[PATCH 2/2] selftests/x86: add generic prctl shadow stack test
Bill Roberts
bill.roberts at arm.com
Tue Jul 14 08:47:40 PDT 2026
Run the same test suite for arch_prctl, against prctl, to ensure
consisteny and correctness between the interfaces.
Signed-off-by: Bill Roberts <bill.roberts at arm.com>
---
tools/testing/selftests/x86/Makefile | 3 +-
.../testing/selftests/x86/test_shadow_stack.c | 55 +++++++++++++++----
.../selftests/x86/test_shadow_stack_prctl.c | 3 +
3 files changed, 50 insertions(+), 11 deletions(-)
create mode 100644 tools/testing/selftests/x86/test_shadow_stack_prctl.c
diff --git a/tools/testing/selftests/x86/Makefile b/tools/testing/selftests/x86/Makefile
index 434065215d12..6a505b42ff66 100644
--- a/tools/testing/selftests/x86/Makefile
+++ b/tools/testing/selftests/x86/Makefile
@@ -19,7 +19,8 @@ TARGETS_C_32BIT_ONLY := entry_from_vm86 test_syscall_vdso unwind_vdso \
test_FCMOV test_FCOMI test_FISTTP \
vdso_restorer
TARGETS_C_64BIT_ONLY := fsgsbase sysret_rip syscall_numbering \
- corrupt_xstate_header amx lam test_shadow_stack avx apx
+ corrupt_xstate_header amx lam test_shadow_stack avx apx \
+ test_shadow_stack_prctl
# Some selftests require 32bit support enabled also on 64bit systems
TARGETS_C_32BIT_NEEDED := ldt_gdt ptrace_syscall
diff --git a/tools/testing/selftests/x86/test_shadow_stack.c b/tools/testing/selftests/x86/test_shadow_stack.c
index 3d6ca33edba4..0d14a7f444aa 100644
--- a/tools/testing/selftests/x86/test_shadow_stack.c
+++ b/tools/testing/selftests/x86/test_shadow_stack.c
@@ -92,6 +92,7 @@ static inline unsigned long __attribute__((always_inline)) get_ssp(void)
* Based on code from nolibc.h. Keep a copy here because this can't pull in all
* of nolibc.h.
*/
+ #ifndef BUILD_PRCTL
#define ARCH_PRCTL(arg1, arg2) \
({ \
long _ret; \
@@ -109,6 +110,40 @@ static inline unsigned long __attribute__((always_inline)) get_ssp(void)
_ret; \
})
+#define SHADOW_STACK_DISABLE() ARCH_PRCTL(ARCH_SHSTK_DISABLE, ARCH_SHSTK_SHSTK)
+#define SHADOW_STACK_ENABLE() ARCH_PRCTL(ARCH_SHSTK_ENABLE, ARCH_SHSTK_SHSTK)
+#define SHADOW_STACK_ENABLE_WRITE() ARCH_PRCTL(ARCH_SHSTK_ENABLE, ARCH_SHSTK_WRSS)
+
+#else
+
+#define PRCTL(option, arg2, arg3, arg4, arg5) \
+({ \
+ long _ret; \
+ register long _num asm("rax") = __NR_prctl; \
+ register long _arg1 asm("rdi") = (long)(option); \
+ register long _arg2 asm("rsi") = (long)(arg2); \
+ register long _arg3 asm("rdx") = (long)(arg3); \
+ register long _arg4 asm("r10") = (long)(arg4); \
+ register long _arg5 asm("r8") = (long)(arg5); \
+ \
+ asm volatile ( \
+ "syscall" \
+ : "=a"(_ret) \
+ : "0"(_num), \
+ "r"(_arg1), "r"(_arg2), "r"(_arg3), \
+ "r"(_arg4), "r"(_arg5) \
+ : "rcx", "r11", "memory", "cc" \
+ ); \
+ _ret; \
+})
+
+#define SHADOW_STACK_DISABLE() PRCTL(PR_SET_SHADOW_STACK_STATUS, 0, 0, 0, 0)
+#define SHADOW_STACK_ENABLE() PRCTL(PR_SET_SHADOW_STACK_STATUS, PR_SHADOW_STACK_ENABLE, 0, 0, 0)
+#define SHADOW_STACK_ENABLE_WRITE() \
+ PRCTL(PR_SET_SHADOW_STACK_STATUS, PR_SHADOW_STACK_ENABLE|PR_SHADOW_STACK_WRITE, 0, 0, 0)
+
+#endif
+
void *create_shstk(void *addr)
{
return (void *)syscall(__NR_map_shadow_stack, addr, SS_SIZE, SHADOW_STACK_SET_TOKEN);
@@ -691,7 +726,7 @@ void segv_gp_handler(int signum, siginfo_t *si, void *uc)
* To work with old glibc, this can't rely on siglongjmp working with
* shadow stack enabled, so disable shadow stack before siglongjmp().
*/
- ARCH_PRCTL(ARCH_SHSTK_DISABLE, ARCH_SHSTK_SHSTK);
+ SHADOW_STACK_DISABLE();
siglongjmp(jmp_buffer, -1);
}
@@ -854,7 +889,7 @@ static int test_uretprobe(void)
if (sigsetjmp(jmp_buffer, 1))
goto out;
- ARCH_PRCTL(ARCH_SHSTK_ENABLE, ARCH_SHSTK_SHSTK);
+ SHADOW_STACK_ENABLE();
/*
* This either segfaults and goes through sigsetjmp above
@@ -866,7 +901,7 @@ static int test_uretprobe(void)
err = 0;
out:
- ARCH_PRCTL(ARCH_SHSTK_DISABLE, ARCH_SHSTK_SHSTK);
+ SHADOW_STACK_DISABLE();
signal(SIGSEGV, SIG_DFL);
if (fd)
close(fd);
@@ -933,7 +968,7 @@ static int test_uprobe_call(void)
if (sigsetjmp(jmp_buffer, 1))
goto out;
- if (ARCH_PRCTL(ARCH_SHSTK_ENABLE, ARCH_SHSTK_SHSTK))
+ if (SHADOW_STACK_ENABLE())
goto out;
/*
@@ -946,7 +981,7 @@ static int test_uprobe_call(void)
err = 0;
out:
- ARCH_PRCTL(ARCH_SHSTK_DISABLE, ARCH_SHSTK_SHSTK);
+ SHADOW_STACK_DISABLE();
signal(SIGSEGV, SIG_DFL);
if (fd >= 0)
close(fd);
@@ -1059,22 +1094,22 @@ int main(int argc, char *argv[])
{
int ret = 0;
- if (ARCH_PRCTL(ARCH_SHSTK_ENABLE, ARCH_SHSTK_SHSTK)) {
+ if (SHADOW_STACK_ENABLE()) {
printf("[SKIP]\tCould not enable Shadow stack\n");
return 1;
}
- if (ARCH_PRCTL(ARCH_SHSTK_DISABLE, ARCH_SHSTK_SHSTK)) {
+ if (SHADOW_STACK_DISABLE()) {
ret = 1;
printf("[FAIL]\tDisabling shadow stack failed\n");
}
- if (ARCH_PRCTL(ARCH_SHSTK_ENABLE, ARCH_SHSTK_SHSTK)) {
+ if (SHADOW_STACK_ENABLE()) {
printf("[SKIP]\tCould not re-enable Shadow stack\n");
return 1;
}
- if (ARCH_PRCTL(ARCH_SHSTK_ENABLE, ARCH_SHSTK_WRSS)) {
+ if (SHADOW_STACK_ENABLE_WRITE()) {
printf("[SKIP]\tCould not enable WRSS\n");
ret = 1;
goto out;
@@ -1164,7 +1199,7 @@ int main(int argc, char *argv[])
* Disable shadow stack before the function returns, or there will be a
* shadow stack violation.
*/
- if (ARCH_PRCTL(ARCH_SHSTK_DISABLE, ARCH_SHSTK_SHSTK)) {
+ if (SHADOW_STACK_DISABLE()) {
ret = 1;
printf("[FAIL]\tDisabling shadow stack failed\n");
}
diff --git a/tools/testing/selftests/x86/test_shadow_stack_prctl.c b/tools/testing/selftests/x86/test_shadow_stack_prctl.c
new file mode 100644
index 000000000000..9c9e2728a9f9
--- /dev/null
+++ b/tools/testing/selftests/x86/test_shadow_stack_prctl.c
@@ -0,0 +1,3 @@
+// SPDX-License-Identifier: GPL-2.0
+#define BUILD_PRCTL 1
+#include "test_shadow_stack.c"
--
2.54.0
More information about the linux-riscv
mailing list