1 /* 2 * Check emulated system register access for linux-user mode. 3 * 4 * See: https://www.kernel.org/doc/Documentation/arm64/cpu-feature-registers.txt 5 * 6 * Copyright (c) 2019 Linaro 7 * 8 * This work is licensed under the terms of the GNU GPL, version 2 or later. 9 * See the COPYING file in the top-level directory. 10 * 11 * SPDX-License-Identifier: GPL-2.0-or-later 12 */ 13 14 #include <asm/hwcap.h> 15 #include <stdio.h> 16 #include <sys/auxv.h> 17 #include <signal.h> 18 #include <string.h> 19 #include <stdbool.h> 20 21 #ifndef HWCAP_CPUID 22 #define HWCAP_CPUID (1 << 11) 23 #endif 24 25 /* 26 * Older assemblers don't recognize newer system register names, 27 * but we can still access them by the Sn_n_Cn_Cn_n syntax. 28 * This also means we don't need to specifically request that the 29 * assembler enables whatever architectural features the ID registers 30 * syntax might be gated behind. 31 */ 32 #define SYS_ID_AA64ISAR2_EL1 S3_0_C0_C6_2 33 #define SYS_ID_AA64MMFR2_EL1 S3_0_C0_C7_2 34 #define SYS_ID_AA64ZFR0_EL1 S3_0_C0_C4_4 35 #define SYS_ID_AA64SMFR0_EL1 S3_0_C0_C4_5 36 37 int failed_bit_count; 38 39 /* Read and print system register `id' value */ 40 #define get_cpu_reg(id) ({ \ 41 unsigned long __val = 0xdeadbeef; \ 42 asm("mrs %0, "#id : "=r" (__val)); \ 43 printf("%-20s: 0x%016lx\n", #id, __val); \ 44 __val; \ 45 }) 46 47 /* As above but also check no bits outside of `mask' are set*/ 48 #define get_cpu_reg_check_mask(id, mask) ({ \ 49 unsigned long __cval = get_cpu_reg(id); \ 50 unsigned long __extra = __cval & ~mask; \ 51 if (__extra) { \ 52 printf("%-20s: 0x%016lx\n", " !!extra bits!!", __extra); \ 53 failed_bit_count++; \ 54 } \ 55 }) 56 57 /* As above but check RAZ */ 58 #define get_cpu_reg_check_zero(id) ({ \ 59 unsigned long __val = 0xdeadbeef; \ 60 asm("mrs %0, "#id : "=r" (__val)); \ 61 if (__val) { \ 62 printf("%-20s: 0x%016lx (not RAZ!)\n", #id, __val); \ 63 failed_bit_count++; \ 64 } \ 65 }) 66 67 /* Chunk up mask into 63:48, 47:32, 31:16, 15:0 to ease counting */ 68 #define _m(a, b, c, d) (0x ## a ## b ## c ## d ##ULL) 69 70 bool should_fail; 71 int should_fail_count; 72 int should_not_fail_count; 73 uintptr_t failed_pc[10]; 74 75 void sigill_handler(int signo, siginfo_t *si, void *data) 76 { 77 ucontext_t *uc = (ucontext_t *)data; 78 79 if (should_fail) { 80 should_fail_count++; 81 } else { 82 uintptr_t pc = (uintptr_t) uc->uc_mcontext.pc; 83 failed_pc[should_not_fail_count++] = pc; 84 } 85 uc->uc_mcontext.pc += 4; 86 } 87 88 int main(void) 89 { 90 struct sigaction sa; 91 92 /* Hook in a SIGILL handler */ 93 memset(&sa, 0, sizeof(struct sigaction)); 94 sa.sa_flags = SA_SIGINFO; 95 sa.sa_sigaction = &sigill_handler; 96 sigemptyset(&sa.sa_mask); 97 98 if (sigaction(SIGILL, &sa, 0) != 0) { 99 perror("sigaction"); 100 return 1; 101 } 102 103 /* Counter values have been exposed since Linux 4.12 */ 104 printf("Checking Counter registers\n"); 105 106 get_cpu_reg(ctr_el0); 107 get_cpu_reg(cntvct_el0); 108 get_cpu_reg(cntfrq_el0); 109 110 /* HWCAP_CPUID indicates we can read feature registers, since Linux 4.11 */ 111 if (!(getauxval(AT_HWCAP) & HWCAP_CPUID)) { 112 printf("CPUID registers unavailable\n"); 113 return 1; 114 } else { 115 printf("Checking CPUID registers\n"); 116 } 117 118 /* 119 * Some registers only expose some bits to user-space. Anything 120 * that is IMPDEF is exported as 0 to user-space. The _mask checks 121 * assert no extra bits are set. 122 * 123 * This check is *not* comprehensive as some fields are set to 124 * minimum valid fields - for the purposes of this check allowed 125 * to have non-zero values. 126 */ 127 get_cpu_reg_check_mask(id_aa64isar0_el1, _m(f0ff,ffff,f0ff,fff0)); 128 get_cpu_reg_check_mask(id_aa64isar1_el1, _m(00ff,f0ff,ffff,ffff)); 129 get_cpu_reg_check_mask(SYS_ID_AA64ISAR2_EL1, _m(0000,0000,0000,ffff)); 130 /* TGran4 & TGran64 as pegged to -1 */ 131 get_cpu_reg_check_mask(id_aa64mmfr0_el1, _m(f000,0000,ff00,0000)); 132 get_cpu_reg_check_mask(id_aa64mmfr1_el1, _m(0000,f000,0000,0000)); 133 get_cpu_reg_check_mask(SYS_ID_AA64MMFR2_EL1, _m(0000,000f,0000,0000)); 134 /* EL1/EL0 reported as AA64 only */ 135 get_cpu_reg_check_mask(id_aa64pfr0_el1, _m(000f,000f,00ff,0011)); 136 get_cpu_reg_check_mask(id_aa64pfr1_el1, _m(0000,0000,0f00,0fff)); 137 /* all hidden, DebugVer fixed to 0x6 (ARMv8 debug architecture) */ 138 get_cpu_reg_check_mask(id_aa64dfr0_el1, _m(0000,0000,0000,0006)); 139 get_cpu_reg_check_zero(id_aa64dfr1_el1); 140 get_cpu_reg_check_mask(SYS_ID_AA64ZFR0_EL1, _m(0ff0,ff0f,00ff,00ff)); 141 get_cpu_reg_check_mask(SYS_ID_AA64SMFR0_EL1, _m(80f1,00fd,0000,0000)); 142 143 get_cpu_reg_check_zero(id_aa64afr0_el1); 144 get_cpu_reg_check_zero(id_aa64afr1_el1); 145 146 get_cpu_reg_check_mask(midr_el1, _m(0000,0000,ffff,ffff)); 147 /* mpidr sets bit 31, everything else hidden */ 148 get_cpu_reg_check_mask(mpidr_el1, _m(0000,0000,8000,0000)); 149 /* REVIDR is all IMPDEF so should be all zeros to user-space */ 150 get_cpu_reg_check_zero(revidr_el1); 151 152 /* 153 * There are a block of more registers that are RAZ in the rest of 154 * the Op0=3, Op1=0, CRn=0, CRm=0,4,5,6,7 space. However for 155 * brevity we don't check stuff that is currently un-allocated 156 * here. Feel free to add them ;-) 157 */ 158 159 printf("Remaining registers should fail\n"); 160 should_fail = true; 161 162 /* Unexposed register access causes SIGILL */ 163 get_cpu_reg(id_mmfr0_el1); 164 get_cpu_reg(id_mmfr1_el1); 165 get_cpu_reg(id_mmfr2_el1); 166 get_cpu_reg(id_mmfr3_el1); 167 168 get_cpu_reg(mvfr0_el1); 169 get_cpu_reg(mvfr1_el1); 170 171 if (should_not_fail_count > 0) { 172 int i; 173 for (i = 0; i < should_not_fail_count; i++) { 174 uintptr_t pc = failed_pc[i]; 175 uint32_t insn = *(uint32_t *) pc; 176 printf("insn %#x @ %#lx unexpected FAIL\n", insn, pc); 177 } 178 return 1; 179 } 180 181 if (failed_bit_count > 0) { 182 printf("Extra information leaked to user-space!\n"); 183 return 1; 184 } 185 186 return should_fail_count == 6 ? 0 : 1; 187 } 188