1 /* SPDX-License-Identifier: GPL-2.0 */
2 /* Copyright (C) 2019 ARM Limited */
3
4 #ifndef __TEST_SIGNALS_UTILS_H__
5 #define __TEST_SIGNALS_UTILS_H__
6
7 #include <assert.h>
8 #include <stdio.h>
9 #include <stdint.h>
10 #include <string.h>
11
12 #include <linux/compiler.h>
13
14 #include "test_signals.h"
15
16 int test_init(struct tdescr *td);
17 int test_setup(struct tdescr *td);
18 void test_cleanup(struct tdescr *td);
19 int test_run(struct tdescr *td);
20 void test_result(struct tdescr *td);
21
22 #ifndef __NR_prctl
23 #define __NR_prctl 167
24 #endif
25
26 /*
27 * The prctl takes 1 argument but we need to ensure that the other
28 * values passed in registers to the syscall are zero since the kernel
29 * validates them.
30 */
31 #define gcs_set_state(state) \
32 ({ \
33 register long _num __asm__ ("x8") = __NR_prctl; \
34 register long _arg1 __asm__ ("x0") = PR_SET_SHADOW_STACK_STATUS; \
35 register long _arg2 __asm__ ("x1") = (long)(state); \
36 register long _arg3 __asm__ ("x2") = 0; \
37 register long _arg4 __asm__ ("x3") = 0; \
38 register long _arg5 __asm__ ("x4") = 0; \
39 \
40 __asm__ volatile ( \
41 "svc #0\n" \
42 : "=r"(_arg1) \
43 : "r"(_arg1), "r"(_arg2), \
44 "r"(_arg3), "r"(_arg4), \
45 "r"(_arg5), "r"(_num) \
46 : "memory", "cc" \
47 ); \
48 _arg1; \
49 })
50
get_gcspr_el0(void)51 static inline __attribute__((always_inline)) uint64_t get_gcspr_el0(void)
52 {
53 uint64_t val;
54
55 asm volatile("mrs %0, S3_3_C2_C5_1" : "=r" (val));
56
57 return val;
58 }
59
feats_ok(struct tdescr * td)60 static inline bool feats_ok(struct tdescr *td)
61 {
62 if (td->feats_incompatible & td->feats_supported)
63 return false;
64 return (td->feats_required & td->feats_supported) == td->feats_required;
65 }
66
67 /*
68 * Obtaining a valid and full-blown ucontext_t from userspace is tricky:
69 * libc getcontext does() not save all the regs and messes with some of
70 * them (pstate value in particular is not reliable).
71 *
72 * Here we use a service signal to grab the ucontext_t from inside a
73 * dedicated signal handler, since there, it is populated by Kernel
74 * itself in setup_sigframe(). The grabbed context is then stored and
75 * made available in td->live_uc.
76 *
77 * As service-signal is used a SIGTRAP induced by a 'brk' instruction,
78 * because here we have to avoid syscalls to trigger the signal since
79 * they would cause any SVE sigframe content (if any) to be removed.
80 *
81 * Anyway this function really serves a dual purpose:
82 *
83 * 1. grab a valid sigcontext into td->live_uc for result analysis: in
84 * such case it returns 1.
85 *
86 * 2. detect if, somehow, a previously grabbed live_uc context has been
87 * used actively with a sigreturn: in such a case the execution would have
88 * magically resumed in the middle of this function itself (seen_already==1):
89 * in such a case return 0, since in fact we have not just simply grabbed
90 * the context.
91 *
92 * This latter case is useful to detect when a fake_sigreturn test-case has
93 * unexpectedly survived without hitting a SEGV.
94 *
95 * Note that the case of runtime dynamically sized sigframes (like in SVE
96 * context) is still NOT addressed: sigframe size is supposed to be fixed
97 * at sizeof(ucontext_t).
98 */
get_current_context(struct tdescr * td,ucontext_t * dest_uc,size_t dest_sz)99 static __always_inline bool get_current_context(struct tdescr *td,
100 ucontext_t *dest_uc,
101 size_t dest_sz)
102 {
103 static volatile bool seen_already;
104 int i;
105 char *uc = (char *)dest_uc;
106
107 assert(td && dest_uc);
108 /* it's a genuine invocation..reinit */
109 seen_already = 0;
110 td->live_uc_valid = 0;
111 td->live_sz = dest_sz;
112
113 /*
114 * This is a memset() but we don't want the compiler to
115 * optimise it into either instructions or a library call
116 * which might be incompatible with streaming mode.
117 */
118 for (i = 0; i < td->live_sz; i++) {
119 uc[i] = 0;
120 OPTIMIZER_HIDE_VAR(uc[0]);
121 }
122
123 td->live_uc = dest_uc;
124 /*
125 * Grab ucontext_t triggering a SIGTRAP.
126 *
127 * Note that:
128 * - live_uc_valid is declared volatile sig_atomic_t in
129 * struct tdescr since it will be changed inside the
130 * sig_copyctx handler
131 * - the additional 'memory' clobber is there to avoid possible
132 * compiler's assumption on live_uc_valid and the content
133 * pointed by dest_uc, which are all changed inside the signal
134 * handler
135 * - BRK causes a debug exception which is handled by the Kernel
136 * and finally causes the SIGTRAP signal to be delivered to this
137 * test thread. Since such delivery happens on the ret_to_user()
138 * /do_notify_resume() debug exception return-path, we are sure
139 * that the registered SIGTRAP handler has been run to completion
140 * before the execution path is restored here: as a consequence
141 * we can be sure that the volatile sig_atomic_t live_uc_valid
142 * carries a meaningful result. Being in a single thread context
143 * we'll also be sure that any access to memory modified by the
144 * handler (namely ucontext_t) will be visible once returned.
145 * - note that since we are using a breakpoint instruction here
146 * to cause a SIGTRAP, the ucontext_t grabbed from the signal
147 * handler would naturally contain a PC pointing exactly to this
148 * BRK line, which means that, on return from the signal handler,
149 * or if we place the ucontext_t on the stack to fake a sigreturn,
150 * we'll end up in an infinite loop of BRK-SIGTRAP-handler.
151 * For this reason we take care to artificially move forward the
152 * PC to the next instruction while inside the signal handler.
153 */
154 asm volatile ("brk #666"
155 : "+m" (*dest_uc)
156 :
157 : "memory");
158
159 /*
160 * If we were grabbing a streaming mode context then we may
161 * have entered streaming mode behind the system's back and
162 * libc or compiler generated code might decide to do
163 * something invalid in streaming mode, or potentially even
164 * the state of ZA. Issue a SMSTOP to exit both now we have
165 * grabbed the state.
166 */
167 if (td->feats_supported & FEAT_SME)
168 asm volatile("msr S0_3_C4_C6_3, xzr");
169
170 /*
171 * If we get here with seen_already==1 it implies the td->live_uc
172 * context has been used to get back here....this probably means
173 * a test has failed to cause a SEGV...anyway live_uc does not
174 * point to a just acquired copy of ucontext_t...so return 0
175 */
176 if (seen_already) {
177 fprintf(stdout,
178 "Unexpected successful sigreturn detected: live_uc is stale !\n");
179 return 0;
180 }
181 seen_already = 1;
182
183 return td->live_uc_valid;
184 }
185
186 int fake_sigreturn(void *sigframe, size_t sz, int misalign_bytes);
187 #endif
188