// Copyright (c) 2007-2009 Nokia Corporation and/or its subsidiary(-ies).

 // All rights reserved.

 // This component and the accompanying materials are made available

 // under the terms of the License "Eclipse Public License v1.0"

 // which accompanies this distribution, and is available

 // at the URL "http://www.eclipse.org/legal/epl-v10.html".

 //

 // Initial Contributors:

 // Nokia Corporation - initial contribution.

 //

 // Contributors:

 //

 // Description:

 // e32test\secure\t_ipcsafety.cpp

 // Overview:

 // Test if it's possible for a thread in a server process to access the IPC alias

 // region outside the control of the kernel.

 // API Information:

 // RMessage2

 // Details:

 // - Create a server which will take a long time IPCing any client request.

 // - Create a high priority thread which will attempt to write to a given

 // location in the IPC region, with an exception handler to retry if it fails.

 // - Create a client process which connects to the server and offers a

 // stack-based descriptor for IPC, as well as the address of another stack

 // variable that should not be able to be accessed.

 // - The bad writer will attempt to jump in and overwrite the variable,

 // causing the client to return a detectable error.

 // - Verify that this does not happen.

 // Platforms/Drives/Compatibility:

 // ARM with multiple memory model only.

 // Assumptions/Requirement/Pre-requisites:

 // Failures and causes:

 // Base Port information:

 // 

 //

 #define __E32TEST_EXTENSION__

 #include <e32test.h>

 #include <e32debug.h>

 #include <e32base.h>

 #include <e32base_private.h>

 #include "mmudetect.h"

 LOCAL_D RTest test(_L("T_IPCSAFETY"));

 void GoodExitWithError();

 TInt* DataToSplat;

 RSemaphore BadSemaphore;

 // Server stuff

 _LIT(KBadServerName,"BadServer");

 class CBadSession : public CSession2

 	{

 	virtual void ServiceL(const RMessage2& aMessage);

 	};

 class CBadServer : public CServer2

 	{

 public:

 	CBadServer(CActive::TPriority aPriority) : CServer2(aPriority)

 		{}

 	virtual CBadSession* NewSessionL(const TVersion& aVersion, const RMessage2& aMessage) const

 		{

 		return new (ELeave) CBadSession();

 		}

 	};

 void CBadSession::ServiceL(const RMessage2& aMessage)

 	{

 	TBuf16<1024> buf;

 	DataToSplat = (TInt*)aMessage.Ptr1();

 	BadSemaphore.Signal();

 	// Read the buffer lots of times to widen the time window

 	for (TInt i=0; i<1024; i++)

 		aMessage.Read(0, buf, 0);

 	CActiveScheduler::Stop();

 	aMessage.Complete(KErrNone);

 	}

 TInt BadServerThread(TAny*)

 	{

 	CTrapCleanup* cleanup=CTrapCleanup::New();

 	if (!cleanup)

 		return KErrNoMemory;

 	CActiveScheduler* scheduler = new CActiveScheduler();

 	if (!scheduler)

 		return KErrNoMemory;

 	CActiveScheduler::Install(scheduler);

 	CBadServer* server = new CBadServer(CActive::EPriorityStandard);

 	if (!server)

 		return KErrNoMemory;

 	TInt r = server->Start(KBadServerName);

 	if (r != KErrNone)

 		return r;

 	RThread::Rendezvous(KErrNone);

 	CActiveScheduler::Start();

 	delete server;

 	delete scheduler;

 	delete cleanup;

 	return KErrNone;

 	}

 class RBadSession : public RSessionBase

 	{

 public:

 	TInt Connect()

 		{

 		return CreateSession(KBadServerName, TVersion(0,0,0));

 		}

 	void AccessMe(TDesC* aBuf, TInt* aValue);

 	};

 void RBadSession::AccessMe(TDesC* aBuf, TInt* aValue)

 	{

 	SendReceive(0, TIpcArgs(aBuf, aValue));

 	};

 // Bad writer thread

 TInt * const KAliasRegion = (TInt*)0x00200000;

 const TUint KAliasMask = 0x000fffff;

 void BadExceptionHandler(TExcType, TInt, TInt, TInt, TUint aStackArgument)

 	{

 	// just retry the instruction after a delay

 	User::AfterHighRes(0);

 	return;

 	}

 TInt BadWriterThread(TAny*)

 	{

 	// set the exception handler so that we don't die when touching the ipc region

 	// as it won't be mapped until an unpredictable time

 	User::SetExceptionHandler((TExceptionHandler)BadExceptionHandler, KExceptionFault);

 	// wait for the server to tell us where to overwrite

 	BadSemaphore.Wait();

 	TInt* target = (TInt*)(((TUint)DataToSplat&KAliasMask)|(TUint)KAliasRegion);

 	*target = KErrGeneral;

 	return KErrNone;

 	}

 // The server process

 TInt BadServerProcess()

 	{

 	test.Title();

 	test.Start(_L("Test bad server overwriting good client memory"));

 	BadSemaphore.CreateLocal(0);

 	test.Next(_L("Setup bad server"));

 	RThread serverThread;

 	TRequestStatus serverStatus, serverRendezvous;

 	test_KErrNone(serverThread.Create(_L("BadServer"), BadServerThread, KDefaultStackSize, NULL, NULL));

 	serverThread.Logon(serverStatus);

 	serverThread.Rendezvous(serverRendezvous);

 	serverThread.Resume();

 	User::WaitForRequest(serverRendezvous);

 	test.Next(_L("Start bad writer thread"));

 	RThread writerThread;

 	TRequestStatus writerStatus;

 	test_KErrNone(writerThread.Create(_L("BadWriter"), BadWriterThread, KDefaultStackSize, NULL, NULL));

 	writerThread.Logon(writerStatus);

 	writerThread.SetPriority(EPriorityMore);

 	writerThread.Resume();

 	test.Next(_L("Run the good client"));

 	RProcess goodProcess;

 	TRequestStatus goodStatus;

 	test_KErrNone(goodProcess.Create(_L("T_IPCSAFETY"), _L("client")));

 	goodProcess.Logon(goodStatus);

 	goodProcess.Resume();

 	test.Next(_L("Wait for server to die"));

 	User::WaitForRequest(serverStatus);

 	test_Equal(EExitKill, serverThread.ExitType());

 	test_KErrNone(serverThread.ExitReason());

 	test.Next(_L("Check if client had memory overwritten"));

 	User::WaitForRequest(goodStatus);

 	test_Equal(EExitKill, goodProcess.ExitType());

 	test_KErrNone(goodProcess.ExitReason());

 	test.Next(_L("Kill off writer thread"));

 	writerThread.Kill(KErrNone);

 	User::WaitForRequest(writerStatus);

 	test_Equal(EExitKill, writerThread.ExitType());

 	test_KErrNone(writerThread.ExitReason());

 	test.End();

 	return KErrNone;

 	}

 // The client process

 TInt GoodClientProcess()

 	{

 	RBadSession bad;

 	TBuf16<1024> buf;

 	TInt r = KErrNone;

 	buf.SetLength(1024);

 	// just keep trying to connect if the server isn't talkative yet

 	while (bad.Connect() != KErrNone)

 		User::After(1);

 	bad.AccessMe(&buf, &r);

 	// Returns r, which logically should be KErrNone as servers aren't

 	// supposed to be able to modify

 	return r;

 	}

 // Main

 GLDEF_C TInt E32Main()

     {

 	TBuf16<512> cmd;

 	User::CommandLine(cmd);

 	// this test hardcodes various multiple memory model parameters

 	// and the moving model's aliasing technique is not susceptible to

 	// the problem in the first place

 	TUint32 memmodel = MemModelAttributes();

 	if ((memmodel & EMemModelTypeMask) != EMemModelTypeMultiple)

 		return KErrNone;

 	if(cmd.Length())

 		return GoodClientProcess();

 	else

 		return BadServerProcess();

     }