For security reason processes can be resumed only when all
credentials are restored. Otherwise someone can attach to a
process, which are not restored credentials yet and execute
some code.
https://bugzilla.openvz.org/show_bug.cgi?id=2561
Signed-off-by: Andrey Vagin <avagin@openvz.org>
Signed-off-by: Pavel Emelyanov <xemul@parallels.com>
The tcp repair manipulations require CAP_SYS_NET_ADMIN on
a calling task. Thus, if the task to restore is run from
non-root user, the tcp socket repair off will fail, but
restoration wouldn't abort.
Fix this by moving creds restore after tcp restore finish.
Signed-off-by: Pavel Emelyanov <xemul@parallels.com>
We use pr_perror, but after direct syscall calling the
errno is not initialized (and in PIE it doesn't even exists).
Signed-off-by: Pavel Emelyanov <xemul@parallels.com>
pie/parasite.c:308:3: warning: Value stored to 'ret' is never read
ret = -1;
Signed-off-by: Andrey Vagin <avagin@openvz.org>
Signed-off-by: Pavel Emelyanov <xemul@parallels.com>
This diet types.h and allows to include BITS_PER_LONG
only where really needed. It makes BITS_PER_LONG definition
close to one used in kernel.
Signed-off-by: Cyrill Gorcunov <gorcunov@openvz.org>
Signed-off-by: Pavel Emelyanov <xemul@parallels.com>
The image data may have no futex provided but we have
no "optional" entry for that (because futex data is
a part of thread_core_entry message).
Still we know that futex length can't be zero thus
make it "optional" by a value -- if length is zero,
we consider it as a sign to skip.
Signed-off-by: Cyrill Gorcunov <gorcunov@openvz.org>
Signed-off-by: Pavel Emelyanov <xemul@parallels.com>
VMA-s may be protected against read, so rights for such VMA-s should be
changed for dumping and protected back after dumping.
Signed-off-by: Andrey Vagin <avagin@openvz.org>
Signed-off-by: Pavel Emelyanov <xemul@parallels.com>
Some syscalls return error code, so for easier debugging
instead of zapping it -- print it together with error
message.
And make error message more detailed as well.
Signed-off-by: Cyrill Gorcunov <gorcunov@openvz.org>
Signed-off-by: Pavel Emelyanov <xemul@parallels.com>
It's being noticed on arm platform the .got table
has been missed to include in .crblob section,
so fix it.
Reported-by: Chanho Park <chanho61.park@samsusng.com>
Signed-off-by: Cyrill Gorcunov <gorcunov@openvz.org>
Signed-off-by: Pavel Emelyanov <xemul@parallels.com>
Each zombie sends SIGCHLD to parent. crtools restores all pending
signals, so all other signals should be collected.
Here is a problems, that signals SIGCHLD can be merged, but crtools
should be sure, that all signals are collected.
For that a zombie locks a global zombie_lock, which is released by
parent.
This operation should be done between CR_STATE_RESTORE and
CR_STATE_RESTORE_SIGCHLD.
Here is one more CR_STATE_RESTORE_ZOMBIES, whic is used for waiting all
zombies.
v2: clean up
v3: rework synchronization
v4: rework without additional CR_STATE-s
Signed-off-by: Andrey Vagin <avagin@openvz.org>
Signed-off-by: Pavel Emelyanov <xemul@parallels.com>
Alexander, could you help me with ARM? I found in glibc sources, that
sa_restoer should look like this:
ports/sysdeps/unix/sysv/linux/arm/sigrestorer.S
....
ENTRY(__cr_restore_rt)
CFI
mov r7, $SYS_ify(rt_sigreturn)
swi 0x0
.fnend
END(__cr_restore_rt)
v2: Move architecture-dependent code in the proper place
v3: Don't add a separate handler for collecting zombies
Cc: Alexander Kartashov <alekskartashov@parallels.com>
Signed-off-by: Andrey Vagin <avagin@openvz.org>
Signed-off-by: Pavel Emelyanov <xemul@parallels.com>
Read siginfo-s from images and send them to itself by sigqueueinfo.
Thread signals cannot be restored in restore_thread_common, because
it blocks SIGCHLD, which used for error detecting.
v2: Don't remap task_args and thread_args
v3: fix error handling
v4: cosmetic clean up
Signed-off-by: Andrey Vagin <avagin@openvz.org>
Signed-off-by: Pavel Emelyanov <xemul@parallels.com>
Actually rt_sigset_t and k_rtsigset_t are the same
Signed-off-by: Andrey Vagin <avagin@openvz.org>
Signed-off-by: Pavel Emelyanov <xemul@parallels.com>
Currently we dump pages directly from parasite into image files. This
is bad for several reasons:
1. We cannot use any more-or-less custom format for pages easily, since
parasite code cannot be linked with any libraries;
2. We will not be able to optimize migration with preliminary memory
migration (a.k.a. iterative migration) with it -- if we send pages
from parasite over network we are not able to let the task we dump
continue running.
That said, what is done is -- pages from target task are put into a
page-pipe in one go, then (not in this patch) parasite can be released
and we can do with pages whatever we want. For now pages are just
spliced from pipe into image file.
Some numbers:
In order to drain 1Gb of memory from task we need 1.5M of shared map
in args (for iovecs) and 4 pipes (8 descriptors) each referencing 128Mb
of pages, which int turn requires 4 x 640K chunks of sequential kernel
memory (for pipe_buffer). Not that big I guess.
Signed-off-by: Pavel Emelyanov <xemul@parallels.com>
Sometimes we don't know the exact amount of data we would want
to send to parasite via args area (e.g. -- while draining fds).
Fix this, by moving the args area behind the parasite blob and
mmap-ing it with the run-time calculated size.
Signed-off-by: Pavel Emelyanov <xemul@parallels.com>
PIE code can't use glibc helpers so instead of passing
CR_NOGLIBC macro in every source file pie code uses just
pass it in pie/Makefile.
Signed-off-by: Cyrill Gorcunov <gorcunov@openvz.org>
Signed-off-by: Pavel Emelyanov <xemul@parallels.com>
PIE code use own handmade stack so we need -fno-stack-protector
option to eliminate compilation warning if -fstack-protector
passed in command line CFLAGS.
Signed-off-by: Cyrill Gorcunov <gorcunov@openvz.org>
Tested-by: Alexander Kartashov <alekskartashov@parallels.com>
Signed-off-by: Pavel Emelyanov <xemul@parallels.com>
It's already defined in general Makefile
Signed-off-by: Cyrill Gorcunov <gorcunov@openvz.org>
Tested-by: Alexander Kartashov <alekskartashov@parallels.com>
Signed-off-by: Pavel Emelyanov <xemul@parallels.com>
In case if CFLAGS is overriden from command line we don't
see our headers anymore. So provide mandatory options in
ccflags-y variable to fix that.
https://bugzilla.openvz.org/show_bug.cgi?id=2521
Reported-by: Jan Engelhardt <jengelh@inai.de>
Signed-off-by: Cyrill Gorcunov <gorcunov@openvz.org>
Tested-by: Alexander Kartashov <alekskartashov@parallels.com>
Signed-off-by: Pavel Emelyanov <xemul@parallels.com>
Because we need util-net.c for both PIE code and
a regular code, just move it to pie/ directory
and build with -fpie option, this way we can reuse
compiled file in main program without additional
compilation pass.
Signed-off-by: Cyrill Gorcunov <gorcunov@openvz.org>
Signed-off-by: Pavel Emelyanov <xemul@parallels.com>
No need to walk up the directories if we need
to include protobuf file. This was always a bad
use of ability to walk the filesystem from other
headers.
Same time we don't need -I$(SRC_DIR)/protobuf/
in general makefile anymore.
[xemul: Small fixlet in head Makefile, since patch
it out-of-order]
Signed-off-by: Cyrill Gorcunov <gorcunov@openvz.org>
Signed-off-by: Pavel Emelyanov <xemul@parallels.com>
Otherwise pie may not be re-built if headers
are changed.
https://bugzilla.openvz.org/show_bug.cgi?id=2465
Reported-by: Andrey Vagin <avagin@openvz.org>
Signed-off-by: Cyrill Gorcunov <gorcunov@openvz.org>
Signed-off-by: Pavel Emelyanov <xemul@parallels.com>
In case if there is the VMA which has a huge size (4,8,16 G)
then the prealoocated bitmap space won't be enough to track
all pages. Thus we call for system help invoking mmap() call
with bitmap length needed.
We simply assume that if such big VMA present the node has enough
memory to provide us space for pages huge bitmap.
Reported-by: Adrian Reber <adrian@lisas.de>
Tested-by: Adrian Reber <adrian@lisas.de>
Signed-off-by: Cyrill Gorcunov <gorcunov@openvz.org>
Signed-off-by: Pavel Emelyanov <xemul@parallels.com>
These functions are designated to convert a native pointer
to uint64_t used to store a virtual address in protobuf messages
and vice versa in a machine-independent way.
Signed-off-by: Alexander Kartashov <alekskartashov@parallels.com>
Signed-off-by: Pavel Emelyanov <xemul@parallels.com>
The patch reverts the commit 58064d9b72.
Signed-off-by: Alexander Kartashov <alekskartashov@parallels.com>
Signed-off-by: Pavel Emelyanov <xemul@parallels.com>
This patch prevents compilation warnings about shift overflow on ARM.
Signed-off-by: Alexander Kartashov <alekskartashov@parallels.com>
Signed-off-by: Pavel Emelyanov <xemul@parallels.com>
This patch replaces the format specifier %ld with PRIx64
in the following places:
* the format string argument of the functions scanf() and printf(),
* in the macros GEN_SYSCTL_*_FUNC.
We need explicit specification of the integer size there.
Signed-off-by: Alexander Kartashov <alekskartashov@parallels.com>
Signed-off-by: Pavel Emelyanov <xemul@parallels.com>
The layout of the struct rlimit depends on the value
of the macro FILE_OFFSET_BITS. If FILE_OFFSET_BITS is 64
the userspace and kernel definitions becomes incoherent
on a 32-bit platform.
The struct krlimit representing the kernel version of
the struct rlimit is introduced to address the issue:
the function restore_rlims() is fixed to convert between
the userspace and kernel representations of the struct.
Signed-off-by: Alexander Kartashov <alekskartashov@parallels.com>
Signed-off-by: Pavel Emelyanov <xemul@parallels.com>
TCP repair mode should be disabled after unlocking connections.
Disabling of repair mode drops SO_REUSEADDR, so it should be restored.
Signed-off-by: Andrey Vagin <avagin@openvz.org>
Signed-off-by: Pavel Emelyanov <xemul@parallels.com>
The macro is designated to tune the beginning of a sigframe on different architectures.
Signed-off-by: Alexander Kartashov <alekskartashov@parallels.com>
Signed-off-by: Pavel Emelyanov <xemul@parallels.com>
Dump the with "new" prlimit syscall that works on arbitrary pid.
Restore is done in restorer _after_ mappings mixup and _before_
caps drop to make it set any max value.
The RLIM_INFINITY is handled explicitly to help future 64<->32
bits migration.
Signed-off-by: Pavel Emelyanov <xemul@parallels.com>
The current sys_mmap error analysis code doesn't work on 32-bit architectures
with 3G/1G userspace/kernel virtual address space split since the syscall
allocates anonymous memory above the first 2G of the address space ---
such an address is a negative integer so it's interpreted as a error code.
The problem isn't encountered on x86-64 becauase it doesn't use negative
virtual addresses in the userspace.
The 3G/1G split is used because memory allocation is currently broken for other
values of the split on ARM: the value of TASK_UNMAPPED_BASE (arch/arm/include/asm/memory.h)
isn't page-aligned if other split value is used so the value of the field
mm_struct::mmap_base is initialized with a page-unaligned value by
the function arch_pick_mmap_layout() (arch/arm/mm/mmap.c) in some circumstances
that breaks page-alignment checks in the kernel memory management code.
This patch modifies sys_mmap return value analysis code replacing tests
for negativeness of the signed return value with tests that checks that
the return value isn't greater than TASK_SIZE.
Signed-off-by: Alexander Kartashov <alekskartashov@parallels.com>
Signed-off-by: Pavel Emelyanov <xemul@parallels.com>
VM above TASK_SIZE is read-only but some areas are mapped on ARM
into the process address space.
Signed-off-by: Alexander Kartashov <alekskartashov@parallels.com>
Signed-off-by: Pavel Emelyanov <xemul@parallels.com>
