threads: Kernel handling of unsafe operations on user memory

hal/armv7a/_interrupts.S

@@ -293,3 +293,38 @@ _syscalls_dispatch:
 	add sp, sp, #8
 	b _hal_cpuRestoreCtx
 .size _syscalls_dispatch, .-_syscalls_dispatch
+
+
+.globl hal_excjmp
+.type hal_excjmp, %function
+hal_excjmp:
+	ldr r1, [r0], #4
+	msr cpsr_fsxc, r1
+	ldr sp, [r0], #4
+	ldr lr, [r0], #4
+	ldm r0, {r4-r11}
+
+	mov r0, #1
+	bx lr
+.size hal_excjmp, .-hal_excjmp
+
+
+/* int hal_setexcjmp(excjmp_context_t *ctx, excjmp_context_t **oldctx) */
+.globl hal_setexcjmp
+.type hal_setexcjmp, %function
+hal_setexcjmp:
+	mrs r2, cpsr
+	str r2, [r0], #4
+	str sp, [r0], #4
+	str lr, [r0], #4
+	stm r0, {r4-r11}
+
+	mov r4, lr
+	sub r0, #12
+	bl threads_setexcjmp
+
+	mov lr, r4
+
+	mov r0, #0
+	bx lr
+.size hal_setexcjmp, .-hal_setexcjmp

hal/armv7a/arch/exceptions.h

@@ -35,4 +35,19 @@ typedef struct _exc_context_t {
 	cpu_context_t cpuCtx;
 } exc_context_t;
 
+
+typedef struct _excjmp_context_t {
+	u32 cpsr;
+	u32 sp;
+	u32 ret;
+	u32 r4;
+	u32 r5;
+	u32 r6;
+	u32 r7;
+	u32 r8;
+	u32 r9;
+	u32 r10;
+	u32 r11;
+} excjmp_context_t;
+
 #endif

hal/armv7a/cpu.c

@@ -17,6 +17,8 @@
 #include "hal/string.h"
 #include "hal/spinlock.h"
 #include "hal/hal.h"
+#include "arch/exceptions.h"
+#include "include/errno.h"
 
 #include "armv7a.h"
 #include "config.h"
@@ -96,8 +98,12 @@ int hal_cpuCreateContext(cpu_context_t **nctx, void *start, void *kstack, size_t
 }
 
 
+extern void threads_setexcjmp(excjmp_context_t *ctx, excjmp_context_t **oldctx);
+
+
 int hal_cpuPushSignal(void *kstack, void (*handler)(void), cpu_context_t *signalCtx, int n, unsigned int oldmask, const int src)
 {
+	excjmp_context_t excctx, *oldctx;
 	cpu_context_t *ctx = (void *)((char *)kstack - sizeof(cpu_context_t));
 	const struct stackArg args[] = {
 		{ &ctx->psr, sizeof(ctx->psr) },
@@ -110,19 +116,26 @@ int hal_cpuPushSignal(void *kstack, void (*handler)(void), cpu_context_t *signal
 
 	(void)src;
 
-	hal_memcpy(signalCtx, ctx, sizeof(cpu_context_t));
+	if (!hal_setexcjmp(&excctx, &oldctx)) {
+		hal_memcpy(signalCtx, ctx, sizeof(cpu_context_t));
 
-	signalCtx->pc = (u32)handler & ~1;
-	signalCtx->sp -= sizeof(cpu_context_t);
+		signalCtx->pc = (u32)handler & ~1;
+		signalCtx->sp -= sizeof(cpu_context_t);
 
-	if (((u32)handler & 1) != 0) {
-		signalCtx->psr |= THUMB_STATE;
+		if (((u32)handler & 1) != 0) {
+			signalCtx->psr |= THUMB_STATE;
+		}
+		else {
+			signalCtx->psr &= ~THUMB_STATE;
+		}
+
+		hal_stackPutArgs((void **)&signalCtx->sp, sizeof(args) / sizeof(args[0]), args);
 	}
 	else {
-		signalCtx->psr &= ~THUMB_STATE;
+		threads_setexcjmp(oldctx, NULL);
+		return -EFAULT;
 	}
-
-	hal_stackPutArgs((void **)&signalCtx->sp, sizeof(args) / sizeof(args[0]), args);
+	threads_setexcjmp(oldctx, NULL);
 
 	return 0;
 }

hal/armv7a/exceptions.c

@@ -119,8 +119,19 @@ static void exceptions_defaultHandler(unsigned int n, exc_context_t *ctx)
 extern void threads_setupUserReturn(void *retval, cpu_context_t *ctx);
 
 
+extern excjmp_context_t *threads_getexcjmp(void);
+
+
+extern void hal_excjmp(excjmp_context_t *ctx);
+
+
 void exceptions_dispatch(unsigned int n, exc_context_t *ctx)
 {
+	excjmp_context_t *excctx = threads_getexcjmp();
+	if (excctx != NULL) {
+		hal_excjmp(excctx);
+	}
+
 	if (n == exc_prefetch || n == exc_abort)
 		exceptions.abortHandler(n, ctx);
 	else if (n == exc_undef)

hal/cpu.h

@@ -20,6 +20,7 @@
 #define SIG_SRC_SCALL 1
 
 #include <arch/cpu.h>
+#include <arch/exceptions.h>
 #include "spinlock.h"
 
 
@@ -113,6 +114,9 @@
 extern void hal_jmp(void *f, void *kstack, void *ustack, size_t kargc, const arg_t *kargs);
 
 
+extern int hal_setexcjmp(excjmp_context_t *ctx, excjmp_context_t **oldctx);
+
+
 /* core management */
 
 

hal/ia32/_exceptions.S

@@ -112,6 +112,62 @@ exception_popContext:
 	iret
 .size exception_popContext, .-exception_popContext
 
+
+/* int hal_setexcjmp(cpu_context_t *ctx, cpu_context_t **oldctx) */
+.globl hal_setexcjmp
+.type hal_setexcjmp, %function
+hal_setexcjmp:
+	pushfl
+	popl %ecx
+
+	movl 4(%esp), %eax /* eax := ctx */
+
+	movl %ecx, 160(%eax)
+
+	leal 4(%eax), %ecx
+	movl %ecx, (%eax)
+		/* Save calee-saved registers */
+	movl %edi, 4(%eax)
+	movl %esi, 8(%eax)
+	movl %ebp, 12(%eax)
+	movl %ebx, 24(%eax)
+
+	movw %gs, 32(%eax)
+	movw %fs, 34(%eax)
+	movw %es, 36(%eax)
+	movw %ds, 38(%eax)
+	movw %cs, 156(%eax)
+	movw $0, 158(%eax)
+	movw %ss, 168(%eax)
+	movw $0, 170(%eax)
+
+	movl %cr0, %ecx
+	movl %ecx, 148(%eax)
+
+	movl %esp, 16(%eax) /* ctx.edx := esp to revert (popContext to supervisor mode does not change esp) */
+		/* save ctx.PC as label 1: */
+	leal (1f), %ecx
+	movl %ecx, 152(%eax)
+
+	movl (%esp), %ecx /* ecx := return address */
+	movl %ecx, 20(%eax) /* ctx.ecx := return address */
+
+	pushl 8(%esp) /* oldctx */
+	pushl 8(%esp) /* ctx */
+	call threads_setexcjmp
+	popl %eax
+	popl %eax
+
+	movl $0, %eax
+	ret
+1:
+	movl %edx, %esp
+	movl %ecx, (%esp) /* restore return address */
+	movl $1, %eax
+	ret
+.size hal_setexcjmp, .-hal_setexcjmp
+
+
 /* Used for FPU lazy context stacking */
 .globl exceptions_exc7_handler
 .align 4, 0x90
@@ -142,6 +198,13 @@ sym:
 /* Exception handling macro */
 #define EXCSTUB(exc)\
 	call exception_pushContext;\
+	;\
+	call threads_getexcjmp;\
+	testl %eax, %eax;\
+	jz 1f;\
+	leal -28(%eax), %esp;\
+	jmp exception_popContext;\
+1:\
 	movl $SEL_KDATA, %eax;\
 	movw %ax, %ds;\
 	movw %ax, %es;\

hal/ia32/arch/exceptions.h

@@ -40,6 +40,8 @@ typedef struct {
 	cpu_context_t cpuCtx;
 } exc_context_t;
 
+typedef cpu_context_t excjmp_context_t;
+
 #pragma pack(pop)
 
 #endif

hal/ia32/cpu.c

@@ -26,6 +26,7 @@
 #include "ia32.h"
 #include "halsyspage.h"
 #include "init.h"
+#include "proc/threads.h"
 
 #include <arch/tlb.h>
 
@@ -179,6 +180,7 @@ void _hal_cpuSetKernelStack(void *kstack)
 
 int hal_cpuPushSignal(void *kstack, void (*handler)(void), cpu_context_t *signalCtx, int n, unsigned int oldmask, const int src)
 {
+	cpu_context_t excctx, *oldctx;
 	cpu_context_t *ctx = (void *)((char *)kstack - sizeof(cpu_context_t));
 	const struct stackArg args[] = {
 		{ &ctx->esp, sizeof(ctx->esp) },
@@ -190,12 +192,20 @@ int hal_cpuPushSignal(void *kstack, void (*handler)(void), cpu_context_t *signal
 
 	(void)src;
 
-	hal_memcpy(signalCtx, ctx, sizeof(cpu_context_t));
 
-	signalCtx->eip = (u32)handler;
-	signalCtx->esp -= sizeof(cpu_context_t);
+	if (!hal_setexcjmp(&excctx, &oldctx)) {
+		hal_memcpy(signalCtx, ctx, sizeof(cpu_context_t));
 
-	hal_stackPutArgs((void **)&signalCtx->esp, sizeof(args) / sizeof(args[0]), args);
+		signalCtx->eip = (u32)handler;
+		signalCtx->esp -= sizeof(cpu_context_t);
+
+		hal_stackPutArgs((void **)&signalCtx->esp, sizeof(args) / sizeof(args[0]), args);
+	}
+	else {
+		threads_setexcjmp(oldctx, NULL);
+		return -EFAULT;
+	}
+	threads_setexcjmp(oldctx, NULL);
 
 	return 0;
 }