@samitouri / QOSamiQemu
Code Commits Issues Pulls Sessions CI/CD
master
master
c 187 lines 6.4 KB
Raw
1 /*
2 * Check emulated system register access for linux-user mode.
3 *
4 * See: https://www.kernel.org/doc/Documentation/arm64/cpu-feature-registers.txt
5 *
6 * Copyright (c) 2019 Linaro
7 *
8 * This work is licensed under the terms of the GNU GPL, version 2 or later.
9 * See the COPYING file in the top-level directory.
10 *
11 * SPDX-License-Identifier: GPL-2.0-or-later
12 */
13
14 #include <asm/hwcap.h>
15 #include <stdio.h>
16 #include <sys/auxv.h>
17 #include <signal.h>
18 #include <string.h>
19 #include <stdbool.h>
20
21 #ifndef HWCAP_CPUID
22 #define HWCAP_CPUID (1 << 11)
23 #endif
24
25 /*
26 * Older assemblers don't recognize newer system register names,
27 * but we can still access them by the Sn_n_Cn_Cn_n syntax.
28 * This also means we don't need to specifically request that the
29 * assembler enables whatever architectural features the ID registers
30 * syntax might be gated behind.
31 */
32 #define SYS_ID_AA64ISAR2_EL1 S3_0_C0_C6_2
33 #define SYS_ID_AA64MMFR2_EL1 S3_0_C0_C7_2
34 #define SYS_ID_AA64ZFR0_EL1 S3_0_C0_C4_4
35 #define SYS_ID_AA64SMFR0_EL1 S3_0_C0_C4_5
36
37 int failed_bit_count;
38
39 /* Read and print system register `id' value */
40 #define get_cpu_reg(id) ({ \
41 unsigned long __val = 0xdeadbeef; \
42 asm("mrs %0, "#id : "=r" (__val)); \
43 printf("%-20s: 0x%016lx\n", #id, __val); \
44 __val; \
45 })
46
47 /* As above but also check no bits outside of `mask' are set*/
48 #define get_cpu_reg_check_mask(id, mask) ({ \
49 unsigned long __cval = get_cpu_reg(id); \
50 unsigned long __extra = __cval & ~mask; \
51 if (__extra) { \
52 printf("%-20s: 0x%016lx\n", " !!extra bits!!", __extra); \
53 failed_bit_count++; \
54 } \
55 })
56
57 /* As above but check RAZ */
58 #define get_cpu_reg_check_zero(id) ({ \
59 unsigned long __val = 0xdeadbeef; \
60 asm("mrs %0, "#id : "=r" (__val)); \
61 if (__val) { \
62 printf("%-20s: 0x%016lx (not RAZ!)\n", #id, __val); \
63 failed_bit_count++; \
64 } \
65 })
66
67 /* Chunk up mask into 63:48, 47:32, 31:16, 15:0 to ease counting */
68 #define _m(a, b, c, d) (0x ## a ## b ## c ## d ##ULL)
69
70 bool should_fail;
71 int should_fail_count;
72 int should_not_fail_count;
73 uintptr_t failed_pc[10];
74
75 void sigill_handler(int signo, siginfo_t *si, void *data)
76 {
77 ucontext_t *uc = (ucontext_t *)data;
78
79 if (should_fail) {
80 should_fail_count++;
81 } else {
82 uintptr_t pc = (uintptr_t) uc->uc_mcontext.pc;
83 failed_pc[should_not_fail_count++] = pc;
84 }
85 uc->uc_mcontext.pc += 4;
86 }
87
88 int main(void)
89 {
90 struct sigaction sa;
91
92 /* Hook in a SIGILL handler */
93 memset(&sa, 0, sizeof(struct sigaction));
94 sa.sa_flags = SA_SIGINFO;
95 sa.sa_sigaction = &sigill_handler;
96 sigemptyset(&sa.sa_mask);
97
98 if (sigaction(SIGILL, &sa, 0) != 0) {
99 perror("sigaction");
100 return 1;
101 }
102
103 /* Counter values have been exposed since Linux 4.12 */
104 printf("Checking Counter registers\n");
105
106 get_cpu_reg(ctr_el0);
107 get_cpu_reg(cntvct_el0);
108 get_cpu_reg(cntfrq_el0);
109
110 /* HWCAP_CPUID indicates we can read feature registers, since Linux 4.11 */
111 if (!(getauxval(AT_HWCAP) & HWCAP_CPUID)) {
112 printf("CPUID registers unavailable\n");
113 return 1;
114 } else {
115 printf("Checking CPUID registers\n");
116 }
117
118 /*
119 * Some registers only expose some bits to user-space. Anything
120 * that is IMPDEF is exported as 0 to user-space. The _mask checks
121 * assert no extra bits are set.
122 *
123 * This check is *not* comprehensive as some fields are set to
124 * minimum valid fields - for the purposes of this check allowed
125 * to have non-zero values.
126 */
127 get_cpu_reg_check_mask(id_aa64isar0_el1, _m(f0ff,ffff,f0ff,fff0));
128 get_cpu_reg_check_mask(id_aa64isar1_el1, _m(00ff,f0ff,ffff,ffff));
129 get_cpu_reg_check_mask(SYS_ID_AA64ISAR2_EL1, _m(00ff,0000,00ff,ffff));
130 /* TGran4 & TGran64 as pegged to -1 */
131 get_cpu_reg_check_mask(id_aa64mmfr0_el1, _m(f000,0000,ff00,0000));
132 get_cpu_reg_check_mask(id_aa64mmfr1_el1, _m(0000,f000,0000,0000));
133 get_cpu_reg_check_mask(SYS_ID_AA64MMFR2_EL1, _m(0000,000f,0000,0000));
134 /* EL1/EL0 reported as AA64 only */
135 get_cpu_reg_check_mask(id_aa64pfr0_el1, _m(000f,000f,00ff,0011));
136 get_cpu_reg_check_mask(id_aa64pfr1_el1, _m(0000,0000,0f00,0fff));
137 /* all hidden, DebugVer fixed to 0x6 (ARMv8 debug architecture) */
138 get_cpu_reg_check_mask(id_aa64dfr0_el1, _m(0000,0000,0000,0006));
139 get_cpu_reg_check_zero(id_aa64dfr1_el1);
140 get_cpu_reg_check_mask(SYS_ID_AA64ZFR0_EL1, _m(0ff0,ff0f,0fff,00ff));
141 get_cpu_reg_check_mask(SYS_ID_AA64SMFR0_EL1, _m(8ff1,fcff,0000,0000));
142
143 get_cpu_reg_check_zero(id_aa64afr0_el1);
144 get_cpu_reg_check_zero(id_aa64afr1_el1);
145
146 get_cpu_reg_check_mask(midr_el1, _m(0000,0000,ffff,ffff));
147 /* mpidr sets bit 31, everything else hidden */
148 get_cpu_reg_check_mask(mpidr_el1, _m(0000,0000,8000,0000));
149 /* REVIDR is all IMPDEF so should be all zeros to user-space */
150 get_cpu_reg_check_zero(revidr_el1);
151
152 /*
153 * There are a block of more registers that are RAZ in the rest of
154 * the Op0=3, Op1=0, CRn=0, CRm=0,4,5,6,7 space. However for
155 * brevity we don't check stuff that is currently un-allocated
156 * here. Feel free to add them ;-)
157 */
158
159 printf("Remaining registers should fail\n");
160 should_fail = true;
161
162 /* Unexposed register access causes SIGILL */
163 get_cpu_reg(id_mmfr0_el1);
164 get_cpu_reg(id_mmfr1_el1);
165 get_cpu_reg(id_mmfr2_el1);
166 get_cpu_reg(id_mmfr3_el1);
167
168 get_cpu_reg(mvfr0_el1);
169 get_cpu_reg(mvfr1_el1);
170
171 if (should_not_fail_count > 0) {
172 int i;
173 for (i = 0; i < should_not_fail_count; i++) {
174 uintptr_t pc = failed_pc[i];
175 uint32_t insn = *(uint32_t *) pc;
176 printf("insn %#x @ %#lx unexpected FAIL\n", insn, pc);
177 }
178 return 1;
179 }
180
181 if (failed_bit_count > 0) {
182 printf("Extra information leaked to user-space!\n");
183 return 1;
184 }
185
186 return should_fail_count == 6 ? 0 : 1;
187 }