/*	$NetBSD: t_user_ldt.c,v 1.6 2021/04/30 13:53:30 christos Exp $	*/

/*
 * Copyright (c) 2020 The NetBSD Foundation, Inc.
 * All rights reserved.
 *
 * This code is derived from software contributed to The NetBSD Foundation
 * by Maxime Villard.
 *
 * Redistribution and use in source and binary forms, with or without
 * modification, are permitted provided that the following conditions
 * are met:
 * 1. Redistributions of source code must retain the above copyright
 *    notice, this list of conditions and the following disclaimer.
 * 2. Redistributions in binary form must reproduce the above copyright
 *    notice, this list of conditions and the following disclaimer in the
 *    documentation and/or other materials provided with the distribution.
 *
 * THIS SOFTWARE IS PROVIDED BY THE NETBSD FOUNDATION, INC. AND CONTRIBUTORS
 * ``AS IS'' AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED
 * TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
 * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL THE FOUNDATION OR CONTRIBUTORS
 * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
 * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
 * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
 * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
 * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
 * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
 * POSSIBILITY OF SUCH DAMAGE.
 */

#include <stdio.h>
#include <stdlib.h>
#include <string.h>
#include <unistd.h>
#include <errno.h>
#include <signal.h>

#include <sys/types.h>
#include <sys/mman.h>
#include <machine/segments.h>
#include <machine/sysarch.h>
#include <machine/vmparam.h>
#include <machine/gdt.h>

#include <atf-c.h>

static uint8_t *ldt_base;
static bool user_ldt_supported;

static void
user_ldt_detect(void)
{
	union descriptor desc;
	int ret;

	ret = i386_get_ldt(0, &desc, 1);
	user_ldt_supported = (ret != -1) || (errno != ENOSYS && errno != EPERM);
}

static void
init_ldt_base(void)
{
	ldt_base = (uint8_t *)mmap(NULL, 2 * PAGE_SIZE, PROT_READ | PROT_WRITE,
	    MAP_PRIVATE | MAP_ANON, -1, 0);
	if (ldt_base == MAP_FAILED)
		atf_tc_fail("mmap failed");
	munmap(ldt_base + PAGE_SIZE, PAGE_SIZE);
}

static void
build_desc(union descriptor *desc, void *basep, uint32_t limit, int type,
    int dpl, int def32, int gran)
{
	uintptr_t base = (uintptr_t)basep;

	limit--;

	desc->sd.sd_lolimit = limit & 0x0000ffff;
	desc->sd.sd_lobase  = base & 0x00ffffff;
	desc->sd.sd_type    = type & 0x1F;
	desc->sd.sd_dpl     = dpl & 0x3;
	desc->sd.sd_p       = 1;
	desc->sd.sd_hilimit = (limit & 0x00ff0000) >> 16;
	desc->sd.sd_xx      = 0;
	desc->sd.sd_def32   = def32 ? 1 : 0;
	desc->sd.sd_gran    = gran ? 1 : 0;
	desc->sd.sd_hibase  = (base & 0xff000000) >> 24;
}

static void
set_ds(unsigned int val)
{
	__asm volatile("mov %0,%%ds"::"r" ((unsigned short)val));
}

static void
set_fs(unsigned int val)
{
	__asm volatile("mov %0,%%fs"::"r" ((unsigned short)val));
}

static uint8_t __noinline
get_fs_byte(const char *addr)
{
	uint8_t val;
	__asm volatile (
		".globl fs_read_begin; fs_read_begin:\n"
		"movb %%fs:%1,%0\n"
		".globl fs_read_end; fs_read_end:\n"
		: "=q" (val) : "m" (*addr)
	);
	return val;
}

/* -------------------------------------------------------------------------- */

ATF_TC(filter_ops);
ATF_TC_HEAD(filter_ops, tc)
{
	atf_tc_set_md_var(tc, "descr",
	    "Ensure that the kernel correctly filters the descriptors");
}
ATF_TC_BODY(filter_ops, tc)
{
	union descriptor desc;
	const int forbidden_types[] = {
		SDT_SYS286TSS,
		SDT_SYSLDT,
		SDT_SYS286BSY,
		SDT_SYS286CGT,
		SDT_SYSTASKGT,
		SDT_SYS286IGT,
		SDT_SYS286TGT,
		SDT_SYSNULL2,
		SDT_SYS386TSS,
		SDT_SYSNULL3,
		SDT_SYS386BSY,
		SDT_SYS386CGT,
		SDT_SYSNULL4,
		SDT_SYS386IGT,
		SDT_SYS386TGT
	};
	size_t i;

	if (!user_ldt_supported) {
		atf_tc_skip("USER_LDT disabled");
	}

	/* The first LDT slots should not be settable. */
	for (i = 0; i < 10; i++) {
		build_desc(&desc, ldt_base, PAGE_SIZE, SDT_MEMRW,
		    SEL_UPL, 1, 0);
		ATF_REQUIRE_EQ(i386_set_ldt(i, &desc, 1), -1);
		ATF_REQUIRE_EQ(errno, EINVAL);
	}

	/* SEL_KPL should not be allowed. */
	build_desc(&desc, ldt_base, PAGE_SIZE, SDT_MEMRW, SEL_KPL, 1, 0);
	ATF_REQUIRE_EQ(i386_set_ldt(256, &desc, 1), -1);
	ATF_REQUIRE_EQ(errno, EACCES);

	/* Long-mode segments should not be allowed. */
	build_desc(&desc, ldt_base, PAGE_SIZE, SDT_MEMRW, SEL_UPL, 1, 0);
	desc.sd.sd_xx = 0b11; /* sd_avl | sd_long */
	ATF_REQUIRE_EQ(i386_set_ldt(256, &desc, 1), -1);
	ATF_REQUIRE_EQ(errno, EACCES);

	/* No forbidden type should be allowed. */
	for (i = 0; i < __arraycount(forbidden_types); i++) {
		build_desc(&desc, ldt_base, PAGE_SIZE, forbidden_types[i],
		    SEL_UPL, 1, 0);
		ATF_REQUIRE_EQ(i386_set_ldt(256, &desc, 1), -1);
		ATF_REQUIRE_EQ(errno, EACCES);
	}

	/* Check the slot limit. */
	build_desc(&desc, ldt_base, PAGE_SIZE, SDT_MEMRW, SEL_UPL, 1, 0);
	ATF_REQUIRE_EQ(i386_set_ldt(MAX_USERLDT_SLOTS-1, &desc, 1),
	    MAX_USERLDT_SLOTS-1);
	ATF_REQUIRE_EQ(i386_set_ldt(MAX_USERLDT_SLOTS, &desc, 1), -1);
	ATF_REQUIRE_EQ(errno, EINVAL);
}

/* -------------------------------------------------------------------------- */

static void
iretq_gp__gp_handler(int signo, siginfo_t *sig, void *ctx)
{
	ATF_REQUIRE(sig->si_signo == SIGSEGV);
	ATF_REQUIRE(sig->si_code == SEGV_ACCERR);
	atf_tc_pass();
	/* NOTREACHED */
}

ATF_TC(iretq_gp);
ATF_TC_HEAD(iretq_gp, tc)
{
	atf_tc_set_md_var(tc, "descr",
	    "Ensure that the kernel correctly handles iretq #GP faults");
}
ATF_TC_BODY(iretq_gp, tc)
{
	union descriptor desc;
	struct sigaction act;

	if (!user_ldt_supported) {
		atf_tc_skip("USER_LDT disabled");
	}

	/* Build a desc, set %ds to it. */
	build_desc(&desc, 0, 0xFFFFFUL, SDT_MEMRWA, SEL_UPL, 1, 1);
	ATF_REQUIRE_EQ(i386_set_ldt(256, &desc, 1), 256);
	set_ds(LSEL(256, SEL_UPL));

	/* Register the fault handler. */
	memset(&act, 0, sizeof(act));
	act.sa_sigaction = iretq_gp__gp_handler;
	act.sa_flags = SA_SIGINFO;
	ATF_REQUIRE_EQ(sigaction(SIGSEGV, &act, NULL), 0);

	/* Set NULL on %ds, iretq should fault. */
	memset(&desc, 0, sizeof(desc));
	ATF_REQUIRE_EQ(i386_set_ldt(256, &desc, 1), 256);

	atf_tc_fail("test did not fault as expected");
}

/* -------------------------------------------------------------------------- */

static void
iretq_np__np_handler(int signo, siginfo_t *sig, void *ctx)
{
	ATF_REQUIRE(sig->si_signo == SIGBUS);
	ATF_REQUIRE(sig->si_code == BUS_ADRERR);
	atf_tc_pass();
	/* NOTREACHED */
}

ATF_TC(iretq_np);
ATF_TC_HEAD(iretq_np, tc)
{
	atf_tc_set_md_var(tc, "descr",
	    "Ensure that the kernel correctly handles iretq #NP faults");
}
ATF_TC_BODY(iretq_np, tc)
{
	union descriptor desc;
	struct sigaction act;

	if (!user_ldt_supported) {
		atf_tc_skip("USER_LDT disabled");
	}

	/* Build a desc, set %ds to it. */
	build_desc(&desc, 0, 0xFFFFFFFFUL, SDT_MEMRWA, SEL_UPL, 1, 1);
	ATF_REQUIRE_EQ(i386_set_ldt(256, &desc, 1), 256);
	set_ds(LSEL(256, SEL_UPL));

	/* Register the fault handler. */
	memset(&act, 0, sizeof(act));
	act.sa_sigaction = iretq_np__np_handler;
	act.sa_flags = SA_SIGINFO;
	ATF_REQUIRE_EQ(sigaction(SIGBUS, &act, NULL), 0);

	/* Set non-present on %ds, iretq should fault. */
	desc.sd.sd_p = 0;
	ATF_REQUIRE_EQ(i386_set_ldt(256, &desc, 1), 256);

	atf_tc_fail("test did not fault as expected");
}

/* -------------------------------------------------------------------------- */

static volatile bool expect_crash;

static void
user_ldt__gp_handler(int signo, siginfo_t *sig, void *ctx)
{
	ucontext_t *uctx = ctx;
	extern uint8_t fs_read_begin;

	if (!expect_crash) {
		atf_tc_fail("unexpected #GP");
	}

	ATF_REQUIRE(sig->si_signo == SIGSEGV);
	ATF_REQUIRE(sig->si_code == SEGV_ACCERR);

	if (uctx->uc_mcontext.__gregs[_REG_EIP] != (intptr_t)&fs_read_begin) {
		atf_tc_fail("got #GP on the wrong instruction");
	}

	set_fs(GSEL(GUDATA_SEL, SEL_UPL));

	atf_tc_pass();
	/* NOTREACHED */
}

ATF_TC(user_ldt);
ATF_TC_HEAD(user_ldt, tc)
{
	atf_tc_set_md_var(tc, "descr",
	    "Ensure that USER_LDT works as expected");
}
ATF_TC_BODY(user_ldt, tc)
{
	union descriptor desc;
	struct sigaction act;

	if (!user_ldt_supported) {
		atf_tc_skip("USER_LDT disabled");
	}

	memset(&act, 0, sizeof(act));
	act.sa_sigaction = user_ldt__gp_handler;
	act.sa_flags = SA_SIGINFO;
	ATF_REQUIRE_EQ(sigaction(SIGSEGV, &act, NULL), 0);

	build_desc(&desc, ldt_base, PAGE_SIZE, SDT_MEMRW, SEL_UPL, 1, 0);
	ATF_REQUIRE_EQ(i386_set_ldt(256, &desc, 1), 256);

	set_fs(LSEL(256, SEL_UPL));

	ldt_base[666] = 123;
	ldt_base[PAGE_SIZE-1] = 213;
	__insn_barrier();
	ATF_REQUIRE_EQ(get_fs_byte((char *)666), 123);
	ATF_REQUIRE_EQ(get_fs_byte((char *)PAGE_SIZE-1), 213);

	/* This one should fault, and it concludes our test case. */
	expect_crash = true;
	get_fs_byte((char *)PAGE_SIZE);

	atf_tc_fail("test did not fault as expected");
}

/* -------------------------------------------------------------------------- */

ATF_TP_ADD_TCS(tp)
{
	user_ldt_detect();
	init_ldt_base();

	ATF_TP_ADD_TC(tp, filter_ops);
	ATF_TP_ADD_TC(tp, iretq_gp);
	ATF_TP_ADD_TC(tp, iretq_np);
	ATF_TP_ADD_TC(tp, user_ldt);

	return atf_no_error();
}