Add ability to add iomap to TSS (take 2) #194

Restioson · 2020-10-17T07:34:08Z

I've refactored #68 to add a new method which allows you to specify IO permissions bitmap size, rather than incorporating it into the existing method. The existing method is now implemented by calling the new, unsafe method with an io permissions bitmap size of 0.

I've tested this by allowing usermode to access the first serial point and then trying to print, which does work. I'm not sure what kind of other unit tests I should write for this.

I've left out any kind of IoPermissionsBitmap structure for now, as this can be implemented on top of this change, and I'm not quite sure about the specifics (for instance, what if you don't want the full 8192 bytes?).

src/structures/gdt.rs

josephlr · 2020-10-17T10:07:22Z

src/structures/gdt.rs

+
+    /// Creates a TSS system descriptor for the given TSS, setting up the IO permissions bitmap.
+    ///
+    /// # Safety


I'm wondering if we could put enough checks here to make this method safe. We could take the IO map as a [u8] slice and then do all of the necessary checks (it's in range, byte past the end is all 1s, iomap_base is <= 0xDFFFH, etc..). We either need to do these checks or document all the requirements from the SDM in the # Safety section.

Returning a result if it fails the checks?

Either that or panic. We would need a custom error type for that (it could live in the tss module).

Btw, I've expanded on the safety requirements. I couldn't find any others than terminating 0xff byte, iomap_base <= 0xdfff, and it points to the IO map slice in the SDM, although maybe I missed some.

It might also be possible to have a TssWithIoMap struct, as discussed here, but I'm unsure how non-8192-length io permissions bitmaps should be handled. Otherwise, that could also be safe.

Later on, we could add a structure (the TssWithIoMap) to this library. That structure would make sure things stay valid (iomap_addr is correctly initialized, there's always a trailing 0xff byte, etc...) And we'd have a descriptor method on that structure that calls this method.

I think it should just check that the iomap_base is correct, and return an error if it's wrong.

Ok. I've pushed a prototype of this now.

I'm thinking over this change again, and I think it has pretty good potential to make mutation of the IO map impossible. As I understand it, it should be possible to change the IO permissions bitmap at runtime, or am I mistaken? If so, giving &'static [u8] would make any modifications instant UB. Perhaps it could take &'static [UnsafeCell<u8>] to get around this?

The first part of this conversation seems to be resolved.

I'm thinking over this change again, and I think it has pretty good potential to make mutation of the IO map impossible. As I understand it, it should be possible to change the IO permissions bitmap at runtime, or am I mistaken? If so, giving &'static [u8] would make any modifications instant UB. Perhaps it could take &'static [UnsafeCell<u8>] to get around this?

It's probably best to merge it as is and look into this in a separate PR. I'm not sure whether UnsafeCell would be enough for this or whether we need to e.g. use AtomicU8. We should ask that someone who has more knowledge of the Rust compiler.

src/structures/gdt.rs

Restioson · 2020-10-17T13:21:56Z

Maybe it would be possible to write an integration test for this wherein the kernel is dropped to userspace and tests out a few ports? I can't get the integration tests to compile though so I'm unsure how to proceed.

Restioson · 2020-10-17T13:22:43Z

Argh, I should really set up cargo fmt as a pre-commit hook or something.

josephlr · 2020-10-17T13:29:29Z

src/structures/gdt.rs

+            return Err(InvalidIoMap::TooLong { len: iomap.len() });
+        }
+
+        let base = iomap.as_ptr() as usize - tss as *const _ as usize;


We need to use wrapping_offset_from here and get an isize. We need to deal with isizes because the iomap could come before the tss, and that would also be wrong.

wrapping_offset_from doesn't exist. I think that offset_from would also be incorrect, as according to offset_from's safety contract:

The distance between the pointers, in bytes, cannot overflow an isize.

This is overflowed if TSS is higher half (say, 0xffffffff80000000) and IO permissions bitmap is lower half (say, 0x1000), I think.

I've just handled this with a manual if check.

src/structures/gdt.rs

src/structures/tss.rs

phil-opp · 2020-12-28T10:32:11Z

@josephlr Do you have time to continue your review or should I try to take over?

phil-opp · 2021-04-01T20:06:21Z

@Restioson Sorry for the long silence! It seems like @josephlr does no longer have time to review this, so I'll take a look.

phil-opp

Looks good to me, thanks a lot! This only needs a rebase, then it should be ready for merging. We can look into the modification problem in a follow-up PR.

phil-opp · 2021-04-01T21:18:21Z

src/structures/tss.rs

+
+/// The given IO permissions bitmap is invalid.
+#[derive(Debug, Copy, Clone, PartialEq, Eq)]
+pub enum InvalidIoMap {


It would be great to have a Display implementation for this struct as a quick way to print an error.

src/structures/tss.rs

src/structures/gdt.rs

phil-opp · 2021-04-01T21:29:16Z

src/structures/gdt.rs

+
+    /// Creates a TSS system descriptor for the given TSS, setting up the IO permissions bitmap.
+    ///
+    /// # Safety


The first part of this conversation seems to be resolved.

I'm thinking over this change again, and I think it has pretty good potential to make mutation of the IO map impossible. As I understand it, it should be possible to change the IO permissions bitmap at runtime, or am I mistaken? If so, giving &'static [u8] would make any modifications instant UB. Perhaps it could take &'static [UnsafeCell<u8>] to get around this?

It's probably best to merge it as is and look into this in a separate PR. I'm not sure whether UnsafeCell would be enough for this or whether we need to e.g. use AtomicU8. We should ask that someone who has more knowledge of the Rust compiler.

Restioson · 2021-04-12T11:59:36Z

Thanks for the review, I will try add the display impl and rebase it shortly! Right now I have a bit of university work to finish but hopefully soon after I can get to this.

Restioson added 2 commits October 17, 2020 09:32

Add ability to add iomap to TSS

7e01e80

formatting

290d0c6

josephlr reviewed Oct 17, 2020

View reviewed changes

josephlr mentioned this pull request Oct 17, 2020

The iomap_base of TaskStateSegment shouldn't be initialized to zero #195

Closed

Restioson added 3 commits October 17, 2020 14:29

doc & iomap limit calculation

7d2fa06

missed a cast :(

027ad7b

expand on safety requirements

ee27c96

josephlr reviewed Oct 17, 2020

View reviewed changes

src/structures/gdt.rs Outdated Show resolved Hide resolved

Restioson added 6 commits October 17, 2020 14:47

-1 after max

c8d062d

fmt

e5a6612

slice for safety

7051f97

error if base =/= expected base

780a8d6

fmt (i always forget this...)

25ce9aa

doc

7691201

fmt

fa5d40e

josephlr reviewed Oct 17, 2020

View reviewed changes

Restioson commented Oct 17, 2020

View reviewed changes

src/structures/gdt.rs Show resolved Hide resolved

handle iomap before tss

fa95830

Restioson commented Oct 17, 2020

View reviewed changes

src/structures/tss.rs Show resolved Hide resolved

phil-opp added the waiting-for-review Waiting for a review from the maintainers. label Dec 28, 2020

phil-opp approved these changes Apr 1, 2021

View reviewed changes

phil-opp added waiting-on-author Waiting for the author to act on review feedback. and removed waiting-for-review Waiting for a review from the maintainers. labels Nov 8, 2021

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Add ability to add iomap to TSS (take 2) #194

Add ability to add iomap to TSS (take 2) #194

Restioson commented Oct 17, 2020 •

edited

josephlr Oct 17, 2020

Restioson Oct 17, 2020

josephlr Oct 17, 2020

Restioson Oct 17, 2020 •

edited

Restioson Oct 17, 2020 •

edited

josephlr Oct 17, 2020

josephlr Oct 17, 2020

Restioson Oct 17, 2020

Restioson Oct 19, 2020 •

edited

phil-opp Apr 1, 2021

Restioson commented Oct 17, 2020

Restioson commented Oct 17, 2020

josephlr Oct 17, 2020

Restioson Oct 17, 2020 •

edited

Restioson Oct 17, 2020

phil-opp commented Dec 28, 2020

phil-opp commented Apr 1, 2021

phil-opp left a comment

phil-opp Apr 1, 2021

phil-opp Apr 1, 2021

Restioson commented Apr 12, 2021

Add ability to add iomap to TSS (take 2) #194

Are you sure you want to change the base?

Add ability to add iomap to TSS (take 2) #194

Conversation

Restioson commented Oct 17, 2020 • edited

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Restioson Oct 17, 2020 • edited

Choose a reason for hiding this comment

Restioson Oct 17, 2020 • edited

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Restioson Oct 19, 2020 • edited

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Restioson commented Oct 17, 2020

Restioson commented Oct 17, 2020

Choose a reason for hiding this comment

Restioson Oct 17, 2020 • edited

Choose a reason for hiding this comment

Choose a reason for hiding this comment

phil-opp commented Dec 28, 2020

phil-opp commented Apr 1, 2021

phil-opp left a comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Restioson commented Apr 12, 2021

Restioson commented Oct 17, 2020 •

edited

Restioson Oct 17, 2020 •

edited

Restioson Oct 17, 2020 •

edited

Restioson Oct 19, 2020 •

edited

Restioson Oct 17, 2020 •

edited