The MSR R/W scheme lets root request an arbitrary wrmsr/rdmsr on any CPU
(used by cpufreqd/thermald). A bad MSR number or reserved-bit value raises
#GP; on the raw wrmsr/rdmsr that is a kernel-mode fault that panics the
whole machine at exit_this_context (unreachable!) — i.e. root userspace can
crash the kernel. Observed on KVM: cpufreqd writing a legacy P-state MSR
(#GP in the msr IPI handler) halted the boot right before the console/login.
Add wrmsr_safe/rdmsr_safe (arch/x86_64): the faulting instruction sits in a
__wrmsr_safe_start/end (resp. rdmsr) region, and the #GP handler recognises a
fault inside those bounds and returns an error via recover_and_efault — the
same fault-recovery mechanism already used for usercopy page faults. The MSR
scheme (local path) and the cross-CPU msr IPI handler now use these and
surface EIO to the caller (IPI failures propagated via a new MsrMailbox
faulted flag) instead of panicking. 32-bit x86 keeps the raw path (untested).
Two fixes on the clean base (all boot-investigation diagnostics removed):
1. ProcScheme::kcall now accepts FileTableVerb::Resize on filetable
handles as a no-op instead of returning EBADF. After the upstream
'move fd allocation into userspace' relibc refactor, FILETABLE
pre-syncs its size via a Resize call before growing; the kernel
already grows posix_fdtbl on insert. Returning EBADF broke add_posix
once a process's fd table grew (notably the bootstrap process manager
proxying child thread ops), making the child's regs/env dup fail and
its ld.so panic, crashing initfs daemons (randd) at boot.
2. ProcUptime uses integer arithmetic instead of f64 (the kernel is
built with +soft-float; f64 in format!() breaks the build).
* Remove lots of unsafe code by initialising in the closure passed to
`call_once`
* Remove `NUMBER_OF_DOMAINS` as size can always be inferred from the
hashmap's len
* `syscall::sendfd`, now, when called with a `ContextHandle::FileTable` adds the fd to the filetable removing it from the calling process's filetable
* Files can now be added to, removed from another process, and can be duplicated using `ProcScheme::kcall`
* Files of another process with the flag O_CLOEXEC can now be closed by using `kcall`
vasilito
R Aadarsh