Skip to content
Permalink
Browse files

arch: arm: userspace: don't use the default stack in z_arm_do_syscall

z_arm_do_syscall is executing in privileged mode. This implies
that we shall not be allowed to use the thread's default
unprivileged stack, (i.e push to or pop from it), to avoid any
possible stack corruptions.

Note that since we execute in PRIV mode and no MPU guard or
PSPLIM register is guarding the end of the default stack, we
won't be able to detect any stack overflows.

This commit implement the above change, by forcing
z_arm_do_syscall() to FIRST switch to privileged
stack and then do all the preparations to execute
the system call.

Signed-off-by: Ioannis Glaropoulos <Ioannis.Glaropoulos@nordicsemi.no>
  • Loading branch information...
ioannisg authored and nashif committed Jun 28, 2019
1 parent f3a1270 commit da735b9c732018c0aef60279a16c8c244a4c3aa2
Showing with 39 additions and 34 deletions.
  1. +39 −34 arch/arm/core/userspace.S
@@ -174,55 +174,60 @@ SECTION_FUNC(TEXT,z_arm_userspace_enter)
*
*/
SECTION_FUNC(TEXT, z_arm_do_syscall)
/*
* r0-r5 contain arguments
* r6 contains call_id
* r8 contains original LR

/* The function is executing in privileged mode. This implies that we
* shall not be allowed to use the thread's default unprivileged stack,
* (i.e push to or pop from it), to avoid a possible stack corruption.
*
* Rationale: since we execute in PRIV mode and no MPU guard or PSPLIM
* register is guarding the end of the default stack, we won't be able
* to detect any stack overflows.
*/
ldr ip, =K_SYSCALL_BAD
cmp r6, ip
bne valid_syscall

/* BAD SYSCALL path */
/* fixup stack frame on unprivileged stack, adding ssf */
mov ip, sp
push {r4,r5,ip,lr}
b dispatch_syscall
#if defined(CONFIG_BUILTIN_STACK_GUARD)
/* clear stack pointer limit before setting the PSP */
mov ip, #0
msr PSPLIM, ip
#endif

valid_syscall:
/* setup privileged stack */
push {r6}
ldr r6, =_kernel
ldr r6, [r6, #_kernel_offset_to_current]
ldr ip, [r6, #_thread_offset_to_priv_stack_start] /* priv stack ptr */
ldr r6, =CONFIG_PRIVILEGED_STACK_SIZE
add ip, r6
pop {r6}
ldr ip, =_kernel
ldr ip, [ip, #_kernel_offset_to_current]
ldr ip, [ip, #_thread_offset_to_priv_stack_start] /* priv stack ptr */
add ip, #CONFIG_PRIVILEGED_STACK_SIZE

/* Store current SP and LR at the beginning of the priv stack */
subs ip, #8
str sp, [ip, #0]
str lr, [ip, #4]

#if defined(CONFIG_BUILTIN_STACK_GUARD)
/* clear stack pointer limit before setting the PSP */
push {r3}
mov r3, #0
msr PSPLIM, r3
pop {r3}
#endif

/* switch to privileged stack */
msr PSP, ip

#if defined(CONFIG_BUILTIN_STACK_GUARD)
/* Set stack pointer limit (needed in privileged mode) */
push {r6}
ldr r6, =_kernel
ldr r6, [r6, #_kernel_offset_to_current]
ldr r6, [r6, #_thread_offset_to_priv_stack_start] /* priv stack ptr */
msr PSPLIM, r6
pop {r6}
ldr ip, =_kernel
ldr ip, [ip, #_kernel_offset_to_current]
ldr ip, [ip, #_thread_offset_to_priv_stack_start] /* priv stack ptr */
msr PSPLIM, ip
#endif

/*
* r0-r5 contain arguments
* r6 contains call_id
* r8 contains original LR
*/
ldr ip, =K_SYSCALL_BAD
cmp r6, ip
bne valid_syscall

/* BAD SYSCALL path */
/* fixup stack frame on the privileged stack, adding ssf */
mov ip, sp
push {r4,r5,ip,lr}
b dispatch_syscall

valid_syscall:
/* push args to complete stack frame */
push {r4,r5}

0 comments on commit da735b9

Please sign in to comment.
You can’t perform that action at this time.