1 /* SPDX-License-Identifier: GPL-2.0 */ 2 /* Copyright (C) 2019 ARM Limited */ 3 4 #ifndef __TEST_SIGNALS_UTILS_H__ 5 #define __TEST_SIGNALS_UTILS_H__ 6 7 #include <assert.h> 8 #include <stdio.h> 9 #include <stdint.h> 10 #include <string.h> 11 12 #include <linux/compiler.h> 13 14 #include "test_signals.h" 15 16 int test_init(struct tdescr *td); 17 int test_setup(struct tdescr *td); 18 void test_cleanup(struct tdescr *td); 19 int test_run(struct tdescr *td); 20 void test_result(struct tdescr *td); 21 22 #ifndef __NR_prctl 23 #define __NR_prctl 167 24 #endif 25 26 /* 27 * The prctl takes 1 argument but we need to ensure that the other 28 * values passed in registers to the syscall are zero since the kernel 29 * validates them. 30 */ 31 #define gcs_set_state(state) \ 32 ({ \ 33 register long _num __asm__ ("x8") = __NR_prctl; \ 34 register long _arg1 __asm__ ("x0") = PR_SET_SHADOW_STACK_STATUS; \ 35 register long _arg2 __asm__ ("x1") = (long)(state); \ 36 register long _arg3 __asm__ ("x2") = 0; \ 37 register long _arg4 __asm__ ("x3") = 0; \ 38 register long _arg5 __asm__ ("x4") = 0; \ 39 \ 40 __asm__ volatile ( \ 41 "svc #0\n" \ 42 : "=r"(_arg1) \ 43 : "r"(_arg1), "r"(_arg2), \ 44 "r"(_arg3), "r"(_arg4), \ 45 "r"(_arg5), "r"(_num) \ 46 : "memory", "cc" \ 47 ); \ 48 _arg1; \ 49 }) 50 51 static inline __attribute__((always_inline)) uint64_t get_gcspr_el0(void) 52 { 53 uint64_t val; 54 55 asm volatile("mrs %0, S3_3_C2_C5_1" : "=r" (val)); 56 57 return val; 58 } 59 60 static inline bool feats_ok(struct tdescr *td) 61 { 62 if (td->feats_incompatible & td->feats_supported) 63 return false; 64 return (td->feats_required & td->feats_supported) == td->feats_required; 65 } 66 67 /* 68 * Obtaining a valid and full-blown ucontext_t from userspace is tricky: 69 * libc getcontext does() not save all the regs and messes with some of 70 * them (pstate value in particular is not reliable). 71 * 72 * Here we use a service signal to grab the ucontext_t from inside a 73 * dedicated signal handler, since there, it is populated by Kernel 74 * itself in setup_sigframe(). The grabbed context is then stored and 75 * made available in td->live_uc. 76 * 77 * As service-signal is used a SIGTRAP induced by a 'brk' instruction, 78 * because here we have to avoid syscalls to trigger the signal since 79 * they would cause any SVE sigframe content (if any) to be removed. 80 * 81 * Anyway this function really serves a dual purpose: 82 * 83 * 1. grab a valid sigcontext into td->live_uc for result analysis: in 84 * such case it returns 1. 85 * 86 * 2. detect if, somehow, a previously grabbed live_uc context has been 87 * used actively with a sigreturn: in such a case the execution would have 88 * magically resumed in the middle of this function itself (seen_already==1): 89 * in such a case return 0, since in fact we have not just simply grabbed 90 * the context. 91 * 92 * This latter case is useful to detect when a fake_sigreturn test-case has 93 * unexpectedly survived without hitting a SEGV. 94 * 95 * Note that the case of runtime dynamically sized sigframes (like in SVE 96 * context) is still NOT addressed: sigframe size is supposed to be fixed 97 * at sizeof(ucontext_t). 98 */ 99 static __always_inline bool get_current_context(struct tdescr *td, 100 ucontext_t *dest_uc, 101 size_t dest_sz) 102 { 103 static volatile bool seen_already; 104 int i; 105 char *uc = (char *)dest_uc; 106 107 assert(td && dest_uc); 108 /* it's a genuine invocation..reinit */ 109 seen_already = 0; 110 td->live_uc_valid = 0; 111 td->live_sz = dest_sz; 112 113 /* 114 * This is a memset() but we don't want the compiler to 115 * optimise it into either instructions or a library call 116 * which might be incompatible with streaming mode. 117 */ 118 for (i = 0; i < td->live_sz; i++) { 119 uc[i] = 0; 120 OPTIMIZER_HIDE_VAR(uc[0]); 121 } 122 123 td->live_uc = dest_uc; 124 /* 125 * Grab ucontext_t triggering a SIGTRAP. 126 * 127 * Note that: 128 * - live_uc_valid is declared volatile sig_atomic_t in 129 * struct tdescr since it will be changed inside the 130 * sig_copyctx handler 131 * - the additional 'memory' clobber is there to avoid possible 132 * compiler's assumption on live_uc_valid and the content 133 * pointed by dest_uc, which are all changed inside the signal 134 * handler 135 * - BRK causes a debug exception which is handled by the Kernel 136 * and finally causes the SIGTRAP signal to be delivered to this 137 * test thread. Since such delivery happens on the ret_to_user() 138 * /do_notify_resume() debug exception return-path, we are sure 139 * that the registered SIGTRAP handler has been run to completion 140 * before the execution path is restored here: as a consequence 141 * we can be sure that the volatile sig_atomic_t live_uc_valid 142 * carries a meaningful result. Being in a single thread context 143 * we'll also be sure that any access to memory modified by the 144 * handler (namely ucontext_t) will be visible once returned. 145 * - note that since we are using a breakpoint instruction here 146 * to cause a SIGTRAP, the ucontext_t grabbed from the signal 147 * handler would naturally contain a PC pointing exactly to this 148 * BRK line, which means that, on return from the signal handler, 149 * or if we place the ucontext_t on the stack to fake a sigreturn, 150 * we'll end up in an infinite loop of BRK-SIGTRAP-handler. 151 * For this reason we take care to artificially move forward the 152 * PC to the next instruction while inside the signal handler. 153 */ 154 asm volatile ("brk #666" 155 : "+m" (*dest_uc) 156 : 157 : "memory"); 158 159 /* 160 * If we were grabbing a streaming mode context then we may 161 * have entered streaming mode behind the system's back and 162 * libc or compiler generated code might decide to do 163 * something invalid in streaming mode, or potentially even 164 * the state of ZA. Issue a SMSTOP to exit both now we have 165 * grabbed the state. 166 */ 167 if (td->feats_supported & FEAT_SME) 168 asm volatile("msr S0_3_C4_C6_3, xzr"); 169 170 /* 171 * If we get here with seen_already==1 it implies the td->live_uc 172 * context has been used to get back here....this probably means 173 * a test has failed to cause a SEGV...anyway live_uc does not 174 * point to a just acquired copy of ucontext_t...so return 0 175 */ 176 if (seen_already) { 177 fprintf(stdout, 178 "Unexpected successful sigreturn detected: live_uc is stale !\n"); 179 return 0; 180 } 181 seen_already = 1; 182 183 return td->live_uc_valid; 184 } 185 186 int fake_sigreturn(void *sigframe, size_t sz, int misalign_bytes); 187 #endif 188