beenull/ladybird
1
0
Fork 0
mirror of https://github.com/LadybirdBrowser/ladybird.git synced 2024-11-22 23:50:19 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 6
ladybird/Kernel/Process.h

757 lines
30 KiB
C
Raw Normal View History

Meta: Add license header to source files As suggested by Joshua, this commit adds the 2-clause BSD license as a comment block to the top of every source file. For the first pass, I've just added myself for simplicity. I encourage everyone to add themselves as copyright holders of any file they've added or modified in some significant way. If I've added myself in error somewhere, feel free to replace it with the appropriate copyright holder instead. Going forward, all new source files should include a license header.
2020-01-18 08:38:21 +00:00
/*
Kernel: Factor address space management out of the Process class This patch adds Space, a class representing a process's address space. - Each Process has a Space. - The Space owns the PageDirectory and all Regions in the Process. This allows us to reorganize sys$execve() so that it constructs and populates a new Space fully before committing to it. Previously, we would construct the new address space while still running in the old one, and encountering an error meant we had to do tedious and error-prone rollback. Those problems are now gone, replaced by what's hopefully a set of much smaller problems and missing cleanups. :^)
2021-02-08 14:45:40 +00:00
* Copyright (c) 2018-2021, Andreas Kling <kling@serenityos.org>
Meta: Add license header to source files As suggested by Joshua, this commit adds the 2-clause BSD license as a comment block to the top of every source file. For the first pass, I've just added myself for simplicity. I encourage everyone to add themselves as copyright holders of any file they've added or modified in some significant way. If I've added myself in error somewhere, feel free to replace it with the appropriate copyright holder instead. Going forward, all new source files should include a license header.
2020-01-18 08:38:21 +00:00
* All rights reserved.
*
* Redistribution and use in source and binary forms, with or without
* modification, are permitted provided that the following conditions are met:
*
* 1. Redistributions of source code must retain the above copyright notice, this
* list of conditions and the following disclaimer.
*
* 2. Redistributions in binary form must reproduce the above copyright notice,
* this list of conditions and the following disclaimer in the documentation
* and/or other materials provided with the distribution.
*
* THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS"
* AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
* IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
* DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE
* FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
* DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR
* SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER
* CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY,
* OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
* OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
*/
Import the "gerbert" kernel I worked on earlier this year. It's a lot crappier than I remembered it. It's gonna need a lot of work.
2018-10-16 09:01:38 +00:00
#pragma once
Kernel: Fix overflow in Process::validate_{read,write}_typed() Userspace could pass us a large count to overflow the check. I'm not enough of a haxx0r to write an actual exploit though.
2020-05-31 18:56:17 +00:00
#include <AK/Checked.h>
Kernel: Reduce header dependencies of Process and Thread
2020-02-16 01:01:42 +00:00
#include <AK/HashMap.h>
Add clang-format file Also run it across the whole tree to get everything using the One True Style. We don't yet run this in an automated fashion as it's a little slow, but there is a snippet to do so in makeall.sh.
2019-05-28 09:53:16 +00:00
#include <AK/InlineLinkedList.h>
Kernel: Reduce header dependencies of Process and Thread
2020-02-16 01:01:42 +00:00
#include <AK/NonnullOwnPtrVector.h>
Kernel: Remove ProcessInspectionHandle and make Process RefCounted By making the Process class RefCounted we don't really need ProcessInspectionHandle anymore. This also fixes some race conditions where a Process may be deleted while still being used by ProcFS. Also make sure to acquire the Process' lock when accessing regions. Last but not least, there's no reason why a thread can't be scheduled while being inspected, though in practice it won't happen anyway because the scheduler lock is held at the same time.
2020-08-02 02:04:56 +00:00
#include <AK/NonnullRefPtrVector.h>
Kernel: Make Region single-owner instead of ref-counted This simplifies the ownership model and makes Region easier to reason about. Userspace Regions are now primarily kept by Process::m_regions. Kernel Regions are kept in various OwnPtr<Regions>'s. Regions now only ever get unmapped when they are destroyed.
2019-09-27 12:19:07 +00:00
#include <AK/String.h>
Kernel: Use Userspace<T> for sys$read() and sys$stat() Add validation helper overloads as needed.
2020-07-31 14:28:37 +00:00
#include <AK/Userspace.h>
Kernel: Make Region weakable and use WeakPtr<Region> instead of Region* This turns use-after-free bugs into null pointer dereferences instead.
2020-02-24 12:24:30 +00:00
#include <AK/WeakPtr.h>
Kernel: Store TTY's foreground process as a WeakPtr<Process> This ensures that we don't leave a stale PGID assigned to the TTY after the process exits, which would make PID recycling attacks possible.
2020-08-06 09:17:53 +00:00
#include <AK/Weakable.h>
Kernel+LibELF: Expose ELF Auxiliary Vector to Userspace The AT_* entries are placed after the environment variables, so that they can be found by iterating until the end of the envp array, and then going even further beyond :^)
2020-07-04 23:37:36 +00:00
#include <Kernel/API/Syscall.h>
Kernel: Reduce header dependencies of Process and Thread
2020-02-16 01:01:42 +00:00
#include <Kernel/FileSystem/InodeMetadata.h>
Kernel: Add forward declaration header
2020-02-16 00:50:16 +00:00
#include <Kernel/Forward.h>
Kernel: Some futex improvements This adds support for FUTEX_WAKE_OP, FUTEX_WAIT_BITSET, FUTEX_WAKE_BITSET, FUTEX_REQUEUE, and FUTEX_CMP_REQUEUE, as well well as global and private futex and absolute/relative timeouts against the appropriate clock. This also changes the implementation so that kernel resources are only used when a thread is blocked on a futex. Global futexes are implemented as offsets in VMObjects, so that different processes can share a futex against the same VMObject despite potentially being mapped at different virtual addresses.
2020-12-22 06:21:58 +00:00
#include <Kernel/FutexQueue.h>
Add clang-format file Also run it across the whole tree to get everything using the One True Style. We don't yet run this in an automated fashion as it's a little slow, but there is a snippet to do so in makeall.sh.
2019-05-28 09:53:16 +00:00
#include <Kernel/Lock.h>
Kernel: Distinguish between new and old process groups with equal pgids This does not add any behaviour change to the processes, but it ties a TTY to an active process group via TIOCSPGRP, and returns the TTY to the kernel when all processes in the process group die. Also makes the TTY keep a link to the original controlling process' parent (for SIGCHLD) instead of the process itself.
2020-08-15 19:13:19 +00:00
#include <Kernel/ProcessGroup.h>
Kernel: Add "setkeymap" pledge promise
2020-06-18 20:18:44 +00:00
#include <Kernel/StdLib.h>
Kernel: Introduce threads, and refactor everything in support of it. The scheduler now operates on threads, rather than on processes. Each process has a main thread, and can have any number of additional threads. The process exits when the main thread exits. This patch doesn't actually spawn any additional threads, it merely does all the plumbing needed to make it possible. :^)
2019-03-23 21:03:17 +00:00
#include <Kernel/Thread.h>
Kernel: Change wait blocking to Process-only blocking This prevents zombies created by multi-threaded applications and brings our model back to closer to what other OSs do. This also means that SIGSTOP needs to halt all threads, and SIGCONT needs to resume those threads.
2020-12-09 04:18:45 +00:00
#include <Kernel/ThreadTracer.h>
Add clang-format file Also run it across the whole tree to get everything using the One True Style. We don't yet run this in an automated fashion as it's a little slow, but there is a snippet to do so in makeall.sh.
2019-05-28 09:53:16 +00:00
#include <Kernel/UnixTypes.h>
Kernel: Implement unveil() as a prefix-tree Fixes #4530.
2020-12-26 10:24:34 +00:00
#include <Kernel/UnveilNode.h>
Kernel: Merge PurgeableVMObject into AnonymousVMObject This implements memory commitments and lazy-allocation of committed memory.
2020-09-05 21:52:14 +00:00
#include <Kernel/VM/AllocationStrategy.h>
Add clang-format file Also run it across the whole tree to get everything using the One True Style. We don't yet run this in an automated fashion as it's a little slow, but there is a snippet to do so in makeall.sh.
2019-05-28 09:53:16 +00:00
#include <Kernel/VM/RangeAllocator.h>
Kernel: Factor address space management out of the Process class This patch adds Space, a class representing a process's address space. - Each Process has a Space. - The Space owns the PageDirectory and all Regions in the Process. This allows us to reorganize sys$execve() so that it constructs and populates a new Space fully before committing to it. Previously, we would construct the new address space while still running in the old one, and encountering an error meant we had to do tedious and error-prone rollback. Those problems are now gone, replaced by what's hopefully a set of much smaller problems and missing cleanups. :^)
2021-02-08 14:45:40 +00:00
#include <Kernel/VM/Space.h>
Kernel: Send more specific signals when crashing due to CPU exceptions. - For division by zero, send SIGFPE. - For illegal instruction, send SIGILL. - For the rest, default to SIGSEGV.
2019-05-26 00:08:51 +00:00
#include <LibC/signal_numbers.h>
Everywhere: Fix weird includes
2021-01-31 14:10:45 +00:00
#include <LibELF/exec_elf.h>
Import the "gerbert" kernel I worked on earlier this year. It's a lot crappier than I remembered it. It's gonna need a lot of work.
2018-10-16 09:01:38 +00:00
Kernel: Move all code into the Kernel namespace
2020-02-16 00:27:42 +00:00
namespace Kernel {
Kernel: Make kgettimeofday use AK::Time
2021-02-28 01:18:48 +00:00
Time kgettimeofday();
Add support for socket send/receive timeouts. Only the receive timeout is hooked up yet. You can change the timeout by calling setsockopt(..., SOL_SOCKET, SO_RCVTIMEO, ...). Use this mechanism to make /bin/ping report timeouts.
2019-03-13 12:13:23 +00:00
Kernel: Add "setkeymap" pledge promise
2020-06-18 20:18:44 +00:00
#define ENUMERATE_PLEDGE_PROMISES \
__ENUMERATE_PLEDGE_PROMISE(stdio) \
__ENUMERATE_PLEDGE_PROMISE(rpath) \
__ENUMERATE_PLEDGE_PROMISE(wpath) \
__ENUMERATE_PLEDGE_PROMISE(cpath) \
__ENUMERATE_PLEDGE_PROMISE(dpath) \
__ENUMERATE_PLEDGE_PROMISE(inet) \
__ENUMERATE_PLEDGE_PROMISE(id) \
__ENUMERATE_PLEDGE_PROMISE(proc) \
Kernel: Add dedicated "ptrace" pledge promise The vast majority of programs don't ever need to use sys$ptrace(), and it seems like a high-value system call to prevent a compromised process from using. This patch moves sys$ptrace() from the "proc" promise to its own, new "ptrace" promise and updates the affected apps.
2021-01-11 21:30:57 +00:00
__ENUMERATE_PLEDGE_PROMISE(ptrace) \
Kernel: Add "setkeymap" pledge promise
2020-06-18 20:18:44 +00:00
__ENUMERATE_PLEDGE_PROMISE(exec) \
__ENUMERATE_PLEDGE_PROMISE(unix) \
Kernel+LibC: Add sys$recvfd() and sys$sendfd() for fd passing These new syscalls allow you to send and receive file descriptors over a local domain socket. This will enable various privilege separation techniques and other good stuff. :^)
2020-06-24 20:57:37 +00:00
__ENUMERATE_PLEDGE_PROMISE(recvfd) \
__ENUMERATE_PLEDGE_PROMISE(sendfd) \
Kernel: Add "setkeymap" pledge promise
2020-06-18 20:18:44 +00:00
__ENUMERATE_PLEDGE_PROMISE(fattr) \
__ENUMERATE_PLEDGE_PROMISE(tty) \
__ENUMERATE_PLEDGE_PROMISE(chown) \
__ENUMERATE_PLEDGE_PROMISE(chroot) \
__ENUMERATE_PLEDGE_PROMISE(thread) \
__ENUMERATE_PLEDGE_PROMISE(video) \
__ENUMERATE_PLEDGE_PROMISE(accept) \
__ENUMERATE_PLEDGE_PROMISE(settime) \
Kernel: Introduce "sigaction" pledge You now have to pledge "sigaction" to change signal handlers/dispositions. This is to prevent malicious code from messing with assertions (and segmentation faults), which are normally expected to instantly terminate the process but can do other things if you change signal disposition for them.
2020-05-26 10:49:35 +00:00
__ENUMERATE_PLEDGE_PROMISE(sigaction) \
Kernel: Add "prot_exec" pledge promise and require it for PROT_EXEC This prevents sys$mmap() and sys$mprotect() from creating executable memory mappings in pledged programs that don't have this promise. Note that the dynamic loader runs before pledging happens, so it's unaffected by this.
2021-01-29 17:50:27 +00:00
__ENUMERATE_PLEDGE_PROMISE(setkeymap) \
Kernel+keymap+KeyboardMapper: New pledge for getkeymap
2021-01-31 21:50:17 +00:00
__ENUMERATE_PLEDGE_PROMISE(prot_exec) \
Kernel: Add "map_fixed" pledge promise This is a new promise that guards access to mmap() with MAP_FIXED. Fixed-address mappings are rarely used, but can be useful if you are trying to groom the process address space for malicious purposes. None of our programs need this at the moment, as the only user of MAP_FIXED is DynamicLoader, but the fixed mappings are constructed before the process has had a chance to pledge anything.
2021-02-21 00:08:48 +00:00
__ENUMERATE_PLEDGE_PROMISE(map_fixed) \
Kernel+keymap+KeyboardMapper: New pledge for getkeymap
2021-01-31 21:50:17 +00:00
__ENUMERATE_PLEDGE_PROMISE(getkeymap)
ping: Use pledge()
2020-01-11 19:48:43 +00:00
enum class Pledge : u32 {
#define __ENUMERATE_PLEDGE_PROMISE(x) x,
ENUMERATE_PLEDGE_PROMISES
#undef __ENUMERATE_PLEDGE_PROMISE
};
Kernel: Rename UnveilState to VeilState
2020-01-21 18:28:29 +00:00
enum class VeilState {
Kernel: Add a basic implementation of unveil() This syscall is a complement to pledge() and adds the same sort of incremental relinquishing of capabilities for filesystem access. The first call to unveil() will "drop a veil" on the process, and from now on, only unveiled parts of the filesystem are visible to it. Each call to unveil() specifies a path to either a directory or a file along with permissions for that path. The permissions are a combination of the following: - r: Read access (like the "rpath" promise) - w: Write access (like the "wpath" promise) - x: Execute access - c: Create/remove access (like the "cpath" promise) Attempts to open a path that has not been unveiled with fail with ENOENT. If the unveiled path lacks sufficient permissions, it will fail with EACCES. Like pledge(), subsequent calls to unveil() with the same path can only remove permissions, not add them. Once you call unveil(nullptr, nullptr), the veil is locked, and it's no longer possible to unveil any more paths for the process, ever. This concept comes from OpenBSD, and their implementation does various things differently, I'm sure. This is just a first implementation for SerenityOS, and we'll keep improving on it as we go. :^)
2020-01-20 21:12:04 +00:00
None,
Kernel: Rename UnveilState to VeilState
2020-01-21 18:28:29 +00:00
Dropped,
Locked,
Kernel: Add a basic implementation of unveil() This syscall is a complement to pledge() and adds the same sort of incremental relinquishing of capabilities for filesystem access. The first call to unveil() will "drop a veil" on the process, and from now on, only unveiled parts of the filesystem are visible to it. Each call to unveil() specifies a path to either a directory or a file along with permissions for that path. The permissions are a combination of the following: - r: Read access (like the "rpath" promise) - w: Write access (like the "wpath" promise) - x: Execute access - c: Create/remove access (like the "cpath" promise) Attempts to open a path that has not been unveiled with fail with ENOENT. If the unveiled path lacks sufficient permissions, it will fail with EACCES. Like pledge(), subsequent calls to unveil() with the same path can only remove permissions, not add them. Once you call unveil(nullptr, nullptr), the veil is locked, and it's no longer possible to unveil any more paths for the process, ever. This concept comes from OpenBSD, and their implementation does various things differently, I'm sure. This is just a first implementation for SerenityOS, and we'll keep improving on it as we go. :^)
2020-01-20 21:12:04 +00:00
};
Kernel: Some futex improvements This adds support for FUTEX_WAKE_OP, FUTEX_WAIT_BITSET, FUTEX_WAKE_BITSET, FUTEX_REQUEUE, and FUTEX_CMP_REQUEUE, as well well as global and private futex and absolute/relative timeouts against the appropriate clock. This also changes the implementation so that kernel resources are only used when a thread is blocked on a futex. Global futexes are implemented as offsets in VMObjects, so that different processes can share a futex against the same VMObject despite potentially being mapped at different virtual addresses.
2020-12-22 06:21:58 +00:00
typedef HashMap<FlatPtr, RefPtr<FutexQueue>> FutexQueues;
Kernel: Factor address space management out of the Process class This patch adds Space, a class representing a process's address space. - Each Process has a Space. - The Space owns the PageDirectory and all Regions in the Process. This allows us to reorganize sys$execve() so that it constructs and populates a new Space fully before committing to it. Previously, we would construct the new address space while still running in the old one, and encountering an error meant we had to do tedious and error-prone rollback. Those problems are now gone, replaced by what's hopefully a set of much smaller problems and missing cleanups. :^)
2021-02-08 14:45:40 +00:00
struct LoadResult;
Kernel: Don't keep protected Process data in a separate allocation The previous architecture had a huge flaw: the pointer to the protected data was itself unprotected, allowing you to overwrite it at any time. This patch reorganizes the protected data so it's part of the Process class itself. (Actually, it's a new ProcessBase helper class.) We use the first 4 KB of Process objects themselves as the new storage location for protected data. Then we make Process objects page-aligned using MAKE_ALIGNED_ALLOCATED. This allows us to easily turn on/off write-protection for everything in the ProcessBase portion of Process. :^) Thanks to @bugaevc for pointing out the flaw! This is still not perfect but it's an improvement.
2021-03-11 12:13:05 +00:00
class ProtectedProcessBase {
protected:
ProcessID m_pid { 0 };
ProcessID m_ppid { 0 };
SessionID m_sid { 0 };
uid_t m_euid { 0 };
gid_t m_egid { 0 };
uid_t m_uid { 0 };
gid_t m_gid { 0 };
uid_t m_suid { 0 };
gid_t m_sgid { 0 };
Vector<gid_t> m_extra_gids;
bool m_dumpable { false };
bool m_has_promises { false };
u32 m_promises { 0 };
bool m_has_execpromises { false };
u32 m_execpromises { 0 };
Kernel: Move process umask into protected data :^)
2021-03-11 12:23:23 +00:00
mode_t m_umask { 022 };
Kernel: Move process signal trampoline address into protected data
2021-03-11 12:28:50 +00:00
VirtualAddress m_signal_trampoline;
Kernel: Move process thread lists into protected data
2021-03-11 13:12:55 +00:00
Atomic<u32> m_thread_count { 0 };
IntrusiveList<Thread, &Thread::m_process_thread_list_node> m_thread_list;
Kernel: Move process termination status/signal into protected data
2021-03-11 13:24:08 +00:00
u8 m_termination_status { 0 };
u8 m_termination_signal { 0 };
Kernel: Don't keep protected Process data in a separate allocation The previous architecture had a huge flaw: the pointer to the protected data was itself unprotected, allowing you to overwrite it at any time. This patch reorganizes the protected data so it's part of the Process class itself. (Actually, it's a new ProcessBase helper class.) We use the first 4 KB of Process objects themselves as the new storage location for protected data. Then we make Process objects page-aligned using MAKE_ALIGNED_ALLOCATED. This allows us to easily turn on/off write-protection for everything in the ProcessBase portion of Process. :^) Thanks to @bugaevc for pointing out the flaw! This is still not perfect but it's an improvement.
2021-03-11 12:13:05 +00:00
};
class ProcessBase : public ProtectedProcessBase {
protected:
u8 m_process_base_padding[PAGE_SIZE - sizeof(ProtectedProcessBase)];
};
static_assert(sizeof(ProcessBase) == PAGE_SIZE);
Kernel: Store TTY's foreground process as a WeakPtr<Process> This ensures that we don't leave a stale PGID assigned to the TTY after the process exits, which would make PID recycling attacks possible.
2020-08-06 09:17:53 +00:00
class Process
Kernel: Don't keep protected Process data in a separate allocation The previous architecture had a huge flaw: the pointer to the protected data was itself unprotected, allowing you to overwrite it at any time. This patch reorganizes the protected data so it's part of the Process class itself. (Actually, it's a new ProcessBase helper class.) We use the first 4 KB of Process objects themselves as the new storage location for protected data. Then we make Process objects page-aligned using MAKE_ALIGNED_ALLOCATED. This allows us to easily turn on/off write-protection for everything in the ProcessBase portion of Process. :^) Thanks to @bugaevc for pointing out the flaw! This is still not perfect but it's an improvement.
2021-03-11 12:13:05 +00:00
: public ProcessBase
, public RefCounted<Process>
Kernel: Store TTY's foreground process as a WeakPtr<Process> This ensures that we don't leave a stale PGID assigned to the TTY after the process exits, which would make PID recycling attacks possible.
2020-08-06 09:17:53 +00:00
, public InlineLinkedListNode<Process>
, public Weakable<Process> {
Kernel: Make Process and Thread non-copyable and non-movable
2020-04-22 09:54:58 +00:00
AK_MAKE_NONCOPYABLE(Process);
AK_MAKE_NONMOVABLE(Process);
Kernel: Don't keep protected Process data in a separate allocation The previous architecture had a huge flaw: the pointer to the protected data was itself unprotected, allowing you to overwrite it at any time. This patch reorganizes the protected data so it's part of the Process class itself. (Actually, it's a new ProcessBase helper class.) We use the first 4 KB of Process objects themselves as the new storage location for protected data. Then we make Process objects page-aligned using MAKE_ALIGNED_ALLOCATED. This allows us to easily turn on/off write-protection for everything in the ProcessBase portion of Process. :^) Thanks to @bugaevc for pointing out the flaw! This is still not perfect but it's an improvement.
2021-03-11 12:13:05 +00:00
MAKE_ALIGNED_ALLOCATED(Process, PAGE_SIZE);
Process now maps regions immediately when they are allocated. This avoids having to do a separate MM.mapRegionsForTask() pass. Also, more Task => Process renaming that I apparently hadn't saved yet.
2018-11-01 12:15:46 +00:00
friend class InlineLinkedListNode<Process>;
Kernel: Introduce threads, and refactor everything in support of it. The scheduler now operates on threads, rather than on processes. Each process has a main thread, and can have any number of additional threads. The process exits when the main thread exits. This patch doesn't actually spawn any additional threads, it merely does all the plumbing needed to make it possible. :^)
2019-03-23 21:03:17 +00:00
friend class Thread;
Kernel: Generate a coredump file when a process crashes When a process crashes, we generate a coredump file and write it in /tmp/coredumps/. The coredump file is an ELF file of type ET_CORE. It contains a segment for every userspace memory region of the process, and an additional PT_NOTE segment that contains the registers state for each thread, and a additional data about memory regions (e.g their name).
2020-11-06 08:09:51 +00:00
friend class CoreDump;
Add clang-format file Also run it across the whole tree to get everything using the One True Style. We don't yet run this in an automated fashion as it's a little slow, but there is a snippet to do so in makeall.sh.
2019-05-28 09:53:16 +00:00
Kernel: Move select Process members into protected memory Process member variable like m_euid are very valuable targets for kernel exploits and until now they have been writable at all times. This patch moves m_euid along with a whole bunch of other members into a new Process::ProtectedData struct. This struct is remapped as read-only memory whenever we don't need to write to it. This means that a kernel write primitive is no longer enough to overwrite a process's effective UID, you must first unprotect the protected data where the UID is stored. :^)
2021-03-10 18:59:46 +00:00
// Helper class to temporarily unprotect a process's protected data so you can write to it.
Kernel: Don't keep protected Process data in a separate allocation The previous architecture had a huge flaw: the pointer to the protected data was itself unprotected, allowing you to overwrite it at any time. This patch reorganizes the protected data so it's part of the Process class itself. (Actually, it's a new ProcessBase helper class.) We use the first 4 KB of Process objects themselves as the new storage location for protected data. Then we make Process objects page-aligned using MAKE_ALIGNED_ALLOCATED. This allows us to easily turn on/off write-protection for everything in the ProcessBase portion of Process. :^) Thanks to @bugaevc for pointing out the flaw! This is still not perfect but it's an improvement.
2021-03-11 12:13:05 +00:00
class ProtectedDataMutationScope {
Kernel: Move select Process members into protected memory Process member variable like m_euid are very valuable targets for kernel exploits and until now they have been writable at all times. This patch moves m_euid along with a whole bunch of other members into a new Process::ProtectedData struct. This struct is remapped as read-only memory whenever we don't need to write to it. This means that a kernel write primitive is no longer enough to overwrite a process's effective UID, you must first unprotect the protected data where the UID is stored. :^)
2021-03-10 18:59:46 +00:00
public:
Kernel: Don't keep protected Process data in a separate allocation The previous architecture had a huge flaw: the pointer to the protected data was itself unprotected, allowing you to overwrite it at any time. This patch reorganizes the protected data so it's part of the Process class itself. (Actually, it's a new ProcessBase helper class.) We use the first 4 KB of Process objects themselves as the new storage location for protected data. Then we make Process objects page-aligned using MAKE_ALIGNED_ALLOCATED. This allows us to easily turn on/off write-protection for everything in the ProcessBase portion of Process. :^) Thanks to @bugaevc for pointing out the flaw! This is still not perfect but it's an improvement.
2021-03-11 12:13:05 +00:00
explicit ProtectedDataMutationScope(Process& process)
Kernel: Move select Process members into protected memory Process member variable like m_euid are very valuable targets for kernel exploits and until now they have been writable at all times. This patch moves m_euid along with a whole bunch of other members into a new Process::ProtectedData struct. This struct is remapped as read-only memory whenever we don't need to write to it. This means that a kernel write primitive is no longer enough to overwrite a process's effective UID, you must first unprotect the protected data where the UID is stored. :^)
2021-03-10 18:59:46 +00:00
: m_process(process)
{
m_process.unprotect_data();
}
Kernel: Don't keep protected Process data in a separate allocation The previous architecture had a huge flaw: the pointer to the protected data was itself unprotected, allowing you to overwrite it at any time. This patch reorganizes the protected data so it's part of the Process class itself. (Actually, it's a new ProcessBase helper class.) We use the first 4 KB of Process objects themselves as the new storage location for protected data. Then we make Process objects page-aligned using MAKE_ALIGNED_ALLOCATED. This allows us to easily turn on/off write-protection for everything in the ProcessBase portion of Process. :^) Thanks to @bugaevc for pointing out the flaw! This is still not perfect but it's an improvement.
2021-03-11 12:13:05 +00:00
~ProtectedDataMutationScope() { m_process.protect_data(); }
Kernel: Move select Process members into protected memory Process member variable like m_euid are very valuable targets for kernel exploits and until now they have been writable at all times. This patch moves m_euid along with a whole bunch of other members into a new Process::ProtectedData struct. This struct is remapped as read-only memory whenever we don't need to write to it. This means that a kernel write primitive is no longer enough to overwrite a process's effective UID, you must first unprotect the protected data where the UID is stored. :^)
2021-03-10 18:59:46 +00:00
private:
Process& m_process;
};
Import the "gerbert" kernel I worked on earlier this year. It's a lot crappier than I remembered it. It's gonna need a lot of work.
2018-10-16 09:01:38 +00:00
public:
Kernel: Turn Thread::current and Process::current into functions This allows us to query the current thread and process on a per processor basis
2020-06-28 21:34:31 +00:00
inline static Process* current()
{
Kernel: Make Thread::current smp-safe Change Thread::current to be a static function and read using the fs register, which eliminates a window between Processor::current() returning and calling a function on it, which can trigger preemption and a move to a different processor, which then causes operating on the wrong object.
2021-01-26 21:16:07 +00:00
auto current_thread = Processor::current_thread();
Kernel: Turn Thread::current and Process::current into functions This allows us to query the current thread and process on a per processor basis
2020-06-28 21:34:31 +00:00
return current_thread ? &current_thread->process() : nullptr;
}
Kernel: Replace "current" with Thread::current and Process::current Suggested by Sergey. The currently running Thread and Process are now Thread::current and Process::current respectively. :^)
2020-02-17 14:04:27 +00:00
Kernel: Allow passing a thread argument for new kernel threads This adds the ability to pass a pointer to kernel thread/process. Also add the ability to use a closure as thread function, which allows passing information to a kernel thread more easily.
2020-11-17 03:51:34 +00:00
template<typename EntryFunction>
Kernel: Merge PurgeableVMObject into AnonymousVMObject This implements memory commitments and lazy-allocation of committed memory.
2020-09-05 21:52:14 +00:00
static RefPtr<Process> create_kernel_process(RefPtr<Thread>& first_thread, String&& name, EntryFunction entry, u32 affinity = THREAD_AFFINITY_DEFAULT)
Kernel: Allow passing a thread argument for new kernel threads This adds the ability to pass a pointer to kernel thread/process. Also add the ability to use a closure as thread function, which allows passing information to a kernel thread more easily.
2020-11-17 03:51:34 +00:00
{
auto* entry_func = new EntryFunction(move(entry));
Kernel: Move block condition evaluation out of the Scheduler This makes the Scheduler a lot leaner by not having to evaluate block conditions every time it is invoked. Instead evaluate them as the states change, and unblock threads at that point. This also implements some more waitid/waitpid/wait features and behavior. For example, WUNTRACED and WNOWAIT are now supported. And wait will now not return EINTR when SIGCHLD is delivered at the same time.
2020-11-29 23:05:27 +00:00
return create_kernel_process(
first_thread, move(name), [](void* data) {
EntryFunction* func = reinterpret_cast<EntryFunction*>(data);
(*func)();
delete func;
},
entry_func, affinity);
Kernel: Allow passing a thread argument for new kernel threads This adds the ability to pass a pointer to kernel thread/process. Also add the ability to use a closure as thread function, which allows passing information to a kernel thread more easily.
2020-11-17 03:51:34 +00:00
}
Kernel: Merge PurgeableVMObject into AnonymousVMObject This implements memory commitments and lazy-allocation of committed memory.
2020-09-05 21:52:14 +00:00
static RefPtr<Process> create_kernel_process(RefPtr<Thread>& first_thread, String&& name, void (*entry)(void*), void* entry_data = nullptr, u32 affinity = THREAD_AFFINITY_DEFAULT);
Kernel: Make Thread refcounted Similar to Process, we need to make Thread refcounted. This will solve problems that will appear once we schedule threads on more than one processor. This allows us to hold onto threads without necessarily holding the scheduler lock for the entire duration.
2020-09-27 14:53:35 +00:00
static RefPtr<Process> create_user_process(RefPtr<Thread>& first_thread, const String& path, uid_t, gid_t, ProcessID ppid, int& error, Vector<String>&& arguments = Vector<String>(), Vector<String>&& environment = Vector<String>(), TTY* = nullptr);
Process now maps regions immediately when they are allocated. This avoids having to do a separate MM.mapRegionsForTask() pass. Also, more Task => Process renaming that I apparently hadn't saved yet.
2018-11-01 12:15:46 +00:00
~Process();
Generate a basic /proc/summary file with some info about all tasks.
2018-10-23 10:44:46 +00:00
Kernel: PID/TID typing This compiles, and contains exactly the same bugs as before. The regex 'FIXME: PID/' should reveal all markers that I left behind, including: - Incomplete conversion - Issues or things that look fishy - Actual bugs that will go wrong during runtime
2020-08-08 15:32:34 +00:00
static Vector<ProcessID> all_pids();
Everywhere: Remove a bunch of redundant 'AK::' namespace prefixes This is basically just for consistency, it's quite strange to see multiple AK container types next to each other, some with and some without the namespace prefix - we're 'using AK::Foo;' a lot and should leverage that. :^)
2021-02-25 20:10:47 +00:00
static NonnullRefPtrVector<Process> all_processes();
Import the "gerbert" kernel I worked on earlier this year. It's a lot crappier than I remembered it. It's gonna need a lot of work.
2018-10-16 09:01:38 +00:00
Kernel: Allow passing a thread argument for new kernel threads This adds the ability to pass a pointer to kernel thread/process. Also add the ability to use a closure as thread function, which allows passing information to a kernel thread more easily.
2020-11-17 03:51:34 +00:00
template<typename EntryFunction>
RefPtr<Thread> create_kernel_thread(EntryFunction entry, u32 priority, const String& name, u32 affinity = THREAD_AFFINITY_DEFAULT, bool joinable = true)
{
auto* entry_func = new EntryFunction(move(entry));
return create_kernel_thread([](void* data) {
EntryFunction* func = reinterpret_cast<EntryFunction*>(data);
(*func)();
delete func;
Kernel: Move block condition evaluation out of the Scheduler This makes the Scheduler a lot leaner by not having to evaluate block conditions every time it is invoked. Instead evaluate them as the states change, and unblock threads at that point. This also implements some more waitid/waitpid/wait features and behavior. For example, WUNTRACED and WNOWAIT are now supported. And wait will now not return EINTR when SIGCHLD is delivered at the same time.
2020-11-29 23:05:27 +00:00
},
priority, name, affinity, joinable);
Kernel: Allow passing a thread argument for new kernel threads This adds the ability to pass a pointer to kernel thread/process. Also add the ability to use a closure as thread function, which allows passing information to a kernel thread more easily.
2020-11-17 03:51:34 +00:00
}
RefPtr<Thread> create_kernel_thread(void (*entry)(void*), void* entry_data, u32 priority, const String& name, u32 affinity = THREAD_AFFINITY_DEFAULT, bool joinable = true);
Kernel: Turn Thread::current and Process::current into functions This allows us to query the current thread and process on a per processor basis
2020-06-28 21:34:31 +00:00
Kernel: Implement a simple process time profiler The kernel now supports basic profiling of all the threads in a process by calling profiling_enable(pid_t). You finish the profiling by calling profiling_disable(pid_t). This all works by recording thread stacks when the timer interrupt fires and the current thread is in a process being profiled. Note that symbolication is deferred until profiling_disable() to avoid adding more noise than necessary to the profile. A simple "/bin/profile" command is included here that can be used to start/stop profiling like so: $ profile 10 on ... wait ... $ profile 10 off After a profile has been recorded, it can be fetched in /proc/profile There are various limits (or "bugs") on this mechanism at the moment: - Only one process can be profiled at a time. - We allocate 8MB for the samples, if you use more space, things will not work, and probably break a bit. - Things will probably fall apart if the profiled process dies during profiling, or while extracing /proc/profile
2019-12-11 19:36:56 +00:00
bool is_profiling() const { return m_profiling; }
void set_profiling(bool profiling) { m_profiling = profiling; }
Kernel: Generate a coredump file when a process crashes When a process crashes, we generate a coredump file and write it in /tmp/coredumps/. The coredump file is an ELF file of type ET_CORE. It contains a segment for every userspace memory region of the process, and an additional PT_NOTE segment that contains the registers state for each thread, and a additional data about memory regions (e.g their name).
2020-11-06 08:09:51 +00:00
bool should_core_dump() const { return m_should_dump_core; }
void set_dump_core(bool dump_core) { m_should_dump_core = dump_core; }
Kernel: Implement a simple process time profiler The kernel now supports basic profiling of all the threads in a process by calling profiling_enable(pid_t). You finish the profiling by calling profiling_disable(pid_t). This all works by recording thread stacks when the timer interrupt fires and the current thread is in a process being profiled. Note that symbolication is deferred until profiling_disable() to avoid adding more noise than necessary to the profile. A simple "/bin/profile" command is included here that can be used to start/stop profiling like so: $ profile 10 on ... wait ... $ profile 10 off After a profile has been recorded, it can be fetched in /proc/profile There are various limits (or "bugs") on this mechanism at the moment: - Only one process can be profiled at a time. - We allocate 8MB for the samples, if you use more space, things will not work, and probably break a bit. - Things will probably fall apart if the profiled process dies during profiling, or while extracing /proc/profile
2019-12-11 19:36:56 +00:00
Kernel: Fix broken destruction order for Process/Thread.
2019-03-24 00:20:35 +00:00
bool is_dead() const { return m_dead; }
Kernel: Introduce threads, and refactor everything in support of it. The scheduler now operates on threads, rather than on processes. Each process has a main thread, and can have any number of additional threads. The process exits when the main thread exits. This patch doesn't actually spawn any additional threads, it merely does all the plumbing needed to make it possible. :^)
2019-03-23 21:03:17 +00:00
Kernel: Specify default memory order for some non-synchronizing Atomics
2021-01-03 23:58:50 +00:00
bool is_stopped() const { return m_is_stopped; }
bool set_stopped(bool stopped) { return m_is_stopped.exchange(stopped); }
Kernel: Change wait blocking to Process-only blocking This prevents zombies created by multi-threaded applications and brings our model back to closer to what other OSs do. This also means that SIGSTOP needs to halt all threads, and SIGCONT needs to resume those threads.
2020-12-09 04:18:45 +00:00
Kernel: Rename Process::is_ring0/3 to Process::is_kernel/user_process Since "rings" typically refer to code execution and user processes can also execute in ring 0, rename these functions to more accurately describe what they mean: kernel processes and user processes.
2020-09-10 15:46:24 +00:00
bool is_kernel_process() const { return m_is_kernel_process; }
bool is_user_process() const { return !m_is_kernel_process; }
Implement sending signals to blocked-in-kernel processes. This is dirty but pretty cool! If we have a pending, unmasked signal for a process that's blocked inside the kernel, we set up alternate stacks for that process and unblock it to execute the signal handler. A slightly different return trampoline is used here: since we need to get back into the kernel, a dedicated syscall is used (sys$sigreturn.) This restores the TSS contents of the process to the state it was in while we were originally blocking in the kernel. NOTE: There's currently only one "kernel resume TSS" so signal nesting definitely won't work.
2018-11-07 20:19:47 +00:00
Kernel: PID/TID typing This compiles, and contains exactly the same bugs as before. The regex 'FIXME: PID/' should reveal all markers that I left behind, including: - Incomplete conversion - Issues or things that look fishy - Actual bugs that will go wrong during runtime
2020-08-08 15:32:34 +00:00
static RefPtr<Process> from_pid(ProcessID);
Kernel: PID/PGID typing This compiles, and fixes two bugs: - setpgid() confusion (see previous commit) - tcsetpgrp() now allows to set a non-empty process group even if the group leader has already died. This makes Serenity slightly more POSIX-compatible.
2020-08-08 20:04:20 +00:00
static SessionID get_sid_from_pgid(ProcessGroupID pgid);
Import the "gerbert" kernel I worked on earlier this year. It's a lot crappier than I remembered it. It's gonna need a lot of work.
2018-10-16 09:01:38 +00:00
const String& name() const { return m_name; }
Kernel: Don't keep protected Process data in a separate allocation The previous architecture had a huge flaw: the pointer to the protected data was itself unprotected, allowing you to overwrite it at any time. This patch reorganizes the protected data so it's part of the Process class itself. (Actually, it's a new ProcessBase helper class.) We use the first 4 KB of Process objects themselves as the new storage location for protected data. Then we make Process objects page-aligned using MAKE_ALIGNED_ALLOCATED. This allows us to easily turn on/off write-protection for everything in the ProcessBase portion of Process. :^) Thanks to @bugaevc for pointing out the flaw! This is still not perfect but it's an improvement.
2021-03-11 12:13:05 +00:00
ProcessID pid() const { return m_pid; }
SessionID sid() const { return m_sid; }
bool is_session_leader() const { return m_sid.value() == m_pid.value(); }
Kernel: Distinguish between new and old process groups with equal pgids This does not add any behaviour change to the processes, but it ties a TTY to an active process group via TIOCSPGRP, and returns the TTY to the kernel when all processes in the process group die. Also makes the TTY keep a link to the original controlling process' parent (for SIGCHLD) instead of the process itself.
2020-08-15 19:13:19 +00:00
ProcessGroupID pgid() const { return m_pg ? m_pg->pgid() : 0; }
Kernel: Don't keep protected Process data in a separate allocation The previous architecture had a huge flaw: the pointer to the protected data was itself unprotected, allowing you to overwrite it at any time. This patch reorganizes the protected data so it's part of the Process class itself. (Actually, it's a new ProcessBase helper class.) We use the first 4 KB of Process objects themselves as the new storage location for protected data. Then we make Process objects page-aligned using MAKE_ALIGNED_ALLOCATED. This allows us to easily turn on/off write-protection for everything in the ProcessBase portion of Process. :^) Thanks to @bugaevc for pointing out the flaw! This is still not perfect but it's an improvement.
2021-03-11 12:13:05 +00:00
bool is_group_leader() const { return pgid().value() == m_pid.value(); }
const Vector<gid_t>& extra_gids() const { return m_extra_gids; }
uid_t euid() const { return m_euid; }
gid_t egid() const { return m_egid; }
uid_t uid() const { return m_uid; }
gid_t gid() const { return m_gid; }
uid_t suid() const { return m_suid; }
gid_t sgid() const { return m_sgid; }
ProcessID ppid() const { return m_ppid; }
bool is_dumpable() const { return m_dumpable; }
Kernel: Move process "dumpable" flag into protected data
2021-03-10 21:42:07 +00:00
void set_dumpable(bool);
Kernel+LibC: Introduce a "dumpable" flag for processes This new flag controls two things: - Whether the kernel will generate core dumps for the process - Whether the EUID:EGID should own the process's files in /proc Processes are automatically made non-dumpable when their EUID or EGID is changed, either via syscalls that specifically modify those ID's, or via sys$execve(), when a set-uid or set-gid program is executed. A process can change its own dumpable flag at any time by calling the new sys$prctl(PR_SET_DUMPABLE) syscall. Fixes #4504.
2020-12-25 17:27:42 +00:00
Kernel: Respect the process umask in open() and mkdir().
2019-02-22 01:39:13 +00:00
mode_t umask() const { return m_umask; }
Add chown() syscall and a simple /bin/chown program.
2019-02-27 11:32:53 +00:00
bool in_group(gid_t) const;
Kernel: Make Process::file_description() vend a RefPtr<FileDescription> This encourages callers to strongly reference file descriptions while working with them. This fixes a use-after-free issue where one thread would close() an open fd while another thread was blocked on it becoming readable. Test: Kernel/uaf-close-while-blocked-in-read.cpp
2020-01-07 14:53:42 +00:00
RefPtr<FileDescription> file_description(int fd) const;
Kernel: Expose blocking and cloexec fd flags in ProcFS
2019-09-28 20:00:38 +00:00
int fd_flags(int fd) const;
Import the "gerbert" kernel I worked on earlier this year. It's a lot crappier than I remembered it. It's gonna need a lot of work.
2018-10-16 09:01:38 +00:00
Add clang-format file Also run it across the whole tree to get everything using the One True Style. We don't yet run this in an automated fashion as it's a little slow, but there is a snippet to do so in makeall.sh.
2019-05-28 09:53:16 +00:00
template<typename Callback>
static void for_each(Callback);
template<typename Callback>
Kernel: PID/PGID typing This compiles, and fixes two bugs: - setpgid() confusion (see previous commit) - tcsetpgrp() now allows to set a non-empty process group even if the group leader has already died. This makes Serenity slightly more POSIX-compatible.
2020-08-08 20:04:20 +00:00
static void for_each_in_pgrp(ProcessGroupID, Callback);
Add clang-format file Also run it across the whole tree to get everything using the One True Style. We don't yet run this in an automated fashion as it's a little slow, but there is a snippet to do so in makeall.sh.
2019-05-28 09:53:16 +00:00
template<typename Callback>
void for_each_child(Callback);
Kernel: Move process thread lists into protected data
2021-03-11 13:12:55 +00:00
Add clang-format file Also run it across the whole tree to get everything using the One True Style. We don't yet run this in an automated fashion as it's a little slow, but there is a snippet to do so in makeall.sh.
2019-05-28 09:53:16 +00:00
template<typename Callback>
Kernel: Move process thread lists into protected data
2021-03-11 13:12:55 +00:00
IterationDecision for_each_thread(Callback);
template<typename Callback>
IterationDecision for_each_thread(Callback callback) const;
Basic ^C interrupt implementation. For testing, I made cat put itself into a new process group. This should eventually be done by sh between fork() and exec().
2018-11-02 13:06:48 +00:00
Deallocate PTY's when they close. This required a fair bit of plumbing. The CharacterDevice::close() virtual will now be closed by ~FileDescriptor(), allowing device implementations to do custom cleanup at that point. One big problem remains: if the master PTY is closed before the slave PTY, we go into crashy land.
2019-01-30 17:26:19 +00:00
void die();
Kernel: Change wait blocking to Process-only blocking This prevents zombies created by multi-threaded applications and brings our model back to closer to what other OSs do. This also means that SIGSTOP needs to halt all threads, and SIGCONT needs to resume those threads.
2020-12-09 04:18:45 +00:00
void finalize();
Import the "gerbert" kernel I worked on earlier this year. It's a lot crappier than I remembered it. It's gonna need a lot of work.
2018-10-16 09:01:38 +00:00
Kernel: Change wait blocking to Process-only blocking This prevents zombies created by multi-threaded applications and brings our model back to closer to what other OSs do. This also means that SIGSTOP needs to halt all threads, and SIGCONT needs to resume those threads.
2020-12-09 04:18:45 +00:00
ThreadTracer* tracer() { return m_tracer.ptr(); }
bool is_traced() const { return !!m_tracer; }
void start_tracing_from(ProcessID tracer);
void stop_tracing();
void tracer_trap(Thread&, const RegisterState&);
Kernel+UserspaceEmulator: Add sys$emuctl() system call This returns ENOSYS if you are running in the real kernel, and some other result if you are running in UserspaceEmulator. There are other ways we could check if we're inside an emulator, but it seemed easier to just ask. :^)
2021-03-09 07:16:00 +00:00
KResultOr<int> sys$emuctl();
Kernel: Make all syscall functions return KResultOr<T> This makes it a lot easier to return errors since we no longer have to worry about negating EFOO errors and can just return them flat.
2021-03-01 12:49:16 +00:00
KResultOr<int> sys$yield();
KResultOr<int> sys$sync();
KResultOr<int> sys$beep();
KResultOr<int> sys$get_process_name(Userspace<char*> buffer, size_t buffer_size);
KResultOr<int> sys$set_process_name(Userspace<const char*> user_name, size_t user_name_length);
KResultOr<int> sys$watch_file(Userspace<const char*> path, size_t path_length);
KResultOr<int> sys$dbgputch(u8);
KResultOr<int> sys$dbgputstr(Userspace<const u8*>, int length);
KResultOr<int> sys$dump_backtrace();
KResultOr<pid_t> sys$gettid();
KResultOr<int> sys$donate(pid_t tid);
KResultOr<pid_t> sys$setsid();
KResultOr<pid_t> sys$getsid(pid_t);
KResultOr<int> sys$setpgid(pid_t pid, pid_t pgid);
KResultOr<pid_t> sys$getpgrp();
KResultOr<pid_t> sys$getpgid(pid_t);
KResultOr<uid_t> sys$getuid();
KResultOr<gid_t> sys$getgid();
KResultOr<uid_t> sys$geteuid();
KResultOr<gid_t> sys$getegid();
KResultOr<pid_t> sys$getpid();
KResultOr<pid_t> sys$getppid();
KResultOr<int> sys$getresuid(Userspace<uid_t*>, Userspace<uid_t*>, Userspace<uid_t*>);
KResultOr<int> sys$getresgid(Userspace<gid_t*>, Userspace<gid_t*>, Userspace<gid_t*>);
KResultOr<mode_t> sys$umask(mode_t);
KResultOr<int> sys$open(Userspace<const Syscall::SC_open_params*>);
KResultOr<int> sys$close(int fd);
KResultOr<ssize_t> sys$read(int fd, Userspace<u8*>, ssize_t);
KResultOr<ssize_t> sys$readv(int fd, Userspace<const struct iovec*> iov, int iov_count);
Kernel: Use Userspace<T> in sys$write()
2021-03-01 13:35:06 +00:00
KResultOr<ssize_t> sys$write(int fd, Userspace<const u8*>, ssize_t);
Kernel: Make all syscall functions return KResultOr<T> This makes it a lot easier to return errors since we no longer have to worry about negating EFOO errors and can just return them flat.
2021-03-01 12:49:16 +00:00
KResultOr<ssize_t> sys$writev(int fd, Userspace<const struct iovec*> iov, int iov_count);
KResultOr<int> sys$fstat(int fd, Userspace<stat*>);
KResultOr<int> sys$stat(Userspace<const Syscall::SC_stat_params*>);
LibC+Kernel: Switch off_t to 64 bits
2021-03-13 21:02:54 +00:00
KResultOr<int> sys$lseek(int fd, Userspace<off_t*>, int whence);
KResultOr<int> sys$ftruncate(int fd, Userspace<off_t*>);
Kernel: Make all syscall functions return KResultOr<T> This makes it a lot easier to return errors since we no longer have to worry about negating EFOO errors and can just return them flat.
2021-03-01 12:49:16 +00:00
KResultOr<int> sys$kill(pid_t pid_or_pgid, int sig);
Use modern C++ attributes instead of __attribute__ voodoo. This is quite nice, although I wish [[gnu::always_inline]] implied inline. Also "gnu::" is kind of a wart, but whatcha gonna do.
2019-02-15 11:30:48 +00:00
[[noreturn]] void sys$exit(int status);
Kernel: Make all syscall functions return KResultOr<T> This makes it a lot easier to return errors since we no longer have to worry about negating EFOO errors and can just return them flat.
2021-03-01 12:49:16 +00:00
KResultOr<int> sys$sigreturn(RegisterState& registers);
KResultOr<pid_t> sys$waitid(Userspace<const Syscall::SC_waitid_params*>);
KResultOr<FlatPtr> sys$mmap(Userspace<const Syscall::SC_mmap_params*>);
KResultOr<FlatPtr> sys$mremap(Userspace<const Syscall::SC_mremap_params*>);
Kernel: Use Userspace<T> in sys${munmap,mprotect,madvise,msyscall}()
2021-03-01 14:53:33 +00:00
KResultOr<int> sys$munmap(Userspace<void*>, size_t);
Kernel: Make all syscall functions return KResultOr<T> This makes it a lot easier to return errors since we no longer have to worry about negating EFOO errors and can just return them flat.
2021-03-01 12:49:16 +00:00
KResultOr<int> sys$set_mmap_name(Userspace<const Syscall::SC_set_mmap_name_params*>);
Kernel: Use Userspace<T> in sys${munmap,mprotect,madvise,msyscall}()
2021-03-01 14:53:33 +00:00
KResultOr<int> sys$mprotect(Userspace<void*>, size_t, int prot);
KResultOr<int> sys$madvise(Userspace<void*>, size_t, int advice);
KResultOr<int> sys$msyscall(Userspace<void*>);
Kernel: Make all syscall functions return KResultOr<T> This makes it a lot easier to return errors since we no longer have to worry about negating EFOO errors and can just return them flat.
2021-03-01 12:49:16 +00:00
KResultOr<int> sys$purge(int mode);
Kernel: Use Userspace<T> in sys$select()
2021-03-01 14:07:01 +00:00
KResultOr<int> sys$select(Userspace<const Syscall::SC_select_params*>);
Kernel: Make all syscall functions return KResultOr<T> This makes it a lot easier to return errors since we no longer have to worry about negating EFOO errors and can just return them flat.
2021-03-01 12:49:16 +00:00
KResultOr<int> sys$poll(Userspace<const Syscall::SC_poll_params*>);
Kernel: Use Userspace<T> in sys$get_dir_entries()
2021-03-01 14:04:31 +00:00
KResultOr<ssize_t> sys$get_dir_entries(int fd, Userspace<void*>, ssize_t);
Kernel: Make all syscall functions return KResultOr<T> This makes it a lot easier to return errors since we no longer have to worry about negating EFOO errors and can just return them flat.
2021-03-01 12:49:16 +00:00
KResultOr<int> sys$getcwd(Userspace<char*>, size_t);
KResultOr<int> sys$chdir(Userspace<const char*>, size_t);
KResultOr<int> sys$fchdir(int fd);
KResultOr<int> sys$adjtime(Userspace<const timeval*>, Userspace<timeval*>);
KResultOr<int> sys$gettimeofday(Userspace<timeval*>);
KResultOr<int> sys$clock_gettime(clockid_t, Userspace<timespec*>);
KResultOr<int> sys$clock_settime(clockid_t, Userspace<const timespec*>);
KResultOr<int> sys$clock_nanosleep(Userspace<const Syscall::SC_clock_nanosleep_params*>);
KResultOr<int> sys$gethostname(Userspace<char*>, ssize_t);
KResultOr<int> sys$sethostname(Userspace<const char*>, ssize_t);
KResultOr<int> sys$uname(Userspace<utsname*>);
KResultOr<int> sys$readlink(Userspace<const Syscall::SC_readlink_params*>);
KResultOr<int> sys$ttyname(int fd, Userspace<char*>, size_t);
KResultOr<int> sys$ptsname(int fd, Userspace<char*>, size_t);
KResultOr<pid_t> sys$fork(RegisterState&);
KResultOr<int> sys$execve(Userspace<const Syscall::SC_execve_params*>);
KResultOr<int> sys$dup2(int old_fd, int new_fd);
Kernel: Use Userspace<T> in sys$sigaction() fuzz-syscalls found a bunch of unaligned accesses into struct sigaction via this syscall. This patch fixes that issue by porting the syscall to Userspace<T> which we should have done anyway. :^) Fixes #5500.
2021-03-01 13:05:42 +00:00
KResultOr<int> sys$sigaction(int signum, Userspace<const sigaction*> act, Userspace<sigaction*> old_act);
Kernel: Make all syscall functions return KResultOr<T> This makes it a lot easier to return errors since we no longer have to worry about negating EFOO errors and can just return them flat.
2021-03-01 12:49:16 +00:00
KResultOr<int> sys$sigprocmask(int how, Userspace<const sigset_t*> set, Userspace<sigset_t*> old_set);
KResultOr<int> sys$sigpending(Userspace<sigset_t*>);
KResultOr<int> sys$getgroups(ssize_t, Userspace<gid_t*>);
KResultOr<int> sys$setgroups(ssize_t, Userspace<const gid_t*>);
KResultOr<int> sys$pipe(int pipefd[2], int flags);
KResultOr<int> sys$killpg(pid_t pgrp, int sig);
KResultOr<int> sys$seteuid(uid_t);
KResultOr<int> sys$setegid(gid_t);
KResultOr<int> sys$setuid(uid_t);
KResultOr<int> sys$setgid(gid_t);
KResultOr<int> sys$setresuid(uid_t, uid_t, uid_t);
KResultOr<int> sys$setresgid(gid_t, gid_t, gid_t);
KResultOr<unsigned> sys$alarm(unsigned seconds);
KResultOr<int> sys$access(Userspace<const char*> pathname, size_t path_length, int mode);
KResultOr<int> sys$fcntl(int fd, int cmd, u32 extra_arg);
KResultOr<int> sys$ioctl(int fd, unsigned request, FlatPtr arg);
KResultOr<int> sys$mkdir(Userspace<const char*> pathname, size_t path_length, mode_t mode);
KResultOr<clock_t> sys$times(Userspace<tms*>);
KResultOr<int> sys$utime(Userspace<const char*> pathname, size_t path_length, Userspace<const struct utimbuf*>);
KResultOr<int> sys$link(Userspace<const Syscall::SC_link_params*>);
KResultOr<int> sys$unlink(Userspace<const char*> pathname, size_t path_length);
KResultOr<int> sys$symlink(Userspace<const Syscall::SC_symlink_params*>);
KResultOr<int> sys$rmdir(Userspace<const char*> pathname, size_t path_length);
KResultOr<int> sys$mount(Userspace<const Syscall::SC_mount_params*>);
KResultOr<int> sys$umount(Userspace<const char*> mountpoint, size_t mountpoint_length);
KResultOr<int> sys$chmod(Userspace<const char*> pathname, size_t path_length, mode_t);
KResultOr<int> sys$fchmod(int fd, mode_t);
KResultOr<int> sys$chown(Userspace<const Syscall::SC_chown_params*>);
KResultOr<int> sys$fchown(int fd, uid_t, gid_t);
KResultOr<int> sys$socket(int domain, int type, int protocol);
KResultOr<int> sys$bind(int sockfd, Userspace<const sockaddr*> addr, socklen_t);
KResultOr<int> sys$listen(int sockfd, int backlog);
KResultOr<int> sys$accept(int sockfd, Userspace<sockaddr*>, Userspace<socklen_t*>);
KResultOr<int> sys$connect(int sockfd, Userspace<const sockaddr*>, socklen_t);
KResultOr<int> sys$shutdown(int sockfd, int how);
KResultOr<ssize_t> sys$sendmsg(int sockfd, Userspace<const struct msghdr*>, int flags);
KResultOr<ssize_t> sys$recvmsg(int sockfd, Userspace<struct msghdr*>, int flags);
KResultOr<int> sys$getsockopt(Userspace<const Syscall::SC_getsockopt_params*>);
KResultOr<int> sys$setsockopt(Userspace<const Syscall::SC_setsockopt_params*>);
KResultOr<int> sys$getsockname(Userspace<const Syscall::SC_getsockname_params*>);
KResultOr<int> sys$getpeername(Userspace<const Syscall::SC_getpeername_params*>);
KResultOr<int> sys$sched_setparam(pid_t pid, Userspace<const struct sched_param*>);
KResultOr<int> sys$sched_getparam(pid_t pid, Userspace<struct sched_param*>);
KResultOr<int> sys$create_thread(void* (*)(void*), Userspace<const Syscall::SC_create_thread_params*>);
[[noreturn]] void sys$exit_thread(Userspace<void*>);
KResultOr<int> sys$join_thread(pid_t tid, Userspace<void**> exit_value);
KResultOr<int> sys$detach_thread(pid_t tid);
KResultOr<int> sys$set_thread_name(pid_t tid, Userspace<const char*> buffer, size_t buffer_size);
KResultOr<int> sys$get_thread_name(pid_t tid, Userspace<char*> buffer, size_t buffer_size);
KResultOr<int> sys$rename(Userspace<const Syscall::SC_rename_params*>);
KResultOr<int> sys$mknod(Userspace<const Syscall::SC_mknod_params*>);
KResultOr<int> sys$halt();
KResultOr<int> sys$reboot();
KResultOr<int> sys$realpath(Userspace<const Syscall::SC_realpath_params*>);
KResultOr<ssize_t> sys$getrandom(Userspace<void*>, size_t, unsigned int);
KResultOr<int> sys$getkeymap(Userspace<const Syscall::SC_getkeymap_params*>);
KResultOr<int> sys$setkeymap(Userspace<const Syscall::SC_setkeymap_params*>);
KResultOr<int> sys$module_load(Userspace<const char*> path, size_t path_length);
KResultOr<int> sys$module_unload(Userspace<const char*> name, size_t name_length);
KResultOr<int> sys$profiling_enable(pid_t);
KResultOr<int> sys$profiling_disable(pid_t);
KResultOr<int> sys$futex(Userspace<const Syscall::SC_futex_params*>);
KResultOr<int> sys$chroot(Userspace<const char*> path, size_t path_length, int mount_flags);
KResultOr<int> sys$pledge(Userspace<const Syscall::SC_pledge_params*>);
KResultOr<int> sys$unveil(Userspace<const Syscall::SC_unveil_params*>);
KResultOr<int> sys$perf_event(int type, FlatPtr arg1, FlatPtr arg2);
Kernel: Use Userspace<T> in sys$get_stack_bounds()
2021-03-01 13:50:36 +00:00
KResultOr<int> sys$get_stack_bounds(Userspace<FlatPtr*> stack_base, Userspace<size_t*> stack_size);
Kernel: Make all syscall functions return KResultOr<T> This makes it a lot easier to return errors since we no longer have to worry about negating EFOO errors and can just return them flat.
2021-03-01 12:49:16 +00:00
KResultOr<int> sys$ptrace(Userspace<const Syscall::SC_ptrace_params*>);
KResultOr<int> sys$sendfd(int sockfd, int fd);
KResultOr<int> sys$recvfd(int sockfd, int options);
KResultOr<long> sys$sysconf(int name);
KResultOr<int> sys$disown(ProcessID);
KResultOr<FlatPtr> sys$allocate_tls(size_t);
KResultOr<int> sys$prctl(int option, FlatPtr arg1, FlatPtr arg2);
KResultOr<int> sys$set_coredump_metadata(Userspace<const Syscall::SC_set_coredump_metadata_params*>);
[[noreturn]] void sys$abort();
KResultOr<int> sys$anon_create(size_t, int options);
Kernel: Add a simple shared memory API for two processes only. And use this to implement shared bitmaps between WindowServer and clients.
2019-02-16 11:13:43 +00:00
Kernel: Remove SmapDisablers in sys$getsockname() and sys$getpeername() Instead use the user/kernel copy helpers to only copy the minimum stuff needed from to/from userspace. Based on work started by Brian Gianforcaro.
2020-01-27 20:11:36 +00:00
template<bool sockname, typename Params>
int get_sock_or_peer_name(const Params&);
Import the "gerbert" kernel I worked on earlier this year. It's a lot crappier than I remembered it. It's gonna need a lot of work.
2018-10-16 09:01:38 +00:00
static void initialize();
Kernel: Crash the current process on OOM (instead of panicking kernel) This patch adds PageFaultResponse::OutOfMemory which informs the fault handler that we were unable to allocate a necessary physical page and cannot continue. In response to this, the kernel will crash the current process. Because we are OOM, we can't symbolicate the crash like we normally would (since the ELF symbolication code needs to allocate), so we also communicate to Process::crash() that we're out of memory. Now we can survive "allocate 300 MB" (only the allocate process dies.) This is definitely not perfect and can easily end up killing a random innocent other process who happened to allocate one page at the wrong time, but it's a *lot* better than panicking on OOM. :^)
2020-05-06 19:11:38 +00:00
[[noreturn]] void crash(int signal, u32 eip, bool out_of_memory = false);
Kernel: Move block condition evaluation out of the Scheduler This makes the Scheduler a lot leaner by not having to evaluate block conditions every time it is invoked. Instead evaluate them as the states change, and unblock threads at that point. This also implements some more waitid/waitpid/wait features and behavior. For example, WUNTRACED and WNOWAIT are now supported. And wait will now not return EINTR when SIGCHLD is delivered at the same time.
2020-11-29 23:05:27 +00:00
[[nodiscard]] siginfo_t wait_info();
Actually destroy tasks after they crash.
2018-10-17 22:26:30 +00:00
Virtual consoles kinda work! We now make three VirtualConsoles at boot: tty0, tty1, and tty2. We launch an instance of /bin/sh in each one. You switch between them with Alt+1/2/3 How very very cool :^)
2018-10-30 14:33:37 +00:00
const TTY* tty() const { return m_tty; }
Kernel: Reduce header dependencies of Process and Thread
2020-02-16 01:01:42 +00:00
void set_tty(TTY*);
Virtual consoles kinda work! We now make three VirtualConsoles at boot: tty0, tty1, and tty2. We launch an instance of /bin/sh in each one. You switch between them with Alt+1/2/3 How very very cool :^)
2018-10-30 14:33:37 +00:00
AK: Rename the common integer typedefs to make it obvious what they are. These types can be picked up by including <AK/Types.h>: * u8, u16, u32, u64 (unsigned) * i8, i16, i32, i64 (signed)
2019-07-03 19:17:35 +00:00
u32 m_ticks_in_user { 0 };
u32 m_ticks_in_kernel { 0 };
Implement basic support for times(). The kernel now bills processes for time spent in kernelspace and userspace separately. The accounting is forwarded to the parent process in reap(). This makes the "time" builtin in bash work.
2018-12-03 00:12:26 +00:00
AK: Rename the common integer typedefs to make it obvious what they are. These types can be picked up by including <AK/Types.h>: * u8, u16, u32, u64 (unsigned) * i8, i16, i32, i64 (signed)
2019-07-03 19:17:35 +00:00
u32 m_ticks_in_user_for_dead_children { 0 };
u32 m_ticks_in_kernel_for_dead_children { 0 };
Implement basic support for times(). The kernel now bills processes for time spent in kernelspace and userspace separately. The accounting is forwarded to the parent process in reap(). This makes the "time" builtin in bash work.
2018-12-03 00:12:26 +00:00
Kernel: Rename Process::cwd_custody() to Process::current_directory(). ...and executable_custody() to just executable().
2019-05-30 18:23:50 +00:00
Custody& current_directory();
Kernel: Expose process executable paths in /proc/all
2020-12-26 23:54:13 +00:00
Custody* executable() { return m_executable.ptr(); }
const Custody* executable() const { return m_executable.ptr(); }
Add a VFS::absolutePath(InodeIdentifier). This is pretty inefficient for ext2fs. We walk the entire block group containing the inode, searching through every directory for an entry referencing this inode. It might be a good idea to cache this information somehow. I'm not sure how often we'll be searching for it. Obviously there are multiple caching layers missing in the file system.
2018-10-28 11:20:25 +00:00
Kernel: Store process arguments and environment in coredumps Currently they're only pushed onto the stack but not easily accessible from the Process class, so this adds a Vector<String> for both.
2021-01-15 19:21:03 +00:00
const Vector<String>& arguments() const { return m_arguments; };
const Vector<String>& environment() const { return m_environment; };
Kernel: And some more KResult/KResultOr<T> porting work.
2019-03-06 21:30:13 +00:00
int number_of_open_file_descriptors() const;
Kernel: Move syscall implementations out of Process.cpp This is something I've been meaning to do for a long time, and here we finally go. This patch moves all sys$foo functions out of Process.cpp and into files in Kernel/Syscalls/. It's not exactly one syscall per file (although it could be, but I got a bit tired of the repetitive work here..) This makes hacking on individual syscalls a lot less painful since you don't have to rebuild nearly as much code every time. I'm also hopeful that this makes it easier to understand individual syscalls. :^)
2020-07-30 21:38:15 +00:00
int max_open_file_descriptors() const
{
return m_max_open_file_descriptors;
}
Preallocate the maximum number of FileHandle pointers (fds) in every process. This could even use a more specific data structure since it doesn't need the grow/shrink capabilities of a vector.
2018-11-01 12:39:28 +00:00
Kernel: Use KResult a bit more in sys$execve()
2021-02-18 07:51:06 +00:00
KResult exec(String path, Vector<String> arguments, Vector<String> environment, int recusion_depth = 0);
Implement fork()! This is quite cool! The syscall entry point plumbs the register dump down to sys$fork(), which uses it to set up the child process's TSS in order to resume execution right after the int 0x80 fork() call. :^) This works pretty well, although there is some problem with the kernel alias mappings used to clone the parent process's regions. If I disable the MM::release_page_directory() code, there's no problem. Probably there's a premature freeing of a physical page somehow.
2018-11-02 19:41:58 +00:00
Kernel: Plumb the elf header of the main program down to Process::load This will enable us to take the desired load address of non-position independent programs into account when randomizing the load address of the dynamic loader.
2021-01-10 19:07:08 +00:00
KResultOr<LoadResult> load(NonnullRefPtr<FileDescription> main_program_description, RefPtr<FileDescription> interpreter_description, const Elf32_Ehdr& main_program_header);
Kernel: Add ability to load interpreter instead of main program When the main executable needs an interpreter, we load the requested interpreter program, and pass to it an open file decsriptor to the main executable via the auxiliary vector. Note that we do not allocate a TLS region for the interpreter.
2020-10-10 09:13:21 +00:00
Kernel: Move select Process members into protected memory Process member variable like m_euid are very valuable targets for kernel exploits and until now they have been writable at all times. This patch moves m_euid along with a whole bunch of other members into a new Process::ProtectedData struct. This struct is remapped as read-only memory whenever we don't need to write to it. This means that a kernel write primitive is no longer enough to overwrite a process's effective UID, you must first unprotect the protected data where the UID is stored. :^)
2021-03-10 18:59:46 +00:00
bool is_superuser() const { return euid() == 0; }
Add some basic setgroups(), getgroups() and initgroups(). Also teach /bin/id to print the user's supplemental groups.
2018-11-07 00:38:51 +00:00
AK: Rename the common integer typedefs to make it obvious what they are. These types can be picked up by including <AK/Types.h>: * u8, u16, u32, u64 (unsigned) * i8, i16, i32, i64 (signed)
2019-07-03 19:17:35 +00:00
void terminate_due_to_signal(u8 signal);
Kernel: Sending a signal to a process now goes to the main thread Instead of falling back to the suspicious "any_thread()" mechanism, just fail with ESRCH if you try to kill() a PID that doesn't have a corresponding TID.
2020-05-16 10:33:48 +00:00
KResult send_signal(u8 signal, Process* sender);
Kernel: Introduce threads, and refactor everything in support of it. The scheduler now operates on threads, rather than on processes. Each process has a main thread, and can have any number of additional threads. The process exits when the main thread exits. This patch doesn't actually spawn any additional threads, it merely does all the plumbing needed to make it possible. :^)
2019-03-23 21:03:17 +00:00
Kernel+LibELF: Store termination signal in coredump ProcessInfo
2021-01-03 20:46:38 +00:00
u8 termination_signal() const { return m_termination_signal; }
Kernel: Move syscall implementations out of Process.cpp This is something I've been meaning to do for a long time, and here we finally go. This patch moves all sys$foo functions out of Process.cpp and into files in Kernel/Syscalls/. It's not exactly one syscall per file (although it could be, but I got a bit tired of the repetitive work here..) This makes hacking on individual syscalls a lot less painful since you don't have to rebuild nearly as much code every time. I'm also hopeful that this makes it easier to understand individual syscalls. :^)
2020-07-30 21:38:15 +00:00
u16 thread_count() const
{
Kernel: Move block condition evaluation out of the Scheduler This makes the Scheduler a lot leaner by not having to evaluate block conditions every time it is invoked. Instead evaluate them as the states change, and unblock threads at that point. This also implements some more waitid/waitpid/wait features and behavior. For example, WUNTRACED and WNOWAIT are now supported. And wait will now not return EINTR when SIGCHLD is delivered at the same time.
2020-11-29 23:05:27 +00:00
return m_thread_count.load(AK::MemoryOrder::memory_order_relaxed);
Kernel: Move syscall implementations out of Process.cpp This is something I've been meaning to do for a long time, and here we finally go. This patch moves all sys$foo functions out of Process.cpp and into files in Kernel/Syscalls/. It's not exactly one syscall per file (although it could be, but I got a bit tired of the repetitive work here..) This makes hacking on individual syscalls a lot less painful since you don't have to rebuild nearly as much code every time. I'm also hopeful that this makes it easier to understand individual syscalls. :^)
2020-07-30 21:38:15 +00:00
}
Kernel: Get rid of "main thread" concept The idea of all processes reliably having a main thread was nice in some ways, but cumbersome in others. More importantly, it didn't match up with POSIX thread semantics, so let's move away from it. This thread gets rid of Process::main_thread() and you now we just have a bunch of Thread objects floating around each Process. When the finalizer nukes the last Thread in a Process, it will also tear down the Process. There's a bunch of more things to fix around this, but this is where we get started :^)
2019-12-22 10:35:02 +00:00
Kernel: Prevent execve/ptrace race Add a per-process ptrace lock and use it to prevent ptrace access to a process after it decides to commit to a new executable in sys$execve(). Fixes #5230.
2021-02-08 22:01:53 +00:00
Lock& big_lock() { return m_big_lock; }
Lock& ptrace_lock() { return m_ptrace_lock; }
Kernel: Add a blunt big process lock. We can't have multiple threads in the same process running in the kernel at the same time, so let's have a per-process lock that threads have to acquire on syscall entry/exit (and yield while blocked.)
2019-04-01 18:02:05 +00:00
Kernel: Add a basic chroot() syscall :^) The chroot() syscall now allows the superuser to isolate a process into a specific subtree of the filesystem. This is not strictly permanent, as it is also possible for a superuser to break *out* of a chroot, but it is a useful mechanism for isolating unprivileged processes. The VFS now uses the current process's root_directory() as the root for path resolution purposes. The root directory is stored as an uncached Custody in the Process object.
2020-01-10 22:14:04 +00:00
Custody& root_directory();
Kernel: Don't forget to copy & destroy root_directory_for_procfs Also, rename it to root_directory_relative_to_global_root.
2020-01-12 18:42:01 +00:00
Custody& root_directory_relative_to_global_root();
Kernel: Add a basic chroot() syscall :^) The chroot() syscall now allows the superuser to isolate a process into a specific subtree of the filesystem. This is not strictly permanent, as it is also possible for a superuser to break *out* of a chroot, but it is a useful mechanism for isolating unprivileged processes. The VFS now uses the current process's root_directory() as the root for path resolution purposes. The root directory is stored as an uncached Custody in the Process object.
2020-01-10 22:14:04 +00:00
void set_root_directory(const Custody&);
Kernel: Don't keep protected Process data in a separate allocation The previous architecture had a huge flaw: the pointer to the protected data was itself unprotected, allowing you to overwrite it at any time. This patch reorganizes the protected data so it's part of the Process class itself. (Actually, it's a new ProcessBase helper class.) We use the first 4 KB of Process objects themselves as the new storage location for protected data. Then we make Process objects page-aligned using MAKE_ALIGNED_ALLOCATED. This allows us to easily turn on/off write-protection for everything in the ProcessBase portion of Process. :^) Thanks to @bugaevc for pointing out the flaw! This is still not perfect but it's an improvement.
2021-03-11 12:13:05 +00:00
bool has_promises() const { return m_has_promises; }
bool has_promised(Pledge pledge) const { return m_promises & (1u << (u32)pledge); }
ping: Use pledge()
2020-01-11 19:48:43 +00:00
Kernel: Move syscall implementations out of Process.cpp This is something I've been meaning to do for a long time, and here we finally go. This patch moves all sys$foo functions out of Process.cpp and into files in Kernel/Syscalls/. It's not exactly one syscall per file (although it could be, but I got a bit tired of the repetitive work here..) This makes hacking on individual syscalls a lot less painful since you don't have to rebuild nearly as much code every time. I'm also hopeful that this makes it easier to understand individual syscalls. :^)
2020-07-30 21:38:15 +00:00
VeilState veil_state() const
{
return m_veil_state;
}
Kernel: Implement unveil() as a prefix-tree Fixes #4530.
2020-12-26 10:24:34 +00:00
const UnveilNode& unveiled_paths() const
Kernel: Move syscall implementations out of Process.cpp This is something I've been meaning to do for a long time, and here we finally go. This patch moves all sys$foo functions out of Process.cpp and into files in Kernel/Syscalls/. It's not exactly one syscall per file (although it could be, but I got a bit tired of the repetitive work here..) This makes hacking on individual syscalls a lot less painful since you don't have to rebuild nearly as much code every time. I'm also hopeful that this makes it easier to understand individual syscalls. :^)
2020-07-30 21:38:15 +00:00
{
return m_unveiled_paths;
}
Kernel: Add a basic implementation of unveil() This syscall is a complement to pledge() and adds the same sort of incremental relinquishing of capabilities for filesystem access. The first call to unveil() will "drop a veil" on the process, and from now on, only unveiled parts of the filesystem are visible to it. Each call to unveil() specifies a path to either a directory or a file along with permissions for that path. The permissions are a combination of the following: - r: Read access (like the "rpath" promise) - w: Write access (like the "wpath" promise) - x: Execute access - c: Create/remove access (like the "cpath" promise) Attempts to open a path that has not been unveiled with fail with ENOENT. If the unveiled path lacks sufficient permissions, it will fail with EACCES. Like pledge(), subsequent calls to unveil() with the same path can only remove permissions, not add them. Once you call unveil(nullptr, nullptr), the veil is locked, and it's no longer possible to unveil any more paths for the process, ever. This concept comes from OpenBSD, and their implementation does various things differently, I'm sure. This is just a first implementation for SerenityOS, and we'll keep improving on it as we go. :^)
2020-01-20 21:12:04 +00:00
Kernel: Move syscall implementations out of Process.cpp This is something I've been meaning to do for a long time, and here we finally go. This patch moves all sys$foo functions out of Process.cpp and into files in Kernel/Syscalls/. It's not exactly one syscall per file (although it could be, but I got a bit tired of the repetitive work here..) This makes hacking on individual syscalls a lot less painful since you don't have to rebuild nearly as much code every time. I'm also hopeful that this makes it easier to understand individual syscalls. :^)
2020-07-30 21:38:15 +00:00
bool wait_for_tracer_at_next_execve() const
{
return m_wait_for_tracer_at_next_execve;
}
void set_wait_for_tracer_at_next_execve(bool val)
{
m_wait_for_tracer_at_next_execve = val;
}
ptrace: Add PT_SETREGS PT_SETTREGS sets the regsiters of the traced thread. It can only be used when the tracee is stopped. Also, refactor ptrace. The implementation was getting long and cluttered the alraedy large Process.cpp file. This commit moves the bulk of the implementation to Kernel/Ptrace.cpp, and factors out peek & poke to separate methods of the Process class.
2020-04-07 15:23:37 +00:00
Kernel: Use Userspace<T> in ptrace syscall
2020-08-01 22:25:19 +00:00
KResultOr<u32> peek_user_data(Userspace<const u32*> address);
KResult poke_user_data(Userspace<u32*> address, u32 data);
ptrace: Add PT_SETREGS PT_SETTREGS sets the regsiters of the traced thread. It can only be used when the tracee is stopped. Also, refactor ptrace. The implementation was getting long and cluttered the alraedy large Process.cpp file. This commit moves the bulk of the implementation to Kernel/Ptrace.cpp, and factors out peek & poke to separate methods of the Process class.
2020-04-07 15:23:37 +00:00
Kernel: disown should unblock any potential waiters This is necessary because if a process changes the state to Stopped or resumes from that state, a wait entry is created in the parent process. So, if a child process does this before disown is called, we need to clear those entries to avoid leaking references/zombies that won't be cleaned up until the former parent exits. This also should solve an even more unlikely corner case where another thread is waiting on a pid that is being disowned by another thread.
2020-12-09 02:04:05 +00:00
void disowned_by_waiter(Process& process);
Kernel: Change wait blocking to Process-only blocking This prevents zombies created by multi-threaded applications and brings our model back to closer to what other OSs do. This also means that SIGSTOP needs to halt all threads, and SIGCONT needs to resume those threads.
2020-12-09 04:18:45 +00:00
void unblock_waiters(Thread::WaitBlocker::UnblockFlags, u8 signal = 0);
Kernel: Move block condition evaluation out of the Scheduler This makes the Scheduler a lot leaner by not having to evaluate block conditions every time it is invoked. Instead evaluate them as the states change, and unblock threads at that point. This also implements some more waitid/waitpid/wait features and behavior. For example, WUNTRACED and WNOWAIT are now supported. And wait will now not return EINTR when SIGCHLD is delivered at the same time.
2020-11-29 23:05:27 +00:00
Thread::WaitBlockCondition& wait_block_condition() { return m_wait_block_condition; }
Kernel: Set "pledge_violation" coredump metadata in REQUIRE_PROMISE() Similar to LibC storing an assertion message before aborting, process death by pledge violation now sets a "pledge_violation" key with the respective pledge name as value in its coredump metadata, which the CrashReporter will then show.
2021-01-20 19:10:13 +00:00
HashMap<String, String>& coredump_metadata() { return m_coredump_metadata; }
Kernel: Add sys$set_coredump_metadata() syscall This can be used by applications to store information (key/value pairs) likely useful for debugging, which will then be embedded in the coredump.
2020-12-30 14:19:57 +00:00
const HashMap<String, String>& coredump_metadata() const { return m_coredump_metadata; }
Kernel: Generate coredump backtraces from "threads for coredump" list This broke with the change that gave each process a list of its own threads. Since threads are removed slightly earlier from that list during process teardown, we're not able to use it for generating coredump backtraces. Fortunately we have the "threads for coredump" list for just this purpose. :^)
2021-01-28 07:41:18 +00:00
const NonnullRefPtrVector<Thread>& threads_for_coredump(Badge<CoreDump>) const { return m_threads_for_coredump; }
Kernel+Profiler: Make profiling per-process and without core dumps This patch merges the profiling functionality in the kernel with the performance events mechanism. A profiler sample is now just another perf event, rather than a dedicated thing. Since perf events were already per-process, this now makes profiling per-process as well. Processes with perf events would already write out a perfcore.PID file to the current directory on death, but since we may want to profile a process and then let it continue running, recorded perf events can now be accessed at any time via /proc/PID/perf_events. This patch also adds information about process memory regions to the perfcore JSON format. This removes the need to supply a core dump to the Profiler app for symbolication, and so the "profiler coredump" mechanism is removed entirely. There's still a hard limit of 4MB worth of perf events per process, so this is by no means a perfect final design, but it's a nice step forward for both simplicity and stability. Fixes #4848 Fixes #4849
2021-01-11 08:52:18 +00:00
PerformanceEventBuffer* perf_events() { return m_perf_event_buffer; }
Kernel: Factor address space management out of the Process class This patch adds Space, a class representing a process's address space. - Each Process has a Space. - The Space owns the PageDirectory and all Regions in the Process. This allows us to reorganize sys$execve() so that it constructs and populates a new Space fully before committing to it. Previously, we would construct the new address space while still running in the old one, and encountering an error meant we had to do tedious and error-prone rollback. Those problems are now gone, replaced by what's hopefully a set of much smaller problems and missing cleanups. :^)
2021-02-08 14:45:40 +00:00
Space& space() { return *m_space; }
const Space& space() const { return *m_space; }
Kernel: Add a way to specify which memory regions can make syscalls This patch adds sys$msyscall() which is loosely based on an OpenBSD mechanism for preventing syscalls from non-blessed memory regions. It works similarly to pledge and unveil, you can call it as many times as you like, and when you're finished, you call it with a null pointer and it will stop accepting new regions from then on. If a syscall later happens and doesn't originate from one of the previously blessed regions, the kernel will simply crash the process.
2021-02-02 18:56:11 +00:00
Kernel: Map signal trampoline into each process's address space The signal trampoline was previously in kernelspace memory, but with a special exception to make it user-accessible. This patch moves it into each process's regular address space so we can stop supporting user-allowed memory above 0xc0000000.
2021-02-13 23:53:53 +00:00
VirtualAddress signal_trampoline() const { return m_signal_trampoline; }
Import the "gerbert" kernel I worked on earlier this year. It's a lot crappier than I remembered it. It's gonna need a lot of work.
2018-10-16 09:01:38 +00:00
private:
More paging stuff. The test userspace process now runs at linear address 0x300000 which is mapped to a dynamically allocated page from the MemoryManager. Cool!
2018-10-18 11:05:00 +00:00
friend class MemoryManager;
Move the scheduler code to its own class. This is very mechanical.
2018-11-07 21:15:02 +00:00
friend class Scheduler;
Refactor the virtual memory object model a bit: Process now has a number of Regions. Each Region is backed by a VMObject. A VMObject can be file-backed or anonymous. These can be shared.
2018-11-08 13:35:30 +00:00
friend class Region;
More paging stuff. The test userspace process now runs at linear address 0x300000 which is mapped to a dynamically allocated page from the MemoryManager. Cool!
2018-10-18 11:05:00 +00:00
Kernel: Keep a list of threads per Process This allow us to iterate only the threads of the process.
2021-01-23 06:24:33 +00:00
bool add_thread(Thread&);
bool remove_thread(Thread&);
Kernel: Make Thread refcounted Similar to Process, we need to make Thread refcounted. This will solve problems that will appear once we schedule threads on more than one processor. This allows us to hold onto threads without necessarily holding the scheduler lock for the entire duration.
2020-09-27 14:53:35 +00:00
Process(RefPtr<Thread>& first_thread, const String& name, uid_t, gid_t, ProcessID ppid, bool is_kernel_process, RefPtr<Custody> cwd = nullptr, RefPtr<Custody> executable = nullptr, TTY* = nullptr, Process* fork_parent = nullptr);
Kernel: PID/TID typing This compiles, and contains exactly the same bugs as before. The regex 'FIXME: PID/' should reveal all markers that I left behind, including: - Incomplete conversion - Issues or things that look fishy - Actual bugs that will go wrong during runtime
2020-08-08 15:32:34 +00:00
static ProcessID allocate_pid();
Unify the Task constructors. There's now Task::create() and Task::createKernelTask().
2018-10-25 09:15:17 +00:00
Kernel: Allow process with multiple threads to call exec and exit This allows a process wich has more than 1 thread to call exec, even from a thread. This kills all the other threads, but it won't wait for them to finish, just makes sure that they are not in a running/runable state. In the case where a thread does exec, the new program PID will be the thread TID, to keep the PID == TID in the new process. This introduces a new function inside the Process class, kill_threads_except_self which is called on exit() too (exit with multiple threads wasn't properly working either). Inside the Lock class, there is the need for a new function, clear_waiters, which removes all the waiters from the Process::big_lock. This is needed since after a exit/exec, there should be no other threads waiting for this lock, the threads should be simply killed. Only queued threads should wait for this lock at this point, since blocked threads are handled in set_should_die.
2020-02-18 12:28:28 +00:00
void kill_threads_except_self();
void kill_all_threads();
Kernel: Don't dump perfcore for non-dumpable processes Fixes #4904
2021-01-11 17:53:45 +00:00
bool dump_core();
bool dump_perfcore();
Kernel: Better handling of allocation failure in profiling If we can't allocate a PerformanceEventBuffer to store the profiling events, we now fail sys$profiling_enable() and sys$perf_event() with ENOMEM instead of carrying on with a broken buffer.
2021-03-02 15:55:54 +00:00
bool create_perf_events_buffer_if_needed();
Kernel: Allow process with multiple threads to call exec and exit This allows a process wich has more than 1 thread to call exec, even from a thread. This kills all the other threads, but it won't wait for them to finish, just makes sure that they are not in a running/runable state. In the case where a thread does exec, the new program PID will be the thread TID, to keep the PID == TID in the new process. This introduces a new function inside the Process class, kill_threads_except_self which is called on exit() too (exit with multiple threads wasn't properly working either). Inside the Lock class, there is the need for a new function, clear_waiters, which removes all the waiters from the Process::big_lock. This is needed since after a exit/exec, there should be no other threads waiting for this lock, the threads should be simply killed. Only queued threads should wait for this lock at this point, since blocked threads are handled in set_should_die.
2020-02-18 12:28:28 +00:00
Kernel: Use KResult a bit more in sys$execve()
2021-02-18 07:51:06 +00:00
KResult do_exec(NonnullRefPtr<FileDescription> main_program_description, Vector<String> arguments, Vector<String> environment, RefPtr<FileDescription> interpreter_description, Thread*& new_main_thread, u32& prev_flags, const Elf32_Ehdr& main_program_header);
Kernel: Make all syscall functions return KResultOr<T> This makes it a lot easier to return errors since we no longer have to worry about negating EFOO errors and can just return them flat.
2021-03-01 12:49:16 +00:00
KResultOr<ssize_t> do_write(FileDescription&, const UserOrKernelBuffer&, size_t);
Import the "gerbert" kernel I worked on earlier this year. It's a lot crappier than I remembered it. It's gonna need a lot of work.
2018-10-16 09:01:38 +00:00
Kernel: Plumb the elf header of the main program down to Process::load This will enable us to take the desired load address of non-position independent programs into account when randomizing the load address of the dynamic loader.
2021-01-10 19:07:08 +00:00
KResultOr<RefPtr<FileDescription>> find_elf_interpreter_for_executable(const String& path, const Elf32_Ehdr& elf_header, int nread, size_t file_size);
Kernel: Tighten up exec/do_exec and allow for PT_INTERP iterpreters This patch changes how exec() figures out which program image to actually load. Previously, we opened the path to our main executable in find_shebang_interpreter_for_executable, read the first page (or less, if the file was smaller) and then decided whether to recurse with the interpreter instead. We then then re-opened the main executable in do_exec. However, since we now want to parse the ELF header and Program Headers of an elf image before even doing any memory region work, we can change the way this whole process works. We open the file and read (up to) the first page in exec() itself, then pass just the page and the amount read to find_shebang_interpreter_for_executable. Since we now have that page and the FileDescription for the main executable handy, we can do a few things. First, validate the ELF header and ELF program headers for any shenanigans. ELF32 Little Endian i386 only, please. Second, we can grab the PT_INTERP interpreter from any ET_DYN files, and open that guy right away if it exists. Finally, we can pass the main executable's and optionally the PT_INTERP interpreter's file descriptions down to do_exec and not have to feel guilty about opening the file twice. In do_exec, we now have a choice. Are we going to load the main executable, or the interpreter? We could load both, but it'll be way easier for the inital pass on the RTLD if we only load the interpreter. Then it can load the main executable itself like any old shared object, just, the one with main in it :). Later on we can load both of them into memory and the RTLD can relocate itself before trying to do anything. The way it's written now the RTLD will get dibs on its requested virtual addresses being the actual virtual addresses.
2020-01-11 01:28:02 +00:00
Kernel: Use alloc_fd() more instead of walking fd list manually.
2019-04-06 12:54:32 +00:00
int alloc_fd(int first_candidate_fd = 0);
Add primitive FIFO and hook it up to sys$pipe(). It's now possible to do this in bash: cat kernel.map | fgrep List This is very cool! :^)
2018-11-12 00:28:46 +00:00
Kernel: Implement the killpg() syscall
2019-11-14 16:16:30 +00:00
KResult do_kill(Process&, int signal);
Kernel: More PID/TID typing
2020-08-08 23:08:24 +00:00
KResult do_killpg(ProcessGroupID pgrp, int signal);
Kernel: Support signaling all processes with pid == -1 This is a special case that was previously not implemented. The idea is that you can dispatch a signal to all other processes the calling process has access to. There was some minor refactoring to make the self signal logic into a function so it could easily be easily re-used from do_killall.
2020-04-26 00:45:23 +00:00
KResult do_killall(int signal);
KResult do_killself(int signal);
Kernel: Implement the killpg() syscall
2019-11-14 16:16:30 +00:00
Kernel+LibC: Add sys$waitid(), and make sys$waitpid() wrap it sys$waitid() takes an explicit description of whether it's waiting for a single process with the given PID, all of the children, a group, etc., and returns its info as a siginfo_t. It also doesn't automatically imply WEXITED, which clears up the confusion in the kernel.
2020-02-05 16:42:43 +00:00
KResultOr<siginfo_t> do_waitid(idtype_t idtype, int id, int options);
Kernel: Use the Syscall string and buffer types more While I was updating syscalls to stop passing null-terminated strings, I added some helpful struct types: - StringArgument { const char*; size_t; } - ImmutableBuffer<Data, Size> { const Data*; Size; } - MutableBuffer<Data, Size> { Data*; Size; } The Process class has some convenience functions for validating and optionally extracting the contents from these structs: - get_syscall_path_argument(StringArgument) - validate_and_copy_string_from_user(StringArgument) - validate(ImmutableBuffer) - validate(MutableBuffer) There's still so much code around this and I'm wondering if we should generate most of it instead. Possible nice little project.
2020-01-11 11:47:47 +00:00
KResultOr<String> get_syscall_path_argument(const char* user_path, size_t path_length) const;
Kernel: Use Userspace<T> for sys$read() and sys$stat() Add validation helper overloads as needed.
2020-07-31 14:28:37 +00:00
KResultOr<String> get_syscall_path_argument(Userspace<const char*> user_path, size_t path_length) const
{
Kernel+AK: Add and use Userspace<T>::unsafe_userspace_ptr() Since we already have the type information in the Userspace template, it was a bit silly to cast manually everywhere. Just add a sufficiently scary-sounding getter for a typed pointer. Thanks @alimpfard for pointing out that I was being silly with tossing out the type. In the future we may want to make this API non-public as well.
2020-07-31 16:46:55 +00:00
return get_syscall_path_argument(user_path.unsafe_userspace_ptr(), path_length);
Kernel: Use Userspace<T> for sys$read() and sys$stat() Add validation helper overloads as needed.
2020-07-31 14:28:37 +00:00
}
Kernel: Use the Syscall string and buffer types more While I was updating syscalls to stop passing null-terminated strings, I added some helpful struct types: - StringArgument { const char*; size_t; } - ImmutableBuffer<Data, Size> { const Data*; Size; } - MutableBuffer<Data, Size> { Data*; Size; } The Process class has some convenience functions for validating and optionally extracting the contents from these structs: - get_syscall_path_argument(StringArgument) - validate_and_copy_string_from_user(StringArgument) - validate(ImmutableBuffer) - validate(MutableBuffer) There's still so much code around this and I'm wondering if we should generate most of it instead. Possible nice little project.
2020-01-11 11:47:47 +00:00
KResultOr<String> get_syscall_path_argument(const Syscall::StringArgument&) const;
Kernel: Pass path+length to mkdir(), rmdir() and chmod()
2020-01-06 10:05:59 +00:00
Kernel: Change wait blocking to Process-only blocking This prevents zombies created by multi-threaded applications and brings our model back to closer to what other OSs do. This also means that SIGSTOP needs to halt all threads, and SIGCONT needs to resume those threads.
2020-12-09 04:18:45 +00:00
bool has_tracee_thread(ProcessID tracer_pid);
Kernel: Add 'ptrace' syscall This commit adds a basic implementation of the ptrace syscall, which allows one process (the tracer) to control another process (the tracee). While a process is being traced, it is stopped whenever a signal is received (other than SIGCONT). The tracer can start tracing another thread with PT_ATTACH, which causes the tracee to stop. From there, the tracer can use PT_CONTINUE to continue the execution of the tracee, or use other request codes (which haven't been implemented yet) to modify the state of the tracee. Additional request codes are PT_SYSCALL, which causes the tracee to continue exection but stop at the next entry or exit from a syscall, and PT_GETREGS which fethces the last saved register set of the tracee (can be used to inspect syscall arguments and return value). A special request code is PT_TRACE_ME, which is issued by the tracee and causes it to stop when it calls execve and wait for the tracer to attach.
2020-03-28 08:47:16 +00:00
Kernel: Some futex improvements This adds support for FUTEX_WAKE_OP, FUTEX_WAIT_BITSET, FUTEX_WAKE_BITSET, FUTEX_REQUEUE, and FUTEX_CMP_REQUEUE, as well well as global and private futex and absolute/relative timeouts against the appropriate clock. This also changes the implementation so that kernel resources are only used when a thread is blocked on a futex. Global futexes are implemented as offsets in VMObjects, so that different processes can share a futex against the same VMObject despite potentially being mapped at different virtual addresses.
2020-12-22 06:21:58 +00:00
void clear_futex_queues_on_exec();
Process now maps regions immediately when they are allocated. This avoids having to do a separate MM.mapRegionsForTask() pass. Also, more Task => Process renaming that I apparently hadn't saved yet.
2018-11-01 12:15:46 +00:00
Process* m_prev { nullptr };
Process* m_next { nullptr };
Import the "gerbert" kernel I worked on earlier this year. It's a lot crappier than I remembered it. It's gonna need a lot of work.
2018-10-16 09:01:38 +00:00
String m_name;
Kernel: Introduce threads, and refactor everything in support of it. The scheduler now operates on threads, rather than on processes. Each process has a main thread, and can have any number of additional threads. The process exits when the main thread exits. This patch doesn't actually spawn any additional threads, it merely does all the plumbing needed to make it possible. :^)
2019-03-23 21:03:17 +00:00
Kernel: Factor address space management out of the Process class This patch adds Space, a class representing a process's address space. - Each Process has a Space. - The Space owns the PageDirectory and all Regions in the Process. This allows us to reorganize sys$execve() so that it constructs and populates a new Space fully before committing to it. Previously, we would construct the new address space while still running in the old one, and encountering an error meant we had to do tedious and error-prone rollback. Those problems are now gone, replaced by what's hopefully a set of much smaller problems and missing cleanups. :^)
2021-02-08 14:45:40 +00:00
OwnPtr<Space> m_space;
Kernel: Distinguish between new and old process groups with equal pgids This does not add any behaviour change to the processes, but it ties a TTY to an active process group via TIOCSPGRP, and returns the TTY to the kernel when all processes in the process group die. Also makes the TTY keep a link to the original controlling process' parent (for SIGCHLD) instead of the process itself.
2020-08-15 19:13:19 +00:00
RefPtr<ProcessGroup> m_pg;
Kernel: Introduce threads, and refactor everything in support of it. The scheduler now operates on threads, rather than on processes. Each process has a main thread, and can have any number of additional threads. The process exits when the main thread exits. This patch doesn't actually spawn any additional threads, it merely does all the plumbing needed to make it possible. :^)
2019-03-23 21:03:17 +00:00
Kernel: Move select Process members into protected memory Process member variable like m_euid are very valuable targets for kernel exploits and until now they have been writable at all times. This patch moves m_euid along with a whole bunch of other members into a new Process::ProtectedData struct. This struct is remapped as read-only memory whenever we don't need to write to it. This means that a kernel write primitive is no longer enough to overwrite a process's effective UID, you must first unprotect the protected data where the UID is stored. :^)
2021-03-10 18:59:46 +00:00
void protect_data();
void unprotect_data();
Kernel+LibC: Implement seteuid() and friends! Add seteuid()/setegid() under _POSIX_SAVED_IDS semantics, which also requires adding suid and sgid to Process, and changing setuid()/setgid() to honor these semantics. The exact semantics aren't specified by POSIX and differ between different Unix implementations. This patch makes serenity follow FreeBSD. The 2002 USENIX paper "Setuid Demystified" explains the differences well. In addition to seteuid() and setegid() this also adds setreuid()/setregid() and setresuid()/setresgid(), and the accessors getresuid()/getresgid(). Also reorder uid/euid functions so that they are the same order everywhere (namely, the order that geteuid()/getuid() already have).
2020-06-17 12:58:00 +00:00
Kernel: Change wait blocking to Process-only blocking This prevents zombies created by multi-threaded applications and brings our model back to closer to what other OSs do. This also means that SIGSTOP needs to halt all threads, and SIGCONT needs to resume those threads.
2020-12-09 04:18:45 +00:00
OwnPtr<ThreadTracer> m_tracer;
Kernel: Reorder some Process members to shrink the class by 8 bytes
2019-08-08 12:56:50 +00:00
static const int m_max_open_file_descriptors { FD_SETSIZE };
Kernel: Introduce threads, and refactor everything in support of it. The scheduler now operates on threads, rather than on processes. Each process has a main thread, and can have any number of additional threads. The process exits when the main thread exits. This patch doesn't actually spawn any additional threads, it merely does all the plumbing needed to make it possible. :^)
2019-03-23 21:03:17 +00:00
Kernel: Turn Process::FileDescriptionAndFlags into a proper class
2020-07-30 21:50:31 +00:00
class FileDescriptionAndFlags {
public:
operator bool() const { return !!m_description; }
FileDescription* description() { return m_description; }
const FileDescription* description() const { return m_description; }
u32 flags() const { return m_flags; }
void set_flags(u32 flags) { m_flags = flags; }
Kernel: Make FIFO inherit from File.
2019-04-29 02:55:54 +00:00
void clear();
Kernel: Turn Process::FileDescriptionAndFlags into a proper class
2020-07-30 21:50:31 +00:00
void set(NonnullRefPtr<FileDescription>&&, u32 flags = 0);
private:
RefPtr<FileDescription> m_description;
u32 m_flags { 0 };
Add close-on-exec flag for file descriptors. I was surprised to find that dup()'ed fds don't share the close-on-exec flag. That means it has to be stored separately from the FileDescriptor object.
2018-11-13 00:36:31 +00:00
};
Kernel: Rename FileDescriptor to FileDescription. After reading a bunch of POSIX specs, I've learned that a file descriptor is the number that refers to a file description, not the description itself. So this patch renames FileDescriptor to FileDescription, and Process now has FileDescription* file_description(int fd).
2019-06-07 07:36:51 +00:00
Vector<FileDescriptionAndFlags> m_fds;
Rework process states to make a bit more sense. Processes are either alive (with many substates), dead or forgiven. A dead process is forgiven when the parent waitpid()s on it. Dead orphans are also forgiven. There's a lot of work to be done around this.
2018-11-07 17:30:59 +00:00
Kernel: Keep a list of threads per Process This allow us to iterate only the threads of the process.
2021-01-23 06:24:33 +00:00
mutable RecursiveSpinLock m_thread_list_lock;
More paging stuff. The test userspace process now runs at linear address 0x300000 which is mapped to a dynamically allocated page from the MemoryManager. Cool!
2018-10-18 11:05:00 +00:00
Kernel: Rename Process::is_ring0/3 to Process::is_kernel/user_process Since "rings" typically refer to code execution and user processes can also execute in ring 0, rename these functions to more accurately describe what they mean: kernel processes and user processes.
2020-09-10 15:46:24 +00:00
const bool m_is_kernel_process;
Kernel: Reorder some Process members to shrink the class by 8 bytes
2019-08-08 12:56:50 +00:00
bool m_dead { false };
Kernel: Implement a simple process time profiler The kernel now supports basic profiling of all the threads in a process by calling profiling_enable(pid_t). You finish the profiling by calling profiling_disable(pid_t). This all works by recording thread stacks when the timer interrupt fires and the current thread is in a process being profiled. Note that symbolication is deferred until profiling_disable() to avoid adding more noise than necessary to the profile. A simple "/bin/profile" command is included here that can be used to start/stop profiling like so: $ profile 10 on ... wait ... $ profile 10 off After a profile has been recorded, it can be fetched in /proc/profile There are various limits (or "bugs") on this mechanism at the moment: - Only one process can be profiled at a time. - We allocate 8MB for the samples, if you use more space, things will not work, and probably break a bit. - Things will probably fall apart if the profiled process dies during profiling, or while extracing /proc/profile
2019-12-11 19:36:56 +00:00
bool m_profiling { false };
Kernel: Specify default memory order for some non-synchronizing Atomics
2021-01-03 23:58:50 +00:00
Atomic<bool, AK::MemoryOrder::memory_order_relaxed> m_is_stopped { false };
Kernel: Generate a coredump file when a process crashes When a process crashes, we generate a coredump file and write it in /tmp/coredumps/. The coredump file is an ELF file of type ET_CORE. It contains a segment for every userspace memory region of the process, and an additional PT_NOTE segment that contains the registers state for each thread, and a additional data about memory regions (e.g their name).
2020-11-06 08:09:51 +00:00
bool m_should_dump_core { false };
Kernel: Reorder some Process members to shrink the class by 8 bytes
2019-08-08 12:56:50 +00:00
AK: Rename RetainPtr => RefPtr and Retained => NonnullRefPtr.
2019-06-21 16:37:47 +00:00
RefPtr<Custody> m_executable;
RefPtr<Custody> m_cwd;
Kernel: Add a basic chroot() syscall :^) The chroot() syscall now allows the superuser to isolate a process into a specific subtree of the filesystem. This is not strictly permanent, as it is also possible for a superuser to break *out* of a chroot, but it is a useful mechanism for isolating unprivileged processes. The VFS now uses the current process's root_directory() as the root for path resolution purposes. The root directory is stored as an uncached Custody in the Process object.
2020-01-10 22:14:04 +00:00
RefPtr<Custody> m_root_directory;
Kernel: Don't forget to copy & destroy root_directory_for_procfs Also, rename it to root_directory_relative_to_global_root.
2020-01-12 18:42:01 +00:00
RefPtr<Custody> m_root_directory_relative_to_global_root;
Add a "pwd" utility to userland. It's implemented as a separate process. How cute is that. Tasks now have a current working directory. Spawned tasks inherit their parent task's working directory. Currently everyone just uses "/" as there's no way to chdir().
2018-10-24 12:28:22 +00:00
Kernel: Store process arguments and environment in coredumps Currently they're only pushed onto the stack but not easily accessible from the Process class, so this adds a Vector<String> for both.
2021-01-15 19:21:03 +00:00
Vector<String> m_arguments;
Vector<String> m_environment;
Kernel: A running process should keep its TTY alive It's not safe to use a raw pointer for Process::m_tty. A pseudoterminal pair will disappear when file descriptors are closed, and we'd end up looking dangly. Just use a RefPtr.
2019-11-06 15:52:54 +00:00
RefPtr<TTY> m_tty;
Start working on virtual consoles/TTYs. This is a mess right now, but I'd rather commit as I go.
2018-10-30 12:59:29 +00:00
Kernel: Make Process::m_master_tls_region a WeakPtr Let's not keep raw Region* variables around like that when it's so easy to avoid it.
2020-02-28 13:04:49 +00:00
WeakPtr<Region> m_master_tls_region;
Kernel: Support thread-local storage This patch adds support for TLS according to the x86 System V ABI. Each thread gets a thread-specific memory region, and the GS segment register always points _to a pointer_ to the thread-specific memory. In other words, to access thread-local variables, userspace programs start by dereferencing the pointer at [gs:0]. The Process keeps a master copy of the TLS segment that new threads should use, and when a new thread is created, they get a copy of it. It's basically whatever the PT_TLS program header in the ELF says.
2019-09-07 13:50:44 +00:00
size_t m_master_tls_size { 0 };
size_t m_master_tls_alignment { 0 };
Kernel: Assign Lock names in class member initializers.
2019-05-02 01:28:20 +00:00
Lock m_big_lock { "Process" };
Kernel: Prevent execve/ptrace race Add a per-process ptrace lock and use it to prevent ptrace access to a process after it decides to commit to a new executable in sys$execve(). Fixes #5230.
2021-02-08 22:01:53 +00:00
Lock m_ptrace_lock { "ptrace" };
Kernel: Implement the alarm() syscall.
2019-06-07 09:30:07 +00:00
Kernel: Use TimerQueue for SIGALRM
2020-12-01 22:44:52 +00:00
RefPtr<Timer> m_alarm_timer;
Kernel+ProcessManager: Let processes have an icon and show it in the table. Processes can now have an icon assigned, which is essentially a 16x16 RGBA32 bitmap exposed as a shared buffer ID. You set the icon ID by calling set_process_icon(int) and the icon ID will be exposed through /proc/all. To make this work, I added a mechanism for making shared buffers globally accessible. For safety reasons, each app seals the icon buffer before making it global. Right now the first call to GWindow::set_icon() is what determines the process icon. We'll probably change this in the future. :^)
2019-07-29 05:26:01 +00:00
Kernel: Rename UnveilState to VeilState
2020-01-21 18:28:29 +00:00
VeilState m_veil_state { VeilState::None };
Kernel: Allow 'elevating' unveil permissions if implicitly inherited from '/' This can happen when an unveil follows another with a path that is a sub-path of the other one: ```c++ unveil("/home/anon/.config/whoa.ini", "rw"); unveil("/home/anon", "r"); // this would fail, as "/home/anon" inherits // the permissions of "/", which is None. ```
2020-12-26 14:24:01 +00:00
UnveilNode m_unveiled_paths { "/", { .full_path = "/", .unveil_inherited_from_root = true } };
Kernel: Add a basic implementation of unveil() This syscall is a complement to pledge() and adds the same sort of incremental relinquishing of capabilities for filesystem access. The first call to unveil() will "drop a veil" on the process, and from now on, only unveiled parts of the filesystem are visible to it. Each call to unveil() specifies a path to either a directory or a file along with permissions for that path. The permissions are a combination of the following: - r: Read access (like the "rpath" promise) - w: Write access (like the "wpath" promise) - x: Execute access - c: Create/remove access (like the "cpath" promise) Attempts to open a path that has not been unveiled with fail with ENOENT. If the unveiled path lacks sufficient permissions, it will fail with EACCES. Like pledge(), subsequent calls to unveil() with the same path can only remove permissions, not add them. Once you call unveil(nullptr, nullptr), the veil is locked, and it's no longer possible to unveil any more paths for the process, ever. This concept comes from OpenBSD, and their implementation does various things differently, I'm sure. This is just a first implementation for SerenityOS, and we'll keep improving on it as we go. :^)
2020-01-20 21:12:04 +00:00
Kernel: Start working on a syscall for logging performance events This patch introduces sys$perf_event() with two event types: - PERF_EVENT_MALLOC - PERF_EVENT_FREE After the first call to sys$perf_event(), a process will begin keeping these events in a buffer. When the process dies, that buffer will be written out to "perfcore" in the current directory unless that filename is already taken. This is probably not the best way to do this, but it's a start and will make it possible to start doing memory allocation profiling. :^)
2020-02-02 19:26:27 +00:00
OwnPtr<PerformanceEventBuffer> m_perf_event_buffer;
Kernel: Allow multiple inspectors of a process (in /proc) Replace Process::m_being_inspected with an inspector reference count. This prevents an assertion from firing when inspecting the same process in /proc from multiple processes at the same time. It was trivially reproducible by opening multiple FileManagers.
2020-02-17 12:29:49 +00:00
Kernel: Some futex improvements This adds support for FUTEX_WAKE_OP, FUTEX_WAIT_BITSET, FUTEX_WAKE_BITSET, FUTEX_REQUEUE, and FUTEX_CMP_REQUEUE, as well well as global and private futex and absolute/relative timeouts against the appropriate clock. This also changes the implementation so that kernel resources are only used when a thread is blocked on a futex. Global futexes are implemented as offsets in VMObjects, so that different processes can share a futex against the same VMObject despite potentially being mapped at different virtual addresses.
2020-12-22 06:21:58 +00:00
FutexQueues m_futex_queues;
SpinLock<u8> m_futex_lock;
Kernel: Add 'ptrace' syscall This commit adds a basic implementation of the ptrace syscall, which allows one process (the tracer) to control another process (the tracee). While a process is being traced, it is stopped whenever a signal is received (other than SIGCONT). The tracer can start tracing another thread with PT_ATTACH, which causes the tracee to stop. From there, the tracer can use PT_CONTINUE to continue the execution of the tracee, or use other request codes (which haven't been implemented yet) to modify the state of the tracee. Additional request codes are PT_SYSCALL, which causes the tracee to continue exection but stop at the next entry or exit from a syscall, and PT_GETREGS which fethces the last saved register set of the tracee (can be used to inspect syscall arguments and return value). A special request code is PT_TRACE_ME, which is issued by the tracee and causes it to stop when it calls execve and wait for the tracer to attach.
2020-03-28 08:47:16 +00:00
// This member is used in the implementation of ptrace's PT_TRACEME flag.
// If it is set to true, the process will stop at the next execve syscall
// and wait for a tracer to attach.
bool m_wait_for_tracer_at_next_execve { false };
Kernel: Move block condition evaluation out of the Scheduler This makes the Scheduler a lot leaner by not having to evaluate block conditions every time it is invoked. Instead evaluate them as the states change, and unblock threads at that point. This also implements some more waitid/waitpid/wait features and behavior. For example, WUNTRACED and WNOWAIT are now supported. And wait will now not return EINTR when SIGCHLD is delivered at the same time.
2020-11-29 23:05:27 +00:00
Thread::WaitBlockCondition m_wait_block_condition;
Kernel: Add sys$set_coredump_metadata() syscall This can be used by applications to store information (key/value pairs) likely useful for debugging, which will then be embedded in the coredump.
2020-12-30 14:19:57 +00:00
HashMap<String, String> m_coredump_metadata;
Kernel: Prevent threads from being destructed between die() and finalize() Killing remaining threads already happens in Process::die(), but coredumps are only written in Process::finalize(). We need to keep a reference to each of those threads to prevent them from being destructed between those two functions, otherwise coredumps will only ever contain information about the last remaining thread. Fixes the underlying problem of #4778, though the UI will need refinements to not show every thread's backtrace mashed together.
2021-01-15 19:29:13 +00:00
Kernel: Generate coredump backtraces from "threads for coredump" list This broke with the change that gave each process a list of its own threads. Since threads are removed slightly earlier from that list during process teardown, we're not able to use it for generating coredump backtraces. Fortunately we have the "threads for coredump" list for just this purpose. :^)
2021-01-28 07:41:18 +00:00
NonnullRefPtrVector<Thread> m_threads_for_coredump;
Import the "gerbert" kernel I worked on earlier this year. It's a lot crappier than I remembered it. It's gonna need a lot of work.
2018-10-16 09:01:38 +00:00
};
Move the scheduler code to its own class. This is very mechanical.
2018-11-07 21:15:02 +00:00
extern InlineLinkedList<Process>* g_processes;
Kernel: Turn Thread::current and Process::current into functions This allows us to query the current thread and process on a per processor basis
2020-06-28 21:34:31 +00:00
extern RecursiveSpinLock g_processes_lock;
Make Process::for_each...() functions inline and allocation-free. AK::Function is very handy, but costs us an 8-byte allocation. Let's not have kmalloc() calls in the scheduler hot path.
2018-11-08 15:09:05 +00:00
template<typename Callback>
inline void Process::for_each(Callback callback)
{
Everywhere: Rename ASSERT => VERIFY (...and ASSERT_NOT_REACHED => VERIFY_NOT_REACHED) Since all of these checks are done in release builds as well, let's rename them to VERIFY to prevent confusion, as everyone is used to assertions being compiled out in release. We can introduce a new ASSERT macro that is specifically for debug checks, but I'm doing this wholesale conversion first since we've accumulated thousands of these already, and it's not immediately obvious which ones are suitable for ASSERT.
2021-02-23 19:42:32 +00:00
VERIFY_INTERRUPTS_DISABLED();
Kernel: Turn Thread::current and Process::current into functions This allows us to query the current thread and process on a per processor basis
2020-06-28 21:34:31 +00:00
ScopedSpinLock lock(g_processes_lock);
Make Process::for_each...() functions inline and allocation-free. AK::Function is very handy, but costs us an 8-byte allocation. Let's not have kmalloc() calls in the scheduler hot path.
2018-11-08 15:09:05 +00:00
for (auto* process = g_processes->head(); process;) {
auto* next_process = process->next();
Meta: Tweak .clang-format to not wrap braces after enums.
2019-06-07 15:13:23 +00:00
if (callback(*process) == IterationDecision::Break)
Make Process::for_each...() functions inline and allocation-free. AK::Function is very handy, but costs us an 8-byte allocation. Let's not have kmalloc() calls in the scheduler hot path.
2018-11-08 15:09:05 +00:00
break;
process = next_process;
}
}
Rage hacking to get bash to run. It finally runs. So cool! :^)
2018-11-11 14:36:40 +00:00
template<typename Callback>
inline void Process::for_each_child(Callback callback)
{
Everywhere: Rename ASSERT => VERIFY (...and ASSERT_NOT_REACHED => VERIFY_NOT_REACHED) Since all of these checks are done in release builds as well, let's rename them to VERIFY to prevent confusion, as everyone is used to assertions being compiled out in release. We can introduce a new ASSERT macro that is specifically for debug checks, but I'm doing this wholesale conversion first since we've accumulated thousands of these already, and it's not immediately obvious which ones are suitable for ASSERT.
2021-02-23 19:42:32 +00:00
VERIFY_INTERRUPTS_DISABLED();
Kernel: PID/TID typing This compiles, and contains exactly the same bugs as before. The regex 'FIXME: PID/' should reveal all markers that I left behind, including: - Incomplete conversion - Issues or things that look fishy - Actual bugs that will go wrong during runtime
2020-08-08 15:32:34 +00:00
ProcessID my_pid = pid();
Kernel: Turn Thread::current and Process::current into functions This allows us to query the current thread and process on a per processor basis
2020-06-28 21:34:31 +00:00
ScopedSpinLock lock(g_processes_lock);
Rage hacking to get bash to run. It finally runs. So cool! :^)
2018-11-11 14:36:40 +00:00
for (auto* process = g_processes->head(); process;) {
auto* next_process = process->next();
Kernel: Move select Process members into protected memory Process member variable like m_euid are very valuable targets for kernel exploits and until now they have been writable at all times. This patch moves m_euid along with a whole bunch of other members into a new Process::ProtectedData struct. This struct is remapped as read-only memory whenever we don't need to write to it. This means that a kernel write primitive is no longer enough to overwrite a process's effective UID, you must first unprotect the protected data where the UID is stored. :^)
2021-03-10 18:59:46 +00:00
if (process->ppid() == my_pid || process->has_tracee_thread(pid())) {
Kernel: Add support for the WSTOPPED flag to the waitpid() syscall. This makes waitpid() return when a child process is stopped via a signal. Use this in Shell to catch stopped children and return control to the command line. :^) Fixes #298.
2019-07-14 09:35:49 +00:00
if (callback(*process) == IterationDecision::Break)
Rage hacking to get bash to run. It finally runs. So cool! :^)
2018-11-11 14:36:40 +00:00
break;
}
process = next_process;
}
}
Make Process::for_each...() functions inline and allocation-free. AK::Function is very handy, but costs us an 8-byte allocation. Let's not have kmalloc() calls in the scheduler hot path.
2018-11-08 15:09:05 +00:00
template<typename Callback>
Kernel: Keep a list of threads per Process This allow us to iterate only the threads of the process.
2021-01-23 06:24:33 +00:00
inline IterationDecision Process::for_each_thread(Callback callback) const
Make Process::for_each...() functions inline and allocation-free. AK::Function is very handy, but costs us an 8-byte allocation. Let's not have kmalloc() calls in the scheduler hot path.
2018-11-08 15:09:05 +00:00
{
Kernel: Remove colonel special-case from Process::for_each_thread Since each Process now has its own list of threads, we don't need to treat colonel any different anymore. This also means that it reports all kernel threads, not just the idle threads.
2021-01-28 05:29:17 +00:00
ScopedSpinLock thread_list_lock(m_thread_list_lock);
for (auto& thread : m_thread_list) {
IterationDecision decision = callback(thread);
if (decision != IterationDecision::Continue)
return decision;
Kernel: Process::for_each_thread() should show the main thread of PID 0
2019-11-26 20:25:11 +00:00
}
Kernel: Keep a list of threads per Process This allow us to iterate only the threads of the process.
2021-01-23 06:24:33 +00:00
return IterationDecision::Continue;
Make Process::for_each...() functions inline and allocation-free. AK::Function is very handy, but costs us an 8-byte allocation. Let's not have kmalloc() calls in the scheduler hot path.
2018-11-08 15:09:05 +00:00
}
Kernel: Move process thread lists into protected data
2021-03-11 13:12:55 +00:00
template<typename Callback>
inline IterationDecision Process::for_each_thread(Callback callback)
{
ScopedSpinLock thread_list_lock(m_thread_list_lock);
for (auto& thread : m_thread_list) {
IterationDecision decision = callback(thread);
if (decision != IterationDecision::Continue)
return decision;
}
return IterationDecision::Continue;
}
Make Process::for_each...() functions inline and allocation-free. AK::Function is very handy, but costs us an 8-byte allocation. Let's not have kmalloc() calls in the scheduler hot path.
2018-11-08 15:09:05 +00:00
template<typename Callback>
Kernel: PID/PGID typing This compiles, and fixes two bugs: - setpgid() confusion (see previous commit) - tcsetpgrp() now allows to set a non-empty process group even if the group leader has already died. This makes Serenity slightly more POSIX-compatible.
2020-08-08 20:04:20 +00:00
inline void Process::for_each_in_pgrp(ProcessGroupID pgid, Callback callback)
Make Process::for_each...() functions inline and allocation-free. AK::Function is very handy, but costs us an 8-byte allocation. Let's not have kmalloc() calls in the scheduler hot path.
2018-11-08 15:09:05 +00:00
{
Everywhere: Rename ASSERT => VERIFY (...and ASSERT_NOT_REACHED => VERIFY_NOT_REACHED) Since all of these checks are done in release builds as well, let's rename them to VERIFY to prevent confusion, as everyone is used to assertions being compiled out in release. We can introduce a new ASSERT macro that is specifically for debug checks, but I'm doing this wholesale conversion first since we've accumulated thousands of these already, and it's not immediately obvious which ones are suitable for ASSERT.
2021-02-23 19:42:32 +00:00
VERIFY_INTERRUPTS_DISABLED();
Kernel: Turn Thread::current and Process::current into functions This allows us to query the current thread and process on a per processor basis
2020-06-28 21:34:31 +00:00
ScopedSpinLock lock(g_processes_lock);
Make Process::for_each...() functions inline and allocation-free. AK::Function is very handy, but costs us an 8-byte allocation. Let's not have kmalloc() calls in the scheduler hot path.
2018-11-08 15:09:05 +00:00
for (auto* process = g_processes->head(); process;) {
auto* next_process = process->next();
Kernel: Process::for_each_in_pgrp() should not include dead processes We don't care about dead processes that were once members of a specific process group. This was causing us to try and send SIGINT to already-dead processes when pressing Ctrl+C in a terminal whose pgrp they were once in. Fixes #922.
2019-12-26 21:20:39 +00:00
if (!process->is_dead() && process->pgid() == pgid) {
Kernel: Use IteratorDecision in Process::for_each_in_pgrp()
2019-08-22 19:12:55 +00:00
if (callback(*process) == IterationDecision::Break)
Kernel: Introduce threads, and refactor everything in support of it. The scheduler now operates on threads, rather than on processes. Each process has a main thread, and can have any number of additional threads. The process exits when the main thread exits. This patch doesn't actually spawn any additional threads, it merely does all the plumbing needed to make it possible. :^)
2019-03-23 21:03:17 +00:00
break;
}
Make Process::for_each...() functions inline and allocation-free. AK::Function is very handy, but costs us an 8-byte allocation. Let's not have kmalloc() calls in the scheduler hot path.
2018-11-08 15:09:05 +00:00
process = next_process;
}
}
Kernel: Start adding various file system permission checks. Fail with EACCES in various situations. Fix userland bugs that were exposed.
2019-02-21 14:45:31 +00:00
Kernel: Take const Process& in InodeMetadata::may_{read,write,execute}
2020-01-07 18:17:35 +00:00
inline bool InodeMetadata::may_read(const Process& process) const
Kernel: Start adding various file system permission checks. Fail with EACCES in various situations. Fix userland bugs that were exposed.
2019-02-21 14:45:31 +00:00
{
Kernel: Don't include the process GID in the "extra GIDs" table Process::m_extra_gids is for supplementary GIDs only.
2020-01-02 22:45:52 +00:00
return may_read(process.euid(), process.egid(), process.extra_gids());
Kernel: Start adding various file system permission checks. Fail with EACCES in various situations. Fix userland bugs that were exposed.
2019-02-21 14:45:31 +00:00
}
Kernel: Take const Process& in InodeMetadata::may_{read,write,execute}
2020-01-07 18:17:35 +00:00
inline bool InodeMetadata::may_write(const Process& process) const
Kernel: Start adding various file system permission checks. Fail with EACCES in various situations. Fix userland bugs that were exposed.
2019-02-21 14:45:31 +00:00
{
Kernel: Don't include the process GID in the "extra GIDs" table Process::m_extra_gids is for supplementary GIDs only.
2020-01-02 22:45:52 +00:00
return may_write(process.euid(), process.egid(), process.extra_gids());
Kernel: Start adding various file system permission checks. Fail with EACCES in various situations. Fix userland bugs that were exposed.
2019-02-21 14:45:31 +00:00
}
Kernel: Take const Process& in InodeMetadata::may_{read,write,execute}
2020-01-07 18:17:35 +00:00
inline bool InodeMetadata::may_execute(const Process& process) const
Kernel: Start adding various file system permission checks. Fail with EACCES in various situations. Fix userland bugs that were exposed.
2019-02-21 14:45:31 +00:00
{
Kernel: Don't include the process GID in the "extra GIDs" table Process::m_extra_gids is for supplementary GIDs only.
2020-01-02 22:45:52 +00:00
return may_execute(process.euid(), process.egid(), process.extra_gids());
Kernel: Start adding various file system permission checks. Fail with EACCES in various situations. Fix userland bugs that were exposed.
2019-02-21 14:45:31 +00:00
}
Kernel: Introduce threads, and refactor everything in support of it. The scheduler now operates on threads, rather than on processes. Each process has a main thread, and can have any number of additional threads. The process exits when the main thread exits. This patch doesn't actually spawn any additional threads, it merely does all the plumbing needed to make it possible. :^)
2019-03-23 21:03:17 +00:00
Kernel: PID/TID typing This compiles, and contains exactly the same bugs as before. The regex 'FIXME: PID/' should reveal all markers that I left behind, including: - Incomplete conversion - Issues or things that look fishy - Actual bugs that will go wrong during runtime
2020-08-08 15:32:34 +00:00
inline ProcessID Thread::pid() const
Kernel: Introduce threads, and refactor everything in support of it. The scheduler now operates on threads, rather than on processes. Each process has a main thread, and can have any number of additional threads. The process exits when the main thread exits. This patch doesn't actually spawn any additional threads, it merely does all the plumbing needed to make it possible. :^)
2019-03-23 21:03:17 +00:00
{
Kernel: Remove ProcessInspectionHandle and make Process RefCounted By making the Process class RefCounted we don't really need ProcessInspectionHandle anymore. This also fixes some race conditions where a Process may be deleted while still being used by ProcFS. Also make sure to acquire the Process' lock when accessing regions. Last but not least, there's no reason why a thread can't be scheduled while being inspected, though in practice it won't happen anyway because the scheduler lock is held at the same time.
2020-08-02 02:04:56 +00:00
return m_process->pid();
Kernel: Introduce threads, and refactor everything in support of it. The scheduler now operates on threads, rather than on processes. Each process has a main thread, and can have any number of additional threads. The process exits when the main thread exits. This patch doesn't actually spawn any additional threads, it merely does all the plumbing needed to make it possible. :^)
2019-03-23 21:03:17 +00:00
}
Kernel: Add LogStream operator<< for Process. It simply prints "process-name(pid)", nothing fancy, but kinda useful.
2019-07-08 16:58:19 +00:00
Kernel: Turn Thread::current and Process::current into functions This allows us to query the current thread and process on a per processor basis
2020-06-28 21:34:31 +00:00
#define REQUIRE_NO_PROMISES \
do { \
if (Process::current()->has_promises()) { \
Everywhere: Replace a bundle of dbg with dbgln. These changes are arbitrarily divided into multiple commits to make it easier to find potentially introduced bugs with git bisect.
2021-01-08 23:11:15 +00:00
dbgln("Has made a promise"); \
Kernel: Turn Thread::current and Process::current into functions This allows us to query the current thread and process on a per processor basis
2020-06-28 21:34:31 +00:00
Process::current()->crash(SIGABRT, 0); \
Everywhere: Rename ASSERT => VERIFY (...and ASSERT_NOT_REACHED => VERIFY_NOT_REACHED) Since all of these checks are done in release builds as well, let's rename them to VERIFY to prevent confusion, as everyone is used to assertions being compiled out in release. We can introduce a new ASSERT macro that is specifically for debug checks, but I'm doing this wholesale conversion first since we've accumulated thousands of these already, and it's not immediately obvious which ones are suitable for ASSERT.
2021-02-23 19:42:32 +00:00
VERIFY_NOT_REACHED(); \
Kernel: Turn Thread::current and Process::current into functions This allows us to query the current thread and process on a per processor basis
2020-06-28 21:34:31 +00:00
} \
Kernel: Add "video" pledge for accessing framebuffer devices WindowServer becomes the only user.
2020-01-12 01:17:30 +00:00
} while (0)
Kernel: Turn Thread::current and Process::current into functions This allows us to query the current thread and process on a per processor basis
2020-06-28 21:34:31 +00:00
#define REQUIRE_PROMISE(promise) \
do { \
if (Process::current()->has_promises() \
&& !Process::current()->has_promised(Pledge::promise)) { \
Everywhere: Replace a bundle of dbg with dbgln. These changes are arbitrarily divided into multiple commits to make it easier to find potentially introduced bugs with git bisect.
2021-01-08 23:11:15 +00:00
dbgln("Has not pledged {}", #promise); \
Kernel: Set "pledge_violation" coredump metadata in REQUIRE_PROMISE() Similar to LibC storing an assertion message before aborting, process death by pledge violation now sets a "pledge_violation" key with the respective pledge name as value in its coredump metadata, which the CrashReporter will then show.
2021-01-20 19:10:13 +00:00
Process::current()->coredump_metadata().set( \
"pledge_violation", #promise); \
Kernel: Turn Thread::current and Process::current into functions This allows us to query the current thread and process on a per processor basis
2020-06-28 21:34:31 +00:00
Process::current()->crash(SIGABRT, 0); \
Everywhere: Rename ASSERT => VERIFY (...and ASSERT_NOT_REACHED => VERIFY_NOT_REACHED) Since all of these checks are done in release builds as well, let's rename them to VERIFY to prevent confusion, as everyone is used to assertions being compiled out in release. We can introduce a new ASSERT macro that is specifically for debug checks, but I'm doing this wholesale conversion first since we've accumulated thousands of these already, and it's not immediately obvious which ones are suitable for ASSERT.
2021-02-23 19:42:32 +00:00
VERIFY_NOT_REACHED(); \
Kernel: Turn Thread::current and Process::current into functions This allows us to query the current thread and process on a per processor basis
2020-06-28 21:34:31 +00:00
} \
Kernel: Add "video" pledge for accessing framebuffer devices WindowServer becomes the only user.
2020-01-12 01:17:30 +00:00
} while (0)
Kernel: Move all code into the Kernel namespace
2020-02-16 00:27:42 +00:00
}
Kernel: Make copy_to/from_user safe and remove unnecessary checks Since the CPU already does almost all necessary validation steps for us, we don't really need to attempt to do this. Doing it ourselves doesn't really work very reliably, because we'd have to account for other processors modifying virtual memory, and we'd have to account for e.g. pages not being able to be allocated due to insufficient resources. So change the copy_to/from_user (and associated helper functions) to use the new safe_memcpy, which will return whether it succeeded or not. The only manual validation step needed (which the CPU can't perform for us) is making sure the pointers provided by user mode aren't pointing to kernel mappings. To make it easier to read/write from/to either kernel or user mode data add the UserOrKernelBuffer helper class, which will internally either use copy_from/to_user or directly memcpy, or pass the data through directly using a temporary buffer on the stack. Last but not least we need to keep syscall params trivial as we need to copy them from/to user mode using copy_from/to_user.
2020-09-12 03:11:07 +00:00
inline static String copy_string_from_user(const Kernel::Syscall::StringArgument& string)
{
return copy_string_from_user(string.characters, string.length);
}
Everywhere: Replace a bundle of dbg with dbgln. These changes are arbitrarily divided into multiple commits to make it easier to find potentially introduced bugs with git bisect.
2021-01-08 23:11:15 +00:00
template<>
struct AK::Formatter<Kernel::Process> : AK::Formatter<String> {
void format(FormatBuilder& builder, const Kernel::Process& value)
{
return AK::Formatter<String>::format(builder, String::formatted("{}({})", value.name(), value.pid().value()));
}
};
Reference in a new issue Copy permalink