#include #include #include #include #include #include #include extern struct scheduler sched_ctx; /* kernel/sched.c */ #define UNMASKABLE (sigset(SIGKILL) | sigset(SIGTERM)) #define TERMSIG (sigset(SIGSEGV) | sigset(SIGINT) | UNMASKABLE) // Referenced in kernel/asm/x86/interrupt.S void* signal_dispatch() { if (!__current->sigctx.sig_pending) { // 没有待处理信号 return 0; } struct sighail* psig = &__current->sigctx; struct sigact* prev_working = psig->inprogress; sigset_t mask = psig->sig_mask | (prev_working ? prev_working->sa_mask : 0); int sig_selected = 31 - __builtin_clz(psig->sig_pending & ~mask); sigset_clear(psig->sig_pending, sig_selected); struct sigact* action = &psig->signals[sig_selected]; if (sig_selected == 0) { // SIG0 is reserved return 0; } if (!action->sa_actor) { if (sigset_test(TERMSIG, sig_selected)) { terminate_proc(sig_selected | PEXITSIG); schedule(); // never return } return 0; } ptr_t ustack = __current->ustack_top; if ((int)(ustack - USTACK_END) < (int)sizeof(struct proc_sig)) { // 用户栈没有空间存放信号上下文 return 0; } struct proc_sig* sigframe = (struct proc_sig*)((ustack - sizeof(struct proc_sig)) & ~0xf); /* 这是一个相当恶心的坑。 问题是出在原本的sigframe->prev_context = __current->intr_ctx的上面 这个语句会被gcc在编译时,用更加高效的 rep movsl 来代替。 由于我们采用按需分页,所以在很多情况下,用户栈实际被分配的空间不允许我们进行完整的 注入,而需要走page fault handler进行动态分页。 竞态条件就出现在这里! 假若我们的__current->intr_ctx注入了一半,然后产生page-fault中断, 那么这就会导致我们的__current->intr_ctx被这个page-fault中断导致的 上下文信息覆盖。那么当page-fault handler成功分配了一个页,返回, 拷贝也就得以进行。遗憾的是,只不过这次拷贝的内容和前面的拷贝是没有任何的关系 (因为此时的intr_ctx已经不是之前的intr_ctx了!) 而这就会导致我们保存在信号上下文中的进程上下文信息不完整,从而在soft_iret时 触发#GP。 解决办法就是先吧intr_ctx拷贝到一个静态分配的区域里,然后再注入到用户栈。 */ static volatile struct proc_sigstate __temp_save; __temp_save.proc_regs = *__current->intr_ctx; memcpy(__temp_save.fxstate, __current->fxstate, 512); sigframe->sig_num = sig_selected; sigframe->sigact = action->sa_actor; sigframe->sighand = action->sa_handler; sigframe->prev_context = __temp_save; action->prev = prev_working; psig->inprogress = action; return sigframe; } void proc_setsignal(struct proc_info* proc, int signum) { sigset_add(proc->sigctx.sig_pending, signum); proc->sigctx.signals[signum].sender = __current->pid; } int signal_send(pid_t pid, int signum) { if (signum < 0 || signum >= _SIG_NUM) { __current->k_status = EINVAL; return -1; } pid_t sender_pid = __current->pid; struct proc_info* proc; if (pid > 0) { proc = get_process(pid); goto send_single; } else if (!pid) { proc = __current; goto send_grp; } else if (pid < -1) { proc = get_process(-pid); goto send_grp; } else { // TODO: send to all process. // But I don't want to support it yet. __current->k_status = EINVAL; return -1; } send_grp: struct proc_info *pos, *n; llist_for_each(pos, n, &proc->grp_member, grp_member) { struct sighail* sh = &pos->sigctx; sigset_add(sh->sig_pending, signum); sh->signals[signum].sender = sender_pid; } send_single: if (PROC_TERMINATED(proc->state)) { __current->k_status = EINVAL; return -1; } sigset_add(proc->sigctx.sig_pending, signum); proc->sigctx.signals[signum].sender = sender_pid; return 0; } __DEFINE_LXSYSCALL1(int, sigreturn, struct proc_sig, *sig_ctx) { memcpy(__current->fxstate, sig_ctx->prev_context.fxstate, 512); // FIXME: Interrupt context is exposed to user space! *__current->intr_ctx = sig_ctx->prev_context.proc_regs; struct sigact* current = __current->sigctx.inprogress; if (current) { __current->sigctx.inprogress = current->prev; current->prev = NULL; } else { __current->sigctx.inprogress = NULL; } schedule(); // never reach! return 0; } __DEFINE_LXSYSCALL3(int, sigprocmask, int, how, const sigset_t, *set, sigset_t, *oldset) { struct sighail* sh = &__current->sigctx; *oldset = sh->sig_mask; if (how == _SIG_BLOCK) { sigset_union(sh->sig_mask, *set); } else if (how == _SIG_UNBLOCK) { sigset_intersect(sh->sig_mask, ~(*set)); } else if (how == _SIG_SETMASK) { sh->sig_mask = *set; } else { return 0; } sigset_intersect(sh->sig_mask, ~UNMASKABLE); return 1; } __DEFINE_LXSYSCALL2(int, sys_sigaction, int, signum, struct sigaction*, action) { if (signum <= 0 || signum >= _SIG_NUM) { return -1; } if (sigset_test(UNMASKABLE, signum)) { return -1; } struct sigact* sa = &__current->sigctx.signals[signum]; sa->sa_actor = (void*)action->sa_sigaction; sa->sa_handler = (void*)action->sa_handler; sigset_union(sa->sa_mask, sigset(signum)); return 0; } __DEFINE_LXSYSCALL(int, pause) { pause_current(); sched_yieldk(); __current->k_status = EINTR; return -1; } __DEFINE_LXSYSCALL2(int, kill, pid_t, pid, int, signum) { return signal_send(pid, signum); } __DEFINE_LXSYSCALL1(int, sigpending, sigset_t, *sigset) { *sigset = __current->sigctx.sig_pending; return 0; } __DEFINE_LXSYSCALL1(int, sigsuspend, sigset_t, *mask) { sigset_t tmp = __current->sigctx.sig_mask; __current->sigctx.sig_mask = (*mask) & ~UNMASKABLE; pause_current(); sched_yieldk(); __current->sigctx.sig_mask = tmp; return -1; }