fix: kernel concurrency, interrupt context, and user VA safety

kernel/src/Ipc/Ipc.hpp

@@ -63,6 +63,23 @@ namespace Ipc {
         Object* object;
     };
 
+    // Pins the object referenced by a handle for the lifetime of the snapshot.
+    // Process threads share one handle table, so a raw table lookup is not
+    // sufficient: another thread may close and destroy the object immediately
+    // after the lookup returns.
+    struct HandleSnapshot {
+        HandleType type = HandleType::None;
+        Object* object = nullptr;
+        uint32_t rights = 0;
+
+        HandleSnapshot() = default;
+        ~HandleSnapshot();
+        HandleSnapshot(const HandleSnapshot&) = delete;
+        HandleSnapshot& operator=(const HandleSnapshot&) = delete;
+
+        bool Capture(int slot, int handle);
+    };
+
     struct WaitsetReady {
         int32_t index;
         uint32_t signals;
@@ -78,7 +95,6 @@ namespace Ipc {
     int CloseHandle(int handle);
     int DupHandle(int handle);
 
-    bool SnapshotHandleForSlot(int slot, int handle, HandleType& type, Object*& object, uint32_t& rights);
     uint32_t GetHandleSignalsForSlot(int slot, int handle);
 
     Stream* CreateStream(uint32_t capacity = DefaultStreamCapacity);
@@ -139,7 +155,6 @@ namespace Ipc {
                          uint64_t& outVa, bool reserveGrowthRange = true);
     int UnmapSurfaceForPid(Surface* surface, int pid, uint64_t pml4Phys);
 
-    ProcessObject* GetProcessObject(int pid);
     int OpenProcessHandle(int pid);
     void ProcessStartedInSlot(int slot, int pid);
     void ProcessExitedInSlot(int slot, int pid);
@@ -156,6 +171,11 @@ namespace Ipc {
     int WaitsetWaitHandle(int waitsetHandle, WaitsetReady* outReady, uint64_t timeoutMs);
 
     void NotifyObjectChanged(Object* object);
+    // Invalidate a user range on every CPU currently running the address
+    // space. Call this after removing PTEs and before releasing their frames.
+    void ShootdownUserRange(uint64_t pml4Phys, uint64_t startVa, uint32_t pages);
+    // Safely remove ordinary PFA-backed user mappings and release their frames.
+    void UnmapAndFreeUserRange(uint64_t pml4Phys, uint64_t startVa, uint64_t pages);
     void CleanupProcessSlot(int slot, int pid, uint64_t pml4Phys);
 
 }