/*      $NetBSD: t_user_ldt.c,v 1.6 2021/04/30 13:53:30 christos Exp $  */

/*
* Copyright (c) 2020 The NetBSD Foundation, Inc.
* All rights reserved.
*
* This code is derived from software contributed to The NetBSD Foundation
* by Maxime Villard.
*
* Redistribution and use in source and binary forms, with or without
* modification, are permitted provided that the following conditions
* are met:
* 1. Redistributions of source code must retain the above copyright
*    notice, this list of conditions and the following disclaimer.
* 2. Redistributions in binary form must reproduce the above copyright
*    notice, this list of conditions and the following disclaimer in the
*    documentation and/or other materials provided with the distribution.
*
* THIS SOFTWARE IS PROVIDED BY THE NETBSD FOUNDATION, INC. AND CONTRIBUTORS
* ``AS IS'' AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED
* TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
* PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL THE FOUNDATION OR CONTRIBUTORS
* BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
* CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
* SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
* INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
* CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
* ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
* POSSIBILITY OF SUCH DAMAGE.
*/

#include <stdio.h>
#include <stdlib.h>
#include <string.h>
#include <unistd.h>
#include <errno.h>
#include <signal.h>

#include <sys/types.h>
#include <sys/mman.h>
#include <machine/segments.h>
#include <machine/sysarch.h>
#include <machine/vmparam.h>
#include <machine/gdt.h>

#include <atf-c.h>

static uint8_t *ldt_base;
static bool user_ldt_supported;

static void
user_ldt_detect(void)
{
       union descriptor desc;
       int ret;

       ret = i386_get_ldt(0, &desc, 1);
       user_ldt_supported = (ret != -1) || (errno != ENOSYS && errno != EPERM);
}

static void
init_ldt_base(void)
{
       ldt_base = (uint8_t *)mmap(NULL, 2 * PAGE_SIZE, PROT_READ | PROT_WRITE,
           MAP_PRIVATE | MAP_ANON, -1, 0);
       if (ldt_base == MAP_FAILED)
               atf_tc_fail("mmap failed");
       munmap(ldt_base + PAGE_SIZE, PAGE_SIZE);
}

static void
build_desc(union descriptor *desc, void *basep, uint32_t limit, int type,
   int dpl, int def32, int gran)
{
       uintptr_t base = (uintptr_t)basep;

       limit--;

       desc->sd.sd_lolimit = limit & 0x0000ffff;
       desc->sd.sd_lobase  = base & 0x00ffffff;
       desc->sd.sd_type    = type & 0x1F;
       desc->sd.sd_dpl     = dpl & 0x3;
       desc->sd.sd_p       = 1;
       desc->sd.sd_hilimit = (limit & 0x00ff0000) >> 16;
       desc->sd.sd_xx      = 0;
       desc->sd.sd_def32   = def32 ? 1 : 0;
       desc->sd.sd_gran    = gran ? 1 : 0;
       desc->sd.sd_hibase  = (base & 0xff000000) >> 24;
}

static void
set_ds(unsigned int val)
{
       __asm volatile("mov %0,%%ds"::"r" ((unsigned short)val));
}

static void
set_fs(unsigned int val)
{
       __asm volatile("mov %0,%%fs"::"r" ((unsigned short)val));
}

static uint8_t __noinline
get_fs_byte(const char *addr)
{
       uint8_t val;
       __asm volatile (
               ".globl fs_read_begin; fs_read_begin:\n"
               "movb %%fs:%1,%0\n"
               ".globl fs_read_end; fs_read_end:\n"
               : "=q" (val) : "m" (*addr)
       );
       return val;
}

/* -------------------------------------------------------------------------- */

ATF_TC(filter_ops);
ATF_TC_HEAD(filter_ops, tc)
{
       atf_tc_set_md_var(tc, "descr",
           "Ensure that the kernel correctly filters the descriptors");
}
ATF_TC_BODY(filter_ops, tc)
{
       union descriptor desc;
       const int forbidden_types[] = {
               SDT_SYS286TSS,
               SDT_SYSLDT,
               SDT_SYS286BSY,
               SDT_SYS286CGT,
               SDT_SYSTASKGT,
               SDT_SYS286IGT,
               SDT_SYS286TGT,
               SDT_SYSNULL2,
               SDT_SYS386TSS,
               SDT_SYSNULL3,
               SDT_SYS386BSY,
               SDT_SYS386CGT,
               SDT_SYSNULL4,
               SDT_SYS386IGT,
               SDT_SYS386TGT
       };
       size_t i;

       if (!user_ldt_supported) {
               atf_tc_skip("USER_LDT disabled");
       }

       /* The first LDT slots should not be settable. */
       for (i = 0; i < 10; i++) {
               build_desc(&desc, ldt_base, PAGE_SIZE, SDT_MEMRW,
                   SEL_UPL, 1, 0);
               ATF_REQUIRE_EQ(i386_set_ldt(i, &desc, 1), -1);
               ATF_REQUIRE_EQ(errno, EINVAL);
       }

       /* SEL_KPL should not be allowed. */
       build_desc(&desc, ldt_base, PAGE_SIZE, SDT_MEMRW, SEL_KPL, 1, 0);
       ATF_REQUIRE_EQ(i386_set_ldt(256, &desc, 1), -1);
       ATF_REQUIRE_EQ(errno, EACCES);

       /* Long-mode segments should not be allowed. */
       build_desc(&desc, ldt_base, PAGE_SIZE, SDT_MEMRW, SEL_UPL, 1, 0);
       desc.sd.sd_xx = 0b11; /* sd_avl | sd_long */
       ATF_REQUIRE_EQ(i386_set_ldt(256, &desc, 1), -1);
       ATF_REQUIRE_EQ(errno, EACCES);

       /* No forbidden type should be allowed. */
       for (i = 0; i < __arraycount(forbidden_types); i++) {
               build_desc(&desc, ldt_base, PAGE_SIZE, forbidden_types[i],
                   SEL_UPL, 1, 0);
               ATF_REQUIRE_EQ(i386_set_ldt(256, &desc, 1), -1);
               ATF_REQUIRE_EQ(errno, EACCES);
       }

       /* Check the slot limit. */
       build_desc(&desc, ldt_base, PAGE_SIZE, SDT_MEMRW, SEL_UPL, 1, 0);
       ATF_REQUIRE_EQ(i386_set_ldt(MAX_USERLDT_SLOTS-1, &desc, 1),
           MAX_USERLDT_SLOTS-1);
       ATF_REQUIRE_EQ(i386_set_ldt(MAX_USERLDT_SLOTS, &desc, 1), -1);
       ATF_REQUIRE_EQ(errno, EINVAL);
}

/* -------------------------------------------------------------------------- */

static void
iretq_gp__gp_handler(int signo, siginfo_t *sig, void *ctx)
{
       ATF_REQUIRE(sig->si_signo == SIGSEGV);
       ATF_REQUIRE(sig->si_code == SEGV_ACCERR);
       atf_tc_pass();
       /* NOTREACHED */
}

ATF_TC(iretq_gp);
ATF_TC_HEAD(iretq_gp, tc)
{
       atf_tc_set_md_var(tc, "descr",
           "Ensure that the kernel correctly handles iretq #GP faults");
}
ATF_TC_BODY(iretq_gp, tc)
{
       union descriptor desc;
       struct sigaction act;

       if (!user_ldt_supported) {
               atf_tc_skip("USER_LDT disabled");
       }

       /* Build a desc, set %ds to it. */
       build_desc(&desc, 0, 0xFFFFFUL, SDT_MEMRWA, SEL_UPL, 1, 1);
       ATF_REQUIRE_EQ(i386_set_ldt(256, &desc, 1), 256);
       set_ds(LSEL(256, SEL_UPL));

       /* Register the fault handler. */
       memset(&act, 0, sizeof(act));
       act.sa_sigaction = iretq_gp__gp_handler;
       act.sa_flags = SA_SIGINFO;
       ATF_REQUIRE_EQ(sigaction(SIGSEGV, &act, NULL), 0);

       /* Set NULL on %ds, iretq should fault. */
       memset(&desc, 0, sizeof(desc));
       ATF_REQUIRE_EQ(i386_set_ldt(256, &desc, 1), 256);

       atf_tc_fail("test did not fault as expected");
}

/* -------------------------------------------------------------------------- */

static void
iretq_np__np_handler(int signo, siginfo_t *sig, void *ctx)
{
       ATF_REQUIRE(sig->si_signo == SIGBUS);
       ATF_REQUIRE(sig->si_code == BUS_ADRERR);
       atf_tc_pass();
       /* NOTREACHED */
}

ATF_TC(iretq_np);
ATF_TC_HEAD(iretq_np, tc)
{
       atf_tc_set_md_var(tc, "descr",
           "Ensure that the kernel correctly handles iretq #NP faults");
}
ATF_TC_BODY(iretq_np, tc)
{
       union descriptor desc;
       struct sigaction act;

       if (!user_ldt_supported) {
               atf_tc_skip("USER_LDT disabled");
       }

       /* Build a desc, set %ds to it. */
       build_desc(&desc, 0, 0xFFFFFFFFUL, SDT_MEMRWA, SEL_UPL, 1, 1);
       ATF_REQUIRE_EQ(i386_set_ldt(256, &desc, 1), 256);
       set_ds(LSEL(256, SEL_UPL));

       /* Register the fault handler. */
       memset(&act, 0, sizeof(act));
       act.sa_sigaction = iretq_np__np_handler;
       act.sa_flags = SA_SIGINFO;
       ATF_REQUIRE_EQ(sigaction(SIGBUS, &act, NULL), 0);

       /* Set non-present on %ds, iretq should fault. */
       desc.sd.sd_p = 0;
       ATF_REQUIRE_EQ(i386_set_ldt(256, &desc, 1), 256);

       atf_tc_fail("test did not fault as expected");
}

/* -------------------------------------------------------------------------- */

static volatile bool expect_crash;

static void
user_ldt__gp_handler(int signo, siginfo_t *sig, void *ctx)
{
       ucontext_t *uctx = ctx;
       extern uint8_t fs_read_begin;

       if (!expect_crash) {
               atf_tc_fail("unexpected #GP");
       }

       ATF_REQUIRE(sig->si_signo == SIGSEGV);
       ATF_REQUIRE(sig->si_code == SEGV_ACCERR);

       if (uctx->uc_mcontext.__gregs[_REG_EIP] != (intptr_t)&fs_read_begin) {
               atf_tc_fail("got #GP on the wrong instruction");
       }

       set_fs(GSEL(GUDATA_SEL, SEL_UPL));

       atf_tc_pass();
       /* NOTREACHED */
}

ATF_TC(user_ldt);
ATF_TC_HEAD(user_ldt, tc)
{
       atf_tc_set_md_var(tc, "descr",
           "Ensure that USER_LDT works as expected");
}
ATF_TC_BODY(user_ldt, tc)
{
       union descriptor desc;
       struct sigaction act;

       if (!user_ldt_supported) {
               atf_tc_skip("USER_LDT disabled");
       }

       memset(&act, 0, sizeof(act));
       act.sa_sigaction = user_ldt__gp_handler;
       act.sa_flags = SA_SIGINFO;
       ATF_REQUIRE_EQ(sigaction(SIGSEGV, &act, NULL), 0);

       build_desc(&desc, ldt_base, PAGE_SIZE, SDT_MEMRW, SEL_UPL, 1, 0);
       ATF_REQUIRE_EQ(i386_set_ldt(256, &desc, 1), 256);

       set_fs(LSEL(256, SEL_UPL));

       ldt_base[666] = 123;
       ldt_base[PAGE_SIZE-1] = 213;
       __insn_barrier();
       ATF_REQUIRE_EQ(get_fs_byte((char *)666), 123);
       ATF_REQUIRE_EQ(get_fs_byte((char *)PAGE_SIZE-1), 213);

       /* This one should fault, and it concludes our test case. */
       expect_crash = true;
       get_fs_byte((char *)PAGE_SIZE);

       atf_tc_fail("test did not fault as expected");
}

/* -------------------------------------------------------------------------- */

ATF_TP_ADD_TCS(tp)
{
       user_ldt_detect();
       init_ldt_base();

       ATF_TP_ADD_TC(tp, filter_ops);
       ATF_TP_ADD_TC(tp, iretq_gp);
       ATF_TP_ADD_TC(tp, iretq_np);
       ATF_TP_ADD_TC(tp, user_ldt);

       return atf_no_error();
}

You are viewing proxied material from ftp.icm.edu.pl. The copyright of proxied material belongs to its original authors. Any comments or complaints in relation to proxied material should be directed to the original authors of the content concerned. Please see the disclaimer for more details.