// K1310 native EL0 slot-reuse and overflow probe over a real child PID. use super::*; use turkos_kernel::runtime::handles::{Error, Handle, Object, Table}; use turkos_kernel::runtime::process_table::{Outcome, ProcessId}; use turkos_kernel::runtime::syscall_abi as abi; static mut OS_K1310_HANDLES: Table = Table::new(); static mut OS_K1310_STAGE: u8 = 0; fn handles() -> &'static mut Table { // Mode 53 runs on one CPU with IRQs masked and no concurrent table user. unsafe { &mut *core::ptr::addr_of_mut!(OS_K1310_HANDLES) } } fn stage() -> u8 { unsafe { read_volatile(core::ptr::addr_of!(OS_K1310_STAGE)) } } fn set_stage(value: u8) { unsafe { write_volatile(core::ptr::addr_of_mut!(OS_K1310_STAGE), value); } } const fn number(generation: u32) -> u64 { (generation as u64) << 32 | 1 } pub(super) fn begin() { unsafe { core::ptr::write(core::ptr::addr_of_mut!(OS_K1310_HANDLES), Table::new()); } set_stage(0); } pub(super) fn finish() -> Result<(), &'static str> { let snapshot = handles().snapshot(); if stage() != 18 || handles().len() != 0 || snapshot.generations != [4] || snapshot.entries != [None] { return Err("generation handle owner leak"); } Ok(()) } pub(super) fn dispatch( episode: &mut OsK1215AEl0Episode, frame: &mut os_k920_exception::Frame, process_table: &mut OsK1105Table<'_>, ) -> u64 { if frame.elr < episode.launch.user_pc || frame.elr >= episode.launch.user_pc + 4096 || !frame.elr.is_multiple_of(4) { park(); } if frame.x[7] == 3 { if episode.case != 1 || episode.calls != 1 || process_table.record(episode.pid).is_err() { park(); } let owner = episode.pid; match frame.x[8] { 18 => { let (generation, next) = match stage() { 0 => (1, 1), 3 => (2, 4), 7 => (3, 8), 13 => (4, 14), _ => park(), }; if frame.x[0] != 2 || handles().len() != 0 { park(); } let issued = handles().open(owner, Object::Channel(50 + u64::from(generation))) .unwrap_or_else(|_| park()); if issued.raw() != number(generation) || handles().len() != 1 || handles().owned(owner) != 1 { park(); } frame.x[0] = issued.raw(); set_stage(next); write_str("TURKOS/OS/K1310G-TRACE: OPEN-GEN=0x"); write_hex(generation as usize); write_str(" SLOT=0x"); write_hex(issued.slot() as usize); write_line(""); 0 } 19 => { let (expected, healthy, next) = match stage() { 1 => (1, true, 2), 4 => (1, false, 5), 5 => (2, true, 6), 8 => (1, false, 9), 9 => (2, false, 10), 10 => (3, true, 11), 14 => (4, true, 15), _ => park(), }; if frame.x[0] != number(expected) { park(); } let before = handles().snapshot(); let result = handles().channel_send(owner, Handle::from_raw(frame.x[0])); if handles().snapshot() != before { park(); } if healthy { if result != Ok(50 + u64::from(expected)) { park(); } frame.x[0] = 50 + u64::from(expected); write_line("TURKOS/OS/K1310G-TRACE: HEALTHY-CURRENT-GENERATION"); } else { if result != Err(Error::BadFd) { park(); } frame.x[0] = abi::AbiResult::Err(abi::Errno::BadFd).encode(); write_line("TURKOS/OS/K1310G-TRACE: STALE-EBADF-NO-OWNER-CHANGE"); } set_stage(next); 0 } 22 => { let (expected, next) = match stage() { 2 => (1, 3), 6 => (2, 7), 11 => (3, 12), 15 => (4, 16), _ => park(), }; if frame.x[0] != number(expected) || handles().close(owner, Handle::from_raw(frame.x[0])).is_err() || handles().len() != 0 || handles().snapshot().generations != [expected] { park(); } frame.x[0] = 0; set_stage(next); 0 } 24 => { if stage() != 12 || frame.x[0] != 0 || handles().len() != 0 { park(); } let mut overflow = Table::::with_generation_seed([u32::MAX]); let before = overflow.snapshot(); if overflow.open(owner, Object::Channel(99)) != Err(Error::IdExhausted) || overflow.snapshot() != before || overflow.len() != 0 || overflow.owned(owner) != 0 { park(); } frame.x[0] = abi::AbiResult::Err(abi::Errno::Overflow).encode(); set_stage(13); write_line("TURKOS/OS/K1310G-TRACE: GENERATION-OVERFLOW-DENIED-NO-PUBLISH"); 0 } _ => { frame.x[0] = abi::AbiResult::Err(abi::Errno::NoSys).encode(); 0 } } } else if frame.x[7] == 2 && frame.x[8] == 3 { let request = turkos_os_user_runtime_abi::decode( frame.x[7], frame.x[8], core::array::from_fn(|i| frame.x[i])) .unwrap_or_else(|_| park()); let turkos_os_user_runtime_abi::Request::Exit(code) = request else { park(); }; if episode.case == 0 { if code != 0 || episode.calls != 2 || stage() != 18 { park(); } } else if code != 42 || episode.calls != 1 || stage() != 17 || handles().owned(episode.pid) != 0 { park(); } process_table.exit_current(code).unwrap_or_else(|_| park()); let outcome = Outcome::Exited(code); if process_table.record(episode.pid).map(|r| r.outcome) != Ok(Some(outcome)) { park(); } if episode.case == 1 { if handles().close_owner(episode.pid) != 0 || handles().len() != 0 { park(); } set_stage(18); write_line("TURKOS/OS/K1310G-TRACE: CHILD-EXIT-OWNER-EMPTY"); } episode.outcome = Some(outcome); 1 } else { if frame.x[7] != abi::ABI_VERSION { park(); } let mut abi_frame = turkos_os_exceptions::exceptions::Frame::EMPTY; abi_frame.x = frame.x; let call = abi::decode_call(&abi_frame).unwrap_or_else(|_| park()); if call == abi::Call::Role { if episode.calls != 0 { park(); } episode.calls = 1; frame.x[0] = episode.case as u64; return 0; } if let abi::Call::RunChild(1) = call { if episode.case != 0 || episode.calls != 1 || stage() != 0 { park(); } return os_k1215a_run_child(episode as *mut _, frame as *mut _, episode.launch.kernel_root); } if let abi::Call::Write(request) = call { if episode.case != 1 || request.fd() != 1 || request.bytes() != 16 || stage() != 16 { park(); } let mut bytes = [0u8; 16]; process_table.copy_current_user_data(episode.pid, request.address(), &mut bytes) .unwrap_or_else(|_| park()); if &bytes != b"GEN:1,2,3;EBADF\n" { park(); } for byte in bytes { write_byte(byte); } frame.x[0] = 16; set_stage(17); write_line("TURKOS/OS/K1310G-TRACE: USER-WROTE-GENERATION-RESULT"); return 0; } park() } }