From 382e9bcac746b408b5b01ea2f59338428ab203dd Mon Sep 17 00:00:00 2001
From: Shell <wangxiaoyao@rt-thread.com>
Date: Fri, 24 Feb 2023 14:52:16 +0800
Subject: [rt-smart] handling kernel from accessing unmapped user stack (#6957)

[rt-smart] handling kernel from accessing unmapped user stack
---
 libcpu/risc-v/t-head/c906/stackframe.h | 6 +++++-
 libcpu/risc-v/t-head/c906/trap.c       | 5 ++++-
 libcpu/risc-v/virt64/stackframe.h      | 7 ++++---
 libcpu/risc-v/virt64/trap.c            | 5 ++++-
 4 files changed, 17 insertions(+), 6 deletions(-)

(limited to 'libcpu')

diff --git a/libcpu/risc-v/t-head/c906/stackframe.h b/libcpu/risc-v/t-head/c906/stackframe.h
index 1e191900b4..d6fd0c3c5e 100644
--- a/libcpu/risc-v/t-head/c906/stackframe.h
+++ b/libcpu/risc-v/t-head/c906/stackframe.h
@@ -13,6 +13,10 @@
 #ifndef __STACKFRAME_H__
 #define __STACKFRAME_H__
 
+#define BYTES(idx)          ((idx) * REGBYTES)
+#define FRAME_OFF_SSTATUS   BYTES(2)
+#define FRAME_OFF_SP        BYTES(32)
+
 #include "cpuport.h"
 #include "encoding.h"
 
@@ -54,7 +58,7 @@
 /**
  * The register `tp` always save/restore when context switch,
  * we call `lwp_user_setting_save` when syscall enter,
- * call `lwp_user_setting_restore` when syscall exit 
+ * call `lwp_user_setting_restore` when syscall exit
  * and modify context stack after `lwp_user_setting_restore` called
  * so that the `tp` can be the correct thread area value.
  */
diff --git a/libcpu/risc-v/t-head/c906/trap.c b/libcpu/risc-v/t-head/c906/trap.c
index aaf5be893f..2600ee0c37 100644
--- a/libcpu/risc-v/t-head/c906/trap.c
+++ b/libcpu/risc-v/t-head/c906/trap.c
@@ -277,6 +277,9 @@ static void handle_nested_trap_panic(
     rt_hw_cpu_shutdown();
 }
 
+#define IN_USER_SPACE (stval >= USER_VADDR_START && stval < USER_VADDR_TOP)
+#define PAGE_FAULT (id == EP_LOAD_PAGE_FAULT || id == EP_STORE_PAGE_FAULT)
+
 /* Trap entry */
 void handle_trap(rt_size_t scause, rt_size_t stval, rt_size_t sepc, struct rt_hw_stack_frame *sp)
 {
@@ -314,7 +317,7 @@ void handle_trap(rt_size_t scause, rt_size_t stval, rt_size_t sepc, struct rt_hw
     else
     {
 #ifdef RT_USING_SMART
-        if (!(sp->sstatus & 0x100))
+        if (!(sp->sstatus & 0x100) || (PAGE_FAULT && IN_USER_SPACE))
         {
             handle_user(scause, stval, sepc, sp);
             // if handle_user() return here, jump to u mode then
diff --git a/libcpu/risc-v/virt64/stackframe.h b/libcpu/risc-v/virt64/stackframe.h
index 5b546f01f9..550fa8947e 100644
--- a/libcpu/risc-v/virt64/stackframe.h
+++ b/libcpu/risc-v/virt64/stackframe.h
@@ -18,8 +18,9 @@
 #include "encoding.h"
 #include "ext_context.h"
 
-#define BYTES(idx) ((idx) * REGBYTES)
-#define FRAME_OFF_SSTATUS BYTES(2)
+#define BYTES(idx)          ((idx) * REGBYTES)
+#define FRAME_OFF_SSTATUS   BYTES(2)
+#define FRAME_OFF_SP        BYTES(32)
 
 #ifdef __ASSEMBLY__
 
@@ -140,7 +141,7 @@
 
 /**
  * @brief Restore All General Registers, for interrupt handling
- * 
+ *
  */
 .macro RESTORE_ALL
 
diff --git a/libcpu/risc-v/virt64/trap.c b/libcpu/risc-v/virt64/trap.c
index 7b3bafae88..b9f30ed715 100644
--- a/libcpu/risc-v/virt64/trap.c
+++ b/libcpu/risc-v/virt64/trap.c
@@ -274,6 +274,9 @@ static void handle_nested_trap_panic(
     rt_hw_cpu_shutdown();
 }
 
+#define IN_USER_SPACE (stval >= USER_VADDR_START && stval < USER_VADDR_TOP)
+#define PAGE_FAULT (id == EP_LOAD_PAGE_FAULT || id == EP_STORE_PAGE_FAULT)
+
 /* Trap entry */
 void handle_trap(rt_size_t scause, rt_size_t stval, rt_size_t sepc, struct rt_hw_stack_frame *sp)
 {
@@ -326,7 +329,7 @@ void handle_trap(rt_size_t scause, rt_size_t stval, rt_size_t sepc, struct rt_hw
             }
 #endif /* ENABLE_VECTOR */
 #ifdef RT_USING_SMART
-            if (!(sp->sstatus & 0x100))
+            if (!(sp->sstatus & 0x100) || (PAGE_FAULT && IN_USER_SPACE))
             {
                 handle_user(scause, stval, sepc, sp);
                 // if handle_user() return here, jump to u mode then
-- 
cgit v1.3.1