examples: Containment tests for a protected build and a kernel build

examples/pffault/CMakeLists.txt

@@ -0,0 +1,33 @@
+# ##############################################################################
+# apps/examples/pffault/CMakeLists.txt
+#
+# SPDX-License-Identifier: Apache-2.0
+#
+# Licensed to the Apache Software Foundation (ASF) under one or more contributor
+# license agreements.  See the NOTICE file distributed with this work for
+# additional information regarding copyright ownership.  The ASF licenses this
+# file to you under the Apache License, Version 2.0 (the "License"); you may not
+# use this file except in compliance with the License.  You may obtain a copy of
+# the License at
+#
+# http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
+# WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.  See the
+# License for the specific language governing permissions and limitations under
+# the License.
+#
+# ##############################################################################
+
+if(CONFIG_EXAMPLES_PFFAULT)
+  nuttx_add_application(
+    NAME
+    ${CONFIG_EXAMPLES_PFFAULT_PROGNAME}
+    SRCS
+    pffault_main.c
+    STACKSIZE
+    ${CONFIG_EXAMPLES_PFFAULT_STACKSIZE}
+    PRIORITY
+    ${CONFIG_EXAMPLES_PFFAULT_PRIORITY})
+endif()

examples/pffault/Kconfig

@@ -0,0 +1,28 @@
+#
+# For a description of the syntax of this configuration file,
+# see the file kconfig-language.txt in the NuttX tools repository.
+#
+
+config EXAMPLES_PFFAULT
+	tristate "Page-fault / PMS isolation test"
+	default n
+	---help---
+		A user-space task that deliberately touches a kernel-space address to
+		exercise the ESP32-S3 PMS isolation boundary and the kernel's
+		recoverable-fault dispatcher.
+
+if EXAMPLES_PFFAULT
+
+config EXAMPLES_PFFAULT_PROGNAME
+	string "Program name"
+	default "pffault"
+
+config EXAMPLES_PFFAULT_PRIORITY
+	int "pffault task priority"
+	default 100
+
+config EXAMPLES_PFFAULT_STACKSIZE
+	int "pffault stack size"
+	default DEFAULT_TASK_STACKSIZE
+
+endif

examples/pffault/Make.defs

@@ -0,0 +1,25 @@
+############################################################################
+# apps/examples/pffault/Make.defs
+#
+# SPDX-License-Identifier: Apache-2.0
+#
+# Licensed to the Apache Software Foundation (ASF) under one or more
+# contributor license agreements.  See the NOTICE file distributed with
+# this work for additional information regarding copyright ownership.  The
+# ASF licenses this file to you under the Apache License, Version 2.0 (the
+# "License"); you may not use this file except in compliance with the
+# License.  You may obtain a copy of the License at
+#
+#   http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
+# WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.  See the
+# License for the specific language governing permissions and limitations
+# under the License.
+#
+############################################################################
+
+ifneq ($(CONFIG_EXAMPLES_PFFAULT),)
+CONFIGURED_APPS += $(APPDIR)/examples/pffault
+endif

examples/pffault/Makefile

@@ -0,0 +1,32 @@
+############################################################################
+# apps/examples/pffault/Makefile
+#
+# SPDX-License-Identifier: Apache-2.0
+#
+# Licensed to the Apache Software Foundation (ASF) under one or more
+# contributor license agreements.  See the NOTICE file distributed with
+# this work for additional information regarding copyright ownership.  The
+# ASF licenses this file to you under the Apache License, Version 2.0 (the
+# "License"); you may not use this file except in compliance with the
+# License.  You may obtain a copy of the License at
+#
+#   http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
+# WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.  See the
+# License for the specific language governing permissions and limitations
+# under the License.
+#
+############################################################################
+
+include $(APPDIR)/Make.defs
+
+PROGNAME  = $(CONFIG_EXAMPLES_PFFAULT_PROGNAME)
+PRIORITY  = $(CONFIG_EXAMPLES_PFFAULT_PRIORITY)
+STACKSIZE = $(CONFIG_EXAMPLES_PFFAULT_STACKSIZE)
+MODULE    = $(CONFIG_EXAMPLES_PFFAULT)
+
+MAINSRC = pffault_main.c
+
+include $(APPDIR)/Application.mk

examples/pffault/pffault_main.c

@@ -0,0 +1,81 @@
+/****************************************************************************
+ * apps/examples/pffault/pffault_main.c
+ *
+ * SPDX-License-Identifier: Apache-2.0
+ *
+ * Licensed to the Apache Software Foundation (ASF) under one or more
+ * contributor license agreements.  See the NOTICE file distributed with
+ * this work for additional information regarding copyright ownership.  The
+ * ASF licenses this file to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance with the
+ * License.  You may obtain a copy of the License at
+ *
+ *   http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
+ * WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.  See the
+ * License for the specific language governing permissions and limitations
+ * under the License.
+ *
+ ****************************************************************************/
+
+/****************************************************************************
+ * Included Files
+ ****************************************************************************/
+
+#include <nuttx/config.h>
+
+#include <stdio.h>
+#include <stdint.h>
+#include <stdbool.h>
+#include <stdlib.h>
+
+/****************************************************************************
+ * Public Functions
+ ****************************************************************************/
+
+/****************************************************************************
+ * Name: main
+ *
+ * Description:
+ *   Deliberately touch a kernel-space address from an unprivileged (WORLD1)
+ *   user task to exercise the ESP32-S3 PMS isolation boundary.  In a working
+ *   protected build this raises a precise Load/StoreProhibited fault that
+ *   the kernel's recoverable-fault dispatcher must handle (terminating just
+ *   this task); the shell should survive.
+ *
+ ****************************************************************************/
+
+int main(int argc, FAR char *argv[])
+{
+  /* Default target: the base of the kernel DRAM region, to which the user
+   * world has no PMS permission.  A second argument "w" makes it a store.
+   */
+
+  volatile uint32_t *kaddr = (volatile uint32_t *)0x3fc98000;
+  bool store = (argc > 1 && argv[1][0] == 'w');
+
+  if (argc > 2)
+    {
+      kaddr = (volatile uint32_t *)strtoul(argv[2], NULL, 0);
+    }
+
+  printf("pffault: user-space %s of kernel addr %p ...\n",
+         store ? "write" : "read", (void *)kaddr);
+  fflush(stdout);
+
+  if (store)
+    {
+      *kaddr = 0xdeadbeef;   /* Expect a precise StoreProhibited (WORLD1) */
+    }
+  else
+    {
+      uint32_t v = *kaddr;   /* Expect a precise LoadProhibited (WORLD1) */
+      printf("pffault: SURVIVED unexpectedly, read %08lx\n",
+             (unsigned long)v);
+    }
+
+  printf("pffault: returned from the faulting access (unexpected)\n");
+  return 0;
+}

examples/sandbox/CMakeLists.txt

@@ -0,0 +1,33 @@
+# ##############################################################################
+# apps/examples/sandbox/CMakeLists.txt
+#
+# SPDX-License-Identifier: Apache-2.0
+#
+# Licensed to the Apache Software Foundation (ASF) under one or more contributor
+# license agreements.  See the NOTICE file distributed with this work for
+# additional information regarding copyright ownership.  The ASF licenses this
+# file to you under the Apache License, Version 2.0 (the "License"); you may not
+# use this file except in compliance with the License.  You may obtain a copy of
+# the License at
+#
+# http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
+# WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.  See the
+# License for the specific language governing permissions and limitations under
+# the License.
+#
+# ##############################################################################
+
+if(CONFIG_EXAMPLES_SANDBOX)
+  nuttx_add_application(
+    NAME
+    ${CONFIG_EXAMPLES_SANDBOX_PROGNAME}
+    SRCS
+    sandbox_main.c
+    STACKSIZE
+    ${CONFIG_EXAMPLES_SANDBOX_STACKSIZE}
+    PRIORITY
+    ${CONFIG_EXAMPLES_SANDBOX_PRIORITY})
+endif()

examples/sandbox/Kconfig

@@ -0,0 +1,85 @@
+#
+# For a description of the syntax of this configuration file,
+# see the file kconfig-language.txt in the NuttX tools repository.
+#
+
+config EXAMPLES_SANDBOX
+	tristate "Protected-build sandbox containment test"
+	default n
+	---help---
+		A test that deliberately tries to escape the kernel/user boundary of
+		a protected or kernel build, and checks that the attempt is contained:
+		the offending process is terminated and everything else keeps running.
+
+		Each target carries the outcome it expects, so the test fails a build
+		that refuses everything as well as one that permits everything.  The
+		"self" target is the control: it touches memory the process owns and
+		must be allowed.
+
+		A protected build derives the kernel target from CONFIG_NUTTX_USERSPACE.
+		A kernel build has no such address, because every process is loaded
+		into its own address environment, so the addresses below supply it.
+
+if EXAMPLES_SANDBOX
+
+config EXAMPLES_SANDBOX_PROGNAME
+	string "Program name"
+	default "sandbox"
+
+config EXAMPLES_SANDBOX_PRIORITY
+	int "sandbox task priority"
+	default 100
+
+config EXAMPLES_SANDBOX_STACKSIZE
+	int "sandbox stack size"
+	default DEFAULT_TASK_STACKSIZE
+
+config EXAMPLES_SANDBOX_ALLOC
+	int "Bytes the offender holds when it dies"
+	default 65536
+	---help---
+		The offending process allocates this much, writes to all of it so the
+		pages are really committed, and opens a file, before it makes the bad
+		access.  It still holds both when it is killed.
+
+		A process that dies owning nothing proves nothing about whether the
+		kill leaks.  Compare "free" before and after a run: the kernel heap
+		and the page pool both have to come back to where they started.
+
+config EXAMPLES_SANDBOX_KERNEL_ADDR
+	hex "Address of kernel memory"
+	default 0x0
+	---help---
+		An address that is mapped and belongs to the kernel.  Reading it from
+		a user process must fault.
+
+		It has to be mapped.  An unmapped address tests the absence of a
+		mapping instead of the permission on one, which is a different thing;
+		use the unmapped target for that.
+
+		Zero means the target is unavailable, and the test reports it as such.
+		A protected build may leave this at zero, because CONFIG_NUTTX_USERSPACE
+		gives the boundary.
+
+config EXAMPLES_SANDBOX_PERIPH_ADDR
+	hex "Address of a peripheral register"
+	default 0x0
+	---help---
+		A peripheral register that a user process must not reach, such as the
+		registers that control the memory mapping itself.
+
+		An MMU keeps processes apart but does not stop one from reaching a
+		peripheral, so this target exercises a different mechanism from the
+		kernel target.  Zero means the target is unavailable.
+
+config EXAMPLES_SANDBOX_UNMAPPED_ADDR
+	hex "Address with no mapping"
+	default 0x0
+	---help---
+		An address in no mapping at all.  Touching it must be reported.
+
+		Hardware that answers an unmapped access quietly, with zero for a read
+		and no fault, hides errors that a fault would show.  Zero means the
+		target is unavailable.
+
+endif

examples/sandbox/Make.defs

@@ -0,0 +1,25 @@
+############################################################################
+# apps/examples/sandbox/Make.defs
+#
+# SPDX-License-Identifier: Apache-2.0
+#
+# Licensed to the Apache Software Foundation (ASF) under one or more
+# contributor license agreements.  See the NOTICE file distributed with
+# this work for additional information regarding copyright ownership.  The
+# ASF licenses this file to you under the Apache License, Version 2.0 (the
+# "License"); you may not use this file except in compliance with the
+# License.  You may obtain a copy of the License at
+#
+#   http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
+# WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.  See the
+# License for the specific language governing permissions and limitations
+# under the License.
+#
+############################################################################
+
+ifneq ($(CONFIG_EXAMPLES_SANDBOX),)
+CONFIGURED_APPS += $(APPDIR)/examples/sandbox
+endif

examples/sandbox/Makefile

@@ -0,0 +1,32 @@
+############################################################################
+# apps/examples/sandbox/Makefile
+#
+# SPDX-License-Identifier: Apache-2.0
+#
+# Licensed to the Apache Software Foundation (ASF) under one or more
+# contributor license agreements.  See the NOTICE file distributed with
+# this work for additional information regarding copyright ownership.  The
+# ASF licenses this file to you under the Apache License, Version 2.0 (the
+# "License"); you may not use this file except in compliance with the
+# License.  You may obtain a copy of the License at
+#
+#   http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
+# WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.  See the
+# License for the specific language governing permissions and limitations
+# under the License.
+#
+############################################################################
+
+include $(APPDIR)/Make.defs
+
+PROGNAME  = $(CONFIG_EXAMPLES_SANDBOX_PROGNAME)
+PRIORITY  = $(CONFIG_EXAMPLES_SANDBOX_PRIORITY)
+STACKSIZE = $(CONFIG_EXAMPLES_SANDBOX_STACKSIZE)
+MODULE    = $(CONFIG_EXAMPLES_SANDBOX)
+
+MAINSRC = sandbox_main.c
+
+include $(APPDIR)/Application.mk