02 Nov, 2011

2 commits


17 Oct, 2007

1 commit

  • This patchset throws out tt mode, which has been non-functional for a while.

    This is done in phases, interspersed with code cleanups on the affected files.

    The removal is done as follows:
    remove all code, config options, and files which depend on
    CONFIG_MODE_TT
    get rid of the CHOOSE_MODE macro, which decided whether to
    call tt-mode or skas-mode code, and replace invocations with their
    skas portions
    replace all now-trivial procedures with their skas equivalents

    There are now a bunch of now-redundant pieces of data structures, including
    mode-specific pieces of the thread structure, pt_regs, and mm_context. These
    are all replaced with their skas-specific contents.

    As part of the ongoing style compliance project, I made a style pass over all
    files that were changed. There are three such patches, one for each phase,
    covering the files affected by that phase but no later ones.

    I noticed that we weren't freeing the LDT state associated with a process when
    it exited, so that's fixed in one of the later patches.

    The last patch is a tidying patch which I've had for a while, but which caused
    inexplicable crashes under tt mode. Since that is no longer a problem, this
    can now go in.

    This patch:

    Start getting rid of tt mode support.

    This patch throws out CONFIG_MODE_TT and all config options, code, and files
    which depend on it.

    CONFIG_MODE_SKAS is gone and everything that depends on it is included
    unconditionally.

    The few changed lines are in re-written Kconfig help, lines which needed
    something skas-related removed from them, and a few more which weren't
    strictly deletions.

    Signed-off-by: Jeff Dike
    Signed-off-by: Andrew Morton
    Signed-off-by: Linus Torvalds

    Jeff Dike
     

14 Oct, 2007

1 commit

  • a) include/asm-um/arch can't just point to include/asm-$(SUBARCH) now
    b) arch/{i386,x86_64}/crypto are merged now
    c) subarch-obj needed changes
    d) cpufeature_64.h should pull "cpufeature_32.h", not
    since it can be included from asm-um/cpufeature.h
    e) in case of uml-i386 we need CONFIG_X86_32 for make and gcc, but not
    for Kconfig
    f) sysctl.c shouldn't do vdso_enabled for uml-i386 (actually, that one
    should be registered from corresponding arch/*/kernel/*, with ifdef
    going away; that's a separate patch, though).

    With that and with Stephen's patch ("[PATCH net-2.6] uml: hard_header fix")
    we have uml allmodconfig building both on i386 and amd64.

    Signed-off-by: Al Viro
    Signed-off-by: Linus Torvalds

    Al Viro
     

15 Mar, 2007

1 commit


01 Jul, 2006

1 commit

  • kbuild used $¤(*F to get filename of target without extension.
    This was used in several places all over kbuild, but introducing
    make -rR broke his for all cases where we specified full path to
    target/prerequsite. It is assumed that make -rR disables old style
    suffix-rules which is why is suddenly failed.

    ia64 was impacted by this change because several div* routines in
    arch/ia64/lib are build using explicit paths and then kbuild failed.

    Thanks to David Mosberger-Tang for an explanation
    what was the root-cause and for testing on ia64.

    This patch also fixes two uses of $(*F) in arch/um

    Signed-off-by: Sam Ravnborg

    Sam Ravnborg
     

02 May, 2006

1 commit

  • *) Rather than duplicate in various buggy ways the application of
    CFLAGS_NO_HARDENING and UNPROFILE (which apply to the same files),
    centralize it in Makefile.rules. UNPROFILE_OBJS mustn't be listed in
    USER_OBJS but are compiled as such.

    I've also verified that unprofile didn't work in the current form, because we
    set _c_flags directly (using CFLAGS and not USER_CFLAGS, which is wrong),
    which is normally used by c_flags, but we also override c_flags for all
    USER_OBJS, and there we don't call unprofile.

    Instead it only worked for unmap.o, the only one which wasn't a USER_OBJ.

    We need to set c_flags (which is not a public Kbuild API) to clear a lot of
    compilation flags like -nostdinc which Kbuild forces on everything.

    *) Rather than $(CFLAGS_$(notdir $@)), which expands to CFLAGS_anObj.s when
    building "anObj.s", use $(CFLAGS_$(*F).o) which always accesses
    CFLAGS_anObj.o, like done by Kbuild.

    *) Make c_flags apply to all targets having the same basename, rather than
    listing .s, .i, .lst and .o, with the use (which I tested) of

    $(USER_OBJS:.o=.%): c_flags = ...

    and of

    - $(obj)/unmap.c: _c_flags = ...
    + $(obj)/unmap.%: _c_flags = ...

    Signed-off-by: Paolo 'Blaisorblade' Giarrusso
    Acked-by: Jeff Dike
    Signed-off-by: Andrew Morton
    Signed-off-by: Linus Torvalds

    Paolo 'Blaisorblade' Giarrusso
     

11 Apr, 2006

1 commit

  • Make sparse checker work for userspace files - it normally gets -nostdinc
    separately, so avoid having it for userspace files. Also, add -D$(SUBARCH)
    for multiarch hosts (i.e. AMD64 with compatibility headers).

    It works, the only problem is a bit of bogus warnings for system headers, but
    they're not too many.

    Signed-off-by: Paolo 'Blaisorblade' Giarrusso
    Cc: Jeff Dike
    Signed-off-by: Andrew Morton
    Signed-off-by: Linus Torvalds

    Paolo 'Blaisorblade' Giarrusso
     

01 Apr, 2006

2 commits


19 Dec, 2005

1 commit


07 Nov, 2005

1 commit

  • Patch imlements full LDT handling in SKAS:
    * UML holds it's own LDT table, used to deliver data on
    modify_ldt(READ)
    * UML disables the default_ldt, inherited from the host (SKAS3)
    or resets LDT entries, set by host's clib and inherited in
    SKAS0
    * A new global variable skas_needs_stub is inserted, that
    can be used to decide, whether stub-pages must be supported
    or not.
    * Uses the syscall-stub to replace missing PTRACE_LDT (therefore,
    write_ldt_entry needs to be modified)

    Signed-off-by: Bodo Stroesser
    Signed-off-by: Jeff Dike
    Cc: Paolo Giarrusso
    Signed-off-by: Andrew Morton
    Signed-off-by: Linus Torvalds

    Bodo Stroesser
     

10 Oct, 2005

1 commit


10 Sep, 2005

1 commit


05 Sep, 2005

1 commit


15 Jul, 2005

1 commit

  • This patch makes the command:

    make ARCH=um SUBARCH=i386

    work on x86_64 hosts (with support for building 32-bit binaries). This is
    especially needed since 64-bit UMLs don't support 32-bit emulation for guest
    binaries, currently. This has been tested in all possible cases and works.

    Only exception is that I've built but not tested a 64-bit binary, because I
    hadn't a 64-bit filesystem available.

    Signed-off-by: Paolo 'Blaisorblade' Giarrusso
    Cc: Jeff Dike
    Signed-off-by: Andrew Morton
    Signed-off-by: Linus Torvalds

    Paolo 'Blaisorblade' Giarrusso
     

08 Jul, 2005

1 commit

  • UML has had two modes of operation - an insecure, slow mode (tt mode) in
    which the kernel is mapped into every process address space which requires
    no host kernel modifications, and a secure, faster mode (skas mode) in
    which the UML kernel is in a separate host address space, which requires a
    patch to the host kernel.

    This patch implements something very close to skas mode for hosts which
    don't support skas - I'm calling this skas0. It provides the security of
    the skas host patch, and some of the performance gains.

    The two main things that are provided by the skas patch, /proc/mm and
    PTRACE_FAULTINFO, are implemented in a way that require no host patch.

    For the remote address space changing stuff (mmap, munmap, and mprotect),
    we set aside two pages in the process above its stack, one of which
    contains a little bit of code which can call mmap et al.

    To update the address space, the system call information (system call
    number and arguments) are written to the stub page above the code. The
    %esp is set to the beginning of the data, the %eip is set the the start of
    the stub, and it repeatedly pops the information into its registers and
    makes the system call until it sees a system call number of zero. This is
    to amortize the cost of the context switch across multiple address space
    updates.

    When the updates are done, it SIGSTOPs itself, and the kernel process
    continues what it was doing.

    For a PTRACE_FAULTINFO replacement, we set up a SIGSEGV handler in the
    child, and let it handle segfaults rather than nullifying them. The
    handler is in the same page as the mmap stub. The second page is used as
    the stack. The handler reads cr2 and err from the sigcontext, sticks them
    at the base of the stack in a faultinfo struct, and SIGSTOPs itself. The
    kernel then reads the faultinfo and handles the fault.

    A complication on x86_64 is that this involves resetting the registers to
    the segfault values when the process is inside the kill system call. This
    breaks on x86_64 because %rcx will contain %rip because you tell SYSRET
    where to return to by putting the value in %rcx. So, this corrupts $rcx on
    return from the segfault. To work around this, I added an
    arch_finish_segv, which on x86 does nothing, but which on x86_64 ptraces
    the child back through the sigreturn. This causes %rcx to be restored by
    sigreturn and avoids the corruption. Ultimately, I think I will replace
    this with the trick of having it send itself a blocked signal which will be
    unblocked by the sigreturn. This will allow it to be stopped just after
    the sigreturn, and PTRACE_SYSCALLed without all the back-and-forth of
    PTRACE_SYSCALLing it through sigreturn.

    This runs on a stock host, so theoretically (and hopefully), tt mode isn't
    needed any more. We need to make sure that this is better in every way
    than tt mode, though. I'm concerned about the speed of address space
    updates and page fault handling, since they involve extra round-trips to
    the child. We can amortize the round-trip cost for large address space
    updates by writing all of the operations to the data page and having the
    child execute them all at the same time. This will help fork and exec, but
    not page faults, since they involve only one page.

    I can't think of any way to help page faults, except to add something like
    PTRACE_FAULTINFO to the host. There is PTRACE_SIGINFO, but UML doesn't use
    siginfo for SIGSEGV (or anything else) because there isn't enough
    information in the siginfo struct to handle page faults (the faulting
    operation type is missing). Adding that would make PTRACE_SIGINFO a usable
    equivalent to PTRACE_FAULTINFO.

    As for the code itself:

    - The system call stub is in arch/um/kernel/sys-$(SUBARCH)/stub.S. It is
    put in its own section of the binary along with stub_segv_handler in
    arch/um/kernel/skas/process.c. This is manipulated with run_syscall_stub
    in arch/um/kernel/skas/mem_user.c. syscall_stub will execute any system
    call at all, but it's only used for mmap, munmap, and mprotect.

    - The x86_64 stub calls sigreturn by hand rather than allowing the normal
    sigreturn to happen, because the normal sigreturn is a SA_RESTORER in
    UML's address space provided by libc. Needless to say, this is not
    available in the child's address space. Also, it does a couple of odd
    pops before that which restore the stack to the state it was in at the
    time the signal handler was called.

    - There is a new field in the arch mmu_context, which is now a union.
    This is the pid to be manipulated rather than the /proc/mm file
    descriptor. Code which deals with this now checks proc_mm to see whether
    it should use the usual skas code or the new code.

    - userspace_tramp is now used to create a new host process for every UML
    process, rather than one per UML processor. It checks proc_mm and
    ptrace_faultinfo to decide whether to map in the pages above its stack.

    - start_userspace now makes CLONE_VM conditional on proc_mm since we need
    separate address spaces now.

    - switch_mm_skas now just sets userspace_pid[0] to the new pid rather
    than PTRACE_SWITCH_MM. There is an addition to userspace which updates
    its idea of the pid being manipulated each time around the loop. This is
    important on exec, when the pid will change underneath userspace().

    - The stub page has a pte, but it can't be mapped in using tlb_flush
    because it is part of tlb_flush. This is why it's required for it to be
    mapped in by userspace_tramp.

    Other random things:

    - The stub section in uml.lds.S is page aligned. This page is written
    out to the backing vm file in setup_physmem because it is mapped from
    there into user processes.

    - There's some confusion with TASK_SIZE now that there are a couple of
    extra pages that the process can't use. TASK_SIZE is considered by the
    elf code to be the usable process memory, which is reasonable, so it is
    decreased by two pages. This confuses the definition of
    USER_PGDS_IN_LAST_PML4, making it too small because of the rounding down
    of the uneven division. So we round it to the nearest PGDIR_SIZE rather
    than the lower one.

    - I added a missing PT_SYSCALL_ARG6_OFFSET macro.

    - um_mmu.h was made into a userspace-usable file.

    - proc_mm and ptrace_faultinfo are globals which say whether the host
    supports these features.

    - There is a bad interaction between the mm.nr_ptes check at the end of
    exit_mmap, stack randomization, and skas0. exit_mmap will stop freeing
    pages at the PGDIR_SIZE boundary after the last vma. If the stack isn't
    on the last page table page, the last pte page won't be freed, as it
    should be since the stub ptes are there, and exit_mmap will BUG because
    there is an unfreed page. To get around this, TASK_SIZE is set to the
    next lowest PGDIR_SIZE boundary and mm->nr_ptes is decremented after the
    calls to init_stub_pte. This ensures that we know the process stack (and
    all other process mappings) will be below the top page table page, and
    thus we know that mm->nr_ptes will be one too many, and can be
    decremented.

    Things that need fixing:

    - We may need better assurrences that the stub code is PIC.

    - The stub pte is set up in init_new_context_skas.

    - alloc_pgdir is probably the right place.

    Signed-off-by: Jeff Dike
    Signed-off-by: Andrew Morton
    Signed-off-by: Linus Torvalds

    Jeff Dike
     

22 Jun, 2005

1 commit

  • With Al Viro

    To make sure switcheroo() can execute when we remap all the executable
    image, we used a trick to make it use a local copy of errno... this trick
    does not work with NPTL glibc, only with LinuxThreads, so use another
    (simpler) one to make it work anyway.

    Hopefully, a lot improved thanks to merging with the version of Al Viro
    (which had his part of problems, though, i.e. removing a fix to another
    bug and not fixing the problem on i386).

    Signed-off-by: Paolo 'Blaisorblade' Giarrusso
    Signed-off-by: Andrew Morton
    Signed-off-by: Linus Torvalds

    Paolo 'Blaisorblade' Giarrusso
     

14 Jun, 2005

1 commit

  • Fix a build failure when CONFIG_MODE_SKAS is disabled and make a Makefile
    comment fit in 80 columns.

    Signed-off-by: Jeff Dike
    Signed-off-by: Andrew Morton
    Signed-off-by: Linus Torvalds

    Jeff Dike
     

06 May, 2005

2 commits

  • Just some breaking of some overly-long lines.

    Signed-off-by: Jeff Dike
    Signed-off-by: Andrew Morton
    Signed-off-by: Linus Torvalds

    Jeff Dike
     
  • - Fix some problems with usage of $(targets) (sometimes missing, sometimes
    used badly) that trigger partial rebuilds when doing a rebuild.

    - At that purpose, also factor out some common code for symlinks creation.

    - Fix a x86-64 build warning, caused by -L/usr/lib, which is anyway useless,
    and invalid in the x86-64 case.

    Tested on x86_64 and x86.

    Signed-off-by: Paolo 'Blaisorblade' Giarrusso
    Signed-off-by: Andrew Morton
    Signed-off-by: Linus Torvalds

    Paolo 'Blaisorblade' Giarrusso
     

17 Apr, 2005

1 commit

  • Initial git repository build. I'm not bothering with the full history,
    even though we have it. We can create a separate "historical" git
    archive of that later if we want to, and in the meantime it's about
    3.2GB when imported into git - space that would just make the early
    git days unnecessarily complicated, when we don't have a lot of good
    infrastructure for it.

    Let it rip!

    Linus Torvalds