/*
* Print out the trusted stack for the current thread, starting at the top.
*
* XXXRW: Would be nice to take a tid/pid argument rather than always use
* curthread.
*/
DB_SHOW_COMMAND(cheristack, ddb_dump_cheristack)
{
struct cheri_stack_frame *csfp;
struct pcb *pcb = curthread->td_pcb;
int i;
db_printf("Trusted stack for TID %d; TSP 0x%016jx\n",
curthread->td_tid, (uintmax_t)pcb->pcb_cheristack.cs_tsp);
for (i = CHERI_STACK_DEPTH - 1; i >= 0; i--) {
/* i > (pcb->pcb_cheristack.cs_tsp / CHERI_FRAME_SIZE); i--) { */
csfp = &pcb->pcb_cheristack.cs_frames[i];
db_printf("Frame %d%c\n", i,
(i >= (pcb->pcb_cheristack.cs_tsp / CHERI_FRAME_SIZE)) ?
'*' : ' ');
CHERI_CLC(CHERI_CR_CTEMP0, CHERI_CR_KDC, &csfp->csf_idc, 0);
db_printf(" IDC ");
DB_CHERI_CAP_PRINT(CHERI_CR_CTEMP0);
CHERI_CLC(CHERI_CR_CTEMP0, CHERI_CR_KDC, &csfp->csf_pcc, 0);
db_printf(" PCC ");
DB_CHERI_CAP_PRINT(CHERI_CR_CTEMP0);
}
}
/*
* The CheriABI equivalent of cpu_set_upcall_kse().
*/
void
cheriabi_set_threadregs(struct thread *td, struct thr_param_c *param)
{
struct trapframe *frame;
frame = td->td_frame;
bzero(frame, sizeof(*frame));
/*
* Keep interrupt mask
*
* XXX-BD: See XXXRW comment in cpu_set_upcall_kse().
*/
td->td_frame->sr = MIPS_SR_KSU_USER | MIPS_SR_EXL | MIPS_SR_INT_IE |
(mips_rd_status() & MIPS_SR_INT_MASK) |
MIPS_SR_PX | MIPS_SR_UX | MIPS_SR_KX | MIPS_SR_COP_2_BIT;
/*
* We don't perform valiation on the new pcc or stack capabilities
* and just let the caller fail on return if they are bogus.
*/
cheri_capability_copy(&frame->stc, ¶m->stack_base);
td->td_frame->sp = param->stack_size;
/*
* XXX-BD: cpu_set_upcall() copies the cheri_signal struct. Do we
* want to point it at our stack instead?
*/
CHERI_CLC(CHERI_CR_CTEMP0, CHERI_CR_KDC, ¶m->start_func, 0);
CHERI_CGETOFFSET(frame->pc, CHERI_CR_CTEMP0);
cheri_capability_copy(&frame->ddc, ¶m->ddc);
cheri_capability_copy(&frame->pcc, ¶m->start_func);
cheri_capability_copy(&frame->c12, ¶m->start_func);
cheri_capability_copy(&frame->c3, ¶m->arg);
}
void
cheri_capability_setoffset(struct chericap *cp, register_t offset)
{
CHERI_CLC(CHERI_CR_CTEMP0, CHERI_CR_KDC, cp, 0);
CHERI_CSETOFFSET(CHERI_CR_CTEMP0, CHERI_CR_CTEMP0, offset);
CHERI_CSC(CHERI_CR_CTEMP0, CHERI_CR_KDC, (register_t)cp, 0);
}
/*
* Print out the trusted stack for the current thread, starting at the top.
*
* XXXRW: Would be nice to take a tid/pid argument rather than always use
* curthread.
*/
DB_SHOW_COMMAND(cheristack, ddb_dump_cheristack)
{
struct chericap c;
struct cheri_stack_frame *csfp;
struct pcb *pcb = curthread->td_pcb;
u_int ctag;
int i;
db_printf("Trusted stack for TID %d; TSP 0x%016jx\n",
curthread->td_tid, (uintmax_t)pcb->pcb_cheristack.cs_tsp);
for (i = CHERI_STACK_DEPTH - 1; i >= 0; i--) {
/* i > (pcb->pcb_cheristack.cs_tsp / CHERI_FRAME_SIZE); i--) { */
csfp = &pcb->pcb_cheristack.cs_frames[i];
db_printf(" Frame %d%c\n", i,
(i >= (pcb->pcb_cheristack.cs_tsp / CHERI_FRAME_SIZE)) ?
'*' : ' ');
CHERI_CLC(CHERI_CR_CTEMP, CHERI_CR_KDC, &csfp->csf_idc, 0);
CHERI_CGETTAG(ctag, CHERI_CR_CTEMP);
c = csfp->csf_idc;
db_printf("\tIDC: t: %u u: %u perms 0x%04jx otype 0x%016jx\n",
ctag, c.c_unsealed, (uintmax_t)c.c_perms,
(uintmax_t)c.c_otype);
db_printf("\t\tbase 0x%016jx length 0x%016jx\n",
(uintmax_t)c.c_base, (uintmax_t)c.c_length);
CHERI_CLC(CHERI_CR_CTEMP, CHERI_CR_KDC, &csfp->csf_pcc, 0);
CHERI_CGETTAG(ctag, CHERI_CR_CTEMP);
c = csfp->csf_pcc;
db_printf("\tPCC: t: %u u: %u perms 0x%04jx otype 0x%016jx\n",
ctag, c.c_unsealed, (uintmax_t)c.c_perms,
(uintmax_t)c.c_otype);
db_printf("\t\tbase 0x%016jx length 0x%016jx\n",
(uintmax_t)c.c_base, (uintmax_t)c.c_length);
db_printf("\tPC: %p SP: %p\n", (void *)csfp->csf_pc,
(void *)csfp->csf_sp);
}
}
/*
* As with system calls, handling signal delivery connotes special authority
* in the runtime environment. In the signal delivery code, we need to
* determine whether to trust the executing thread to have valid stack state,
* and use this function to query whether the execution environment is
* suitable for direct handler execution, or if (in effect) a security-domain
* transition is required first.
*/
int
cheri_signal_sandboxed(struct thread *td)
{
uintmax_t c_perms;
CHERI_CLC(CHERI_CR_CTEMP0, CHERI_CR_KDC, &td->td_pcb->pcb_regs.pcc,
0);
CHERI_CGETPERM(c_perms, CHERI_CR_CTEMP0);
if ((c_perms & CHERI_PERM_SYSCALL) == 0) {
atomic_add_int(&security_cheri_sandboxed_signals, 1);
return (ECAPMODE);
}
return (0);
}
/*
* When thr_new() creates a new thread, we might need to lift properties from
* the capability state in the parent thread. This is our opportunity to do
* so.
*/
void
cheriabi_thr_new_md(struct thread *parent_td, struct thr_param_c *param)
{
register_t tag_set;
/*
* XXXRW: Currently, we'll install the parent's DDC in the child
* thread if there is (effectively) a NULL capability in the param
* structure for DDC. Really, we should trigger this based on a flag
* set in the param, so that the parent thread can request a NULL DDC
* if it wants to.
*/
CHERI_CLC(CHERI_CR_CTEMP0, CHERI_CR_KDC, ¶m->ddc, 0);
CHERI_CGETTAG(tag_set, CHERI_CR_CTEMP0);
if (!tag_set)
cheri_capability_copy(¶m->ddc,
&parent_td->td_pcb->pcb_regs.ddc);
}
static int
cheriabi_set_mcontext(struct thread *td, mcontext_c_t *mcp)
{
struct trapframe *tp;
int tag;
if (mcp->mc_regs[0] != UCONTEXT_MAGIC) {
printf("mcp->mc_regs[0] != UCONTEXT_MAGIC\n");
return (EINVAL);
}
tp = td->td_frame;
cheri_trapframe_from_cheriframe(tp, &mcp->mc_cheriframe);
bcopy((void *)&mcp->mc_regs, (void *)&td->td_frame->zero,
sizeof(mcp->mc_regs));
td->td_md.md_flags = (mcp->mc_fpused & MDTD_FPUSED)
#ifdef CPU_QEMU_MALTA
| (td->td_md.md_flags & MDTD_QTRACE)
#endif
;
if (mcp->mc_fpused)
bcopy((void *)&mcp->mc_fpregs, (void *)&td->td_frame->f0,
sizeof(mcp->mc_fpregs));
td->td_frame->pc = mcp->mc_pc;
td->td_frame->mullo = mcp->mullo;
td->td_frame->mulhi = mcp->mulhi;
cheri_capability_copy(&td->td_md.md_tls_cap, &mcp->mc_tls);
CHERI_CLC(CHERI_CR_CTEMP0, CHERI_CR_KDC, &mcp->mc_tls, 0);
CHERI_CGETTAG(tag, CHERI_CR_CTEMP0);
if (tag)
CHERI_CTOPTR(td->td_md.md_tls, CHERI_CR_CTEMP0, CHERI_CR_KDC);
else
td->td_md.md_tls = NULL;
/* Dont let user to set any bits in status and cause registers. */
return (0);
}
/*
* Only allow most system calls from either ambient authority, or from
* sandboxes that have been explicitly delegated CHERI_PERM_SYSCALL via their
* code capability. Note that CHERI_PERM_SYSCALL effectively implies ambient
* authority, as the kernel does not [currently] interpret pointers/lengths
* via userspace $ddc.
*/
int
cheri_syscall_authorize(struct thread *td, u_int code, int nargs,
register_t *args)
{
uintmax_t c_perms;
/*
* Allow the cycle counter to be read via sysarch.
*
* XXXRW: Now that we support a userspace cycle counter, we should
* remove this.
*/
if (code == SYS_sysarch && args[0] == MIPS_GET_COUNT)
return (0);
/*
* Check whether userspace holds the rights defined in
* cheri_capability_set_user() in $pcc. Note that object type doesn't
* come into play here.
*
* XXXRW: Possibly ECAPMODE should be EPROT or ESANDBOX?
*/
CHERI_CLC(CHERI_CR_CTEMP0, CHERI_CR_KDC, &td->td_pcb->pcb_regs.pcc,
0);
CHERI_CGETPERM(c_perms, CHERI_CR_CTEMP0);
if ((c_perms & CHERI_PERM_SYSCALL) == 0) {
atomic_add_int(&security_cheri_syscall_violations, 1);
#if DDB
if (security_cheri_debugger_on_sandbox_syscall)
kdb_enter(KDB_WHY_CHERI,
"Syscall rejected in CHERI sandbox");
#endif
return (ECAPMODE);
}
return (0);
}
void
cheri_log_exception_registers(struct trapframe *frame)
{
struct cheri_frame *cheriframe;
/* XXXRW: awkward and unmaintainable pointer construction. */
cheriframe = &(((struct pcb *)frame)->pcb_cheriframe);
/* C0 */
CHERI_CLC(CHERI_CR_CTEMP0, CHERI_CR_KDC, &cheriframe->cf_c0, 0);
CHERI_REG_PRINT(CHERI_CR_CTEMP0, 0);
/* C1 */
CHERI_CLC(CHERI_CR_CTEMP0, CHERI_CR_KDC, &cheriframe->cf_c1, 0);
CHERI_REG_PRINT(CHERI_CR_CTEMP0, 1);
/* C2 */
CHERI_CLC(CHERI_CR_CTEMP0, CHERI_CR_KDC, &cheriframe->cf_c2, 0);
CHERI_REG_PRINT(CHERI_CR_CTEMP0, 2);
/* C3 */
CHERI_CLC(CHERI_CR_CTEMP0, CHERI_CR_KDC, &cheriframe->cf_c3, 0);
CHERI_REG_PRINT(CHERI_CR_CTEMP0, 3);
/* C4 */
CHERI_CLC(CHERI_CR_CTEMP0, CHERI_CR_KDC, &cheriframe->cf_c4, 0);
CHERI_REG_PRINT(CHERI_CR_CTEMP0, 4);
/* C5 */
CHERI_CLC(CHERI_CR_CTEMP0, CHERI_CR_KDC, &cheriframe->cf_c5, 0);
CHERI_REG_PRINT(CHERI_CR_CTEMP0, 5);
/* C6 */
CHERI_CLC(CHERI_CR_CTEMP0, CHERI_CR_KDC, &cheriframe->cf_c6, 0);
CHERI_REG_PRINT(CHERI_CR_CTEMP0, 6);
/* C7 */
CHERI_CLC(CHERI_CR_CTEMP0, CHERI_CR_KDC, &cheriframe->cf_c7, 0);
CHERI_REG_PRINT(CHERI_CR_CTEMP0, 7);
/* C8 */
CHERI_CLC(CHERI_CR_CTEMP0, CHERI_CR_KDC, &cheriframe->cf_c8, 0);
CHERI_REG_PRINT(CHERI_CR_CTEMP0, 8);
/* C9 */
CHERI_CLC(CHERI_CR_CTEMP0, CHERI_CR_KDC, &cheriframe->cf_c9, 0);
CHERI_REG_PRINT(CHERI_CR_CTEMP0, 9);
/* C10 */
CHERI_CLC(CHERI_CR_CTEMP0, CHERI_CR_KDC, &cheriframe->cf_c10, 0);
CHERI_REG_PRINT(CHERI_CR_CTEMP0, 10);
/* C11 */
CHERI_CLC(CHERI_CR_CTEMP0, CHERI_CR_KDC, &cheriframe->cf_c11, 0);
CHERI_REG_PRINT(CHERI_CR_CTEMP0, 11);
/* C12 */
CHERI_CLC(CHERI_CR_CTEMP0, CHERI_CR_KDC, &cheriframe->cf_c12, 0);
CHERI_REG_PRINT(CHERI_CR_CTEMP0, 12);
/* C13 */
CHERI_CLC(CHERI_CR_CTEMP0, CHERI_CR_KDC, &cheriframe->cf_c13, 0);
CHERI_REG_PRINT(CHERI_CR_CTEMP0, 13);
/* C14 */
CHERI_CLC(CHERI_CR_CTEMP0, CHERI_CR_KDC, &cheriframe->cf_c14, 0);
CHERI_REG_PRINT(CHERI_CR_CTEMP0, 14);
/* C15 */
CHERI_CLC(CHERI_CR_CTEMP0, CHERI_CR_KDC, &cheriframe->cf_c15, 0);
CHERI_REG_PRINT(CHERI_CR_CTEMP0, 15);
/* C16 */
CHERI_CLC(CHERI_CR_CTEMP0, CHERI_CR_KDC, &cheriframe->cf_c16, 0);
CHERI_REG_PRINT(CHERI_CR_CTEMP0, 16);
/* C17 */
CHERI_CLC(CHERI_CR_CTEMP0, CHERI_CR_KDC, &cheriframe->cf_c17, 0);
CHERI_REG_PRINT(CHERI_CR_CTEMP0, 17);
/* C18 */
CHERI_CLC(CHERI_CR_CTEMP0, CHERI_CR_KDC, &cheriframe->cf_c18, 0);
CHERI_REG_PRINT(CHERI_CR_CTEMP0, 18);
/* C19 */
CHERI_CLC(CHERI_CR_CTEMP0, CHERI_CR_KDC, &cheriframe->cf_c19, 0);
CHERI_REG_PRINT(CHERI_CR_CTEMP0, 19);
/* C20 */
CHERI_CLC(CHERI_CR_CTEMP0, CHERI_CR_KDC, &cheriframe->cf_c20, 0);
CHERI_REG_PRINT(CHERI_CR_CTEMP0, 20);
/* C21 */
CHERI_CLC(CHERI_CR_CTEMP0, CHERI_CR_KDC, &cheriframe->cf_c21, 0);
CHERI_REG_PRINT(CHERI_CR_CTEMP0, 21);
/* C22 */
CHERI_CLC(CHERI_CR_CTEMP0, CHERI_CR_KDC, &cheriframe->cf_c22, 0);
CHERI_REG_PRINT(CHERI_CR_CTEMP0, 22);
/* C23 */
CHERI_CLC(CHERI_CR_CTEMP0, CHERI_CR_KDC, &cheriframe->cf_c23, 0);
CHERI_REG_PRINT(CHERI_CR_CTEMP0, 23);
/* C24 - RCC */
CHERI_CLC(CHERI_CR_CTEMP0, CHERI_CR_KDC, &cheriframe->cf_rcc, 0);
CHERI_REG_PRINT(CHERI_CR_CTEMP0, 24);
/* C26 - IDC */
CHERI_CLC(CHERI_CR_CTEMP0, CHERI_CR_KDC, &cheriframe->cf_idc, 0);
CHERI_REG_PRINT(CHERI_CR_CTEMP0, 26);
/* C31 - saved PCC */
CHERI_CLC(CHERI_CR_CTEMP0, CHERI_CR_KDC, &cheriframe->cf_pcc, 0);
CHERI_REG_PRINT(CHERI_CR_CTEMP0, 31);
}
int
cheriabi_sysarch(struct thread *td, struct cheriabi_sysarch_args *uap)
{
struct trapframe *regs = &td->td_pcb->pcb_regs;
int error;
int parms_from_cap = 1;
size_t reqsize;
register_t reqperms;
/*
* The sysarch() fill_uap function is machine-independent so can not
* check the validity of the capabilty which becomes uap->parms. As
* such, it makes no attempt to convert the result. We need to
* perform those checks here.
*/
switch (uap->op) {
case MIPS_SET_TLS:
reqsize = 0;
reqperms = 0;
break;
case MIPS_GET_TLS:
case CHERI_GET_STACK:
case CHERI_GET_TYPECAP:
reqsize = sizeof(struct chericap);
reqperms = CHERI_PERM_STORE|CHERI_PERM_STORE_CAP;
break;
case CHERI_SET_STACK:
reqsize = sizeof(struct chericap);
reqperms = CHERI_PERM_LOAD|CHERI_PERM_LOAD_CAP;
break;
case CHERI_MMAP_GETBASE:
case CHERI_MMAP_GETLEN:
case CHERI_MMAP_GETOFFSET:
case CHERI_MMAP_GETPERM:
case CHERI_MMAP_SETOFFSET:
case CHERI_MMAP_SETBOUNDS:
reqsize = sizeof(uint64_t);
reqperms = CHERI_PERM_STORE;
break;
case CHERI_MMAP_ANDPERM:
reqsize = sizeof(uint64_t);
reqperms = CHERI_PERM_LOAD|CHERI_PERM_STORE;
break;
case MIPS_GET_COUNT:
parms_from_cap = 0;
break;
#ifdef CPU_QEMU_MALTA
case QEMU_GET_QTRACE:
reqsize = sizeof(int);
reqperms = CHERI_PERM_STORE;
break;
case QEMU_SET_QTRACE:
reqsize = sizeof(int);
reqperms = CHERI_PERM_LOAD;
break;
#endif
default:
return (EINVAL);
}
if (parms_from_cap) {
error = cheriabi_cap_to_ptr(&uap->parms, ®s->c3,
reqsize, reqperms, 0);
if (error != 0)
return (error);
}
switch (uap->op) {
case MIPS_SET_TLS:
return (cheriabi_set_user_tls(td, ®s->c3));
case MIPS_GET_TLS:
error = copyoutcap(&td->td_md.md_tls_cap, uap->parms,
sizeof(struct chericap));
return (error);
case CHERI_MMAP_GETBASE: {
size_t base;
PROC_LOCK(td->td_proc);
CHERI_CLC(CHERI_CR_CTEMP0, CHERI_CR_KDC,
&td->td_proc->p_md.md_cheri_mmap_cap, 0);
CHERI_CGETBASE(base, CHERI_CR_CTEMP0);
PROC_UNLOCK(td->td_proc);
if (suword64(uap->parms, base) != 0)
return (EFAULT);
return (0);
}
case CHERI_MMAP_GETLEN: {
size_t len;
PROC_LOCK(td->td_proc);
CHERI_CLC(CHERI_CR_CTEMP0, CHERI_CR_KDC,
&td->td_proc->p_md.md_cheri_mmap_cap, 0);
CHERI_CGETLEN(len, CHERI_CR_CTEMP0);
PROC_UNLOCK(td->td_proc);
if (suword64(uap->parms, len) != 0)
return (EFAULT);
return (0);
}
case CHERI_MMAP_GETOFFSET: {
ssize_t offset;
PROC_LOCK(td->td_proc);
CHERI_CLC(CHERI_CR_CTEMP0, CHERI_CR_KDC,
&td->td_proc->p_md.md_cheri_mmap_cap, 0);
CHERI_CGETOFFSET(offset, CHERI_CR_CTEMP0);
PROC_UNLOCK(td->td_proc);
if (suword64(uap->parms, offset) != 0)
return (EFAULT);
return (0);
}
case CHERI_MMAP_GETPERM: {
uint64_t perms;
PROC_LOCK(td->td_proc);
CHERI_CLC(CHERI_CR_CTEMP0, CHERI_CR_KDC,
&td->td_proc->p_md.md_cheri_mmap_cap, 0);
CHERI_CGETPERM(perms, CHERI_CR_CTEMP0);
PROC_UNLOCK(td->td_proc);
if (suword64(uap->parms, perms) != 0)
return (EFAULT);
return (0);
}
case CHERI_MMAP_ANDPERM: {
uint64_t perms;
perms = fuword64(uap->parms);
if (perms == -1)
return (EINVAL);
PROC_LOCK(td->td_proc);
CHERI_CLC(CHERI_CR_CTEMP0, CHERI_CR_KDC,
&td->td_proc->p_md.md_cheri_mmap_cap, 0);
CHERI_CANDPERM(CHERI_CR_CTEMP0, CHERI_CR_CTEMP0,
(register_t)perms);
CHERI_CSC(CHERI_CR_CTEMP0, CHERI_CR_KDC,
&td->td_proc->p_md.md_cheri_mmap_cap, 0);
CHERI_CGETPERM(perms, CHERI_CR_CTEMP0);
PROC_UNLOCK(td->td_proc);
if (suword64(uap->parms, perms) != 0)
return (EFAULT);
return (0);
}
case CHERI_MMAP_SETOFFSET: {
size_t len;
ssize_t offset;
offset = fuword64(uap->parms);
/* Reject errors and misaligned offsets */
if (offset == -1 || (offset & PAGE_MASK) != 0)
return (EINVAL);
PROC_LOCK(td->td_proc);
CHERI_CLC(CHERI_CR_CTEMP0, CHERI_CR_KDC,
&td->td_proc->p_md.md_cheri_mmap_cap, 0);
CHERI_CGETLEN(len, CHERI_CR_CTEMP0);
/* Don't allow out of bounds offsets, they aren't useful */
if (offset < 0 || offset > len) {
PROC_UNLOCK(td->td_proc);
return (EINVAL);
}
CHERI_CSETOFFSET(CHERI_CR_CTEMP0, CHERI_CR_CTEMP0,
(register_t)offset);
CHERI_CSC(CHERI_CR_CTEMP0, CHERI_CR_KDC,
&td->td_proc->p_md.md_cheri_mmap_cap, 0);
PROC_UNLOCK(td->td_proc);
return (0);
}
case CHERI_MMAP_SETBOUNDS: {
size_t len, olen;
ssize_t offset;
len = fuword64(uap->parms);
/* Reject errors or misaligned lengths */
if (len == (size_t)-1 || (len & PAGE_MASK) != 0)
return (EINVAL);
PROC_LOCK(td->td_proc);
CHERI_CLC(CHERI_CR_CTEMP0, CHERI_CR_KDC,
&td->td_proc->p_md.md_cheri_mmap_cap, 0);
CHERI_CGETLEN(olen, CHERI_CR_CTEMP0);
CHERI_CGETOFFSET(offset, CHERI_CR_CTEMP0);
/* Don't try to set out of bounds lengths */
if (offset > olen || len > olen - offset) {
PROC_UNLOCK(td->td_proc);
return (EINVAL);
}
CHERI_CSETBOUNDS(CHERI_CR_CTEMP0, CHERI_CR_CTEMP0,
(register_t)len);
CHERI_CSC(CHERI_CR_CTEMP0, CHERI_CR_KDC,
&td->td_proc->p_md.md_cheri_mmap_cap, 0);
PROC_UNLOCK(td->td_proc);
return (0);
}
default:
return (sysarch(td, (struct sysarch_args*)uap));
}
}
/*
* The CheriABI version of sendsig(9) largely borrows from the MIPS version,
* and it is important to keep them in sync. It differs primarily in that it
* must also be aware of user stack-handling ABIs, so is also sensitive to our
* (fluctuating) design choices in how $stc and $sp interact. The current
* design uses ($stc + $sp) for stack-relative references, so early on we have
* to calculate a 'relocated' version of $sp that we can then use for
* MIPS-style access.
*
* This code, as with the CHERI-aware MIPS code, makes a privilege
* determination in order to decide whether to trust the stack exposed by the
* user code for the purposes of signal handling. We must use the alternative
* stack if there is any indication that using the user thread's stack state
* might violate the userspace compartmentalisation model.
*/
static void
cheriabi_sendsig(sig_t catcher, ksiginfo_t *ksi, sigset_t *mask)
{
struct proc *p;
struct thread *td;
struct trapframe *regs;
struct sigacts *psp;
struct sigframe_c sf, *sfp;
uintptr_t stackbase;
vm_offset_t sp;
int cheri_is_sandboxed;
int sig;
int oonstack;
td = curthread;
p = td->td_proc;
PROC_LOCK_ASSERT(p, MA_OWNED);
sig = ksi->ksi_signo;
psp = p->p_sigacts;
mtx_assert(&psp->ps_mtx, MA_OWNED);
regs = td->td_frame;
/*
* In CheriABI, $sp is $stc relative, so calculate a relocation base
* that must be combined with regs->sp from this point onwards.
* Unfortunately, we won't retain bounds and permissions information
* (as is the case elsewhere in CheriABI). While 'stackbase'
* suggests that $stc's offset isn't included, in practice it will be,
* although we may reasonably assume that it will be zero.
*
* If it turns out we will be delivering to the alternative signal
* stack, we'll recalculate stackbase later.
*/
CHERI_CLC(CHERI_CR_CTEMP0, CHERI_CR_KDC, &td->td_pcb->pcb_regs.stc,
0);
CHERI_CTOPTR(stackbase, CHERI_CR_CTEMP0, CHERI_CR_KDC);
oonstack = sigonstack(stackbase + regs->sp);
/*
* CHERI affects signal delivery in the following ways:
*
* (1) Additional capability-coprocessor state is exposed via
* extensions to the context frame placed on the stack.
*
* (2) If the user $pcc doesn't include CHERI_PERM_SYSCALL, then we
* consider user state to be 'sandboxed' and therefore to require
* special delivery handling which includes a domain-switch to the
* thread's context-switch domain. (This is done by
* cheri_sendsig()).
*
* (3) If an alternative signal stack is not defined, and we are in a
* 'sandboxed' state, then we have two choices: (a) if the signal
* is of type SA_SANDBOX_UNWIND, we will automatically unwind the
* trusted stack by one frame; (b) otherwise, we will terminate
* the process unconditionally.
*/
cheri_is_sandboxed = cheri_signal_sandboxed(td);
/*
* We provide the ability to drop into the debugger in two different
* circumstances: (1) if the code running is sandboxed; and (2) if the
* fault is a CHERI protection fault. Handle both here for the
* non-unwind case. Do this before we rewrite any general-purpose or
* capability register state for the thread.
*/
#if DDB
if (cheri_is_sandboxed && security_cheri_debugger_on_sandbox_signal)
kdb_enter(KDB_WHY_CHERI, "Signal delivery to CHERI sandbox");
else if (sig == SIGPROT && security_cheri_debugger_on_sigprot)
kdb_enter(KDB_WHY_CHERI,
"SIGPROT delivered outside sandbox");
#endif
/*
* If a thread is running sandboxed, we can't rely on $sp which may
* not point at a valid stack in the ambient context, or even be
* maliciously manipulated. We must therefore always use the
* alternative stack. We are also therefore unable to tell whether we
* are on the alternative stack, so must clear 'oonstack' here.
*
* XXXRW: This requires significant further thinking; however, the net
* upshot is that it is not a good idea to do an object-capability
* invoke() from a signal handler, as with so many other things in
* life.
*/
if (cheri_is_sandboxed != 0)
oonstack = 0;
/* save user context */
bzero(&sf, sizeof(sf));
sf.sf_uc.uc_sigmask = *mask;
#if 0
/*
* XXX-BD: stack_t type differs and we can't just fake a capabilty.
* We don't restore the value so what purpose does it serve?
*/
sf.sf_uc.uc_stack = td->td_sigstk;
#endif
sf.sf_uc.uc_mcontext.mc_onstack = (oonstack) ? 1 : 0;
sf.sf_uc.uc_mcontext.mc_pc = regs->pc;
sf.sf_uc.uc_mcontext.mullo = regs->mullo;
sf.sf_uc.uc_mcontext.mulhi = regs->mulhi;
cheri_capability_copy(&sf.sf_uc.uc_mcontext.mc_tls,
&td->td_md.md_tls_cap);
sf.sf_uc.uc_mcontext.mc_regs[0] = UCONTEXT_MAGIC; /* magic number */
bcopy((void *)®s->ast, (void *)&sf.sf_uc.uc_mcontext.mc_regs[1],
sizeof(sf.sf_uc.uc_mcontext.mc_regs) - sizeof(register_t));
sf.sf_uc.uc_mcontext.mc_fpused = td->td_md.md_flags & MDTD_FPUSED;
#if defined(CPU_HAVEFPU)
if (sf.sf_uc.uc_mcontext.mc_fpused) {
/* if FPU has current state, save it first */
if (td == PCPU_GET(fpcurthread))
MipsSaveCurFPState(td);
bcopy((void *)&td->td_frame->f0,
(void *)sf.sf_uc.uc_mcontext.mc_fpregs,
sizeof(sf.sf_uc.uc_mcontext.mc_fpregs));
}
#endif
/* XXXRW: sf.sf_uc.uc_mcontext.sr seems never to be set? */
sf.sf_uc.uc_mcontext.cause = regs->cause;
cheri_trapframe_to_cheriframe(&td->td_pcb->pcb_regs,
&sf.sf_uc.uc_mcontext.mc_cheriframe);
/*
* Allocate and validate space for the signal handler context. For
* CheriABI purposes, 'sp' from this point forward is relocated
* relative to any pertinent stack capability. For an alternative
* signal context, we need to recalculate stackbase for later use in
* calculating a new $sp for the signal-handling context.
*
* XXXRW: It seems like it would be nice to both the regular and
* alternative stack calculations in the same place. However, we need
* oonstack sooner. We should clean this up later.
*/
if ((td->td_pflags & TDP_ALTSTACK) != 0 && !oonstack &&
SIGISMEMBER(psp->ps_sigonstack, sig)) {
stackbase = (vm_offset_t)td->td_sigstk.ss_sp;
sp = (vm_offset_t)(stackbase + td->td_sigstk.ss_size);
} else {
/*
* Signals delivered when a CHERI sandbox is present must be
* delivered on the alternative stack rather than a local one.
* If an alternative stack isn't present, then terminate or
* risk leaking capabilities (and control) to the sandbox (or
* just crashing the sandbox).
*/
if (cheri_is_sandboxed) {
mtx_unlock(&psp->ps_mtx);
printf("pid %d, tid %d: signal in sandbox without "
"alternative stack defined\n", td->td_proc->p_pid,
td->td_tid);
sigexit(td, SIGILL);
/* NOTREACHED */
}
sp = (vm_offset_t)(stackbase + regs->sp);
}
sp -= sizeof(struct sigframe_c);
/* For CHERI, keep the stack pointer capability aligned. */
sp &= ~(CHERICAP_SIZE - 1);
sfp = (void *)sp;
/* Build the argument list for the signal handler. */
regs->a0 = sig;
if (SIGISMEMBER(psp->ps_siginfo, sig)) {
/*
* Signal handler installed with SA_SIGINFO.
*
* XXXRW: We would ideally synthesise these from the
* user-originated stack capability, rather than $kdc, to be
* on the safe side.
*/
cheri_capability_set(®s->c3, CHERI_CAP_USER_DATA_PERMS,
(void *)(intptr_t)&sfp->sf_si, sizeof(sfp->sf_si), 0);
cheri_capability_set(®s->c4, CHERI_CAP_USER_DATA_PERMS,
(void *)(intptr_t)&sfp->sf_uc, sizeof(sfp->sf_uc), 0);
/* sf.sf_ahu.sf_action = (__siginfohandler_t *)catcher; */
/* fill siginfo structure */
sf.sf_si.si_signo = sig;
sf.sf_si.si_code = ksi->ksi_code;
/*
* Write out badvaddr, but don't create a valid capability
* since that might allow privilege amplification.
*
* XXX-BD: This probably isn't the right method.
* XXX-BD: Do we want to set base or offset?
*
* XXXRW: I think there's some argument that anything
* receiving this signal is fairly privileged. But we could
* generate a $ddc-relative (or $pcc-relative) capability, if
* possible. (Using versions if $ddc and $pcc for the
* signal-handling context rather than that which caused the
* signal). I'd be tempted to deliver badvaddr as the offset
* of that capability. If badvaddr is not in range, then we
* should just deliver an untagged NULL-derived version
* (perhaps)?
*/
*((uintptr_t *)&sf.sf_si.si_addr) =
(uintptr_t)(void *)regs->badvaddr;
}
/*
* XXX: No support for undocumented arguments to old style handlers.
*/
mtx_unlock(&psp->ps_mtx);
PROC_UNLOCK(p);
/*
* Copy the sigframe out to the user's stack.
*/
if (copyoutcap(&sf, (void *)sfp, sizeof(sf)) != 0) {
/*
* Something is wrong with the stack pointer.
* ...Kill the process.
*/
PROC_LOCK(p);
printf("pid %d, tid %d: could not copy out sigframe\n",
td->td_proc->p_pid, td->td_tid);
sigexit(td, SIGILL);
/* NOTREACHED */
}
/*
* Re-acquire process locks necessary to access suitable pcb fields.
* However, arguably, these operations should be atomic with the
* initial inspection of 'psp'.
*/
PROC_LOCK(p);
mtx_lock(&psp->ps_mtx);
/*
* Install CHERI signal-delivery register state for handler to run
* in. As we don't install this in the CHERI frame on the user stack,
* it will be (generally) be removed automatically on sigreturn().
*/
/* XXX-BD: this isn't quite right */
cheri_sendsig(td);
/*
* Note that $sp must be installed relative to $stc, so re-subtract
* the stack base here.
*/
regs->pc = (register_t)(intptr_t)catcher;
regs->sp = (register_t)((intptr_t)sfp - stackbase);
cheri_capability_copy(®s->c12, &psp->ps_sigcap[_SIG_IDX(sig)]);
cheri_capability_copy(®s->c17,
&td->td_pcb->pcb_cherisignal.csig_sigcode);
}
static int
cheriabi_fetch_syscall_args(struct thread *td, struct syscall_args *sa)
{
struct trapframe *locr0 = td->td_frame; /* aka td->td_pcb->pcv_regs */
struct sysentvec *se;
#ifdef OLD_ARG_HANDLING
register_t intargs[8];
uintptr_t ptrargs[8];
u_int tag;
int i, isaved, psaved, curint, curptr, nintargs, nptrargs;
#endif
int error;
error = 0;
bzero(sa->args, sizeof(sa->args));
/* compute next PC after syscall instruction */
td->td_pcb->pcb_tpc = sa->trapframe->pc; /* Remember if restart */
if (DELAYBRANCH(sa->trapframe->cause)) /* Check BD bit */
locr0->pc = MipsEmulateBranch(locr0, sa->trapframe->pc, 0, 0);
else
locr0->pc += sizeof(int);
sa->code = locr0->v0;
se = td->td_proc->p_sysent;
if (se->sv_mask)
sa->code &= se->sv_mask;
if (sa->code >= se->sv_size)
sa->callp = &se->sv_table[0];
else
sa->callp = &se->sv_table[sa->code];
sa->narg = sa->callp->sy_narg;
#ifndef OLD_ARG_HANDLING
error = cheriabi_dispatch_fill_uap(td, sa->code, sa->args);
#else
intargs[0] = locr0->a0;
intargs[1] = locr0->a1;
intargs[2] = locr0->a2;
intargs[3] = locr0->a3;
intargs[4] = locr0->a4;
intargs[5] = locr0->a5;
intargs[6] = locr0->a6;
intargs[7] = locr0->a7;
isaved = 8;
#if defined(CPU_CHERI_CHERI0) || defined (CPU_CHERI_CHERI8) || defined(CPU_CHERI_CHERI16)
#error CHERIABI does not support fewer than 8 argument registers
#endif
/*
* XXXBD: We should ideally use a user capability rather than $kdc
* to generate the pointers, but then we have to answer: which one?
*
* XXXRW: The kernel cannot distinguish between pointers with tags vs.
* untagged (possible) integers, which is problematic when a
* system-call argument is an intptr_t. We used to just use CToPtr
* here, but this caused untagged integer arguments to be lost. Now
* we pick one of CToPtr and CToInt based on the tag -- but this is
* not really ideal. Instead, we'd prefer that the kernel could
* differentiate between the two explicitly using tagged capabilities,
* which we're not yet ready to do.
*/
CHERI_CLC(CHERI_CR_CTEMP0, CHERI_CR_KDC, &locr0->c3, 0);
CHERI_CGETTAG(tag, CHERI_CR_CTEMP0);
if (tag)
CHERI_CTOPTR(ptrargs[0], CHERI_CR_CTEMP0, CHERI_CR_KDC);
else
CHERI_CTOINT(ptrargs[0], CHERI_CR_CTEMP0);
CHERI_CLC(CHERI_CR_CTEMP0, CHERI_CR_KDC, &locr0->c4, 0);
CHERI_CGETTAG(tag, CHERI_CR_CTEMP0);
if (tag)
CHERI_CTOPTR(ptrargs[1], CHERI_CR_CTEMP0, CHERI_CR_KDC);
else
CHERI_CTOINT(ptrargs[1], CHERI_CR_CTEMP0);
CHERI_CLC(CHERI_CR_CTEMP0, CHERI_CR_KDC, &locr0->c5, 0);
CHERI_CGETTAG(tag, CHERI_CR_CTEMP0);
if (tag)
CHERI_CTOPTR(ptrargs[2], CHERI_CR_CTEMP0, CHERI_CR_KDC);
else
CHERI_CTOINT(ptrargs[2], CHERI_CR_CTEMP0);
CHERI_CLC(CHERI_CR_CTEMP0, CHERI_CR_KDC, &locr0->c6, 0);
CHERI_CGETTAG(tag, CHERI_CR_CTEMP0);
if (tag)
CHERI_CTOPTR(ptrargs[3], CHERI_CR_CTEMP0, CHERI_CR_KDC);
else
CHERI_CTOINT(ptrargs[3], CHERI_CR_CTEMP0);
CHERI_CLC(CHERI_CR_CTEMP0, CHERI_CR_KDC, &locr0->c7, 0);
CHERI_CGETTAG(tag, CHERI_CR_CTEMP0);
if (tag)
CHERI_CTOPTR(ptrargs[4], CHERI_CR_CTEMP0, CHERI_CR_KDC);
else
CHERI_CTOINT(ptrargs[4], CHERI_CR_CTEMP0);
CHERI_CLC(CHERI_CR_CTEMP0, CHERI_CR_KDC, &locr0->c8, 0);
CHERI_CGETTAG(tag, CHERI_CR_CTEMP0);
if (tag)
CHERI_CTOPTR(ptrargs[5], CHERI_CR_CTEMP0, CHERI_CR_KDC);
else
CHERI_CTOINT(ptrargs[5], CHERI_CR_CTEMP0);
CHERI_CLC(CHERI_CR_CTEMP0, CHERI_CR_KDC, &locr0->c9, 0);
CHERI_CGETTAG(tag, CHERI_CR_CTEMP0);
if (tag)
CHERI_CTOPTR(ptrargs[6], CHERI_CR_CTEMP0, CHERI_CR_KDC);
else
CHERI_CTOINT(ptrargs[6], CHERI_CR_CTEMP0);
CHERI_CLC(CHERI_CR_CTEMP0, CHERI_CR_KDC, &locr0->c10, 0);
CHERI_CGETTAG(tag, CHERI_CR_CTEMP0);
if (tag)
CHERI_CTOPTR(ptrargs[7], CHERI_CR_CTEMP0, CHERI_CR_KDC);
else
CHERI_CTOINT(ptrargs[7], CHERI_CR_CTEMP0);
psaved = 8;
#ifdef TRAP_DEBUG
if (trap_debug)
printf("SYSCALL #%d pid:%u\n", sa->code, td->td_proc->p_pid);
#endif
nptrargs = bitcount(CHERIABI_SYS_argmap[sa->code].sam_ptrmask);
nintargs = sa->narg - nptrargs;
KASSERT(nintargs <= isaved,
("SYSCALL #%u pid:%u, nintargs (%u) > isaved (%u).\n",
sa->code, td->td_proc->p_pid, nintargs, isaved));
KASSERT(nptrargs <= psaved,
("SYSCALL #%u pid:%u, nptrargs (%u) > psaved (%u).\n",
sa->code, td->td_proc->p_pid, nptrargs, psaved));
/*
* Check each argument to see if it is a pointer and pop an argument
* off the appropriate list.
*/
curint = curptr = 0;
for (i = 0; i < sa->narg; i++)
sa->args[i] =
(CHERIABI_SYS_argmap[sa->code].sam_ptrmask & 1 << i) ?
ptrargs[curptr++] : intargs[curint++];
#endif /* OLD_ARG_HANDLING */
td->td_retval[0] = 0;
td->td_retval[1] = locr0->v1;
return (error);
}
static int
cheriabi_fetch_syscall_args(struct thread *td, struct syscall_args *sa)
{
struct trapframe *locr0 = td->td_frame; /* aka td->td_pcb->pcv_regs */
struct cheri_frame *capreg = &td->td_pcb->pcb_cheriframe;
register_t intargs[8];
uintptr_t ptrargs[8];
struct sysentvec *se;
int error, i, isaved, psaved, curint, curptr, nintargs, nptrargs;
error = 0;
bzero(sa->args, sizeof(sa->args));
/* compute next PC after syscall instruction */
td->td_pcb->pcb_tpc = sa->trapframe->pc; /* Remember if restart */
if (DELAYBRANCH(sa->trapframe->cause)) /* Check BD bit */
locr0->pc = MipsEmulateBranch(locr0, sa->trapframe->pc, 0, 0);
else
locr0->pc += sizeof(int);
sa->code = locr0->v0;
switch (sa->code) {
case CHERIABI_SYS___syscall:
case CHERIABI_SYS_syscall:
/*
* This is an indirect syscall, in which the code is the first
* argument.
*/
sa->code = locr0->a0;
intargs[0] = locr0->a1;
intargs[1] = locr0->a2;
intargs[2] = locr0->a3;
intargs[3] = locr0->a4;
intargs[4] = locr0->a5;
intargs[5] = locr0->a6;
intargs[6] = locr0->a7;
isaved = 7;
break;
default:
/*
* A direct syscall, arguments are just parameters to the syscall.
*/
intargs[0] = locr0->a0;
intargs[1] = locr0->a1;
intargs[2] = locr0->a2;
intargs[3] = locr0->a3;
intargs[4] = locr0->a4;
intargs[5] = locr0->a5;
intargs[6] = locr0->a6;
intargs[7] = locr0->a7;
isaved = 8;
break;
}
#if defined(CPU_CHERI_CHERI0) || defined (CPU_CHERI_CHERI8) || defined(CPU_CHERI_CHERI16)
#error CHERIABI does not support fewer than 8 argument registers
#endif
/*
* XXXBD: we should idealy use a user capability rather than KDC
* to generate the pointers, but then we have to answer: which one?
*/
CHERI_CLC(CHERI_CR_CTEMP0, CHERI_CR_KDC, &capreg->cf_c3, 0);
CHERI_CTOPTR(ptrargs[0], CHERI_CR_CTEMP0, CHERI_CR_KDC);
CHERI_CLC(CHERI_CR_CTEMP0, CHERI_CR_KDC, &capreg->cf_c4, 0);
CHERI_CTOPTR(ptrargs[1], CHERI_CR_CTEMP0, CHERI_CR_KDC);
CHERI_CLC(CHERI_CR_CTEMP0, CHERI_CR_KDC, &capreg->cf_c5, 0);
CHERI_CTOPTR(ptrargs[2], CHERI_CR_CTEMP0, CHERI_CR_KDC);
CHERI_CLC(CHERI_CR_CTEMP0, CHERI_CR_KDC, &capreg->cf_c6, 0);
CHERI_CTOPTR(ptrargs[3], CHERI_CR_CTEMP0, CHERI_CR_KDC);
CHERI_CLC(CHERI_CR_CTEMP0, CHERI_CR_KDC, &capreg->cf_c7, 0);
CHERI_CTOPTR(ptrargs[4], CHERI_CR_CTEMP0, CHERI_CR_KDC);
CHERI_CLC(CHERI_CR_CTEMP0, CHERI_CR_KDC, &capreg->cf_c8, 0);
CHERI_CTOPTR(ptrargs[5], CHERI_CR_CTEMP0, CHERI_CR_KDC);
CHERI_CLC(CHERI_CR_CTEMP0, CHERI_CR_KDC, &capreg->cf_c9, 0);
CHERI_CTOPTR(ptrargs[6], CHERI_CR_CTEMP0, CHERI_CR_KDC);
CHERI_CLC(CHERI_CR_CTEMP0, CHERI_CR_KDC, &capreg->cf_c10, 0);
CHERI_CTOPTR(ptrargs[7], CHERI_CR_CTEMP0, CHERI_CR_KDC);
psaved = 8;
#ifdef TRAP_DEBUG
if (trap_debug)
printf("SYSCALL #%d pid:%u\n", sa->code, td->td_proc->p_pid);
#endif
se = td->td_proc->p_sysent;
/*
* XXX
* Shouldn't this go before switching on the code?
*/
if (se->sv_mask)
sa->code &= se->sv_mask;
if (sa->code >= se->sv_size)
sa->callp = &se->sv_table[0];
else
sa->callp = &se->sv_table[sa->code];
sa->narg = sa->callp->sy_narg;
nptrargs = bitcount(CHERIABI_SYS_argmap[sa->code].sam_ptrmask);
nintargs = sa->narg - nintargs;
KASSERT(nintargs <= isaved,
("SYSCALL #%u pid:%u, nintargs (%u) > isaved (%u).\n",
sa->code, td->td_proc->p_pid, nintargs, isaved));
KASSERT(nptrargs <= psaved,
("SYSCALL #%u pid:%u, nptrargs (%u) > psaved (%u).\n",
sa->code, td->td_proc->p_pid, nptrargs, psaved));
/*
* Check each argument to see if it is a pointer and pop an argument
* off the appropriate list.
*/
curint = curptr = 0;
for (i = 0; i < sa->narg; i++)
sa->args[i] =
(CHERIABI_SYS_argmap[sa->code].sam_ptrmask & 1 << i) ?
ptrargs[curptr++] : intargs[curint++];
td->td_retval[0] = 0;
td->td_retval[1] = locr0->v1;
return (error);
}