1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
|
// Copyright 2021 The gVisor Authors.
//
// Licensed under the Apache License, Version 2.0 (the "License");
// you may not use this file except in compliance with the License.
// You may obtain a copy of the License at
//
// http://www.apache.org/licenses/LICENSE-2.0
//
// Unless required by applicable law or agreed to in writing, software
// distributed under the License is distributed on an "AS IS" BASIS,
// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
// See the License for the specific language governing permissions and
// limitations under the License.
package systrap
import (
"fmt"
"sync/atomic"
"unsafe"
"golang.org/x/sys/unix"
"gvisor.dev/gvisor/pkg/abi/linux"
)
func (t *syscallThread) initRequestReplyAddresses(sentryStackAddr uintptr) {
// These are safe as these addresses are mmapped and never moved/gced.
sentryMessage := (*syscallSentryMessage)(unsafe.Pointer(sentryStackAddr))
stubMessage := (*syscallStubMessage)(unsafe.Pointer(sentryStackAddr + syscallStubMessageOffset))
atomic.StoreUint32(&sentryMessage.state, 0)
t.sentryMessage = sentryMessage
t.stubMessage = stubMessage
}
// maskAllSignals blocks all signals.
func (t *syscallThread) maskAllSignalsAttached() {
p := t.thread
mask := ^uint64(0)
if _, _, errno := unix.RawSyscall6(unix.SYS_PTRACE, linux.PTRACE_SETSIGMASK, uintptr(p.tid), 8, uintptr(unsafe.Pointer(&mask)), 0, 0); errno != 0 {
panic(fmt.Sprintf("unable to setmask: %v", errno))
}
}
// unmaskAllSignals unblocks all signals.
func (t *syscallThread) unmaskAllSignalsAttached() {
p := t.thread
mask := uint64(0)
if _, _, errno := unix.RawSyscall6(unix.SYS_PTRACE, linux.PTRACE_SETSIGMASK, uintptr(p.tid), 8, uintptr(unsafe.Pointer(&mask)), 0, 0); errno != 0 {
panic(fmt.Sprintf("unable to setmask: %v", errno))
}
}
func futexWakeUint32(addr *uint32) error {
if _, _, e := unix.RawSyscall6(unix.SYS_FUTEX, uintptr(unsafe.Pointer(addr)), linux.FUTEX_WAKE, 1, 0, 0, 0); e != 0 {
return fmt.Errorf("failed to FUTEX_WAKE: %v", e)
}
return nil
}
func futexWaitForUint32(addr *uint32, targetValue uint32) error {
for {
val := atomic.LoadUint32(addr)
if val == targetValue {
break
}
_, _, e := unix.Syscall6(unix.SYS_FUTEX, uintptr(unsafe.Pointer(addr)), linux.FUTEX_WAIT, uintptr(val), 0, 0, 0)
if e != 0 && e != unix.EAGAIN && e != unix.EINTR {
return fmt.Errorf("failed to FUTEX_WAIT: %v", e)
}
}
return nil
}
// futexWaitWake waits when other side will call FUTEX_WAKE. A value of the
// futex word has to be equal to futexValue and it must not be changed.
func futexWaitWake(futexAddr *uint32, futexValue uint32) error {
for {
_, _, e := unix.Syscall6(unix.SYS_FUTEX, uintptr(unsafe.Pointer(futexAddr)), linux.FUTEX_WAIT, uintptr(futexValue), 0, 0, 0)
if e == 0 {
break
}
if e != unix.EAGAIN && e != unix.EINTR {
return fmt.Errorf("failed to FUTEX_WAIT: %v", e)
}
}
return nil
}
func (t *syscallThread) kickSeccompNotify() unix.Errno {
_, _, errno := unix.RawSyscall(unix.SYS_IOCTL, uintptr(t.seccompNotify.Fd()),
uintptr(linux.SECCOMP_IOCTL_NOTIF_SEND),
uintptr(unsafe.Pointer(&t.seccompNotifyResp)))
return errno
}
func (t *syscallThread) waitForSeccompNotify() error {
for {
req := linux.SeccompNotif{}
_, _, errno := unix.RawSyscall(unix.SYS_IOCTL, uintptr(t.seccompNotify.Fd()),
uintptr(linux.SECCOMP_IOCTL_NOTIF_RECV),
uintptr(unsafe.Pointer(&req)))
if errno == 0 {
t.seccompNotifyResp.ID = req.ID
break
}
if errno == unix.EINTR && t.subproc.alive() {
continue
}
t.thread.kill()
return fmt.Errorf("failed getting response from syscall thread : %w", errno)
}
return nil
}
|
