Enabled SMAP/SMEP protections

5 files changed, 113 insertions, 50 deletions

diff --git a/kernel/features/fs.c b/kernel/features/fs.c
index cc9949e..47e7891 100644
--- a/kernel/features/fs.c
+++ b/kernel/features/fs.c
@@ -1,6 +1,7 @@
 // MIT License, Copyright (c) 2020 Marvin Borner
 
 #include <assert.h>
+#include <cpu.h>
 #include <crypto.h>
 #include <def.h>
 #include <errno.h>
@@ -65,15 +66,24 @@ static struct mount_info *vfs_recursive_find(char *path)
 
 static struct mount_info *vfs_find_mount_info(const char *path)
 {
-	if (path[0] != '/')
+	stac();
+	if (path[0] != '/') {
+		clac();
 		return NULL;
-	return vfs_recursive_find(strdup(path));
+	}
+	clac();
+	struct mount_info *ret = vfs_recursive_find(strdup_user(path));
+	return ret;
 }
 
 struct device *vfs_find_dev(const char *path)
 {
-	if (path[0] != '/')
+	stac();
+	if (path[0] != '/') {
+		clac();
 		return NULL;
+	}
+	clac();
 	struct mount_info *m = vfs_find_mount_info(path);
 	if (m->dev->vfs->type == VFS_DEVFS) // TODO: ?
 		return device_get_by_name(path + strlen(m->path) + 1);
@@ -130,7 +140,6 @@ res vfs_mount(struct device *dev, const char *path)
 
 res vfs_read(const char *path, void *buf, u32 offset, u32 count)
 {
-	/* printf("%s READ: %s\n", proc_current() ? proc_current()->name : "Unknown", path); */
 	if (!memory_valid(path))
 		return -EFAULT;
 
@@ -159,7 +168,6 @@ res vfs_read(const char *path, void *buf, u32 offset, u32 count)
 
 res vfs_write(const char *path, void *buf, u32 offset, u32 count)
 {
-	/* printf("%s WRITE: %s\n", proc_current() ? proc_current()->name : "Unknown", path); */
 	if (!memory_valid(path))
 		return -EFAULT;
 
@@ -255,21 +263,31 @@ res vfs_block(const char *path, u32 func_ptr)
 	return m->dev->vfs->block(path, func_ptr, m->dev);
 }
 
+// TODO: Reduce stac clac?
+// TODO: Fix page fault when called too often/fast
 res vfs_poll(const char **files)
 {
 	if (!memory_valid(files))
 		return -EFAULT;
 
+	stac();
 	for (const char **p = files; *p && memory_valid(*p) && **p; p++) {
 		res ready = vfs_ready(*p);
+		clac();
 		if (ready == 1)
 			return p - files;
 		else if (ready < 0)
 			return ready;
+		stac();
 	}
+	clac();
 
-	for (const char **p = files; *p && memory_valid(*p) && **p; p++)
+	stac();
+	for (const char **p = files; *p && memory_valid(*p) && **p; p++) {
 		vfs_block(*p, (u32)vfs_poll);
+		stac();
+	}
+	clac();
 
 	return PROC_MAX_BLOCK_IDS + 1;
 }
@@ -325,7 +343,7 @@ struct device *device_get_by_name(const char *name)
 {
 	struct node *iterator = devices->head;
 	while (iterator) {
-		if (!strcmp(((struct device *)iterator->data)->name, name))
+		if (!strcmp_user(((struct device *)iterator->data)->name, name))
 			return iterator->data;
 		iterator = iterator->next;
 	}
@@ -522,7 +540,7 @@ static res read_inode(struct ext2_inode *in, void *buf, u32 offset, u32 count, s
 		u32 block_offset = (i == first_block) ? first_block_offset : 0;
 		u32 byte_count = MIN(BLOCK_SIZE - block_offset, remaining);
 
-		memcpy((u8 *)buf + copied, data + block_offset, byte_count);
+		memcpy_user((u8 *)buf + copied, data + block_offset, byte_count);
 
 		copied += byte_count;
 		remaining -= byte_count;
@@ -583,12 +601,14 @@ static u32 find_inode(const char *name, u32 dir_inode, struct device *dev)
 static struct ext2_inode *find_inode_by_path(const char *path, struct ext2_inode *in_buf,
 					     struct device *dev)
 {
-	if (path[0] != '/')
-		return NULL;
-
-	char *path_cp = strdup(path);
+	char *path_cp = strdup_user(path);
 	char *init = path_cp; // For freeing
 
+	if (path_cp[0] != '/') {
+		free(init);
+		return NULL;
+	}
+
 	path_cp++;
 	u32 current_inode = EXT2_ROOT;
 
@@ -623,9 +643,9 @@ static struct ext2_inode *find_inode_by_path(const char *path, struct ext2_inode
 res ext2_read(const char *path, void *buf, u32 offset, u32 count, struct device *dev)
 {
 	struct ext2_inode in = { 0 };
-	if (find_inode_by_path(path, &in, dev) == &in)
+	if (find_inode_by_path(path, &in, dev) == &in) {
 		return read_inode(&in, buf, offset, count, dev);
-	else
+	} else
 		return -ENOENT;
 }
 
@@ -638,8 +658,10 @@ res ext2_stat(const char *path, struct stat *buf, struct device *dev)
 	//u32 num_blocks = in.blocks / (BLOCK_SIZE / SECTOR_SIZE);
 	//u32 sz = BLOCK_SIZE * num_blocks;
 
+	stac();
 	buf->dev_id = dev->id;
 	buf->size = in.size;
+	clac();
 
 	return EOK;
 }
diff --git a/kernel/features/load.c b/kernel/features/load.c
index c5039ed..0439424 100644
--- a/kernel/features/load.c
+++ b/kernel/features/load.c
@@ -1,5 +1,6 @@
 // MIT License, Copyright (c) 2020 Marvin Borner
 
+#include <cpu.h>
 #include <errno.h>
 #include <fs.h>
 #include <load.h>
@@ -9,6 +10,8 @@
 
 #define PROC_STACK_SIZE 0x4000
 
+#include <print.h>
+
 res elf_load(const char *path, struct proc *proc)
 {
 	if (!memory_valid(path))
@@ -18,19 +21,23 @@ res elf_load(const char *path, struct proc *proc)
 	memory_bypass_enable();
 	res stat = vfs_stat(path, &s);
 	memory_bypass_disable();
-	if (stat != 0)
+	if (stat != EOK)
 		return stat;
 
 	struct elf_header header = { 0 };
+	stac();
 	memory_bypass_enable();
 	res read = vfs_read(path, &header, 0, sizeof(header));
 	memory_bypass_disable();
+	clac();
 	if (read < 0)
 		return read;
 	if (read != sizeof(header))
 		return -ENOEXEC;
 
+	stac();
 	strlcpy(proc->name, path, sizeof(proc->name));
+	clac();
 
 	// Valid?
 	u8 *magic = header.ident;
@@ -44,10 +51,12 @@ res elf_load(const char *path, struct proc *proc)
 
 	for (u32 i = 0; i < header.phnum; i++) {
 		struct elf_program program = { 0 };
+
 		memory_bypass_enable();
 		if (vfs_read(path, &program, header.phoff + header.phentsize * i,
 			     sizeof(program)) != sizeof(program)) {
 			memory_bypass_disable();
+			clac();
 			return -ENOEXEC;
 		}
 		memory_bypass_disable();
@@ -82,11 +91,13 @@ res elf_load(const char *path, struct proc *proc)
 	memory_backup_dir(&prev);
 	memory_switch_dir(proc->page_dir);
 
+	stac();
 	u32 stack = (u32)memory_alloc(proc->page_dir, PROC_STACK_SIZE, MEMORY_USER | MEMORY_CLEAR);
 	proc->regs.ebp = stack + PROC_STACK_SIZE;
 	proc->regs.useresp = stack + PROC_STACK_SIZE;
 	proc->regs.eip = header.entry;
 	proc->entry = header.entry;
+	clac();
 
 	memory_switch_dir(prev);
 	return EOK;
diff --git a/kernel/features/mm.c b/kernel/features/mm.c
index 86d33c7..75b64bd 100644
--- a/kernel/features/mm.c
+++ b/kernel/features/mm.c
@@ -56,11 +56,12 @@ void page_fault_handler(struct regs *r)
 	} else {
 		dir = &kernel_dir;
 	}
-	u32 paddr = virtual_to_physical(dir, vaddr);
 
 	// Print!
+	u32 paddr = virtual_to_physical(dir, vaddr);
 	printf("%s process tried to %s a %s page at [vaddr=%x; paddr=%x]\n", super, operation, type,
 	       vaddr, paddr);
+	print_trace(5);
 
 	isr_panic(r);
 }
@@ -350,7 +351,7 @@ void *memory_alloc(struct page_dir *dir, u32 size, u32 flags)
 	}
 
 	if (flags & MEMORY_CLEAR)
-		memset((void *)vaddr, 0, size);
+		memset_user((void *)vaddr, 0, size);
 
 	return (void *)vaddr;
 
@@ -427,8 +428,10 @@ res memory_sys_alloc(struct page_dir *dir, u32 size, u32 *addr, u32 *id, u8 shar
 	link->vrange = memory_range(vaddr, size);
 	list_add(proc_current()->memory, link);
 
+	stac();
 	*addr = vaddr;
 	*id = obj->id;
+	clac();
 
 	return EOK;
 }
@@ -466,9 +469,6 @@ res memory_sys_shaccess(struct page_dir *dir, u32 id, u32 *addr, u32 *size)
 	if (!memory_valid(addr) || !memory_valid(size))
 		return -EFAULT;
 
-	*addr = 0;
-	*size = 0;
-
 	struct node *iterator = memory_objects->head;
 	while (iterator) {
 		struct memory_object *obj = iterator->data;
@@ -480,8 +480,10 @@ res memory_sys_shaccess(struct page_dir *dir, u32 id, u32 *addr, u32 *size)
 			struct memory_range shrange =
 				virtual_alloc(dir, obj->prange, MEMORY_CLEAR | MEMORY_USER);
 
+			stac();
 			*addr = shrange.base;
 			*size = shrange.size;
+			clac();
 
 			struct memory_proc_link *link = zalloc(sizeof(*link));
 			link->obj = obj;
@@ -493,6 +495,11 @@ res memory_sys_shaccess(struct page_dir *dir, u32 id, u32 *addr, u32 *size)
 		iterator = iterator->next;
 	}
 
+	stac();
+	*addr = 0;
+	*size = 0;
+	clac();
+
 	return -ENOENT;
 }
 
diff --git a/kernel/features/proc.c b/kernel/features/proc.c
index 6d07945..21e63b3 100644
--- a/kernel/features/proc.c
+++ b/kernel/features/proc.c
@@ -305,7 +305,9 @@ void proc_stack_push(struct proc *proc, u32 data)
 	memory_switch_dir(proc->page_dir);
 
 	proc->regs.useresp -= sizeof(data);
+	stac();
 	*(u32 *)proc->regs.useresp = data;
+	clac();
 
 	memory_switch_dir(prev);
 }
@@ -314,6 +316,7 @@ void proc_stack_push(struct proc *proc, u32 data)
 
 static const char *procfs_parse_path(const char **path, u32 *pid)
 {
+	stac();
 	while (**path == '/')
 		(*path)++;
 
@@ -326,19 +329,20 @@ static const char *procfs_parse_path(const char **path, u32 *pid)
 		*pid = proc_current()->pid;
 		*path += 4;
 	}
+	clac();
 
 	return *path;
 }
 
 static enum stream_defaults procfs_stream(const char *path)
 {
-	if (!memcmp(path, "in", 3)) {
+	if (!memcmp_user(path, "in", 3)) {
 		return STREAM_IN;
-	} else if (!memcmp(path, "out", 4)) {
+	} else if (!memcmp_user(path, "out", 4)) {
 		return STREAM_OUT;
-	} else if (!memcmp(path, "err", 4)) {
+	} else if (!memcmp_user(path, "err", 4)) {
 		return STREAM_ERR;
-	} else if (!memcmp(path, "log", 4)) {
+	} else if (!memcmp_user(path, "log", 4)) {
 		return STREAM_LOG;
 	} else {
 		return STREAM_UNKNOWN;
@@ -356,20 +360,24 @@ static res procfs_write(const char *path, void *buf, u32 offset, u32 count, stru
 	procfs_parse_path(&path, &pid);
 	if (pid) {
 		struct proc *p = proc_from_pid(pid);
-		if (!p || path[0] != '/')
+		stac();
+		if (!p || path[0] != '/') {
+			clac();
 			return -ENOENT;
+		}
+		clac();
 
 		path++;
-		if (!memcmp(path, "msg", 4)) {
+		if (!memcmp_user(path, "msg", 4)) {
 			void *msg_data = malloc(count);
-			memcpy(msg_data, buf, count);
+			memcpy_user(msg_data, buf, count);
 			struct procfs_message *msg = malloc(sizeof(*msg));
 			msg->data = msg_data;
 			msg->size = count;
 			stack_push_bot(p->messages, msg); // TODO: Use offset
 			proc_unblock(pid, PROC_BLOCK_MSG);
 			return count;
-		} else if (!memcmp(path, "io/", 3)) {
+		} else if (!memcmp_user(path, "io/", 3)) {
 			path += 3;
 			enum stream_defaults id = procfs_stream(path);
 			if (id == STREAM_UNKNOWN)
@@ -381,7 +389,7 @@ static res procfs_write(const char *path, void *buf, u32 offset, u32 count, stru
 
 			struct stream *stream = &p->streams[id];
 			assert(stream->offset_write + count < STREAM_MAX_SIZE); // TODO: Resize
-			memcpy((char *)(stream->data + stream->offset_write), buf, count);
+			memcpy_user((char *)(stream->data + stream->offset_write), buf, count);
 			stream->offset_write += count;
 			proc_unblock(dev->id, PROC_BLOCK_DEV);
 			return count;
@@ -400,40 +408,46 @@ static res procfs_read(const char *path, void *buf, u32 offset, u32 count, struc
 
 	if (pid) {
 		struct proc *p = proc_from_pid(pid);
-		if (!p || path[0] != '/')
+		stac();
+		if (!p || path[0] != '/') {
+			clac();
 			return -ENOENT;
+		}
+		clac();
 
 		path++;
-		if (!memcmp(path, "pid", 4)) {
-			//memcpy(buf, ((u8 *)p->pid) + offset, count);
+		if (!memcmp_user(path, "pid", 4)) {
+			/* memcpy_user(buf, ((u8 *)p->pid) + offset, count); */
+			stac();
 			*(u32 *)buf = p->pid;
+			clac();
 			return count;
-		} else if (!memcmp(path, "name", 5)) {
-			memcpy(buf, p->name + offset, count);
+		} else if (!memcmp_user(path, "name", 5)) {
+			memcpy_user(buf, p->name + offset, count);
 			return count;
-		} else if (!memcmp(path, "status", 7)) {
+		} else if (!memcmp_user(path, "status", 7)) {
 			const char *status = p->state == PROC_RUNNING ? "running" : "sleeping";
-			memcpy(buf, status + offset, count);
+			memcpy_user(buf, status + offset, count);
 			return count;
-		} else if (!memcmp(path, "msg", 4)) {
+		} else if (!memcmp_user(path, "msg", 4)) {
 			if (stack_empty(p->messages)) {
 				return -EIO; // This shouldn't happen
 			} else {
 				struct procfs_message *msg = stack_pop(p->messages);
 				if (!msg)
 					return -EIO;
-				memcpy(buf, msg->data + offset, MIN(count, msg->size));
+				memcpy_user(buf, msg->data + offset, MIN(count, msg->size));
 				free(msg->data);
 				free(msg);
 				return MIN(count, msg->size);
 			}
-		} else if (!memcmp(path, "io/", 3)) {
+		} else if (!memcmp_user(path, "io/", 3)) {
 			path += 3;
 			enum stream_defaults id = procfs_stream(path);
 			if (id == STREAM_UNKNOWN)
 				return -ENOENT;
 			struct stream *stream = &p->streams[id];
-			memcpy(buf, stream->data + stream->offset_read, count);
+			memcpy_user(buf, stream->data + stream->offset_read, count);
 			stream->offset_read += count;
 			return count;
 		}
@@ -449,11 +463,15 @@ static res procfs_block(const char *path, u32 func_ptr, struct device *dev)
 
 	if (pid) {
 		struct proc *p = proc_from_pid(pid);
-		if (!p || path[0] != '/')
+		stac();
+		if (!p || path[0] != '/') {
+			clac();
 			return -ENOENT;
+		}
+		clac();
 
 		path++;
-		if (!memcmp(path, "msg", 4)) {
+		if (!memcmp_user(path, "msg", 4)) {
 			proc_block(pid, PROC_BLOCK_MSG, func_ptr);
 			return EOK;
 		} else {
@@ -485,13 +503,17 @@ static res procfs_ready(const char *path, struct device *dev)
 
 	if (pid) {
 		struct proc *p = proc_from_pid(pid);
-		if (!p || path[0] != '/')
+		stac();
+		if (!p || path[0] != '/') {
+			clac();
 			return -ENOENT;
+		}
+		clac();
 
 		path++;
-		if (!memcmp(path, "msg", 4)) {
+		if (!memcmp_user(path, "msg", 4)) {
 			return stack_empty(p->messages) == 0;
-		} else if (!memcmp(path, "io/", 3)) {
+		} else if (!memcmp_user(path, "io/", 3)) {
 			path += 3;
 			enum stream_defaults id = procfs_stream(path);
 			if (id == STREAM_UNKNOWN)
@@ -535,7 +557,8 @@ NORETURN void proc_init(void)
 	assert(vfs_mount(dev, "/proc/") == EOK);
 
 	// Idle proc
-	struct proc *kernel_proc = proc_make(PROC_PRIV_KERNEL);
+	// TODO: Reimplement hlt privileges in idle proc (SMEP!)
+	struct proc *kernel_proc = proc_make(PROC_PRIV_NONE);
 	assert(elf_load("/bin/idle", kernel_proc) == EOK);
 	kernel_proc->state = PROC_BLOCKED;
 	kernel_proc->quantum.val = 0;
diff --git a/kernel/features/syscall.c b/kernel/features/syscall.c
index 6a64996..b5c08da 100644
--- a/kernel/features/syscall.c
+++ b/kernel/features/syscall.c
@@ -28,8 +28,8 @@ static void syscall_handler(struct regs *r)
 		break;
 	}
 	case SYS_ALLOC: {
-		r->eax = (u32)memory_sys_alloc(proc_current()->page_dir, r->ebx, (u32 *)r->ecx,
-					       (u32 *)r->edx, (u8)r->esi);
+		r->eax = memory_sys_alloc(proc_current()->page_dir, r->ebx, (u32 *)r->ecx,
+					  (u32 *)r->edx, (u8)r->esi);
 		break;
 	}
 	case SYS_FREE: {
@@ -102,7 +102,7 @@ static void syscall_handler(struct regs *r)
 		case SYS_BOOT_REBOOT:
 			print("Rebooting...\n");
 			outb(0x64, 0xfe);
-			__asm__ volatile("ud2");
+			__asm__ volatile("cli\nud2");
 			break;
 		case SYS_BOOT_SHUTDOWN:
 			print("Shutting down...\n");
@@ -110,7 +110,7 @@ static void syscall_handler(struct regs *r)
 			outw(0x604, 0x2000);
 			outw(0x4004, 0x3400);
 			outb(0x64, 0xfe);
-			__asm__ volatile("ud2");
+			__asm__ volatile("cli\nud2");
 			break;
 		default:
 			r->eax = -EINVAL;