1 /* $NetBSD: t_user_ldt.c,v 1.6 2021/04/30 13:53:30 christos Exp $ */
2
3 /*
4 * Copyright (c) 2020 The NetBSD Foundation, Inc.
5 * All rights reserved.
6 *
7 * This code is derived from software contributed to The NetBSD Foundation
8 * by Maxime Villard.
9 *
10 * Redistribution and use in source and binary forms, with or without
11 * modification, are permitted provided that the following conditions
12 * are met:
13 * 1. Redistributions of source code must retain the above copyright
14 * notice, this list of conditions and the following disclaimer.
15 * 2. Redistributions in binary form must reproduce the above copyright
16 * notice, this list of conditions and the following disclaimer in the
17 * documentation and/or other materials provided with the distribution.
18 *
19 * THIS SOFTWARE IS PROVIDED BY THE NETBSD FOUNDATION, INC. AND CONTRIBUTORS
20 * ``AS IS'' AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED
21 * TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
22 * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE FOUNDATION OR CONTRIBUTORS
23 * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
24 * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
25 * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
26 * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
27 * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
28 * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
29 * POSSIBILITY OF SUCH DAMAGE.
30 */
31
32 #include <stdio.h>
33 #include <stdlib.h>
34 #include <string.h>
35 #include <unistd.h>
36 #include <errno.h>
37 #include <signal.h>
38
39 #include <sys/types.h>
40 #include <sys/mman.h>
41 #include <machine/segments.h>
42 #include <machine/sysarch.h>
43 #include <machine/vmparam.h>
44 #include <machine/gdt.h>
45
46 #include <atf-c.h>
47
48 static uint8_t *ldt_base;
49 static bool user_ldt_supported;
50
51 static void
user_ldt_detect(void)52 user_ldt_detect(void)
53 {
54 union descriptor desc;
55 int ret;
56
57 ret = i386_get_ldt(0, &desc, 1);
58 user_ldt_supported = (ret != -1) || (errno != ENOSYS && errno != EPERM);
59 }
60
61 static void
init_ldt_base(void)62 init_ldt_base(void)
63 {
64 ldt_base = (uint8_t *)mmap(NULL, 2 * PAGE_SIZE, PROT_READ | PROT_WRITE,
65 MAP_PRIVATE | MAP_ANON, -1, 0);
66 if (ldt_base == MAP_FAILED)
67 atf_tc_fail("mmap failed");
68 munmap(ldt_base + PAGE_SIZE, PAGE_SIZE);
69 }
70
71 static void
build_desc(union descriptor * desc,void * basep,uint32_t limit,int type,int dpl,int def32,int gran)72 build_desc(union descriptor *desc, void *basep, uint32_t limit, int type,
73 int dpl, int def32, int gran)
74 {
75 uintptr_t base = (uintptr_t)basep;
76
77 limit--;
78
79 desc->sd.sd_lolimit = limit & 0x0000ffff;
80 desc->sd.sd_lobase = base & 0x00ffffff;
81 desc->sd.sd_type = type & 0x1F;
82 desc->sd.sd_dpl = dpl & 0x3;
83 desc->sd.sd_p = 1;
84 desc->sd.sd_hilimit = (limit & 0x00ff0000) >> 16;
85 desc->sd.sd_xx = 0;
86 desc->sd.sd_def32 = def32 ? 1 : 0;
87 desc->sd.sd_gran = gran ? 1 : 0;
88 desc->sd.sd_hibase = (base & 0xff000000) >> 24;
89 }
90
91 static void
set_ds(unsigned int val)92 set_ds(unsigned int val)
93 {
94 __asm volatile("mov %0,%%ds"::"r" ((unsigned short)val));
95 }
96
97 static void
set_fs(unsigned int val)98 set_fs(unsigned int val)
99 {
100 __asm volatile("mov %0,%%fs"::"r" ((unsigned short)val));
101 }
102
103 static uint8_t __noinline
get_fs_byte(const char * addr)104 get_fs_byte(const char *addr)
105 {
106 uint8_t val;
107 __asm volatile (
108 ".globl fs_read_begin; fs_read_begin:\n"
109 "movb %%fs:%1,%0\n"
110 ".globl fs_read_end; fs_read_end:\n"
111 : "=q" (val) : "m" (*addr)
112 );
113 return val;
114 }
115
116 /* -------------------------------------------------------------------------- */
117
118 ATF_TC(filter_ops);
ATF_TC_HEAD(filter_ops,tc)119 ATF_TC_HEAD(filter_ops, tc)
120 {
121 atf_tc_set_md_var(tc, "descr",
122 "Ensure that the kernel correctly filters the descriptors");
123 }
ATF_TC_BODY(filter_ops,tc)124 ATF_TC_BODY(filter_ops, tc)
125 {
126 union descriptor desc;
127 const int forbidden_types[] = {
128 SDT_SYS286TSS,
129 SDT_SYSLDT,
130 SDT_SYS286BSY,
131 SDT_SYS286CGT,
132 SDT_SYSTASKGT,
133 SDT_SYS286IGT,
134 SDT_SYS286TGT,
135 SDT_SYSNULL2,
136 SDT_SYS386TSS,
137 SDT_SYSNULL3,
138 SDT_SYS386BSY,
139 SDT_SYS386CGT,
140 SDT_SYSNULL4,
141 SDT_SYS386IGT,
142 SDT_SYS386TGT
143 };
144 size_t i;
145
146 if (!user_ldt_supported) {
147 atf_tc_skip("USER_LDT disabled");
148 }
149
150 /* The first LDT slots should not be settable. */
151 for (i = 0; i < 10; i++) {
152 build_desc(&desc, ldt_base, PAGE_SIZE, SDT_MEMRW,
153 SEL_UPL, 1, 0);
154 ATF_REQUIRE_EQ(i386_set_ldt(i, &desc, 1), -1);
155 ATF_REQUIRE_EQ(errno, EINVAL);
156 }
157
158 /* SEL_KPL should not be allowed. */
159 build_desc(&desc, ldt_base, PAGE_SIZE, SDT_MEMRW, SEL_KPL, 1, 0);
160 ATF_REQUIRE_EQ(i386_set_ldt(256, &desc, 1), -1);
161 ATF_REQUIRE_EQ(errno, EACCES);
162
163 /* Long-mode segments should not be allowed. */
164 build_desc(&desc, ldt_base, PAGE_SIZE, SDT_MEMRW, SEL_UPL, 1, 0);
165 desc.sd.sd_xx = 0b11; /* sd_avl | sd_long */
166 ATF_REQUIRE_EQ(i386_set_ldt(256, &desc, 1), -1);
167 ATF_REQUIRE_EQ(errno, EACCES);
168
169 /* No forbidden type should be allowed. */
170 for (i = 0; i < __arraycount(forbidden_types); i++) {
171 build_desc(&desc, ldt_base, PAGE_SIZE, forbidden_types[i],
172 SEL_UPL, 1, 0);
173 ATF_REQUIRE_EQ(i386_set_ldt(256, &desc, 1), -1);
174 ATF_REQUIRE_EQ(errno, EACCES);
175 }
176
177 /* Check the slot limit. */
178 build_desc(&desc, ldt_base, PAGE_SIZE, SDT_MEMRW, SEL_UPL, 1, 0);
179 ATF_REQUIRE_EQ(i386_set_ldt(MAX_USERLDT_SLOTS-1, &desc, 1),
180 MAX_USERLDT_SLOTS-1);
181 ATF_REQUIRE_EQ(i386_set_ldt(MAX_USERLDT_SLOTS, &desc, 1), -1);
182 ATF_REQUIRE_EQ(errno, EINVAL);
183 }
184
185 /* -------------------------------------------------------------------------- */
186
187 static void
iretq_gp__gp_handler(int signo,siginfo_t * sig,void * ctx)188 iretq_gp__gp_handler(int signo, siginfo_t *sig, void *ctx)
189 {
190 ATF_REQUIRE(sig->si_signo == SIGSEGV);
191 ATF_REQUIRE(sig->si_code == SEGV_ACCERR);
192 atf_tc_pass();
193 /* NOTREACHED */
194 }
195
196 ATF_TC(iretq_gp);
ATF_TC_HEAD(iretq_gp,tc)197 ATF_TC_HEAD(iretq_gp, tc)
198 {
199 atf_tc_set_md_var(tc, "descr",
200 "Ensure that the kernel correctly handles iretq #GP faults");
201 }
ATF_TC_BODY(iretq_gp,tc)202 ATF_TC_BODY(iretq_gp, tc)
203 {
204 union descriptor desc;
205 struct sigaction act;
206
207 if (!user_ldt_supported) {
208 atf_tc_skip("USER_LDT disabled");
209 }
210
211 /* Build a desc, set %ds to it. */
212 build_desc(&desc, 0, 0xFFFFFUL, SDT_MEMRWA, SEL_UPL, 1, 1);
213 ATF_REQUIRE_EQ(i386_set_ldt(256, &desc, 1), 256);
214 set_ds(LSEL(256, SEL_UPL));
215
216 /* Register the fault handler. */
217 memset(&act, 0, sizeof(act));
218 act.sa_sigaction = iretq_gp__gp_handler;
219 act.sa_flags = SA_SIGINFO;
220 ATF_REQUIRE_EQ(sigaction(SIGSEGV, &act, NULL), 0);
221
222 /* Set NULL on %ds, iretq should fault. */
223 memset(&desc, 0, sizeof(desc));
224 ATF_REQUIRE_EQ(i386_set_ldt(256, &desc, 1), 256);
225
226 atf_tc_fail("test did not fault as expected");
227 }
228
229 /* -------------------------------------------------------------------------- */
230
231 static void
iretq_np__np_handler(int signo,siginfo_t * sig,void * ctx)232 iretq_np__np_handler(int signo, siginfo_t *sig, void *ctx)
233 {
234 ATF_REQUIRE(sig->si_signo == SIGBUS);
235 ATF_REQUIRE(sig->si_code == BUS_ADRERR);
236 atf_tc_pass();
237 /* NOTREACHED */
238 }
239
240 ATF_TC(iretq_np);
ATF_TC_HEAD(iretq_np,tc)241 ATF_TC_HEAD(iretq_np, tc)
242 {
243 atf_tc_set_md_var(tc, "descr",
244 "Ensure that the kernel correctly handles iretq #NP faults");
245 }
ATF_TC_BODY(iretq_np,tc)246 ATF_TC_BODY(iretq_np, tc)
247 {
248 union descriptor desc;
249 struct sigaction act;
250
251 if (!user_ldt_supported) {
252 atf_tc_skip("USER_LDT disabled");
253 }
254
255 /* Build a desc, set %ds to it. */
256 build_desc(&desc, 0, 0xFFFFFFFFUL, SDT_MEMRWA, SEL_UPL, 1, 1);
257 ATF_REQUIRE_EQ(i386_set_ldt(256, &desc, 1), 256);
258 set_ds(LSEL(256, SEL_UPL));
259
260 /* Register the fault handler. */
261 memset(&act, 0, sizeof(act));
262 act.sa_sigaction = iretq_np__np_handler;
263 act.sa_flags = SA_SIGINFO;
264 ATF_REQUIRE_EQ(sigaction(SIGBUS, &act, NULL), 0);
265
266 /* Set non-present on %ds, iretq should fault. */
267 desc.sd.sd_p = 0;
268 ATF_REQUIRE_EQ(i386_set_ldt(256, &desc, 1), 256);
269
270 atf_tc_fail("test did not fault as expected");
271 }
272
273 /* -------------------------------------------------------------------------- */
274
275 static volatile bool expect_crash;
276
277 static void
user_ldt__gp_handler(int signo,siginfo_t * sig,void * ctx)278 user_ldt__gp_handler(int signo, siginfo_t *sig, void *ctx)
279 {
280 ucontext_t *uctx = ctx;
281 extern uint8_t fs_read_begin;
282
283 if (!expect_crash) {
284 atf_tc_fail("unexpected #GP");
285 }
286
287 ATF_REQUIRE(sig->si_signo == SIGSEGV);
288 ATF_REQUIRE(sig->si_code == SEGV_ACCERR);
289
290 if (uctx->uc_mcontext.__gregs[_REG_EIP] != (intptr_t)&fs_read_begin) {
291 atf_tc_fail("got #GP on the wrong instruction");
292 }
293
294 set_fs(GSEL(GUDATA_SEL, SEL_UPL));
295
296 atf_tc_pass();
297 /* NOTREACHED */
298 }
299
300 ATF_TC(user_ldt);
ATF_TC_HEAD(user_ldt,tc)301 ATF_TC_HEAD(user_ldt, tc)
302 {
303 atf_tc_set_md_var(tc, "descr",
304 "Ensure that USER_LDT works as expected");
305 }
ATF_TC_BODY(user_ldt,tc)306 ATF_TC_BODY(user_ldt, tc)
307 {
308 union descriptor desc;
309 struct sigaction act;
310
311 if (!user_ldt_supported) {
312 atf_tc_skip("USER_LDT disabled");
313 }
314
315 memset(&act, 0, sizeof(act));
316 act.sa_sigaction = user_ldt__gp_handler;
317 act.sa_flags = SA_SIGINFO;
318 ATF_REQUIRE_EQ(sigaction(SIGSEGV, &act, NULL), 0);
319
320 build_desc(&desc, ldt_base, PAGE_SIZE, SDT_MEMRW, SEL_UPL, 1, 0);
321 ATF_REQUIRE_EQ(i386_set_ldt(256, &desc, 1), 256);
322
323 set_fs(LSEL(256, SEL_UPL));
324
325 ldt_base[666] = 123;
326 ldt_base[PAGE_SIZE-1] = 213;
327 __insn_barrier();
328 ATF_REQUIRE_EQ(get_fs_byte((char *)666), 123);
329 ATF_REQUIRE_EQ(get_fs_byte((char *)PAGE_SIZE-1), 213);
330
331 /* This one should fault, and it concludes our test case. */
332 expect_crash = true;
333 get_fs_byte((char *)PAGE_SIZE);
334
335 atf_tc_fail("test did not fault as expected");
336 }
337
338 /* -------------------------------------------------------------------------- */
339
ATF_TP_ADD_TCS(tp)340 ATF_TP_ADD_TCS(tp)
341 {
342 user_ldt_detect();
343 init_ldt_base();
344
345 ATF_TP_ADD_TC(tp, filter_ops);
346 ATF_TP_ADD_TC(tp, iretq_gp);
347 ATF_TP_ADD_TC(tp, iretq_np);
348 ATF_TP_ADD_TC(tp, user_ldt);
349
350 return atf_no_error();
351 }
352