Prevent userland from invoking BUG system calls, by saving the initial BUG

trap vector contents, putting the bugtrap() stub in place, and switching
back and forth between them when the kernel needs to invoke BUG functions.

4 files changed, 65 insertions, 39 deletions

diff --git a/sys/arch/mvme88k/dev/bugio.c b/sys/arch/mvme88k/dev/bugio.c
index 10d39ef1540..a8ae21fcf9f 100644
--- a/sys/arch/mvme88k/dev/bugio.c
+++ b/sys/arch/mvme88k/dev/bugio.c
@@ -1,17 +1,56 @@
-/*	$OpenBSD: bugio.c,v 1.9 2002/03/05 22:11:37 miod Exp $ */
+/*	$OpenBSD: bugio.c,v 1.10 2003/09/01 19:14:01 miod Exp $ */
 /*  Copyright (c) 1998 Steve Murphree, Jr. */
 
 #include <sys/param.h>
 #include <sys/systm.h>
 
+#include <machine/asm_macro.h>
 #include <machine/bugio.h>
 #include <machine/prom.h>
 
 register_t ossr0, ossr1, ossr2, ossr3;
 register_t bugsr0, bugsr1, bugsr2, bugsr3;
 
+unsigned long bugvec[2], sysbugvec[2];
+
+void bug_vector(void);
+void sysbug_vector(void);
+
+#define MVMEPROM_CALL(x)						\
+	__asm__ __volatile__ (__CONCAT("or r9,r0,",__STRING(x)));	\
+	__asm__ __volatile__ ("tb0 0,r0,496")
+
+void
+bug_vector()
+{
+	unsigned long *vbr, psr;
+
+	psr = disable_interrupts_return_psr();	/* paranoia */
+
+	__asm__ __volatile__ ("ldcr %0, cr7" : "=r" (vbr));
+	vbr[2 * MVMEPROM_VECTOR + 0] = bugvec[0];
+	vbr[2 * MVMEPROM_VECTOR + 1] = bugvec[1];
+
+	set_psr(psr);
+}
+
+void
+sysbug_vector()
+{
+	unsigned long *vbr, psr;
+
+	psr = disable_interrupts_return_psr();	/* paranoia */
+
+	__asm__ __volatile__ ("ldcr %0, cr7" : "=r" (vbr));
+	vbr[2 * MVMEPROM_VECTOR + 0] = sysbugvec[0];
+	vbr[2 * MVMEPROM_VECTOR + 1] = sysbugvec[1];
+
+	set_psr(psr);
+}
+
 #define	BUGCTXT()							\
 {									\
+	bug_vector();							\
 	__asm__ __volatile__ ("ldcr %0, cr17" : "=r" (ossr0));		\
 	__asm__ __volatile__ ("ldcr %0, cr18" : "=r" (ossr1));		\
 	__asm__ __volatile__ ("ldcr %0, cr19" : "=r" (ossr2));		\
@@ -36,6 +75,7 @@ register_t bugsr0, bugsr1, bugsr2, bugsr3;
 	__asm__ __volatile__ ("stcr %0, cr18" :: "r"(ossr1));		\
 	__asm__ __volatile__ ("stcr %0, cr19" :: "r"(ossr2));		\
 	__asm__ __volatile__ ("stcr %0, cr20" :: "r"(ossr3));		\
+	sysbug_vector();						\
 }
 
 static void
diff --git a/sys/arch/mvme88k/dev/bugtty.c b/sys/arch/mvme88k/dev/bugtty.c
index 18753ce6401..e8f6b482bbd 100644
--- a/sys/arch/mvme88k/dev/bugtty.c
+++ b/sys/arch/mvme88k/dev/bugtty.c
@@ -1,4 +1,4 @@
-/*	$OpenBSD: bugtty.c,v 1.15 2003/08/15 20:32:14 tedu Exp $ */
+/*	$OpenBSD: bugtty.c,v 1.16 2003/09/01 19:14:01 miod Exp $ */
 
 /* Copyright (c) 1998 Steve Murphree, Jr. 
  * Copyright (c) 1995 Dale Rahn.
@@ -113,7 +113,7 @@ bugttyattach(parent, self, aux)
 	struct device *self;
 	void *aux;
 {
-	printf(": bugtty\n");
+	printf(": fallback console\n");
 }
 
 #define BUGTTYUNIT(x) ((x) & (0x7f))
@@ -467,21 +467,6 @@ bugttycnprobe(cp)
 		return (0);
 	}
 		
-#if 0
-	switch (cputyp) {
-	case CPU_147:
-	case CPU_162:
-		cp->cn_pri = CN_NORMAL;
-		return (0);
-	default:
-		break;
-	}
-#endif
-#if 0
-	cp->cn_pri = CN_NORMAL;
-	return (0);
-#endif /* 0 */
-
 	/* locate the major number */
 	for (maj = 0; maj < nchrdev; maj++)
 		if (cdevsw[maj].d_open == bugttyopen)
diff --git a/sys/arch/mvme88k/include/prom.h b/sys/arch/mvme88k/include/prom.h
index 5fc34b43042..551213cffd7 100644
--- a/sys/arch/mvme88k/include/prom.h
+++ b/sys/arch/mvme88k/include/prom.h
@@ -1,4 +1,4 @@
-/*	$OpenBSD: prom.h,v 1.10 2003/06/04 04:11:37 deraadt Exp $ */
+/*	$OpenBSD: prom.h,v 1.11 2003/09/01 19:14:04 miod Exp $ */
 /*
  * Copyright (c) 1998 Steve Murphree, Jr.
  * Copyright (c) 1996 Nivas Madhur
@@ -30,6 +30,9 @@
 #ifndef __MACHINE_PROM_H__
 #define __MACHINE_PROM_H__
 
+/* BUG trap vector */
+#define	MVMEPROM_VECTOR		496
+
 #define MVMEPROM_INCHR		0x00
 #define MVMEPROM_INSTAT		0x01
 #define MVMEPROM_INLN		0x02
@@ -157,11 +160,9 @@ struct mvmeprom_args {
 	u_int	cputyp;
 };
 
-#endif
+extern unsigned long bugvec[2], sysbugvec[2];	/* BUG trap vector copies */
 
-#define MVMEPROM_CALL(x)	\
-	__asm__ __volatile__ ( __CONCAT("or r9,r0,",__STRING(x)) ); \
-	__asm__ __volatile__ ("tb0 0,r0,496")
+#endif	/* _LOCORE */
 
 #define MVMEPROM_REG_DEVLUN	"r2"
 #define MVMEPROM_REG_CTRLLUN	"r3"
diff --git a/sys/arch/mvme88k/mvme88k/locore_c_routines.c b/sys/arch/mvme88k/mvme88k/locore_c_routines.c
index fc9a14f1e02..ca62159eae1 100644
--- a/sys/arch/mvme88k/mvme88k/locore_c_routines.c
+++ b/sys/arch/mvme88k/mvme88k/locore_c_routines.c
@@ -1,4 +1,4 @@
-/* $OpenBSD: locore_c_routines.c,v 1.30 2003/08/22 11:23:06 miod Exp $	*/
+/* $OpenBSD: locore_c_routines.c,v 1.31 2003/09/01 19:14:04 miod Exp $	*/
 /*
  * Mach Operating System
  * Copyright (c) 1993-1991 Carnegie Mellon University
@@ -38,6 +38,7 @@
 #include <machine/asm_macro.h>		/* enable/disable interrupts	*/
 #include <machine/cpu_number.h>		/* cpu_number()		*/
 #include <machine/locore.h>
+#include <machine/prom.h>
 #include <machine/trap.h>
 #ifdef M88100
 #include <machine/m88100.h>		/* DMT_VALID		*/
@@ -321,6 +322,8 @@ vector_init(m88k_exception_vector_area *vector, unsigned *vector_init_list)
 {
 	unsigned num;
 	unsigned vec;
+	extern void bugtrap(void);
+	extern void m88110_bugtrap(void);
 
 	for (num = 0; (vec = vector_init_list[num]) != END_OF_VECTOR_LIST; num++) {
 		if (vec != UNKNOWN_HANDLER)
@@ -331,42 +334,35 @@ vector_init(m88k_exception_vector_area *vector, unsigned *vector_init_list)
 		__asm__ (NOP_STRING);
 	}
 
+	/* Save BUG vector */
+	bugvec[0] = vector[MVMEPROM_VECTOR].word_one;
+	bugvec[1] = vector[MVMEPROM_VECTOR].word_two;
+
 	switch (cputyp) {
 #ifdef M88110
 	case CPU_88110:
-		while (num < 496) {
-			SET_VECTOR(num, m88110_sigsys);
-			num++;
-		}
-		num++; /* skip 496, BUG ROM vector */
-		SET_VECTOR(450, m88110_syscall_handler);
-
 		while (num <= SIGSYS_MAX)
 			SET_VECTOR(num++, m88110_sigsys);
 
 		while (num <= SIGTRAP_MAX)
 			SET_VECTOR(num++, m88110_sigtrap);
 
+		SET_VECTOR(450, m88110_syscall_handler);
+		SET_VECTOR(MVMEPROM_VECTOR, m88110_bugtrap);
 		SET_VECTOR(504, m88110_stepbpt);
 		SET_VECTOR(511, m88110_userbpt);
 		break;
 #endif /* M88110 */
 #ifdef M88100
 	case CPU_88100:
-		while (num < 496) {
-			SET_VECTOR(num, sigsys);
-			num++;
-		}
-		num++; /* skip 496, BUG ROM vector */
-
-		SET_VECTOR(450, syscall_handler);
-
 		while (num <= SIGSYS_MAX)
 			SET_VECTOR(num++, sigsys);
 
 		while (num <= SIGTRAP_MAX)
 			SET_VECTOR(num++, sigtrap);
 
+		SET_VECTOR(450, syscall_handler);
+		SET_VECTOR(MVMEPROM_VECTOR, bugtrap);
 		SET_VECTOR(504, stepbpt);
 		SET_VECTOR(511, userbpt);
 		break;
@@ -375,6 +371,10 @@ vector_init(m88k_exception_vector_area *vector, unsigned *vector_init_list)
 
 	/* GCC will by default produce explicit trap 503 for division by zero */
 	SET_VECTOR(503, vector_init_list[T_ZERODIV]);
+
+	/* Save new BUG vector */
+	sysbugvec[0] = vector[MVMEPROM_VECTOR].word_one;
+	sysbugvec[1] = vector[MVMEPROM_VECTOR].word_two;
 }
 
 #ifdef MVME188