source: mainline/kernel/generic/src/ddi/ddi.c@ 07d4271

Last change on this file since 07d4271 was 07d4271, checked in by Jiří Zárevúcky <zarevucky.jiri@…>, 17 months ago

Fix some unsound task reference manipulation and locking

In some operations that take task ID as an argument,
there's a possibility of the task being destroyed mid-operation
and a subsequent use-after-free situation.
As a general solution, task_find_by_id() is reimplemented to
check for this situation and always return a valid strong reference.
The callers then only need to handle the reference itself, and
don't need to concern themselves with tasks_lock.

  • Property mode set to 100644
File size: 13.6 KB
RevLine 
[9a8d91b]1/*
[df4ed85]2 * Copyright (c) 2006 Jakub Jermar
[9a8d91b]3 * All rights reserved.
4 *
5 * Redistribution and use in source and binary forms, with or without
6 * modification, are permitted provided that the following conditions
7 * are met:
8 *
9 * - Redistributions of source code must retain the above copyright
10 * notice, this list of conditions and the following disclaimer.
11 * - Redistributions in binary form must reproduce the above copyright
12 * notice, this list of conditions and the following disclaimer in the
13 * documentation and/or other materials provided with the distribution.
14 * - The name of the author may not be used to endorse or promote products
15 * derived from this software without specific prior written permission.
16 *
17 * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR
18 * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES
19 * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.
20 * IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT,
21 * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
22 * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
23 * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
24 * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
25 * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
26 * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
27 */
[b45c443]28
[174156fd]29/** @addtogroup kernel_generic_ddi
[b45c443]30 * @{
31 */
[e49e234]32
[9179d0a]33/**
[b45c443]34 * @file
[e49e234]35 * @brief Device Driver Interface functions.
[9179d0a]36 *
37 * This file contains functions that comprise the Device Driver Interface.
38 * These are the functions for mapping physical memory and enabling I/O
39 * space to tasks.
40 */
[9a8d91b]41
[63e27ef]42#include <assert.h>
[9a8d91b]43#include <ddi/ddi.h>
44#include <proc/task.h>
[719a208]45#include <security/perm.h>
[9a8d91b]46#include <mm/frame.h>
47#include <mm/as.h>
[46e886f]48#include <mm/km.h>
[c6ae4c2]49#include <mm/page.h>
[373acb4]50#include <synch/mutex.h>
[e3c762cd]51#include <syscall/copy.h>
[6f7071b]52#include <adt/odict.h>
[9a8d91b]53#include <arch.h>
54#include <align.h>
55#include <errno.h>
[b169619]56#include <memw.h>
[7a0359b]57#include <trace.h>
[c6ae4c2]58#include <bitops.h>
[46e886f]59#include <arch/asm.h>
[9a8d91b]60
[6f7071b]61/** This lock protects the @c pareas ordered dictionary. */
62static mutex_t pareas_lock;
[f8ddd17]63
[6f7071b]64/** Ordered dictionary of enabled physical memory areas by base address. */
65static odict_t pareas;
66
67static void *pareas_getkey(odlink_t *);
68static int pareas_cmp(void *, void *);
[ae318d3]69
[da1bafb]70/** Initialize DDI.
71 *
72 */
[f8ddd17]73void ddi_init(void)
74{
[6f7071b]75 odict_initialize(&pareas, pareas_getkey, pareas_cmp);
76 mutex_initialize(&pareas_lock, MUTEX_PASSIVE);
77}
78
79/** Initialize physical area structure.
80 *
81 * This should always be called first on the parea structure before
82 * filling in fields and calling ddi_parea_register.
83 *
84 * @param parea Pointer to physical area structure.
85 *
86 */
87void ddi_parea_init(parea_t *parea)
88{
89 memset(parea, 0, sizeof(parea_t));
[f8ddd17]90}
91
92/** Enable piece of physical memory for mapping by physmem_map().
93 *
94 * @param parea Pointer to physical area structure.
95 *
96 */
97void ddi_parea_register(parea_t *parea)
98{
[6f7071b]99 mutex_lock(&pareas_lock);
[a35b458]100
[f8ddd17]101 /*
[e49e234]102 * We don't check for overlaps here as the kernel is pretty sane.
[f8ddd17]103 */
[6f7071b]104 odict_insert(&parea->lpareas, &pareas, NULL);
[a35b458]105
[6f7071b]106 mutex_unlock(&pareas_lock);
[f8ddd17]107}
108
[e037cf37]109/** Norify physical area has been unmapped.
110 *
111 * @param parea Physical area
112 */
113void ddi_parea_unmap_notify(parea_t *parea)
114{
115 parea->mapped = false;
116 if (parea->mapped_changed != NULL)
117 parea->mapped_changed(parea->arg);
118}
119
[8da51ad]120/** Map piece of physical memory into virtual address space of current task.
[9a8d91b]121 *
[c6ae4c2]122 * @param phys Physical address of the starting frame.
[9a8d91b]123 * @param pages Number of pages to map.
[6212095]124 * @param flags Address space area flags for the mapping.
[fbcdeb8]125 * @param virt Virtual address of the starting page.
126 * @param bound Lowest virtual address bound.
[9a8d91b]127 *
[c6ae4c2]128 * @return EOK on success.
[719a208]129 * @return EPERM if the caller lacks permissions to use this syscall.
[fbcdeb8]130 * @return EBADMEM if phys is not page aligned.
[c6ae4c2]131 * @return ENOENT if there is no task matching the specified ID or
132 * the physical address space is not enabled for mapping.
133 * @return ENOMEM if there was a problem in creating address space area.
[e49e234]134 *
[9a8d91b]135 */
[8df5f20]136_NO_TRACE static errno_t physmem_map(uintptr_t phys, size_t pages,
[fbcdeb8]137 unsigned int flags, uintptr_t *virt, uintptr_t bound)
[9a8d91b]138{
[63e27ef]139 assert(TASK);
[a35b458]140
[c6ae4c2]141 if ((phys % FRAME_SIZE) != 0)
[d7533c7]142 return EBADMEM;
[a35b458]143
[9a8d91b]144 /*
[d7533c7]145 * Unprivileged tasks are only allowed to map pareas
146 * which are explicitly marked as such.
[9a8d91b]147 */
[d7533c7]148 bool priv =
[719a208]149 ((perm_get(TASK) & PERM_MEM_MANAGER) == PERM_MEM_MANAGER);
[a35b458]150
[e49e234]151 mem_backend_data_t backend_data;
[c6ae4c2]152 backend_data.base = phys;
[e49e234]153 backend_data.frames = pages;
[c101dc0]154 backend_data.anonymous = false;
[a35b458]155
[b366a6f4]156 /*
157 * Check if the memory region is explicitly enabled
158 * for mapping by any parea structure.
159 */
[a35b458]160
[6f7071b]161 mutex_lock(&pareas_lock);
162 odlink_t *odlink = odict_find_eq(&pareas, &phys, NULL);
163 parea_t *parea = odlink != NULL ?
164 odict_get_instance(odlink, parea_t, lpareas) : NULL;
[a35b458]165
[b366a6f4]166 if ((parea != NULL) && (parea->frames >= pages)) {
167 if ((!priv) && (!parea->unpriv)) {
[6f7071b]168 mutex_unlock(&pareas_lock);
[b366a6f4]169 return EPERM;
170 }
[a35b458]171
[b366a6f4]172 goto map;
173 }
[a35b458]174
[b366a6f4]175 parea = NULL;
[6f7071b]176 mutex_unlock(&pareas_lock);
[a35b458]177
[b366a6f4]178 /*
179 * Check if the memory region is part of physical
180 * memory generally enabled for mapping.
181 */
[a35b458]182
[da1bafb]183 irq_spinlock_lock(&zones.lock, true);
[c6ae4c2]184 size_t znum = find_zone(ADDR2PFN(phys), pages, 0);
[a35b458]185
[98000fb]186 if (znum == (size_t) -1) {
[d7533c7]187 /*
188 * Frames not found in any zone
189 * -> assume it is a hardware device and allow mapping
190 * for privileged tasks.
[e49e234]191 */
[da1bafb]192 irq_spinlock_unlock(&zones.lock, true);
[a35b458]193
[d7533c7]194 if (!priv)
195 return EPERM;
[a35b458]196
[e49e234]197 goto map;
[ae318d3]198 }
[a35b458]199
[3164e3b]200 if (zones.info[znum].flags & (ZONE_FIRMWARE | ZONE_RESERVED)) {
[d7533c7]201 /*
[3164e3b]202 * Frames are part of firmware or reserved zone
[d7533c7]203 * -> allow mapping for privileged tasks.
204 */
[da1bafb]205 irq_spinlock_unlock(&zones.lock, true);
[a35b458]206
[d7533c7]207 if (!priv)
208 return EPERM;
[a35b458]209
[e49e234]210 goto map;
211 }
[a35b458]212
[da1bafb]213 irq_spinlock_unlock(&zones.lock, true);
[e49e234]214 return ENOENT;
[a35b458]215
[e49e234]216map:
[e037cf37]217 backend_data.parea = parea;
218
[fbcdeb8]219 if (!as_area_create(TASK->as, flags, FRAMES2SIZE(pages),
220 AS_AREA_ATTR_NONE, &phys_backend, &backend_data, virt, bound)) {
[9a8d91b]221 /*
[b366a6f4]222 * The address space area was not created.
[9a8d91b]223 * We report it using ENOMEM.
224 */
[a35b458]225
[b366a6f4]226 if (parea != NULL)
[6f7071b]227 mutex_unlock(&pareas_lock);
[a35b458]228
[9a8d91b]229 return ENOMEM;
230 }
[a35b458]231
[0ee077ee]232 /*
233 * Mapping is created on-demand during page fault.
234 */
[a35b458]235
[b366a6f4]236 if (parea != NULL) {
237 parea->mapped = true;
[6f7071b]238 mutex_unlock(&pareas_lock);
[b366a6f4]239 }
[a35b458]240
[b366a6f4]241 return EOK;
[9a8d91b]242}
243
[8df5f20]244_NO_TRACE static errno_t physmem_unmap(uintptr_t virt)
[fbcdeb8]245{
[63e27ef]246 assert(TASK);
[8cd680c]247
248 return as_area_destroy(TASK->as, virt);
[fbcdeb8]249}
250
251/** Wrapper for SYS_PHYSMEM_MAP syscall.
252 *
253 * @param phys Physical base address to map
254 * @param pages Number of pages
255 * @param flags Flags of newly mapped pages
256 * @param virt_ptr Destination virtual address
257 * @param bound Lowest virtual address bound.
258 *
259 * @return 0 on success, otherwise it returns error code found in errno.h
260 *
261 */
[b7fd2a0]262sys_errno_t sys_physmem_map(uintptr_t phys, size_t pages, unsigned int flags,
[5a5269d]263 uspace_ptr_uintptr_t virt_ptr, uintptr_t bound)
[fbcdeb8]264{
[bf9cb2f]265 uintptr_t virt;
[b7fd2a0]266 errno_t rc = copy_from_uspace(&virt, virt_ptr, sizeof(virt));
[bf9cb2f]267 if (rc != EOK)
268 return rc;
[a35b458]269
[bf9cb2f]270 rc = physmem_map(ALIGN_DOWN(phys, FRAME_SIZE), pages, flags, &virt,
271 bound);
[fbcdeb8]272 if (rc != EOK)
273 return rc;
[a35b458]274
[fbcdeb8]275 rc = copy_to_uspace(virt_ptr, &virt, sizeof(virt));
276 if (rc != EOK) {
[5a5269d]277 physmem_unmap(virt);
[fbcdeb8]278 return rc;
279 }
[a35b458]280
[fbcdeb8]281 return EOK;
282}
283
[b7fd2a0]284sys_errno_t sys_physmem_unmap(uintptr_t virt)
[fbcdeb8]285{
286 return physmem_unmap(virt);
287}
288
[6f7071b]289/** Get key function for the @c pareas ordered dictionary.
290 *
291 * @param odlink Link
292 * @return Pointer to base address cast as 'void *'
293 */
294static void *pareas_getkey(odlink_t *odlink)
295{
296 parea_t *parea = odict_get_instance(odlink, parea_t, lpareas);
297 return (void *) &parea->pbase;
298}
299
300/** Key comparison function for the @c pareas ordered dictionary.
301 *
302 * @param a Pointer to parea A base
303 * @param b Pointer to parea B base
304 * @return -1, 0, 1 iff base of A is less than, equal to, greater than B
305 */
306static int pareas_cmp(void *a, void *b)
307{
308 uintptr_t pa = *(uintptr_t *)a;
309 uintptr_t pb = *(uintptr_t *)b;
310
311 if (pa < pb)
312 return -1;
313 else if (pa == pb)
314 return 0;
315 else
316 return +1;
317}
318
[f52e54da]319/** Enable range of I/O space for task.
320 *
[8cd680c]321 * @param id Task ID of the destination task.
[f52e54da]322 * @param ioaddr Starting I/O address.
[8cd680c]323 * @param size Size of the enabled I/O space.
[f52e54da]324 *
[719a208]325 * @return 0 on success, EPERM if the caller lacks permissions to use this
[e49e234]326 * syscall, ENOENT if there is no task matching the specified ID.
327 *
[f52e54da]328 */
[8df5f20]329_NO_TRACE static errno_t iospace_enable(task_id_t id, uintptr_t ioaddr, size_t size)
[f52e54da]330{
331 /*
332 * Make sure the caller is authorised to make this syscall.
333 */
[719a208]334 perm_t perms = perm_get(TASK);
335 if (!(perms & PERM_IO_MANAGER))
[f52e54da]336 return EPERM;
[a35b458]337
[e49e234]338 task_t *task = task_find_by_id(id);
[a35b458]339
[07d4271]340 if (!task)
[f52e54da]341 return ENOENT;
[a35b458]342
[07d4271]343 errno_t rc = ENOENT;
344
345 irq_spinlock_lock(&task->lock, true);
[8cd680c]346
[07d4271]347 /* Check that the task belongs to the correct security context. */
348 if (container_check(CONTAINER, task->container))
349 rc = ddi_iospace_enable_arch(task, ioaddr, size);
350
351 irq_spinlock_unlock(&task->lock, true);
352 task_release(task);
[8cd680c]353 return rc;
354}
355
356/** Disable range of I/O space for task.
357 *
358 * @param id Task ID of the destination task.
359 * @param ioaddr Starting I/O address.
360 * @param size Size of the enabled I/O space.
361 *
[719a208]362 * @return 0 on success, EPERM if the caller lacks permissions to use this
[8cd680c]363 * syscall, ENOENT if there is no task matching the specified ID.
364 *
365 */
[8df5f20]366_NO_TRACE static errno_t iospace_disable(task_id_t id, uintptr_t ioaddr, size_t size)
[8cd680c]367{
368 /*
369 * Make sure the caller is authorised to make this syscall.
370 */
[719a208]371 perm_t perms = perm_get(TASK);
372 if (!(perms & PERM_IO_MANAGER))
[8cd680c]373 return EPERM;
[a35b458]374
[8cd680c]375 task_t *task = task_find_by_id(id);
[a35b458]376
[07d4271]377 if (!task)
[8cd680c]378 return ENOENT;
[a35b458]379
[07d4271]380 errno_t rc = ENOENT;
381
382 irq_spinlock_lock(&task->lock, true);
[a35b458]383
[07d4271]384 /* Check that the task belongs to the correct security context. */
385 if (container_check(CONTAINER, task->container))
386 rc = ddi_iospace_disable_arch(task, ioaddr, size);
387
388 irq_spinlock_unlock(&task->lock, true);
389 task_release(task);
[f52e54da]390 return rc;
391}
392
393/** Wrapper for SYS_ENABLE_IOSPACE syscall.
394 *
[abbc16e]395 * @param uspace_io_arg User space address of DDI argument structure.
[f52e54da]396 *
397 * @return 0 on success, otherwise it returns error code found in errno.h
[e49e234]398 *
399 */
[5a5269d]400sys_errno_t sys_iospace_enable(uspace_ptr_ddi_ioarg_t uspace_io_arg)
[f52e54da]401{
402 ddi_ioarg_t arg;
[b7fd2a0]403 errno_t rc = copy_from_uspace(&arg, uspace_io_arg, sizeof(ddi_ioarg_t));
[a53ed3a]404 if (rc != EOK)
[b7fd2a0]405 return (sys_errno_t) rc;
[a35b458]406
[b7fd2a0]407 return (sys_errno_t) iospace_enable((task_id_t) arg.task_id,
[f619ec11]408 (uintptr_t) arg.ioaddr, (size_t) arg.size);
[f52e54da]409}
[2bb8648]410
[5a5269d]411sys_errno_t sys_iospace_disable(uspace_ptr_ddi_ioarg_t uspace_io_arg)
[fbcdeb8]412{
[8cd680c]413 ddi_ioarg_t arg;
[b7fd2a0]414 errno_t rc = copy_from_uspace(&arg, uspace_io_arg, sizeof(ddi_ioarg_t));
[a53ed3a]415 if (rc != EOK)
[b7fd2a0]416 return (sys_errno_t) rc;
[8cd680c]417
[b7fd2a0]418 return (sys_errno_t) iospace_disable((task_id_t) arg.task_id,
[8cd680c]419 (uintptr_t) arg.ioaddr, (size_t) arg.size);
[fbcdeb8]420}
421
[8df5f20]422_NO_TRACE static errno_t dmamem_map(uintptr_t virt, size_t size, unsigned int map_flags,
[8cbf1c3]423 unsigned int flags, uintptr_t *phys)
[c6ae4c2]424{
[63e27ef]425 assert(TASK);
[a35b458]426
[fbcdeb8]427 // TODO: implement locking of non-anonymous mapping
428 return page_find_mapping(virt, phys);
429}
430
[8df5f20]431_NO_TRACE static errno_t dmamem_map_anonymous(size_t size, uintptr_t constraint,
[b0c2075]432 unsigned int map_flags, unsigned int flags, uintptr_t *phys,
433 uintptr_t *virt, uintptr_t bound)
[fbcdeb8]434{
[63e27ef]435 assert(TASK);
[a35b458]436
[e2a0d76]437 size_t frames = SIZE2FRAMES(size);
[14741a0]438 if (frames == 0)
439 return EINVAL;
440
[482f968]441 // FIXME: probably need to ensure that the memory is suitable for DMA
[a17cced]442 *phys = frame_alloc(frames, FRAME_ATOMIC, constraint);
[8cbf1c3]443 if (*phys == 0)
[fbcdeb8]444 return ENOMEM;
[a35b458]445
[fbcdeb8]446 mem_backend_data_t backend_data;
[8cbf1c3]447 backend_data.base = *phys;
[e2a0d76]448 backend_data.frames = frames;
[c101dc0]449 backend_data.anonymous = true;
[7d83c54]450 backend_data.parea = NULL;
[a35b458]451
[fbcdeb8]452 if (!as_area_create(TASK->as, map_flags, size,
453 AS_AREA_ATTR_NONE, &phys_backend, &backend_data, virt, bound)) {
[a17cced]454 frame_free(*phys, frames);
[fbcdeb8]455 return ENOMEM;
[c6ae4c2]456 }
[a35b458]457
[fbcdeb8]458 return EOK;
[c6ae4c2]459}
460
[8df5f20]461_NO_TRACE static errno_t dmamem_unmap(uintptr_t virt, size_t size)
[c6ae4c2]462{
463 // TODO: implement unlocking & unmap
464 return EOK;
465}
466
[8df5f20]467_NO_TRACE static errno_t dmamem_unmap_anonymous(uintptr_t virt)
[c6ae4c2]468{
[c101dc0]469 return as_area_destroy(TASK->as, virt);
[fbcdeb8]470}
471
[b7fd2a0]472sys_errno_t sys_dmamem_map(size_t size, unsigned int map_flags, unsigned int flags,
[5a5269d]473 uspace_ptr_uintptr_t phys_ptr, uspace_ptr_uintptr_t virt_ptr, uintptr_t bound)
[fbcdeb8]474{
475 if ((flags & DMAMEM_FLAGS_ANONYMOUS) == 0) {
476 /*
477 * Non-anonymous DMA mapping
478 */
[a35b458]479
[8cbf1c3]480 uintptr_t phys;
[5a5269d]481 errno_t rc = dmamem_map(virt_ptr, size, map_flags,
[fbcdeb8]482 flags, &phys);
[a35b458]483
[fbcdeb8]484 if (rc != EOK)
485 return rc;
[a35b458]486
[fbcdeb8]487 rc = copy_to_uspace(phys_ptr, &phys, sizeof(phys));
488 if (rc != EOK) {
[5a5269d]489 dmamem_unmap(virt_ptr, size);
[fbcdeb8]490 return rc;
491 }
492 } else {
493 /*
494 * Anonymous DMA mapping
495 */
[a35b458]496
[b0c2075]497 uintptr_t constraint;
[b7fd2a0]498 errno_t rc = copy_from_uspace(&constraint, phys_ptr,
[b0c2075]499 sizeof(constraint));
500 if (rc != EOK)
501 return rc;
[a35b458]502
[bf9cb2f]503 uintptr_t virt;
504 rc = copy_from_uspace(&virt, virt_ptr, sizeof(virt));
505 if (rc != EOK)
506 return rc;
[a35b458]507
[8cbf1c3]508 uintptr_t phys;
[b0c2075]509 rc = dmamem_map_anonymous(size, constraint, map_flags, flags,
[fbcdeb8]510 &phys, &virt, bound);
511 if (rc != EOK)
512 return rc;
[a35b458]513
[fbcdeb8]514 rc = copy_to_uspace(phys_ptr, &phys, sizeof(phys));
515 if (rc != EOK) {
[5a5269d]516 dmamem_unmap_anonymous(virt);
[fbcdeb8]517 return rc;
518 }
[a35b458]519
[fbcdeb8]520 rc = copy_to_uspace(virt_ptr, &virt, sizeof(virt));
521 if (rc != EOK) {
[5a5269d]522 dmamem_unmap_anonymous(virt);
[fbcdeb8]523 return rc;
524 }
[c6ae4c2]525 }
[a35b458]526
[c6ae4c2]527 return EOK;
528}
529
[b7fd2a0]530sys_errno_t sys_dmamem_unmap(uintptr_t virt, size_t size, unsigned int flags)
[c6ae4c2]531{
[fbcdeb8]532 if ((flags & DMAMEM_FLAGS_ANONYMOUS) == 0)
533 return dmamem_unmap(virt, size);
534 else
535 return dmamem_unmap_anonymous(virt);
[c6ae4c2]536}
[46e886f]537void *pio_map(void *phys, size_t size)
538{
539#ifdef IO_SPACE_BOUNDARY
540 if (phys < IO_SPACE_BOUNDARY)
541 return phys;
542#endif
543 return (void *) km_map((uintptr_t) phys, size, KM_NATURAL_ALIGNMENT,
544 PAGE_READ | PAGE_WRITE | PAGE_NOT_CACHEABLE);
545}
546
547void pio_unmap(void *phys, void *virt, size_t size)
548{
549#ifdef IO_SPACE_BOUNDARY
550 if (phys < IO_SPACE_BOUNDARY)
551 return;
552#endif
553 km_unmap((uintptr_t) virt, size);
554}
[c6ae4c2]555
[06e1e95]556/** @}
[b45c443]557 */
Note: See TracBrowser for help on using the repository browser.