1  /*
       2   * Check decoding of PR_SET_SPECULATION_CTRL and PR_GET_SPECULATION_CTRL
       3   * prctl operations.
       4   *
       5   * Copyright (c) 2018-2021 The strace developers.
       6   * All rights reserved.
       7   *
       8   * SPDX-License-Identifier: GPL-2.0-or-later
       9   */
      10  
      11  #include "tests.h"
      12  #include "scno.h"
      13  
      14  #include <errno.h>
      15  #include <stdio.h>
      16  #include <stdlib.h>
      17  #include <unistd.h>
      18  #include <linux/prctl.h>
      19  
      20  static long injected_val;
      21  
      22  static long
      23  do_prctl(kernel_ulong_t cmd, kernel_ulong_t arg2, kernel_ulong_t arg3)
      24  {
      25  	long rc = syscall(__NR_prctl, cmd, arg2, arg3);
      26  
      27  	if (rc != injected_val)
      28  		error_msg_and_fail("Return value (%ld) differs from expected "
      29  				   "injected value (%ld)",
      30  				   rc, injected_val);
      31  
      32  	return rc;
      33  }
      34  
      35  int
      36  main(int argc, char **argv)
      37  {
      38  	static const kernel_ulong_t bogus_arg2 =
      39  		(kernel_ulong_t) 0xdeadfacebadc0dedULL;
      40  	static const kernel_ulong_t bogus_arg3 =
      41  		(kernel_ulong_t) 0xdecafeedbeefda7eULL;
      42  
      43  	static const struct {
      44  		long arg;
      45  		const char *str;
      46  	} spec_strs[] = {
      47  		{ 0, "PR_SPEC_STORE_BYPASS" },
      48  		{ 1, "PR_SPEC_INDIRECT_BRANCH" },
      49  		{ 2, "PR_SPEC_L1D_FLUSH" },
      50  	};
      51  
      52  	static const struct {
      53  		long arg;
      54  		const char *str;
      55  	} get_strs[] = {
      56  		{ -1, "" },
      57  		{ 0, " (PR_SPEC_NOT_AFFECTED)" },
      58  		{ 1, " (PR_SPEC_PRCTL)" },
      59  		{ 3, " (PR_SPEC_PRCTL|PR_SPEC_ENABLE)" },
      60  		{ 8, " (PR_SPEC_FORCE_DISABLE)" },
      61  		{ 16, " (PR_SPEC_DISABLE_NOEXEC)" },
      62  		{ 32, "" },
      63  		{ 42, " (PR_SPEC_ENABLE|PR_SPEC_FORCE_DISABLE|0x20)" },
      64  	};
      65  	static const struct {
      66  		kernel_ulong_t arg;
      67  		const char *str;
      68  	} set_strs[] = {
      69  		{ 0, "0 /* PR_SPEC_??? */" },
      70  		{ 1, "0x1 /* PR_SPEC_??? */" },
      71  		{ 2, "PR_SPEC_ENABLE" },
      72  		{ 3, "0x3 /* PR_SPEC_??? */" },
      73  		{ 8, "PR_SPEC_FORCE_DISABLE" },
      74  		{ 16, "PR_SPEC_DISABLE_NOEXEC" },
      75  		{ 32, "0x20 /* PR_SPEC_??? */" },
      76  		{ (kernel_ulong_t) 0xdecafeedbeefda7eULL, "0x"
      77  #if SIZEOF_KERNEL_LONG_T == 8
      78  			"decafeed"
      79  #endif
      80  			"beefda7e /* PR_SPEC_??? */" },
      81  	};
      82  
      83  	long rc;
      84  	unsigned long num_skip;
      85  	const char *str = NULL;
      86  	bool locked = false;
      87  
      88  	if (argc < 3)
      89  		error_msg_and_fail("Usage: %s NUM_SKIP INJECT_RETVAL", argv[0]);
      90  
      91  	num_skip = strtoul(argv[1], NULL, 0);
      92  	injected_val = strtol(argv[2], NULL, 0);
      93  
      94  	for (size_t i = 0; i < num_skip; i++) {
      95  		if ((prctl_marker() != injected_val) ||
      96  		    ((injected_val == -1) && (errno != ENOTTY)))
      97  			continue;
      98  
      99  		locked = true;
     100  		break;
     101  	}
     102  
     103  	if (!locked)
     104  		error_msg_and_fail("Have not locked on prctl(-1, -2, -3, -4"
     105  				   ", -5) returning %ld", injected_val);
     106  
     107  	/* PR_GET_SPECULATION_CTRL */
     108  	rc = do_prctl(52, 3, bogus_arg3);
     109  	printf("prctl(PR_GET_SPECULATION_CTRL, 0x3 /* PR_SPEC_??? */) "
     110  	       "= %s (INJECTED)\n", sprintrc(rc));
     111  
     112  	rc = do_prctl(52, bogus_arg2, bogus_arg3);
     113  	printf("prctl(PR_GET_SPECULATION_CTRL, %#llx /* PR_SPEC_??? */) "
     114  	       "= %s (INJECTED)\n",
     115  	       (unsigned long long) bogus_arg2, sprintrc(rc));
     116  
     117  	for (unsigned c = 0; c < ARRAY_SIZE(spec_strs); c++) {
     118  		rc = do_prctl(52, spec_strs[c].arg, bogus_arg3);
     119  
     120  		for (unsigned i = 0; i < ARRAY_SIZE(get_strs); i++) {
     121  			if (get_strs[i].arg == rc) {
     122  				str = get_strs[i].str;
     123  				break;
     124  			}
     125  		}
     126  		if (!str)
     127  			error_msg_and_fail("Unknown return value: %ld", rc);
     128  
     129  		if (rc < 0) {
     130  			printf("prctl(PR_GET_SPECULATION_CTRL, %s) = %s%s"
     131  			       " (INJECTED)\n",
     132  			       spec_strs[c].str, sprintrc(rc), str);
     133  		} else {
     134  			printf("prctl(PR_GET_SPECULATION_CTRL, %s) = %#lx%s"
     135  			       " (INJECTED)\n",
     136  			       spec_strs[c].str, rc, str);
     137  		}
     138  	}
     139  
     140  
     141  	/* PR_SET_SPECULATION_CTRL*/
     142  	rc = do_prctl(53, 3, bogus_arg3);
     143  	printf("prctl(PR_SET_SPECULATION_CTRL, 0x3 /* PR_SPEC_??? */, %#llx) "
     144  	       "= %s (INJECTED)\n",
     145  	       (unsigned long long) bogus_arg3, sprintrc(rc));
     146  
     147  	rc = do_prctl(53, bogus_arg2, bogus_arg3);
     148  	printf("prctl(PR_SET_SPECULATION_CTRL, %#llx /* PR_SPEC_??? */, %#llx) "
     149  	       "= %s (INJECTED)\n",
     150  	       (unsigned long long) bogus_arg2,
     151  	       (unsigned long long) bogus_arg3,
     152  	       sprintrc(rc));
     153  
     154  	for (unsigned c = 0; c < ARRAY_SIZE(spec_strs); c++) {
     155  		for (unsigned i = 0; i < ARRAY_SIZE(set_strs); i++) {
     156  			rc = do_prctl(53, spec_strs[c].arg, set_strs[i].arg);
     157  			printf("prctl(PR_SET_SPECULATION_CTRL, %s"
     158  			       ", %s) = %s (INJECTED)\n",
     159  			       spec_strs[c].str, set_strs[i].str, sprintrc(rc));
     160  		}
     161  	}
     162  
     163  	puts("+++ exited with 0 +++");
     164  	return 0;
     165  }