hal: Bulletproof kernel operations on user memory#664
Conversation
![gemini-code-assist[bot]](https://avatars.githubusercontent.com/in/956858?s=60&v=4){kind=small}
There was a problem hiding this comment.
Summary of Changes
Hello @etiaro, I'm Gemini Code Assist1! I'm currently reviewing this pull request and will post my feedback shortly. In the meantime, here's a summary to help you and other reviewers quickly get up to speed!
This pull request introduces a robust exception handling mechanism within the kernel, inspired by try-catch blocks and setjmp/longjmp semantics. This mechanism is designed to safely manage operations that interact with user memory, preventing processor exceptions and improving system stability. A key application demonstrated is enhanced stack overflow handling on MMU-enabled devices.
Highlights
- Kernel Exception Handling Framework: Implemented a
setjmp/longjmp-like mechanism (hal_setexcjmp,hal_excjmp) at the hardware abstraction layer (HAL) for ARMv7-A and IA32 architectures. This allows kernel code to gracefully recover from processor exceptions (e.g., page faults) that occur during operations on user memory, providing a 'try-catch' semantic. - Thread-Specific Exception Context: Introduced a new
excjmpctxfield to thethread_tstructure and addedthreads_setexcjmp/threads_getexcjmpfunctions. This enables the storage and retrieval of a thread-local exception jump context, ensuring that exception handling is managed on a per-thread basis. - Safer Signal Handling: Modified
hal_cpuPushSignalto utilize the new exception handling framework. This change protects the operations involved in setting up signal contexts against potential memory faults, returning an-EFAULTerror if a fault occurs, which then leads to the termination of the affected process inthreads_setupUserReturn. - Internal Code Refactoring: Replaced all internal calls to the static
_proc_currentfunction with the publicproc_currentfunction across theproc/threads.cfile, streamlining access to the current thread's context.
Using Gemini Code Assist
The full guide for Gemini Code Assist can be found on our documentation page, here are some quick tips.
Invoking Gemini
You can request assistance from Gemini at any point in your pull request via creating an issue comment (i.e. comment on the pull request page) using either /gemini <command> or @gemini-code-assist <command>. Below is a summary of the supported commands.
| Feature | Command | Description |
|---|---|---|
| Code Review | /gemini review |
Performs a code review for the current pull request in its current state. |
| Pull Request Summary | /gemini summary |
Provides a summary of the current pull request in its current state. |
| Comment | @gemini-code-assist | Responds in comments when explicitly tagged, both in issue comments and review comments. |
| Help | /gemini help |
Displays a list of available commands. |
Customization
To customize Gemini Code Assist for GitHub experience, repository maintainers can create a configuration file and/or provide a custom code review style guide (such as PEP-8 for Python) by creating and adding files to a .gemini/ folder in the base of the repository. Detailed instructions can be found here.
Limitations & Feedback
Gemini Code Assist is currently in preview and may make mistakes. Please leave feedback on any instances where its feedback is incorrect or counter productive. You can react with 👍 and 👎 on @gemini-code-assist comments to provide feedback.
You can also get AI-powered code generation, chat, as well as code reviews directly in the IDE at no cost with the Gemini Code Assist IDE Extension.
Footnotes
-
Review the Privacy Notices, Generative AI Prohibited Use Policy, Terms of Service, and learn how to configure Gemini Code Assist in GitHub here. Gemini can make mistakes, so double check it and use code with caution. ↩
There was a problem hiding this comment.
Code Review
The code changes introduce a mechanism for handling kernel unsafe operations, similar to try-catch, using setjmp/longjmp. It includes functions for setting and getting exception jump contexts, and integrates this mechanism into signal handling. The changes span multiple files, modifying assembly code, header files, and C code to implement this new exception handling feature.
3c8b5ff to
1472edb
Compare
etiaro
changed the title
etiaro
changed the title
1472edb to
a1498e6
Compare
10c64c7 to
331849c
Compare
etiaro
changed the title
331849c to
8bd2ac3
Compare
etiaro
changed the title
8bd2ac3 to
6cabf93
Compare
![github-actions[bot]](https://avatars.githubusercontent.com/in/15368?s=60&v=4){kind=small}
Introduce usermem module with functions for safe operations on user memory. TASK: RTOS-1141
6cabf93 to
c01d05e
Compare
Introduce checks for read/write access to memory pointed to in syscall arguments. TASK: RTOS-1141
TBD: implement in all syscalls
c01d05e to
31f1c4c
Compare
2 participants
Description
Inspired by BSD/openQNX exception handling routines, this draft introduces a mechanism with semantics similar to try - catch and based on idea similar to setjmp/longjmp by introducing
hal_createexcjmpthat prepares "try-catch" context to be saved in TCBthreads_setexcjmp/threads_getexcjmpwhich manages access to dedicatedthread_tstruct fieldIntroduced a few basic function and preprocessor macro for easy and safe use of this exception handling mechanism.
On NOMMU targets, thanks to fixed configuration of accessible memory, simple access checks are good enough. That being said protection (R/W/E) checks are included in this PR to ensure no illegal accesses via kernel.
Motivation and Context
There are some events in kernel code that require operating on user's memory., which is vulnerable to TOCTOU class races.
There's no good way to ensure such memory operations won't trigger a processor exception apart from interrupting all threads that could access that memory fragment.
These mechanisms can also be used in the future to gently handle user stackoverflows and faulty signal trampolines that currently can become a cascade of kernel exceptions.
Types of changes
How Has This Been Tested?
Checklist:
Special treatment