Contiki 3.x
syscalls.h
1 /*
2  * Copyright (C) 2015-2016, Intel Corporation. All rights reserved.
3  *
4  * Redistribution and use in source and binary forms, with or without
5  * modification, are permitted provided that the following conditions
6  * are met:
7  * 1. Redistributions of source code must retain the above copyright
8  * notice, this list of conditions and the following disclaimer.
9  * 2. Redistributions in binary form must reproduce the above copyright
10  * notice, this list of conditions and the following disclaimer in the
11  * documentation and/or other materials provided with the distribution.
12  *
13  * 3. Neither the name of the copyright holder nor the names of its
14  * contributors may be used to endorse or promote products derived
15  * from this software without specific prior written permission.
16  *
17  * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
18  * ``AS IS'' AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
19  * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS
20  * FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE
21  * COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT,
22  * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
23  * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR
24  * SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
25  * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
26  * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
27  * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED
28  * OF THE POSSIBILITY OF SUCH DAMAGE.
29  */
30 
31 #ifndef CPU_X86_MM_SYSCALLS_H_
32 #define CPU_X86_MM_SYSCALLS_H_
33 
34 #include "helpers.h"
35 #include "prot-domains.h"
36 #include <stdbool.h>
37 
38 typedef uint32_t dom_id_bitmap_t;
39 
40 typedef struct syscalls_entrypoint {
41  uintptr_t entrypoint;
42  dom_id_bitmap_t doms;
43 } syscalls_entrypoint_t;
44 extern syscalls_entrypoint_t ATTR_KERN_ADDR_SPACE syscalls_entrypoints[];
45 extern syscalls_entrypoint_t ATTR_KERN_ADDR_SPACE syscalls_entrypoints_end[];
46 
47 #define SYSCALLS_ACTUAL_CNT (syscalls_entrypoints_end - syscalls_entrypoints)
48 
49 #if X86_CONF_PROT_DOMAINS != X86_CONF_PROT_DOMAINS__NONE
50 
51 #define SYSCALLS_ALLOC_ENTRYPOINT(nm) \
52  syscalls_entrypoint_t __attribute__((section(".syscall_bss"))) \
53  ATTR_KERN_ADDR_SPACE _syscall_ent_##nm
54 
55 #define SYSCALLS_INIT(nm) \
56  KERN_WRITEL(_syscall_ent_##nm.entrypoint, (uintptr_t)_syscall_##nm); \
57  KERN_WRITEL(_syscall_ent_##nm.doms, 0)
58 
59 #define SYSCALLS_DEFINE(nm, ...) \
60  void _syscall_##nm(__VA_ARGS__); \
61  SYSCALLS_STUB(nm); \
62  void _syscall_##nm(__VA_ARGS__)
63 
64 #define SYSCALLS_DEFINE_SINGLETON(nm, dcd, ...) \
65  void _syscall_##nm(__VA_ARGS__); \
66  SYSCALLS_STUB_SINGLETON(nm, dcd); \
67  void _syscall_##nm(__VA_ARGS__)
68 
69 #define SYSCALLS_AUTHZ_UPD(nm, drv, set) \
70  { \
71  dom_id_t _sc_tmp_id; \
72  dom_id_bitmap_t _sc_tmp_bm; \
73  KERN_READL(_sc_tmp_id, (drv).dom_id); \
74  KERN_READL(_sc_tmp_bm, _syscall_ent_##nm.doms); \
75  if(set) { \
76  _sc_tmp_bm |= BIT(_sc_tmp_id); \
77  } else { \
78  _sc_tmp_bm &= ~BIT(_sc_tmp_id); \
79  } \
80  KERN_WRITEL(_syscall_ent_##nm.doms, _sc_tmp_bm); \
81  }
82 
83 /**
84  * Check that any untrusted pointer that could have been influenced by a caller
85  * (i.e. a stack parameter or global variable) refers to a location at or above
86  * a certain stack boundary and halt otherwise. This is used to prevent a
87  * protection domain from calling a different protection domain and passing a
88  * pointer that references a location in the callee's stack other than its
89  * parameters.
90  *
91  * This also checks that the pointer is either within the stack region or the
92  * shared data region, which is important for preventing redirection of data
93  * accesses to MMIO or metadata regions. This check is omitted for multi-
94  * segment protection domain implementations, since the segment settings
95  * already enforce this property for pointers dereferenced in DS. Pointers
96  * that can be influenced by a caller should not be dereferenced in any other
97  * segment.
98  *
99  * The pointer is both validated and copied to a new storage location, which
100  * must be within the callee's local stack region (excluding the parameter
101  * region). This is to mitigate scenarios such as two pointers being validated
102  * and an adversary later inducing a write through one of the pointers to the
103  * other pointer to corrupt the latter pointer before it is used.
104  *
105  * The frame address is adjusted to account for the first word pushed on the
106  * local frame and the return address, since neither of those should ever be
107  * referenced by an incoming pointer. In particular, if an incoming pointer
108  * references the return address, it could potentially redirect execution with
109  * the privileges of the callee protection domain.
110  */
111 #if X86_CONF_PROT_DOMAINS_MULTI_SEG
112 #define PROT_DOMAINS_VALIDATE_PTR(validated, untrusted, sz) \
113  validated = untrusted; \
114  if(((uintptr_t)(validated)) < \
115  ((2 * sizeof(uintptr_t)) + (uintptr_t)__builtin_frame_address(0))) { \
116  halt(); \
117  }
118 #else
119 #define PROT_DOMAINS_VALIDATE_PTR(validated, untrusted, sz) \
120  validated = untrusted; \
121  if((((uintptr_t)(validated)) < \
122  ((2 * sizeof(uintptr_t)) + (uintptr_t)__builtin_frame_address(0))) || \
123  (((uintptr_t)&_edata_addr) <= (((uintptr_t)(validated)) + (sz)))) { \
124  halt(); \
125  }
126 #endif
127 
128 #else
129 
130 #define SYSCALLS_ALLOC_ENTRYPOINT(nm)
131 #define SYSCALLS_INIT(nm)
132 #define SYSCALLS_DEFINE(nm, ...) void nm(__VA_ARGS__)
133 #define SYSCALLS_DEFINE_SINGLETON(nm, dcd, ...) void nm(__VA_ARGS__)
134 #define SYSCALLS_AUTHZ_UPD(nm, drv, set)
135 #define PROT_DOMAINS_VALIDATE_PTR(validated, untrusted, sz) validated = untrusted
136 
137 #endif
138 
139 #define SYSCALLS_AUTHZ(nm, drv) SYSCALLS_AUTHZ_UPD(nm, drv, true)
140 #define SYSCALLS_DEAUTHZ(nm, drv) SYSCALLS_AUTHZ_UPD(nm, drv, false)
141 
142 #endif /* CPU_X86_MM_SYSCALLS_H_ */
Generated on Thu Jul 6 2017 20:52:51 for Contiki 3.x by   doxygen 1.8.6