/*
 * Copyright 2017, Data61, CSIRO (ABN 41 687 119 230)
 *
 * SPDX-License-Identifier: BSD-2-Clause
 */

/* Include Kconfig variables. */
#include <autoconf.h>
#include <sel4test-driver/gen_config.h>

#include <stdio.h>

#include "../helpers.h"

/* This file contains tests related to bugs that have previously occured. Tests
 * should validate that the bug no longer exists.
 */

/* Previously the layout of seL4_UserContext in libsel4 has been inconsistent
 * with frameRegisters/gpRegisters in the kernel. This causes the syscalls
 * seL4_TCB_ReadRegisters and seL4_TCB_WriteRegisters to function incorrectly.
 * The following tests whether this issue has been re-introduced. For more
 * information, see SELFOUR-113.
 */

/* An endpoint for the helper thread and the main thread to synchronise on. */
static seL4_CPtr shared_endpoint;

/* This function provides a wrapper around seL4_Send to the parent thread. It
 * can't be called directly from asm because seL4_Send typically gets inlined
 * and its likely that no visible copy of this function exists to branch to.
 */
void reply_to_parent(seL4_Word result)
__attribute__((noinline));
void reply_to_parent(seL4_Word result)
{
    seL4_MessageInfo_t info = seL4_MessageInfo_new(result, 0, 0, 0);
    seL4_Word badge = 0; /* ignored */
    seL4_Word empty = 0; /* ignored */

#if defined(CONFIG_ARCH_IA32)
#if defined(CONFIG_KERNEL_MCS)
    seL4_SendWithMRs(shared_endpoint, info, &empty);
#else
    seL4_SendWithMRs(shared_endpoint, info, &empty, &empty);
#endif /* CONFIG_KERNEL_MCS */
#else
    seL4_SendWithMRs(shared_endpoint, info, &empty, &empty, &empty, &empty);
#endif /* CONFIG_ARCH_IA32 */

    /* Block to avoid returning and assume our parent will kill us. */
    seL4_Wait(shared_endpoint, &badge);
}

/* Test the registers we have been setup with and pass the result back to our
 * parent. This function is really static, but GCC doesn't like a static
 * declaration when the definition is in asm.
 */
void test_registers(void)
#if defined(CONFIG_ARCH_AARCH32)
/* Probably not necessary to mark this function naked as we define the
 * whole thing in asm anyway, but just in case GCC tries to do anything
 * sneaky.
 */
__attribute__((naked))
#endif
;
int test_write_registers(env_t env)
{
    helper_thread_t thread;
    seL4_UserContext context = { 0 };
    int result;
    seL4_MessageInfo_t info;
    seL4_Word badge = 0; /* ignored */

    /* Create a thread without starting it. Most of these arguments are
     * ignored.
     */
    create_helper_thread(env, &thread);
    shared_endpoint = thread.local_endpoint.cptr;

#if defined(CONFIG_ARCH_AARCH32)
    context.pc = (seL4_Word)&test_registers;
    context.sp = 13;
    context.r0 = 15;
    context.r1 = 1;
    context.r2 = 2;
    context.r3 = 3;
    context.r4 = 4;
    context.r5 = 5;
    context.r6 = 6;
    context.r7 = 7;
    context.r8 = 8;
    context.r9 = 9;
    context.r10 = 10;
    context.r11 = 11;
    context.r12 = 12;
    /* R13 == SP */
    context.r14 = 14; /* LR */
    /* R15 == PC */
#elif defined(CONFIG_ARCH_AARCH64)
    context.pc = (seL4_Word)&test_registers;
    context.sp = 1;
    context.x0 = 2;
    context.x1 = 3;
    context.x2 = 4;
    context.x3 = 5;
    context.x4 = 6;
    context.x5 = 7;
    context.x6 = 8;
    context.x7 = 9;
    context.x8 = 10;
    context.x9 = 11;
    context.x10 = 12;
    context.x11 = 13;
    context.x12 = 14;
    context.x13 = 15;
    context.x14 = 16;
    context.x15 = 17;
    context.x16 = 18;
    context.x17 = 19;
    context.x18 = 20;
    context.x19 = 21;
    context.x20 = 22;
    context.x21 = 23;
    context.x22 = 24;
    context.x23 = 25;
    context.x24 = 26;
    context.x25 = 27;
    context.x26 = 28;
    context.x27 = 29;
    context.x28 = 30;
    context.x29 = 31;
    context.x30 = 32;
#elif defined(CONFIG_ARCH_X86_64)
    context.rip = (seL4_Word)&test_registers;
    context.rsp = 0x00000004UL;
    context.rax = 0x0000000aUL;
    context.rbx = 0x0000000bUL;
    context.rcx = 0x0000000cUL;
    context.rdx = 0x0000000dUL;
    context.rsi = 0x00000005UL;
    context.rdi = 0x00000002UL;
    context.rbp = 0x00000003UL;
    context.rflags = 0x00000001UL;
    context.r8 = 0x00000088UL;
    context.r9 = 0x00000099UL;
    context.r10 = 0x00000010UL;
    context.r11 = 0x00000011UL;
    context.r12 = 0x00000012UL;
    context.r13 = 0x00000013UL;
    context.r14 = 0x00000014UL;
    context.r15 = 0x00000015UL;
#elif defined(CONFIG_ARCH_X86)
    context.eip = (seL4_Word)&test_registers;
    context.esp = 0x00000004;
    context.eax = 0x0000000a;
    context.ebx = 0x0000000b;
    context.ecx = 0x0000000c;
    context.edx = 0x0000000d;
    context.esi = 0x00000005;
    context.edi = 0x00000002;
    context.ebp = 0x00000003;
    context.eflags = 0x00000001; /* Set the CF bit */
#elif defined(CONFIG_ARCH_RISCV)
    context.pc = (seL4_Word)&test_registers;
    context.ra = 1;
    context.sp = 2;
    /* skip gp and tp, they are 'unallocatable' */
    context.t0 = 4;
    context.t1 = 5;
    context.t2 = 6;
    context.s0 = 7;
    context.s1 = 8;
    /* skip a0, we use it to load the immediate values to and compare the rest */
    context.a1 = 10;
    context.a2 = 11;
    context.a3 = 12;
    context.a4 = 13;
    context.a5 = 14;
    context.a6 = 15;

    /* This is an ABI requirment */
    extern char __global_pointer$[];
    context.gp = (seL4_Word) __global_pointer$;
#else
#error "Unsupported architecture"
#endif

    result = seL4_TCB_WriteRegisters(get_helper_tcb(&thread), true, 0 /* ignored */,
                                     sizeof(seL4_UserContext) / sizeof(seL4_Word), &context);

    if (!result) {
        /* If we've successfully started the thread, block until it's checked
         * its registers.
         */
        info = api_recv(shared_endpoint, &badge, get_helper_reply(&thread));
    }
    cleanup_helper(env, &thread);

    test_assert(result == 0);

    result = seL4_MessageInfo_get_label(info);
    test_assert(result == 0);

    return sel4test_get_result();
}
DEFINE_TEST(REGRESSIONS0001, "Ensure WriteRegisters functions correctly", test_write_registers, true)

#if defined(CONFIG_ARCH_ARM)
#if defined(CONFIG_ARCH_AARCH32)
/* Performs an ldrex and strex sequence with a context switch in between. See
 * the comment in the function following for an explanation of purpose.
 */
static int do_ldrex(void)
{
    seL4_Word dummy1, dummy2, result;

    /* We don't really care where we are loading from here. This is just to set
     * the exclusive access tag.
     */
    asm volatile("ldrex %[rt], [%[rn]]"
                 : [rt]"=&r"(dummy1)
                 : [rn]"r"(&dummy2));

    /* Force a context switch to our parent. */
    seL4_Signal(shared_endpoint);

    /* Again, we don't care where we are storing to. This is to see whether the
     * exclusive access tag is still set.
     */
    asm volatile("strex %[rd], %[rt], [%[rn]]"
                 : [rd]"=&r"(result)
                 : [rt]"r"(dummy2), [rn]"r"(&dummy1));

    /* The strex should have failed (and returned 1) because the context switch
     * should have cleared the exclusive access tag.
     */
    return result == 0 ? FAILURE : SUCCESS;
}
#elif defined(CONFIG_ARCH_AARCH64)
static int do_ldrex(void)
{
    seL4_Word dummy1, dummy2, result;

    /* We don't really care where we are loading from here. This is just to set
     * the exclusive access tag.
     */
    asm volatile("ldxr %[rt], [%[rn]]"
                 : [rt]"=&r"(dummy1)
                 : [rn]"r"(&dummy2));

    /* Force a context switch to our parent. */
    seL4_Signal(shared_endpoint);

    /* Again, we don't care where we are storing to. This is to see whether the
     * exclusive access tag is still set.
     */
    asm volatile("mov %x0, #0\t\n"
                 "stxr %w0, %[rt], [%[rn]]"
                 : [rd]"=&r"(result)
                 : [rt]"r"(dummy2), [rn]"r"(&dummy1));

    /* The stxr should have failed (and returned 1) because the context switch
     * should have cleared the exclusive access tag.
     */
    return result == 0 ? FAILURE : SUCCESS;
}
#else
#error "Unsupported architecture"
#endif

/* Prior to kernel changeset a4656bf3066e the load-exclusive monitor was not
 * cleared on a context switch. This causes unexpected and incorrect behaviour
 * for any userspace program relying on ldrex/strex to implement exclusion
 * mechanisms. This test checks that the monitor is cleared correctly on
 * switch. See SELFOUR-141 for more information.
 */
int test_ldrex_cleared(env_t env)
{
    helper_thread_t thread;
    seL4_Word result;
    seL4_Word badge = 0; /* ignored */

    /* Create a child to perform the ldrex/strex. */
    create_helper_thread(env, &thread);
    shared_endpoint = thread.local_endpoint.cptr;
    start_helper(env, &thread, (helper_fn_t) do_ldrex, 0, 0, 0, 0);

    /* Wait for the child to do ldrex and signal us. */
    seL4_Wait(shared_endpoint, &badge);

    /* Wait for the child to do strex and exit. */
    result = wait_for_helper(&thread);

    cleanup_helper(env, &thread);

    return result;
}
DEFINE_TEST(REGRESSIONS0002, "Test the load-exclusive monitor is cleared on context switch", test_ldrex_cleared, true)
#endif

#if defined(CONFIG_ARCH_IA32)
static volatile int got_cpl = 0;
static volatile uintptr_t stack_after_cpl = 0;
static volatile uint32_t kernel_hash;
void VISIBLE do_after_cpl_change(void)
{
    printf("XOR hash for first MB of kernel region 0x%x\n", kernel_hash);
    test_check(false);
    /* we don't have a stack to pop back up to message the test parent,
     * but we can just fault, the result is that the test output
     * will have a 'spurious' invalid instruction error, too bad */
    asm volatile("hlt");
}
static int do_wait_for_cpl(void)
{
    /* check our current CPL */
    uint16_t cs;
    asm volatile("mov %%cs, %0" : "=r"(cs));
    if ((cs & 3) == 0) {
        got_cpl = 1;
        /* prove we have root by doing something only the kernel can do */
        /* like disabling interrupts */
        asm volatile("cli");
        /* let's hash a meg of kernel code */
        int i;
        uint32_t *kernel = (uint32_t *)0xe0000000;
        for (i = 0; i < BIT(20) / sizeof(uint32_t); i++) {
            kernel_hash ^= kernel[i];
        }
        /* take away our privileges (and put interupts back on) by constructing
         * an iret. we need to lose root so that we can call the kernel again. We
         * also need to stop using the kernel stack */
        asm volatile(
            "andl $0xFFFFFFE0, %%esp\n"
            "push %[SS] \n"
            "push %[STACK] \n"
            "pushf \n"
            "orl $0x200,(%%esp) \n"
            "push %[CS] \n"
            "push $do_after_cpl_change\n"
            "iret\n"
            :
            : [SS]"r"(0x23),
            [CS]"r"(0x1b),
            [STACK]"r"(stack_after_cpl));
        /* this is unreachable */
    }
    while (1) {
        /* Sit here calling the kernel to maximize the chance that when the
         * the timer interrupt finally fires it will actually happen when
         * we are inside the kernel, this will result in the exception being
         * delayed until we switch back to user mode */
        seL4_Yield();
    }
    return 0;
}

int test_no_ret_with_cpl0(env_t env)
{
    helper_thread_t thread;
    int error;

    /* start a low priority helper thread that we will attempt to change the CPL of */
    create_helper_thread(env, &thread);
    start_helper(env, &thread, (helper_fn_t) do_wait_for_cpl, 0, 0, 0, 0);
    stack_after_cpl = (uintptr_t)get_helper_initial_stack_pointer(&thread);

    for (int i = 0; i < 20; i++) {
        sel4test_sleep(env, NS_IN_S / 10);
        if (got_cpl) {
            wait_for_helper(&thread);
            break;
        }
        /* reset the helper threads registers */
        seL4_UserContext context;
        error = seL4_TCB_ReadRegisters(get_helper_tcb(&thread), false, 0, sizeof(seL4_UserContext) / sizeof(seL4_Word),
                                       &context);
        test_eq(error, 0);
        context.eip = (seL4_Word)do_wait_for_cpl;
        /* If all went well in the helper thread then the interrupt came in
         * whilst it was performing a kernel invocation. This means the interrupt
         * would have been masked until it performed a 'sysexit' to return to user.
         * Should an interrupt occur right then, however, the trap frame that is
         * constructed is to the 'sysexit' instruction, and the stored CS and SS
         * are CPL0 (kernel privilege). Kernel privilige is needed because once this
         * thread is resumed (via iret) we will resume at the sysexit (and hence will
         * need kernel privilege), then the sysexit will happen forcively removing
         * kernel privilege.
         * Right now, however, the interrupt has occured and we have woken up. The
         * below call to WriteRegisters will overwrite the return address (which
         * was going to be sysexit) to our own function, which will then be running
         * at CPL0 */
        error = seL4_TCB_WriteRegisters(get_helper_tcb(&thread), true, 0, sizeof(seL4_UserContext) / sizeof(seL4_Word),
                                        &context);
        test_eq(error, 0);
    }

    cleanup_helper(env, &thread);

    return sel4test_get_result();
}
DEFINE_TEST(REGRESSIONS0003, "Test return to user with CPL0 exploit", test_no_ret_with_cpl0,
            config_set(CONFIG_HAVE_TIMER))
#endif /* defined(CONFIG_ARCH_IA32) */