Add CapbilityPtr and Add SuccessAddr and SuccessPtr syscall variants

arch/cortex-m/src/syscall.rs

@@ -232,9 +232,9 @@ impl<A: CortexMVariant> kernel::syscall::UserspaceKernelBoundary for SysCall<A>
         //  - Stack offset 4 is R12, which the syscall interface ignores
         let stack_bottom = state.psp as *mut usize;
         ptr::write(stack_bottom.offset(7), state.psr); //......... -> APSR
-        ptr::write(stack_bottom.offset(6), callback.pc | 1); //... -> PC
+        ptr::write(stack_bottom.offset(6), usize::from(callback.pc) | 1); //... -> PC
         ptr::write(stack_bottom.offset(5), state.yield_pc | 1); // -> LR
-        ptr::write(stack_bottom.offset(3), callback.argument3); // -> R3
+        ptr::write(stack_bottom.offset(3), callback.argument3.into()); // -> R3
         ptr::write(stack_bottom.offset(2), callback.argument2); // -> R2
         ptr::write(stack_bottom.offset(1), callback.argument1); // -> R1
         ptr::write(stack_bottom.offset(0), callback.argument0); // -> R0
@@ -300,8 +300,13 @@ impl<A: CortexMVariant> kernel::syscall::UserspaceKernelBoundary for SysCall<A>
 
             // Use the helper function to convert these raw values into a Tock
             // `Syscall` type.
-            let syscall =
-                kernel::syscall::Syscall::from_register_arguments(svc_num, r0, r1, r2, r3);
+            let syscall = kernel::syscall::Syscall::from_register_arguments(
+                svc_num,
+                r0,
+                r1.into(),
+                r2.into(),
+                r3.into(),
+            );
 
             match syscall {
                 Some(s) => kernel::syscall::ContextSwitchReason::SyscallFired { syscall: s },

arch/rv32i/src/syscall.rs

@@ -195,7 +195,7 @@ impl kernel::syscall::UserspaceKernelBoundary for SysCall {
         state.regs[R_A0] = callback.argument0 as u32;
         state.regs[R_A1] = callback.argument1 as u32;
         state.regs[R_A2] = callback.argument2 as u32;
-        state.regs[R_A3] = callback.argument3 as u32;
+        state.regs[R_A3] = callback.argument3.as_ptr() as usize as u32;
 
         // We also need to set the return address (ra) register so that the new
         // function that the process is running returns to the correct location.
@@ -206,7 +206,7 @@ impl kernel::syscall::UserspaceKernelBoundary for SysCall {
         state.regs[R_RA] = state.pc;
 
         // Save the PC we expect to execute.
-        state.pc = callback.pc as u32;
+        state.pc = callback.pc.as_ptr() as usize as u32;
 
         Ok(())
     }
@@ -631,9 +631,9 @@ impl kernel::syscall::UserspaceKernelBoundary for SysCall {
                         let syscall = kernel::syscall::Syscall::from_register_arguments(
                             state.regs[R_A4] as u8,
                             state.regs[R_A0] as usize,
-                            state.regs[R_A1] as usize,
-                            state.regs[R_A2] as usize,
-                            state.regs[R_A3] as usize,
+                            (state.regs[R_A1] as usize).into(),
+                            (state.regs[R_A2] as usize).into(),
+                            (state.regs[R_A3] as usize).into(),
                         );
 
                         match syscall {

kernel/src/grant.rs

@@ -707,8 +707,8 @@ impl<'a> GrantKernelData<'a> {
 #[repr(C)]
 #[derive(Default)]
 struct SavedUpcall {
-    appdata: usize,
-    fn_ptr: Option<NonNull<()>>,
+    appdata: crate::upcall::AppdataType,
+    fn_ptr: crate::upcall::FnPtrType,
 }
 
 /// A minimal representation of a read-only allow from app, used for storing a

kernel/src/kernel.rs

@@ -9,7 +9,6 @@
 //! etc.) is defined in the `scheduler` subcrate and selected by a board.
 
 use core::cell::Cell;
-use core::ptr::NonNull;
 
 use crate::capabilities;
 use crate::config;
@@ -877,15 +876,17 @@ impl Kernel {
                             subscribe_num: subdriver_number,
                         };
 
+                        // TODO: when the compiler supports capability types bring this back
+                        // as a NonNull type.
                         // First check if `upcall_ptr` is null. A null
                         // `upcall_ptr` will result in `None` here and
                         // represents the special "unsubscribe" operation.
-                        let ptr = NonNull::new(upcall_ptr);
+                        // let ptr = NonNull::new(upcall_ptr);
 
                         // For convenience create an `Upcall` type now. This is
                         // just a data structure and doesn't do any checking or
                         // conversion.
-                        let upcall = Upcall::new(process.processid(), upcall_id, appdata, ptr);
+                        let upcall = Upcall::new(process.processid(), upcall_id, appdata, upcall_ptr);
 
                         // If `ptr` is not null, we must first verify that the
                         // upcall function pointer is within process accessible
@@ -895,8 +896,8 @@ impl Kernel {
                         // > process executable memory...), the kernel...MUST
                         // > immediately return a failure with a error code of
                         // > `INVALID`.
-                        let rval1 = ptr.and_then(|upcall_ptr_nonnull| {
-                            if !process.is_valid_upcall_function_pointer(upcall_ptr_nonnull) {
+                        let rval1 = upcall_ptr.map_or(None, |upcall_ptr_nonnull| {
+                            if !process.is_valid_upcall_function_pointer(upcall_ptr_nonnull.as_ptr()) {
                                 Some(ErrorCode::INVAL)
                             } else {
                                 None
@@ -1010,7 +1011,7 @@ impl Kernel {
                                 process.processid(),
                                 driver_number,
                                 subdriver_number,
-                                upcall_ptr as usize,
+                                upcall_ptr,
                                 appdata,
                                 rval
                             );

kernel/src/lib.rs

@@ -114,6 +114,7 @@ pub mod grant;
 pub mod hil;
 pub mod introspection;
 pub mod ipc;
+pub mod metaptr;
 pub mod platform;
 pub mod process;
 pub mod process_checker;

kernel/src/memop.rs

@@ -52,48 +52,48 @@ pub(crate) fn memop(process: &dyn Process, op_type: usize, r1: usize) -> Syscall
         // Op Type 1: SBRK
         1 => process
             .sbrk(r1 as isize)
-            .map(|addr| SyscallReturn::SuccessU32(addr as u32))
+            .map(|addr| SyscallReturn::SuccessPtr(addr))
             .unwrap_or(SyscallReturn::Failure(ErrorCode::NOMEM)),
 
         // Op Type 2: Process memory start
-        2 => SyscallReturn::SuccessU32(process.get_addresses().sram_start as u32),
+        2 => SyscallReturn::SuccessUSize(process.get_addresses().sram_start),
 
         // Op Type 3: Process memory end
-        3 => SyscallReturn::SuccessU32(process.get_addresses().sram_end as u32),
+        3 => SyscallReturn::SuccessUSize(process.get_addresses().sram_end),
 
         // Op Type 4: Process flash start
-        4 => SyscallReturn::SuccessU32(process.get_addresses().flash_start as u32),
+        4 => SyscallReturn::SuccessUSize(process.get_addresses().flash_start),
 
         // Op Type 5: Process flash end
-        5 => SyscallReturn::SuccessU32(process.get_addresses().flash_end as u32),
+        5 => SyscallReturn::SuccessUSize(process.get_addresses().flash_end),
 
         // Op Type 6: Grant region begin
-        6 => SyscallReturn::SuccessU32(process.get_addresses().sram_grant_start as u32),
+        6 => SyscallReturn::SuccessUSize(process.get_addresses().sram_grant_start),
 
         // Op Type 7: Number of defined writeable regions in the TBF header.
-        7 => SyscallReturn::SuccessU32(process.number_writeable_flash_regions() as u32),
+        7 => SyscallReturn::SuccessUSize(process.number_writeable_flash_regions()),
 
         // Op Type 8: The start address of the writeable region indexed by r1.
         8 => {
-            let flash_start = process.get_addresses().flash_start as u32;
+            let flash_start = process.get_addresses().flash_start;
             let (offset, size) = process.get_writeable_flash_region(r1);
             if size == 0 {
                 SyscallReturn::Failure(ErrorCode::FAIL)
             } else {
-                SyscallReturn::SuccessU32(flash_start + offset)
+                SyscallReturn::SuccessUSize(flash_start + offset)
             }
         }
 
         // Op Type 9: The end address of the writeable region indexed by r1.
         // Returns (void*) -1 on failure, meaning the selected writeable region
         // does not exist.
         9 => {
-            let flash_start = process.get_addresses().flash_start as u32;
+            let flash_start = process.get_addresses().flash_start;
             let (offset, size) = process.get_writeable_flash_region(r1);
             if size == 0 {
                 SyscallReturn::Failure(ErrorCode::FAIL)
             } else {
-                SyscallReturn::SuccessU32(flash_start + offset + size)
+                SyscallReturn::SuccessUSize(flash_start + offset + size)
             }
         }
 

kernel/src/metaptr.rs

@@ -0,0 +1,113 @@
+// Licensed under the Apache License, Version 2.0 or the MIT License.
+// SPDX-License-Identifier: Apache-2.0 OR MIT
+// Copyright Google LLC 2024.
+
+//! Defines the MetaPtr type
+
+use core::fmt::{Formatter, LowerHex, UpperHex};
+use core::ops::AddAssign;
+
+/// A pointer with target specific metadata.
+/// This should be used any time the kernel wishes to grant authority to the user, or any time
+/// the user should be required to prove validity of a pointer.
+#[derive(Default, Copy, Clone, PartialEq, Eq, PartialOrd, Ord, Hash, Debug)]
+#[repr(transparent)]
+pub struct MetaPtr {
+    ptr: usize,
+}
+
+#[derive(Copy, Clone, PartialEq)]
+pub enum MetaPermissions {
+    Any,
+    Read,
+    Write,
+    ReadWrite,
+    Execute,
+}
+
+impl From<MetaPtr> for usize {
+    #[inline]
+    fn from(from: MetaPtr) -> Self {
+        from.ptr
+    }
+}
+
+impl From<usize> for MetaPtr {
+    #[inline]
+    fn from(from: usize) -> Self {
+        Self { ptr: from }
+    }
+}
+
+impl UpperHex for MetaPtr {
+    #[inline]
+    fn fmt(&self, f: &mut Formatter<'_>) -> core::fmt::Result {
+        UpperHex::fmt(&self.ptr, f)
+    }
+}
+
+impl LowerHex for MetaPtr {
+    #[inline]
+    fn fmt(&self, f: &mut Formatter<'_>) -> core::fmt::Result {
+        LowerHex::fmt(&self.ptr, f)
+    }
+}
+
+impl AddAssign<usize> for MetaPtr {
+    #[inline]
+    fn add_assign(&mut self, rhs: usize) {
+        self.ptr.add_assign(rhs)
+    }
+}
+
+impl MetaPtr {
+    pub fn as_ptr(&self) -> *const () {
+        self.ptr as *const ()
+    }
+
+    /// Convert to a raw pointer, checking that metadata allows a particular set of permissions over
+    /// a given number of bytes.
+    /// If the metadata does not allow for this, returns null.
+    /// If no such metadata exists, this succeeds.
+    #[inline]
+    pub fn as_ptr_checked(&self, _length: usize, _perms: MetaPermissions) -> *const () {
+        self.ptr as *const ()
+    }
+
+    #[inline]
+    pub fn new_with_metadata(
+        ptr: *const (),
+        _base: usize,
+        _length: usize,
+        _perms: MetaPermissions,
+    ) -> Self {
+        Self { ptr: ptr as usize }
+    }
+
+    #[inline]
+    pub fn map_or<U, F>(&self, default: U, f: F) -> U
+    where
+        F: FnOnce(&Self) -> U,
+    {
+        if self.ptr == 0usize {
+            default
+        } else {
+            f(self)
+        }
+    }
+
+    #[inline]
+    pub fn map_or_else<U, D, F>(&self, default: D, f: F) -> U
+    where
+        D: FnOnce() -> U,
+        F: FnOnce(&Self) -> U,
+    {
+        let addr: usize = (*self).into();
+
+        if addr == 0 {
+            default()
+        } else {
+            f(self)
+        }
+    }
+}

kernel/src/process.rs

@@ -14,6 +14,7 @@ use crate::capabilities;
 use crate::errorcode::ErrorCode;
 use crate::ipc;
 use crate::kernel::Kernel;
+use crate::metaptr::MetaPtr;
 use crate::platform::mpu::{self};
 use crate::processbuffer::{ReadOnlyProcessBuffer, ReadWriteProcessBuffer};
 use crate::storage_permissions;
@@ -539,7 +540,7 @@ pub trait Process {
     ///   process's memory region.
     /// - [`Error::KernelError`] if there was an internal kernel error. This is
     ///   a bug.
-    fn brk(&self, new_break: *const u8) -> Result<*const u8, Error>;
+    fn brk(&self, new_break: *const u8) -> Result<MetaPtr, Error>;
 
     /// Change the location of the program break by `increment` bytes,
     /// reallocate the MPU region covering program memory, and return the
@@ -559,7 +560,7 @@ pub trait Process {
     ///   process's memory region.
     /// - [`Error::KernelError`] if there was an internal kernel error. This is
     ///   a bug.
-    fn sbrk(&self, increment: isize) -> Result<*const u8, Error>;
+    fn sbrk(&self, increment: isize) -> Result<MetaPtr, Error>;
 
     /// How many writeable flash regions defined in the TBF header for this
     /// process.
@@ -574,10 +575,10 @@ pub trait Process {
     ///
     /// ## Returns
     ///
-    /// A tuple containing the a `u32` of the offset from the beginning of the
-    /// process's flash region where the writeable region starts and a `u32` of
+    /// A tuple containing the a `usize` of the offset from the beginning of the
+    /// process's flash region where the writeable region starts and a `usize` of
     /// the size of the region in bytes.
-    fn get_writeable_flash_region(&self, region_index: usize) -> (u32, u32);
+    fn get_writeable_flash_region(&self, region_index: usize) -> (usize, usize);
 
     /// Debug function to update the kernel on where the stack starts for this
     /// process. Processes are not required to call this through the memop
@@ -790,7 +791,7 @@ pub trait Process {
     ///
     /// Returns `true` if the upcall function pointer is valid for this process,
     /// and `false` otherwise.
-    fn is_valid_upcall_function_pointer(&self, upcall_fn: NonNull<()>) -> bool;
+    fn is_valid_upcall_function_pointer(&self, upcall_fn: *const ()) -> bool;
 
     // functions for processes that are architecture specific
 
@@ -1078,9 +1079,9 @@ pub struct FunctionCall {
     /// The third argument to the function.
     pub argument2: usize,
     /// The fourth argument to the function.
-    pub argument3: usize,
+    pub argument3: MetaPtr,
     /// The PC of the function to execute.
-    pub pc: usize,
+    pub pc: MetaPtr,
 }
 
 /// This is similar to `FunctionCall` but for the special case of the Null