mirror of
https://github.com/subhobhai943/SUB-OS.git
synced 2026-10-25 16:52:29 +00:00
subhobhai943andClaude Opus 5
ecdc5be435
SUB-OS had a syscall table and user GDT descriptors but nothing that could actually leave ring 0: lazybox and the shell run as kernel code, and syscall_handler() was never reachable from a user program. This adds the missing path end to end on x86_64. Address spaces (arch/x86_64/mm/vmspace.c) - The boot page tables identity-map the low 4 GB off PML4[0] and leave the rest empty, so userland is given its own PML4 slot (512 GiB) rather than holes punched in the kernel's 2 MB huge-page map. A process PML4 shares entry 0 with the kernel and privately owns entry 1. - Frames outside the identity map are refused rather than written through an unmapped pointer; lifting that needs a recursive map or a higher-half direct map, which is noted in the file. ELF loader (kernel/elf.c) - Validates ELF64/little-endian/ET_EXEC/machine, bounds-checks every program header against both the image and the user address range, and lays PT_LOAD segments into an address space. Frames arrive zeroed, so .bss is covered. Ring transition (arch/x86_64/cpu/usermode.asm) - user_enter() drops to ring 3 via iretq after scrubbing every GPR, and user_return() unwinds back to it when the process exits, so exec looks like a call that blocks until the program finishes. Syscalls - INT 0x80 installed at DPL 3 with the Linux x86_64 register convention. The process gets its own kernel stack for the trap, because TSS.rsp0 must not point at the stack user_enter() is standing on. - Every user pointer is range-checked before use. The process page tables are still live during a syscall, so without that check a program could pass a kernel address and have write(2) dump kernel text to the console. The new /sbin/init asserts both a wild pointer and a kernel pointer are rejected. - write(2) to stdout/stderr routes through the new console_write(), which reuses printk's routing so output reaches serial and the framebuffer console rather than only the VGA text buffer. Faults - A ring 3 exception now kills that process and reports CR2 instead of panicking the machine. Userland (userland/init/) - /sbin/init is a real freestanding static executable, linked at the user base and embedded in the kernel image by scripts/mkblob.py. It reports its pid, verifies .bss was zeroed and .data is writable, checks the two pointer rejections, and exits. aarch64 and armv8i keep building: the loader and exec path are portable, and those ports get honest vmspace stubs that fail cleanly rather than pretending to run a program with kernel privileges. Verified under QEMU: init loads at 0x80004000a0, reports pid 1, .bss zeroed, .data writable, both bad pointers rejected, and exits 0 back into the shell. Co-Authored-By: Claude Opus 5 <[email protected]> Claude-Session: https://claude.ai/code/session_0161Jh7uCEMLYEMNPsjC1LKf
68 lines
2.5 KiB
C
68 lines
2.5 KiB
C
#ifndef _MM_VMSPACE_H
|
|
#define _MM_VMSPACE_H
|
|
|
|
#include <stdint.h>
|
|
#include <stddef.h>
|
|
#include <stdbool.h>
|
|
|
|
/*
|
|
* Per-process address spaces.
|
|
*
|
|
* The boot page tables identity-map the low 4 GB with 2 MB supervisor pages
|
|
* hanging off PML4[0], and leave PML4[1..511] empty. Userland is therefore
|
|
* given its own PML4 slot rather than carving holes out of the kernel's
|
|
* identity map: a process PML4 shares entry 0 with the kernel (so ring 0 can
|
|
* still reach every kernel address after the CR3 switch) and privately owns
|
|
* entry 1, which is where every user mapping lives.
|
|
*/
|
|
#define USER_PML4_SLOT 1UL
|
|
#define USER_BASE (USER_PML4_SLOT << 39) /* 512 GiB */
|
|
#define USER_SPAN (1UL << 39) /* 512 GiB */
|
|
#define USER_LIMIT (USER_BASE + USER_SPAN)
|
|
|
|
#define USER_LOAD_BASE (USER_BASE + 0x400000UL) /* +4 MiB */
|
|
#define USER_STACK_TOP (USER_BASE + 0x08000000UL) /* +128 MiB */
|
|
#define USER_STACK_PAGES 16UL /* 64 KiB stack */
|
|
|
|
#define VM_PAGE_SIZE 4096UL
|
|
|
|
/* vmspace_map / vmspace_alloc protection flags (arch-neutral). */
|
|
#define VM_PROT_READ 0x1
|
|
#define VM_PROT_WRITE 0x2
|
|
#define VM_PROT_EXEC 0x4
|
|
#define VM_PROT_USER 0x8
|
|
|
|
typedef struct vmspace vmspace_t;
|
|
|
|
/* Create an address space that shares the kernel's mappings. NULL on OOM. */
|
|
vmspace_t* vmspace_create(void);
|
|
|
|
/* Release every page and page table the space privately owns. */
|
|
void vmspace_destroy(vmspace_t* vm);
|
|
|
|
/* Map one already-allocated physical page. Returns 0 or a negative errno. */
|
|
int vmspace_map_page(vmspace_t* vm, uint64_t virt, uint64_t phys, int prot);
|
|
|
|
/*
|
|
* Allocate zeroed physical pages and map [virt, virt+len) with them.
|
|
* `virt` and `len` need not be page aligned; the covered range is rounded out.
|
|
*/
|
|
int vmspace_alloc(vmspace_t* vm, uint64_t virt, size_t len, int prot);
|
|
|
|
/* Copy kernel memory into an already-mapped user range. */
|
|
int vmspace_write(vmspace_t* vm, uint64_t dst, const void* src, size_t len);
|
|
|
|
/* Translate a user virtual address to a physical one, or 0 if unmapped. */
|
|
uint64_t vmspace_resolve(vmspace_t* vm, uint64_t virt);
|
|
|
|
/* Install this address space on the current CPU. */
|
|
void vmspace_switch(vmspace_t* vm);
|
|
|
|
/* True when the whole range is mapped and reachable from ring 3. */
|
|
bool vmspace_range_ok(vmspace_t* vm, uint64_t virt, size_t len);
|
|
|
|
/* Pages currently charged to this address space. */
|
|
uint64_t vmspace_resident_pages(vmspace_t* vm);
|
|
|
|
#endif /* _MM_VMSPACE_H */
|