2018-11-13 12:27:44 +05:30
# SPDX-License-Identifier: GPL-2.0 WITH Linux-syscall-note
#
# Linux system call numbers and entry vectors for ia64
#
# The format is:
# <number> <abi> <name> <entry point>
#
# Add 1024 to <number> will get the actual system call number
#
# The <abi> is always "common" for this file
#
0 common ni_syscall sys_ni_syscall
1 common exit sys_exit
2 common read sys_read
3 common write sys_write
4 common open sys_open
5 common close sys_close
6 common creat sys_creat
7 common link sys_link
8 common unlink sys_unlink
9 common execve ia64_execve
10 common chdir sys_chdir
11 common fchdir sys_fchdir
12 common utimes sys_utimes
13 common mknod sys_mknod
14 common chmod sys_chmod
15 common chown sys_chown
16 common lseek sys_lseek
17 common getpid sys_getpid
18 common getppid sys_getppid
19 common mount sys_mount
2018-12-30 15:16:48 +01:00
20 common umount2 sys_umount
2018-11-13 12:27:44 +05:30
21 common setuid sys_setuid
22 common getuid sys_getuid
23 common geteuid sys_geteuid
24 common ptrace sys_ptrace
25 common access sys_access
26 common sync sys_sync
27 common fsync sys_fsync
28 common fdatasync sys_fdatasync
29 common kill sys_kill
30 common rename sys_rename
31 common mkdir sys_mkdir
32 common rmdir sys_rmdir
33 common dup sys_dup
34 common pipe sys_ia64_pipe
35 common times sys_times
36 common brk ia64_brk
37 common setgid sys_setgid
38 common getgid sys_getgid
39 common getegid sys_getegid
40 common acct sys_acct
41 common ioctl sys_ioctl
42 common fcntl sys_fcntl
43 common umask sys_umask
44 common chroot sys_chroot
45 common ustat sys_ustat
46 common dup2 sys_dup2
47 common setreuid sys_setreuid
48 common setregid sys_setregid
49 common getresuid sys_getresuid
50 common setresuid sys_setresuid
51 common getresgid sys_getresgid
52 common setresgid sys_setresgid
53 common getgroups sys_getgroups
54 common setgroups sys_setgroups
55 common getpgid sys_getpgid
56 common setpgid sys_setpgid
57 common setsid sys_setsid
58 common getsid sys_getsid
59 common sethostname sys_sethostname
60 common setrlimit sys_setrlimit
61 common getrlimit sys_getrlimit
62 common getrusage sys_getrusage
63 common gettimeofday sys_gettimeofday
64 common settimeofday sys_settimeofday
65 common select sys_select
66 common poll sys_poll
67 common symlink sys_symlink
68 common readlink sys_readlink
69 common uselib sys_uselib
70 common swapon sys_swapon
71 common swapoff sys_swapoff
72 common reboot sys_reboot
73 common truncate sys_truncate
74 common ftruncate sys_ftruncate
75 common fchmod sys_fchmod
76 common fchown sys_fchown
77 common getpriority ia64_getpriority
78 common setpriority sys_setpriority
79 common statfs sys_statfs
80 common fstatfs sys_fstatfs
81 common gettid sys_gettid
82 common semget sys_semget
83 common semop sys_semop
84 common semctl sys_semctl
85 common msgget sys_msgget
86 common msgsnd sys_msgsnd
87 common msgrcv sys_msgrcv
88 common msgctl sys_msgctl
89 common shmget sys_shmget
90 common shmat sys_shmat
91 common shmdt sys_shmdt
92 common shmctl sys_shmctl
93 common syslog sys_syslog
94 common setitimer sys_setitimer
95 common getitimer sys_getitimer
# 1120 was old_stat
# 1121 was old_lstat
# 1122 was old_fstat
99 common vhangup sys_vhangup
100 common lchown sys_lchown
101 common remap_file_pages sys_remap_file_pages
102 common wait4 sys_wait4
103 common sysinfo sys_sysinfo
104 common clone sys_clone
105 common setdomainname sys_setdomainname
106 common uname sys_newuname
107 common adjtimex sys_adjtimex
# 1132 was create_module
109 common init_module sys_init_module
110 common delete_module sys_delete_module
# 1135 was get_kernel_syms
# 1136 was query_module
113 common quotactl sys_quotactl
2021-06-29 15:11:44 -05:00
114 common bdflush sys_ni_syscall
2018-11-13 12:27:44 +05:30
115 common sysfs sys_sysfs
116 common personality sys_personality
117 common afs_syscall sys_ni_syscall
118 common setfsuid sys_setfsuid
119 common setfsgid sys_setfsgid
120 common getdents sys_getdents
121 common flock sys_flock
122 common readv sys_readv
123 common writev sys_writev
124 common pread64 sys_pread64
125 common pwrite64 sys_pwrite64
2020-08-14 17:31:07 -07:00
126 common _sysctl sys_ni_syscall
2018-11-13 12:27:44 +05:30
127 common mmap sys_mmap
128 common munmap sys_munmap
129 common mlock sys_mlock
130 common mlockall sys_mlockall
131 common mprotect sys_mprotect
132 common mremap ia64_mremap
133 common msync sys_msync
134 common munlock sys_munlock
135 common munlockall sys_munlockall
136 common sched_getparam sys_sched_getparam
137 common sched_setparam sys_sched_setparam
138 common sched_getscheduler sys_sched_getscheduler
139 common sched_setscheduler sys_sched_setscheduler
140 common sched_yield sys_sched_yield
141 common sched_get_priority_max sys_sched_get_priority_max
142 common sched_get_priority_min sys_sched_get_priority_min
143 common sched_rr_get_interval sys_sched_rr_get_interval
144 common nanosleep sys_nanosleep
145 common nfsservctl sys_ni_syscall
146 common prctl sys_prctl
147 common old_getpagesize sys_getpagesize
148 common mmap2 sys_mmap2
149 common pciconfig_read sys_pciconfig_read
150 common pciconfig_write sys_pciconfig_write
2020-09-11 11:49:19 +02:00
151 common perfmonctl sys_ni_syscall
2018-11-13 12:27:44 +05:30
152 common sigaltstack sys_sigaltstack
153 common rt_sigaction sys_rt_sigaction
154 common rt_sigpending sys_rt_sigpending
155 common rt_sigprocmask sys_rt_sigprocmask
156 common rt_sigqueueinfo sys_rt_sigqueueinfo
157 common rt_sigreturn sys_rt_sigreturn
158 common rt_sigsuspend sys_rt_sigsuspend
159 common rt_sigtimedwait sys_rt_sigtimedwait
160 common getcwd sys_getcwd
161 common capget sys_capget
162 common capset sys_capset
163 common sendfile sys_sendfile64
164 common getpmsg sys_ni_syscall
165 common putpmsg sys_ni_syscall
166 common socket sys_socket
167 common bind sys_bind
168 common connect sys_connect
169 common listen sys_listen
170 common accept sys_accept
171 common getsockname sys_getsockname
172 common getpeername sys_getpeername
173 common socketpair sys_socketpair
174 common send sys_send
175 common sendto sys_sendto
176 common recv sys_recv
177 common recvfrom sys_recvfrom
178 common shutdown sys_shutdown
179 common setsockopt sys_setsockopt
180 common getsockopt sys_getsockopt
181 common sendmsg sys_sendmsg
182 common recvmsg sys_recvmsg
183 common pivot_root sys_pivot_root
184 common mincore sys_mincore
185 common madvise sys_madvise
186 common stat sys_newstat
187 common lstat sys_newlstat
188 common fstat sys_newfstat
189 common clone2 sys_clone2
190 common getdents64 sys_getdents64
191 common getunwind sys_getunwind
192 common readahead sys_readahead
193 common setxattr sys_setxattr
194 common lsetxattr sys_lsetxattr
195 common fsetxattr sys_fsetxattr
196 common getxattr sys_getxattr
197 common lgetxattr sys_lgetxattr
198 common fgetxattr sys_fgetxattr
199 common listxattr sys_listxattr
200 common llistxattr sys_llistxattr
201 common flistxattr sys_flistxattr
202 common removexattr sys_removexattr
203 common lremovexattr sys_lremovexattr
204 common fremovexattr sys_fremovexattr
205 common tkill sys_tkill
206 common futex sys_futex
207 common sched_setaffinity sys_sched_setaffinity
208 common sched_getaffinity sys_sched_getaffinity
209 common set_tid_address sys_set_tid_address
210 common fadvise64 sys_fadvise64_64
211 common tgkill sys_tgkill
212 common exit_group sys_exit_group
213 common lookup_dcookie sys_lookup_dcookie
214 common io_setup sys_io_setup
215 common io_destroy sys_io_destroy
216 common io_getevents sys_io_getevents
217 common io_submit sys_io_submit
218 common io_cancel sys_io_cancel
219 common epoll_create sys_epoll_create
220 common epoll_ctl sys_epoll_ctl
221 common epoll_wait sys_epoll_wait
222 common restart_syscall sys_restart_syscall
223 common semtimedop sys_semtimedop
224 common timer_create sys_timer_create
225 common timer_settime sys_timer_settime
226 common timer_gettime sys_timer_gettime
227 common timer_getoverrun sys_timer_getoverrun
228 common timer_delete sys_timer_delete
229 common clock_settime sys_clock_settime
230 common clock_gettime sys_clock_gettime
231 common clock_getres sys_clock_getres
232 common clock_nanosleep sys_clock_nanosleep
233 common fstatfs64 sys_fstatfs64
234 common statfs64 sys_statfs64
235 common mbind sys_mbind
236 common get_mempolicy sys_get_mempolicy
237 common set_mempolicy sys_set_mempolicy
238 common mq_open sys_mq_open
239 common mq_unlink sys_mq_unlink
240 common mq_timedsend sys_mq_timedsend
241 common mq_timedreceive sys_mq_timedreceive
242 common mq_notify sys_mq_notify
243 common mq_getsetattr sys_mq_getsetattr
244 common kexec_load sys_kexec_load
245 common vserver sys_ni_syscall
246 common waitid sys_waitid
247 common add_key sys_add_key
248 common request_key sys_request_key
249 common keyctl sys_keyctl
250 common ioprio_set sys_ioprio_set
251 common ioprio_get sys_ioprio_get
252 common move_pages sys_move_pages
253 common inotify_init sys_inotify_init
254 common inotify_add_watch sys_inotify_add_watch
255 common inotify_rm_watch sys_inotify_rm_watch
256 common migrate_pages sys_migrate_pages
257 common openat sys_openat
258 common mkdirat sys_mkdirat
259 common mknodat sys_mknodat
260 common fchownat sys_fchownat
261 common futimesat sys_futimesat
262 common newfstatat sys_newfstatat
263 common unlinkat sys_unlinkat
264 common renameat sys_renameat
265 common linkat sys_linkat
266 common symlinkat sys_symlinkat
267 common readlinkat sys_readlinkat
268 common fchmodat sys_fchmodat
269 common faccessat sys_faccessat
270 common pselect6 sys_pselect6
271 common ppoll sys_ppoll
272 common unshare sys_unshare
273 common splice sys_splice
274 common set_robust_list sys_set_robust_list
275 common get_robust_list sys_get_robust_list
276 common sync_file_range sys_sync_file_range
277 common tee sys_tee
278 common vmsplice sys_vmsplice
279 common fallocate sys_fallocate
280 common getcpu sys_getcpu
281 common epoll_pwait sys_epoll_pwait
282 common utimensat sys_utimensat
283 common signalfd sys_signalfd
284 common timerfd sys_ni_syscall
285 common eventfd sys_eventfd
286 common timerfd_create sys_timerfd_create
287 common timerfd_settime sys_timerfd_settime
288 common timerfd_gettime sys_timerfd_gettime
289 common signalfd4 sys_signalfd4
290 common eventfd2 sys_eventfd2
291 common epoll_create1 sys_epoll_create1
292 common dup3 sys_dup3
293 common pipe2 sys_pipe2
294 common inotify_init1 sys_inotify_init1
295 common preadv sys_preadv
296 common pwritev sys_pwritev
297 common rt_tgsigqueueinfo sys_rt_tgsigqueueinfo
298 common recvmmsg sys_recvmmsg
299 common fanotify_init sys_fanotify_init
300 common fanotify_mark sys_fanotify_mark
301 common prlimit64 sys_prlimit64
302 common name_to_handle_at sys_name_to_handle_at
303 common open_by_handle_at sys_open_by_handle_at
304 common clock_adjtime sys_clock_adjtime
305 common syncfs sys_syncfs
306 common setns sys_setns
307 common sendmmsg sys_sendmmsg
308 common process_vm_readv sys_process_vm_readv
309 common process_vm_writev sys_process_vm_writev
310 common accept4 sys_accept4
311 common finit_module sys_finit_module
312 common sched_setattr sys_sched_setattr
313 common sched_getattr sys_sched_getattr
314 common renameat2 sys_renameat2
315 common getrandom sys_getrandom
316 common memfd_create sys_memfd_create
317 common bpf sys_bpf
318 common execveat sys_execveat
319 common userfaultfd sys_userfaultfd
320 common membarrier sys_membarrier
321 common kcmp sys_kcmp
322 common mlock2 sys_mlock2
323 common copy_file_range sys_copy_file_range
324 common preadv2 sys_preadv2
325 common pwritev2 sys_pwritev2
2018-12-30 22:25:07 +01:00
326 common statx sys_statx
327 common io_pgetevents sys_io_pgetevents
2018-12-30 22:50:22 +01:00
328 common perf_event_open sys_perf_event_open
329 common seccomp sys_seccomp
2018-12-31 23:12:32 +01:00
330 common pkey_mprotect sys_pkey_mprotect
331 common pkey_alloc sys_pkey_alloc
332 common pkey_free sys_pkey_free
333 common rseq sys_rseq
2019-01-10 12:45:11 +01:00
# 334 through 423 are reserved to sync up with other architectures
2019-02-28 13:59:19 +01:00
424 common pidfd_send_signal sys_pidfd_send_signal
425 common io_uring_setup sys_io_uring_setup
426 common io_uring_enter sys_io_uring_enter
427 common io_uring_register sys_io_uring_register
2019-05-16 12:52:34 +01:00
428 common open_tree sys_open_tree
429 common move_mount sys_move_mount
430 common fsopen sys_fsopen
431 common fsconfig sys_fsconfig
432 common fsmount sys_fsmount
433 common fspick sys_fspick
2019-05-24 12:44:59 +02:00
434 common pidfd_open sys_pidfd_open
2019-07-14 21:22:04 +02:00
# 435 reserved for clone3
2019-05-24 11:31:44 +02:00
436 common close_range sys_close_range
open: introduce openat2(2) syscall
/* Background. */
For a very long time, extending openat(2) with new features has been
incredibly frustrating. This stems from the fact that openat(2) is
possibly the most famous counter-example to the mantra "don't silently
accept garbage from userspace" -- it doesn't check whether unknown flags
are present[1].
This means that (generally) the addition of new flags to openat(2) has
been fraught with backwards-compatibility issues (O_TMPFILE has to be
defined as __O_TMPFILE|O_DIRECTORY|[O_RDWR or O_WRONLY] to ensure old
kernels gave errors, since it's insecure to silently ignore the
flag[2]). All new security-related flags therefore have a tough road to
being added to openat(2).
Userspace also has a hard time figuring out whether a particular flag is
supported on a particular kernel. While it is now possible with
contemporary kernels (thanks to [3]), older kernels will expose unknown
flag bits through fcntl(F_GETFL). Giving a clear -EINVAL during
openat(2) time matches modern syscall designs and is far more
fool-proof.
In addition, the newly-added path resolution restriction LOOKUP flags
(which we would like to expose to user-space) don't feel related to the
pre-existing O_* flag set -- they affect all components of path lookup.
We'd therefore like to add a new flag argument.
Adding a new syscall allows us to finally fix the flag-ignoring problem,
and we can make it extensible enough so that we will hopefully never
need an openat3(2).
/* Syscall Prototype. */
/*
* open_how is an extensible structure (similar in interface to
* clone3(2) or sched_setattr(2)). The size parameter must be set to
* sizeof(struct open_how), to allow for future extensions. All future
* extensions will be appended to open_how, with their zero value
* acting as a no-op default.
*/
struct open_how { /* ... */ };
int openat2(int dfd, const char *pathname,
struct open_how *how, size_t size);
/* Description. */
The initial version of 'struct open_how' contains the following fields:
flags
Used to specify openat(2)-style flags. However, any unknown flag
bits or otherwise incorrect flag combinations (like O_PATH|O_RDWR)
will result in -EINVAL. In addition, this field is 64-bits wide to
allow for more O_ flags than currently permitted with openat(2).
mode
The file mode for O_CREAT or O_TMPFILE.
Must be set to zero if flags does not contain O_CREAT or O_TMPFILE.
resolve
Restrict path resolution (in contrast to O_* flags they affect all
path components). The current set of flags are as follows (at the
moment, all of the RESOLVE_ flags are implemented as just passing
the corresponding LOOKUP_ flag).
RESOLVE_NO_XDEV => LOOKUP_NO_XDEV
RESOLVE_NO_SYMLINKS => LOOKUP_NO_SYMLINKS
RESOLVE_NO_MAGICLINKS => LOOKUP_NO_MAGICLINKS
RESOLVE_BENEATH => LOOKUP_BENEATH
RESOLVE_IN_ROOT => LOOKUP_IN_ROOT
open_how does not contain an embedded size field, because it is of
little benefit (userspace can figure out the kernel open_how size at
runtime fairly easily without it). It also only contains u64s (even
though ->mode arguably should be a u16) to avoid having padding fields
which are never used in the future.
Note that as a result of the new how->flags handling, O_PATH|O_TMPFILE
is no longer permitted for openat(2). As far as I can tell, this has
always been a bug and appears to not be used by userspace (and I've not
seen any problems on my machines by disallowing it). If it turns out
this breaks something, we can special-case it and only permit it for
openat(2) but not openat2(2).
After input from Florian Weimer, the new open_how and flag definitions
are inside a separate header from uapi/linux/fcntl.h, to avoid problems
that glibc has with importing that header.
/* Testing. */
In a follow-up patch there are over 200 selftests which ensure that this
syscall has the correct semantics and will correctly handle several
attack scenarios.
In addition, I've written a userspace library[4] which provides
convenient wrappers around openat2(RESOLVE_IN_ROOT) (this is necessary
because no other syscalls support RESOLVE_IN_ROOT, and thus lots of care
must be taken when using RESOLVE_IN_ROOT'd file descriptors with other
syscalls). During the development of this patch, I've run numerous
verification tests using libpathrs (showing that the API is reasonably
usable by userspace).
/* Future Work. */
Additional RESOLVE_ flags have been suggested during the review period.
These can be easily implemented separately (such as blocking auto-mount
during resolution).
Furthermore, there are some other proposed changes to the openat(2)
interface (the most obvious example is magic-link hardening[5]) which
would be a good opportunity to add a way for userspace to restrict how
O_PATH file descriptors can be re-opened.
Another possible avenue of future work would be some kind of
CHECK_FIELDS[6] flag which causes the kernel to indicate to userspace
which openat2(2) flags and fields are supported by the current kernel
(to avoid userspace having to go through several guesses to figure it
out).
[1]: https://lwn.net/Articles/588444/
[2]: https://lore.kernel.org/lkml/CA+55aFyyxJL1LyXZeBsf2ypriraj5ut1XkNDsunRBqgVjZU_6Q@mail.gmail.com
[3]: commit 629e014bb834 ("fs: completely ignore unknown open flags")
[4]: https://sourceware.org/bugzilla/show_bug.cgi?id=17523
[5]: https://lore.kernel.org/lkml/20190930183316.10190-2-cyphar@cyphar.com/
[6]: https://youtu.be/ggD-eb3yPVs
Suggested-by: Christian Brauner <christian.brauner@ubuntu.com>
Signed-off-by: Aleksa Sarai <cyphar@cyphar.com>
Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
2020-01-18 23:07:59 +11:00
437 common openat2 sys_openat2
2020-01-07 09:59:26 -08:00
438 common pidfd_getfd sys_pidfd_getfd
2020-05-14 16:44:25 +02:00
439 common faccessat2 sys_faccessat2
mm/madvise: introduce process_madvise() syscall: an external memory hinting API
There is usecase that System Management Software(SMS) want to give a
memory hint like MADV_[COLD|PAGEEOUT] to other processes and in the
case of Android, it is the ActivityManagerService.
The information required to make the reclaim decision is not known to the
app. Instead, it is known to the centralized userspace
daemon(ActivityManagerService), and that daemon must be able to initiate
reclaim on its own without any app involvement.
To solve the issue, this patch introduces a new syscall
process_madvise(2). It uses pidfd of an external process to give the
hint. It also supports vector address range because Android app has
thousands of vmas due to zygote so it's totally waste of CPU and power if
we should call the syscall one by one for each vma.(With testing 2000-vma
syscall vs 1-vector syscall, it showed 15% performance improvement. I
think it would be bigger in real practice because the testing ran very
cache friendly environment).
Another potential use case for the vector range is to amortize the cost
ofTLB shootdowns for multiple ranges when using MADV_DONTNEED; this could
benefit users like TCP receive zerocopy and malloc implementations. In
future, we could find more usecases for other advises so let's make it
happens as API since we introduce a new syscall at this moment. With
that, existing madvise(2) user could replace it with process_madvise(2)
with their own pid if they want to have batch address ranges support
feature.
ince it could affect other process's address range, only privileged
process(PTRACE_MODE_ATTACH_FSCREDS) or something else(e.g., being the same
UID) gives it the right to ptrace the process could use it successfully.
The flag argument is reserved for future use if we need to extend the API.
I think supporting all hints madvise has/will supported/support to
process_madvise is rather risky. Because we are not sure all hints make
sense from external process and implementation for the hint may rely on
the caller being in the current context so it could be error-prone. Thus,
I just limited hints as MADV_[COLD|PAGEOUT] in this patch.
If someone want to add other hints, we could hear the usecase and review
it for each hint. It's safer for maintenance rather than introducing a
buggy syscall but hard to fix it later.
So finally, the API is as follows,
ssize_t process_madvise(int pidfd, const struct iovec *iovec,
unsigned long vlen, int advice, unsigned int flags);
DESCRIPTION
The process_madvise() system call is used to give advice or directions
to the kernel about the address ranges from external process as well as
local process. It provides the advice to address ranges of process
described by iovec and vlen. The goal of such advice is to improve
system or application performance.
The pidfd selects the process referred to by the PID file descriptor
specified in pidfd. (See pidofd_open(2) for further information)
The pointer iovec points to an array of iovec structures, defined in
<sys/uio.h> as:
struct iovec {
void *iov_base; /* starting address */
size_t iov_len; /* number of bytes to be advised */
};
The iovec describes address ranges beginning at address(iov_base)
and with size length of bytes(iov_len).
The vlen represents the number of elements in iovec.
The advice is indicated in the advice argument, which is one of the
following at this moment if the target process specified by pidfd is
external.
MADV_COLD
MADV_PAGEOUT
Permission to provide a hint to external process is governed by a
ptrace access mode PTRACE_MODE_ATTACH_FSCREDS check; see ptrace(2).
The process_madvise supports every advice madvise(2) has if target
process is in same thread group with calling process so user could
use process_madvise(2) to extend existing madvise(2) to support
vector address ranges.
RETURN VALUE
On success, process_madvise() returns the number of bytes advised.
This return value may be less than the total number of requested
bytes, if an error occurred. The caller should check return value
to determine whether a partial advice occurred.
FAQ:
Q.1 - Why does any external entity have better knowledge?
Quote from Sandeep
"For Android, every application (including the special SystemServer)
are forked from Zygote. The reason of course is to share as many
libraries and classes between the two as possible to benefit from the
preloading during boot.
After applications start, (almost) all of the APIs end up calling into
this SystemServer process over IPC (binder) and back to the
application.
In a fully running system, the SystemServer monitors every single
process periodically to calculate their PSS / RSS and also decides
which process is "important" to the user for interactivity.
So, because of how these processes start _and_ the fact that the
SystemServer is looping to monitor each process, it does tend to *know*
which address range of the application is not used / useful.
Besides, we can never rely on applications to clean things up
themselves. We've had the "hey app1, the system is low on memory,
please trim your memory usage down" notifications for a long time[1].
They rely on applications honoring the broadcasts and very few do.
So, if we want to avoid the inevitable killing of the application and
restarting it, some way to be able to tell the OS about unimportant
memory in these applications will be useful.
- ssp
Q.2 - How to guarantee the race(i.e., object validation) between when
giving a hint from an external process and get the hint from the target
process?
process_madvise operates on the target process's address space as it
exists at the instant that process_madvise is called. If the space
target process can run between the time the process_madvise process
inspects the target process address space and the time that
process_madvise is actually called, process_madvise may operate on
memory regions that the calling process does not expect. It's the
responsibility of the process calling process_madvise to close this
race condition. For example, the calling process can suspend the
target process with ptrace, SIGSTOP, or the freezer cgroup so that it
doesn't have an opportunity to change its own address space before
process_madvise is called. Another option is to operate on memory
regions that the caller knows a priori will be unchanged in the target
process. Yet another option is to accept the race for certain
process_madvise calls after reasoning that mistargeting will do no
harm. The suggested API itself does not provide synchronization. It
also apply other APIs like move_pages, process_vm_write.
The race isn't really a problem though. Why is it so wrong to require
that callers do their own synchronization in some manner? Nobody
objects to write(2) merely because it's possible for two processes to
open the same file and clobber each other's writes --- instead, we tell
people to use flock or something. Think about mmap. It never
guarantees newly allocated address space is still valid when the user
tries to access it because other threads could unmap the memory right
before. That's where we need synchronization by using other API or
design from userside. It shouldn't be part of API itself. If someone
needs more fine-grained synchronization rather than process level,
there were two ideas suggested - cookie[2] and anon-fd[3]. Both are
applicable via using last reserved argument of the API but I don't
think it's necessary right now since we have already ways to prevent
the race so don't want to add additional complexity with more
fine-grained optimization model.
To make the API extend, it reserved an unsigned long as last argument
so we could support it in future if someone really needs it.
Q.3 - Why doesn't ptrace work?
Injecting an madvise in the target process using ptrace would not work
for us because such injected madvise would have to be executed by the
target process, which means that process would have to be runnable and
that creates the risk of the abovementioned race and hinting a wrong
VMA. Furthermore, we want to act the hint in caller's context, not the
callee's, because the callee is usually limited in cpuset/cgroups or
even freezed state so they can't act by themselves quick enough, which
causes more thrashing/kill. It doesn't work if the target process are
ptraced(e.g., strace, debugger, minidump) because a process can have at
most one ptracer.
[1] https://developer.android.com/topic/performance/memory"
[2] process_getinfo for getting the cookie which is updated whenever
vma of process address layout are changed - Daniel Colascione -
https://lore.kernel.org/lkml/20190520035254.57579-1-minchan@kernel.org/T/#m7694416fd179b2066a2c62b5b139b14e3894e224
[3] anonymous fd which is used for the object(i.e., address range)
validation - Michal Hocko -
https://lore.kernel.org/lkml/20200120112722.GY18451@dhcp22.suse.cz/
[minchan@kernel.org: fix process_madvise build break for arm64]
Link: http://lkml.kernel.org/r/20200303145756.GA219683@google.com
[minchan@kernel.org: fix build error for mips of process_madvise]
Link: http://lkml.kernel.org/r/20200508052517.GA197378@google.com
[akpm@linux-foundation.org: fix patch ordering issue]
[akpm@linux-foundation.org: fix arm64 whoops]
[minchan@kernel.org: make process_madvise() vlen arg have type size_t, per Florian]
[akpm@linux-foundation.org: fix i386 build]
[sfr@canb.auug.org.au: fix syscall numbering]
Link: https://lkml.kernel.org/r/20200905142639.49fc3f1a@canb.auug.org.au
[sfr@canb.auug.org.au: madvise.c needs compat.h]
Link: https://lkml.kernel.org/r/20200908204547.285646b4@canb.auug.org.au
[minchan@kernel.org: fix mips build]
Link: https://lkml.kernel.org/r/20200909173655.GC2435453@google.com
[yuehaibing@huawei.com: remove duplicate header which is included twice]
Link: https://lkml.kernel.org/r/20200915121550.30584-1-yuehaibing@huawei.com
[minchan@kernel.org: do not use helper functions for process_madvise]
Link: https://lkml.kernel.org/r/20200921175539.GB387368@google.com
[akpm@linux-foundation.org: pidfd_get_pid() gained an argument]
[sfr@canb.auug.org.au: fix up for "iov_iter: transparently handle compat iovecs in import_iovec"]
Link: https://lkml.kernel.org/r/20200928212542.468e1fef@canb.auug.org.au
Signed-off-by: Minchan Kim <minchan@kernel.org>
Signed-off-by: YueHaibing <yuehaibing@huawei.com>
Signed-off-by: Stephen Rothwell <sfr@canb.auug.org.au>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Reviewed-by: Suren Baghdasaryan <surenb@google.com>
Reviewed-by: Vlastimil Babka <vbabka@suse.cz>
Acked-by: David Rientjes <rientjes@google.com>
Cc: Alexander Duyck <alexander.h.duyck@linux.intel.com>
Cc: Brian Geffon <bgeffon@google.com>
Cc: Christian Brauner <christian@brauner.io>
Cc: Daniel Colascione <dancol@google.com>
Cc: Jann Horn <jannh@google.com>
Cc: Jens Axboe <axboe@kernel.dk>
Cc: Joel Fernandes <joel@joelfernandes.org>
Cc: Johannes Weiner <hannes@cmpxchg.org>
Cc: John Dias <joaodias@google.com>
Cc: Kirill Tkhai <ktkhai@virtuozzo.com>
Cc: Michal Hocko <mhocko@suse.com>
Cc: Oleksandr Natalenko <oleksandr@redhat.com>
Cc: Sandeep Patil <sspatil@google.com>
Cc: SeongJae Park <sj38.park@gmail.com>
Cc: SeongJae Park <sjpark@amazon.de>
Cc: Shakeel Butt <shakeelb@google.com>
Cc: Sonny Rao <sonnyrao@google.com>
Cc: Tim Murray <timmurray@google.com>
Cc: Christian Brauner <christian.brauner@ubuntu.com>
Cc: Florian Weimer <fw@deneb.enyo.de>
Cc: <linux-man@vger.kernel.org>
Link: http://lkml.kernel.org/r/20200302193630.68771-3-minchan@kernel.org
Link: http://lkml.kernel.org/r/20200508183320.GA125527@google.com
Link: http://lkml.kernel.org/r/20200622192900.22757-4-minchan@kernel.org
Link: https://lkml.kernel.org/r/20200901000633.1920247-4-minchan@kernel.org
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
2020-10-17 16:14:59 -07:00
440 common process_madvise sys_process_madvise
2020-12-18 14:05:41 -08:00
441 common epoll_pwait2 sys_epoll_pwait2
fs: add mount_setattr()
This implements the missing mount_setattr() syscall. While the new mount
api allows to change the properties of a superblock there is currently
no way to change the properties of a mount or a mount tree using file
descriptors which the new mount api is based on. In addition the old
mount api has the restriction that mount options cannot be applied
recursively. This hasn't changed since changing mount options on a
per-mount basis was implemented in [1] and has been a frequent request
not just for convenience but also for security reasons. The legacy
mount syscall is unable to accommodate this behavior without introducing
a whole new set of flags because MS_REC | MS_REMOUNT | MS_BIND |
MS_RDONLY | MS_NOEXEC | [...] only apply the mount option to the topmost
mount. Changing MS_REC to apply to the whole mount tree would mean
introducing a significant uapi change and would likely cause significant
regressions.
The new mount_setattr() syscall allows to recursively clear and set
mount options in one shot. Multiple calls to change mount options
requesting the same changes are idempotent:
int mount_setattr(int dfd, const char *path, unsigned flags,
struct mount_attr *uattr, size_t usize);
Flags to modify path resolution behavior are specified in the @flags
argument. Currently, AT_EMPTY_PATH, AT_RECURSIVE, AT_SYMLINK_NOFOLLOW,
and AT_NO_AUTOMOUNT are supported. If useful, additional lookup flags to
restrict path resolution as introduced with openat2() might be supported
in the future.
The mount_setattr() syscall can be expected to grow over time and is
designed with extensibility in mind. It follows the extensible syscall
pattern we have used with other syscalls such as openat2(), clone3(),
sched_{set,get}attr(), and others.
The set of mount options is passed in the uapi struct mount_attr which
currently has the following layout:
struct mount_attr {
__u64 attr_set;
__u64 attr_clr;
__u64 propagation;
__u64 userns_fd;
};
The @attr_set and @attr_clr members are used to clear and set mount
options. This way a user can e.g. request that a set of flags is to be
raised such as turning mounts readonly by raising MOUNT_ATTR_RDONLY in
@attr_set while at the same time requesting that another set of flags is
to be lowered such as removing noexec from a mount tree by specifying
MOUNT_ATTR_NOEXEC in @attr_clr.
Note, since the MOUNT_ATTR_<atime> values are an enum starting from 0,
not a bitmap, users wanting to transition to a different atime setting
cannot simply specify the atime setting in @attr_set, but must also
specify MOUNT_ATTR__ATIME in the @attr_clr field. So we ensure that
MOUNT_ATTR__ATIME can't be partially set in @attr_clr and that @attr_set
can't have any atime bits set if MOUNT_ATTR__ATIME isn't set in
@attr_clr.
The @propagation field lets callers specify the propagation type of a
mount tree. Propagation is a single property that has four different
settings and as such is not really a flag argument but an enum.
Specifically, it would be unclear what setting and clearing propagation
settings in combination would amount to. The legacy mount() syscall thus
forbids the combination of multiple propagation settings too. The goal
is to keep the semantics of mount propagation somewhat simple as they
are overly complex as it is.
The @userns_fd field lets user specify a user namespace whose idmapping
becomes the idmapping of the mount. This is implemented and explained in
detail in the next patch.
[1]: commit 2e4b7fcd9260 ("[PATCH] r/o bind mounts: honor mount writer counts at remount")
Link: https://lore.kernel.org/r/20210121131959.646623-35-christian.brauner@ubuntu.com
Cc: David Howells <dhowells@redhat.com>
Cc: Aleksa Sarai <cyphar@cyphar.com>
Cc: Al Viro <viro@zeniv.linux.org.uk>
Cc: linux-fsdevel@vger.kernel.org
Cc: linux-api@vger.kernel.org
Reviewed-by: Christoph Hellwig <hch@lst.de>
Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>
2021-01-21 14:19:53 +01:00
442 common mount_setattr sys_mount_setattr
2021-05-31 18:42:58 +02:00
443 common quotactl_fd sys_quotactl_fd
2021-04-22 17:41:19 +02:00
444 common landlock_create_ruleset sys_landlock_create_ruleset
445 common landlock_add_rule sys_landlock_add_rule
446 common landlock_restrict_self sys_landlock_restrict_self
