support for PSPLIM hardware overflow check register

kernel/include/sentry/managers/task.h

@@ -214,5 +214,18 @@ kstatus_t mgr_task_local_ipc_iterate(taskh_t owner, taskh_t *peer, uint8_t *idx)
  */
 secure_bool_t mgr_task_has_respawned(taskh_t t);
 
+/**
+ * @brief return the limit address of the bottom of the stack
+ *
+ * This address is useful for hardwares that support stack overflow detection,
+ * as it can be used as a stack guard limit registers.
+ *
+ * @param t task handle
+ * @param stack_limit output parameter to store the stack limit address
+ * @return K_STATUS_OKAY if the stack limit has been successfully retrieved,
+ *         K_ERROR_INVPARAM if the task handle is invalid or stack limit cannot be retrieved
+ */
+kstatus_t mgr_task_get_stack_size(const taskh_t h, size_t* stack_limit);
+
 
 #endif/*!SECURITY_MANAGER_H*/

kernel/src/arch/asm-cortex-m/handler.c

@@ -339,6 +339,13 @@ stack_frame_t *Default_SubHandler(stack_frame_t *frame)
         /* clearing the sysreturn. next job is no more syscall-preempted */
         mgr_task_clear_sysreturn(next);
     }
+#if CONFIG_ARCH_ARM_ARMV8MML
+    /* ARMv8-M Mainline support PSPLIM register to detect stack overflow */
+    size_t stack_limit = 0;
+    if (likely(mgr_task_get_stack_size(next, &stack_limit) == K_STATUS_OKAY)) {
+        asm volatile ("MSR psplim, %0" : : "r" (stack_limit) );
+    }
+#endif
     return newframe;
 }
 

kernel/src/managers/task/task_core.c

@@ -90,6 +90,37 @@ size_t mgr_task_get_text_region_size(const task_meta_t *meta)
     /* got and data in flash are excluded (no need) */
 }
 
+/*@
+   assigns \nothing;
+
+   behavior ok:
+     assumes stack_limit != \null;
+     assigns *stack_limit;
+   behavior err:
+     assumes stack_limit == \null;
+     assigns \nothing;
+
+   complete behaviors;
+   disjoint behaviors;
+*/
+kstatus_t mgr_task_get_stack_size(const taskh_t h, size_t* stack_limit)
+{
+    kstatus_t status = K_ERROR_INVPARAM;
+    task_t *tsk = task_get_from_handle(h);
+    if (unlikely(tsk == NULL)) {
+        pr_err("invalid task handle!");
+        goto err;
+    }
+    if (unlikely(stack_limit == NULL)) {
+        pr_err("invalid stack limit pointer!");
+        goto err;
+    }
+    *stack_limit = tsk->stack_limit;
+    status = K_STATUS_OKAY;
+err:
+    return status;
+}
+
 void task_dump_table(void)
 {
 #ifndef CONFIG_BUILD_TARGET_RELEASE

kernel/src/managers/task/task_core.h

@@ -128,13 +128,21 @@ typedef struct  task {
     secure_bool_t   sysretassigned; /**< a syscall has assigned a sysreturn */
     Status          sysreturn;  /**< current job syscall return */
     secure_bool_t   has_respawned;    /**< SECURE_TRUE if the task has been respawned */
+    size_t          stack_limit;   /**< stack limit address, based on metadata info */
 } task_t;
 
 
 kstatus_t task_set_job_layout(task_t * const tsk);
 
+/*@
+    assigns \nothing;
+    ensures \valid(\result);
+ */
 task_t *task_get_table(void);
 
+/*@
+    assigns \nothing;
+ */
 task_t *task_get_from_handle(taskh_t h);
 
 void task_dump_table(void);

kernel/src/managers/task/task_init.c

@@ -254,7 +254,11 @@ kstatus_t task_do_initiate_localinfo(task_meta_t const * const meta, task_t *tas
      */
     task_ctx->sp = mgr_task_initialize_sp(0UL, stack_top, (meta->s_text + meta->entrypoint_offset), meta->s_got);
 #endif
-
+    if (unlikely(stack_top < meta->stack_size)) {
+        pr_err("security invalid stack size, not mappable   ");
+        panic(PANIC_CONFIGURATION_MISMATCH);
+    }
+    task_ctx->stack_limit = stack_top - meta->stack_size;
     task_ctx->state = JOB_STATE_READY;
     task_ctx->sysretassigned = SECURE_FALSE;
     task_ctx->returncode = 0UL;