From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from mail-pj1-f42.google.com (mail-pj1-f42.google.com [209.85.216.42]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 5E0CE37F727 for ; Fri, 10 Jul 2026 20:53:55 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=209.85.216.42 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1783716839; cv=none; b=OqXtVnkPk+9SW2T/eZFVFwoDVC7no0+fzO6+06a0747VHqWZ9dFMlh5gqLGGWkO83EGvV4eDU3f2pqHzKc2lTEUKwIItf3oPpsVMKRjpVvp/WUl0k2Qie1tSKim8iQXpBykLdzZJGxyO7W3ORv1zaApxxFkRaEmSWdWy5/cYuGg= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1783716839; c=relaxed/simple; bh=Q2g+92mZWfRURIjo+o3PCxwGhr1SoCujFcAi1LgOXqc=; h=From:To:Cc:Subject:Date:Message-ID:MIME-Version; b=HwhXoS9gDXrQ+BRUODtezzOvdiQxJ4uo3SfWOvq0h2PerCVAFdgavhxrGiHz6XtSS/p4u3lpsiETS5j2gg+3L1IT+xbx40GyFyia1QBc3jZdrm4yKmMXyrYNsasi6UbGnCxnVaUAqjUOCqU9lMmP7CpPtXIojgbnxnqGDbIHWp8= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com; spf=pass smtp.mailfrom=gmail.com; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b=TIvW3cTJ; arc=none smtp.client-ip=209.85.216.42 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=gmail.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b="TIvW3cTJ" Received: by mail-pj1-f42.google.com with SMTP id 98e67ed59e1d1-381018b9375so1734374a91.0 for ; Fri, 10 Jul 2026 13:53:55 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20251104; t=1783716834; x=1784321634; darn=vger.kernel.org; h=content-transfer-encoding:mime-version:message-id:date:subject:cc :to:from:from:to:cc:subject:date:message-id:reply-to:content-type; bh=13qA2fJAs5tJqvbMzl890ijH0mJhzYe7F+N4H+bA7a0=; b=TIvW3cTJxuR/cbmOyPSv+UxqSdQnO8waU82Qg5Pkkj5eKczbAdPKKs+nrALhHxlpzm 6vp+Wob5PEi7jx1YQhFbmUcZrlW7jfwRdm/8RtInqXE/1+y8vbGt8lFc6S+esTH8whfK Xm+4mz+X+SUFP3MB8l51sZQ2UtRWSvOAZPt9wC8M5HAnW1R3oX9Mt7QQ7G8UsBHJ36bL DS2GQ7honundK+AoGwURlOeJqtlNqKXC7pRJmQYBcNGZLczmDIUNxmz0RuH+HoZ52L++ 2tWwsWnuE92sWnRdy9WBAJpcGqGCNwP7VbrsOLtIUemIqrtj+r3a+J/aZUNeO50dAI50 0RTw== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1783716834; x=1784321634; h=content-transfer-encoding:mime-version:message-id:date:subject:cc :to:from:x-gm-gg:x-gm-message-state:from:to:cc:subject:date :message-id:reply-to:content-type; bh=13qA2fJAs5tJqvbMzl890ijH0mJhzYe7F+N4H+bA7a0=; b=BfY0CZJ694Hrh828rHIPeNYq4VGbmfIrhN3EsBknsAkPT3nVZwt++D0zhdf7OxaVEP VgVvXJ9fPJsozhpMjqX+rXGAw7GN88tY4xu8NlmdxqbGww7rGzXW1OPEhQCPGepVoz/7 yd9U5C54ib/uE3Sd77ENh7bSdvLBYOQ4zC/7fQZdQJKHC5O+xMi+y2N85qYbSnASc9IJ OJdM8IdEBGHlYooQL36n0Q8l6dEb5EctqrBzWOdyB56kf93Iafm6+TmYlBg87UPyopNt +wuvwGEzFc9RdoGTmFDmAgSQx6Ov2hI5SJFnsaYnmwT1ACvsIeedAdEv04TqYLBh7xp8 sbjw== X-Forwarded-Encrypted: i=1; AHgh+RpJ53nyCvleI/dAVYERwC3y/lEriXUQ2ce2nO8ligRaYSe/Um0BBvePIOGfPjmq/XP2dxUNlKPXe0OiGe4=@vger.kernel.org X-Gm-Message-State: AOJu0YyoRXVlW7WBVtFHlRxbyEEO5ajx2bMzlqAjpc4K0nkirTvuq0ji DaCuOD6LFvtt2W9k6EYAsbK0kG8N4WkP3JgneircBHru74C5Gpwnd8MjcAFx/A== X-Gm-Gg: AfdE7cmHI/18ylUx4dySkJxPnOdQb8vd6aOfpVeYsbJRxE8wtMd8GV+z5VzD1Y4BBXA ORuLaKOP+M2xSy5DnYlXcx8RdM6/5b7hGn7z6I8YuVYEmBRXvFaYjRv+R1u52cDc1iiYNhtomfZ /pdR68ZHu+gjh+i2qO+b/qwPpq3r3MQEjqEUc84T6V/jRGotJoPtBPb+NKenS9mLBH/kF0HmJ62 Eqm1sQ32jGhPUQox6diJ2oYVHGuOp3vIhFQ+7wdJQTQdFgSKtLrcyVanEWSbHoDCeVFs2ITYs72 wrJn906KJEiuDWyll9/0iFYt13YLLRMGWjXX72kWka8VycO8TgyGtK5rjg19jvHohvyWa6itQ+m 1syQXc+bMdkWnKGScAWPnKyYflu3isIG2ZzSePNs05zEKWZdz3l8LmBiDxGpSSvrOmSeCcQ4ZA+ ZARTiUxRl4omUK/WZQqrFeS66R14chkF38b5BI1/f4Pb6Q82Vkw7Q3p8Q= X-Received: by 2002:a05:6a21:9f17:b0:3c0:9c19:65c4 with SMTP id adf61e73a8af0-3c110aaff03mr652395637.76.1783716834255; Fri, 10 Jul 2026 13:53:54 -0700 (PDT) Received: from pop-os.scu.edu ([129.210.115.107]) by smtp.gmail.com with ESMTPSA id 5a478bee46e88-3119c2a7bb5sm21724371eec.25.2026.07.10.13.53.52 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Fri, 10 Jul 2026 13:53:53 -0700 (PDT) From: Cong Wang To: Richard Weinberger , Anton Ivanov , Johannes Berg Cc: Benjamin Berg , linux-um@lists.infradead.org, linux-kernel@vger.kernel.org, Cong Wang Subject: [RFC PATCH 0/6] um: introduce pidfd_mmap()/pidfd_munmap() syscalls Date: Fri, 10 Jul 2026 13:53:18 -0700 Message-ID: <20260710205324.1343217-1-xiyou.wangcong@gmail.com> X-Mailer: git-send-email 2.43.0 Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: 8bit This RFC adds two syscalls, pidfd_mmap() and pidfd_munmap(), that let a supervisor install or remove a mapping in another process's address space without target-side cooperation, and converts User Mode Linux to use them. pidfd_mmap(int pidfd, struct pidfd_mmap_args *uargs, unsigned int flags) pidfd_munmap(int pidfd, unsigned long addr, unsigned long len) The backing fd (if any) is resolved in the *caller's* fd table, mirroring pidfd_getfd()'s cross-task install model. Both are gated by ptrace_may_access(PTRACE_MODE_ATTACH_REALCREDS); LSM/fsnotify hooks run against the caller. pidfd_mmap() takes an extensible, size-versioned argument struct (clone3/openat2 style) since an mmap-shaped call exceeds the 6-argument syscall limit. They build on the mm-side remote-install primitives vm_mmap_remote()/ vm_munmap_remote(), posted separately as: https://lore.kernel.org/all/20260704231831.354543-2-xiyou.wangcong@gmail.com/ UML is the motivating user. Its SKAS monitor previously installed guest mappings by driving the stub to execute mmap/munmap itself: in seccomp mode it passed the physmem fd to the stub over SCM_RIGHTS, and in ptrace mode it batched STUB_SYSCALL_MMAP/MUNMAP entries for the stub to run. pidfd_mmap() lets the monitor install mappings into the stub's mm directly, so the stub never touches the fd or executes mmap/munmap. With both modes converted, the entire stub-syscall batcher and the SCM_RIGHTS fd-passing become dead code and are removed (net ~530 lines). The ptrace conversion (patch 5) is included mainly to demonstrate the primitive's reach; the security caveats pidfd_mmap() does *not* address (e.g. a guest blocking SIGALRM to dodge scheduling) are preserved in stub.c. As this is an RFC, the UML side _intentionally_ does not handle host portability: it assumes a host kernel that provides pidfd_mmap() and deliberately omits any detection or fallback for older hosts (which would otherwise pick the ptrace path, or fail the seccomp probe). That belongs in a non-RFC version and is left out here to keep the series focused on demonstrating the impact on UML. --- Cong Wang (6): pidfd: add pidfd_mmap()/pidfd_munmap() syscalls um: acquire a stub pidfd via CLONE_PIDFD in seccomp mode um: install guest mappings via pidfd_mmap() in seccomp mode um: forbid mmap/munmap in the stub seccomp filter um: install guest mappings via pidfd_mmap() in both modes selftests/pidfd: add pidfd_mmap()/pidfd_munmap() tests arch/um/include/shared/os.h | 4 - arch/um/include/shared/skas/mm_id.h | 8 +- arch/um/include/shared/skas/stub-data.h | 28 -- arch/um/kernel/skas/mmu.c | 9 +- arch/um/kernel/skas/stub.c | 151 ++-------- arch/um/kernel/skas/stub_exe.c | 20 +- arch/um/os-Linux/skas/mem.c | 275 ++---------------- arch/um/os-Linux/skas/process.c | 92 ++---- arch/um/os-Linux/start_up.c | 8 +- arch/x86/entry/syscalls/syscall_64.tbl | 2 + include/linux/syscalls.h | 5 + include/uapi/linux/pidfd.h | 18 ++ kernel/pid.c | 132 +++++++++ scripts/syscall.tbl | 2 + tools/testing/selftests/pidfd/Makefile | 3 +- tools/testing/selftests/pidfd/pidfd.h | 34 +++ .../testing/selftests/pidfd/pidfd_mmap_test.c | 234 +++++++++++++++ 17 files changed, 520 insertions(+), 505 deletions(-) create mode 100644 tools/testing/selftests/pidfd/pidfd_mmap_test.c base-commit: 69288464b0af40a988958c0e1b29ff15ccd2acb7 -- 2.43.0