⬢ DragonFlyBSD Kernel Audit
DF-5668 / fix.diff
← back to finding ↓ download raw 
  1
  2
  3
  4
  5
  6
  7
  8
  9
 10
 11
 12
 13
 14
 15
 16
 17
 18
 19
 20
 21
 22
 23
 24
 25
 26
 27
 28
 29
 30
 31
 32
 33
 34
 35
 36
 37
 38
 39
 40
 41
 42
 43
 44
 45
 46
 47
 48
 49
 50
 51
 52
 53
 54
 55
 56
 57
 58
 59
 60
 61
 62
 63
 64
 65
 66
 67
 68
 69
 70
 71
 72
 73
 74
 75
 76
 77
 78
 79
 80
 81
 82
 83
 84
 85
 86
 87
 88
 89
 90
 91
 92
 93
 94
 95
 96
 97
 98
 99
100
101
102
103
104
105
106
107
108
109
110
--- sys/platform/pc64/acpica/OsdEnvironment.c
+++ sys/platform/pc64/acpica/OsdEnvironment.c
@@ -33,12 +33,17 @@
 
 #include <sys/types.h>
 #include <sys/linker_set.h>
+#include <sys/systm.h>
 #include <sys/sysctl.h>
 
+#include <machine/pmap.h>
 #include <machine/vmparam.h>
 
 #include "acpi.h"
 
+static int	acpi_rsdp_checksum(const uint8_t *, int);
+static int	acpi_validate_rsdp_paddr(u_long);
+
 static u_long acpi_root_phys;
 
 SYSCTL_ULONG(_machdep, OID_AUTO, acpi_root, CTLFLAG_RD, &acpi_root_phys, 0,
@@ -56,6 +61,51 @@
 	return (AE_OK);
 }
 
+/*
+ * Sum a region modulo 256; a valid ACPI checksum region sums to 0.
+ */
+static int
+acpi_rsdp_checksum(const uint8_t *cp, int len)
+{
+	int sum = 0;
+
+	while (len-- > 0)
+		sum += *cp++;
+	return (sum & 0xFF);
+}
+
+/*
+ * The RSDP address passed in via hint.acpi.0.rsdp must refer to actual
+ * physical memory (mapping an address with reserved PTE bits faults the
+ * moment it is read) and the bytes it points at must actually look like
+ * an RSDP (signature, a revision we understand, checksums) before it is
+ * handed to ACPICA as the table root.  Otherwise fall back to the
+ * firmware scan.
+ */
+static int
+acpi_validate_rsdp_paddr(u_long paddr)
+{
+	const ACPI_TABLE_RSDP *rsdp;
+	void *map;
+	int ok = 0;
+
+	if (paddr == 0 || paddr >= ptoa(Maxmem))
+		return (0);
+	map = pmap_mapdev(paddr, PAGE_SIZE);
+	rsdp = (const ACPI_TABLE_RSDP *)map;
+	if (memcmp(rsdp->Signature, ACPI_SIG_RSDP,
+	    sizeof(rsdp->Signature)) == 0 &&
+	    rsdp->Revision <= 2 &&
+	    acpi_rsdp_checksum((const uint8_t *)rsdp,
+	    ACPI_RSDP_CHECKSUM_LENGTH) == 0 &&
+	    (rsdp->Revision < 2 ||
+	    acpi_rsdp_checksum((const uint8_t *)rsdp,
+	    ACPI_RSDP_XCHECKSUM_LENGTH) == 0))
+		ok = 1;
+	pmap_unmapdev((vm_offset_t)map, PAGE_SIZE);
+	return (ok);
+}
+
 ACPI_PHYSICAL_ADDRESS
 AcpiOsGetRootPointer(void)
 {
@@ -70,8 +120,14 @@
 		 * manually here.
 		 */
 		if (kgetenv_ulong("hint.acpi.0.rsdp", &acpi_root) == 1) {
-			acpi_root_phys = acpi_root;
-		} else {
+			if (acpi_validate_rsdp_paddr(acpi_root)) {
+				acpi_root_phys = acpi_root;
+			} else {
+				kprintf("AcpiOsGetRootPointer: kenv RSDP failed "
+				    "validation, falling back to firmware scan\n");
+			}
+		}
+		if (acpi_root_phys == 0) {
 			status = AcpiFindRootPointer(&ptr);
 			if (ACPI_SUCCESS(status))
 				acpi_root_phys = ptr;
--- sys/contrib/dev/acpica/source/components/tables/tbxfload.c
+++ sys/contrib/dev/acpica/source/components/tables/tbxfload.c
@@ -272,10 +272,16 @@
      * Load the namespace. The DSDT is required, but any SSDT and
      * PSDT tables are optional. Verify the DSDT.
      */
+    if (!AcpiGbl_RootTableList.CurrentTableCount ||
+        AcpiGbl_DsdtIndex == ACPI_INVALID_TABLE_INDEX)
+    {
+        Status = AE_NO_ACPI_TABLES;
+        goto UnlockAndExit;
+    }
+
     Table = &AcpiGbl_RootTableList.Tables[AcpiGbl_DsdtIndex];
 
-    if (!AcpiGbl_RootTableList.CurrentTableCount ||
-        !ACPI_COMPARE_NAMESEG (Table->Signature.Ascii, ACPI_SIG_DSDT) ||
+    if (!ACPI_COMPARE_NAMESEG (Table->Signature.Ascii, ACPI_SIG_DSDT) ||
          ACPI_FAILURE (AcpiTbValidateTable (Table)))
     {
         Status = AE_NO_ACPI_TABLES;