t_user_ldt.c revision 1.1.2.2
1 1.1.2.2 martin /* $NetBSD: t_user_ldt.c,v 1.1.2.2 2020/04/21 18:42:47 martin Exp $ */ 2 1.1.2.2 martin 3 1.1.2.2 martin /* 4 1.1.2.2 martin * Copyright (c) 2020 The NetBSD Foundation, Inc. 5 1.1.2.2 martin * All rights reserved. 6 1.1.2.2 martin * 7 1.1.2.2 martin * This code is derived from software contributed to The NetBSD Foundation 8 1.1.2.2 martin * by Maxime Villard. 9 1.1.2.2 martin * 10 1.1.2.2 martin * Redistribution and use in source and binary forms, with or without 11 1.1.2.2 martin * modification, are permitted provided that the following conditions 12 1.1.2.2 martin * are met: 13 1.1.2.2 martin * 1. Redistributions of source code must retain the above copyright 14 1.1.2.2 martin * notice, this list of conditions and the following disclaimer. 15 1.1.2.2 martin * 2. Redistributions in binary form must reproduce the above copyright 16 1.1.2.2 martin * notice, this list of conditions and the following disclaimer in the 17 1.1.2.2 martin * documentation and/or other materials provided with the distribution. 18 1.1.2.2 martin * 19 1.1.2.2 martin * THIS SOFTWARE IS PROVIDED BY THE NETBSD FOUNDATION, INC. AND CONTRIBUTORS 20 1.1.2.2 martin * ``AS IS'' AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED 21 1.1.2.2 martin * TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR 22 1.1.2.2 martin * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE FOUNDATION OR CONTRIBUTORS 23 1.1.2.2 martin * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR 24 1.1.2.2 martin * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF 25 1.1.2.2 martin * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS 26 1.1.2.2 martin * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN 27 1.1.2.2 martin * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) 28 1.1.2.2 martin * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE 29 1.1.2.2 martin * POSSIBILITY OF SUCH DAMAGE. 30 1.1.2.2 martin */ 31 1.1.2.2 martin 32 1.1.2.2 martin #include <stdio.h> 33 1.1.2.2 martin #include <stdlib.h> 34 1.1.2.2 martin #include <string.h> 35 1.1.2.2 martin #include <unistd.h> 36 1.1.2.2 martin #include <errno.h> 37 1.1.2.2 martin #include <signal.h> 38 1.1.2.2 martin 39 1.1.2.2 martin #include <sys/types.h> 40 1.1.2.2 martin #include <sys/mman.h> 41 1.1.2.2 martin #include <machine/segments.h> 42 1.1.2.2 martin #include <machine/sysarch.h> 43 1.1.2.2 martin #include <machine/vmparam.h> 44 1.1.2.2 martin 45 1.1.2.2 martin #include <atf-c.h> 46 1.1.2.2 martin 47 1.1.2.2 martin static uint8_t *ldt_base; 48 1.1.2.2 martin static bool user_ldt_supported; 49 1.1.2.2 martin 50 1.1.2.2 martin static void 51 1.1.2.2 martin user_ldt_detect(void) 52 1.1.2.2 martin { 53 1.1.2.2 martin union descriptor desc; 54 1.1.2.2 martin int ret; 55 1.1.2.2 martin 56 1.1.2.2 martin ret = i386_get_ldt(0, &desc, 1); 57 1.1.2.2 martin user_ldt_supported = (ret != -1) || (errno != ENOTSUP); 58 1.1.2.2 martin } 59 1.1.2.2 martin 60 1.1.2.2 martin static void 61 1.1.2.2 martin init_ldt_base(void) 62 1.1.2.2 martin { 63 1.1.2.2 martin ldt_base = (uint8_t *)mmap(NULL, 2 * PAGE_SIZE, PROT_READ | PROT_WRITE, 64 1.1.2.2 martin MAP_PRIVATE | MAP_ANON, -1, 0); 65 1.1.2.2 martin if (ldt_base == MAP_FAILED) 66 1.1.2.2 martin atf_tc_fail("mmap failed"); 67 1.1.2.2 martin munmap(ldt_base + PAGE_SIZE, PAGE_SIZE); 68 1.1.2.2 martin } 69 1.1.2.2 martin 70 1.1.2.2 martin static void 71 1.1.2.2 martin build_desc(union descriptor *desc, void *basep, uint32_t limit, int type, 72 1.1.2.2 martin int dpl, int def32, int gran) 73 1.1.2.2 martin { 74 1.1.2.2 martin uintptr_t base = (uintptr_t)basep; 75 1.1.2.2 martin 76 1.1.2.2 martin limit--; 77 1.1.2.2 martin 78 1.1.2.2 martin desc->sd.sd_lolimit = limit & 0x0000ffff; 79 1.1.2.2 martin desc->sd.sd_lobase = base & 0x00ffffff; 80 1.1.2.2 martin desc->sd.sd_type = type & 0x1F; 81 1.1.2.2 martin desc->sd.sd_dpl = dpl & 0x3; 82 1.1.2.2 martin desc->sd.sd_p = 1; 83 1.1.2.2 martin desc->sd.sd_hilimit = (limit & 0x00ff0000) >> 16; 84 1.1.2.2 martin desc->sd.sd_xx = 0; 85 1.1.2.2 martin desc->sd.sd_def32 = def32 ? 1 : 0; 86 1.1.2.2 martin desc->sd.sd_gran = gran ? 1 : 0; 87 1.1.2.2 martin desc->sd.sd_hibase = (base & 0xff000000) >> 24; 88 1.1.2.2 martin } 89 1.1.2.2 martin 90 1.1.2.2 martin static void 91 1.1.2.2 martin set_fs(unsigned int val) 92 1.1.2.2 martin { 93 1.1.2.2 martin __asm volatile("mov %0,%%fs"::"r" ((unsigned short)val)); 94 1.1.2.2 martin } 95 1.1.2.2 martin 96 1.1.2.2 martin static uint8_t __noinline 97 1.1.2.2 martin get_fs_byte(const char *addr) 98 1.1.2.2 martin { 99 1.1.2.2 martin uint8_t val; 100 1.1.2.2 martin __asm volatile ( 101 1.1.2.2 martin ".globl fs_read_begin; fs_read_begin:\n" 102 1.1.2.2 martin "movb %%fs:%1,%0\n" 103 1.1.2.2 martin ".globl fs_read_end; fs_read_end:\n" 104 1.1.2.2 martin : "=q" (val) : "m" (*addr) 105 1.1.2.2 martin ); 106 1.1.2.2 martin return val; 107 1.1.2.2 martin } 108 1.1.2.2 martin 109 1.1.2.2 martin /* -------------------------------------------------------------------------- */ 110 1.1.2.2 martin 111 1.1.2.2 martin ATF_TC(filter_ops); 112 1.1.2.2 martin ATF_TC_HEAD(filter_ops, tc) 113 1.1.2.2 martin { 114 1.1.2.2 martin atf_tc_set_md_var(tc, "descr", 115 1.1.2.2 martin "Ensure that the kernel correctly filters the descriptors"); 116 1.1.2.2 martin } 117 1.1.2.2 martin ATF_TC_BODY(filter_ops, tc) 118 1.1.2.2 martin { 119 1.1.2.2 martin union descriptor desc; 120 1.1.2.2 martin const int forbidden_types[] = { 121 1.1.2.2 martin SDT_SYS286TSS, 122 1.1.2.2 martin SDT_SYSLDT, 123 1.1.2.2 martin SDT_SYS286BSY, 124 1.1.2.2 martin SDT_SYS286CGT, 125 1.1.2.2 martin SDT_SYSTASKGT, 126 1.1.2.2 martin SDT_SYS286IGT, 127 1.1.2.2 martin SDT_SYS286TGT, 128 1.1.2.2 martin SDT_SYSNULL2, 129 1.1.2.2 martin SDT_SYS386TSS, 130 1.1.2.2 martin SDT_SYSNULL3, 131 1.1.2.2 martin SDT_SYS386BSY, 132 1.1.2.2 martin SDT_SYS386CGT, 133 1.1.2.2 martin SDT_SYSNULL4, 134 1.1.2.2 martin SDT_SYS386IGT, 135 1.1.2.2 martin SDT_SYS386TGT 136 1.1.2.2 martin }; 137 1.1.2.2 martin size_t i; 138 1.1.2.2 martin 139 1.1.2.2 martin if (!user_ldt_supported) { 140 1.1.2.2 martin atf_tc_skip("USER_LDT disabled"); 141 1.1.2.2 martin } 142 1.1.2.2 martin 143 1.1.2.2 martin /* The first LDT slots should not be settable. */ 144 1.1.2.2 martin for (i = 0; i < 10; i++) { 145 1.1.2.2 martin build_desc(&desc, ldt_base, PAGE_SIZE, SDT_MEMRW, 146 1.1.2.2 martin SEL_UPL, 1, 0); 147 1.1.2.2 martin ATF_REQUIRE_EQ(i386_set_ldt(i, &desc, 1), -1); 148 1.1.2.2 martin ATF_REQUIRE_EQ(errno, EINVAL); 149 1.1.2.2 martin } 150 1.1.2.2 martin 151 1.1.2.2 martin /* SEL_KPL should not be allowed. */ 152 1.1.2.2 martin build_desc(&desc, ldt_base, PAGE_SIZE, SDT_MEMRW, SEL_KPL, 1, 0); 153 1.1.2.2 martin ATF_REQUIRE_EQ(i386_set_ldt(256, &desc, 1), -1); 154 1.1.2.2 martin ATF_REQUIRE_EQ(errno, EACCES); 155 1.1.2.2 martin 156 1.1.2.2 martin /* Long-mode segments should not be allowed. */ 157 1.1.2.2 martin build_desc(&desc, ldt_base, PAGE_SIZE, SDT_MEMRW, SEL_UPL, 1, 0); 158 1.1.2.2 martin desc.sd.sd_xx = 0b11; /* sd_avl | sd_long */ 159 1.1.2.2 martin ATF_REQUIRE_EQ(i386_set_ldt(256, &desc, 1), -1); 160 1.1.2.2 martin ATF_REQUIRE_EQ(errno, EACCES); 161 1.1.2.2 martin 162 1.1.2.2 martin /* No forbidden type should be allowed. */ 163 1.1.2.2 martin for (i = 0; i < __arraycount(forbidden_types); i++) { 164 1.1.2.2 martin build_desc(&desc, ldt_base, PAGE_SIZE, forbidden_types[i], 165 1.1.2.2 martin SEL_UPL, 1, 0); 166 1.1.2.2 martin ATF_REQUIRE_EQ(i386_set_ldt(256, &desc, 1), -1); 167 1.1.2.2 martin ATF_REQUIRE_EQ(errno, EACCES); 168 1.1.2.2 martin } 169 1.1.2.2 martin } 170 1.1.2.2 martin 171 1.1.2.2 martin /* -------------------------------------------------------------------------- */ 172 1.1.2.2 martin 173 1.1.2.2 martin static volatile bool expect_crash; 174 1.1.2.2 martin 175 1.1.2.2 martin static void 176 1.1.2.2 martin gp_handler(int signo, siginfo_t *sig, void *ctx) 177 1.1.2.2 martin { 178 1.1.2.2 martin ucontext_t *uctx = ctx; 179 1.1.2.2 martin extern uint8_t fs_read_begin; 180 1.1.2.2 martin 181 1.1.2.2 martin if (!expect_crash) { 182 1.1.2.2 martin atf_tc_fail("unexpected #GP"); 183 1.1.2.2 martin } 184 1.1.2.2 martin 185 1.1.2.2 martin ATF_REQUIRE(sig->si_signo == SIGSEGV); 186 1.1.2.2 martin ATF_REQUIRE(sig->si_code == SEGV_ACCERR); 187 1.1.2.2 martin 188 1.1.2.2 martin if (uctx->uc_mcontext.__gregs[_REG_EIP] != (intptr_t)&fs_read_begin) { 189 1.1.2.2 martin atf_tc_fail("got #GP on the wrong instruction"); 190 1.1.2.2 martin } 191 1.1.2.2 martin 192 1.1.2.2 martin set_fs(GSEL(GUDATA_SEL, SEL_UPL)); 193 1.1.2.2 martin 194 1.1.2.2 martin atf_tc_pass(); 195 1.1.2.2 martin /* NOTREACHED */ 196 1.1.2.2 martin } 197 1.1.2.2 martin 198 1.1.2.2 martin ATF_TC(user_ldt); 199 1.1.2.2 martin ATF_TC_HEAD(user_ldt, tc) 200 1.1.2.2 martin { 201 1.1.2.2 martin atf_tc_set_md_var(tc, "descr", 202 1.1.2.2 martin "Ensure that USER_LDT works as expected"); 203 1.1.2.2 martin } 204 1.1.2.2 martin ATF_TC_BODY(user_ldt, tc) 205 1.1.2.2 martin { 206 1.1.2.2 martin union descriptor desc; 207 1.1.2.2 martin struct sigaction act; 208 1.1.2.2 martin 209 1.1.2.2 martin if (!user_ldt_supported) { 210 1.1.2.2 martin atf_tc_skip("USER_LDT disabled"); 211 1.1.2.2 martin } 212 1.1.2.2 martin 213 1.1.2.2 martin memset(&act, 0, sizeof(act)); 214 1.1.2.2 martin act.sa_sigaction = gp_handler; 215 1.1.2.2 martin act.sa_flags = SA_SIGINFO; 216 1.1.2.2 martin ATF_REQUIRE_EQ(sigaction(SIGSEGV, &act, NULL), 0); 217 1.1.2.2 martin 218 1.1.2.2 martin build_desc(&desc, ldt_base, PAGE_SIZE, SDT_MEMRW, SEL_UPL, 1, 0); 219 1.1.2.2 martin ATF_REQUIRE_EQ(i386_set_ldt(256, &desc, 1), 256); 220 1.1.2.2 martin 221 1.1.2.2 martin set_fs(LSEL(256, SEL_UPL)); 222 1.1.2.2 martin 223 1.1.2.2 martin ldt_base[666] = 123; 224 1.1.2.2 martin ldt_base[PAGE_SIZE-1] = 213; 225 1.1.2.2 martin __insn_barrier(); 226 1.1.2.2 martin ATF_REQUIRE_EQ(get_fs_byte((char *)666), 123); 227 1.1.2.2 martin ATF_REQUIRE_EQ(get_fs_byte((char *)PAGE_SIZE-1), 213); 228 1.1.2.2 martin 229 1.1.2.2 martin /* This one should fault, and it concludes our test case. */ 230 1.1.2.2 martin expect_crash = true; 231 1.1.2.2 martin get_fs_byte((char *)PAGE_SIZE); 232 1.1.2.2 martin 233 1.1.2.2 martin atf_tc_fail("test did not fault as expected"); 234 1.1.2.2 martin } 235 1.1.2.2 martin 236 1.1.2.2 martin /* -------------------------------------------------------------------------- */ 237 1.1.2.2 martin 238 1.1.2.2 martin ATF_TP_ADD_TCS(tp) 239 1.1.2.2 martin { 240 1.1.2.2 martin user_ldt_detect(); 241 1.1.2.2 martin init_ldt_base(); 242 1.1.2.2 martin 243 1.1.2.2 martin ATF_TP_ADD_TC(tp, filter_ops); 244 1.1.2.2 martin ATF_TP_ADD_TC(tp, user_ldt); 245 1.1.2.2 martin 246 1.1.2.2 martin return atf_no_error(); 247 1.1.2.2 martin } 248
Indexes created Sun Oct 19 02:09:48 GMT 2025