kernel: user memory is reached only through a checked copy
A new user-memory module owns every kernel touch of a user buffer: copyFromUser, the new copyToUser, and the resolve behind both. The walk accumulates the U/S and writable bits down all four levels with the MMU's own AND rule — folding a 2 MiB leaf in before it resolves and refusing a 1 GiB leaf outright — so a copy honours what ring 3 itself would be allowed, closing the presence-only trust model the IPC layer carried since bring-up. It then confirms the frame is physmap-backed, because that is how the copy reaches it: an mmio_map'd BAR passes the permission walk and would otherwise fault ring 0 on an alias the physmap never mapped, on the IPC path as much as the new one. The nine stragglers that dereferenced user pointers raw now route through it, so a bad pointer returns -EFAULT where it used to fault the kernel. The write direction restructures its callees around kernel bounce buffers: scheduler and devices-broker enumerate from a slot cursor (a task exiting between chunks can neither duplicate nor lose an entry), klog_read drains the ring in chunks, and fs_node stages headers and names contiguously. fs_resolve copies out before installing the endpoint handle, so a faulting copy cannot strand a capability; its out-capacity bound no longer adds an unbounded ring-3 length to the base, which wrapped and trapped the kernel's own overflow check. debug_write reads the caller's message once. Suite 107/107 (new user-memory case: seven bad pointers refused, each paired with a sound call that must still succeed).
This commit is contained in:
Daniel Samson
parent
c4f16a5448
commit
8d4a7cf240
|
|
@ -332,6 +332,7 @@ pub fn build(b: *std.Build) void {
|
|||
"args-echo",
|
||||
"process-test",
|
||||
"thread-test", // the multi-threaded fixture (its package sets .threaded)
|
||||
"user-memory-test", // aims deliberately bad user pointers at the checked copy layer
|
||||
}) |fixture| {
|
||||
const package = b.lazyDependency(fixture, .{}) orelse
|
||||
@panic("a test fixture package is missing under test/system/services");
|
||||
|
|
|
|||
|
|
@ -74,6 +74,7 @@
|
|||
.@"args-echo" = .{ .path = "test/system/services/args-echo", .lazy = true },
|
||||
.@"process-test" = .{ .path = "test/system/services/process-test", .lazy = true },
|
||||
.@"thread-test" = .{ .path = "test/system/services/thread-test", .lazy = true },
|
||||
.@"user-memory-test" = .{ .path = "test/system/services/user-memory-test", .lazy = true },
|
||||
// See `zig fetch --save <url>` for a command-line interface for adding dependencies.
|
||||
//.example = .{
|
||||
// // When updating this field to a new URL, be sure to delete the corresponding
|
||||
|
|
|
|||
|
|
@ -33,7 +33,7 @@ the logging/USB-lifecycle track).
|
|||
|
||||
- [x] **Phase 0** — baseline: suite green on `main` (106/106, 2026-07-31; `zig build` + `zig build test` clean at 9a32380), plan committed
|
||||
- [x] **PM** — path-migration flag-day (`/etc`→`/system/configuration`, `/var/log`→`/system/logs`, `/mnt/usb`→`/volumes/usb`; vfs carve-out for the two writable `/system` subtrees, FAT's `/var` mount split in two; suite 106/106)
|
||||
- [ ] **H1** — the `user-memory` module; nine stragglers converted; leaf U/S+W checks
|
||||
- [x] **H1** — the `user-memory` module; nine stragglers converted; leaf U/S+W checks (plus physmap-coverage confirmation, so an `mmio_map`'d buffer cannot fault ring 0 — this also closes the same hazard on the IPC path; `fs_resolve`'s out-capacity bound made overflow-safe; suite 107/107)
|
||||
- [ ] **merge** group 1 → main, push
|
||||
- [ ] **P1** — envelope module + `Define`; vfs `NodeKind.protocol` + open-reply-capability; client `Channel`
|
||||
- [ ] **P2** — registry in init; `/protocol` reserved; ServiceId flag-day (11 binds, 17 lookups)
|
||||
|
|
|
|||
|
|
@ -257,6 +257,16 @@ pub fn translate(root: u64, virtual: u64) ?u64 {
|
|||
return paging.translateIn(root, virtual);
|
||||
}
|
||||
|
||||
/// `translate` for an address the kernel is about to touch *on a process's
|
||||
/// behalf*: the walk additionally demands the permission ring 3 would need — the
|
||||
/// leaf user-accessible (U/S set at every level), and writable (R/W at every
|
||||
/// level) when `for_write`. Null means "the process itself could not do this",
|
||||
/// which the checked copy layer (system/kernel/user-memory.zig) turns into
|
||||
/// -EFAULT instead of a kernel dereference.
|
||||
pub fn translateUser(root: u64, virtual: u64, for_write: bool) ?u64 {
|
||||
return paging.translateUserIn(root, virtual, for_write);
|
||||
}
|
||||
|
||||
/// Map a page accessible from ring 3 (U/S bit at every level). The caller keeps
|
||||
/// W^X: code read-only + executable, data writable + no-execute.
|
||||
pub fn mapUserPage(virtual: u64, physical: u64, writable: bool, executable: bool) void {
|
||||
|
|
|
|||
|
|
@ -524,6 +524,58 @@ pub fn translateIn(pml4: u64, virtual: u64) ?u64 {
|
|||
return (pte & address_mask) | (virtual & (page_size - 1));
|
||||
}
|
||||
|
||||
/// `translateIn` with the ring-3 permission bits enforced: the walk accumulates
|
||||
/// the protection flags of every level it descends through and refuses the
|
||||
/// translation unless the *effective* permission allows the access ring 3 would
|
||||
/// be allowed — U/S set at every level, and (for `for_write`) R/W set at every
|
||||
/// level too. A bit cleared anywhere on the path denies, which is exactly how
|
||||
/// the MMU combines them, so a checked kernel copy sees the same permissions the
|
||||
/// process itself does.
|
||||
///
|
||||
/// This is the walk `system/kernel/user-memory.zig` copies through, and the
|
||||
/// reason a kernel copy can never be steered at a kernel-only mapping or made to
|
||||
/// write a read-only user page (a process's own text, say).
|
||||
///
|
||||
/// Huge pages: a 2 MiB PDE leaf resolves like `translateIn`, with its own U/S and
|
||||
/// R/W folded into the accumulator first. A PDPTE with PS set (a 1 GiB leaf) is
|
||||
/// refused rather than descended into — danos never builds one, and denying is
|
||||
/// the safe direction for a permission-checked walk.
|
||||
pub fn translateUserIn(pml4: u64, virtual: u64, for_write: bool) ?u64 {
|
||||
// Start all-ones and AND in each level: a cleared bit at any level denies.
|
||||
var effective: u64 = ~@as(u64, 0);
|
||||
|
||||
const pml4e = tableAt(pml4)[(virtual >> 39) & 0x1FF];
|
||||
if (pml4e & present == 0) return null;
|
||||
effective &= pml4e;
|
||||
|
||||
const pdpte = tableAt(pml4e & address_mask)[(virtual >> 30) & 0x1FF];
|
||||
if (pdpte & present == 0) return null;
|
||||
if (pdpte & page_size_bit != 0) return null; // 1 GiB leaf: never built here, refuse
|
||||
effective &= pdpte;
|
||||
|
||||
const pde = tableAt(pdpte & address_mask)[(virtual >> 21) & 0x1FF];
|
||||
if (pde & present == 0) return null;
|
||||
effective &= pde;
|
||||
if (pde & page_size_bit != 0) { // 2 MiB huge leaf: frame base is bits 51:21
|
||||
if (!permits(effective, for_write)) return null;
|
||||
return (pde & address_mask & ~@as(u64, huge_page_size - 1)) | (virtual & (huge_page_size - 1));
|
||||
}
|
||||
|
||||
const pte = tableAt(pde & address_mask)[(virtual >> 12) & 0x1FF];
|
||||
if (pte & present == 0) return null;
|
||||
effective &= pte;
|
||||
if (!permits(effective, for_write)) return null;
|
||||
return (pte & address_mask) | (virtual & (page_size - 1));
|
||||
}
|
||||
|
||||
/// Whether accumulated walk flags allow a ring-3 access: user-accessible always,
|
||||
/// and writable when the access is a store.
|
||||
fn permits(effective: u64, for_write: bool) bool {
|
||||
if (effective & user == 0) return false;
|
||||
if (for_write and effective & writable == 0) return false;
|
||||
return true;
|
||||
}
|
||||
|
||||
fn invalidate(virtual: u64) void {
|
||||
// invlpg needs its operand via a register-indirect memory reference that Zig
|
||||
// inline asm won't form directly, so stage the address in a register first.
|
||||
|
|
|
|||
|
|
@ -132,13 +132,31 @@ fn record(node: *platform.Device, parent_id: u64) u64 {
|
|||
}
|
||||
|
||||
/// Copy up to `out.len` device descriptors into `out`; returns the total count
|
||||
/// available (which may exceed `out.len`).
|
||||
/// available (which may exceed `out.len`). For kernel callers with a buffer big
|
||||
/// enough to take the whole table in one go.
|
||||
pub fn enumerate(out: []device_abi.DeviceDescriptor) usize {
|
||||
const n = @min(count, out.len);
|
||||
@memcpy(out[0..n], devices[0..n]);
|
||||
_ = enumerateFrom(0, out);
|
||||
return count;
|
||||
}
|
||||
|
||||
/// How many devices the table holds — the total `device_enumerate` reports back
|
||||
/// however few of them fit in the caller's buffer.
|
||||
pub fn deviceCount() usize {
|
||||
return count;
|
||||
}
|
||||
|
||||
/// Copy up to `out.len` descriptors starting at table index `start`, returning how
|
||||
/// many were filled (0 once `start` reaches the end). The chunked form: the
|
||||
/// `device_enumerate` system call bounces the table out through a small kernel
|
||||
/// buffer, one chunk at a time, because a descriptor is far too big to stage a
|
||||
/// whole user-requested array of them on a 16 KiB kernel stack.
|
||||
pub fn enumerateFrom(start: usize, out: []device_abi.DeviceDescriptor) usize {
|
||||
if (start >= count) return 0;
|
||||
const n = @min(count - start, out.len);
|
||||
@memcpy(out[0..n], devices[start..][0..n]);
|
||||
return n;
|
||||
}
|
||||
|
||||
/// Take exclusive ownership of device `id` for task `owner`. Fails if the id is
|
||||
/// out of range or already claimed.
|
||||
pub fn claim(id: u64, owner: u32) bool {
|
||||
|
|
|
|||
|
|
@ -17,18 +17,20 @@
|
|||
//! endpoint's own FIFO (threaded through the otherwise-idle `Task.next`); servers
|
||||
//! waiting for work use a normal WaitQueue.
|
||||
//!
|
||||
//! Trust model (bring-up): copies honour only page presence and a user-half bound,
|
||||
//! not the leaf U/S or R/W bits and not SMAP — a #PF-tolerant, permission-checked
|
||||
//! copy is a later security-track item, matching the existing debug_write gap.
|
||||
//! Trust model: every side of a copy that names a *user* address space goes
|
||||
//! through system/kernel/user-memory.zig — user-half bound, page presence, and
|
||||
//! the leaf permissions ring 3 itself would face (U/S to read, U/S + R/W to
|
||||
//! write). A kernel-side buffer is trusted and translated as-is. An unmapped or
|
||||
//! wrongly-permissioned page fails the operation; it never faults ring 0.
|
||||
|
||||
const std = @import("std");
|
||||
const boot_handoff = @import("boot-handoff");
|
||||
const abi = @import("abi");
|
||||
const architecture = @import("architecture");
|
||||
const scheduler = @import("scheduler.zig");
|
||||
const sync = @import("sync.zig");
|
||||
const heap = @import("heap.zig");
|
||||
const pmm = @import("pmm.zig");
|
||||
const user_memory = @import("user-memory.zig");
|
||||
|
||||
const page_size = abi.page_size;
|
||||
const Task = scheduler.Task;
|
||||
|
|
@ -83,8 +85,9 @@ const PostSlot = struct {
|
|||
bytes: [POST_MAXIMUM]u8 = undefined,
|
||||
};
|
||||
|
||||
/// End of the user (low) canonical half — user buffers must lie below it.
|
||||
const user_half_end: u64 = 0x0000_8000_0000_0000;
|
||||
/// End of the user (low) canonical half — user buffers must lie below it. One
|
||||
/// definition, in the module that owns the user-memory contract.
|
||||
const user_half_end: u64 = user_memory.user_half_end;
|
||||
|
||||
/// A rendezvous endpoint. Allocated from the kernel heap; referenced by handle
|
||||
/// (per process) and/or by a registry slot, counted by `refcount`.
|
||||
|
|
@ -300,18 +303,22 @@ pub fn abandonSenderLocked(t: *Task) void {
|
|||
/// Copy `len` bytes from `source_va` in address space `source_as` to `destination_va` in
|
||||
/// `destination_as`, walking each side's page tables through the physmap (no CR3 switch).
|
||||
/// `*_as == 0` means the kernel address space (for kernel-task endpoints). User
|
||||
/// buffers must lie in the low half. Returns false — never #PFs — if any page is
|
||||
/// unmapped or out of range. Handles page-straddling buffers.
|
||||
/// buffers must lie in the low half and carry the permission ring 3 would need for
|
||||
/// their side of the copy — readable to send from, writable to receive into.
|
||||
/// Returns false — never #PFs — if any page is unmapped, out of range, or
|
||||
/// wrongly permissioned. Handles page-straddling buffers.
|
||||
///
|
||||
/// This is the process↔process case, which `user-memory` deliberately does not
|
||||
/// cover (it knows one user address space at a time); both sides resolve through
|
||||
/// `user_memory.resolve`, so the permission rules are the same ones.
|
||||
fn copyAcross(source_as: u64, source_va: u64, destination_as: u64, destination_va: u64, len: usize) bool {
|
||||
const source_root = if (source_as != 0) source_as else architecture.kernelPageTable();
|
||||
const destination_root = if (destination_as != 0) destination_as else architecture.kernelPageTable();
|
||||
if (source_as != 0 and (source_va >= user_half_end or source_va + len > user_half_end)) return false;
|
||||
if (destination_as != 0 and (destination_va >= user_half_end or destination_va + len > user_half_end)) return false;
|
||||
if (source_as != 0 and !user_memory.userRangeOk(source_va, len)) return false;
|
||||
if (destination_as != 0 and !user_memory.userRangeOk(destination_va, len)) return false;
|
||||
|
||||
var off: usize = 0;
|
||||
while (off < len) {
|
||||
const s = architecture.translate(source_root, source_va + off) orelse return false;
|
||||
const d = architecture.translate(destination_root, destination_va + off) orelse return false;
|
||||
const s = user_memory.resolve(source_as, source_va + off, false) orelse return false;
|
||||
const d = user_memory.resolve(destination_as, destination_va + off, true) orelse return false;
|
||||
const s_left = page_size - ((source_va + off) & (page_size - 1));
|
||||
const d_left = page_size - ((destination_va + off) & (page_size - 1));
|
||||
const n = @min(@min(s_left, d_left), len - off);
|
||||
|
|
@ -323,27 +330,10 @@ fn copyAcross(source_as: u64, source_va: u64, destination_as: u64, destination_v
|
|||
return true;
|
||||
}
|
||||
|
||||
/// Copy `destination.len` bytes from `user_va` in address space `user_as` into the kernel
|
||||
/// buffer `destination`, walking the user page tables through the physmap. Returns false if
|
||||
/// the range escapes the user half or any source page is unmapped — so a bad user
|
||||
/// pointer *fails the system_call* rather than faulting the kernel (danos has no
|
||||
/// fault-recovering copy-in, so a raw dereference of an unmapped user page would halt
|
||||
/// the machine). The correct way to pull a fixed-size struct in from user space, and
|
||||
/// a single fetch: no TOCTOU against a hostile pointer.
|
||||
pub fn copyFromUser(user_as: u64, user_va: u64, destination: []u8) bool {
|
||||
if (user_as == 0) return false; // not a user address space
|
||||
if (user_va >= user_half_end or user_va + destination.len > user_half_end) return false;
|
||||
var off: usize = 0;
|
||||
while (off < destination.len) {
|
||||
const s = architecture.translate(user_as, user_va + off) orelse return false;
|
||||
const s_left = page_size - ((user_va + off) & (page_size - 1));
|
||||
const n = @min(s_left, destination.len - off);
|
||||
const source: [*]const u8 = @ptrFromInt(boot_handoff.physicalToVirtual(s));
|
||||
@memcpy(destination[off..][0..n], source[0..n]);
|
||||
off += n;
|
||||
}
|
||||
return true;
|
||||
}
|
||||
/// The checked copy-in, re-exported from its home in `user-memory` so the many
|
||||
/// `ipc.copyFromUser` call sites keep reading naturally. New code should reach
|
||||
/// for `user-memory` directly — it is where the write direction lives too.
|
||||
pub const copyFromUser = user_memory.copyFromUser;
|
||||
|
||||
// --- the two IPC operations -------------------------------------------------
|
||||
|
||||
|
|
|
|||
|
|
@ -31,6 +31,7 @@ const scheduler = @import("scheduler.zig");
|
|||
const console = @import("console.zig");
|
||||
const sync = @import("sync.zig");
|
||||
const ipc = @import("ipc-synchronous.zig");
|
||||
const user_memory = @import("user-memory.zig");
|
||||
const devices_broker = @import("devices-broker.zig");
|
||||
const irq = @import("irq.zig");
|
||||
const iommu = @import("iommu.zig");
|
||||
|
|
@ -110,6 +111,14 @@ pub const maximum_arguments = 8;
|
|||
/// Ceiling on the `system_spawn` extra-arguments blob (argv[1..], NUL-separated).
|
||||
pub const maximum_argument_bytes = 256;
|
||||
|
||||
/// Longest path `fs_resolve` accepts, longest prefix `fs_mount`/`fs_unmount`
|
||||
/// accept, and longest backend rewrite prefix. Each is also the size of the
|
||||
/// kernel staging buffer the argument is copied into, which is why they are
|
||||
/// named here rather than spelled as literals at the check.
|
||||
pub const maximum_resolve_path = 224;
|
||||
pub const maximum_mount_prefix = 64;
|
||||
pub const maximum_mount_rewrite = 32;
|
||||
|
||||
/// Auxiliary-vector entry types (System V AMD64 process entry). Only what the
|
||||
/// kernel emits today; a C runtime scans the vector until the null terminator.
|
||||
const auxiliary_vector_null: u64 = 0; // AT_NULL — end of the vector
|
||||
|
|
@ -378,6 +387,12 @@ fn systemIpcSend(state: *architecture.CpuState) void {
|
|||
|
||||
/// device_enumerate(buffer, maximum) -> total: snapshot the device table into the caller's
|
||||
/// buffer (up to `maximum` entries), returning the total device count.
|
||||
///
|
||||
/// The broker fills a small kernel chunk which `copyToUser` then places in the
|
||||
/// caller's buffer: the kernel never stores through a user pointer, so a bad one
|
||||
/// is -EFAULT instead of a ring-0 page fault. A DeviceDescriptor is a few hundred
|
||||
/// bytes, so the chunk is deliberately tiny — the 16 KiB kernel stack could not
|
||||
/// hold a whole user-requested array of them.
|
||||
fn systemDeviceEnumerate(state: *architecture.CpuState) void {
|
||||
const buffer_ptr = architecture.systemCallArg(state, 0);
|
||||
const maximum = architecture.systemCallArg(state, 1);
|
||||
|
|
@ -385,8 +400,20 @@ fn systemDeviceEnumerate(state: *architecture.CpuState) void {
|
|||
if (t.address_space == 0 or buffer_ptr >= user_half_end) return fail(state);
|
||||
const sz = @sizeOf(device_abi.DeviceDescriptor);
|
||||
const cap = @min(maximum, (user_half_end - buffer_ptr) / sz); // clamp to the user half
|
||||
const out: [*]device_abi.DeviceDescriptor = @ptrFromInt(buffer_ptr);
|
||||
architecture.setSystemCallResult(state, devices_broker.enumerate(out[0..@intCast(cap)]));
|
||||
|
||||
var chunk: [2]device_abi.DeviceDescriptor = undefined;
|
||||
var copied: u64 = 0;
|
||||
var start: usize = 0;
|
||||
while (copied < cap) {
|
||||
const filled = devices_broker.enumerateFrom(start, &chunk);
|
||||
if (filled == 0) break;
|
||||
start += filled;
|
||||
const take = @min(@as(u64, filled), cap - copied);
|
||||
const bytes = std.mem.sliceAsBytes(chunk[0..@intCast(take)]);
|
||||
if (!user_memory.copyToUser(t.address_space, buffer_ptr + copied * sz, bytes)) return failErr(state, ipc.EFAULT);
|
||||
copied += take;
|
||||
}
|
||||
architecture.setSystemCallResult(state, devices_broker.deviceCount());
|
||||
}
|
||||
|
||||
/// device_claim(id) -> 0/-1: take exclusive ownership of a device for this process.
|
||||
|
|
@ -969,7 +996,17 @@ fn systemSpawn(state: *architecture.CpuState) void {
|
|||
const image = ramdisk_image orelse return fail(state);
|
||||
const rd = initial_ramdisk.Reader.init(image) orelse return fail(state);
|
||||
|
||||
const name = @as([*]const u8, @ptrFromInt(ptr))[0..len];
|
||||
// Both buffers come in through the checked copy layer, once. The lengths are
|
||||
// already bounded above, so the staging arrays are small and fixed — and
|
||||
// because the bytes are now the kernel's own, nothing below can be changed
|
||||
// by another thread of the caller between validation and use.
|
||||
var name_storage: [scheduler.maximum_task_name]u8 = undefined;
|
||||
const name = name_storage[0..@intCast(len)];
|
||||
if (!user_memory.copyFromUser(t.address_space, ptr, name)) return failErr(state, ipc.EFAULT);
|
||||
var argument_storage: [maximum_argument_bytes]u8 = undefined;
|
||||
const arguments = argument_storage[0..@intCast(arguments_len)];
|
||||
if (arguments_len != 0 and !user_memory.copyFromUser(t.address_space, arguments_ptr, arguments)) return failErr(state, ipc.EFAULT);
|
||||
|
||||
// Exact path first, basename fallback second; either way argv[0] (and hence
|
||||
// the task name, and the log ring's attribution) is the stored full path.
|
||||
const item = rd.find(name) orelse return fail(state); // no bundled binary by that name
|
||||
|
|
@ -977,8 +1014,7 @@ fn systemSpawn(state: *architecture.CpuState) void {
|
|||
argv[0] = item.name;
|
||||
var argc: usize = 1;
|
||||
if (arguments_len != 0) {
|
||||
const blob = @as([*]const u8, @ptrFromInt(arguments_ptr))[0..arguments_len];
|
||||
var pieces = std.mem.tokenizeScalar(u8, blob, 0);
|
||||
var pieces = std.mem.tokenizeScalar(u8, arguments, 0);
|
||||
while (pieces.next()) |piece| {
|
||||
if (argc == maximum_arguments) return fail(state);
|
||||
argv[argc] = piece;
|
||||
|
|
@ -1129,8 +1165,27 @@ fn systemProcessEnumerate(state: *architecture.CpuState) void {
|
|||
if (t.address_space == 0 or buffer_ptr >= user_half_end) return fail(state);
|
||||
const sz = @sizeOf(abi.ProcessDescriptor);
|
||||
const cap = @min(maximum, (user_half_end - buffer_ptr) / sz); // clamp to the user half
|
||||
const out: [*]abi.ProcessDescriptor = @ptrFromInt(buffer_ptr);
|
||||
architecture.setSystemCallResult(state, scheduler.enumerate(out[0..@intCast(cap)]));
|
||||
|
||||
// The scheduler describes a chunk of the table into kernel memory, then
|
||||
// `copyToUser` places it — the kernel never stores through the user pointer.
|
||||
// Once the caller's buffer is full the walk continues with an empty chunk,
|
||||
// because the result is the true live count, not what fitted.
|
||||
var chunk: [8]abi.ProcessDescriptor = undefined;
|
||||
var copied: u64 = 0;
|
||||
var total: u64 = 0;
|
||||
var cursor: usize = 0;
|
||||
while (true) {
|
||||
const room: []abi.ProcessDescriptor = if (copied < cap) chunk[0..@intCast(@min(chunk.len, cap - copied))] else chunk[0..0];
|
||||
const found = scheduler.enumerateFrom(&cursor, room);
|
||||
total += found.live;
|
||||
if (found.filled != 0) {
|
||||
const bytes = std.mem.sliceAsBytes(chunk[0..found.filled]);
|
||||
if (!user_memory.copyToUser(t.address_space, buffer_ptr + copied * sz, bytes)) return failErr(state, ipc.EFAULT);
|
||||
copied += found.filled;
|
||||
}
|
||||
if (found.done) break;
|
||||
}
|
||||
architecture.setSystemCallResult(state, total);
|
||||
}
|
||||
|
||||
/// process_kill(id) -> 0 / -ESRCH / -EPERM: end the process `id`. Only its
|
||||
|
|
@ -1682,9 +1737,10 @@ fn systemIrqAck(state: *architecture.CpuState) void {
|
|||
/// The pointer must lie in the user (low) half, so kernel addresses and
|
||||
/// non-canonical values fall outside it and the read below can't be steered at
|
||||
/// kernel data. Length is checked first so the upper-bound add can't overflow.
|
||||
/// Known gap (fine for trusted user code): a pointer into an *unmapped* hole in
|
||||
/// the user half passes the check and the read #PFs -> on_fault halts — a
|
||||
/// self-DoS, not an isolation break. Fault-recovering copy-in is a later item.
|
||||
/// The message then comes in ONCE through the checked copy layer: an unmapped
|
||||
/// hole in the user half is -EFAULT rather than a kernel fault, and the bytes the
|
||||
/// log stamps are the same bytes that were validated (the old code read the user
|
||||
/// buffer twice — once to stage it, once again inside `log.append`).
|
||||
///
|
||||
/// The emit runs under the kernel lock, so a message is atomic on the wire — two
|
||||
/// processes writing from different cores can interleave *messages*, never bytes.
|
||||
|
|
@ -1697,7 +1753,6 @@ fn systemDebugWrite(state: *architecture.CpuState) void {
|
|||
const len = architecture.systemCallArg(state, 1);
|
||||
const level_raw = architecture.systemCallArg(state, 2);
|
||||
if (len <= write_buffer.len and ptr < user_half_end and ptr + len <= user_half_end) {
|
||||
const source: [*]const u8 = @ptrFromInt(ptr);
|
||||
// Levels above the enum range clamp to raw — old two-arg callers land
|
||||
// there naturally (garbage in arg 2 stays harmless).
|
||||
const level: abi.KlogLevel = if (level_raw <= @intFromEnum(abi.KlogLevel.raw))
|
||||
|
|
@ -1707,14 +1762,16 @@ fn systemDebugWrite(state: *architecture.CpuState) void {
|
|||
const t = scheduler.current();
|
||||
const flags = sync.enter();
|
||||
defer sync.leave(flags);
|
||||
@memcpy(write_buffer[0..len], source[0..len]); // keep the latest message
|
||||
// One copy in, under the lock; `write_buffer` (the latest message, which
|
||||
// the kernel tests assert on) doubles as the staging buffer the log reads.
|
||||
if (!user_memory.copyFromUser(t.address_space, ptr, write_buffer[0..len])) return failErr(state, ipc.EFAULT);
|
||||
write_len = len;
|
||||
write_from_user = architecture.fromUser(state);
|
||||
write_count += 1;
|
||||
// The kernel stamps the sender's identity — attribution is structural,
|
||||
// not a prefix convention the payload could forge (and it is stamped
|
||||
// per line inside log.append).
|
||||
log.append(t.id, t.name(), level, source[0..len]);
|
||||
log.append(t.id, t.name(), level, write_buffer[0..len]);
|
||||
architecture.setSystemCallResult(state, len);
|
||||
} else {
|
||||
fail(state);
|
||||
|
|
@ -1729,18 +1786,35 @@ fn systemDebugWrite(state: *architecture.CpuState) void {
|
|||
/// [KlogRecordHeader][name][message] frames out of the byte stream (abi.zig).
|
||||
///
|
||||
/// The mirror of `debug_write`: the same overflow-safe user-half bounds check,
|
||||
/// but the copy runs kernel -> user, under the log lock (inside log.readAt) so
|
||||
/// the stream can't move underneath the copy. A read-only diagnostic.
|
||||
/// but the copy runs kernel -> user. The ring is drained a chunk at a time into a
|
||||
/// kernel staging buffer (each chunk read under the log lock, so the stream can't
|
||||
/// move underneath it) and each chunk is then placed with `copyToUser` — a
|
||||
/// reader may ask for a megabyte, and the kernel stack is 16 KiB. A partial
|
||||
/// result is honest: the reader advances its cursor by what it got. A read-only
|
||||
/// diagnostic.
|
||||
fn systemKlogRead(state: *architecture.CpuState) void {
|
||||
const offset = architecture.systemCallArg(state, 0);
|
||||
const ptr = architecture.systemCallArg(state, 1);
|
||||
const len = architecture.systemCallArg(state, 2);
|
||||
const t = scheduler.current();
|
||||
// Confine the whole destination span to the user (low) half. `len <=
|
||||
// user_half_end - ptr` bounds the length without an overflowing add.
|
||||
if (ptr < user_half_end and len <= user_half_end - ptr) {
|
||||
const dest: [*]u8 = @ptrFromInt(ptr);
|
||||
const n = log.readAt(offset, dest[0..len]) orelse return fail(state);
|
||||
architecture.setSystemCallResult(state, n);
|
||||
var chunk: [512]u8 = undefined;
|
||||
var done: u64 = 0;
|
||||
while (done < len) {
|
||||
const want = @min(@as(u64, chunk.len), len - done);
|
||||
const n = log.readAt(offset + done, chunk[0..@intCast(want)]) orelse {
|
||||
// The cursor fell behind the ring's tail mid-drain. What was
|
||||
// already placed stands; only a first-chunk miss fails the call.
|
||||
if (done == 0) return fail(state);
|
||||
break;
|
||||
};
|
||||
if (n == 0) break; // caught up
|
||||
if (!user_memory.copyToUser(t.address_space, ptr + done, chunk[0..n])) return failErr(state, ipc.EFAULT);
|
||||
done += n;
|
||||
}
|
||||
architecture.setSystemCallResult(state, done);
|
||||
} else {
|
||||
fail(state);
|
||||
}
|
||||
|
|
@ -1753,10 +1827,10 @@ fn systemKlogRead(state: *architecture.CpuState) void {
|
|||
fn systemKlogStatus(state: *architecture.CpuState) void {
|
||||
const ptr = architecture.systemCallArg(state, 0);
|
||||
const size = @sizeOf(abi.KlogStatus);
|
||||
const t = scheduler.current();
|
||||
if (ptr < user_half_end and size <= user_half_end - ptr) {
|
||||
var status = log.status();
|
||||
const dest: [*]u8 = @ptrFromInt(ptr);
|
||||
@memcpy(dest[0..size], std.mem.asBytes(&status)[0..size]);
|
||||
if (!user_memory.copyValueToUser(t.address_space, ptr, &status)) return failErr(state, ipc.EFAULT);
|
||||
architecture.setSystemCallResult(state, 0);
|
||||
} else {
|
||||
fail(state);
|
||||
|
|
@ -1775,10 +1849,12 @@ fn systemFsResolve(state: *architecture.CpuState) void {
|
|||
const flags = architecture.systemCallArg(state, 2);
|
||||
const out_ptr = architecture.systemCallArg(state, 3);
|
||||
const out_cap = architecture.systemCallArg(state, 4);
|
||||
if (path_len == 0 or path_len > 224 or path_ptr >= user_half_end or path_ptr + path_len > user_half_end) return fail(state);
|
||||
if (out_cap != 0 and (out_ptr >= user_half_end or out_ptr + out_cap > user_half_end)) return fail(state);
|
||||
const path = @as([*]const u8, @ptrFromInt(path_ptr))[0..path_len];
|
||||
if (path_len == 0 or path_len > maximum_resolve_path or path_ptr >= user_half_end or path_ptr + path_len > user_half_end) return fail(state);
|
||||
if (out_cap != 0 and !user_memory.userRangeOk(out_ptr, @intCast(out_cap))) return fail(state);
|
||||
const t = scheduler.current();
|
||||
var path_storage: [maximum_resolve_path]u8 = undefined;
|
||||
const path = path_storage[0..@intCast(path_len)];
|
||||
if (!user_memory.copyFromUser(t.address_space, path_ptr, path)) return failErr(state, ipc.EFAULT);
|
||||
|
||||
const flags_lock = sync.enter();
|
||||
defer sync.leave(flags_lock);
|
||||
|
|
@ -1790,14 +1866,15 @@ fn systemFsResolve(state: *architecture.CpuState) void {
|
|||
.backend => |*backend| {
|
||||
// The rewritten path goes back in the out buffer behind a u16
|
||||
// length prefix (a third result register would collide with r8's
|
||||
// argument role in the userspace stub).
|
||||
// argument role in the userspace stub). Both halves are placed with
|
||||
// the checked copy, and *before* the handle is installed, so an
|
||||
// -EFAULT never strands a capability in the caller's table.
|
||||
if (backend.path_len + 2 > out_cap) return fail(state);
|
||||
const prefix = [2]u8{ @intCast(backend.path_len & 0xFF), @intCast(backend.path_len >> 8) };
|
||||
if (!user_memory.copyToUser(t.address_space, out_ptr, &prefix)) return failErr(state, ipc.EFAULT);
|
||||
if (!user_memory.copyToUser(t.address_space, out_ptr + 2, backend.path[0..backend.path_len])) return failErr(state, ipc.EFAULT);
|
||||
const handle = ipc.installHandleDeduped(t, backend.endpoint);
|
||||
if (handle < 0) return fail(state);
|
||||
const destination: [*]u8 = @ptrFromInt(out_ptr);
|
||||
destination[0] = @intCast(backend.path_len & 0xFF);
|
||||
destination[1] = @intCast(backend.path_len >> 8);
|
||||
@memcpy(destination[2..][0..backend.path_len], backend.path[0..backend.path_len]);
|
||||
architecture.setSystemCallResult(state, abi.fs_route_backend);
|
||||
architecture.setSystemCallResult2(state, @intCast(handle));
|
||||
},
|
||||
|
|
@ -1809,6 +1886,12 @@ fn systemFsResolve(state: *architecture.CpuState) void {
|
|||
/// kernel-backed node. read copies file bytes; status copies a FileAttributes;
|
||||
/// readdir copies [DirectoryEntryHeader][name] for the `offset`th child. Reads
|
||||
/// of the immutable initrd never take the kernel lock.
|
||||
///
|
||||
/// Every result reaches the caller through `copyToUser`, never a store through
|
||||
/// the user pointer. `read` stages the file bytes a chunk at a time — a caller
|
||||
/// may ask for the 64 KiB ceiling, which no kernel stack could hold — so a
|
||||
/// mid-way -EFAULT is possible; the call fails and the already-placed prefix is
|
||||
/// meaningless, exactly as a failed read should be.
|
||||
fn systemFsNode(state: *architecture.CpuState) void {
|
||||
const operation = architecture.systemCallArg(state, 0);
|
||||
const node_token = architecture.systemCallArg(state, 1);
|
||||
|
|
@ -1817,16 +1900,24 @@ fn systemFsNode(state: *architecture.CpuState) void {
|
|||
const buf_len = architecture.systemCallArg(state, 4);
|
||||
if (buf_ptr >= user_half_end or buf_len > user_half_end - buf_ptr) return fail(state);
|
||||
const capped = @min(buf_len, 64 * 1024); // bound any single copy
|
||||
const destination: [*]u8 = @ptrFromInt(buf_ptr);
|
||||
const t = scheduler.current();
|
||||
switch (operation) {
|
||||
abi.fs_node_read => {
|
||||
const n = vfs.nodeRead(node_token, offset, destination[0..capped]) orelse return fail(state);
|
||||
architecture.setSystemCallResult(state, n);
|
||||
var chunk: [512]u8 = undefined;
|
||||
var done: u64 = 0;
|
||||
while (done < capped) {
|
||||
const want = @min(@as(u64, chunk.len), capped - done);
|
||||
const n = vfs.nodeRead(node_token, offset + done, chunk[0..@intCast(want)]) orelse return fail(state);
|
||||
if (n == 0) break; // end of file
|
||||
if (!user_memory.copyToUser(t.address_space, buf_ptr + done, chunk[0..n])) return failErr(state, ipc.EFAULT);
|
||||
done += n;
|
||||
}
|
||||
architecture.setSystemCallResult(state, done);
|
||||
},
|
||||
abi.fs_node_status => {
|
||||
var attributes = vfs.nodeStatus(node_token) orelse return fail(state);
|
||||
if (capped < @sizeOf(abi.FileAttributes)) return fail(state);
|
||||
@memcpy(destination[0..@sizeOf(abi.FileAttributes)], std.mem.asBytes(&attributes));
|
||||
if (!user_memory.copyValueToUser(t.address_space, buf_ptr, &attributes)) return failErr(state, ipc.EFAULT);
|
||||
architecture.setSystemCallResult(state, @sizeOf(abi.FileAttributes));
|
||||
},
|
||||
abi.fs_node_readdir => {
|
||||
|
|
@ -1837,10 +1928,13 @@ fn systemFsNode(state: *architecture.CpuState) void {
|
|||
architecture.setSystemCallResult(state, 0); // past the end
|
||||
return;
|
||||
};
|
||||
var header = result.header;
|
||||
// Header and name are staged contiguously so one entry is one copy.
|
||||
var entry: [@sizeOf(abi.DirectoryEntryHeader) + name_buffer.len]u8 = undefined;
|
||||
const header = result.header;
|
||||
const total = header_size + @min(result.name_len, capped - header_size);
|
||||
@memcpy(destination[0..header_size], std.mem.asBytes(&header));
|
||||
@memcpy(destination[header_size..total], name_buffer[0 .. total - header_size]);
|
||||
@memcpy(entry[0..header_size], std.mem.asBytes(&header));
|
||||
@memcpy(entry[header_size..total], name_buffer[0 .. total - header_size]);
|
||||
if (!user_memory.copyToUser(t.address_space, buf_ptr, entry[0..total])) return failErr(state, ipc.EFAULT);
|
||||
architecture.setSystemCallResult(state, total);
|
||||
},
|
||||
else => fail(state),
|
||||
|
|
@ -1857,12 +1951,19 @@ fn systemFsMount(state: *architecture.CpuState) void {
|
|||
const backend_handle = architecture.systemCallArg(state, 2);
|
||||
const rewrite_ptr = architecture.systemCallArg(state, 3);
|
||||
const rewrite_len = architecture.systemCallArg(state, 4);
|
||||
if (prefix_len == 0 or prefix_len > 64 or prefix_ptr >= user_half_end or prefix_ptr + prefix_len > user_half_end) return fail(state);
|
||||
if (rewrite_len > 32) return fail(state);
|
||||
if (prefix_len == 0 or prefix_len > maximum_mount_prefix or prefix_ptr >= user_half_end or prefix_ptr + prefix_len > user_half_end) return fail(state);
|
||||
if (rewrite_len > maximum_mount_rewrite) return fail(state);
|
||||
if (rewrite_len != 0 and (rewrite_ptr >= user_half_end or rewrite_ptr + rewrite_len > user_half_end)) return fail(state);
|
||||
const t = scheduler.current();
|
||||
const prefix = @as([*]const u8, @ptrFromInt(prefix_ptr))[0..prefix_len];
|
||||
const rewrite = if (rewrite_len == 0) "" else @as([*]const u8, @ptrFromInt(rewrite_ptr))[0..rewrite_len];
|
||||
// Both strings come in through the checked copy; `mountBackend` copies them
|
||||
// again into the mount table, so these staging buffers only need to outlive
|
||||
// this call.
|
||||
var prefix_storage: [maximum_mount_prefix]u8 = undefined;
|
||||
const prefix = prefix_storage[0..@intCast(prefix_len)];
|
||||
if (!user_memory.copyFromUser(t.address_space, prefix_ptr, prefix)) return failErr(state, ipc.EFAULT);
|
||||
var rewrite_storage: [maximum_mount_rewrite]u8 = undefined;
|
||||
const rewrite = rewrite_storage[0..@intCast(rewrite_len)];
|
||||
if (rewrite_len != 0 and !user_memory.copyFromUser(t.address_space, rewrite_ptr, rewrite)) return failErr(state, ipc.EFAULT);
|
||||
|
||||
const flags = sync.enter();
|
||||
defer sync.leave(flags);
|
||||
|
|
@ -1879,8 +1980,11 @@ fn systemFsMount(state: *architecture.CpuState) void {
|
|||
fn systemFsUnmount(state: *architecture.CpuState) void {
|
||||
const prefix_ptr = architecture.systemCallArg(state, 0);
|
||||
const prefix_len = architecture.systemCallArg(state, 1);
|
||||
if (prefix_len == 0 or prefix_len > 64 or prefix_ptr >= user_half_end or prefix_ptr + prefix_len > user_half_end) return fail(state);
|
||||
const prefix = @as([*]const u8, @ptrFromInt(prefix_ptr))[0..prefix_len];
|
||||
if (prefix_len == 0 or prefix_len > maximum_mount_prefix or prefix_ptr >= user_half_end or prefix_ptr + prefix_len > user_half_end) return fail(state);
|
||||
const t = scheduler.current();
|
||||
var prefix_storage: [maximum_mount_prefix]u8 = undefined;
|
||||
const prefix = prefix_storage[0..@intCast(prefix_len)];
|
||||
if (!user_memory.copyFromUser(t.address_space, prefix_ptr, prefix)) return failErr(state, ipc.EFAULT);
|
||||
const flags = sync.enter();
|
||||
defer sync.leave(flags);
|
||||
if (!vfs.unmount(prefix)) return fail(state);
|
||||
|
|
|
|||
|
|
@ -1203,35 +1203,72 @@ pub fn destroyTaskLocked(t: *Task) void {
|
|||
/// Snapshot the task table into `out` (up to its length), returning the total
|
||||
/// number of live tasks — the kernel half of `process_enumerate`, mirroring
|
||||
/// devices_broker.enumerate. Kernel tasks are included (empty name, supervisor 0):
|
||||
/// an honest `ps` shows the idle tasks too. `out` may be user memory: the caller's
|
||||
/// address space is loaded during its system call, and the same bring-up trust
|
||||
/// applies as for device_enumerate (an unmapped user page faults the kernel).
|
||||
/// an honest `ps` shows the idle tasks too. `out` is always KERNEL memory: the
|
||||
/// system call bounces it out to the caller through the checked copy layer
|
||||
/// (system/kernel/user-memory.zig), so a bad user pointer fails the call instead
|
||||
/// of faulting ring 0.
|
||||
pub fn enumerate(out: []abi.ProcessDescriptor) u64 {
|
||||
var total: u64 = 0;
|
||||
var cursor: usize = 0;
|
||||
while (true) {
|
||||
// Past the buffer, keep walking with an empty chunk: the total is the
|
||||
// whole live count, however few descriptors the caller had room for.
|
||||
const room = if (total < out.len) out[@intCast(total)..] else out[out.len..];
|
||||
const chunk = enumerateFrom(&cursor, room);
|
||||
total += chunk.live;
|
||||
if (chunk.done) return total;
|
||||
}
|
||||
}
|
||||
|
||||
/// What one chunk of the task-table walk found.
|
||||
pub const TaskChunk = struct {
|
||||
/// Live tasks passed in this chunk, whether or not they fit in `out` — this
|
||||
/// is what the running total (and hence `process_enumerate`'s result) counts.
|
||||
live: usize,
|
||||
/// How many of those were written into `out` (`@min(live, out.len)`).
|
||||
filled: usize,
|
||||
/// The cursor reached the end of the table: this was the last chunk.
|
||||
done: bool,
|
||||
};
|
||||
|
||||
/// One chunk of the task table: starting at slot `cursor` (advanced past
|
||||
/// everything scanned), describe up to `out.len` live tasks into `out` — or, with
|
||||
/// an empty `out`, just count the rest. `cursor == tasks.len` ends the walk.
|
||||
///
|
||||
/// The chunked form exists so `process_enumerate` can stage each chunk in a small
|
||||
/// kernel buffer and copy it out with `user_memory.copyToUser`, rather than
|
||||
/// handing a user pointer to the kernel's own stores. A *slot* cursor, rather
|
||||
/// than a "skip the first N live tasks" count, keeps chunks from duplicating or
|
||||
/// losing an entry when a task exits between them.
|
||||
pub fn enumerateFrom(cursor: *usize, out: []abi.ProcessDescriptor) TaskChunk {
|
||||
const flags = sync.enter();
|
||||
defer sync.leave(flags);
|
||||
var total: u64 = 0;
|
||||
for (&tasks) |*t| {
|
||||
var live: usize = 0;
|
||||
var filled: usize = 0;
|
||||
const limit = if (out.len == 0) tasks.len else out.len; // always makes progress
|
||||
while (cursor.* < tasks.len and live < limit) {
|
||||
const t = &tasks[cursor.*];
|
||||
cursor.* += 1;
|
||||
if (t.state == .free or t.state == .reaping) continue; // reaping = already exited
|
||||
if (total < out.len) {
|
||||
const d = &out[total];
|
||||
d.* = .{
|
||||
.id = t.id,
|
||||
.supervisor = t.supervisor,
|
||||
.leader = t.leader,
|
||||
.state = @intFromEnum(@as(abi.ProcessState, switch (t.state) {
|
||||
.ready => .ready,
|
||||
.running => .running,
|
||||
.blocked => .blocked,
|
||||
.free, .reaping => unreachable,
|
||||
})),
|
||||
.priority = t.priority,
|
||||
.name_length = t.name_length,
|
||||
.name = t.name_buffer,
|
||||
};
|
||||
}
|
||||
total += 1;
|
||||
live += 1;
|
||||
if (filled == out.len) continue;
|
||||
out[filled] = .{
|
||||
.id = t.id,
|
||||
.supervisor = t.supervisor,
|
||||
.leader = t.leader,
|
||||
.state = @intFromEnum(@as(abi.ProcessState, switch (t.state) {
|
||||
.ready => .ready,
|
||||
.running => .running,
|
||||
.blocked => .blocked,
|
||||
.free, .reaping => unreachable,
|
||||
})),
|
||||
.priority = t.priority,
|
||||
.name_length = t.name_length,
|
||||
.name = t.name_buffer,
|
||||
};
|
||||
filled += 1;
|
||||
}
|
||||
return total;
|
||||
return .{ .live = live, .filled = filled, .done = cursor.* >= tasks.len };
|
||||
}
|
||||
|
||||
/// Whether the running task is a user process (has its own address space).
|
||||
|
|
|
|||
|
|
@ -29,6 +29,7 @@ const process = @import("process.zig");
|
|||
const initial_ramdisk = @import("initial-ramdisk");
|
||||
const kernel_log = @import("log.zig");
|
||||
const kernel_vfs = @import("vfs.zig");
|
||||
const user_memory = @import("user-memory.zig");
|
||||
|
||||
/// Formatted test-marker write. Goes through the kernel log (not straight to
|
||||
/// serial): the log lock is what keeps marker lines from interleaving with
|
||||
|
|
@ -141,6 +142,8 @@ pub fn run(case: []const u8, boot_information: *const BootInformation) void {
|
|||
faultNull();
|
||||
} else if (eql(case, "usermem")) {
|
||||
userMemTest();
|
||||
} else if (eql(case, "user-memory")) {
|
||||
userMemoryTest(boot_information);
|
||||
} else if (eql(case, "user-pf")) {
|
||||
userPfTest();
|
||||
} else if (eql(case, "fault-recovery")) {
|
||||
|
|
@ -1023,6 +1026,103 @@ fn userMemTest() void {
|
|||
result();
|
||||
}
|
||||
|
||||
/// The checked copy layer (system/kernel/user-memory.zig), against a scratch
|
||||
/// address space built here rather than a live process — so the refusals can be
|
||||
/// provoked exactly: a kernel-half address, an unmapped user page, and a user
|
||||
/// page mapped read-only. Then the fixture proves the same refusals reach ring 3
|
||||
/// as -errno instead of a kernel fault.
|
||||
fn userMemoryTest(boot_information: *const BootInformation) void {
|
||||
log("DANOS-TEST-BEGIN: user-memory\n", .{});
|
||||
const base_free = pmm.stats().free_frames;
|
||||
|
||||
const address_space = architecture.createAddressSpace() orelse {
|
||||
check("created a scratch address space", false);
|
||||
result();
|
||||
return;
|
||||
};
|
||||
check("created a scratch address space", address_space != 0);
|
||||
|
||||
// Three consecutive pages: two writable, the third read-only — so a copy that
|
||||
// straddles into the third proves the write check applies per page, not just
|
||||
// to the first one the walk touches.
|
||||
const writable_pages = 2;
|
||||
const total_pages = 3;
|
||||
const arena = process.heap_arena_base;
|
||||
var frames: [total_pages]u64 = undefined;
|
||||
var mapped: usize = 0;
|
||||
while (mapped < total_pages) : (mapped += 1) {
|
||||
frames[mapped] = pmm.alloc() orelse break;
|
||||
architecture.mapUserPageInto(address_space, arena + mapped * abi.page_size, frames[mapped], mapped < writable_pages, false);
|
||||
}
|
||||
check("mapped two writable and one read-only user page", mapped == total_pages);
|
||||
if (mapped == total_pages) {
|
||||
const read_only = arena + writable_pages * abi.page_size;
|
||||
const unmapped = arena + total_pages * abi.page_size;
|
||||
const kernel_half: u64 = 0xFFFF_8000_0000_0000;
|
||||
|
||||
var out: [16]u8 = undefined;
|
||||
const pattern = [_]u8{ 0xC0, 0xDE, 0xF0, 0x0D, 0xBA, 0xAD, 0xF0, 0x0D };
|
||||
|
||||
// A round trip through the writable page: what copyToUser placed is what
|
||||
// copyFromUser brings back, and the frame really holds it.
|
||||
const wrote = user_memory.copyToUser(address_space, arena + 32, &pattern);
|
||||
const read_back = user_memory.copyFromUser(address_space, arena + 32, out[0..pattern.len]);
|
||||
const frame_view: [*]const u8 = @ptrFromInt(boot_handoff.physicalToVirtual(frames[0] + 32));
|
||||
check("copyToUser/copyFromUser round trip", wrote and read_back and
|
||||
eql(out[0..pattern.len], &pattern) and eql(frame_view[0..pattern.len], &pattern));
|
||||
|
||||
// Straddling the 4 KiB boundary between the two writable pages.
|
||||
const straddle = arena + abi.page_size - 4;
|
||||
check("a page-straddling round trip", user_memory.copyToUser(address_space, straddle, &pattern) and
|
||||
user_memory.copyFromUser(address_space, straddle, out[0..pattern.len]) and
|
||||
eql(out[0..pattern.len], &pattern));
|
||||
|
||||
// Kernel-half addresses are refused by the range check, before any walk.
|
||||
check("copyToUser refuses a kernel-half address", !user_memory.copyToUser(address_space, kernel_half, &pattern));
|
||||
check("copyFromUser refuses a kernel-half address", !user_memory.copyFromUser(address_space, kernel_half, out[0..pattern.len]));
|
||||
check("a range running off the end of the user half is refused", !user_memory.copyToUser(address_space, user_memory.user_half_end - 4, &pattern));
|
||||
|
||||
// An unmapped-but-in-range page: the latent kernel fault H1 exists to kill.
|
||||
check("copyToUser refuses an unmapped user page", !user_memory.copyToUser(address_space, unmapped, &pattern));
|
||||
check("copyFromUser refuses an unmapped user page", !user_memory.copyFromUser(address_space, unmapped, out[0..pattern.len]));
|
||||
|
||||
// The leaf permission bits: a read-only user page may be read, never written.
|
||||
check("copyToUser refuses a read-only user mapping", !user_memory.copyToUser(address_space, read_only, &pattern));
|
||||
check("copyFromUser accepts a read-only user mapping", user_memory.copyFromUser(address_space, read_only, out[0..pattern.len]));
|
||||
check("a write straddling into a read-only page is refused", !user_memory.copyToUser(address_space, read_only - 4, &pattern));
|
||||
|
||||
// The kernel's own address space is not a user address space.
|
||||
check("copyToUser refuses address space 0", !user_memory.copyToUser(0, arena, &pattern));
|
||||
check("copyFromUser refuses address space 0", !user_memory.copyFromUser(0, arena, out[0..pattern.len]));
|
||||
}
|
||||
|
||||
var i: usize = 0;
|
||||
while (i < mapped) : (i += 1) {
|
||||
const va = arena + i * abi.page_size;
|
||||
architecture.unmapUserPageInto(address_space, va);
|
||||
pmm.free(frames[i]);
|
||||
}
|
||||
architecture.destroyAddressSpace(address_space);
|
||||
check("no frames leaked (free count restored)", pmm.stats().free_frames == base_free);
|
||||
|
||||
// Now the ring-3 half: the fixture aims bad pointers at the converted system
|
||||
// calls and must get failures back with the machine still running.
|
||||
if (boot_information.initial_ramdisk_len == 0) {
|
||||
check("bootloader handed over an initial_ramdisk", false);
|
||||
result();
|
||||
return;
|
||||
}
|
||||
const image = @as([*]const u8, @ptrFromInt(boot_handoff.physicalToVirtual(boot_information.initial_ramdisk_base)))[0..boot_information.initial_ramdisk_len];
|
||||
const rd = initial_ramdisk.Reader.init(image) orelse {
|
||||
check("initial_ramdisk image is valid", false);
|
||||
result();
|
||||
return;
|
||||
};
|
||||
process.setInitialRamdisk(image);
|
||||
check("user-memory-test spawned", spawnNamed(rd, "user-memory-test"));
|
||||
result();
|
||||
}
|
||||
|
||||
// --- synchronous IPC --------------------------------------------------------
|
||||
|
||||
var ipc_endpoint: *ipcsync.Endpoint = undefined;
|
||||
|
|
|
|||
|
|
@ -0,0 +1,117 @@
|
|||
//! The single trusted door between ring 0 and a process's memory.
|
||||
//!
|
||||
//! Kernel code never dereferences a user virtual address. It walks that address
|
||||
//! space's page tables through the physmap — kernel mappings throughout — and
|
||||
//! moves the bytes there. Three properties fall out of that one decision:
|
||||
//!
|
||||
//! - **A bad pointer fails the system call.** danos has no fault-recovering
|
||||
//! copy-in, so a raw dereference of an unmapped-but-in-range user page would
|
||||
//! halt the machine. Here it is a `false` return and an `-EFAULT`.
|
||||
//! - **The copy is a single fetch.** A struct pulled in once cannot be changed
|
||||
//! underneath the checks that follow it — no TOCTOU against a hostile pointer.
|
||||
//! - **It is SMAP-proof by construction.** No ring-0 access to a user-mapped
|
||||
//! page ever happens, so the CR4.SMAP bit needs no `stac` window anywhere
|
||||
//! (docs/os-development/smep-smap.md). There is no `stac` in this tree, and a
|
||||
//! change that adds one is wrong by definition.
|
||||
//!
|
||||
//! The walk enforces the permissions ring 3 itself would face: a read needs the
|
||||
//! leaf user-accessible (U/S at every level), a write needs it writable too
|
||||
//! (R/W at every level). So a syscall argument cannot steer the kernel at a
|
||||
//! kernel-only mapping, nor make it write a process's own read-only text — the
|
||||
//! properties that matter once shared or copy-on-write mappings exist, and the
|
||||
//! reason the "presence only" caveat that used to sit at the top of
|
||||
//! ipc-synchronous.zig is gone.
|
||||
//!
|
||||
//! Scope: this module knows only about *user* address spaces. The kernel side of
|
||||
//! a copy (an IPC reply staged in kernel memory, a bounce buffer) is trusted and
|
||||
//! translated without permission checks — see `resolve`.
|
||||
|
||||
const std = @import("std");
|
||||
const boot_handoff = @import("boot-handoff");
|
||||
const abi = @import("abi");
|
||||
const architecture = @import("architecture");
|
||||
|
||||
const page_size = abi.page_size;
|
||||
|
||||
/// End of the user (low) canonical half. Every user buffer must lie below it, so
|
||||
/// kernel addresses and non-canonical values are refused by the range check
|
||||
/// alone, before any table is read.
|
||||
pub const user_half_end: u64 = 0x0000_8000_0000_0000;
|
||||
|
||||
/// Whether `[virtual, virtual + len)` lies wholly inside the user half. The
|
||||
/// length is compared against the remaining span rather than added to the base,
|
||||
/// so a huge `len` cannot wrap the check.
|
||||
pub fn userRangeOk(virtual: u64, len: usize) bool {
|
||||
if (virtual >= user_half_end) return false;
|
||||
return len <= user_half_end - virtual;
|
||||
}
|
||||
|
||||
/// Resolve one address for a copy. `address_space == 0` means the kernel's own
|
||||
/// tables — trusted, translated as-is. A real address space is a process's, and
|
||||
/// the walk demands what ring 3 would need: user-accessible, plus writable when
|
||||
/// this side of the copy is the destination.
|
||||
///
|
||||
/// A user frame must also be reachable *through the physmap*, because that is how
|
||||
/// the copy loops touch it. The physmap covers RAM only: `paging.init` skips every
|
||||
/// `.mmio` region, while `mmio_map` hands a driver its device's BAR as an ordinary
|
||||
/// user-accessible mapping. Such a page satisfies the permission walk and would
|
||||
/// then fault ring 0 on the physmap alias — the very #PF this layer exists to make
|
||||
/// impossible — so coverage is confirmed before the address is returned, and an
|
||||
/// uncovered frame is refused like any other bad buffer. (Confirming coverage,
|
||||
/// rather than testing the `device_grant` bit, is what keeps physmap-backed RAM
|
||||
/// that merely carries that bit — a scanout surface — usable as a buffer.)
|
||||
pub fn resolve(address_space: u64, virtual: u64, for_write: bool) ?u64 {
|
||||
if (address_space == 0) return architecture.translate(architecture.kernelPageTable(), virtual);
|
||||
const physical = architecture.translateUser(address_space, virtual, for_write) orelse return null;
|
||||
if (architecture.translate(architecture.kernelPageTable(), boot_handoff.physicalToVirtual(physical)) == null) return null;
|
||||
return physical;
|
||||
}
|
||||
|
||||
/// Copy `destination.len` bytes from `user_va` in address space `user_as` into the
|
||||
/// kernel buffer `destination`. False — never a #PF — if the range escapes the
|
||||
/// user half, or any source page is unmapped or not readable from ring 3.
|
||||
/// Handles page-straddling buffers.
|
||||
pub fn copyFromUser(user_as: u64, user_va: u64, destination: []u8) bool {
|
||||
if (user_as == 0) return false; // not a user address space
|
||||
if (!userRangeOk(user_va, destination.len)) return false;
|
||||
var off: usize = 0;
|
||||
while (off < destination.len) {
|
||||
const physical = resolve(user_as, user_va + off, false) orelse return false;
|
||||
const left = page_size - ((user_va + off) & (page_size - 1));
|
||||
const n = @min(left, destination.len - off);
|
||||
const source: [*]const u8 = @ptrFromInt(boot_handoff.physicalToVirtual(physical));
|
||||
@memcpy(destination[off..][0..n], source[0..n]);
|
||||
off += n;
|
||||
}
|
||||
return true;
|
||||
}
|
||||
|
||||
/// The write direction: copy the kernel buffer `source` out to `user_va` in
|
||||
/// address space `user_as`. False — never a #PF, never a partial promise — if the
|
||||
/// range escapes the user half, or any destination page is unmapped, kernel-only,
|
||||
/// or read-only for ring 3. (A refusal mid-way may already have written earlier
|
||||
/// pages; the caller fails the whole system call, so the buffer's contents are
|
||||
/// meaningless either way.)
|
||||
///
|
||||
/// The mirror of `copyFromUser`, and the only way kernel data reaches a user
|
||||
/// buffer outside the IPC path's `copyAcross`.
|
||||
pub fn copyToUser(user_as: u64, user_va: u64, source: []const u8) bool {
|
||||
if (user_as == 0) return false; // not a user address space
|
||||
if (!userRangeOk(user_va, source.len)) return false;
|
||||
var off: usize = 0;
|
||||
while (off < source.len) {
|
||||
const physical = resolve(user_as, user_va + off, true) orelse return false;
|
||||
const left = page_size - ((user_va + off) & (page_size - 1));
|
||||
const n = @min(left, source.len - off);
|
||||
const destination: [*]u8 = @ptrFromInt(boot_handoff.physicalToVirtual(physical));
|
||||
@memcpy(destination[0..n], source[off..][0..n]);
|
||||
off += n;
|
||||
}
|
||||
return true;
|
||||
}
|
||||
|
||||
/// `copyToUser` for any fixed-layout value — the shape most write-direction
|
||||
/// system calls want (a `KlogStatus`, a `FileAttributes`).
|
||||
pub fn copyValueToUser(user_as: u64, user_va: u64, value: anytype) bool {
|
||||
return copyToUser(user_as, user_va, std.mem.asBytes(value));
|
||||
}
|
||||
|
|
@ -184,11 +184,16 @@ fn installMount(prefix: []const u8, kind: MountKind, backend: ?*ipc.Endpoint, re
|
|||
|
||||
// --- resolve -----------------------------------------------------------------
|
||||
|
||||
/// Longest rewritten mount-relative path a backend resolution can carry — the
|
||||
/// size `fs_resolve`'s caller has to have room for, so it is named rather than
|
||||
/// spelled out at the one place that builds it.
|
||||
pub const maximum_backend_path = maximum_rewrite + maximum_prefix + 160;
|
||||
|
||||
pub const Resolved = union(enum) {
|
||||
/// Kernel-served: a permanent node token.
|
||||
kernel_node: u64,
|
||||
/// Backend-served: the endpoint plus the rewritten mount-relative path.
|
||||
backend: struct { endpoint: *ipc.Endpoint, path: [maximum_rewrite + maximum_prefix + 160]u8, path_len: usize },
|
||||
backend: struct { endpoint: *ipc.Endpoint, path: [maximum_backend_path]u8, path_len: usize },
|
||||
not_found: void,
|
||||
};
|
||||
|
||||
|
|
|
|||
|
|
@ -343,6 +343,16 @@ CASES = [
|
|||
{"name": "usermem",
|
||||
"expect": r"DANOS-TEST-RESULT: PASS",
|
||||
"fail": r"DANOS-TEST-RESULT: FAIL"},
|
||||
# The checked copy layer (system/kernel/user-memory.zig): kernel-side unit
|
||||
# checks for the bound, presence, and leaf U/S + writable refusals, then a
|
||||
# fixture aiming unmapped-but-in-range pointers at klog_read/klog_status/
|
||||
# process_enumerate/device_enumerate/fs_resolve/debug_write. Each must come
|
||||
# back as a wrapped -errno with the machine still running — before H1 every
|
||||
# one of them dereferenced the bad page in ring 0 and halted it.
|
||||
{"name": "user-memory",
|
||||
"timeout": 60,
|
||||
"expect": r"(?s)(?=.*DANOS-TEST-RESULT: PASS)(?=.*user-memory-test: ok)",
|
||||
"fail": r"user-memory-test: FAIL|DANOS-TEST-RESULT: FAIL|CPU EXCEPTION|KERNEL PANIC"},
|
||||
# Isolation: a ring-3 read of a kernel-only page must #PF with error code
|
||||
# 0x5 (present|user) at the user IP. ([\s\S] spans lines; `.` doesn't.)
|
||||
{"name": "user-pf",
|
||||
|
|
|
|||
|
|
@ -0,0 +1,15 @@
|
|||
//! The user-memory-test fixture as a binary package (docs/build-packages-plan.md):
|
||||
//! this file names the binary and EXACTLY the modules its source imports —
|
||||
//! build-support resolves each name from the domains this zon declares.
|
||||
|
||||
const std = @import("std");
|
||||
const build_support = @import("build-support");
|
||||
|
||||
pub fn build(b: *std.Build) void {
|
||||
const exe = build_support.userBinary(b, .{
|
||||
.name = "user-memory-test",
|
||||
.root_source_file = b.path("user-memory-test.zig"),
|
||||
.imports = &.{ "abi", "system-call", "logging", "driver" },
|
||||
});
|
||||
b.installArtifact(exe);
|
||||
}
|
||||
|
|
@ -0,0 +1,15 @@
|
|||
.{
|
||||
.name = .user_memory_test,
|
||||
.version = "0.0.0",
|
||||
.fingerprint = 0xde57dc97fd81a402, // Changing this has security and trust implications.
|
||||
.minimum_zig_version = "0.16.0",
|
||||
.dependencies = .{
|
||||
// build-support supplies the shared recipe; kernel is implicit in
|
||||
// every binary (the root shim + link script live there). The rest
|
||||
// are exactly the homes of this binary's declared imports.
|
||||
.@"build-support" = .{ .path = "../../../../build-support" },
|
||||
.kernel = .{ .path = "../../../../library/kernel" },
|
||||
.device = .{ .path = "../../../../library/device" },
|
||||
},
|
||||
.paths = .{""},
|
||||
}
|
||||
|
|
@ -0,0 +1,111 @@
|
|||
//! user-memory-test — QEMU fixture for the kernel's checked copy layer
|
||||
//! (system/kernel/user-memory.zig).
|
||||
//!
|
||||
//! Every check comes in a pair: the same system call is made once with a sound
|
||||
//! buffer and once with a pointer that is *inside* the user half but mapped in no
|
||||
//! process. The sound call must succeed and the unsound one must return a wrapped
|
||||
//! -errno — proving the refusal is attributable to the pointer and not to the
|
||||
//! call being impossible. Before H1 the unsound half of each pair dereferenced an
|
||||
//! unmapped page in ring 0, which halts the machine; the fixture reaching its
|
||||
//! final marker at all is the substance of the test.
|
||||
//!
|
||||
//! Prints `user-memory-test: <check> ok` per pair and `user-memory-test: ok` at
|
||||
//! the end, which the harness asserts on (test/qemu_test.py).
|
||||
|
||||
const abi = @import("abi");
|
||||
const sc = @import("system-call");
|
||||
const logging = @import("logging");
|
||||
const device = @import("driver");
|
||||
|
||||
/// A user-half address that is mapped in no process: below the code image
|
||||
/// (0x0000_7000_0000_0000) and far from every arena the kernel hands out. It
|
||||
/// passes each system call's bounds check and then fails the page walk — the
|
||||
/// exact shape the checked copy exists for.
|
||||
const unmapped: usize = 0x0000_6000_0000_0000;
|
||||
|
||||
/// The kernel returns failures as a small negative errno in the result register.
|
||||
fn failed(r: usize) bool {
|
||||
return r > ~@as(usize, 0) - 4095;
|
||||
}
|
||||
|
||||
var failures: u32 = 0;
|
||||
|
||||
fn check(comptime name: []const u8, ok: bool) void {
|
||||
if (ok) {
|
||||
_ = logging.write("user-memory-test: " ++ name ++ " ok\n");
|
||||
} else {
|
||||
failures += 1;
|
||||
_ = logging.write("user-memory-test: FAIL " ++ name ++ "\n");
|
||||
}
|
||||
}
|
||||
|
||||
/// klog_read writes the ring's bytes out to the caller. Read from the ring's own
|
||||
/// tail so the offset is certainly valid and the copy is what decides the call.
|
||||
fn klogRead() void {
|
||||
var status: abi.KlogStatus = undefined;
|
||||
if (@as(isize, @bitCast(sc.systemCall1(.klog_status, @intFromPtr(&status)))) != 0) {
|
||||
check("klog_status (sound out buffer accepted)", false);
|
||||
return;
|
||||
}
|
||||
var buffer: [64]u8 = undefined;
|
||||
const good = sc.systemCall3(.klog_read, status.tail, @intFromPtr(&buffer), buffer.len);
|
||||
const bad = sc.systemCall3(.klog_read, status.tail, unmapped, buffer.len);
|
||||
check("klog_read (bad out buffer refused)", !failed(good) and failed(bad));
|
||||
|
||||
// The status struct itself is a write-direction copy of its own.
|
||||
const bad_status = sc.systemCall1(.klog_status, unmapped);
|
||||
check("klog_status (bad out buffer refused)", failed(bad_status));
|
||||
}
|
||||
|
||||
fn processEnumerate() void {
|
||||
var table: [4]abi.ProcessDescriptor = undefined;
|
||||
const good = sc.systemCall2(.process_enumerate, @intFromPtr(&table), table.len);
|
||||
const bad = sc.systemCall2(.process_enumerate, unmapped, table.len);
|
||||
check("process_enumerate (bad out buffer refused)", good != 0 and !failed(good) and failed(bad));
|
||||
}
|
||||
|
||||
/// Descriptors are hundreds of bytes each — keep them off the stack. Four spans
|
||||
/// more than one kernel chunk, so the chunked copy-out is genuinely exercised.
|
||||
var descriptors: [4]device.DeviceDescriptor = undefined;
|
||||
|
||||
fn deviceEnumerate() void {
|
||||
const good = sc.systemCall2(.device_enumerate, @intFromPtr(&descriptors), descriptors.len);
|
||||
const bad = sc.systemCall2(.device_enumerate, unmapped, descriptors.len);
|
||||
check("device_enumerate (bad out buffer refused)", !failed(good) and failed(bad));
|
||||
}
|
||||
|
||||
fn fsResolve() void {
|
||||
var out: [256]u8 = undefined;
|
||||
const path = "/system/services/init";
|
||||
const good = sc.systemCall5(.fs_resolve, @intFromPtr(path.ptr), path.len, 0, @intFromPtr(&out), out.len);
|
||||
const bad = sc.systemCall5(.fs_resolve, unmapped, path.len, 0, @intFromPtr(&out), out.len);
|
||||
check("fs_resolve (bad path buffer refused)", !failed(good) and failed(bad));
|
||||
|
||||
// The out-buffer capacity is unbounded ring-3 input: the range check must
|
||||
// not add it to the base, or the sum wraps the user-half bound and traps
|
||||
// the kernel's own overflow check. Surviving this call is the assertion.
|
||||
const wrapping = sc.systemCall5(.fs_resolve, @intFromPtr(path.ptr), path.len, 0, @intFromPtr(&out), ~@as(usize, 0));
|
||||
check("fs_resolve (wrapping out capacity refused)", failed(wrapping));
|
||||
}
|
||||
|
||||
/// debug_write reads the caller's message; a bad pointer must not take the
|
||||
/// kernel down on the way to the log ring.
|
||||
fn debugWrite() void {
|
||||
const bad = sc.systemCall3(.debug_write, unmapped, 16, @intFromEnum(abi.KlogLevel.info));
|
||||
check("debug_write (bad message buffer refused)", failed(bad));
|
||||
}
|
||||
|
||||
pub fn main() void {
|
||||
klogRead();
|
||||
processEnumerate();
|
||||
deviceEnumerate();
|
||||
fsResolve();
|
||||
debugWrite();
|
||||
// Reaching here at all means seven bad user pointers failed their calls
|
||||
// instead of faulting ring 0.
|
||||
if (failures == 0) {
|
||||
_ = logging.write("user-memory-test: ok\n");
|
||||
} else {
|
||||
_ = logging.write("user-memory-test: FAILED\n");
|
||||
}
|
||||
}
|
||||
Loading…
Reference in New Issue