1. 24 May, 2012 1 commit
  2. 22 May, 2012 1 commit
  3. 16 May, 2012 1 commit
  4. 28 Mar, 2012 1 commit
  5. 11 Mar, 2012 1 commit
  6. 27 Feb, 2012 1 commit
  7. 27 Dec, 2011 1 commit
    • Martin Schwidefsky's avatar
      [S390] cleanup trap handling · aa33c8cb
      Martin Schwidefsky authored
      Move the program interruption code and the translation exception identifier
      to the pt_regs structure as 'int_code' and 'int_parm_long' and make the
      first level interrupt handler in entry[64].S store the two values. That
      makes it possible to drop 'prot_addr' and 'trap_no' from the thread_struct
      and to reduce the number of arguments to a lot of functions. Finally
      un-inline do_trap. Overall this saves 5812 bytes in the .text section of
      the 64 bit kernel.
      Signed-off-by: default avatarMartin Schwidefsky <schwidefsky@de.ibm.com>
      aa33c8cb
  8. 01 Dec, 2011 1 commit
  9. 30 Oct, 2011 5 commits
    • Martin Schwidefsky's avatar
      [S390] allow all addressing modes · d4e81b35
      Martin Schwidefsky authored
      The user space program can change its addressing mode between the
      24-bit, 31-bit and the 64-bit mode if the kernel is 64 bit. Currently
      the kernel always forces the standard amode on signal delivery and
      signal return and on ptrace: 64-bit for a 64-bit process, 31-bit for
      a compat process and 31-bit kernels. Change the signal and ptrace code
      to allow the full range of addressing modes. Signal handlers are
      run in the standard addressing mode for the process.
      
      One caveat is that even an 31-bit compat process can switch to the
      64-bit mode. The next signal will switch back into the 31-bit mode
      and there is no room in the 31-bit compat signal frame to store the
      information that the program came from the 64-bit mode.
      Signed-off-by: default avatarMartin Schwidefsky <schwidefsky@de.ibm.com>
      d4e81b35
    • Martin Schwidefsky's avatar
      [S390] cleanup psw related bits and pieces · b50511e4
      Martin Schwidefsky authored
      Split out addressing mode bits from PSW_BASE_BITS, rename PSW_BASE_BITS
      to PSW_MASK_BASE, get rid of psw_user32_bits, remove unused function
      enabled_wait(), introduce PSW_MASK_USER, and drop PSW_MASK_MERGE macros.
      Change psw_kernel_bits / psw_user_bits to contain only the bits that
      are always set in the respective mode.
      Signed-off-by: default avatarMartin Schwidefsky <schwidefsky@de.ibm.com>
      b50511e4
    • Martin Schwidefsky's avatar
      [S390] add TIF_SYSCALL thread flag · b6ef5bb3
      Martin Schwidefsky authored
      Add an explicit TIF_SYSCALL bit that indicates if a task is inside
      a system call. The svc_code in the pt_regs structure is now only
      valid if TIF_SYSCALL is set. With this definition TIF_RESTART_SVC
      can be replaced with TIF_SYSCALL. Overall do_signal is a bit more
      readable and it saves a few lines of code.
      Signed-off-by: default avatarMartin Schwidefsky <schwidefsky@de.ibm.com>
      b6ef5bb3
    • Martin Schwidefsky's avatar
      [S390] addressing mode limits and psw address wrapping · ccf45caf
      Martin Schwidefsky authored
      An instruction with an address right below the adress limit for the
      current addressing mode will wrap. The instruction restart logic in
      the protection fault handler and the signal code need to follow the
      wrapping rules to find the correct instruction address.
      Signed-off-by: default avatarMartin Schwidefsky <schwidefsky@de.ibm.com>
      ccf45caf
    • Martin Schwidefsky's avatar
      [S390] signal race with restarting system calls · 20b40a79
      Martin Schwidefsky authored
      For a ERESTARTNOHAND/ERESTARTSYS/ERESTARTNOINTR restarting system call
      do_signal will prepare the restart of the system call with a rewind of
      the PSW before calling get_signal_to_deliver (where the debugger might
      take control). For A ERESTART_RESTARTBLOCK restarting system call
      do_signal will set -EINTR as return code.
      There are two issues with this approach:
      1) strace never sees ERESTARTNOHAND, ERESTARTSYS, ERESTARTNOINTR or
         ERESTART_RESTARTBLOCK as the rewinding already took place or the
         return code has been changed to -EINTR
      2) if get_signal_to_deliver does not return with a signal to deliver
         the restart via the repeat of the svc instruction is left in place.
         This opens a race if another signal is made pending before the
         system call instruction can be reexecuted. The original system call
         will be restarted even if the second signal would have ended the
         system call with -EINTR.
      
      These two issues can be solved by dropping the early rewind of the
      system call before get_signal_to_deliver has been called and by using
      the TIF_RESTART_SVC magic to do the restart if no signal has to be
      delivered. The only situation where the system call restart via the
      repeat of the svc instruction is appropriate is when a SA_RESTART
      signal is delivered to user space.
      
      Unfortunately this breaks inferior calls by the debugger again. The
      system call number and the length of the system call instruction is
      lost over the inferior call and user space will see ERESTARTNOHAND/
      ERESTARTSYS/ERESTARTNOINTR/ERESTART_RESTARTBLOCK. To correct this a
      new ptrace interface is added to save/restore the system call number
      and system call instruction length.
      Signed-off-by: default avatarMartin Schwidefsky <schwidefsky@de.ibm.com>
      20b40a79
  10. 03 Aug, 2011 2 commits
  11. 05 Jan, 2011 1 commit
  12. 17 May, 2010 1 commit
  13. 27 Jan, 2010 1 commit
  14. 13 Jan, 2010 1 commit
  15. 02 Sep, 2009 1 commit
    • David Howells's avatar
      KEYS: Add a keyctl to install a process's session keyring on its parent [try #6] · ee18d64c
      David Howells authored
      Add a keyctl to install a process's session keyring onto its parent.  This
      replaces the parent's session keyring.  Because the COW credential code does
      not permit one process to change another process's credentials directly, the
      change is deferred until userspace next starts executing again.  Normally this
      will be after a wait*() syscall.
      
      To support this, three new security hooks have been provided:
      cred_alloc_blank() to allocate unset security creds, cred_transfer() to fill in
      the blank security creds and key_session_to_parent() - which asks the LSM if
      the process may replace its parent's session keyring.
      
      The replacement may only happen if the process has the same ownership details
      as its parent, and the process has LINK permission on the session keyring, and
      the session keyring is owned by the process, and the LSM permits it.
      
      Note that this requires alteration to each architecture's notify_resume path.
      This has been done for all arches barring blackfin, m68k* and xtensa, all of
      which need assembly alteration to support TIF_NOTIFY_RESUME.  This allows the
      replacement to be performed at the point the parent process resumes userspace
      execution.
      
      This allows the userspace AFS pioctl emulation to fully emulate newpag() and
      the VIOCSETTOK and VIOCSETTOK2 pioctls, all of which require the ability to
      alter the parent process's PAG membership.  However, since kAFS doesn't use
      PAGs per se, but rather dumps the keys into the session keyring, the session
      keyring of the parent must be replaced if, for example, VIOCSETTOK is passed
      the newpag flag.
      
      This can be tested with the following program:
      
      	#include <stdio.h>
      	#include <stdlib.h>
      	#include <keyutils.h>
      
      	#define KEYCTL_SESSION_TO_PARENT	18
      
      	#define OSERROR(X, S) do { if ((long)(X) == -1) { perror(S); exit(1); } } while(0)
      
      	int main(int argc, char **argv)
      	{
      		key_serial_t keyring, key;
      		long ret;
      
      		keyring = keyctl_join_session_keyring(argv[1]);
      		OSERROR(keyring, "keyctl_join_session_keyring");
      
      		key = add_key("user", "a", "b", 1, keyring);
      		OSERROR(key, "add_key");
      
      		ret = keyctl(KEYCTL_SESSION_TO_PARENT);
      		OSERROR(ret, "KEYCTL_SESSION_TO_PARENT");
      
      		return 0;
      	}
      
      Compiled and linked with -lkeyutils, you should see something like:
      
      	[dhowells@andromeda ~]$ keyctl show
      	Session Keyring
      	       -3 --alswrv   4043  4043  keyring: _ses
      	355907932 --alswrv   4043    -1   \_ keyring: _uid.4043
      	[dhowells@andromeda ~]$ /tmp/newpag
      	[dhowells@andromeda ~]$ keyctl show
      	Session Keyring
      	       -3 --alswrv   4043  4043  keyring: _ses
      	1055658746 --alswrv   4043  4043   \_ user: a
      	[dhowells@andromeda ~]$ /tmp/newpag hello
      	[dhowells@andromeda ~]$ keyctl show
      	Session Keyring
      	       -3 --alswrv   4043  4043  keyring: hello
      	340417692 --alswrv   4043  4043   \_ user: a
      
      Where the test program creates a new session keyring, sticks a user key named
      'a' into it and then installs it on its parent.
      Signed-off-by: default avatarDavid Howells <dhowells@redhat.com>
      Signed-off-by: default avatarJames Morris <jmorris@namei.org>
      ee18d64c
  16. 12 Jun, 2009 1 commit
  17. 14 Jan, 2009 1 commit
  18. 27 Nov, 2008 1 commit
    • Martin Schwidefsky's avatar
      [S390] fix system call parameter functions. · 59da2139
      Martin Schwidefsky authored
      syscall_get_nr() currently returns a valid result only if the call
      chain of the traced process includes do_syscall_trace_enter(). But
      collect_syscall() can be called for any sleeping task, the result of
      syscall_get_nr() in general is completely bogus.
      
      To make syscall_get_nr() work for any sleeping task the traps field
      in pt_regs is replace with svcnr - the system call number the process
      is executing. If svcnr == 0 the process is not on a system call path.
      
      The syscall_get_arguments and syscall_set_arguments use regs->gprs[2]
      for the first system call parameter. This is incorrect since gprs[2]
      may have been overwritten with the system call number if the call
      chain includes do_syscall_trace_enter. Use regs->orig_gprs2 instead.
      Signed-off-by: default avatarMartin Schwidefsky <schwidefsky@de.ibm.com>
      59da2139
  19. 10 Oct, 2008 1 commit
  20. 17 Apr, 2008 2 commits
  21. 26 Jan, 2008 1 commit
  22. 08 May, 2007 1 commit
  23. 27 Apr, 2007 1 commit
  24. 05 Feb, 2007 1 commit
    • Gerald Schaefer's avatar
      [S390] noexec protection · c1821c2e
      Gerald Schaefer authored
      This provides a noexec protection on s390 hardware. Our hardware does
      not have any bits left in the pte for a hw noexec bit, so this is a
      different approach using shadow page tables and a special addressing
      mode that allows separate address spaces for code and data.
      
      As a special feature of our "secondary-space" addressing mode, separate
      page tables can be specified for the translation of data addresses
      (storage operands) and instruction addresses. The shadow page table is
      used for the instruction addresses and the standard page table for the
      data addresses.
      The shadow page table is linked to the standard page table by a pointer
      in page->lru.next of the struct page corresponding to the page that
      contains the standard page table (since page->private is not really
      private with the pte_lock and the page table pages are not in the LRU
      list).
      Depending on the software bits of a pte, it is either inserted into
      both page tables or just into the standard (data) page table. Pages of
      a vma that does not have the VM_EXEC bit set get mapped only in the
      data address space. Any try to execute code on such a page will cause a
      page translation exception. The standard reaction to this is a SIGSEGV
      with two exceptions: the two system call opcodes 0x0a77 (sys_sigreturn)
      and 0x0aad (sys_rt_sigreturn) are allowed. They are stored by the
      kernel to the signal stack frame. Unfortunately, the signal return
      mechanism cannot be modified to use an SA_RESTORER because the
      exception unwinding code depends on the system call opcode stored
      behind the signal stack frame.
      
      This feature requires that user space is executed in secondary-space
      mode and the kernel in home-space mode, which means that the addressing
      modes need to be switched and that the noexec protection only works
      for user space.
      After switching the addressing modes, we cannot use the mvcp/mvcs
      instructions anymore to copy between kernel and user space. A new
      mvcos instruction has been added to the z9 EC/BC hardware which allows
      to copy between arbitrary address spaces, but on older hardware the
      page tables need to be walked manually.
      Signed-off-by: default avatarGerald Schaefer <geraldsc@de.ibm.com>
      Signed-off-by: default avatarMartin Schwidefsky <schwidefsky@de.ibm.com>
      c1821c2e
  25. 27 Oct, 2006 1 commit
  26. 04 Oct, 2006 1 commit
  27. 20 Sep, 2006 2 commits
  28. 30 Jun, 2006 1 commit
  29. 02 May, 2006 1 commit
  30. 01 Feb, 2006 1 commit
  31. 06 Jan, 2006 2 commits
  32. 29 Sep, 2005 1 commit