kernel/linux.git/arch/um/include/shared, branch v6.18.21Linux kernel stable tree (mirror)https://git.radix-linux.su/kernel/linux.git/atom?h=v6.18.212025-09-10T12:23:52+00:00um: Centralize stub size calculations2025-09-10T12:23:52+00:00Tiwei Bietiwei.btw@antgroup.com2025-08-27T00:57:03+00:00urn:sha1:e047f9af9d6948728614f7eea41ba53d5b767e9f
Currently, the stub size is calculated in multiple places. Define
a macro that performs the calculation so that the code is easier
to read and maintain.
Signed-off-by: Tiwei Bie <tiwei.btw@antgroup.com>
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
um: Remove outdated comment about STUB_DATA_PAGES2025-09-10T12:23:49+00:00Tiwei Bietiwei.btw@antgroup.com2025-08-27T00:57:02+00:00urn:sha1:b765d69a1adf83b969f1f0c8353b80c3c18ef2f7
STUB_DATA_PAGES is no longer required to be a power of two since
commit 91f0a0c5cc5b ("um: Calculate stub data address relative to
stub code"). Remove the outdated comment.
Signed-off-by: Tiwei Bie <tiwei.btw@antgroup.com>
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
um: Remove unused offset and child_err fields from stub_data2025-09-10T12:23:47+00:00Tiwei Bietiwei.btw@antgroup.com2025-08-27T00:57:01+00:00urn:sha1:78624eb99e1ab1d16c8a7172ac9c6bdefb7befe3
They are no longer used. Remove them.
Signed-off-by: Tiwei Bie <tiwei.btw@antgroup.com>
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
um: Replace __ASSEMBLY__ with __ASSEMBLER__ in the usermode headers2025-07-22T15:12:45+00:00Thomas Huththuth@redhat.com2025-03-14T07:10:06+00:00urn:sha1:fc9ed2f6589dc2c11f05883e5c323be5f39fd241
While the GCC and Clang compilers already define __ASSEMBLER__
automatically when compiling assembly code, __ASSEMBLY__ is a
macro that only gets defined by the Makefiles in the kernel.
This can be very confusing when switching between userspace
and kernelspace coding, so let's standardize on the __ASSEMBLER__
macro that is provided by the compilers now.
This is a completely mechanical patch (done with a simple "sed -i"
statement).
Cc: Richard Weinberger <richard@nod.at>
Cc: Anton Ivanov <anton.ivanov@cambridgegreys.com>
Cc: Johannes Berg <johannes@sipsolutions.net>
Cc: linux-um@lists.infradead.org
Signed-off-by: Thomas Huth <thuth@redhat.com>
Link: https://patch.msgid.link/20250314071013.1575167-36-thuth@redhat.com
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
um: Stop tracking stub's PID via userspace_pid[]2025-07-13T17:42:49+00:00Tiwei Bietiwei.btw@antgroup.com2025-07-11T06:50:21+00:00urn:sha1:f7e9077a1649877d4b33ce91d58711d393a63c1b
The PID of the stub process can be obtained from current_mm_id().
There is no need to track it via userspace_pid[]. Stop doing that
to simplify the code.
Signed-off-by: Tiwei Bie <tiwei.btw@antgroup.com>
Link: https://patch.msgid.link/20250711065021.2535362-4-tiwei.bie@linux.dev
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
um: pass FD for memory operations when needed2025-06-02T14:20:10+00:00Benjamin Bergbenjamin.berg@intel.com2025-06-02T13:00:52+00:00urn:sha1:e92e2552858142b60238b9828d802f128e4acccd
Instead of always sharing the FDs with the userspace process, only hand
over the FDs needed for mmap when required. The idea is that userspace
might be able to force the stub into executing an mmap syscall, however,
it will not be able to manipulate the control flow sufficiently to have
access to an FD that would allow mapping arbitrary memory.
Security wise, we need to be sure that only the expected syscalls are
executed after the kernel sends FDs through the socket. This is
currently not the case, as userspace can trivially jump to the
rt_sigreturn syscall instruction to execute any syscall that the stub is
permitted to do. With this, it can trick the kernel to send the FD,
which in turn allows userspace to freely map any physical memory.
As such, this is currently *not* secure. However, in principle the
approach should be fine with a more strict SECCOMP filter and a careful
review of the stub control flow (as userspace can prepare a stack). With
some care, it is likely possible to extend the security model to SMP if
desired.
Signed-off-by: Benjamin Berg <benjamin.berg@intel.com>
Link: https://patch.msgid.link/20250602130052.545733-8-benjamin@sipsolutions.net
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
um: Implement kernel side of SECCOMP based process handling2025-06-02T13:17:19+00:00Benjamin Bergbenjamin@sipsolutions.net2025-06-02T13:00:50+00:00urn:sha1:406d17c6c370a33cfb54067d9e205305293d4604
This adds the kernel side of the seccomp based process handling.
Co-authored-by: Johannes Berg <johannes@sipsolutions.net>
Signed-off-by: Benjamin Berg <benjamin@sipsolutions.net>
Signed-off-by: Benjamin Berg <benjamin.berg@intel.com>
Link: https://patch.msgid.link/20250602130052.545733-6-benjamin@sipsolutions.net
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
um: Track userspace children dying in SECCOMP mode2025-06-02T13:17:19+00:00Benjamin Bergbenjamin@sipsolutions.net2025-06-02T13:00:49+00:00urn:sha1:8420e08fe3a594b6ffa07705ac270faa2ed452c5
When in seccomp mode, we would hang forever on the futex if a child has
died unexpectedly. In contrast, ptrace mode will notice it and kill the
corresponding thread when it fails to run it.
Fix this issue using a new IRQ that is fired after a SIGCHLD and keeping
an (internal) list of all MMs. In the IRQ handler, find the affected MM
and set its PID to -1 as well as the futex variable to FUTEX_IN_KERN.
This, together with futex returning -EINTR after the signal is
sufficient to implement a race-free detection of a child dying.
Note that this also enables IRQ handling while starting a userspace
process. This should be safe and SECCOMP requires the IRQ in case the
process does not come up properly.
Signed-off-by: Benjamin Berg <benjamin@sipsolutions.net>
Signed-off-by: Benjamin Berg <benjamin.berg@intel.com>
Link: https://patch.msgid.link/20250602130052.545733-5-benjamin@sipsolutions.net
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
um: Add stub side of SECCOMP/futex based process handling2025-06-02T13:17:19+00:00Benjamin Bergbenjamin@sipsolutions.net2025-06-02T13:00:47+00:00urn:sha1:dac494bf54f764a114f16621ef04f534dd754ac1
This adds the stub side for the new seccomp process management code. In
this case we do register save/restore through the signal handler
mcontext.
Add special code for handling TLS, which for x86_64 means setting the
FS_BASE/GS_BASE registers while for i386 it means calling the
set_thread_area syscall.
Co-authored-by: Johannes Berg <johannes@sipsolutions.net>
Signed-off-by: Benjamin Berg <benjamin@sipsolutions.net>
Signed-off-by: Benjamin Berg <benjamin.berg@intel.com>
Link: https://patch.msgid.link/20250602130052.545733-3-benjamin@sipsolutions.net
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
um: Remove legacy network transport infrastructure2025-05-05T08:26:59+00:00Tiwei Bietiwei.btw@antgroup.com2025-05-03T05:17:10+00:00urn:sha1:e619e18ed462bded8e8f12672a37053d39451404
All legacy network transports have been removed. Vector transports
provide the same capabilities with significantly higher network
throughput. There is no reason to keep the legacy network transport
infrastructure anymore. Remove it to reduce the maintenance burden.
Signed-off-by: Tiwei Bie <tiwei.btw@antgroup.com>
Acked-By: Anton Ivanov <anton.ivanov@cambridgegreys.com>
Link: https://patch.msgid.link/20250503051710.3286595-4-tiwei.btw@antgroup.com
Signed-off-by: Johannes Berg <johannes.berg@intel.com>