set the icon ID by calling set_process_icon(int) and the icon ID will be exposed through /proc/all. To make this work, I added a mechanism for making shared buffers globally accessible. For safety reasons, each app seals the icon buffer before making it global. Right now the first call to GWindow::set_icon() is what determines the process icon. We'll probably change this in the future. :^)
2019-07-29 05:26:01 +00:00
LOCKER(shared_buffers().lock());
auto it = shared_buffers().resource().find(shared_buffer_id);
if (it == shared_buffers().resource().end())
return -EINVAL;
auto& shared_buffer = *(*it).value;
if (!shared_buffer.is_shared_with(m_pid))
return -EPERM;
shared_buffer.share_globally();
return 0;
}
Kernel: Add a simple shared memory API for two processes only. And use this to implement shared bitmaps between WindowServer and clients.
2019-02-16 11:13:43 +00:00
int Process::sys$release_shared_buffer(int shared_buffer_id)
{
ping: Use pledge()
2020-01-11 19:48:43 +00:00
REQUIRE_PROMISE(shared_buffer);
Kernel: Add a simple shared memory API for two processes only. And use this to implement shared bitmaps between WindowServer and clients.
2019-02-16 11:13:43 +00:00
LOCKER(shared_buffers().lock());
auto it = shared_buffers().resource().find(shared_buffer_id);
if (it == shared_buffers().resource().end())
return -EINVAL;
auto& shared_buffer = *(*it).value;
Kernel: Disallow access to shared buffers we're not allowed to access. Unless we're on the share list, make all shared buffer related syscalls return EPERM.
2019-07-28 05:11:14 +00:00
if (!shared_buffer.is_shared_with(m_pid))
return -EPERM;
Move WindowServer to userspace. This is a monster patch that required changing a whole bunch of things. There are performance and stability issues all over the place, but it works. Pretty cool, I have to admit :^)
2019-02-16 23:13:47 +00:00
#ifdef SHARED_BUFFER_DEBUG
Add a C++ helper class for working with shared buffers. This is a bit more comfortable than passing the shared buffer ID manually everywhere and keeping track of size etc.
2019-03-08 11:22:55 +00:00
kprintf("%s(%u): Releasing shared buffer %d, buffer count: %u\n", name().characters(), pid(), shared_buffer_id, shared_buffers().resource().size());
Move WindowServer to userspace. This is a monster patch that required changing a whole bunch of things. There are performance and stability issues all over the place, but it works. Pretty cool, I have to admit :^)
2019-02-16 23:13:47 +00:00
#endif
SharedBuffer: Fix a denial of service It's a very bad idea to increment the refcount on behalf of another process. That process may (for either benign or evil reasons) not reference the SharedBuffer, and then we'll be stuck with loads of SharedBuffers until we OOM. Instead, increment the refcount when the buffer is mapped. That way, a buffer is only kept if *someone* has explicitly requested it via get_shared_buffer. Fixes #341
2019-07-19 15:46:21 +00:00
shared_buffer.deref_for_process(*this);
Kernel: Add a simple shared memory API for two processes only. And use this to implement shared bitmaps between WindowServer and clients.
2019-02-16 11:13:43 +00:00
return 0;
}
void* Process::sys$get_shared_buffer(int shared_buffer_id)
{
ping: Use pledge()
2020-01-11 19:48:43 +00:00
REQUIRE_PROMISE(shared_buffer);
Kernel: Add a simple shared memory API for two processes only. And use this to implement shared bitmaps between WindowServer and clients.
2019-02-16 11:13:43 +00:00
LOCKER(shared_buffers().lock());
auto it = shared_buffers().resource().find(shared_buffer_id);
if (it == shared_buffers().resource().end())
return (void*)-EINVAL;
auto& shared_buffer = *(*it).value;
Kernel: SharedBuffer sharing cleanup Rather than limiting it to two shared processes, store a Vector of references, so we can add more if we want. Makes the code a little more generic. No actual change to the syscall interface yet, so nothing takes advantage of this yet.
2019-07-15 18:38:41 +00:00
if (!shared_buffer.is_shared_with(m_pid))
Kernel: Disallow access to shared buffers we're not allowed to access. Unless we're on the share list, make all shared buffer related syscalls return EPERM.
2019-07-28 05:11:14 +00:00
return (void*)-EPERM;
Move WindowServer to userspace. This is a monster patch that required changing a whole bunch of things. There are performance and stability issues all over the place, but it works. Pretty cool, I have to admit :^)
2019-02-16 23:13:47 +00:00
#ifdef SHARED_BUFFER_DEBUG
Add a C++ helper class for working with shared buffers. This is a bit more comfortable than passing the shared buffer ID manually everywhere and keeping track of size etc.
2019-03-08 11:22:55 +00:00
kprintf("%s(%u): Retaining shared buffer %d, buffer count: %u\n", name().characters(), pid(), shared_buffer_id, shared_buffers().resource().size());
Move WindowServer to userspace. This is a monster patch that required changing a whole bunch of things. There are performance and stability issues all over the place, but it works. Pretty cool, I have to admit :^)
2019-02-16 23:13:47 +00:00
#endif
SharedBuffer: Fix a denial of service It's a very bad idea to increment the refcount on behalf of another process. That process may (for either benign or evil reasons) not reference the SharedBuffer, and then we'll be stuck with loads of SharedBuffers until we OOM. Instead, increment the refcount when the buffer is mapped. That way, a buffer is only kept if *someone* has explicitly requested it via get_shared_buffer. Fixes #341
2019-07-19 15:46:21 +00:00
return shared_buffer.ref_for_process_and_get_address(*this);
Kernel: Add a simple shared memory API for two processes only. And use this to implement shared bitmaps between WindowServer and clients.
2019-02-16 11:13:43 +00:00
}
Kernel: Block a signal from being dispatched again until handler returns. We don't handle nesting yet, but this is a step in the right direction.
2019-03-05 09:34:08 +00:00
Add a C++ helper class for working with shared buffers. This is a bit more comfortable than passing the shared buffer ID manually everywhere and keeping track of size etc.
2019-03-08 11:22:55 +00:00
int Process::sys$seal_shared_buffer(int shared_buffer_id)
{
ping: Use pledge()
2020-01-11 19:48:43 +00:00
REQUIRE_PROMISE(shared_buffer);
Add a C++ helper class for working with shared buffers. This is a bit more comfortable than passing the shared buffer ID manually everywhere and keeping track of size etc.
2019-03-08 11:22:55 +00:00
LOCKER(shared_buffers().lock());
auto it = shared_buffers().resource().find(shared_buffer_id);
if (it == shared_buffers().resource().end())
return -EINVAL;
auto& shared_buffer = *(*it).value;
Kernel: SharedBuffer sharing cleanup Rather than limiting it to two shared processes, store a Vector of references, so we can add more if we want. Makes the code a little more generic. No actual change to the syscall interface yet, so nothing takes advantage of this yet.
2019-07-15 18:38:41 +00:00
if (!shared_buffer.is_shared_with(m_pid))
Kernel: Disallow access to shared buffers we're not allowed to access. Unless we're on the share list, make all shared buffer related syscalls return EPERM.
2019-07-28 05:11:14 +00:00
return -EPERM;
Add a C++ helper class for working with shared buffers. This is a bit more comfortable than passing the shared buffer ID manually everywhere and keeping track of size etc.
2019-03-08 11:22:55 +00:00
#ifdef SHARED_BUFFER_DEBUG
kprintf("%s(%u): Sealing shared buffer %d\n", name().characters(), pid(), shared_buffer_id);
#endif
shared_buffer.seal();
return 0;
}
int Process::sys$get_shared_buffer_size(int shared_buffer_id)
{
ping: Use pledge()
2020-01-11 19:48:43 +00:00
REQUIRE_PROMISE(shared_buffer);
Add a C++ helper class for working with shared buffers. This is a bit more comfortable than passing the shared buffer ID manually everywhere and keeping track of size etc.
2019-03-08 11:22:55 +00:00
LOCKER(shared_buffers().lock());
auto it = shared_buffers().resource().find(shared_buffer_id);
if (it == shared_buffers().resource().end())
return -EINVAL;
auto& shared_buffer = *(*it).value;
Kernel: SharedBuffer sharing cleanup Rather than limiting it to two shared processes, store a Vector of references, so we can add more if we want. Makes the code a little more generic. No actual change to the syscall interface yet, so nothing takes advantage of this yet.
2019-07-15 18:38:41 +00:00
if (!shared_buffer.is_shared_with(m_pid))
Kernel: Disallow access to shared buffers we're not allowed to access. Unless we're on the share list, make all shared buffer related syscalls return EPERM.
2019-07-28 05:11:14 +00:00
return -EPERM;
Add a C++ helper class for working with shared buffers. This is a bit more comfortable than passing the shared buffer ID manually everywhere and keeping track of size etc.
2019-03-08 11:22:55 +00:00
#ifdef SHARED_BUFFER_DEBUG
kprintf("%s(%u): Get shared buffer %d size: %u\n", name().characters(), pid(), shared_buffer_id, shared_buffers().resource().size());
#endif
return shared_buffer.size();
}
Kernel+LibC: Make all SharedBuffers purgeable (default: non-volatile) This patch makes SharedBuffer use a PurgeableVMObject as its underlying memory object. A new syscall is added to control the volatile flag of a SharedBuffer.
2019-12-09 19:06:47 +00:00
int Process::sys$set_shared_buffer_volatile(int shared_buffer_id, bool state)
{
ping: Use pledge()
2020-01-11 19:48:43 +00:00
REQUIRE_PROMISE(shared_buffer);
Kernel+LibC: Make all SharedBuffers purgeable (default: non-volatile) This patch makes SharedBuffer use a PurgeableVMObject as its underlying memory object. A new syscall is added to control the volatile flag of a SharedBuffer.
2019-12-09 19:06:47 +00:00
LOCKER(shared_buffers().lock());
auto it = shared_buffers().resource().find(shared_buffer_id);
if (it == shared_buffers().resource().end())
return -EINVAL;
auto& shared_buffer = *(*it).value;
if (!shared_buffer.is_shared_with(m_pid))
return -EPERM;
#ifdef SHARED_BUFFER_DEBUG
kprintf("%s(%u): Set shared buffer %d volatile: %u\n", name().characters(), pid(), shared_buffer_id, state);
#endif
if (!state) {
bool was_purged = shared_buffer.vmobject().was_purged();
shared_buffer.vmobject().set_volatile(state);
shared_buffer.vmobject().set_was_purged(false);
return was_purged ? 1 : 0;
}
shared_buffer.vmobject().set_volatile(true);
return 0;
}
AK: Rename the common integer typedefs to make it obvious what they are. These types can be picked up by including <AK/Types.h>: * u8, u16, u32, u64 (unsigned) * i8, i16, i32, i64 (signed)
2019-07-03 19:17:35 +00:00
void Process::terminate_due_to_signal(u8 signal)
Kernel: Introduce threads, and refactor everything in support of it. The scheduler now operates on threads, rather than on processes. Each process has a main thread, and can have any number of additional threads. The process exits when the main thread exits. This patch doesn't actually spawn any additional threads, it merely does all the plumbing needed to make it possible. :^)
2019-03-23 21:03:17 +00:00
{
ASSERT_INTERRUPTS_DISABLED();
ASSERT(signal < 32);
dbgprintf("terminate_due_to_signal %s(%u) <- %u\n", name().characters(), pid(), signal);
m_termination_status = 0;
m_termination_signal = signal;
die();
}
AK: Rename the common integer typedefs to make it obvious what they are. These types can be picked up by including <AK/Types.h>: * u8, u16, u32, u64 (unsigned) * i8, i16, i32, i64 (signed)
2019-07-03 19:17:35 +00:00
void Process::send_signal(u8 signal, Process* sender)
Kernel: Introduce threads, and refactor everything in support of it. The scheduler now operates on threads, rather than on processes. Each process has a main thread, and can have any number of additional threads. The process exits when the main thread exits. This patch doesn't actually spawn any additional threads, it merely does all the plumbing needed to make it possible. :^)
2019-03-23 21:03:17 +00:00
{
Kernel: Process::send_signal() should prefer main thread The main/first thread in a process always has the same TID as the PID.
2020-01-06 13:37:08 +00:00
InterruptDisabler disabler;
auto* thread = Thread::from_tid(m_pid);
if (!thread)
thread = &any_thread();
thread->send_signal(signal, sender);
Kernel: Introduce threads, and refactor everything in support of it. The scheduler now operates on threads, rather than on processes. Each process has a main thread, and can have any number of additional threads. The process exits when the main thread exits. This patch doesn't actually spawn any additional threads, it merely does all the plumbing needed to make it possible. :^)
2019-03-23 21:03:17 +00:00
}
Kernel+LibC: Add a simple create_thread() syscall. It takes two parameters, a function pointer for the entry function, and a void* argument to be passed to that function on the new thread.
2019-03-23 21:59:08 +00:00
Kernel: Remove manual STAC/CLAC in create_thread()
2020-01-12 10:51:31 +00:00
int Process::sys$create_thread(void* (*entry)(void*), void* argument, const Syscall::SC_create_thread_params* user_params)
Kernel+LibC: Add a simple create_thread() syscall. It takes two parameters, a function pointer for the entry function, and a void* argument to be passed to that function on the new thread.
2019-03-23 21:59:08 +00:00
{
ping: Use pledge()
2020-01-11 19:48:43 +00:00
REQUIRE_PROMISE(thread);
Kernel+LibC: Add a simple create_thread() syscall. It takes two parameters, a function pointer for the entry function, and a void* argument to be passed to that function on the new thread.
2019-03-23 21:59:08 +00:00
if (!validate_read((const void*)entry, sizeof(void*)))
return -EFAULT;
Kernel+LibPthread: pthread_create handles pthread_attr_t Add an initial implementation of pthread attributes for: * detach state (joinable, detached) * schedule params (just priority) * guard page size (as skeleton) (requires kernel support maybe?) * stack size and user-provided stack location (4 or 8 MB only, must be aligned) Add some tests too, to the thread test program. Also, LibC: Move pthread declarations to sys/types.h, where they belong.
2019-11-18 03:08:10 +00:00
Kernel: Remove manual STAC/CLAC in create_thread()
2020-01-12 10:51:31 +00:00
Syscall::SC_create_thread_params params;
Kernel: Combine validate and copy of user mode pointers (#1069) Right now there is a significant amount of boiler plate code required to validate user mode parameters in syscalls. In an attempt to reduce this a bit, introduce validate_read_and_copy_typed which combines the usermode address check and does the copy internally if the validation passes. This cleans up a little bit of code from a significant amount of syscalls.
2020-01-13 10:19:18 +00:00
if (!validate_read_and_copy_typed(&params, user_params))
return -EFAULT;
Kernel: Remove manual STAC/CLAC in create_thread()
2020-01-12 10:51:31 +00:00
unsigned detach_state = params.m_detach_state;
int schedule_priority = params.m_schedule_priority;
void* stack_location = params.m_stack_location;
unsigned stack_size = params.m_stack_size;
Kernel: Start implementing x86 SMAP support Supervisor Mode Access Prevention (SMAP) is an x86 CPU feature that prevents the kernel from accessing userspace memory. With SMAP enabled, trying to read/write a userspace memory address while in the kernel will now generate a page fault. Since it's sometimes necessary to read/write userspace memory, there are two new instructions that quickly switch the protection on/off: STAC (disables protection) and CLAC (enables protection.) These are exposed in kernel code via the stac() and clac() helpers. There's also a SmapDisabler RAII object that can be used to ensure that you don't forget to re-enable protection before returning to userspace code. THis patch also adds copy_to_user(), copy_from_user() and memset_user() which are the "correct" way of doing things. These functions allow us to briefly disable protection for a specific purpose, and then turn it back on immediately after it's done. Going forward all kernel code should be moved to using these and all uses of SmapDisabler are to be considered FIXME's. Note that we're not realizing the full potential of this feature since I've used SmapDisabler quite liberally in this initial bring-up patch.
2020-01-05 17:00:15 +00:00
Kernel: Fix bad TOCTOU pattern in syscalls that take a parameter struct Our syscall calling convention only allows passing up to 3 arguments in registers. For syscalls that take more arguments, we bake them into a struct and pass a pointer to that struct instead. When doing pointer validation, this is what we would do: 1) Validate the "params" struct 2) Validate "params->some_pointer" 3) ... other stuff ... 4) Use "params->some_pointer" Since the parameter struct is stored in userspace, it can be modified by userspace after validation has completed. This was a recurring pattern in many syscalls that was further hidden by me using structured binding declarations to give convenient local names to things in the parameter struct: auto& [some_pointer, ...] = *params; memcpy(some_pointer, ...); This devilishly makes "some_pointer" look like a local variable but it's actually more like an alias for "params->some_pointer" and will expand to a dereference when accessed! This patch fixes the issues by explicitly copying out each member from the parameter structs before validating them, and then never using the "param" pointers beyond that. Thanks to braindead for finding this bug! :^)
2020-01-05 08:13:00 +00:00
if (!validate_write(stack_location, stack_size))
return -EFAULT;
u32 user_stack_address = reinterpret_cast<u32>(stack_location) + stack_size;
Kernel+LibPthread: pthread_create handles pthread_attr_t Add an initial implementation of pthread attributes for: * detach state (joinable, detached) * schedule params (just priority) * guard page size (as skeleton) (requires kernel support maybe?) * stack size and user-provided stack location (4 or 8 MB only, must be aligned) Add some tests too, to the thread test program. Also, LibC: Move pthread declarations to sys/types.h, where they belong.
2019-11-18 03:08:10 +00:00
if (!MM.validate_user_stack(*this, VirtualAddress(user_stack_address - 4)))
Kernel+LibPthread+LibC: Create secondary thread stacks in userspace Have pthread_create() allocate a stack and passing it to the kernel instead of this work happening in the kernel. The more of this we can do in userspace, the better. This patch also unexposes the raw create_thread() and exit_thread() syscalls since they are now only used by LibPthread anyway.
2019-11-17 16:28:17 +00:00
return -EFAULT;
Kernel+LibPthread: pthread_create handles pthread_attr_t Add an initial implementation of pthread attributes for: * detach state (joinable, detached) * schedule params (just priority) * guard page size (as skeleton) (requires kernel support maybe?) * stack size and user-provided stack location (4 or 8 MB only, must be aligned) Add some tests too, to the thread test program. Also, LibC: Move pthread declarations to sys/types.h, where they belong.
2019-11-18 03:08:10 +00:00
// FIXME: return EAGAIN if Thread::all_threads().size() is greater than PTHREAD_THREADS_MAX
Kernel: Fix bad TOCTOU pattern in syscalls that take a parameter struct Our syscall calling convention only allows passing up to 3 arguments in registers. For syscalls that take more arguments, we bake them into a struct and pass a pointer to that struct instead. When doing pointer validation, this is what we would do: 1) Validate the "params" struct 2) Validate "params->some_pointer" 3) ... other stuff ... 4) Use "params->some_pointer" Since the parameter struct is stored in userspace, it can be modified by userspace after validation has completed. This was a recurring pattern in many syscalls that was further hidden by me using structured binding declarations to give convenient local names to things in the parameter struct: auto& [some_pointer, ...] = *params; memcpy(some_pointer, ...); This devilishly makes "some_pointer" look like a local variable but it's actually more like an alias for "params->some_pointer" and will expand to a dereference when accessed! This patch fixes the issues by explicitly copying out each member from the parameter structs before validating them, and then never using the "param" pointers beyond that. Thanks to braindead for finding this bug! :^)
2020-01-05 08:13:00 +00:00
int requested_thread_priority = schedule_priority;
Kernel: Refactor scheduler to use dynamic thread priorities Threads now have numeric priorities with a base priority in the 1-99 range. Whenever a runnable thread is *not* scheduled, its effective priority is incremented by 1. This is tracked in Thread::m_extra_priority. The effective priority of a thread is m_priority + m_extra_priority. When a runnable thread *is* scheduled, its m_extra_priority is reset to zero and the effective priority returns to base. This means that lower-priority threads will always eventually get scheduled to run, once its effective priority becomes high enough to exceed the base priority of threads "above" it. The previous values for ThreadPriority (Low, Normal and High) are now replaced as follows: Low -> 10 Normal -> 30 High -> 50 In other words, it will take 20 ticks for a "Low" priority thread to get to "Normal" effective priority, and another 20 to reach "High". This is not perfect, and I've used some quite naive data structures, but I think the mechanism will allow us to build various new and interesting optimizations, and we can figure out better data structures later on. :^)
2019-12-30 17:46:17 +00:00
if (requested_thread_priority < THREAD_PRIORITY_MIN || requested_thread_priority > THREAD_PRIORITY_MAX)
Kernel+LibPthread: pthread_create handles pthread_attr_t Add an initial implementation of pthread attributes for: * detach state (joinable, detached) * schedule params (just priority) * guard page size (as skeleton) (requires kernel support maybe?) * stack size and user-provided stack location (4 or 8 MB only, must be aligned) Add some tests too, to the thread test program. Also, LibC: Move pthread declarations to sys/types.h, where they belong.
2019-11-18 03:08:10 +00:00
return -EINVAL;
Kernel: Fix bad TOCTOU pattern in syscalls that take a parameter struct Our syscall calling convention only allows passing up to 3 arguments in registers. For syscalls that take more arguments, we bake them into a struct and pass a pointer to that struct instead. When doing pointer validation, this is what we would do: 1) Validate the "params" struct 2) Validate "params->some_pointer" 3) ... other stuff ... 4) Use "params->some_pointer" Since the parameter struct is stored in userspace, it can be modified by userspace after validation has completed. This was a recurring pattern in many syscalls that was further hidden by me using structured binding declarations to give convenient local names to things in the parameter struct: auto& [some_pointer, ...] = *params; memcpy(some_pointer, ...); This devilishly makes "some_pointer" look like a local variable but it's actually more like an alias for "params->some_pointer" and will expand to a dereference when accessed! This patch fixes the issues by explicitly copying out each member from the parameter structs before validating them, and then never using the "param" pointers beyond that. Thanks to braindead for finding this bug! :^)
2020-01-05 08:13:00 +00:00
bool is_thread_joinable = (0 == detach_state);
Kernel+LibPthread: pthread_create handles pthread_attr_t Add an initial implementation of pthread attributes for: * detach state (joinable, detached) * schedule params (just priority) * guard page size (as skeleton) (requires kernel support maybe?) * stack size and user-provided stack location (4 or 8 MB only, must be aligned) Add some tests too, to the thread test program. Also, LibC: Move pthread declarations to sys/types.h, where they belong.
2019-11-18 03:08:10 +00:00
// FIXME: Do something with guard pages?
Kernel+LibC: Add a simple create_thread() syscall. It takes two parameters, a function pointer for the entry function, and a void* argument to be passed to that function on the new thread.
2019-03-23 21:59:08 +00:00
auto* thread = new Thread(*this);
Kernel+LibPthread: pthread_create handles pthread_attr_t Add an initial implementation of pthread attributes for: * detach state (joinable, detached) * schedule params (just priority) * guard page size (as skeleton) (requires kernel support maybe?) * stack size and user-provided stack location (4 or 8 MB only, must be aligned) Add some tests too, to the thread test program. Also, LibC: Move pthread declarations to sys/types.h, where they belong.
2019-11-18 03:08:10 +00:00
Kernel: Allow setting thread names The main thread of each kernel/user process will take the name of the process. Extra threads will get a fancy new name "ProcessName[<tid>]". Thread backtraces now list the thread name in addtion to tid. Add the thread name to /proc/all (should it get its own proc file?). Add two new syscalls, set_thread_name and get_thread_name.
2019-12-07 19:45:26 +00:00
// We know this thread is not the main_thread,
// So give it a unique name until the user calls $set_thread_name on it
// length + 4 to give space for our extra junk at the end
StringBuilder builder(m_name.length() + 4);
builder.append(m_name);
builder.appendf("[%d]", thread->tid());
thread->set_name(builder.to_string());
Kernel+LibPthread: pthread_create handles pthread_attr_t Add an initial implementation of pthread attributes for: * detach state (joinable, detached) * schedule params (just priority) * guard page size (as skeleton) (requires kernel support maybe?) * stack size and user-provided stack location (4 or 8 MB only, must be aligned) Add some tests too, to the thread test program. Also, LibC: Move pthread declarations to sys/types.h, where they belong.
2019-11-18 03:08:10 +00:00
thread->set_priority(requested_thread_priority);
thread->set_joinable(is_thread_joinable);
Kernel+LibC: Add a simple create_thread() syscall. It takes two parameters, a function pointer for the entry function, and a void* argument to be passed to that function on the new thread.
2019-03-23 21:59:08 +00:00
auto& tss = thread->tss();
Use uintptr_t instead of u32 when storing pointers as integers uintptr_t is 32-bit or 64-bit depending on the target platform. This will help us write pointer size agnostic code so that when the day comes that we want to do a 64-bit port, we'll be in better shape.
2020-01-20 12:06:14 +00:00
tss.eip = (uintptr_t)entry;
Kernel+LibC: Add a simple create_thread() syscall. It takes two parameters, a function pointer for the entry function, and a void* argument to be passed to that function on the new thread.
2019-03-23 21:59:08 +00:00
tss.eflags = 0x0202;
tss.cr3 = page_directory().cr3();
Kernel+LibPthread: pthread_create handles pthread_attr_t Add an initial implementation of pthread attributes for: * detach state (joinable, detached) * schedule params (just priority) * guard page size (as skeleton) (requires kernel support maybe?) * stack size and user-provided stack location (4 or 8 MB only, must be aligned) Add some tests too, to the thread test program. Also, LibC: Move pthread declarations to sys/types.h, where they belong.
2019-11-18 03:08:10 +00:00
tss.esp = user_stack_address;
Kernel+LibPthread+LibC: Create secondary thread stacks in userspace Have pthread_create() allocate a stack and passing it to the kernel instead of this work happening in the kernel. The more of this we can do in userspace, the better. This patch also unexposes the raw create_thread() and exit_thread() syscalls since they are now only used by LibPthread anyway.
2019-11-17 16:28:17 +00:00
// NOTE: The stack needs to be 16-byte aligned.
Use uintptr_t instead of u32 when storing pointers as integers uintptr_t is 32-bit or 64-bit depending on the target platform. This will help us write pointer size agnostic code so that when the day comes that we want to do a 64-bit port, we'll be in better shape.
2020-01-20 12:06:14 +00:00
thread->push_value_on_stack((uintptr_t)argument);
Kernel+LibPthread+LibC: Create secondary thread stacks in userspace Have pthread_create() allocate a stack and passing it to the kernel instead of this work happening in the kernel. The more of this we can do in userspace, the better. This patch also unexposes the raw create_thread() and exit_thread() syscalls since they are now only used by LibPthread anyway.
2019-11-17 16:28:17 +00:00
thread->push_value_on_stack(0);
Kernel: Support thread-local storage This patch adds support for TLS according to the x86 System V ABI. Each thread gets a thread-specific memory region, and the GS segment register always points _to a pointer_ to the thread-specific memory. In other words, to access thread-local variables, userspace programs start by dereferencing the pointer at [gs:0]. The Process keeps a master copy of the TLS segment that new threads should use, and when a new thread is created, they get a copy of it. It's basically whatever the PT_TLS program header in the ELF says.
2019-09-07 13:50:44 +00:00
thread->make_thread_specific_region({});
Kernel+LibC: Add a simple create_thread() syscall. It takes two parameters, a function pointer for the entry function, and a void* argument to be passed to that function on the new thread.
2019-03-23 21:59:08 +00:00
thread->set_state(Thread::State::Runnable);
Kernel: Make the create_thread() syscall return the new thread ID.
2019-07-14 08:17:58 +00:00
return thread->tid();
Kernel+LibC: Add a simple create_thread() syscall. It takes two parameters, a function pointer for the entry function, and a void* argument to be passed to that function on the new thread.
2019-03-23 21:59:08 +00:00
}
LibGUI+Kernel: Add a GLock class (userspace mutex.) It's basically a userspace port of the kernel's Lock class. Added gettid() and donate() syscalls to support the timeslice donation feature we already enjoyed in the kernel.
2019-03-25 12:03:49 +00:00
Kernel+LibPthread: Implement pthread_join() It's now possible to block until another thread in the same process has exited. We can also retrieve its exit value, which is whatever value it passed to pthread_exit(). :^)
2019-11-14 19:58:23 +00:00
void Process::sys$exit_thread(void* exit_value)
Kernel+LibC: Add exit_thread() syscall.
2019-04-29 13:17:20 +00:00
{
ping: Use pledge()
2020-01-11 19:48:43 +00:00
REQUIRE_PROMISE(thread);
Kernel: The exit_thread() syscall should unlock the big lock. Since exit_thread() never returns, it can't rely on the syscall trap handler to unlock the big lock before returning.
2019-04-29 13:56:25 +00:00
cli();
Kernel: Get rid of "main thread" concept The idea of all processes reliably having a main thread was nice in some ways, but cumbersome in others. More importantly, it didn't match up with POSIX thread semantics, so let's move away from it. This thread gets rid of Process::main_thread() and you now we just have a bunch of Thread objects floating around each Process. When the finalizer nukes the last Thread in a Process, it will also tear down the Process. There's a bunch of more things to fix around this, but this is where we get started :^)
2019-12-22 10:35:02 +00:00
current->m_exit_value = exit_value;
Kernel: Unwind kernel stacks before dying While executing in the kernel, a thread can acquire various resources that need cleanup, such as locks and references to RefCounted objects. This cleanup normally happens on the exit path, such as in destructors for various RAII guards. But we weren't calling those exit paths when killing threads that have been executing in the kernel, such as threads blocked on reading or sleeping, thus causing leaks. This commit changes how killing threads works. Now, instead of killing a thread directly, one is supposed to call thread->set_should_die(), which will unblock it and make it unwind the stack if it is blocked in the kernel. Then, just before returning to the userspace, the thread will automatically die.
2019-11-14 15:46:01 +00:00
current->set_should_die();
Kernel: Allow unlocking a held Lock with interrupts disabled This is needed to eliminate a race in Thread::wait_on() where we'd otherwise have to wait until after unlocking the process lock before we can disable interrupts.
2020-01-12 21:53:20 +00:00
big_lock().force_unlock_if_locked();
Kernel: Unwind kernel stacks before dying While executing in the kernel, a thread can acquire various resources that need cleanup, such as locks and references to RefCounted objects. This cleanup normally happens on the exit path, such as in destructors for various RAII guards. But we weren't calling those exit paths when killing threads that have been executing in the kernel, such as threads blocked on reading or sleeping, thus causing leaks. This commit changes how killing threads works. Now, instead of killing a thread directly, one is supposed to call thread->set_should_die(), which will unblock it and make it unwind the stack if it is blocked in the kernel. Then, just before returning to the userspace, the thread will automatically die.
2019-11-14 15:46:01 +00:00
current->die_if_needed();
Kernel+LibC: Add exit_thread() syscall.
2019-04-29 13:17:20 +00:00
ASSERT_NOT_REACHED();
}
Kernel+LibPthread: Implement pthread_detach()
2019-12-07 13:47:00 +00:00
int Process::sys$detach_thread(int tid)
{
ping: Use pledge()
2020-01-11 19:48:43 +00:00
REQUIRE_PROMISE(thread);
Kernel: Disable interrupts while looking into the thread table There was a race window in a bunch of syscalls between calling Thread::from_tid() and checking if the found thread was in the same process as the calling thread. If the found thread object was destroyed at that point, there was a use-after-free that could be exploited by filling the kernel heap with something that looked like a thread object.
2020-01-27 12:48:54 +00:00
InterruptDisabler disabler;
Kernel: Use Thread::from_tid() in more places
2020-01-04 17:56:04 +00:00
auto* thread = Thread::from_tid(tid);
if (!thread || thread->pid() != pid())
Kernel+LibPthread: Implement pthread_detach()
2019-12-07 13:47:00 +00:00
return -ESRCH;
if (!thread->is_joinable())
return -EINVAL;
thread->set_joinable(false);
return 0;
}
Kernel+LibPthread: Implement pthread_join() It's now possible to block until another thread in the same process has exited. We can also retrieve its exit value, which is whatever value it passed to pthread_exit(). :^)
2019-11-14 19:58:23 +00:00
int Process::sys$join_thread(int tid, void** exit_value)
{
ping: Use pledge()
2020-01-11 19:48:43 +00:00
REQUIRE_PROMISE(thread);
Kernel+LibPthread: Implement pthread_join() It's now possible to block until another thread in the same process has exited. We can also retrieve its exit value, which is whatever value it passed to pthread_exit(). :^)
2019-11-14 19:58:23 +00:00
if (exit_value && !validate_write_typed(exit_value))
return -EFAULT;
Kernel: Disable interrupts while looking into the thread table There was a race window in a bunch of syscalls between calling Thread::from_tid() and checking if the found thread was in the same process as the calling thread. If the found thread object was destroyed at that point, there was a use-after-free that could be exploited by filling the kernel heap with something that looked like a thread object.
2020-01-27 12:48:54 +00:00
InterruptDisabler disabler;
Kernel: Use Thread::from_tid() in more places
2020-01-04 17:56:04 +00:00
auto* thread = Thread::from_tid(tid);
if (!thread || thread->pid() != pid())
Kernel+LibPthread: Implement pthread_join() It's now possible to block until another thread in the same process has exited. We can also retrieve its exit value, which is whatever value it passed to pthread_exit(). :^)
2019-11-14 19:58:23 +00:00
return -ESRCH;
if (thread == current)
return -EDEADLK;
if (thread->m_joinee == current)
return -EDEADLK;
ASSERT(thread->m_joiner != current);
if (thread->m_joiner)
return -EINVAL;
Kernel+LibPthread: pthread_create handles pthread_attr_t Add an initial implementation of pthread attributes for: * detach state (joinable, detached) * schedule params (just priority) * guard page size (as skeleton) (requires kernel support maybe?) * stack size and user-provided stack location (4 or 8 MB only, must be aligned) Add some tests too, to the thread test program. Also, LibC: Move pthread declarations to sys/types.h, where they belong.
2019-11-18 03:08:10 +00:00
if (!thread->is_joinable())
return -EINVAL;
Kernel+LibPthread: Implement pthread_join() It's now possible to block until another thread in the same process has exited. We can also retrieve its exit value, which is whatever value it passed to pthread_exit(). :^)
2019-11-14 19:58:23 +00:00
Kernel: Move Thread::m_joinee_exit_value into the JoinBlocker There's no need for this to be a permanent Thread member. Just use a reference in the JoinBlocker instead.
2019-11-14 20:04:34 +00:00
void* joinee_exit_value = nullptr;
Kernel: Fix kernel null deref on process crash during join_thread() The join_thread() syscall is not supposed to be interruptible by signals, but it was. And since the process death mechanism piggybacked on signal interrupts, it was possible to interrupt a pthread_join() by killing the process that was doing it, leading to confusing due to some assumptions being made by Thread::finalize() for threads that have a pending joiner. This patch fixes the issue by making "interrupted by death" a distinct block result separate from "interrupted by signal". Then we handle that state in join_thread() and tidy things up so that thread finalization doesn't get confused by the pending joiner being gone. Test: Tests/Kernel/null-deref-crash-during-pthread_join.cpp
2020-01-10 18:15:01 +00:00
// NOTE: pthread_join() cannot be interrupted by signals. Only by death.
for (;;) {
auto result = current->block<Thread::JoinBlocker>(*thread, joinee_exit_value);
if (result == Thread::BlockResult::InterruptedByDeath) {
// NOTE: This cleans things up so that Thread::finalize() won't
// get confused about a missing joiner when finalizing the joinee.
InterruptDisabler disabler;
current->m_joinee->m_joiner = nullptr;
current->m_joinee = nullptr;
return 0;
}
}
Kernel+LibPthread: Implement pthread_join() It's now possible to block until another thread in the same process has exited. We can also retrieve its exit value, which is whatever value it passed to pthread_exit(). :^)
2019-11-14 19:58:23 +00:00
// NOTE: 'thread' is very possibly deleted at this point. Clear it just to be safe.
thread = nullptr;
if (exit_value)
Kernel: Use the templated copy_to/from_user() in more places These ensure that the "to" and "from" pointers have the same type, and also that we copy the correct number of bytes.
2020-01-20 12:38:31 +00:00
copy_to_user(exit_value, &joinee_exit_value);
Kernel+LibPthread: Implement pthread_join() It's now possible to block until another thread in the same process has exited. We can also retrieve its exit value, which is whatever value it passed to pthread_exit(). :^)
2019-11-14 19:58:23 +00:00
return 0;
}
Kernel: Use the Syscall string and buffer types more While I was updating syscalls to stop passing null-terminated strings, I added some helpful struct types: - StringArgument { const char*; size_t; } - ImmutableBuffer<Data, Size> { const Data*; Size; } - MutableBuffer<Data, Size> { Data*; Size; } The Process class has some convenience functions for validating and optionally extracting the contents from these structs: - get_syscall_path_argument(StringArgument) - validate_and_copy_string_from_user(StringArgument) - validate(ImmutableBuffer) - validate(MutableBuffer) There's still so much code around this and I'm wondering if we should generate most of it instead. Possible nice little project.
2020-01-11 11:47:47 +00:00
int Process::sys$set_thread_name(int tid, const char* user_name, size_t user_name_length)
Kernel: Allow setting thread names The main thread of each kernel/user process will take the name of the process. Extra threads will get a fancy new name "ProcessName[<tid>]". Thread backtraces now list the thread name in addtion to tid. Add the thread name to /proc/all (should it get its own proc file?). Add two new syscalls, set_thread_name and get_thread_name.
2019-12-07 19:45:26 +00:00
{
ping: Use pledge()
2020-01-11 19:48:43 +00:00
REQUIRE_PROMISE(thread);
Kernel: Use the Syscall string and buffer types more While I was updating syscalls to stop passing null-terminated strings, I added some helpful struct types: - StringArgument { const char*; size_t; } - ImmutableBuffer<Data, Size> { const Data*; Size; } - MutableBuffer<Data, Size> { Data*; Size; } The Process class has some convenience functions for validating and optionally extracting the contents from these structs: - get_syscall_path_argument(StringArgument) - validate_and_copy_string_from_user(StringArgument) - validate(ImmutableBuffer) - validate(MutableBuffer) There's still so much code around this and I'm wondering if we should generate most of it instead. Possible nice little project.
2020-01-11 11:47:47 +00:00
auto name = validate_and_copy_string_from_user(user_name, user_name_length);
if (name.is_null())
Kernel: Allow setting thread names The main thread of each kernel/user process will take the name of the process. Extra threads will get a fancy new name "ProcessName[<tid>]". Thread backtraces now list the thread name in addtion to tid. Add the thread name to /proc/all (should it get its own proc file?). Add two new syscalls, set_thread_name and get_thread_name.
2019-12-07 19:45:26 +00:00
return -EFAULT;
const size_t max_thread_name_size = 64;
Kernel: Remove SmapDisablers in open(), openat() and set_thread_name() This patch introduces a helpful copy_string_from_user() function that takes a bounded null-terminated string from userspace memory and copies it into a String object.
2020-01-05 20:51:06 +00:00
if (name.length() > max_thread_name_size)
Kernel: Allow setting thread names The main thread of each kernel/user process will take the name of the process. Extra threads will get a fancy new name "ProcessName[<tid>]". Thread backtraces now list the thread name in addtion to tid. Add the thread name to /proc/all (should it get its own proc file?). Add two new syscalls, set_thread_name and get_thread_name.
2019-12-07 19:45:26 +00:00
return -EINVAL;
Kernel: Disable interrupts while looking into the thread table There was a race window in a bunch of syscalls between calling Thread::from_tid() and checking if the found thread was in the same process as the calling thread. If the found thread object was destroyed at that point, there was a use-after-free that could be exploited by filling the kernel heap with something that looked like a thread object.
2020-01-27 12:48:54 +00:00
InterruptDisabler disabler;
Kernel: Use Thread::from_tid() in more places
2020-01-04 17:56:04 +00:00
auto* thread = Thread::from_tid(tid);
if (!thread || thread->pid() != pid())
Kernel: Allow setting thread names The main thread of each kernel/user process will take the name of the process. Extra threads will get a fancy new name "ProcessName[<tid>]". Thread backtraces now list the thread name in addtion to tid. Add the thread name to /proc/all (should it get its own proc file?). Add two new syscalls, set_thread_name and get_thread_name.
2019-12-07 19:45:26 +00:00
return -ESRCH;
Kernel: Remove SmapDisablers in open(), openat() and set_thread_name() This patch introduces a helpful copy_string_from_user() function that takes a bounded null-terminated string from userspace memory and copies it into a String object.
2020-01-05 20:51:06 +00:00
thread->set_name(name);
Kernel: Allow setting thread names The main thread of each kernel/user process will take the name of the process. Extra threads will get a fancy new name "ProcessName[<tid>]". Thread backtraces now list the thread name in addtion to tid. Add the thread name to /proc/all (should it get its own proc file?). Add two new syscalls, set_thread_name and get_thread_name.
2019-12-07 19:45:26 +00:00
return 0;
}
Kernel: Use the Syscall string and buffer types more While I was updating syscalls to stop passing null-terminated strings, I added some helpful struct types: - StringArgument { const char*; size_t; } - ImmutableBuffer<Data, Size> { const Data*; Size; } - MutableBuffer<Data, Size> { Data*; Size; } The Process class has some convenience functions for validating and optionally extracting the contents from these structs: - get_syscall_path_argument(StringArgument) - validate_and_copy_string_from_user(StringArgument) - validate(ImmutableBuffer) - validate(MutableBuffer) There's still so much code around this and I'm wondering if we should generate most of it instead. Possible nice little project.
2020-01-11 11:47:47 +00:00
int Process::sys$get_thread_name(int tid, char* buffer, size_t buffer_size)
Kernel: Allow setting thread names The main thread of each kernel/user process will take the name of the process. Extra threads will get a fancy new name "ProcessName[<tid>]". Thread backtraces now list the thread name in addtion to tid. Add the thread name to /proc/all (should it get its own proc file?). Add two new syscalls, set_thread_name and get_thread_name.
2019-12-07 19:45:26 +00:00
{
ping: Use pledge()
2020-01-11 19:48:43 +00:00
REQUIRE_PROMISE(thread);
Kernel: Use the Syscall string and buffer types more While I was updating syscalls to stop passing null-terminated strings, I added some helpful struct types: - StringArgument { const char*; size_t; } - ImmutableBuffer<Data, Size> { const Data*; Size; } - MutableBuffer<Data, Size> { Data*; Size; } The Process class has some convenience functions for validating and optionally extracting the contents from these structs: - get_syscall_path_argument(StringArgument) - validate_and_copy_string_from_user(StringArgument) - validate(ImmutableBuffer) - validate(MutableBuffer) There's still so much code around this and I'm wondering if we should generate most of it instead. Possible nice little project.
2020-01-11 11:47:47 +00:00
if (buffer_size == 0)
Kernel: Allow setting thread names The main thread of each kernel/user process will take the name of the process. Extra threads will get a fancy new name "ProcessName[<tid>]". Thread backtraces now list the thread name in addtion to tid. Add the thread name to /proc/all (should it get its own proc file?). Add two new syscalls, set_thread_name and get_thread_name.
2019-12-07 19:45:26 +00:00
return -EINVAL;
if (!validate_write(buffer, buffer_size))
return -EFAULT;
Kernel: Disable interrupts while looking into the thread table There was a race window in a bunch of syscalls between calling Thread::from_tid() and checking if the found thread was in the same process as the calling thread. If the found thread object was destroyed at that point, there was a use-after-free that could be exploited by filling the kernel heap with something that looked like a thread object.
2020-01-27 12:48:54 +00:00
InterruptDisabler disabler;
Kernel: Use Thread::from_tid() in more places
2020-01-04 17:56:04 +00:00
auto* thread = Thread::from_tid(tid);
if (!thread || thread->pid() != pid())
Kernel: Allow setting thread names The main thread of each kernel/user process will take the name of the process. Extra threads will get a fancy new name "ProcessName[<tid>]". Thread backtraces now list the thread name in addtion to tid. Add the thread name to /proc/all (should it get its own proc file?). Add two new syscalls, set_thread_name and get_thread_name.
2019-12-07 19:45:26 +00:00
return -ESRCH;
Kernel: Start implementing x86 SMAP support Supervisor Mode Access Prevention (SMAP) is an x86 CPU feature that prevents the kernel from accessing userspace memory. With SMAP enabled, trying to read/write a userspace memory address while in the kernel will now generate a page fault. Since it's sometimes necessary to read/write userspace memory, there are two new instructions that quickly switch the protection on/off: STAC (disables protection) and CLAC (enables protection.) These are exposed in kernel code via the stac() and clac() helpers. There's also a SmapDisabler RAII object that can be used to ensure that you don't forget to re-enable protection before returning to userspace code. THis patch also adds copy_to_user(), copy_from_user() and memset_user() which are the "correct" way of doing things. These functions allow us to briefly disable protection for a specific purpose, and then turn it back on immediately after it's done. Going forward all kernel code should be moved to using these and all uses of SmapDisabler are to be considered FIXME's. Note that we're not realizing the full potential of this feature since I've used SmapDisabler quite liberally in this initial bring-up patch.
2020-01-05 17:00:15 +00:00
if (thread->name().length() + 1 > (size_t)buffer_size)
Kernel: Allow setting thread names The main thread of each kernel/user process will take the name of the process. Extra threads will get a fancy new name "ProcessName[<tid>]". Thread backtraces now list the thread name in addtion to tid. Add the thread name to /proc/all (should it get its own proc file?). Add two new syscalls, set_thread_name and get_thread_name.
2019-12-07 19:45:26 +00:00
return -ENAMETOOLONG;
Kernel: Start implementing x86 SMAP support Supervisor Mode Access Prevention (SMAP) is an x86 CPU feature that prevents the kernel from accessing userspace memory. With SMAP enabled, trying to read/write a userspace memory address while in the kernel will now generate a page fault. Since it's sometimes necessary to read/write userspace memory, there are two new instructions that quickly switch the protection on/off: STAC (disables protection) and CLAC (enables protection.) These are exposed in kernel code via the stac() and clac() helpers. There's also a SmapDisabler RAII object that can be used to ensure that you don't forget to re-enable protection before returning to userspace code. THis patch also adds copy_to_user(), copy_from_user() and memset_user() which are the "correct" way of doing things. These functions allow us to briefly disable protection for a specific purpose, and then turn it back on immediately after it's done. Going forward all kernel code should be moved to using these and all uses of SmapDisabler are to be considered FIXME's. Note that we're not realizing the full potential of this feature since I've used SmapDisabler quite liberally in this initial bring-up patch.
2020-01-05 17:00:15 +00:00
copy_to_user(buffer, thread->name().characters(), thread->name().length() + 1);
Kernel: Allow setting thread names The main thread of each kernel/user process will take the name of the process. Extra threads will get a fancy new name "ProcessName[<tid>]". Thread backtraces now list the thread name in addtion to tid. Add the thread name to /proc/all (should it get its own proc file?). Add two new syscalls, set_thread_name and get_thread_name.
2019-12-07 19:45:26 +00:00
return 0;
}
LibGUI+Kernel: Add a GLock class (userspace mutex.) It's basically a userspace port of the kernel's Lock class. Added gettid() and donate() syscalls to support the timeslice donation feature we already enjoyed in the kernel.
2019-03-25 12:03:49 +00:00
int Process::sys$gettid()
{
ping: Use pledge()
2020-01-11 19:48:43 +00:00
REQUIRE_PROMISE(stdio);
LibGUI+Kernel: Add a GLock class (userspace mutex.) It's basically a userspace port of the kernel's Lock class. Added gettid() and donate() syscalls to support the timeslice donation feature we already enjoyed in the kernel.
2019-03-25 12:03:49 +00:00
return current->tid();
}
int Process::sys$donate(int tid)
{
ping: Use pledge()
2020-01-11 19:48:43 +00:00
REQUIRE_PROMISE(stdio);
LibGUI+Kernel: Add a GLock class (userspace mutex.) It's basically a userspace port of the kernel's Lock class. Added gettid() and donate() syscalls to support the timeslice donation feature we already enjoyed in the kernel.
2019-03-25 12:03:49 +00:00
if (tid < 0)
return -EINVAL;
InterruptDisabler disabler;
Kernel: Use Thread::from_tid() in more places
2020-01-04 17:56:04 +00:00
auto* thread = Thread::from_tid(tid);
if (!thread || thread->pid() != pid())
return -ESRCH;
Scheduler::donate_to(thread, "sys$donate");
LibGUI+Kernel: Add a GLock class (userspace mutex.) It's basically a userspace port of the kernel's Lock class. Added gettid() and donate() syscalls to support the timeslice donation feature we already enjoyed in the kernel.
2019-03-25 12:03:49 +00:00
return 0;
}
Kernel+Userland: Add the rename() syscall along with a basic /bin/mv.
2019-04-07 21:35:26 +00:00
Kernel: Pass a parameter struct to rename()
2020-01-11 09:36:54 +00:00
int Process::sys$rename(const Syscall::SC_rename_params* user_params)
Kernel+Userland: Add the rename() syscall along with a basic /bin/mv.
2019-04-07 21:35:26 +00:00
{
ping: Use pledge()
2020-01-11 19:48:43 +00:00
REQUIRE_PROMISE(cpath);
Kernel: Pass a parameter struct to rename()
2020-01-11 09:36:54 +00:00
Syscall::SC_rename_params params;
Kernel: Combine validate and copy of user mode pointers (#1069) Right now there is a significant amount of boiler plate code required to validate user mode parameters in syscalls. In an attempt to reduce this a bit, introduce validate_read_and_copy_typed which combines the usermode address check and does the copy internally if the validation passes. This cleans up a little bit of code from a significant amount of syscalls.
2020-01-13 10:19:18 +00:00
if (!validate_read_and_copy_typed(&params, user_params))
return -EFAULT;
Kernel: Use the Syscall string and buffer types more While I was updating syscalls to stop passing null-terminated strings, I added some helpful struct types: - StringArgument { const char*; size_t; } - ImmutableBuffer<Data, Size> { const Data*; Size; } - MutableBuffer<Data, Size> { Data*; Size; } The Process class has some convenience functions for validating and optionally extracting the contents from these structs: - get_syscall_path_argument(StringArgument) - validate_and_copy_string_from_user(StringArgument) - validate(ImmutableBuffer) - validate(MutableBuffer) There's still so much code around this and I'm wondering if we should generate most of it instead. Possible nice little project.
2020-01-11 11:47:47 +00:00
auto old_path = get_syscall_path_argument(params.old_path);
Kernel: Pass a parameter struct to rename()
2020-01-11 09:36:54 +00:00
if (old_path.is_error())
return old_path.error();
Kernel: Use the Syscall string and buffer types more While I was updating syscalls to stop passing null-terminated strings, I added some helpful struct types: - StringArgument { const char*; size_t; } - ImmutableBuffer<Data, Size> { const Data*; Size; } - MutableBuffer<Data, Size> { Data*; Size; } The Process class has some convenience functions for validating and optionally extracting the contents from these structs: - get_syscall_path_argument(StringArgument) - validate_and_copy_string_from_user(StringArgument) - validate(ImmutableBuffer) - validate(MutableBuffer) There's still so much code around this and I'm wondering if we should generate most of it instead. Possible nice little project.
2020-01-11 11:47:47 +00:00
auto new_path = get_syscall_path_argument(params.new_path);
Kernel: Pass a parameter struct to rename()
2020-01-11 09:36:54 +00:00
if (new_path.is_error())
return new_path.error();
return VFS::the().rename(old_path.value(), new_path.value(), current_directory());
Kernel+Userland: Add the rename() syscall along with a basic /bin/mv.
2019-04-07 21:35:26 +00:00
}
Kernel+LibC: Add stubs for POSIX shared memory API. Specifically shm_open() and shm_unlink(). This patch just adds stubs.
2019-04-08 21:44:12 +00:00
Kernel: More work towards POSIX SHM, also add ftruncate().
2019-04-08 23:10:00 +00:00
int Process::sys$ftruncate(int fd, off_t length)
{
ping: Use pledge()
2020-01-11 19:48:43 +00:00
REQUIRE_PROMISE(stdio);
Kernel: Validate ftruncate(fd, length) syscall inputs - EINVAL if 'length' is negative - EBADF if 'fd' is not open for writing
2020-01-07 13:42:56 +00:00
if (length < 0)
return -EINVAL;
Kernel: Make Process::file_description() vend a RefPtr<FileDescription> This encourages callers to strongly reference file descriptions while working with them. This fixes a use-after-free issue where one thread would close() an open fd while another thread was blocked on it becoming readable. Test: Kernel/uaf-close-while-blocked-in-read.cpp
2020-01-07 14:53:42 +00:00
auto description = file_description(fd);
Kernel: Rename "descriptor" to "description" where appropriate. Now that FileDescription is called that, variables of that type should not be called "descriptor". This is kinda wordy but we'll get used to it.
2019-06-13 20:03:04 +00:00
if (!description)
Kernel: More work towards POSIX SHM, also add ftruncate().
2019-04-08 23:10:00 +00:00
return -EBADF;
Kernel: Validate ftruncate(fd, length) syscall inputs - EINVAL if 'length' is negative - EBADF if 'fd' is not open for writing
2020-01-07 13:42:56 +00:00
if (!description->is_writable())
return -EBADF;
Kernel: Make File::truncate() take a u64 No point in taking a signed type here. We validate at the syscall layer and then pass around a u64 from then on.
2020-02-08 11:07:04 +00:00
return description->truncate(static_cast<u64>(length));
Kernel: More work towards POSIX SHM, also add ftruncate().
2019-04-08 23:10:00 +00:00
}
Kernel: Add a systrace() syscall and implement /bin/strace using it. Calling systrace(pid) gives you a file descriptor with a stream of the syscalls made by a peer process. The process must be owned by the same UID who calls systrace(). :^)
2019-04-22 16:44:45 +00:00
Kernel: Make watch_file() syscall take path length as a size_t We don't care to handle negative path lengths anyway.
2020-01-06 10:12:29 +00:00
int Process::sys$watch_file(const char* user_path, size_t path_length)
Kernel: Add a mechanism for listening for changes to an inode. The syscall is quite simple: int watch_file(const char* path, int path_length); It returns a file descriptor referring to a "InodeWatcher" object in the kernel. It becomes readable whenever something changes about the inode. Currently this is implemented by hooking the "metadata dirty bit" in Inode which isn't perfect, but it's a start. :^)
2019-07-22 18:01:11 +00:00
{
ping: Use pledge()
2020-01-11 19:48:43 +00:00
REQUIRE_PROMISE(rpath);
Kernel: Use get_syscall_path_argument() for syscalls that take paths
2020-01-06 10:10:38 +00:00
auto path = get_syscall_path_argument(user_path, path_length);
if (path.is_error())
return path.error();
Kernel: Start implementing x86 SMAP support Supervisor Mode Access Prevention (SMAP) is an x86 CPU feature that prevents the kernel from accessing userspace memory. With SMAP enabled, trying to read/write a userspace memory address while in the kernel will now generate a page fault. Since it's sometimes necessary to read/write userspace memory, there are two new instructions that quickly switch the protection on/off: STAC (disables protection) and CLAC (enables protection.) These are exposed in kernel code via the stac() and clac() helpers. There's also a SmapDisabler RAII object that can be used to ensure that you don't forget to re-enable protection before returning to userspace code. THis patch also adds copy_to_user(), copy_from_user() and memset_user() which are the "correct" way of doing things. These functions allow us to briefly disable protection for a specific purpose, and then turn it back on immediately after it's done. Going forward all kernel code should be moved to using these and all uses of SmapDisabler are to be considered FIXME's. Note that we're not realizing the full potential of this feature since I've used SmapDisabler quite liberally in this initial bring-up patch.
2020-01-05 17:00:15 +00:00
Kernel: Use get_syscall_path_argument() for syscalls that take paths
2020-01-06 10:10:38 +00:00
auto custody_or_error = VFS::the().resolve_path(path.value(), current_directory());
Kernel: Add a mechanism for listening for changes to an inode. The syscall is quite simple: int watch_file(const char* path, int path_length); It returns a file descriptor referring to a "InodeWatcher" object in the kernel. It becomes readable whenever something changes about the inode. Currently this is implemented by hooking the "metadata dirty bit" in Inode which isn't perfect, but it's a start. :^)
2019-07-22 18:01:11 +00:00
if (custody_or_error.is_error())
return custody_or_error.error();
auto& custody = custody_or_error.value();
auto& inode = custody->inode();
Kernel+FileManager: Disallow watch_file() in unsupported file systems Currently only Ext2FS and TmpFS supports InodeWatchers. We now fail with ENOTSUPP if watch_file() is called on e.g ProcFS. This fixes an issue with FileManager chewing up all the CPU when /proc was opened. Watchers don't keep the watched Inode open, and when they close, the watcher FD will EOF. Since nothing else kept /proc open in FileManager, the watchers created for it would EOF immediately, causing a refresh over and over. Fixes #879.
2019-12-15 18:33:39 +00:00
if (!inode.fs().supports_watchers())
return -ENOTSUP;
Kernel: Add a mechanism for listening for changes to an inode. The syscall is quite simple: int watch_file(const char* path, int path_length); It returns a file descriptor referring to a "InodeWatcher" object in the kernel. It becomes readable whenever something changes about the inode. Currently this is implemented by hooking the "metadata dirty bit" in Inode which isn't perfect, but it's a start. :^)
2019-07-22 18:01:11 +00:00
int fd = alloc_fd();
if (fd < 0)
return fd;
m_fds[fd].set(FileDescription::create(*InodeWatcher::create(inode)));
Kernel: read() and write() should fail with EBADF for wrong mode fd's It was previously possible to write to read-only file descriptors, and read from write-only file descriptors. All FileDescription objects now start out non-readable + non-writable, and whoever is creating them has to "manually" enable reading/writing by calling set_readable() and/or set_writable() on them.
2020-01-03 02:29:59 +00:00
m_fds[fd].description->set_readable(true);
Kernel: Add a mechanism for listening for changes to an inode. The syscall is quite simple: int watch_file(const char* path, int path_length); It returns a file descriptor referring to a "InodeWatcher" object in the kernel. It becomes readable whenever something changes about the inode. Currently this is implemented by hooking the "metadata dirty bit" in Inode which isn't perfect, but it's a start. :^)
2019-07-22 18:01:11 +00:00
return fd;
}
Kernel: Add a systrace() syscall and implement /bin/strace using it. Calling systrace(pid) gives you a file descriptor with a stream of the syscalls made by a peer process. The process must be owned by the same UID who calls systrace(). :^)
2019-04-22 16:44:45 +00:00
int Process::sys$systrace(pid_t pid)
{
ping: Use pledge()
2020-01-11 19:48:43 +00:00
REQUIRE_PROMISE(proc);
Kernel: Add a systrace() syscall and implement /bin/strace using it. Calling systrace(pid) gives you a file descriptor with a stream of the syscalls made by a peer process. The process must be owned by the same UID who calls systrace(). :^)
2019-04-22 16:44:45 +00:00
InterruptDisabler disabler;
auto* peer = Process::from_pid(pid);
if (!peer)
return -ESRCH;
if (peer->uid() != m_euid)
return -EACCES;
int fd = alloc_fd();
if (fd < 0)
return fd;
Kernel: Rename "descriptor" to "description" where appropriate. Now that FileDescription is called that, variables of that type should not be called "descriptor". This is kinda wordy but we'll get used to it.
2019-06-13 20:03:04 +00:00
auto description = FileDescription::create(peer->ensure_tracer());
Kernel: read() and write() should fail with EBADF for wrong mode fd's It was previously possible to write to read-only file descriptors, and read from write-only file descriptors. All FileDescription objects now start out non-readable + non-writable, and whoever is creating them has to "manually" enable reading/writing by calling set_readable() and/or set_writable() on them.
2020-01-03 02:29:59 +00:00
description->set_readable(true);
Kernel: Rename "descriptor" to "description" where appropriate. Now that FileDescription is called that, variables of that type should not be called "descriptor". This is kinda wordy but we'll get used to it.
2019-06-13 20:03:04 +00:00
m_fds[fd].set(move(description), 0);
Kernel: Add a systrace() syscall and implement /bin/strace using it. Calling systrace(pid) gives you a file descriptor with a stream of the syscalls made by a peer process. The process must be owned by the same UID who calls systrace(). :^)
2019-04-22 16:44:45 +00:00
return fd;
}
Kernel: Only allow superuser to halt() the system (#342) Following the discussion in #334, shutdown must also have root-only run permissions.
2019-07-19 11:08:26 +00:00
int Process::sys$halt()
{
if (!is_superuser())
return -EPERM;
ping: Use pledge()
2020-01-11 19:48:43 +00:00
REQUIRE_NO_PROMISES;
Kernel: Only allow superuser to halt() the system (#342) Following the discussion in #334, shutdown must also have root-only run permissions.
2019-07-19 11:08:26 +00:00
dbgprintf("acquiring FS locks...\n");
FS::lock_all();
dbgprintf("syncing mounted filesystems...\n");
FS::sync();
dbgprintf("attempting system shutdown...\n");
IO::out16(0x604, 0x2000);
return ESUCCESS;
}
Kernel+Userland: Addd reboot syscall (#334) Rolling with the theme of adding a dialog to shutdown the machine, it is probably nice to have a way to reboot the machine without performing a full system powerdown. A reboot program has been added to `/bin/` as well as a corresponding `syscall` (SC_reboot). This syscall works by attempting to pulse the 8042 keyboard controller. Note that this is NOT supported on new machines, and should only be a fallback until we have proper ACPI support. The implementation causes a triple fault in QEMU, which then restarts the system. The filesystems are locked and synchronized before this occurs, so there shouldn't be any corruption etctera.
2019-07-19 07:58:12 +00:00
int Process::sys$reboot()
{
if (!is_superuser())
return -EPERM;
ping: Use pledge()
2020-01-11 19:48:43 +00:00
REQUIRE_NO_PROMISES;
Kernel+Userland: Addd reboot syscall (#334) Rolling with the theme of adding a dialog to shutdown the machine, it is probably nice to have a way to reboot the machine without performing a full system powerdown. A reboot program has been added to `/bin/` as well as a corresponding `syscall` (SC_reboot). This syscall works by attempting to pulse the 8042 keyboard controller. Note that this is NOT supported on new machines, and should only be a fallback until we have proper ACPI support. The implementation causes a triple fault in QEMU, which then restarts the system. The filesystems are locked and synchronized before this occurs, so there shouldn't be any corruption etctera.
2019-07-19 07:58:12 +00:00
dbgprintf("acquiring FS locks...\n");
FS::lock_all();
dbgprintf("syncing mounted filesystems...\n");
FS::sync();
dbgprintf("attempting reboot via KB Controller...\n");
IO::out8(0x64, 0xFE);
return ESUCCESS;
}
Kernel: Pass a parameter struct to mount() This was the last remaining syscall that took a null-terminated string and figured out how long it was by walking it in kernelspace *shudder*.
2020-01-11 09:46:21 +00:00
int Process::sys$mount(const Syscall::SC_mount_params* user_params)
Kernel: mount system call (#396) It is now possible to mount ext2 `DiskDevice` devices under Serenity on any folder in the root filesystem. Currently any user can do this with any permissions. There's a fair amount of assumptions made here too, that might not be too good, but can be worked on in the future. This is a good start to allow more dynamic operation under the OS itself. It is also currently impossible to unmount and such, and devices will fail to mount in Linux as the FS 'needs to be cleaned'. I'll work on getting `umount` done ASAP to rectify this (as well as working on less assumption-making in the mount syscall. We don't want to just be able to mount DiskDevices!). This could probably be fixed with some `-t` flag or something similar.
2019-08-02 13:18:47 +00:00
{
Kernel: Some improvements to the mount syscall - You must now have superuser privileges to use mount(). - We now verify that the mount point is a valid path first, before trying to find a filesystem on the specified device. - Convert some dbgprintf() to dbg().
2019-08-02 17:03:50 +00:00
if (!is_superuser())
return -EPERM;
ping: Use pledge()
2020-01-11 19:48:43 +00:00
REQUIRE_NO_PROMISES;
Kernel: Pass a parameter struct to mount() This was the last remaining syscall that took a null-terminated string and figured out how long it was by walking it in kernelspace *shudder*.
2020-01-11 09:46:21 +00:00
Syscall::SC_mount_params params;
Kernel: Combine validate and copy of user mode pointers (#1069) Right now there is a significant amount of boiler plate code required to validate user mode parameters in syscalls. In an attempt to reduce this a bit, introduce validate_read_and_copy_typed which combines the usermode address check and does the copy internally if the validation passes. This cleans up a little bit of code from a significant amount of syscalls.
2020-01-13 10:19:18 +00:00
if (!validate_read_and_copy_typed(&params, user_params))
return -EFAULT;
Kernel: Start implementing x86 SMAP support Supervisor Mode Access Prevention (SMAP) is an x86 CPU feature that prevents the kernel from accessing userspace memory. With SMAP enabled, trying to read/write a userspace memory address while in the kernel will now generate a page fault. Since it's sometimes necessary to read/write userspace memory, there are two new instructions that quickly switch the protection on/off: STAC (disables protection) and CLAC (enables protection.) These are exposed in kernel code via the stac() and clac() helpers. There's also a SmapDisabler RAII object that can be used to ensure that you don't forget to re-enable protection before returning to userspace code. THis patch also adds copy_to_user(), copy_from_user() and memset_user() which are the "correct" way of doing things. These functions allow us to briefly disable protection for a specific purpose, and then turn it back on immediately after it's done. Going forward all kernel code should be moved to using these and all uses of SmapDisabler are to be considered FIXME's. Note that we're not realizing the full potential of this feature since I've used SmapDisabler quite liberally in this initial bring-up patch.
2020-01-05 17:00:15 +00:00
Kernel: Pass a parameter struct to mount() This was the last remaining syscall that took a null-terminated string and figured out how long it was by walking it in kernelspace *shudder*.
2020-01-11 09:46:21 +00:00
auto source = validate_and_copy_string_from_user(params.source);
auto target = validate_and_copy_string_from_user(params.target);
auto fs_type = validate_and_copy_string_from_user(params.fs_type);
if (source.is_null() || target.is_null() || fs_type.is_null())
Kernel: mount system call (#396) It is now possible to mount ext2 `DiskDevice` devices under Serenity on any folder in the root filesystem. Currently any user can do this with any permissions. There's a fair amount of assumptions made here too, that might not be too good, but can be worked on in the future. This is a good start to allow more dynamic operation under the OS itself. It is also currently impossible to unmount and such, and devices will fail to mount in Linux as the FS 'needs to be cleaned'. I'll work on getting `umount` done ASAP to rectify this (as well as working on less assumption-making in the mount syscall. We don't want to just be able to mount DiskDevices!). This could probably be fixed with some `-t` flag or something similar.
2019-08-02 13:18:47 +00:00
return -EFAULT;
Kernel: Pass a parameter struct to mount() This was the last remaining syscall that took a null-terminated string and figured out how long it was by walking it in kernelspace *shudder*.
2020-01-11 09:46:21 +00:00
dbg() << "mount " << fs_type << ": source " << source << " @ " << target;
Kernel: Some improvements to the mount syscall - You must now have superuser privileges to use mount(). - We now verify that the mount point is a valid path first, before trying to find a filesystem on the specified device. - Convert some dbgprintf() to dbg().
2019-08-02 17:03:50 +00:00
Kernel: Pass a parameter struct to mount() This was the last remaining syscall that took a null-terminated string and figured out how long it was by walking it in kernelspace *shudder*.
2020-01-11 09:46:21 +00:00
auto custody_or_error = VFS::the().resolve_path(target, current_directory());
Kernel: Some improvements to the mount syscall - You must now have superuser privileges to use mount(). - We now verify that the mount point is a valid path first, before trying to find a filesystem on the specified device. - Convert some dbgprintf() to dbg().
2019-08-02 17:03:50 +00:00
if (custody_or_error.is_error())
return custody_or_error.error();
Kernel: Pass a parameter struct to mount() This was the last remaining syscall that took a null-terminated string and figured out how long it was by walking it in kernelspace *shudder*.
2020-01-11 09:46:21 +00:00
auto& target_custody = custody_or_error.value();
Kernel: Some improvements to the mount syscall - You must now have superuser privileges to use mount(). - We now verify that the mount point is a valid path first, before trying to find a filesystem on the specified device. - Convert some dbgprintf() to dbg().
2019-08-02 17:03:50 +00:00
Kernel: Pass a parameter struct to mount() This was the last remaining syscall that took a null-terminated string and figured out how long it was by walking it in kernelspace *shudder*.
2020-01-11 09:46:21 +00:00
RefPtr<FS> fs;
Kernel: mount system call (#396) It is now possible to mount ext2 `DiskDevice` devices under Serenity on any folder in the root filesystem. Currently any user can do this with any permissions. There's a fair amount of assumptions made here too, that might not be too good, but can be worked on in the future. This is a good start to allow more dynamic operation under the OS itself. It is also currently impossible to unmount and such, and devices will fail to mount in Linux as the FS 'needs to be cleaned'. I'll work on getting `umount` done ASAP to rectify this (as well as working on less assumption-making in the mount syscall. We don't want to just be able to mount DiskDevices!). This could probably be fixed with some `-t` flag or something similar.
2019-08-02 13:18:47 +00:00
Kernel: Implement bind mounts You can now bind-mount files and directories. This essentially exposes an existing part of the file system in another place, and can be used as an alternative to symlinks or hardlinks. Here's an example of doing this: # mkdir /tmp/foo # mount /home/anon/myfile.txt /tmp/foo -o bind # cat /tmp/foo This is anon's file.
2020-01-11 16:08:35 +00:00
if (params.flags & MS_BIND) {
// We're doing a bind mount.
auto source_or_error = VFS::the().resolve_path(source, current_directory());
if (source_or_error.is_error())
return source_or_error.error();
auto& source_custody = source_or_error.value();
Kernel: Properly propagate bind mount flags Previously, when performing a bind mount flags other than MS_BIND were ignored. Now, they're properly propagated the same way a for any other mount.
2020-01-12 16:22:24 +00:00
return VFS::the().bind_mount(source_custody, target_custody, params.flags);
Kernel: Implement bind mounts You can now bind-mount files and directories. This essentially exposes an existing part of the file system in another place, and can be used as an alternative to symlinks or hardlinks. Here's an example of doing this: # mkdir /tmp/foo # mount /home/anon/myfile.txt /tmp/foo -o bind # cat /tmp/foo This is anon's file.
2020-01-11 16:08:35 +00:00
}
Kernel: Pass a parameter struct to mount() This was the last remaining syscall that took a null-terminated string and figured out how long it was by walking it in kernelspace *shudder*.
2020-01-11 09:46:21 +00:00
if (fs_type == "ext2" || fs_type == "Ext2FS") {
Kernel: Simplify Ext2FS mount code path Instead of looking up device metadata and then looking up a device by that metadata explicitly, just use VFS::open(). This also means that attempting to mount a device residing on a MS_NODEV file system will properly fail.
2020-01-12 15:29:19 +00:00
auto source_or_error = VFS::the().open(source, O_RDWR, 0, current_directory());
if (source_or_error.is_error())
return source_or_error.error();
Kernel+LibC+Userland: Support mounting other kinds of filesystems
2019-08-15 16:13:56 +00:00
Kernel: Simplify Ext2FS mount code path Instead of looking up device metadata and then looking up a device by that metadata explicitly, just use VFS::open(). This also means that attempting to mount a device residing on a MS_NODEV file system will properly fail.
2020-01-12 15:29:19 +00:00
auto* device = source_or_error.value()->device();
Kernel: Merge unnecessary DiskDevice class into BlockDevice
2020-02-08 01:17:26 +00:00
if (!device || !device->is_block_device()) {
dbg() << "mount: this is not a BlockDevice";
Kernel+LibC+Userland: Support mounting other kinds of filesystems
2019-08-15 16:13:56 +00:00
return -ENODEV;
}
Kernel: Merge unnecessary DiskDevice class into BlockDevice
2020-02-08 01:17:26 +00:00
auto& block_device = static_cast<BlockDevice&>(*device);
Kernel: mount() should fail if the provided device is not a disk device In the future, we should allow mounting any block device. At the moment there is too much filesystem code that depends on the underlying device being a DiskDevice.
2019-08-02 17:30:30 +00:00
Kernel: Merge unnecessary DiskDevice class into BlockDevice
2020-02-08 01:17:26 +00:00
dbg() << "mount: attempting to mount " << block_device.absolute_path() << " on " << target;
Kernel+LibC+Userland: Support mounting other kinds of filesystems
2019-08-15 16:13:56 +00:00
Kernel: Merge unnecessary DiskDevice class into BlockDevice
2020-02-08 01:17:26 +00:00
fs = Ext2FS::create(block_device);
Kernel: Pass a parameter struct to mount() This was the last remaining syscall that took a null-terminated string and figured out how long it was by walking it in kernelspace *shudder*.
2020-01-11 09:46:21 +00:00
} else if (fs_type == "proc" || fs_type == "ProcFS") {
Kernel+LibC+Userland: Support mounting other kinds of filesystems
2019-08-15 16:13:56 +00:00
fs = ProcFS::create();
Kernel: Pass a parameter struct to mount() This was the last remaining syscall that took a null-terminated string and figured out how long it was by walking it in kernelspace *shudder*.
2020-01-11 09:46:21 +00:00
} else if (fs_type == "devpts" || fs_type == "DevPtsFS") {
Kernel+LibC+Userland: Support mounting other kinds of filesystems
2019-08-15 16:13:56 +00:00
fs = DevPtsFS::create();
Kernel: Pass a parameter struct to mount() This was the last remaining syscall that took a null-terminated string and figured out how long it was by walking it in kernelspace *shudder*.
2020-01-11 09:46:21 +00:00
} else if (fs_type == "tmp" || fs_type == "TmpFS") {
Kernel+LibC+Userland: Support mounting other kinds of filesystems
2019-08-15 16:13:56 +00:00
fs = TmpFS::create();
Kernel: Pass a parameter struct to mount() This was the last remaining syscall that took a null-terminated string and figured out how long it was by walking it in kernelspace *shudder*.
2020-01-11 09:46:21 +00:00
} else {
Kernel+LibC+Userland: Support mounting other kinds of filesystems
2019-08-15 16:13:56 +00:00
return -ENODEV;
Kernel: Pass a parameter struct to mount() This was the last remaining syscall that took a null-terminated string and figured out how long it was by walking it in kernelspace *shudder*.
2020-01-11 09:46:21 +00:00
}
Kernel: mount system call (#396) It is now possible to mount ext2 `DiskDevice` devices under Serenity on any folder in the root filesystem. Currently any user can do this with any permissions. There's a fair amount of assumptions made here too, that might not be too good, but can be worked on in the future. This is a good start to allow more dynamic operation under the OS itself. It is also currently impossible to unmount and such, and devices will fail to mount in Linux as the FS 'needs to be cleaned'. I'll work on getting `umount` done ASAP to rectify this (as well as working on less assumption-making in the mount syscall. We don't want to just be able to mount DiskDevices!). This could probably be fixed with some `-t` flag or something similar.
2019-08-02 13:18:47 +00:00
Kernel+LibC+Userland: Support mounting other kinds of filesystems
2019-08-15 16:13:56 +00:00
if (!fs->initialize()) {
Kernel: Pass a parameter struct to mount() This was the last remaining syscall that took a null-terminated string and figured out how long it was by walking it in kernelspace *shudder*.
2020-01-11 09:46:21 +00:00
dbg() << "mount: failed to initialize " << fs_type << " filesystem on " << source;
Kernel: mount() should fail if the provided device is not a disk device In the future, we should allow mounting any block device. At the moment there is too much filesystem code that depends on the underlying device being a DiskDevice.
2019-08-02 17:30:30 +00:00
return -ENODEV;
Kernel: mount system call (#396) It is now possible to mount ext2 `DiskDevice` devices under Serenity on any folder in the root filesystem. Currently any user can do this with any permissions. There's a fair amount of assumptions made here too, that might not be too good, but can be worked on in the future. This is a good start to allow more dynamic operation under the OS itself. It is also currently impossible to unmount and such, and devices will fail to mount in Linux as the FS 'needs to be cleaned'. I'll work on getting `umount` done ASAP to rectify this (as well as working on less assumption-making in the mount syscall. We don't want to just be able to mount DiskDevices!). This could probably be fixed with some `-t` flag or something similar.
2019-08-02 13:18:47 +00:00
}
Kernel+LibC: Add support for mount flags At the moment, the actual flags are ignored, but we correctly propagate them all the way from the original mount() syscall to each custody that resides on the mounted FS.
2020-01-11 15:25:26 +00:00
auto result = VFS::the().mount(fs.release_nonnull(), target_custody, params.flags);
Kernel: Pass a parameter struct to mount() This was the last remaining syscall that took a null-terminated string and figured out how long it was by walking it in kernelspace *shudder*.
2020-01-11 09:46:21 +00:00
dbg() << "mount: successfully mounted " << source << " on " << target;
Kernel: Some improvements to the mount syscall - You must now have superuser privileges to use mount(). - We now verify that the mount point is a valid path first, before trying to find a filesystem on the specified device. - Convert some dbgprintf() to dbg().
2019-08-02 17:03:50 +00:00
return result;
Kernel: mount system call (#396) It is now possible to mount ext2 `DiskDevice` devices under Serenity on any folder in the root filesystem. Currently any user can do this with any permissions. There's a fair amount of assumptions made here too, that might not be too good, but can be worked on in the future. This is a good start to allow more dynamic operation under the OS itself. It is also currently impossible to unmount and such, and devices will fail to mount in Linux as the FS 'needs to be cleaned'. I'll work on getting `umount` done ASAP to rectify this (as well as working on less assumption-making in the mount syscall. We don't want to just be able to mount DiskDevices!). This could probably be fixed with some `-t` flag or something similar.
2019-08-02 13:18:47 +00:00
}
Kernel: Take path+length in the unlink() and umount() syscalls
2020-01-09 11:41:15 +00:00
int Process::sys$umount(const char* user_mountpoint, size_t mountpoint_length)
Kernel: Added unmount ability to VFS It is now possible to unmount file systems from the VFS via `umount`. It works via looking up the `fsid` of the filesystem from the `Inode`'s metatdata so I'm not sure how fragile it is. It seems to work for now though as something to get us going.
2019-08-11 13:56:39 +00:00
{
if (!is_superuser())
return -EPERM;
ping: Use pledge()
2020-01-11 19:48:43 +00:00
REQUIRE_NO_PROMISES;
Kernel: Take path+length in the unlink() and umount() syscalls
2020-01-09 11:41:15 +00:00
if (!validate_read(user_mountpoint, mountpoint_length))
Kernel: Added unmount ability to VFS It is now possible to unmount file systems from the VFS via `umount`. It works via looking up the `fsid` of the filesystem from the `Inode`'s metatdata so I'm not sure how fragile it is. It seems to work for now though as something to get us going.
2019-08-11 13:56:39 +00:00
return -EFAULT;
Kernel: Take path+length in the unlink() and umount() syscalls
2020-01-09 11:41:15 +00:00
auto mountpoint = get_syscall_path_argument(user_mountpoint, mountpoint_length);
if (mountpoint.is_error())
return mountpoint.error();
auto metadata_or_error = VFS::the().lookup_metadata(mountpoint.value(), current_directory());
Kernel: Added unmount ability to VFS It is now possible to unmount file systems from the VFS via `umount`. It works via looking up the `fsid` of the filesystem from the `Inode`'s metatdata so I'm not sure how fragile it is. It seems to work for now though as something to get us going.
2019-08-11 13:56:39 +00:00
if (metadata_or_error.is_error())
return metadata_or_error.error();
Kernel: Do the umount() by the guest's root inode identifier It was previously possible to unmount a filesystem mounted on /mnt by doing e.g "umount /mnt/some/path".
2019-08-17 12:24:50 +00:00
auto guest_inode_id = metadata_or_error.value().inode;
return VFS::the().unmount(guest_inode_id);
Kernel: Added unmount ability to VFS It is now possible to unmount file systems from the VFS via `umount`. It works via looking up the `fsid` of the filesystem from the `Inode`'s metatdata so I'm not sure how fragile it is. It seems to work for now though as something to get us going.
2019-08-11 13:56:39 +00:00
}
Kernel: Add a systrace() syscall and implement /bin/strace using it. Calling systrace(pid) gives you a file descriptor with a stream of the syscalls made by a peer process. The process must be owned by the same UID who calls systrace(). :^)
2019-04-22 16:44:45 +00:00
ProcessTracer& Process::ensure_tracer()
{
if (!m_tracer)
m_tracer = ProcessTracer::create(m_pid);
return *m_tracer;
}
Kernel: Make FIFO inherit from File.
2019-04-29 02:55:54 +00:00
Kernel: Rename FileDescriptor to FileDescription. After reading a bunch of POSIX specs, I've learned that a file descriptor is the number that refers to a file description, not the description itself. So this patch renames FileDescriptor to FileDescription, and Process now has FileDescription* file_description(int fd).
2019-06-07 07:36:51 +00:00
void Process::FileDescriptionAndFlags::clear()
Kernel: Make FIFO inherit from File.
2019-04-29 02:55:54 +00:00
{
Kernel: Rename "descriptor" to "description" where appropriate. Now that FileDescription is called that, variables of that type should not be called "descriptor". This is kinda wordy but we'll get used to it.
2019-06-13 20:03:04 +00:00
description = nullptr;
Kernel: Make FIFO inherit from File.
2019-04-29 02:55:54 +00:00
flags = 0;
}
AK: Rename the common integer typedefs to make it obvious what they are. These types can be picked up by including <AK/Types.h>: * u8, u16, u32, u64 (unsigned) * i8, i16, i32, i64 (signed)
2019-07-03 19:17:35 +00:00
void Process::FileDescriptionAndFlags::set(NonnullRefPtr<FileDescription>&& d, u32 f)
Kernel: Make FIFO inherit from File.
2019-04-29 02:55:54 +00:00
{
Kernel: Rename "descriptor" to "description" where appropriate. Now that FileDescription is called that, variables of that type should not be called "descriptor". This is kinda wordy but we'll get used to it.
2019-06-13 20:03:04 +00:00
description = move(d);
Kernel: Make FIFO inherit from File.
2019-04-29 02:55:54 +00:00
flags = f;
}
Kernel+Userland: Implement mknod() syscall and add a /bin/mknod program.
2019-05-03 20:59:58 +00:00
Kernel: Pass a parameter struct to mknod()
2020-01-11 09:27:37 +00:00
int Process::sys$mknod(const Syscall::SC_mknod_params* user_params)
Kernel+Userland: Implement mknod() syscall and add a /bin/mknod program.
2019-05-03 20:59:58 +00:00
{
ping: Use pledge()
2020-01-11 19:48:43 +00:00
REQUIRE_PROMISE(dpath);
Kernel: Pass a parameter struct to mknod()
2020-01-11 09:27:37 +00:00
Syscall::SC_mknod_params params;
Kernel: Combine validate and copy of user mode pointers (#1069) Right now there is a significant amount of boiler plate code required to validate user mode parameters in syscalls. In an attempt to reduce this a bit, introduce validate_read_and_copy_typed which combines the usermode address check and does the copy internally if the validation passes. This cleans up a little bit of code from a significant amount of syscalls.
2020-01-13 10:19:18 +00:00
if (!validate_read_and_copy_typed(&params, user_params))
return -EFAULT;
Kernel: Pass a parameter struct to mknod()
2020-01-11 09:27:37 +00:00
if (!is_superuser() && !is_regular_file(params.mode) && !is_fifo(params.mode) && !is_socket(params.mode))
return -EPERM;
Kernel: Use the Syscall string and buffer types more While I was updating syscalls to stop passing null-terminated strings, I added some helpful struct types: - StringArgument { const char*; size_t; } - ImmutableBuffer<Data, Size> { const Data*; Size; } - MutableBuffer<Data, Size> { Data*; Size; } The Process class has some convenience functions for validating and optionally extracting the contents from these structs: - get_syscall_path_argument(StringArgument) - validate_and_copy_string_from_user(StringArgument) - validate(ImmutableBuffer) - validate(MutableBuffer) There's still so much code around this and I'm wondering if we should generate most of it instead. Possible nice little project.
2020-01-11 11:47:47 +00:00
auto path = get_syscall_path_argument(params.path);
Kernel: Pass a parameter struct to mknod()
2020-01-11 09:27:37 +00:00
if (path.is_error())
return path.error();
return VFS::the().mknod(path.value(), params.mode & ~umask(), params.dev, current_directory());
Kernel+Userland: Implement mknod() syscall and add a /bin/mknod program.
2019-05-03 20:59:58 +00:00
}
Kernel+LibC: Add a dump_backtrace() syscall. This is very simple but already very useful. Now you're able to call to dump_backtrace() from anywhere userspace to get a nice symbolicated backtrace in the debugger output. :^)
2019-07-21 07:59:17 +00:00
int Process::sys$dump_backtrace()
{
dump_backtrace();
return 0;
}
Kernel+LibC: Add a dbgputch() syscall and use it for userspace dbgprintf(). The "stddbg" stream was a cute idea but we never ended up using it in practice, so let's simplify this and implement userspace dbgprintf() on top of a simple dbgputch() syscall instead. This makes debugging LibC startup a little bit easier. :^)
2019-07-21 17:45:31 +00:00
int Process::sys$dbgputch(u8 ch)
{
IO::out8(0xe9, ch);
return 0;
}
Kernel+LibC: Add a dbgputstr() syscall for sending strings to debug output. This is very handy for the DebugLogStream implementation, among others. :^)
2019-07-21 19:43:37 +00:00
int Process::sys$dbgputstr(const u8* characters, int length)
{
Kernel: Zero-length dbgputstr() should just return 0
2019-08-09 17:44:14 +00:00
if (!length)
return 0;
Kernel+LibC: Add a dbgputstr() syscall for sending strings to debug output. This is very handy for the DebugLogStream implementation, among others. :^)
2019-07-21 19:43:37 +00:00
if (!validate_read(characters, length))
return -EFAULT;
Kernel: Start implementing x86 SMAP support Supervisor Mode Access Prevention (SMAP) is an x86 CPU feature that prevents the kernel from accessing userspace memory. With SMAP enabled, trying to read/write a userspace memory address while in the kernel will now generate a page fault. Since it's sometimes necessary to read/write userspace memory, there are two new instructions that quickly switch the protection on/off: STAC (disables protection) and CLAC (enables protection.) These are exposed in kernel code via the stac() and clac() helpers. There's also a SmapDisabler RAII object that can be used to ensure that you don't forget to re-enable protection before returning to userspace code. THis patch also adds copy_to_user(), copy_from_user() and memset_user() which are the "correct" way of doing things. These functions allow us to briefly disable protection for a specific purpose, and then turn it back on immediately after it's done. Going forward all kernel code should be moved to using these and all uses of SmapDisabler are to be considered FIXME's. Note that we're not realizing the full potential of this feature since I've used SmapDisabler quite liberally in this initial bring-up patch.
2020-01-05 17:00:15 +00:00
SmapDisabler disabler;
Kernel+LibC: Add a dbgputstr() syscall for sending strings to debug output. This is very handy for the DebugLogStream implementation, among others. :^)
2019-07-21 19:43:37 +00:00
for (int i = 0; i < length; ++i)
IO::out8(0xe9, characters[i]);
return 0;
}
Kernel: Dump backtrace to debugger for DefaultSignalAction::DumpCore. This makes assertion failures generate backtraces again. Sorry to everyone who suffered from the lack of backtraces lately. :^) We share code with the /proc/PID/stack implementation. You can now get the current backtrace for a Thread via Thread::backtrace(), and all the traces for a Process via Process::backtrace().
2019-07-25 19:02:19 +00:00
Kernel: Use KBufferBuilder to build ProcFS files and backtraces This is not perfect as it uses a lot of VM, but since the buffers are supposed to be temporary it's not super terrible. This could be improved by giving back the unused VM to the kernel's RangeAllocator after finishing the buffer building.
2019-08-07 19:52:43 +00:00
KBuffer Process::backtrace(ProcessInspectionHandle& handle) const
Kernel: Dump backtrace to debugger for DefaultSignalAction::DumpCore. This makes assertion failures generate backtraces again. Sorry to everyone who suffered from the lack of backtraces lately. :^) We share code with the /proc/PID/stack implementation. You can now get the current backtrace for a Thread via Thread::backtrace(), and all the traces for a Process via Process::backtrace().
2019-07-25 19:02:19 +00:00
{
Kernel: Use KBufferBuilder to build ProcFS files and backtraces This is not perfect as it uses a lot of VM, but since the buffers are supposed to be temporary it's not super terrible. This could be improved by giving back the unused VM to the kernel's RangeAllocator after finishing the buffer building.
2019-08-07 19:52:43 +00:00
KBufferBuilder builder;
Kernel: Dump backtrace to debugger for DefaultSignalAction::DumpCore. This makes assertion failures generate backtraces again. Sorry to everyone who suffered from the lack of backtraces lately. :^) We share code with the /proc/PID/stack implementation. You can now get the current backtrace for a Thread via Thread::backtrace(), and all the traces for a Process via Process::backtrace().
2019-07-25 19:02:19 +00:00
for_each_thread([&](Thread& thread) {
Kernel: Allow setting thread names The main thread of each kernel/user process will take the name of the process. Extra threads will get a fancy new name "ProcessName[<tid>]". Thread backtraces now list the thread name in addtion to tid. Add the thread name to /proc/all (should it get its own proc file?). Add two new syscalls, set_thread_name and get_thread_name.
2019-12-07 19:45:26 +00:00
builder.appendf("Thread %d (%s):\n", thread.tid(), thread.name().characters());
Kernel: Dump backtrace to debugger for DefaultSignalAction::DumpCore. This makes assertion failures generate backtraces again. Sorry to everyone who suffered from the lack of backtraces lately. :^) We share code with the /proc/PID/stack implementation. You can now get the current backtrace for a Thread via Thread::backtrace(), and all the traces for a Process via Process::backtrace().
2019-07-25 19:02:19 +00:00
builder.append(thread.backtrace(handle));
return IterationDecision::Continue;
});
Kernel: Use KBufferBuilder to build ProcFS files and backtraces This is not perfect as it uses a lot of VM, but since the buffers are supposed to be temporary it's not super terrible. This could be improved by giving back the unused VM to the kernel's RangeAllocator after finishing the buffer building.
2019-08-07 19:52:43 +00:00
return builder.build();
Kernel: Dump backtrace to debugger for DefaultSignalAction::DumpCore. This makes assertion failures generate backtraces again. Sorry to everyone who suffered from the lack of backtraces lately. :^) We share code with the /proc/PID/stack implementation. You can now get the current backtrace for a Thread via Thread::backtrace(), and all the traces for a Process via Process::backtrace().
2019-07-25 19:02:19 +00:00
}
Kernel+ProcessManager: Let processes have an icon and show it in the table. Processes can now have an icon assigned, which is essentially a 16x16 RGBA32 bitmap exposed as a shared buffer ID. You set the icon ID by calling set_process_icon(int) and the icon ID will be exposed through /proc/all. To make this work, I added a mechanism for making shared buffers globally accessible. For safety reasons, each app seals the icon buffer before making it global. Right now the first call to GWindow::set_icon() is what determines the process icon. We'll probably change this in the future. :^)
2019-07-29 05:26:01 +00:00
int Process::sys$set_process_icon(int icon_id)
{
ping: Use pledge()
2020-01-11 19:48:43 +00:00
REQUIRE_PROMISE(shared_buffer);
Kernel+ProcessManager: Let processes have an icon and show it in the table. Processes can now have an icon assigned, which is essentially a 16x16 RGBA32 bitmap exposed as a shared buffer ID. You set the icon ID by calling set_process_icon(int) and the icon ID will be exposed through /proc/all. To make this work, I added a mechanism for making shared buffers globally accessible. For safety reasons, each app seals the icon buffer before making it global. Right now the first call to GWindow::set_icon() is what determines the process icon. We'll probably change this in the future. :^)
2019-07-29 05:26:01 +00:00
LOCKER(shared_buffers().lock());
auto it = shared_buffers().resource().find(icon_id);
if (it == shared_buffers().resource().end())
return -EINVAL;
auto& shared_buffer = *(*it).value;
if (!shared_buffer.is_shared_with(m_pid))
return -EPERM;
m_icon_id = icon_id;
return 0;
}
Kernel+LibC: Add get_process_name() syscall It does exactly what it sounds like: int get_process_name(char* buffer, int buffer_size);
2019-08-15 18:55:10 +00:00
int Process::sys$get_process_name(char* buffer, int buffer_size)
{
ping: Use pledge()
2020-01-11 19:48:43 +00:00
REQUIRE_PROMISE(stdio);
Kernel+LibC: Add get_process_name() syscall It does exactly what it sounds like: int get_process_name(char* buffer, int buffer_size);
2019-08-15 18:55:10 +00:00
if (buffer_size <= 0)
return -EINVAL;
if (!validate_write(buffer, buffer_size))
return -EFAULT;
Kernel: Start implementing x86 SMAP support Supervisor Mode Access Prevention (SMAP) is an x86 CPU feature that prevents the kernel from accessing userspace memory. With SMAP enabled, trying to read/write a userspace memory address while in the kernel will now generate a page fault. Since it's sometimes necessary to read/write userspace memory, there are two new instructions that quickly switch the protection on/off: STAC (disables protection) and CLAC (enables protection.) These are exposed in kernel code via the stac() and clac() helpers. There's also a SmapDisabler RAII object that can be used to ensure that you don't forget to re-enable protection before returning to userspace code. THis patch also adds copy_to_user(), copy_from_user() and memset_user() which are the "correct" way of doing things. These functions allow us to briefly disable protection for a specific purpose, and then turn it back on immediately after it's done. Going forward all kernel code should be moved to using these and all uses of SmapDisabler are to be considered FIXME's. Note that we're not realizing the full potential of this feature since I've used SmapDisabler quite liberally in this initial bring-up patch.
2020-01-05 17:00:15 +00:00
if (m_name.length() + 1 > (size_t)buffer_size)
Kernel+LibC: Add get_process_name() syscall It does exactly what it sounds like: int get_process_name(char* buffer, int buffer_size);
2019-08-15 18:55:10 +00:00
return -ENAMETOOLONG;
Kernel: Start implementing x86 SMAP support Supervisor Mode Access Prevention (SMAP) is an x86 CPU feature that prevents the kernel from accessing userspace memory. With SMAP enabled, trying to read/write a userspace memory address while in the kernel will now generate a page fault. Since it's sometimes necessary to read/write userspace memory, there are two new instructions that quickly switch the protection on/off: STAC (disables protection) and CLAC (enables protection.) These are exposed in kernel code via the stac() and clac() helpers. There's also a SmapDisabler RAII object that can be used to ensure that you don't forget to re-enable protection before returning to userspace code. THis patch also adds copy_to_user(), copy_from_user() and memset_user() which are the "correct" way of doing things. These functions allow us to briefly disable protection for a specific purpose, and then turn it back on immediately after it's done. Going forward all kernel code should be moved to using these and all uses of SmapDisabler are to be considered FIXME's. Note that we're not realizing the full potential of this feature since I've used SmapDisabler quite liberally in this initial bring-up patch.
2020-01-05 17:00:15 +00:00
copy_to_user(buffer, m_name.characters(), m_name.length() + 1);
Kernel+LibC: Add get_process_name() syscall It does exactly what it sounds like: int get_process_name(char* buffer, int buffer_size);
2019-08-15 18:55:10 +00:00
return 0;
}
Kernel: Add a Linux-style getrandom syscall The way it gets the entropy and blasts it to the buffer is pretty ugly IMHO, but it does work for now. (It should be replaced, by not truncating a u32.) It implements an (unused for now) flags argument, like Linux but instead of OpenBSD's. This is in case we want to distinguish between entropy sources or any other reason and have to implement a new syscall later. Of course, learn from Linux's struggles with entropy sourcing too.
2019-10-13 14:41:55 +00:00
// We don't use the flag yet, but we could use it for distinguishing
// random source like Linux, unlike the OpenBSD equivalent. However, if we
// do, we should be able of the caveats that Linux has dealt with.
int Process::sys$getrandom(void* buffer, size_t buffer_size, unsigned int flags __attribute__((unused)))
{
Kernel: Put some more syscalls in the "stdio" bucket yield() and get_kernel_info_page() seem like decent fits for "stdio".
2020-01-12 09:30:02 +00:00
REQUIRE_PROMISE(stdio);
Kernel: Add a Linux-style getrandom syscall The way it gets the entropy and blasts it to the buffer is pretty ugly IMHO, but it does work for now. (It should be replaced, by not truncating a u32.) It implements an (unused for now) flags argument, like Linux but instead of OpenBSD's. This is in case we want to distinguish between entropy sources or any other reason and have to implement a new syscall later. Of course, learn from Linux's struggles with entropy sourcing too.
2019-10-13 14:41:55 +00:00
if (buffer_size <= 0)
return -EINVAL;
if (!validate_write(buffer, buffer_size))
return -EFAULT;
Kernel: Use word-sized entropy as much as possible in syscall
2019-10-13 15:55:58 +00:00
Kernel: Fix SMAP violation in sys$getrandom()
2020-01-12 19:10:53 +00:00
SmapDisabler disabler;
Kernel: Add a more expressive API for getting random bytes We now have these API's in <Kernel/Random.h>: - get_fast_random_bytes(u8* buffer, size_t buffer_size) - get_good_random_bytes(u8* buffer, size_t buffer_size) - get_fast_random<T>() - get_good_random<T>() Internally they both use x86 RDRAND if available, otherwise they fall back to the same LCG we had in RandomDevice all along. The main purpose of this patch is to give kernel code a way to better express its needs for random data. Randomness is something that will require a lot more work, but this is hopefully a step in the right direction.
2020-01-03 11:36:30 +00:00
get_good_random_bytes((u8*)buffer, buffer_size);
Kernel: Add a Linux-style getrandom syscall The way it gets the entropy and blasts it to the buffer is pretty ugly IMHO, but it does work for now. (It should be replaced, by not truncating a u32.) It implements an (unused for now) flags argument, like Linux but instead of OpenBSD's. This is in case we want to distinguish between entropy sources or any other reason and have to implement a new syscall later. Of course, learn from Linux's struggles with entropy sourcing too.
2019-10-13 14:41:55 +00:00
return 0;
}
Kernel+LibC: Implement clock_gettime() and clock_nanosleep() Only the CLOCK_MONOTONIC clock is supported at the moment, and it only has millisecond precision. :^)
2019-11-02 18:34:06 +00:00
Kernel: Combine validate and copy of user mode pointers (#1069) Right now there is a significant amount of boiler plate code required to validate user mode parameters in syscalls. In an attempt to reduce this a bit, introduce validate_read_and_copy_typed which combines the usermode address check and does the copy internally if the validation passes. This cleans up a little bit of code from a significant amount of syscalls.
2020-01-13 10:19:18 +00:00
int Process::sys$setkeymap(const Syscall::SC_setkeymap_params* user_params)
Kernel: Implement the setkeymap() syscall.
2019-11-23 07:48:07 +00:00
{
if (!is_superuser())
return -EPERM;
ping: Use pledge()
2020-01-11 19:48:43 +00:00
REQUIRE_NO_PROMISES;
Kernel: Combine validate and copy of user mode pointers (#1069) Right now there is a significant amount of boiler plate code required to validate user mode parameters in syscalls. In an attempt to reduce this a bit, introduce validate_read_and_copy_typed which combines the usermode address check and does the copy internally if the validation passes. This cleans up a little bit of code from a significant amount of syscalls.
2020-01-13 10:19:18 +00:00
Syscall::SC_setkeymap_params params;
if (!validate_read_and_copy_typed(&params, user_params))
Kernel: Implement AltGr key support
2019-12-31 12:37:38 +00:00
return -EFAULT;
Kernel: Combine validate and copy of user mode pointers (#1069) Right now there is a significant amount of boiler plate code required to validate user mode parameters in syscalls. In an attempt to reduce this a bit, introduce validate_read_and_copy_typed which combines the usermode address check and does the copy internally if the validation passes. This cleans up a little bit of code from a significant amount of syscalls.
2020-01-13 10:19:18 +00:00
const char* map = params.map;
const char* shift_map = params.shift_map;
const char* alt_map = params.alt_map;
const char* altgr_map = params.altgr_map;
Kernel: Fix bad TOCTOU pattern in syscalls that take a parameter struct Our syscall calling convention only allows passing up to 3 arguments in registers. For syscalls that take more arguments, we bake them into a struct and pass a pointer to that struct instead. When doing pointer validation, this is what we would do: 1) Validate the "params" struct 2) Validate "params->some_pointer" 3) ... other stuff ... 4) Use "params->some_pointer" Since the parameter struct is stored in userspace, it can be modified by userspace after validation has completed. This was a recurring pattern in many syscalls that was further hidden by me using structured binding declarations to give convenient local names to things in the parameter struct: auto& [some_pointer, ...] = *params; memcpy(some_pointer, ...); This devilishly makes "some_pointer" look like a local variable but it's actually more like an alias for "params->some_pointer" and will expand to a dereference when accessed! This patch fixes the issues by explicitly copying out each member from the parameter structs before validating them, and then never using the "param" pointers beyond that. Thanks to braindead for finding this bug! :^)
2020-01-05 08:13:00 +00:00
if (!validate_read(map, 0x80))
Kernel: Implement AltGr key support
2019-12-31 12:37:38 +00:00
return -EFAULT;
Kernel: Fix bad TOCTOU pattern in syscalls that take a parameter struct Our syscall calling convention only allows passing up to 3 arguments in registers. For syscalls that take more arguments, we bake them into a struct and pass a pointer to that struct instead. When doing pointer validation, this is what we would do: 1) Validate the "params" struct 2) Validate "params->some_pointer" 3) ... other stuff ... 4) Use "params->some_pointer" Since the parameter struct is stored in userspace, it can be modified by userspace after validation has completed. This was a recurring pattern in many syscalls that was further hidden by me using structured binding declarations to give convenient local names to things in the parameter struct: auto& [some_pointer, ...] = *params; memcpy(some_pointer, ...); This devilishly makes "some_pointer" look like a local variable but it's actually more like an alias for "params->some_pointer" and will expand to a dereference when accessed! This patch fixes the issues by explicitly copying out each member from the parameter structs before validating them, and then never using the "param" pointers beyond that. Thanks to braindead for finding this bug! :^)
2020-01-05 08:13:00 +00:00
if (!validate_read(shift_map, 0x80))
Kernel: Implement the setkeymap() syscall.
2019-11-23 07:48:07 +00:00
return -EFAULT;
Kernel: Fix bad TOCTOU pattern in syscalls that take a parameter struct Our syscall calling convention only allows passing up to 3 arguments in registers. For syscalls that take more arguments, we bake them into a struct and pass a pointer to that struct instead. When doing pointer validation, this is what we would do: 1) Validate the "params" struct 2) Validate "params->some_pointer" 3) ... other stuff ... 4) Use "params->some_pointer" Since the parameter struct is stored in userspace, it can be modified by userspace after validation has completed. This was a recurring pattern in many syscalls that was further hidden by me using structured binding declarations to give convenient local names to things in the parameter struct: auto& [some_pointer, ...] = *params; memcpy(some_pointer, ...); This devilishly makes "some_pointer" look like a local variable but it's actually more like an alias for "params->some_pointer" and will expand to a dereference when accessed! This patch fixes the issues by explicitly copying out each member from the parameter structs before validating them, and then never using the "param" pointers beyond that. Thanks to braindead for finding this bug! :^)
2020-01-05 08:13:00 +00:00
if (!validate_read(alt_map, 0x80))
Kernel: Implement the setkeymap() syscall.
2019-11-23 07:48:07 +00:00
return -EFAULT;
Kernel: Fix bad TOCTOU pattern in syscalls that take a parameter struct Our syscall calling convention only allows passing up to 3 arguments in registers. For syscalls that take more arguments, we bake them into a struct and pass a pointer to that struct instead. When doing pointer validation, this is what we would do: 1) Validate the "params" struct 2) Validate "params->some_pointer" 3) ... other stuff ... 4) Use "params->some_pointer" Since the parameter struct is stored in userspace, it can be modified by userspace after validation has completed. This was a recurring pattern in many syscalls that was further hidden by me using structured binding declarations to give convenient local names to things in the parameter struct: auto& [some_pointer, ...] = *params; memcpy(some_pointer, ...); This devilishly makes "some_pointer" look like a local variable but it's actually more like an alias for "params->some_pointer" and will expand to a dereference when accessed! This patch fixes the issues by explicitly copying out each member from the parameter structs before validating them, and then never using the "param" pointers beyond that. Thanks to braindead for finding this bug! :^)
2020-01-05 08:13:00 +00:00
if (!validate_read(altgr_map, 0x80))
Kernel: Implement the setkeymap() syscall.
2019-11-23 07:48:07 +00:00
return -EFAULT;
Kernel: Fix SMAP in setkeymap syscall It looks like setkeymap was missed when the SMAP functionality was introduced. Disable SMAP only in the scope where we actually read the usermode addresses.
2020-01-13 09:26:20 +00:00
SmapDisabler disabler;
Kernel: Fix bad TOCTOU pattern in syscalls that take a parameter struct Our syscall calling convention only allows passing up to 3 arguments in registers. For syscalls that take more arguments, we bake them into a struct and pass a pointer to that struct instead. When doing pointer validation, this is what we would do: 1) Validate the "params" struct 2) Validate "params->some_pointer" 3) ... other stuff ... 4) Use "params->some_pointer" Since the parameter struct is stored in userspace, it can be modified by userspace after validation has completed. This was a recurring pattern in many syscalls that was further hidden by me using structured binding declarations to give convenient local names to things in the parameter struct: auto& [some_pointer, ...] = *params; memcpy(some_pointer, ...); This devilishly makes "some_pointer" look like a local variable but it's actually more like an alias for "params->some_pointer" and will expand to a dereference when accessed! This patch fixes the issues by explicitly copying out each member from the parameter structs before validating them, and then never using the "param" pointers beyond that. Thanks to braindead for finding this bug! :^)
2020-01-05 08:13:00 +00:00
KeyboardDevice::the().set_maps(map, shift_map, alt_map, altgr_map);
Kernel: Implement the setkeymap() syscall.
2019-11-23 07:48:07 +00:00
return 0;
}
Kernel+LibC: Implement clock_gettime() and clock_nanosleep() Only the CLOCK_MONOTONIC clock is supported at the moment, and it only has millisecond precision. :^)
2019-11-02 18:34:06 +00:00
int Process::sys$clock_gettime(clockid_t clock_id, timespec* ts)
{
ping: Use pledge()
2020-01-11 19:48:43 +00:00
REQUIRE_PROMISE(stdio);
Kernel+LibC: Implement clock_gettime() and clock_nanosleep() Only the CLOCK_MONOTONIC clock is supported at the moment, and it only has millisecond precision. :^)
2019-11-02 18:34:06 +00:00
if (!validate_write_typed(ts))
return -EFAULT;
Kernel: Paper over SMAP violations in clock_{gettime,nanosleep}() Just put some SmapDisablers here to unbreak the nesalizer port.
2020-01-05 22:20:33 +00:00
SmapDisabler disabler;
Kernel+LibC: Implement clock_gettime() and clock_nanosleep() Only the CLOCK_MONOTONIC clock is supported at the moment, and it only has millisecond precision. :^)
2019-11-02 18:34:06 +00:00
switch (clock_id) {
case CLOCK_MONOTONIC:
ts->tv_sec = g_uptime / TICKS_PER_SECOND;
ts->tv_nsec = (g_uptime % TICKS_PER_SECOND) * 1000000;
break;
default:
return -EINVAL;
}
return 0;
}
Kernel: Remove SmapDisabler in clock_nanosleep()
2020-01-11 10:51:03 +00:00
int Process::sys$clock_nanosleep(const Syscall::SC_clock_nanosleep_params* user_params)
Kernel+LibC: Implement clock_gettime() and clock_nanosleep() Only the CLOCK_MONOTONIC clock is supported at the moment, and it only has millisecond precision. :^)
2019-11-02 18:34:06 +00:00
{
ping: Use pledge()
2020-01-11 19:48:43 +00:00
REQUIRE_PROMISE(stdio);
Kernel: Combine validate and copy of user mode pointers (#1069) Right now there is a significant amount of boiler plate code required to validate user mode parameters in syscalls. In an attempt to reduce this a bit, introduce validate_read_and_copy_typed which combines the usermode address check and does the copy internally if the validation passes. This cleans up a little bit of code from a significant amount of syscalls.
2020-01-13 10:19:18 +00:00
Kernel: Remove SmapDisabler in clock_nanosleep()
2020-01-11 10:51:03 +00:00
Syscall::SC_clock_nanosleep_params params;
Kernel: Combine validate and copy of user mode pointers (#1069) Right now there is a significant amount of boiler plate code required to validate user mode parameters in syscalls. In an attempt to reduce this a bit, introduce validate_read_and_copy_typed which combines the usermode address check and does the copy internally if the validation passes. This cleans up a little bit of code from a significant amount of syscalls.
2020-01-13 10:19:18 +00:00
if (!validate_read_and_copy_typed(&params, user_params))
return -EFAULT;
Kernel+LibC: Implement clock_gettime() and clock_nanosleep() Only the CLOCK_MONOTONIC clock is supported at the moment, and it only has millisecond precision. :^)
2019-11-02 18:34:06 +00:00
Kernel: Remove SmapDisabler in clock_nanosleep()
2020-01-11 10:51:03 +00:00
if (params.requested_sleep && !validate_read_typed(params.requested_sleep))
Kernel+LibC: Implement clock_gettime() and clock_nanosleep() Only the CLOCK_MONOTONIC clock is supported at the moment, and it only has millisecond precision. :^)
2019-11-02 18:34:06 +00:00
return -EFAULT;
Kernel: Remove SmapDisabler in clock_nanosleep()
2020-01-11 10:51:03 +00:00
timespec requested_sleep;
copy_from_user(&requested_sleep, params.requested_sleep);
if (params.remaining_sleep && !validate_write_typed(params.remaining_sleep))
Kernel+LibC: Implement clock_gettime() and clock_nanosleep() Only the CLOCK_MONOTONIC clock is supported at the moment, and it only has millisecond precision. :^)
2019-11-02 18:34:06 +00:00
return -EFAULT;
Kernel: Remove SmapDisabler in clock_nanosleep()
2020-01-11 10:51:03 +00:00
bool is_absolute = params.flags & TIMER_ABSTIME;
Kernel+LibC: Implement clock_gettime() and clock_nanosleep() Only the CLOCK_MONOTONIC clock is supported at the moment, and it only has millisecond precision. :^)
2019-11-02 18:34:06 +00:00
Kernel: Remove SmapDisabler in clock_nanosleep()
2020-01-11 10:51:03 +00:00
switch (params.clock_id) {
Kernel+LibC: Implement clock_gettime() and clock_nanosleep() Only the CLOCK_MONOTONIC clock is supported at the moment, and it only has millisecond precision. :^)
2019-11-02 18:34:06 +00:00
case CLOCK_MONOTONIC: {
u64 wakeup_time;
if (is_absolute) {
Kernel: Remove SmapDisabler in clock_nanosleep()
2020-01-11 10:51:03 +00:00
u64 time_to_wake = (requested_sleep.tv_sec * 1000 + requested_sleep.tv_nsec / 1000000);
Kernel+LibC: Implement clock_gettime() and clock_nanosleep() Only the CLOCK_MONOTONIC clock is supported at the moment, and it only has millisecond precision. :^)
2019-11-02 18:34:06 +00:00
wakeup_time = current->sleep_until(time_to_wake);
} else {
Kernel: Remove SmapDisabler in clock_nanosleep()
2020-01-11 10:51:03 +00:00
u32 ticks_to_sleep = (requested_sleep.tv_sec * 1000 + requested_sleep.tv_nsec / 1000000);
Kernel+LibC: Implement clock_gettime() and clock_nanosleep() Only the CLOCK_MONOTONIC clock is supported at the moment, and it only has millisecond precision. :^)
2019-11-02 18:34:06 +00:00
if (!ticks_to_sleep)
return 0;
wakeup_time = current->sleep(ticks_to_sleep);
}
if (wakeup_time > g_uptime) {
u32 ticks_left = wakeup_time - g_uptime;
Kernel: Remove SmapDisabler in clock_nanosleep()
2020-01-11 10:51:03 +00:00
if (!is_absolute && params.remaining_sleep) {
timespec remaining_sleep;
memset(&remaining_sleep, 0, sizeof(timespec));
remaining_sleep.tv_sec = ticks_left / TICKS_PER_SECOND;
ticks_left -= remaining_sleep.tv_sec * TICKS_PER_SECOND;
remaining_sleep.tv_nsec = ticks_left * 1000000;
copy_to_user(params.remaining_sleep, &remaining_sleep);
Kernel+LibC: Implement clock_gettime() and clock_nanosleep() Only the CLOCK_MONOTONIC clock is supported at the moment, and it only has millisecond precision. :^)
2019-11-02 18:34:06 +00:00
}
return -EINTR;
}
return 0;
}
default:
return -EINVAL;
}
}
Kernel: Use a lookup table for syscalls Instead of the big ugly switch statement, build a lookup table using the syscall enumeration macro. This greatly simplifies the syscall implementation. :^)
2019-11-09 21:18:16 +00:00
int Process::sys$sync()
{
ping: Use pledge()
2020-01-11 19:48:43 +00:00
REQUIRE_PROMISE(stdio);
Kernel: Use a lookup table for syscalls Instead of the big ugly switch statement, build a lookup table using the syscall enumeration macro. This greatly simplifies the syscall implementation. :^)
2019-11-09 21:18:16 +00:00
VFS::the().sync();
return 0;
}
int Process::sys$yield()
{
Kernel: Put some more syscalls in the "stdio" bucket yield() and get_kernel_info_page() seem like decent fits for "stdio".
2020-01-12 09:30:02 +00:00
REQUIRE_PROMISE(stdio);
Kernel: Release the big process lock while yielding in sys$yield() Otherwise, a thread calling sched_yield() will prevent other threads in that process from entering the kernel.
2019-11-16 11:18:59 +00:00
current->yield_without_holding_big_lock();
return 0;
Kernel: Use a lookup table for syscalls Instead of the big ugly switch statement, build a lookup table using the syscall enumeration macro. This greatly simplifies the syscall implementation. :^)
2019-11-09 21:18:16 +00:00
}
int Process::sys$beep()
{
Kernel: Move PC speaker beep timing logic from scheduler to the syscall I don't know why I put this in the scheduler to begin with.. the caller can just block until the beeping is finished.
2019-12-26 21:31:26 +00:00
PCSpeaker::tone_on(440);
u64 wakeup_time = current->sleep(100);
PCSpeaker::tone_off();
if (wakeup_time > g_uptime)
return -EINTR;
Kernel: Use a lookup table for syscalls Instead of the big ugly switch statement, build a lookup table using the syscall enumeration macro. This greatly simplifies the syscall implementation. :^)
2019-11-09 21:18:16 +00:00
return 0;
}
Kernel: Implement very simple kernel module loading It's now possible to load a .o file into the kernel via a syscall. The kernel will perform all the necessary ELF relocations, and then call the "module_init" symbol in the loaded module.
2019-11-28 19:59:11 +00:00
Kernel: SMAP fixes for module_load() and module_unload() Remove SmapDisabler in module_load() + use get_syscall_path_argument(). Also fix a SMAP violation in module_unload().
2020-01-06 10:36:16 +00:00
int Process::sys$module_load(const char* user_path, size_t path_length)
Kernel: Implement very simple kernel module loading It's now possible to load a .o file into the kernel via a syscall. The kernel will perform all the necessary ELF relocations, and then call the "module_init" symbol in the loaded module.
2019-11-28 19:59:11 +00:00
{
if (!is_superuser())
return -EPERM;
Kernel: SMAP fixes for module_load() and module_unload() Remove SmapDisabler in module_load() + use get_syscall_path_argument(). Also fix a SMAP violation in module_unload().
2020-01-06 10:36:16 +00:00
ping: Use pledge()
2020-01-11 19:48:43 +00:00
REQUIRE_NO_PROMISES;
Kernel: SMAP fixes for module_load() and module_unload() Remove SmapDisabler in module_load() + use get_syscall_path_argument(). Also fix a SMAP violation in module_unload().
2020-01-06 10:36:16 +00:00
auto path = get_syscall_path_argument(user_path, path_length);
if (path.is_error())
return path.error();
Kernel: Pass correct permission flags when opening files Right now, permission flags passed to VFS::open() are effectively ignored, but that is going to change. * O_RDONLY is 0, but it's still nicer to pass it explicitly * POSIX says that binding a Unix socket to a symlink shall fail with EADDRINUSE
2020-01-18 22:04:48 +00:00
auto description_or_error = VFS::the().open(path.value(), O_RDONLY, 0, current_directory());
Kernel: Implement very simple kernel module loading It's now possible to load a .o file into the kernel via a syscall. The kernel will perform all the necessary ELF relocations, and then call the "module_init" symbol in the loaded module.
2019-11-28 19:59:11 +00:00
if (description_or_error.is_error())
return description_or_error.error();
auto& description = description_or_error.value();
auto payload = description->read_entire_file();
auto storage = KBuffer::create_with_size(payload.size());
memcpy(storage.data(), payload.data(), payload.size());
payload.clear();
Kernel+LibELF: Validate PT_LOAD and PT_TLS offsets before memcpy()'ing Before this, you could make the kernel copy memory from anywhere by setting up an ELF executable with a program header specifying file offsets outside the file. Since ELFImage didn't even know how large it was, we had no clue that we were copying things from outside the ELF. Fix this by adding a size field to ELFImage and validating program header ranges before memcpy()'ing to them. The ELF code is definitely going to need more validation and checking.
2020-01-06 20:04:57 +00:00
auto elf_image = make<ELFImage>(storage.data(), storage.size());
Kernel: Implement very simple kernel module loading It's now possible to load a .o file into the kernel via a syscall. The kernel will perform all the necessary ELF relocations, and then call the "module_init" symbol in the loaded module.
2019-11-28 19:59:11 +00:00
if (!elf_image->parse())
return -ENOEXEC;
HashMap<String, u8*> section_storage_by_name;
auto module = make<Module>();
elf_image->for_each_section_of_type(SHT_PROGBITS, [&](const ELFImage::Section& section) {
Kernel: Unbreak module loading (broke with NX bit changes) Modules are now mapped fully RWX. This can definitely be improved, but at least it unbreaks the feature for now.
2020-01-03 02:44:55 +00:00
auto section_storage = KBuffer::copy(section.raw_data(), section.size(), Region::Access::Read | Region::Access::Write | Region::Access::Execute);
Kernel: Implement very simple kernel module loading It's now possible to load a .o file into the kernel via a syscall. The kernel will perform all the necessary ELF relocations, and then call the "module_init" symbol in the loaded module.
2019-11-28 19:59:11 +00:00
section_storage_by_name.set(section.name(), section_storage.data());
module->sections.append(move(section_storage));
return IterationDecision::Continue;
});
Kernel: Fail module loading if any symbols can not be resolved
2019-12-24 03:09:18 +00:00
bool missing_symbols = false;
Kernel: Implement very simple kernel module loading It's now possible to load a .o file into the kernel via a syscall. The kernel will perform all the necessary ELF relocations, and then call the "module_init" symbol in the loaded module.
2019-11-28 19:59:11 +00:00
elf_image->for_each_section_of_type(SHT_PROGBITS, [&](const ELFImage::Section& section) {
auto* section_storage = section_storage_by_name.get(section.name()).value_or(nullptr);
ASSERT(section_storage);
section.relocations().for_each_relocation([&](const ELFImage::Relocation& relocation) {
auto& patch_ptr = *reinterpret_cast<ptrdiff_t*>(section_storage + relocation.offset());
switch (relocation.type()) {
case R_386_PC32: {
// PC-relative relocation
dbg() << "PC-relative relocation: " << relocation.symbol().name();
Kernel: Allow modules to link against anything in kernel.map :^) We now use the symbols from kernel.map to link modules as they are loaded into the kernel. This is pretty fricken cool!
2019-11-28 20:30:20 +00:00
u32 symbol_address = address_for_kernel_symbol(relocation.symbol().name());
Kernel: Fail module loading if any symbols can not be resolved
2019-12-24 03:09:18 +00:00
if (symbol_address == 0)
missing_symbols = true;
Kernel: Implement very simple kernel module loading It's now possible to load a .o file into the kernel via a syscall. The kernel will perform all the necessary ELF relocations, and then call the "module_init" symbol in the loaded module.
2019-11-28 19:59:11 +00:00
dbg() << " Symbol address: " << (void*)symbol_address;
ptrdiff_t relative_offset = (char*)symbol_address - ((char*)&patch_ptr + 4);
patch_ptr = relative_offset;
break;
}
case R_386_32: // Absolute relocation
dbg() << "Absolute relocation: '" << relocation.symbol().name() << "' value:" << relocation.symbol().value() << ", index:" << relocation.symbol_index();
Kernel: Allow modules to link against anything in kernel.map :^) We now use the symbols from kernel.map to link modules as they are loaded into the kernel. This is pretty fricken cool!
2019-11-28 20:30:20 +00:00
if (relocation.symbol().bind() == STB_LOCAL) {
auto* section_storage_containing_symbol = section_storage_by_name.get(relocation.symbol().section().name()).value_or(nullptr);
ASSERT(section_storage_containing_symbol);
Kernel: Fail module loading if any symbols can not be resolved
2019-12-24 03:09:18 +00:00
u32 symbol_address = (ptrdiff_t)(section_storage_containing_symbol + relocation.symbol().value());
if (symbol_address == 0)
missing_symbols = true;
dbg() << " Symbol address: " << (void*)symbol_address;
patch_ptr += symbol_address;
Kernel: Allow modules to link against anything in kernel.map :^) We now use the symbols from kernel.map to link modules as they are loaded into the kernel. This is pretty fricken cool!
2019-11-28 20:30:20 +00:00
} else if (relocation.symbol().bind() == STB_GLOBAL) {
Kernel: Fail module loading if any symbols can not be resolved
2019-12-24 03:09:18 +00:00
u32 symbol_address = address_for_kernel_symbol(relocation.symbol().name());
if (symbol_address == 0)
missing_symbols = true;
dbg() << " Symbol address: " << (void*)symbol_address;
patch_ptr += symbol_address;
Kernel: Allow modules to link against anything in kernel.map :^) We now use the symbols from kernel.map to link modules as they are loaded into the kernel. This is pretty fricken cool!
2019-11-28 20:30:20 +00:00
} else {
ASSERT_NOT_REACHED();
}
Kernel: Implement very simple kernel module loading It's now possible to load a .o file into the kernel via a syscall. The kernel will perform all the necessary ELF relocations, and then call the "module_init" symbol in the loaded module.
2019-11-28 19:59:11 +00:00
break;
}
return IterationDecision::Continue;
});
return IterationDecision::Continue;
});
Kernel: Fail module loading if any symbols can not be resolved
2019-12-24 03:09:18 +00:00
if (missing_symbols)
Kernel: Do not return ENOENT for unresolved symbols ENOENT means "no such file or directory", not "no such symbol". Return EINVAL instead, as we already do in other cases.
2020-01-18 22:22:40 +00:00
return -EINVAL;
Kernel: Fail module loading if any symbols can not be resolved
2019-12-24 03:09:18 +00:00
Kernel: Implement very simple kernel module loading It's now possible to load a .o file into the kernel via a syscall. The kernel will perform all the necessary ELF relocations, and then call the "module_init" symbol in the loaded module.
2019-11-28 19:59:11 +00:00
auto* text_base = section_storage_by_name.get(".text").value_or(nullptr);
if (!text_base) {
dbg() << "No .text section found in module!";
return -EINVAL;
}
elf_image->for_each_symbol([&](const ELFImage::Symbol& symbol) {
dbg() << " - " << symbol.type() << " '" << symbol.name() << "' @ " << (void*)symbol.value() << ", size=" << symbol.size();
Kernel+LibELF: Don't blindly trust ELF symbol offsets in symbolication It was possible to craft a custom ELF executable that when symbolicated would cause the kernel to read from user-controlled addresses anywhere in memory. You could then fetch this memory via /proc/PID/stack We fix this by making ELFImage hand out StringView rather than raw const char* for symbol names. In case a symbol offset is outside the ELF image, you get a null StringView. :^) Test: Kernel/elf-symbolication-kernel-read-exploit.cpp
2020-01-16 21:04:44 +00:00
if (symbol.name() == "module_init") {
Kernel: Implement basic module unloading :^) Kernel modules can now be unloaded via a syscall. They get a chance to run some code of course. Before deallocating them, we call their "module_fini" symbol.
2019-11-28 20:07:22 +00:00
module->module_init = (ModuleInitPtr)(text_base + symbol.value());
Kernel+LibELF: Don't blindly trust ELF symbol offsets in symbolication It was possible to craft a custom ELF executable that when symbolicated would cause the kernel to read from user-controlled addresses anywhere in memory. You could then fetch this memory via /proc/PID/stack We fix this by making ELFImage hand out StringView rather than raw const char* for symbol names. In case a symbol offset is outside the ELF image, you get a null StringView. :^) Test: Kernel/elf-symbolication-kernel-read-exploit.cpp
2020-01-16 21:04:44 +00:00
} else if (symbol.name() == "module_fini") {
Kernel: Implement basic module unloading :^) Kernel modules can now be unloaded via a syscall. They get a chance to run some code of course. Before deallocating them, we call their "module_fini" symbol.
2019-11-28 20:07:22 +00:00
module->module_fini = (ModuleFiniPtr)(text_base + symbol.value());
Kernel+LibELF: Don't blindly trust ELF symbol offsets in symbolication It was possible to craft a custom ELF executable that when symbolicated would cause the kernel to read from user-controlled addresses anywhere in memory. You could then fetch this memory via /proc/PID/stack We fix this by making ELFImage hand out StringView rather than raw const char* for symbol names. In case a symbol offset is outside the ELF image, you get a null StringView. :^) Test: Kernel/elf-symbolication-kernel-read-exploit.cpp
2020-01-16 21:04:44 +00:00
} else if (symbol.name() == "module_name") {
Kernel: Have modules export their name in a "module_name" string This will show up in /proc/modules, and is also the name you can pass to the module_unload() syscall for unloading the module.
2019-11-29 20:31:17 +00:00
const u8* storage = section_storage_by_name.get(symbol.section().name()).value_or(nullptr);
if (storage)
module->name = String((const char*)(storage + symbol.value()));
Kernel: Implement very simple kernel module loading It's now possible to load a .o file into the kernel via a syscall. The kernel will perform all the necessary ELF relocations, and then call the "module_init" symbol in the loaded module.
2019-11-28 19:59:11 +00:00
}
return IterationDecision::Continue;
});
Kernel: Implement basic module unloading :^) Kernel modules can now be unloaded via a syscall. They get a chance to run some code of course. Before deallocating them, we call their "module_fini" symbol.
2019-11-28 20:07:22 +00:00
if (!module->module_init)
Kernel: Implement very simple kernel module loading It's now possible to load a .o file into the kernel via a syscall. The kernel will perform all the necessary ELF relocations, and then call the "module_init" symbol in the loaded module.
2019-11-28 19:59:11 +00:00
return -EINVAL;
Kernel: Disallow loading a module twice without explicitly unloading it This ensures that a module has the chance to run its cleanup functions before it's taken out of service.
2019-12-24 00:40:26 +00:00
if (g_modules->contains(module->name)) {
dbg() << "a module with the name " << module->name << " is already loaded; please unload it first";
return -EEXIST;
}
Kernel: Implement basic module unloading :^) Kernel modules can now be unloaded via a syscall. They get a chance to run some code of course. Before deallocating them, we call their "module_fini" symbol.
2019-11-28 20:07:22 +00:00
module->module_init();
Kernel: Implement very simple kernel module loading It's now possible to load a .o file into the kernel via a syscall. The kernel will perform all the necessary ELF relocations, and then call the "module_init" symbol in the loaded module.
2019-11-28 19:59:11 +00:00
auto name = module->name;
g_modules->set(name, move(module));
return 0;
}
Kernel: Use the Syscall string and buffer types more While I was updating syscalls to stop passing null-terminated strings, I added some helpful struct types: - StringArgument { const char*; size_t; } - ImmutableBuffer<Data, Size> { const Data*; Size; } - MutableBuffer<Data, Size> { Data*; Size; } The Process class has some convenience functions for validating and optionally extracting the contents from these structs: - get_syscall_path_argument(StringArgument) - validate_and_copy_string_from_user(StringArgument) - validate(ImmutableBuffer) - validate(MutableBuffer) There's still so much code around this and I'm wondering if we should generate most of it instead. Possible nice little project.
2020-01-11 11:47:47 +00:00
int Process::sys$module_unload(const char* user_name, size_t name_length)
Kernel: Implement very simple kernel module loading It's now possible to load a .o file into the kernel via a syscall. The kernel will perform all the necessary ELF relocations, and then call the "module_init" symbol in the loaded module.
2019-11-28 19:59:11 +00:00
{
if (!is_superuser())
return -EPERM;
Kernel: Implement basic module unloading :^) Kernel modules can now be unloaded via a syscall. They get a chance to run some code of course. Before deallocating them, we call their "module_fini" symbol.
2019-11-28 20:07:22 +00:00
ping: Use pledge()
2020-01-11 19:48:43 +00:00
REQUIRE_NO_PROMISES;
Kernel: Use the Syscall string and buffer types more While I was updating syscalls to stop passing null-terminated strings, I added some helpful struct types: - StringArgument { const char*; size_t; } - ImmutableBuffer<Data, Size> { const Data*; Size; } - MutableBuffer<Data, Size> { Data*; Size; } The Process class has some convenience functions for validating and optionally extracting the contents from these structs: - get_syscall_path_argument(StringArgument) - validate_and_copy_string_from_user(StringArgument) - validate(ImmutableBuffer) - validate(MutableBuffer) There's still so much code around this and I'm wondering if we should generate most of it instead. Possible nice little project.
2020-01-11 11:47:47 +00:00
auto module_name = validate_and_copy_string_from_user(user_name, name_length);
if (module_name.is_null())
return -EFAULT;
Kernel: SMAP fixes for module_load() and module_unload() Remove SmapDisabler in module_load() + use get_syscall_path_argument(). Also fix a SMAP violation in module_unload().
2020-01-06 10:36:16 +00:00
auto it = g_modules->find(module_name);
Kernel: Implement basic module unloading :^) Kernel modules can now be unloaded via a syscall. They get a chance to run some code of course. Before deallocating them, we call their "module_fini" symbol.
2019-11-28 20:07:22 +00:00
if (it == g_modules->end())
return -ENOENT;
if (it->value->module_fini)
it->value->module_fini();
g_modules->remove(it);
Kernel: Implement very simple kernel module loading It's now possible to load a .o file into the kernel via a syscall. The kernel will perform all the necessary ELF relocations, and then call the "module_init" symbol in the loaded module.
2019-11-28 19:59:11 +00:00
return 0;
}
Kernel: Implement a simple process time profiler The kernel now supports basic profiling of all the threads in a process by calling profiling_enable(pid_t). You finish the profiling by calling profiling_disable(pid_t). This all works by recording thread stacks when the timer interrupt fires and the current thread is in a process being profiled. Note that symbolication is deferred until profiling_disable() to avoid adding more noise than necessary to the profile. A simple "/bin/profile" command is included here that can be used to start/stop profiling like so: $ profile 10 on ... wait ... $ profile 10 off After a profile has been recorded, it can be fetched in /proc/profile There are various limits (or "bugs") on this mechanism at the moment: - Only one process can be profiled at a time. - We allocate 8MB for the samples, if you use more space, things will not work, and probably break a bit. - Things will probably fall apart if the profiled process dies during profiling, or while extracing /proc/profile
2019-12-11 19:36:56 +00:00
int Process::sys$profiling_enable(pid_t pid)
{
ping: Use pledge()
2020-01-11 19:48:43 +00:00
REQUIRE_NO_PROMISES;
Kernel: Implement a simple process time profiler The kernel now supports basic profiling of all the threads in a process by calling profiling_enable(pid_t). You finish the profiling by calling profiling_disable(pid_t). This all works by recording thread stacks when the timer interrupt fires and the current thread is in a process being profiled. Note that symbolication is deferred until profiling_disable() to avoid adding more noise than necessary to the profile. A simple "/bin/profile" command is included here that can be used to start/stop profiling like so: $ profile 10 on ... wait ... $ profile 10 off After a profile has been recorded, it can be fetched in /proc/profile There are various limits (or "bugs") on this mechanism at the moment: - Only one process can be profiled at a time. - We allocate 8MB for the samples, if you use more space, things will not work, and probably break a bit. - Things will probably fall apart if the profiled process dies during profiling, or while extracing /proc/profile
2019-12-11 19:36:56 +00:00
InterruptDisabler disabler;
auto* process = Process::from_pid(pid);
if (!process)
return -ESRCH;
if (!is_superuser() && process->uid() != m_uid)
return -EPERM;
Profiling::start(*process);
process->set_profiling(true);
return 0;
}
int Process::sys$profiling_disable(pid_t pid)
{
InterruptDisabler disabler;
auto* process = Process::from_pid(pid);
if (!process)
return -ESRCH;
if (!is_superuser() && process->uid() != m_uid)
return -EPERM;
process->set_profiling(false);
Profiling::stop();
return 0;
}
Kernel+LibC: Publish a "kernel info page" and use it for gettimeofday() This patch adds a single "kernel info page" that is mappable read-only by any process and contains the current time of day. This is then used to implement a version of gettimeofday() that doesn't have to make a syscall. To protect against race condition issues, the info page also has a serial number which is incremented whenever the kernel updates the contents of the page. Make sure to verify that the serial number is the same before and after reading the information you want from the page.
2019-12-15 20:29:26 +00:00
void* Process::sys$get_kernel_info_page()
{
Kernel: Put some more syscalls in the "stdio" bucket yield() and get_kernel_info_page() seem like decent fits for "stdio".
2020-01-12 09:30:02 +00:00
REQUIRE_PROMISE(stdio);
Kernel: Make sure the kernel info page is read-only for userspace To enforce this, we create two separate mappings of the same underlying physical page. A writable mapping for the kernel, and a read-only one for userspace (the one returned by sys$get_kernel_info_page.)
2019-12-15 21:21:28 +00:00
return s_info_page_address_for_userspace.as_ptr();
Kernel+LibC: Publish a "kernel info page" and use it for gettimeofday() This patch adds a single "kernel info page" that is mappable read-only by any process and contains the current time of day. This is then used to implement a version of gettimeofday() that doesn't have to make a syscall. To protect against race condition issues, the info page also has a serial number which is incremented whenever the kernel updates the contents of the page. Make sure to verify that the serial number is the same before and after reading the information you want from the page.
2019-12-15 20:29:26 +00:00
}
Kernel: Get rid of "main thread" concept The idea of all processes reliably having a main thread was nice in some ways, but cumbersome in others. More importantly, it didn't match up with POSIX thread semantics, so let's move away from it. This thread gets rid of Process::main_thread() and you now we just have a bunch of Thread objects floating around each Process. When the finalizer nukes the last Thread in a Process, it will also tear down the Process. There's a bunch of more things to fix around this, but this is where we get started :^)
2019-12-22 10:35:02 +00:00
Thread& Process::any_thread()
{
Thread* found_thread = nullptr;
for_each_thread([&](auto& thread) {
found_thread = &thread;
return IterationDecision::Break;
});
ASSERT(found_thread);
return *found_thread;
}
Kernel+LibPthread+LibC: Add a naive futex and use it for pthread_cond_t This patch implements a simple version of the futex (fast userspace mutex) API in the kernel and uses it to make the pthread_cond_t API's block instead of busily sched_yield(). An arbitrary userspace address is passed to the kernel as a "token" that identifies the futex and you can then FUTEX_WAIT and FUTEX_WAKE that specific userspace address. FUTEX_WAIT corresponds to pthread_cond_wait() and FUTEX_WAKE is used for pthread_cond_signal() and pthread_cond_broadcast(). I'm pretty sure I'm missing something in this implementation, but it's hopefully okay for a start. :^)
2019-12-22 20:29:47 +00:00
WaitQueue& Process::futex_queue(i32* userspace_address)
{
Use uintptr_t instead of u32 when storing pointers as integers uintptr_t is 32-bit or 64-bit depending on the target platform. This will help us write pointer size agnostic code so that when the day comes that we want to do a 64-bit port, we'll be in better shape.
2020-01-20 12:06:14 +00:00
auto& queue = m_futex_queues.ensure((uintptr_t)userspace_address);
Kernel+LibPthread+LibC: Add a naive futex and use it for pthread_cond_t This patch implements a simple version of the futex (fast userspace mutex) API in the kernel and uses it to make the pthread_cond_t API's block instead of busily sched_yield(). An arbitrary userspace address is passed to the kernel as a "token" that identifies the futex and you can then FUTEX_WAIT and FUTEX_WAKE that specific userspace address. FUTEX_WAIT corresponds to pthread_cond_wait() and FUTEX_WAKE is used for pthread_cond_signal() and pthread_cond_broadcast(). I'm pretty sure I'm missing something in this implementation, but it's hopefully okay for a start. :^)
2019-12-22 20:29:47 +00:00
if (!queue)
queue = make<WaitQueue>();
return *queue;
}
Kernel: Remove SmapDisabler in futex()
2020-01-06 10:44:15 +00:00
int Process::sys$futex(const Syscall::SC_futex_params* user_params)
Kernel+LibPthread+LibC: Add a naive futex and use it for pthread_cond_t This patch implements a simple version of the futex (fast userspace mutex) API in the kernel and uses it to make the pthread_cond_t API's block instead of busily sched_yield(). An arbitrary userspace address is passed to the kernel as a "token" that identifies the futex and you can then FUTEX_WAIT and FUTEX_WAKE that specific userspace address. FUTEX_WAIT corresponds to pthread_cond_wait() and FUTEX_WAKE is used for pthread_cond_signal() and pthread_cond_broadcast(). I'm pretty sure I'm missing something in this implementation, but it's hopefully okay for a start. :^)
2019-12-22 20:29:47 +00:00
{
Kernel: Require the "thread" pledge promise for futex()
2020-01-12 09:27:42 +00:00
REQUIRE_PROMISE(thread);
Kernel+LibPthread+LibC: Add a naive futex and use it for pthread_cond_t This patch implements a simple version of the futex (fast userspace mutex) API in the kernel and uses it to make the pthread_cond_t API's block instead of busily sched_yield(). An arbitrary userspace address is passed to the kernel as a "token" that identifies the futex and you can then FUTEX_WAIT and FUTEX_WAKE that specific userspace address. FUTEX_WAIT corresponds to pthread_cond_wait() and FUTEX_WAKE is used for pthread_cond_signal() and pthread_cond_broadcast(). I'm pretty sure I'm missing something in this implementation, but it's hopefully okay for a start. :^)
2019-12-22 20:29:47 +00:00
Kernel: Remove SmapDisabler in futex()
2020-01-06 10:44:15 +00:00
Syscall::SC_futex_params params;
Kernel: Combine validate and copy of user mode pointers (#1069) Right now there is a significant amount of boiler plate code required to validate user mode parameters in syscalls. In an attempt to reduce this a bit, introduce validate_read_and_copy_typed which combines the usermode address check and does the copy internally if the validation passes. This cleans up a little bit of code from a significant amount of syscalls.
2020-01-13 10:19:18 +00:00
if (!validate_read_and_copy_typed(&params, user_params))
return -EFAULT;
Kernel: Start implementing x86 SMAP support Supervisor Mode Access Prevention (SMAP) is an x86 CPU feature that prevents the kernel from accessing userspace memory. With SMAP enabled, trying to read/write a userspace memory address while in the kernel will now generate a page fault. Since it's sometimes necessary to read/write userspace memory, there are two new instructions that quickly switch the protection on/off: STAC (disables protection) and CLAC (enables protection.) These are exposed in kernel code via the stac() and clac() helpers. There's also a SmapDisabler RAII object that can be used to ensure that you don't forget to re-enable protection before returning to userspace code. THis patch also adds copy_to_user(), copy_from_user() and memset_user() which are the "correct" way of doing things. These functions allow us to briefly disable protection for a specific purpose, and then turn it back on immediately after it's done. Going forward all kernel code should be moved to using these and all uses of SmapDisabler are to be considered FIXME's. Note that we're not realizing the full potential of this feature since I've used SmapDisabler quite liberally in this initial bring-up patch.
2020-01-05 17:00:15 +00:00
Kernel: Remove SmapDisabler in futex()
2020-01-06 10:44:15 +00:00
i32* userspace_address = params.userspace_address;
int futex_op = params.futex_op;
i32 value = params.val;
const timespec* user_timeout = params.timeout;
Kernel+LibPthread+LibC: Add a naive futex and use it for pthread_cond_t This patch implements a simple version of the futex (fast userspace mutex) API in the kernel and uses it to make the pthread_cond_t API's block instead of busily sched_yield(). An arbitrary userspace address is passed to the kernel as a "token" that identifies the futex and you can then FUTEX_WAIT and FUTEX_WAKE that specific userspace address. FUTEX_WAIT corresponds to pthread_cond_wait() and FUTEX_WAKE is used for pthread_cond_signal() and pthread_cond_broadcast(). I'm pretty sure I'm missing something in this implementation, but it's hopefully okay for a start. :^)
2019-12-22 20:29:47 +00:00
if (!validate_read_typed(userspace_address))
return -EFAULT;
Kernel: Remove SmapDisabler in futex()
2020-01-06 10:44:15 +00:00
if (user_timeout && !validate_read_typed(user_timeout))
Kernel+LibPthread+LibC: Add a naive futex and use it for pthread_cond_t This patch implements a simple version of the futex (fast userspace mutex) API in the kernel and uses it to make the pthread_cond_t API's block instead of busily sched_yield(). An arbitrary userspace address is passed to the kernel as a "token" that identifies the futex and you can then FUTEX_WAIT and FUTEX_WAKE that specific userspace address. FUTEX_WAIT corresponds to pthread_cond_wait() and FUTEX_WAKE is used for pthread_cond_signal() and pthread_cond_broadcast(). I'm pretty sure I'm missing something in this implementation, but it's hopefully okay for a start. :^)
2019-12-22 20:29:47 +00:00
return -EFAULT;
Kernel: Remove SmapDisabler in futex()
2020-01-06 10:44:15 +00:00
timespec timeout { 0, 0 };
if (user_timeout)
Kernel: Use the templated copy_from_user where possible Now that the templated version of copy_from_user exists their is normally no reason to use the version which takes the number of bytes to copy. Move to the templated version where possible.
2020-01-13 07:00:35 +00:00
copy_from_user(&timeout, user_timeout);
Kernel: Remove SmapDisabler in futex()
2020-01-06 10:44:15 +00:00
i32 user_value;
Kernel+LibPthread+LibC: Add a naive futex and use it for pthread_cond_t This patch implements a simple version of the futex (fast userspace mutex) API in the kernel and uses it to make the pthread_cond_t API's block instead of busily sched_yield(). An arbitrary userspace address is passed to the kernel as a "token" that identifies the futex and you can then FUTEX_WAIT and FUTEX_WAKE that specific userspace address. FUTEX_WAIT corresponds to pthread_cond_wait() and FUTEX_WAKE is used for pthread_cond_signal() and pthread_cond_broadcast(). I'm pretty sure I'm missing something in this implementation, but it's hopefully okay for a start. :^)
2019-12-22 20:29:47 +00:00
switch (futex_op) {
case FUTEX_WAIT:
Kernel: Use the templated copy_from_user where possible Now that the templated version of copy_from_user exists their is normally no reason to use the version which takes the number of bytes to copy. Move to the templated version where possible.
2020-01-13 07:00:35 +00:00
copy_from_user(&user_value, userspace_address);
Kernel: Remove SmapDisabler in futex()
2020-01-06 10:44:15 +00:00
if (user_value != value)
Kernel+LibPthread+LibC: Add a naive futex and use it for pthread_cond_t This patch implements a simple version of the futex (fast userspace mutex) API in the kernel and uses it to make the pthread_cond_t API's block instead of busily sched_yield(). An arbitrary userspace address is passed to the kernel as a "token" that identifies the futex and you can then FUTEX_WAIT and FUTEX_WAKE that specific userspace address. FUTEX_WAIT corresponds to pthread_cond_wait() and FUTEX_WAKE is used for pthread_cond_signal() and pthread_cond_broadcast(). I'm pretty sure I'm missing something in this implementation, but it's hopefully okay for a start. :^)
2019-12-22 20:29:47 +00:00
return -EAGAIN;
// FIXME: This is supposed to be interruptible by a signal, but right now WaitQueue cannot be interrupted.
// FIXME: Support timeout!
current->wait_on(futex_queue(userspace_address));
break;
case FUTEX_WAKE:
if (value == 0)
return 0;
if (value == 1) {
futex_queue(userspace_address).wake_one();
} else {
// FIXME: Wake exactly (value) waiters.
futex_queue(userspace_address).wake_all();
}
break;
}
return 0;
}
Kernel: Add a basic thread boosting mechanism This patch introduces a syscall: int set_thread_boost(int tid, int amount) You can use this to add a permanent boost value to the effective thread priority of any thread with your UID (or any thread in the system if you are the superuser.) This is quite crude, but opens up some interesting opportunities. :^)
2019-12-30 18:23:13 +00:00
int Process::sys$set_thread_boost(int tid, int amount)
{
ping: Use pledge()
2020-01-11 19:48:43 +00:00
REQUIRE_PROMISE(proc);
Kernel: Add a basic thread boosting mechanism This patch introduces a syscall: int set_thread_boost(int tid, int amount) You can use this to add a permanent boost value to the effective thread priority of any thread with your UID (or any thread in the system if you are the superuser.) This is quite crude, but opens up some interesting opportunities. :^)
2019-12-30 18:23:13 +00:00
if (amount < 0 || amount > 20)
return -EINVAL;
InterruptDisabler disabler;
auto* thread = Thread::from_tid(tid);
if (!thread)
return -ESRCH;
if (thread->state() == Thread::State::Dead || thread->state() == Thread::State::Dying)
return -ESRCH;
if (!is_superuser() && thread->process().uid() != euid())
return -EPERM;
thread->set_priority_boost(amount);
return 0;
}
Kernel: Also add a process boosting mechanism Let's also have set_process_boost() for giving all threads in a process the same boost.
2019-12-30 19:10:00 +00:00
int Process::sys$set_process_boost(pid_t pid, int amount)
{
ping: Use pledge()
2020-01-11 19:48:43 +00:00
REQUIRE_PROMISE(proc);
Kernel: Also add a process boosting mechanism Let's also have set_process_boost() for giving all threads in a process the same boost.
2019-12-30 19:10:00 +00:00
if (amount < 0 || amount > 20)
return -EINVAL;
InterruptDisabler disabler;
auto* process = Process::from_pid(pid);
if (!process || process->is_dead())
return -ESRCH;
if (!is_superuser() && process->uid() != euid())
return -EPERM;
process->m_priority_boost = amount;
return 0;
}
Kernel: Add a basic chroot() syscall :^) The chroot() syscall now allows the superuser to isolate a process into a specific subtree of the filesystem. This is not strictly permanent, as it is also possible for a superuser to break *out* of a chroot, but it is a useful mechanism for isolating unprivileged processes. The VFS now uses the current process's root_directory() as the root for path resolution purposes. The root directory is stored as an uncached Custody in the Process object.
2020-01-10 22:14:04 +00:00
Kernel: Don't forget to copy & destroy root_directory_for_procfs Also, rename it to root_directory_relative_to_global_root.
2020-01-12 18:42:01 +00:00
int Process::sys$chroot(const char* user_path, size_t path_length, int mount_flags)
Kernel: Add a basic chroot() syscall :^) The chroot() syscall now allows the superuser to isolate a process into a specific subtree of the filesystem. This is not strictly permanent, as it is also possible for a superuser to break *out* of a chroot, but it is a useful mechanism for isolating unprivileged processes. The VFS now uses the current process's root_directory() as the root for path resolution purposes. The root directory is stored as an uncached Custody in the Process object.
2020-01-10 22:14:04 +00:00
{
if (!is_superuser())
return -EPERM;
ping: Use pledge()
2020-01-11 19:48:43 +00:00
REQUIRE_PROMISE(chroot);
Kernel: Add a basic chroot() syscall :^) The chroot() syscall now allows the superuser to isolate a process into a specific subtree of the filesystem. This is not strictly permanent, as it is also possible for a superuser to break *out* of a chroot, but it is a useful mechanism for isolating unprivileged processes. The VFS now uses the current process's root_directory() as the root for path resolution purposes. The root directory is stored as an uncached Custody in the Process object.
2020-01-10 22:14:04 +00:00
auto path = get_syscall_path_argument(user_path, path_length);
if (path.is_error())
return path.error();
auto directory_or_error = VFS::the().open_directory(path.value(), current_directory());
if (directory_or_error.is_error())
return directory_or_error.error();
Kernel+LibC: Add support for mount flags At the moment, the actual flags are ignored, but we correctly propagate them all the way from the original mount() syscall to each custody that resides on the mounted FS.
2020-01-11 15:25:26 +00:00
auto directory = directory_or_error.value();
Kernel+LibC: Allow passing mount flags to chroot() Since a chroot is in many ways similar to a separate root mount, we can also apply mount flags to it as if it was an actual mount. These flags will apply whenever the chrooted process accesses its root directory, but not when other processes access this same directory for the outside. Since it's common to chdir("/") immediately after chrooting (so that files accessed through the current directory inherit the same mount flags), this effectively allows one to apply additional limitations to a process confined inside a chroot. To this effect, sys$chroot() gains a mount_flags argument (exposed as chroot_with_mount_flags() in userspace) which can be set to all the same values as the flags argument for sys$mount(), and additionally to -1 to keep the flags set for that file system. Note that passing 0 as mount_flags will unset any flags that may have been set for the file system, not keep them.
2020-01-12 18:03:42 +00:00
m_root_directory_relative_to_global_root = directory;
int chroot_mount_flags = mount_flags == -1 ? directory->mount_flags() : mount_flags;
set_root_directory(Custody::create(nullptr, "", directory->inode(), chroot_mount_flags));
Kernel: Add a basic chroot() syscall :^) The chroot() syscall now allows the superuser to isolate a process into a specific subtree of the filesystem. This is not strictly permanent, as it is also possible for a superuser to break *out* of a chroot, but it is a useful mechanism for isolating unprivileged processes. The VFS now uses the current process's root_directory() as the root for path resolution purposes. The root directory is stored as an uncached Custody in the Process object.
2020-01-10 22:14:04 +00:00
return 0;
}
Custody& Process::root_directory()
{
if (!m_root_directory)
m_root_directory = VFS::the().root_custody();
return *m_root_directory;
}
Kernel: Don't forget to copy & destroy root_directory_for_procfs Also, rename it to root_directory_relative_to_global_root.
2020-01-12 18:42:01 +00:00
Custody& Process::root_directory_relative_to_global_root()
Kernel: Expose a process's filesystem root as a /proc/PID/root symlink In order to preserve the absolute path of the process root, we save the custody used by chroot() before stripping it to become the new "/". There's probably a better way to do this.
2020-01-10 22:48:44 +00:00
{
Kernel: Don't forget to copy & destroy root_directory_for_procfs Also, rename it to root_directory_relative_to_global_root.
2020-01-12 18:42:01 +00:00
if (!m_root_directory_relative_to_global_root)
m_root_directory_relative_to_global_root = root_directory();
return *m_root_directory_relative_to_global_root;
Kernel: Expose a process's filesystem root as a /proc/PID/root symlink In order to preserve the absolute path of the process root, we save the custody used by chroot() before stripping it to become the new "/". There's probably a better way to do this.
2020-01-10 22:48:44 +00:00
}
Kernel: Add a basic chroot() syscall :^) The chroot() syscall now allows the superuser to isolate a process into a specific subtree of the filesystem. This is not strictly permanent, as it is also possible for a superuser to break *out* of a chroot, but it is a useful mechanism for isolating unprivileged processes. The VFS now uses the current process's root_directory() as the root for path resolution purposes. The root directory is stored as an uncached Custody in the Process object.
2020-01-10 22:14:04 +00:00
void Process::set_root_directory(const Custody& root)
{
m_root_directory = root;
}
ping: Use pledge()
2020-01-11 19:48:43 +00:00
int Process::sys$pledge(const Syscall::SC_pledge_params* user_params)
{
Syscall::SC_pledge_params params;
Kernel: Combine validate and copy of user mode pointers (#1069) Right now there is a significant amount of boiler plate code required to validate user mode parameters in syscalls. In an attempt to reduce this a bit, introduce validate_read_and_copy_typed which combines the usermode address check and does the copy internally if the validation passes. This cleans up a little bit of code from a significant amount of syscalls.
2020-01-13 10:19:18 +00:00
if (!validate_read_and_copy_typed(&params, user_params))
return -EFAULT;
ping: Use pledge()
2020-01-11 19:48:43 +00:00
if (params.promises.length > 1024 || params.execpromises.length > 1024)
return -E2BIG;
String promises;
if (params.promises.characters) {
promises = validate_and_copy_string_from_user(params.promises);
if (promises.is_null())
return -EFAULT;
}
String execpromises;
if (params.execpromises.characters) {
execpromises = validate_and_copy_string_from_user(params.execpromises);
if (execpromises.is_null())
return -EFAULT;
}
auto parse_pledge = [&](auto& pledge_spec, u32& mask) {
auto parts = pledge_spec.split_view(' ');
for (auto& part : parts) {
#define __ENUMERATE_PLEDGE_PROMISE(x) \
if (part == #x) { \
mask |= (1u << (u32)Pledge::x); \
continue; \
}
ENUMERATE_PLEDGE_PROMISES
#undef __ENUMERATE_PLEDGE_PROMISE
if (part == "dns") {
// "dns" is an alias for "unix" since DNS queries go via LookupServer
mask |= (1u << (u32)Pledge::unix);
continue;
}
return false;
}
return true;
};
if (!promises.is_null()) {
u32 new_promises = 0;
if (!parse_pledge(promises, new_promises))
return -EINVAL;
Kernel: Clearing promises with pledge("") should fail Thanks Sergey for catching this brain-fart. :^)
2020-01-12 11:14:08 +00:00
if (m_promises && (!new_promises || new_promises & ~m_promises))
ping: Use pledge()
2020-01-11 19:48:43 +00:00
return -EPERM;
m_promises = new_promises;
}
if (!execpromises.is_null()) {
u32 new_execpromises = 0;
if (!parse_pledge(execpromises, new_execpromises))
return -EINVAL;
Kernel: Clearing promises with pledge("") should fail Thanks Sergey for catching this brain-fart. :^)
2020-01-12 11:14:08 +00:00
if (m_execpromises && (!new_execpromises || new_execpromises & ~m_execpromises))
ping: Use pledge()
2020-01-11 19:48:43 +00:00
return -EPERM;
m_execpromises = new_execpromises;
}
return 0;
}
Kernel: Add a Process::add_region() helper This is a private helper for adding a Region to Process::m_regions. It's just for convenience since it's a bit cumbersome to do this.
2020-01-19 15:25:38 +00:00
Region& Process::add_region(NonnullOwnPtr<Region> region)
{
auto* ptr = region.ptr();
m_regions.append(move(region));
return *ptr;
}
Kernel: Add a basic implementation of unveil() This syscall is a complement to pledge() and adds the same sort of incremental relinquishing of capabilities for filesystem access. The first call to unveil() will "drop a veil" on the process, and from now on, only unveiled parts of the filesystem are visible to it. Each call to unveil() specifies a path to either a directory or a file along with permissions for that path. The permissions are a combination of the following: - r: Read access (like the "rpath" promise) - w: Write access (like the "wpath" promise) - x: Execute access - c: Create/remove access (like the "cpath" promise) Attempts to open a path that has not been unveiled with fail with ENOENT. If the unveiled path lacks sufficient permissions, it will fail with EACCES. Like pledge(), subsequent calls to unveil() with the same path can only remove permissions, not add them. Once you call unveil(nullptr, nullptr), the veil is locked, and it's no longer possible to unveil any more paths for the process, ever. This concept comes from OpenBSD, and their implementation does various things differently, I'm sure. This is just a first implementation for SerenityOS, and we'll keep improving on it as we go. :^)
2020-01-20 21:12:04 +00:00
int Process::sys$unveil(const Syscall::SC_unveil_params* user_params)
{
Syscall::SC_unveil_params params;
if (!validate_read_and_copy_typed(&params, user_params))
return -EFAULT;
if (!params.path.characters && !params.permissions.characters) {
Kernel: Rename UnveilState to VeilState
2020-01-21 18:28:29 +00:00
m_veil_state = VeilState::Locked;
Kernel: Add a basic implementation of unveil() This syscall is a complement to pledge() and adds the same sort of incremental relinquishing of capabilities for filesystem access. The first call to unveil() will "drop a veil" on the process, and from now on, only unveiled parts of the filesystem are visible to it. Each call to unveil() specifies a path to either a directory or a file along with permissions for that path. The permissions are a combination of the following: - r: Read access (like the "rpath" promise) - w: Write access (like the "wpath" promise) - x: Execute access - c: Create/remove access (like the "cpath" promise) Attempts to open a path that has not been unveiled with fail with ENOENT. If the unveiled path lacks sufficient permissions, it will fail with EACCES. Like pledge(), subsequent calls to unveil() with the same path can only remove permissions, not add them. Once you call unveil(nullptr, nullptr), the veil is locked, and it's no longer possible to unveil any more paths for the process, ever. This concept comes from OpenBSD, and their implementation does various things differently, I'm sure. This is just a first implementation for SerenityOS, and we'll keep improving on it as we go. :^)
2020-01-20 21:12:04 +00:00
return 0;
}
Kernel: Rename UnveilState to VeilState
2020-01-21 18:28:29 +00:00
if (m_veil_state == VeilState::Locked)
Kernel: Add a basic implementation of unveil() This syscall is a complement to pledge() and adds the same sort of incremental relinquishing of capabilities for filesystem access. The first call to unveil() will "drop a veil" on the process, and from now on, only unveiled parts of the filesystem are visible to it. Each call to unveil() specifies a path to either a directory or a file along with permissions for that path. The permissions are a combination of the following: - r: Read access (like the "rpath" promise) - w: Write access (like the "wpath" promise) - x: Execute access - c: Create/remove access (like the "cpath" promise) Attempts to open a path that has not been unveiled with fail with ENOENT. If the unveiled path lacks sufficient permissions, it will fail with EACCES. Like pledge(), subsequent calls to unveil() with the same path can only remove permissions, not add them. Once you call unveil(nullptr, nullptr), the veil is locked, and it's no longer possible to unveil any more paths for the process, ever. This concept comes from OpenBSD, and their implementation does various things differently, I'm sure. This is just a first implementation for SerenityOS, and we'll keep improving on it as we go. :^)
2020-01-20 21:12:04 +00:00
return -EPERM;
if (!params.path.characters || !params.permissions.characters)
return -EINVAL;
if (params.permissions.length > 4)
return -EINVAL;
auto path = get_syscall_path_argument(params.path);
if (path.is_error())
return path.error();
if (path.value().is_empty() || path.value().characters()[0] != '/')
return -EINVAL;
auto permissions = validate_and_copy_string_from_user(params.permissions);
if (permissions.is_null())
return -EFAULT;
unsigned new_permissions = 0;
for (size_t i = 0; i < permissions.length(); ++i) {
switch (permissions[i]) {
case 'r':
new_permissions |= UnveiledPath::Access::Read;
break;
case 'w':
new_permissions |= UnveiledPath::Access::Write;
break;
case 'x':
new_permissions |= UnveiledPath::Access::Execute;
break;
case 'c':
new_permissions |= UnveiledPath::Access::CreateOrRemove;
break;
default:
return -EINVAL;
}
}
for (int i = 0; i < m_unveiled_paths.size(); ++i) {
auto& unveiled_path = m_unveiled_paths[i];
if (unveiled_path.path == path.value()) {
if (new_permissions & ~unveiled_path.permissions)
return -EPERM;
unveiled_path.permissions = new_permissions;
return 0;
}
}
m_unveiled_paths.append({ path.value(), new_permissions });
Kernel: Rename UnveilState to VeilState
2020-01-21 18:28:29 +00:00
ASSERT(m_veil_state != VeilState::Locked);
m_veil_state = VeilState::Dropped;
Kernel: Add a basic implementation of unveil() This syscall is a complement to pledge() and adds the same sort of incremental relinquishing of capabilities for filesystem access. The first call to unveil() will "drop a veil" on the process, and from now on, only unveiled parts of the filesystem are visible to it. Each call to unveil() specifies a path to either a directory or a file along with permissions for that path. The permissions are a combination of the following: - r: Read access (like the "rpath" promise) - w: Write access (like the "wpath" promise) - x: Execute access - c: Create/remove access (like the "cpath" promise) Attempts to open a path that has not been unveiled with fail with ENOENT. If the unveiled path lacks sufficient permissions, it will fail with EACCES. Like pledge(), subsequent calls to unveil() with the same path can only remove permissions, not add them. Once you call unveil(nullptr, nullptr), the veil is locked, and it's no longer possible to unveil any more paths for the process, ever. This concept comes from OpenBSD, and their implementation does various things differently, I'm sure. This is just a first implementation for SerenityOS, and we'll keep improving on it as we go. :^)
2020-01-20 21:12:04 +00:00
return 0;
}
Kernel: Start working on a syscall for logging performance events This patch introduces sys$perf_event() with two event types: - PERF_EVENT_MALLOC - PERF_EVENT_FREE After the first call to sys$perf_event(), a process will begin keeping these events in a buffer. When the process dies, that buffer will be written out to "perfcore" in the current directory unless that filename is already taken. This is probably not the best way to do this, but it's a start and will make it possible to start doing memory allocation profiling. :^)
2020-02-02 19:26:27 +00:00
int Process::sys$perf_event(int type, uintptr_t arg1, uintptr_t arg2)
{
if (!m_perf_event_buffer)
m_perf_event_buffer = make<PerformanceEventBuffer>();
return m_perf_event_buffer->append(type, arg1, arg2);
}
Reference in a new issue Copy permalink