Daniel Samson
f23f073624
Delegation moves out of onHello and into the spawn itself. The manager holds the hardware and names it in the call that creates the driver; the kernel checks the device is the caller's to give, then hands it over as part of making the child. The reason is the window. A transfer after spawning always leaves an interval in which the child is running and does not yet hold its device. It would close on QEMU every time and open occasionally on a machine with different core counts and timing — the exact failure shape this track exists to delete, and not one worth introducing while removing the others. Fused into the spawn there is no interval: the child does not exist until it holds the device. Ownership is checked BEFORE the child is created, so a refusal leaves nothing running rather than a driver without the hardware it was spawned for. The IOMMU confinement moves with the device, as it does on the transfer path. systemCall6 is added for the sixth argument; r9 was free, and abi gains a no_device sentinel matching the protocol's. No driver had to change to receive a device, which is what makes this better than requiring every driver to hello: ps2-bus keeps its legacy status, and discovery — which has no assignment at all, since it is what produces the device tree — is unaffected. The attacker fixture now tries the spawn as a back door: name someone else's device, and both the spawn and any child must be refused. Verifying that assertion exposed a bug in the fixture itself. The kernel case's pass marker was "device-authority: ok", which matches the FIRST per-assertion line, so its wait loop exited before any failure was printed — the case would have passed with failures in it, and had been able to since D2. The verdict lines now carry a distinct VERDICT prefix, and with the ownership check removed the case genuinely fails. A green test that cannot go red is worse than no test. Suite 118/118.
84 lines
3.0 KiB
Zig
84 lines
3.0 KiB
Zig
//! Raw `system_call` instruction wrappers for user space — one per arity.
|
|
//!
|
|
//! ABI: number in rax, arguments in rdi, rsi, rdx, r10, r8, r9, result in rax.
|
|
//! The `system_call` instruction itself clobbers rcx (it holds the return rip) and
|
|
//! r11 (the saved rflags); the kernel entry stub preserves everything else.
|
|
//! Note argument #3 goes in **r10, not rcx** — rcx is unavailable across the
|
|
//! instruction, so the kernel reads the 4th argument from r10.
|
|
|
|
const abi = @import("abi");
|
|
const SystemCall = abi.SystemCall;
|
|
|
|
pub inline fn systemCall0(n: SystemCall) usize {
|
|
return asm volatile ("syscall"
|
|
: [ret] "={rax}" (-> usize),
|
|
: [n] "{rax}" (@intFromEnum(n)),
|
|
: .{ .rcx = true, .r11 = true, .memory = true });
|
|
}
|
|
|
|
pub inline fn systemCall1(n: SystemCall, a0: usize) usize {
|
|
return asm volatile ("syscall"
|
|
: [ret] "={rax}" (-> usize),
|
|
: [n] "{rax}" (@intFromEnum(n)),
|
|
[a0] "{rdi}" (a0),
|
|
: .{ .rcx = true, .r11 = true, .memory = true });
|
|
}
|
|
|
|
pub inline fn systemCall2(n: SystemCall, a0: usize, a1: usize) usize {
|
|
return asm volatile ("syscall"
|
|
: [ret] "={rax}" (-> usize),
|
|
: [n] "{rax}" (@intFromEnum(n)),
|
|
[a0] "{rdi}" (a0),
|
|
[a1] "{rsi}" (a1),
|
|
: .{ .rcx = true, .r11 = true, .memory = true });
|
|
}
|
|
|
|
pub inline fn systemCall3(n: SystemCall, a0: usize, a1: usize, a2: usize) usize {
|
|
return asm volatile ("syscall"
|
|
: [ret] "={rax}" (-> usize),
|
|
: [n] "{rax}" (@intFromEnum(n)),
|
|
[a0] "{rdi}" (a0),
|
|
[a1] "{rsi}" (a1),
|
|
[a2] "{rdx}" (a2),
|
|
: .{ .rcx = true, .r11 = true, .memory = true });
|
|
}
|
|
|
|
pub inline fn systemCall4(n: SystemCall, a0: usize, a1: usize, a2: usize, a3: usize) usize {
|
|
return asm volatile ("syscall"
|
|
: [ret] "={rax}" (-> usize),
|
|
: [n] "{rax}" (@intFromEnum(n)),
|
|
[a0] "{rdi}" (a0),
|
|
[a1] "{rsi}" (a1),
|
|
[a2] "{rdx}" (a2),
|
|
[a3] "{r10}" (a3),
|
|
: .{ .rcx = true, .r11 = true, .memory = true });
|
|
}
|
|
|
|
pub inline fn systemCall5(n: SystemCall, a0: usize, a1: usize, a2: usize, a3: usize, a4: usize) usize {
|
|
return asm volatile ("syscall"
|
|
: [ret] "={rax}" (-> usize),
|
|
: [n] "{rax}" (@intFromEnum(n)),
|
|
[a0] "{rdi}" (a0),
|
|
[a1] "{rsi}" (a1),
|
|
[a2] "{rdx}" (a2),
|
|
[a3] "{r10}" (a3),
|
|
[a4] "{r8}" (a4),
|
|
: .{ .rcx = true, .r11 = true, .memory = true });
|
|
}
|
|
|
|
/// The sixth and last argument register. `syscall` clobbers rcx, so r10 stands in for
|
|
/// it and r9 is the end of the line — a call needing a seventh would have to pass a
|
|
/// struct instead.
|
|
pub inline fn systemCall6(n: SystemCall, a0: usize, a1: usize, a2: usize, a3: usize, a4: usize, a5: usize) usize {
|
|
return asm volatile ("syscall"
|
|
: [ret] "={rax}" (-> usize),
|
|
: [n] "{rax}" (@intFromEnum(n)),
|
|
[a0] "{rdi}" (a0),
|
|
[a1] "{rsi}" (a1),
|
|
[a2] "{rdx}" (a2),
|
|
[a3] "{r10}" (a3),
|
|
[a4] "{r8}" (a4),
|
|
[a5] "{r9}" (a5),
|
|
: .{ .rcx = true, .r11 = true, .memory = true });
|
|
}
|