User pointers: copyin, copyout, arguments

1warm-upChoose one

cat calls open("README", 0), and in the kernel the saved a0 is 0x3fe0, the address of the string in cat’s memory. Why can’t sys_open simply cast that number to char * and read the name through it?

User pages may be out on disk, and only copyinstr knows how to bring them back.The hart is running on the kernel page table, where 0x3fe0 is not cat’s memory; the address only has a meaning in cat’s own page table.argaddr has already copied the string into the kernel, so reading it again would be wasted work.0x3fe0 is a physical address, and kernel code can only use virtual addresses.

2warm-upChoose all that apply

A user program passes garbage in every argument register. Which of these functions reject a bad user-supplied value themselves, by returning -1?

3warm-upClick the line

cat’s page table maps the trapframe page and the stack guard page, both without PTE_U. Click the line in walkaddr that stops the kernel from copying into or out of such pages on a user’s behalf.

kernel/vm.c

118// Look up a virtual address, return the physical address,
119// or 0 if not mapped.
120// Can only be used to look up user pages.
121uint64
122walkaddr(pagetable_t pagetable, uint64 va)
123{
124  pte_t *pte;
125  uint64 pa;
126
127  if (va >= MAXVA)
128    return 0;
129
130  pte = walk(pagetable, va, 0);
131  if (pte == 0)
132    return 0;
133  if ((*pte & PTE_V) == 0)
134    return 0;
135  if ((*pte & PTE_U) == 0)
136    return 0;
137  pa = PTE2PA(*pte);
138  return pa;
139}

Your pick: none yet (click a line in the code)

4solidType a number

sys_open calls argstr(0, path, MAXPATH) with char path[MAXPATH] and MAXPATH = 128. What is the longest path, in characters not counting the NUL, that this call accepts?

kernel/vm.c

411int
412copyinstr(pagetable_t pagetable, uint64 psz, char *dst, uint64 srcva,
        uint64 max)
414{
uint64 n, va0, pa0;
int got_null = 0;
417
while (got_null == 0 && max > 0) {
  va0 = PGROUNDDOWN(srcva);
  pa0 = walkaddr(pagetable, va0);
  if (pa0 == 0) {
    if ((pa0 = vmfault(pagetable, psz, va0, 1)) == 0) {
      return -1;
    }
  }
  n = PGSIZE - (srcva - va0);
  if (n > max)
    n = max;
429
  char *p = (char *)(pa0 + (srcva - va0));
  while (n > 0) {
    if (*p == '\0') {
      *dst = '\0';
      got_null = 1;
      break;
    } else {
      *dst = *p;
    }
    --n;
    --max;
    p++;
    dst++;
  }
444
  srcva = va0 + PGSIZE;
}
if (got_null) {
  return 0;
} else {
  return -1;
}
452}

decimal, 0x hex or 0b binary

5solidChoose all that apply

cat has p->sz = 0x4000, laid out as in Tour 6: System-call arguments and user pointers: code and data at 0x0000-0x1fff, the guard page at 0x2000 (mapped, no PTE_U), and the stack page at 0x3000, which holds "README\0" at 0x3fe0 and "cat\0" at 0x3ff0. For which of these addresses, passed as the open path, does copyinstr return -1?

6deepChoose one

pipewrite calls copyin once per byte while holding pi->lock, a spinlock. Why is that allowed?

kernel/pipe.c

77pipewrite(struct pipe *pi, uint64 addr, int n)
78{
int i = 0;
struct proc *pr = myproc();
81
acquire(&pi->lock);
while (i < n) {
  if (pi->readopen == 0 || killed(pr)) {
    release(&pi->lock);
    return -1;
  }
  if (pi->nwrite == pi->nread + PIPESIZE) { //DOC: pipewrite-full
    wakeup(&pi->nread);
    sleep_prepare(&pi->nwrite);
    release(&pi->lock);
    sleep();
    acquire(&pi->lock);
  } else {
    char ch;
    if (copyin(pr->pagetable, pr->sz, &ch, addr + i, 1) == -1) {
      if (i == 0)
        i = -1;
      break;
    }
    pi->data[pi->nwrite++ % PIPESIZE] = ch;
    i++;
  }
}
wakeup(&pi->nread);
release(&pi->lock);
107
return i;
109}

pi->lock is really a sleep-lock, so sleeping while holding it would be fine.User memory can never be missing, so copyin cannot fail while the lock is held.copyin never sleeps; its slowest path, vmfault calling kalloc, only takes another spinlock briefly.copyin turns interrupts back on, so the lock is effectively released while it copies.

7solidTrue or false, and why

True or false: a user program can make read(fd, (char *)main, 100) overwrite its own code with file data, because the code page has PTE_U and lies below p->sz.

TrueFalse

Why?

copyout checks the leaf PTE for PTE_W (vm.c:364), and code pages are mapped by exec without PTE_W, so the copy returns -1.vmfault refuses because code pages are below the guard page.walkaddr refuses any page with PTE_X set, so code pages can never be copied to or from.

8solidPut in order

sys_open fetches its path with argstr(0, path, MAXPATH); the user passed 0x3fe0. Put these steps in the order they happen.

fetchstr returns strlen(path), which is 6
copyinstr rounds the address down to its page, va0 = 0x3000
bytes are copied from the physical page until the NUL
walkaddr checks the leaf PTE for PTE_V and PTE_U and returns the physical page
argaddr copies the saved a0 (0x3fe0) out of the trapframe
fetchstr calls copyinstr with p->pagetable and p->sz

9warm-upChoose one

argraw returns p->trapframe->a0 and so on. Why does it read the trapframe instead of the hart’s real a0-a5 registers?

kernel/syscall.c

34static uint64
35argraw(int n)
36{
struct proc *p = myproc();
switch (n) {
case 0:
  return p->trapframe->a0;
case 1:
  return p->trapframe->a1;
case 2:
  return p->trapframe->a2;
case 3:
  return p->trapframe->a3;
case 4:
  return p->trapframe->a4;
case 5:
  return p->trapframe->a5;
}
panic("argraw");
return -1;
54}

The trapframe holds values the kernel has already checked, while the registers are untrusted.The registers have been reused since the ecall; the trapframe is the only place where the user’s values survive.Reading registers from C requires a spinlock, and the trapframe does not.The hart’s a0 holds the system-call number, so the arguments had to be moved elsewhere.

10solidFill in the machine state

cat is in open, and its hart is inside the byte-copying loop of copyinstr (no lazy page is involved). What is the state of that hart?

kernel/vm.c

  n = PGSIZE - (srcva - va0);
  if (n > max)
    n = max;
429
  char *p = (char *)(pa0 + (srcva - va0));
  while (n > 0) {
    if (*p == '\0') {
      *dst = '\0';
      got_null = 1;
      break;
    } else {
      *dst = *p;
    }
    --n;
    --max;
    p++;
    dst++;
  }
444
  srcva = va0 + PGSIZE;

Privilege modeActive stackPage table (satp)Interrupts (sstatus.SIE)noffintena

11deepFill in the machine state

A write system call on a pipe reaches pipewrite, which holds pi->lock and calls copyin on a never-touched lazy sbrk page. copyin calls vmfault, which calls kalloc. What is the hart’s state at the moment kalloc holds kmem.lock?

Privilege modeActive stackPage table (satp)Interrupts (sstatus.SIE)noffintena

12warm-upType a number

copyin is called with srcva = 0x1ff0 and len = 48. How many bytes does the first iteration of its while loop copy?

kernel/vm.c

382int
383copyin(pagetable_t pagetable, uint64 psz, char *dst, uint64 srcva, uint64 len)
384{
uint64 n, va0, pa0;
386
while (len > 0) {
  va0 = PGROUNDDOWN(srcva);
  pa0 = walkaddr(pagetable, va0);
  if (pa0 == 0) {
    if ((pa0 = vmfault(pagetable, psz, va0, 1)) == 0) {
      return -1;
    }
  }
  n = PGSIZE - (srcva - va0);
  if (n > len)
    n = len;
  memmove(dst, (void *)(pa0 + (srcva - va0)), n);
399
  len -= n;
  dst += n;
  srcva = va0 + PGSIZE;
}
return 0;
405}

decimal, 0x hex or 0b binary

13solidType a number

sys_exec collects the user’s argv into char *argv[MAXARG], with MAXARG = 32. What is the largest number of argument strings (not counting the terminating 0 pointer) that exec can accept?

kernel/sysfile.c

458uint64
459sys_exec(void)
460{
char path[MAXPATH], *argv[MAXARG];
int i;
uint64 uargv, uarg;
464
argaddr(1, &uargv);
if (argstr(0, path, MAXPATH) < 0) {
  return -1;
}
memset(argv, 0, sizeof(argv));
for (i = 0;; i++) {
  if (i >= NELEM(argv)) {
    goto bad;
  }
  if (fetchaddr(uargv + sizeof(uint64) * i, (uint64 *)&uarg) < 0) {
    goto bad;
  }
  if (uarg == 0) {
    argv[i] = 0;
    break;
  }
  argv[i] = kalloc();
  if (argv[i] == 0)
    goto bad;
  if (fetchstr(uarg, argv[i], PGSIZE) < 0)
    goto bad;
}

decimal, 0x hex or 0b binary

14warm-upMatch the pairs

Match each function with what it does.

argrawfetchaddrcopyinstreither_copyoutvmfault

15deepChoose one

lazy_copyinstr grows the heap lazily by two pages with sbrklazy(2 * PGSIZE), writes '/' to the last byte of the first page (p[4095]), and never touches the second page. Then it calls open(&p[4095], O_RDONLY). The string’s NUL would be at p[4096], on the untouched page. What happens?

user/usertests.c

2743void
2744lazy_copyinstr(char *s)
2745{
char *p = sbrk(0);
sbrk(PGSIZE - ((uint64)p % PGSIZE));
2748
p = sbrk(0);
if ((uint64)p % PGSIZE != 0) {
  printf("%s: sbrk did not align\n", s);
  exit(1);
}
2754
sbrklazy(2 * PGSIZE);
p[4095] = '/';
int fd = open(&p[4095], O_RDONLY);
if (fd < 0) {
  printf("could not open /");
  exit(1);
}

The kernel takes a page fault inside copyinstr and usertrap allocates the page.open returns -1, because walkaddr returns 0 for the second page and copyinstr gives up.The kernel panics, because the string crosses into memory that has no physical page.copyinstr’s walkaddr fails on the second page, vmfault allocates a zeroed page there, the first byte is NUL, and open(“/”) succeeds.

16deepChoose one

fetchaddr tests addr >= p->sz || addr + sizeof(uint64) > p->sz. With p->sz = 0x4000, which addr would pass the second test, even though it is outside the process, so that only the first test rejects it?

kernel/syscall.c

10// Fetch the uint64 at addr from the current process.
11int
12fetchaddr(uint64 addr, uint64 *ip)
13{
14  struct proc *p = myproc();
15  if (addr >= p->sz ||
16      addr + sizeof(uint64) > p->sz) // both tests needed, in case of overflow
17    return -1;
18  if (copyin(p->pagetable, p->sz, (char *)ip, addr, sizeof(*ip)) != 0)
19    return -1;
20  return 0;
21}

0x40000xfffffffffffffffc0x3ffc0x3ff8

17solidClick the line

A program passes copyout a buffer in heap memory it grew with lazy sbrk and has never touched. Click the line that makes the copy succeed anyway.

kernel/vm.c

341// Copy from kernel to user.
342// Copy len bytes from src to virtual address dstva in a given page table.
343// Return 0 on success, -1 on error.
344int
345copyout(pagetable_t pagetable, uint64 psz, uint64 dstva, char *src, uint64 len)
346{
347  uint64 n, va0, pa0;
348  pte_t *pte;
349
350  while (len > 0) {
351    va0 = PGROUNDDOWN(dstva);
352    if (va0 >= MAXVA)
353      return -1;
354
355    pa0 = walkaddr(pagetable, va0);
356    if (pa0 == 0) {
357      if ((pa0 = vmfault(pagetable, psz, va0, 0)) == 0) {
358        return -1;
359      }
360    }
361
362    pte = walk(pagetable, va0, 0);
363    // forbid copyout over read-only user text pages.
364    if ((*pte & PTE_W) == 0)
365      return -1;
366
367    n = PGSIZE - (dstva - va0);
368    if (n > len)
369      n = len;
370    memmove((void *)(pa0 + (dstva - va0)), src, n);
371
372    len -= n;
373    src += n;
374    dstva = va0 + PGSIZE;
375  }
376  return 0;
377}

Your pick: none yet (click a line in the code)

18deepChoose all that apply

A program calls read(fd, buf, 2048) on a regular file at offset 0 whose size is at least 2048. buf is exactly 1024 bytes below p->sz (which is page-aligned), on a page the program has already used. Which statements are true?

kernel/fs.c

509int
510readi(struct inode *ip, int user_dst, uint64 dst, uint off, uint n)
511{
uint tot, m;
struct buf *bp;
514
if (off > ip->size || off + n < off)
  return 0;
if (off + n > ip->size)
  n = ip->size - off;
519
for (tot = 0; tot < n; tot += m, off += m, dst += m) {
  uint addr = bmap(ip, off / BSIZE);
  if (addr == 0)
    break;
  bp = bread(ip->dev, addr);
  m = min(n - tot, BSIZE - off % BSIZE);
  if (either_copyout(user_dst, dst, bp->data + (off % BSIZE), m) == -1) {
    brelse(bp);
    tot = -1;
    break;
  }
  brelse(bp);
}
return tot;
534}

read returns 1024, the bytes that were copied before the failure.The first 1024 bytes of the file end up in buf.read returns -1.The kernel panics, because the copy runs past the end of the process.The file offset f->off stays 0.

19solidTrue or false, and why

True or false: walkaddr's test if (va >= MAXVA) return 0; is redundant, because vmfault would refuse such an address anyway (it is above p->sz).

kernel/vm.c

118// Look up a virtual address, return the physical address,
119// or 0 if not mapped.
120// Can only be used to look up user pages.
121uint64
122walkaddr(pagetable_t pagetable, uint64 va)
123{
124  pte_t *pte;
125  uint64 pa;
126
127  if (va >= MAXVA)
128    return 0;
129
130  pte = walk(pagetable, va, 0);
131  if (pte == 0)
132    return 0;
133  if ((*pte & PTE_V) == 0)
134    return 0;
135  if ((*pte & PTE_U) == 0)
136    return 0;
137  pa = PTE2PA(*pte);
138  return pa;
139}

TrueFalse

Why?

Addresses at or above MAXVA are valid user addresses, and the test makes walkaddr translate them correctly.vmfault does not look at p->sz, so it would allocate a page at such an address.walkaddr next calls walk, and walk panics on va >= MAXVA; the test must come first so a user-chosen address can never panic the kernel.

20warm-upChoose one

When copyin translates a user address, which page table does it walk?

The process’s own page table, passed in as the pagetable argument (p->pagetable).The table in satp, which the hart is currently using.A combined table that maps both kernel and user memory.None; in the kernel, user addresses are already physical addresses.

21warm-upChoose one

walkaddr returns a physical address pa0, and copyin then calls memmove(dst, (void *)(pa0 + (srcva - va0)), n) while the hart uses the kernel page table. Why does using a physical address as a pointer work?

kernel/vm.c

382int
383copyin(pagetable_t pagetable, uint64 psz, char *dst, uint64 srcva, uint64 len)
384{
uint64 n, va0, pa0;
386
while (len > 0) {
  va0 = PGROUNDDOWN(srcva);
  pa0 = walkaddr(pagetable, va0);
  if (pa0 == 0) {
    if ((pa0 = vmfault(pagetable, psz, va0, 1)) == 0) {
      return -1;
    }
  }
  n = PGSIZE - (srcva - va0);
  if (n > len)
    n = len;
  memmove(dst, (void *)(pa0 + (srcva - va0)), n);
399
  len -= n;
  dst += n;
  srcva = va0 + PGSIZE;
}
return 0;
405}

pa0 is really a user virtual address, which the kernel table also maps.The kernel switches satp to the user page table just for the memmove.The kernel page table maps all of RAM at virtual address = physical address, so pa0 is also a valid kernel virtual address.copyin turns paging off for the duration of the memmove.

22solidChoose one

A buggy program passes 0x2f00, inside its stack guard page, as the buffer for fstat. In copyout, walkaddr returns 0, so vmfault gets its chance. The address is below p->sz. Why doesn’t vmfault give the program a fresh page there?

kernel/vm.c

454// allocate and map user memory if process is referencing a page
455// that was lazily allocated in sys_sbrk().
456// returns 0 if va is invalid or already mapped, or if
457// out of physical memory, and physical address if successful.
458uint64
459vmfault(pagetable_t pagetable, uint64 psz, uint64 va, int read)
460{
461  uint64 mem;
462
463  if (va >= psz)
464    return 0;
465  va = PGROUNDDOWN(va);
466  if (ismapped(pagetable, va)) {
467    return 0;
468  }
469  mem = (uint64)kalloc();
470  if (mem == 0)
471    return 0;
472  memset((void *)mem, 0, PGSIZE);
473  if (mappages(pagetable, va, PGSIZE, mem, PTE_W | PTE_U | PTE_R) != 0) {
474    kfree((void *)mem);
475    return 0;
476  }
477  return mem;
478}
479
480int
481ismapped(pagetable_t pagetable, uint64 va)
482{
483  pte_t *pte = walk(pagetable, va, 0);
484  if (pte == 0) {
485    return 0;
486  }
487  if (*pte & PTE_V) {
488    return 1;
489  }
490  return 0;
491}

0x2f00 is not below p->sz; the guard page sits above the process’s size.kalloc refuses to hand out pages below the user stack.vmfault allocates only for reads (read == 1), and copyout passes 0.ismapped finds that a valid PTE already exists there (V set, U clear), so vmfault treats the page as forbidden, not lazy.

23solidDecode the bits

In one run, gdb shows the leaf PTE for cat’s guard page at 0x2000 as 0x21fc7407. Decode it.

Value: 0x21fc7407

PTE_V (bit 0)PTE_W (bit 2)PTE_U (bit 4)Physical page (PTE2PA)Does walkaddr return a physical address for 0x2000?

24solidChoose one

sys_open copies its path into char path[MAXPATH] on the kernel stack, but sys_exec copies each argument string into a whole page from kalloc. Why the difference?

kernel/sysfile.c

458uint64
459sys_exec(void)
460{
char path[MAXPATH], *argv[MAXARG];
int i;
uint64 uargv, uarg;
464
argaddr(1, &uargv);
if (argstr(0, path, MAXPATH) < 0) {
  return -1;
}
memset(argv, 0, sizeof(argv));
for (i = 0;; i++) {
  if (i >= NELEM(argv)) {
    goto bad;
  }
  if (fetchaddr(uargv + sizeof(uint64) * i, (uint64 *)&uarg) < 0) {
    goto bad;
  }
  if (uarg == 0) {
    argv[i] = 0;
    break;
  }
  argv[i] = kalloc();
  if (argv[i] == 0)
    goto bad;
  if (fetchstr(uarg, argv[i], PGSIZE) < 0)
    goto bad;
}

The kalloc pages are mapped into the new program’s address space as its argv.Each argument may be up to a page long and there may be 31 of them, far more than the one-page kernel stack can hold.copyinstr can only write to page-aligned destinations.kexec frees the process’s old memory, which would destroy strings kept on the kernel stack.

25deepChoose one

A program whose file descriptor 1 is the console calls write(1, (char *)0x80000000, 8). What does write return?

kernel/console.c

62int
63consolewrite(int user_src, uint64 src, int n)
64{
65  char buf[32]; // move batches from user space to uart.
66  int i = 0;
67
68  while (i < n) {
69    int nn = sizeof(buf);
70    if (nn > n - i)
71      nn = n - i;
72    if (either_copyin(buf, user_src, src + i, nn) == -1)
73      break;
74    uartwrite(buf, nn);
75    i += nn;
76  }
77
78  return i;
79}

08, after printing 8 bytes of kernel code-1Nothing; the kernel panics.