/*      $NetBSD: t_signal_and_sp.c,v 1.21 2025/04/26 23:49:55 uwe Exp $ */

/*
 * Copyright (c) 2024 The NetBSD Foundation, Inc.
 * All rights reserved.
 *
 * Redistribution and use in source and binary forms, with or without
 * modification, are permitted provided that the following conditions
 * are met:
 * 1. Redistributions of source code must retain the above copyright
 *    notice, this list of conditions and the following disclaimer.
 * 2. Redistributions in binary form must reproduce the above copyright
 *    notice, this list of conditions and the following disclaimer in the
 *    documentation and/or other materials provided with the distribution.
 *
 * THIS SOFTWARE IS PROVIDED BY THE NETBSD FOUNDATION, INC. AND CONTRIBUTORS
 * ``AS IS'' AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED
 * TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
 * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL THE FOUNDATION OR CONTRIBUTORS
 * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
 * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
 * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
 * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
 * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
 * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
 * POSSIBILITY OF SUCH DAMAGE.
 */

#define __EXPOSE_STACK  /* <sys/param.h>: expose STACK_ALIGNBYTES */

#include <sys/cdefs.h>
__RCSID("$NetBSD: t_signal_and_sp.c,v 1.21 2025/04/26 23:49:55 uwe Exp $");

#include <sys/param.h>
#include <sys/wait.h>

#include <atf-c.h>
#include <limits.h>
#include <poll.h>
#include <pthread.h>
#include <signal.h>
#include <stdint.h>
#include <stdio.h>
#include <stdlib.h>
#include <string.h>
#include <time.h>
#include <ucontext.h>
#include <unistd.h>

#include "h_execsp.h"
#include "h_macros.h"

#ifdef HAVE_STACK_POINTER_H
#  include "stack_pointer.h"
#endif

#define PR_59327 "PR kern/59327: user stack pointer is not aligned properly"

#ifdef HAVE_SIGNALSPHANDLER
void signalsphandler(int);      /* signalsphandler.S assembly routine */
#endif

void *volatile signalsp;

static void
test_execsp(const struct atf_tc *tc, const char *prog)
{
#ifdef STACK_ALIGNBYTES
        char h_execsp[PATH_MAX];
        struct execsp execsp;
        int fd[2];
        pid_t pid;
        struct pollfd pollfd;
        int nfds;
        ssize_t nread;
        int status;

        /*
         * Determine the full path to the helper program.
         */
        RL(snprintf(h_execsp, sizeof(h_execsp), "%s/%s",
                atf_tc_get_config_var(tc, "srcdir"), prog));

        /*
         * Create a pipe to read a bundle of stack pointer samples from
         * the child, and fork the child.
         */
        RL(pipe(fd));
        RL(pid = vfork());
        if (pid == 0) {         /* child */
                char *const argv[] = {h_execsp, NULL};

                if (dup2(fd[1], STDOUT_FILENO) == -1)
                        _exit(1);
                if (closefrom(STDERR_FILENO + 1) == -1)
                        _exit(2);
                if (execve(argv[0], argv, NULL) == -1)
                        _exit(3);
                _exit(4);
        }

        /*
         * Close the writing end so, if something goes wrong in the
         * child, we don't hang indefinitely waiting for output.
         */
        RL(close(fd[1]));

        /*
         * Wait up to 5sec for the child to return an answer.  Any more
         * than that, and we kill it.  The child is mostly hand-written
         * assembly routines where lots can go wrong, so don't bother
         * waiting if it gets stuck in a loop.
         */
        pollfd.fd = fd[0];
        pollfd.events = POLLIN;
        RL(nfds = poll(&pollfd, 1, 5*1000/*ms*/));
        if (nfds == 0) {
                fprintf(stderr, "child hung, killing\n");
                RL(kill(pid, SIGKILL));
        }

        /*
         * Read a bundle of stack pointer samples from the child.
         */
        RL(nread = read(fd[0], &execsp, sizeof(execsp)));
        ATF_CHECK_MSG((size_t)nread == sizeof(execsp),
            "nread=%zu sizeof(execsp)=%zu",
            (size_t)nread, sizeof(execsp));

        /*
         * Wait for the child to terminate and report failure if it
         * didn't exit cleanly.
         */
        RL(waitpid(pid, &status, 0));
        if (WIFSIGNALED(status)) {
                atf_tc_fail_nonfatal("child exited on signal %d (%s)",
                    WTERMSIG(status), strsignal(WTERMSIG(status)));
        } else if (!WIFEXITED(status)) {
                atf_tc_fail_nonfatal("child exited status=0x%x", status);
        } else {
                ATF_CHECK_MSG(WEXITSTATUS(status) == 0,
                    "child exited with code %d",
                    WEXITSTATUS(status));
        }

        /*
         * Now that we have reaped the child, stop here if the stack
         * pointer samples are bogus; otherwise verify they are all
         * aligned.
         */
        if ((size_t)nread != sizeof(execsp))
                return;         /* failed already */

        printf("start sp @ %p\n", execsp.startsp);
        printf("ctor sp @ %p\n", execsp.ctorsp);
        printf("main sp @ %p\n", execsp.mainsp);
        printf("dtor sp @ %p\n", execsp.dtorsp);

        ATF_CHECK_MSG(((uintptr_t)execsp.startsp & STACK_ALIGNBYTES) == 0,
            "elf entry point was called with misaligned sp: %p",
            execsp.startsp);

        ATF_CHECK_MSG(((uintptr_t)execsp.ctorsp & STACK_ALIGNBYTES) == 0,
            "elf constructor was called with misaligned sp: %p",
            execsp.ctorsp);

        ATF_CHECK_MSG(((uintptr_t)execsp.mainsp & STACK_ALIGNBYTES) == 0,
            "main function was called with misaligned sp: %p",
            execsp.mainsp);

        ATF_CHECK_MSG(((uintptr_t)execsp.dtorsp & STACK_ALIGNBYTES) == 0,
            "elf destructor was called with misaligned sp: %p",
            execsp.dtorsp);

        /*
         * Leave a reminder on architectures for which we haven't
         * implemented execsp_start.S.
         */
        if (execsp.startsp == NULL ||
            execsp.ctorsp == NULL ||
            execsp.mainsp == NULL ||
            execsp.dtorsp == NULL)
                atf_tc_skip("Not fully supported on this architecture");
#else
        atf_tc_skip("Unknown STACK_ALIGNBYTES on this architecture");
#endif
}

ATF_TC(execsp_dynamic);
ATF_TC_HEAD(execsp_dynamic, tc)
{
        atf_tc_set_md_var(tc, "descr",
            "Verify stack pointer is aligned on dynamic program start");
}
ATF_TC_BODY(execsp_dynamic, tc)
{
        test_execsp(tc, "h_execsp_dynamic");
}

ATF_TC(execsp_static);
ATF_TC_HEAD(execsp_static, tc)
{
        atf_tc_set_md_var(tc, "descr",
            "Verify stack pointer is aligned on static program start");
}
ATF_TC_BODY(execsp_static, tc)
{
        test_execsp(tc, "h_execsp_static");
}

#if defined STACK_ALIGNBYTES && defined HAVE_CONTEXTSPFUNC
void *volatile contextsp;       /* set by contextspfunc.S */
static ucontext_t return_context;
static volatile bool test_context_done;

void contextspfunc(void);       /* contextspfunc.S assembly routine */

static void
contextnoop(void)
{

        fprintf(stderr, "contextnoop\n");
        /* control will return to contextspfunc via uc_link */
}

void contextdone(void);         /* called by contextspfunc.S */
void
contextdone(void)
{

        fprintf(stderr, "contextdone\n");
        ATF_REQUIRE(!test_context_done);
        test_context_done = true;
        RL(setcontext(&return_context));
        atf_tc_fail("setcontext returned");
}
#endif

ATF_TC(contextsp);
ATF_TC_HEAD(contextsp, tc)
{
        atf_tc_set_md_var(tc, "descr",
            "Verify stack pointer is aligned on makecontext entry");
}
ATF_TC_BODY(contextsp, tc)
{
#if defined STACK_ALIGNBYTES && defined HAVE_CONTEXTSPFUNC
        ucontext_t uc;
        char *stack;
        unsigned i;

        REQUIRE_LIBC(stack = malloc(SIGSTKSZ + STACK_ALIGNBYTES), NULL);
        fprintf(stderr, "stack @ [%p,%p)\n", stack,
            stack + SIGSTKSZ + STACK_ALIGNBYTES);

        for (i = 0; i <= STACK_ALIGNBYTES; i++) {
                contextsp = NULL;
                test_context_done = false;

                RL(getcontext(&uc));
                uc.uc_stack.ss_sp = stack;
                uc.uc_stack.ss_size = SIGSTKSZ + i;
                makecontext(&uc, &contextspfunc, 0);

                fprintf(stderr, "[%u] swapcontext\n", i);
                RL(swapcontext(&return_context, &uc));

                ATF_CHECK(contextsp != NULL);
                ATF_CHECK_MSG((uintptr_t)stack <= (uintptr_t)contextsp &&
                    (uintptr_t)contextsp <= (uintptr_t)stack + SIGSTKSZ + i,
                    "contextsp=%p", contextsp);
                ATF_CHECK_MSG(((uintptr_t)contextsp & STACK_ALIGNBYTES) == 0,
                    "[%u] makecontext function called with misaligned sp %p",
                    i, contextsp);
        }

        for (i = 0; i <= STACK_ALIGNBYTES; i++) {
                contextsp = NULL;
                test_context_done = false;

                RL(getcontext(&uc));
                uc.uc_stack.ss_sp = stack + i;
                uc.uc_stack.ss_size = SIGSTKSZ;
                makecontext(&uc, &contextspfunc, 0);

                fprintf(stderr, "[%u] swapcontext\n", i);
                RL(swapcontext(&return_context, &uc));

                ATF_CHECK(contextsp != NULL);
                ATF_CHECK_MSG((uintptr_t)stack + i <= (uintptr_t)contextsp &&
                    (uintptr_t)contextsp <= (uintptr_t)stack + i + SIGSTKSZ,
                    "contextsp=%p", contextsp);
                ATF_CHECK_MSG(((uintptr_t)contextsp & STACK_ALIGNBYTES) == 0,
                    "[%u] makecontext function called with misaligned sp %p",
                    i, contextsp);
        }
#else
        atf_tc_skip("Not implemented on this platform");
#endif
}

ATF_TC(contextsplink);
ATF_TC_HEAD(contextsplink, tc)
{
        atf_tc_set_md_var(tc, "descr",
            "Verify stack pointer is aligned on makecontext link entry");
}
ATF_TC_BODY(contextsplink, tc)
{
#if defined STACK_ALIGNBYTES && defined HAVE_CONTEXTSPFUNC
        ucontext_t uc1, uc2;
        char *stack1, *stack2;
        unsigned i;

        REQUIRE_LIBC(stack1 = malloc(SIGSTKSZ), NULL);
        fprintf(stderr, "stack1 @ [%p,%p)\n", stack1, stack1 + SIGSTKSZ);
        REQUIRE_LIBC(stack2 = malloc(SIGSTKSZ + STACK_ALIGNBYTES), NULL);
        fprintf(stderr, "stack2 @ [%p,%p)\n",
            stack2, stack2 + SIGSTKSZ + STACK_ALIGNBYTES);

        for (i = 0; i <= STACK_ALIGNBYTES; i++) {
                contextsp = NULL;
                test_context_done = false;

                RL(getcontext(&uc1));
                uc1.uc_stack.ss_sp = stack1;
                uc1.uc_stack.ss_size = SIGSTKSZ;
                uc1.uc_link = &uc2;
                makecontext(&uc1, &contextnoop, 0);

                RL(getcontext(&uc2));
                uc2.uc_stack.ss_sp = stack2;
                uc2.uc_stack.ss_size = SIGSTKSZ + i;
                makecontext(&uc2, &contextspfunc, 0);

                fprintf(stderr, "[%u] swapcontext\n", i);
                RL(swapcontext(&return_context, &uc1));

                ATF_CHECK(contextsp != NULL);
                ATF_CHECK_MSG((uintptr_t)stack2 <= (uintptr_t)contextsp &&
                    (uintptr_t)contextsp <= (uintptr_t)stack2 + SIGSTKSZ + i,
                    "contextsp=%p", contextsp);
                ATF_CHECK_MSG(((uintptr_t)contextsp & STACK_ALIGNBYTES) == 0,
                    "[%u] makecontext function called with misaligned sp %p",
                    i, contextsp);
        }

        for (i = 0; i <= STACK_ALIGNBYTES; i++) {
                contextsp = NULL;
                test_context_done = false;

                RL(getcontext(&uc1));
                uc1.uc_stack.ss_sp = stack1;
                uc1.uc_stack.ss_size = SIGSTKSZ;
                uc1.uc_link = &uc2;
                makecontext(&uc1, &contextnoop, 0);

                RL(getcontext(&uc2));
                uc2.uc_stack.ss_sp = stack2 + i;
                uc2.uc_stack.ss_size = SIGSTKSZ;
                makecontext(&uc2, &contextspfunc, 0);

                fprintf(stderr, "[%u] swapcontext\n", i);
                RL(swapcontext(&return_context, &uc1));

                ATF_CHECK(contextsp != NULL);
                ATF_CHECK_MSG((uintptr_t)stack2 + i <= (uintptr_t)contextsp &&
                    (uintptr_t)contextsp <= (uintptr_t)stack2 + SIGSTKSZ + i,
                    "contextsp=%p", contextsp);
                ATF_CHECK_MSG(((uintptr_t)contextsp & STACK_ALIGNBYTES) == 0,
                    "[%u] makecontext function called with misaligned sp %p",
                    i, contextsp);
        }
#else
        atf_tc_skip("Not implemented on this platform");
#endif
}

ATF_TC(signalsp);
ATF_TC_HEAD(signalsp, tc)
{
        atf_tc_set_md_var(tc, "descr",
            "Verify stack pointer is aligned on entry to signal handler");
}
ATF_TC_BODY(signalsp, tc)
{
#if defined STACK_ALIGNBYTES && defined HAVE_SIGNALSPHANDLER
        struct sigaction sa;

        memset(&sa, 0, sizeof(sa));
        sa.sa_handler = &signalsphandler;
        RL(sigaction(SIGUSR1, &sa, NULL));
        RL(raise(SIGUSR1));

        ATF_CHECK_MSG(((uintptr_t)signalsp & STACK_ALIGNBYTES) == 0,
            "signal handler was called with a misaligned sp: %p",
            signalsp);
#else
        atf_tc_skip("Not implemented on this platform");
#endif
}

ATF_TC(signalsp_sigaltstack);
ATF_TC_HEAD(signalsp_sigaltstack, tc)
{
        atf_tc_set_md_var(tc, "descr",
            "Verify stack pointer is aligned on entry to signal handler"
            " with maximally misaligned sigaltstack");
}
ATF_TC_BODY(signalsp_sigaltstack, tc)
{
#if defined STACK_ALIGNBYTES && HAVE_SIGNALSPHANDLER
#if defined(__sh__)
        atf_tc_expect_fail(PR_59327);
#endif
        char *stack;
        struct sigaction sa;
        struct sigaltstack ss;
        unsigned i;

        memset(&sa, 0, sizeof(sa));
        sa.sa_handler = &signalsphandler;
        sa.sa_flags = SA_ONSTACK;
        RL(sigaction(SIGUSR1, &sa, NULL));

        /*
         * Allocate a signal stack with enough slop to try all possible
         * misalignments of the stack pointer.  Print it to stderr so
         * it always appears in atf output before shenanigans happen.
         */
        REQUIRE_LIBC(stack = malloc(SIGSTKSZ + STACK_ALIGNBYTES), NULL);
        fprintf(stderr, "stack @ [%p, %p)\n",
            stack, stack + SIGSTKSZ + STACK_ALIGNBYTES);

        /*
         * Try with all alignments of high addresses.
         */
        for (i = 0; i <= STACK_ALIGNBYTES; i++) {
                ss.ss_sp = stack;
                ss.ss_size = SIGSTKSZ + i;
                ss.ss_flags = 0;
                RL(sigaltstack(&ss, NULL));

                signalsp = NULL;
                RL(raise(SIGUSR1));
                ATF_CHECK(signalsp != NULL);
                ATF_CHECK_MSG((uintptr_t)stack <= (uintptr_t)signalsp &&
                    (uintptr_t)signalsp <= (uintptr_t)stack + SIGSTKSZ + i,
                    "signalsp=%p", signalsp);
                ATF_CHECK_MSG(((uintptr_t)signalsp & STACK_ALIGNBYTES) == 0,
                    "[%u] signal handler was called with a misaligned sp: %p",
                    i, signalsp);
        }

        /*
         * Try with all alignments of low addresses.
         */
        for (i = 0; i <= STACK_ALIGNBYTES; i++) {
                ss.ss_sp = stack + i;
                ss.ss_size = SIGSTKSZ;
                ss.ss_flags = 0;
                RL(sigaltstack(&ss, NULL));

                signalsp = NULL;
                RL(raise(SIGUSR1));
                ATF_CHECK(signalsp != NULL);
                ATF_CHECK_MSG((uintptr_t)stack + i <= (uintptr_t)signalsp &&
                    (uintptr_t)signalsp <= (uintptr_t)stack + i + SIGSTKSZ,
                    "signalsp=%p", signalsp);
                ATF_CHECK_MSG(((uintptr_t)signalsp & STACK_ALIGNBYTES) == 0,
                    "[%u] signal handler was called with a misaligned sp: %p",
                    i, signalsp);
        }
#else
        atf_tc_skip("Not implemented on this platform");
#endif
}

#if defined STACK_ALIGNBYTES && defined HAVE_THREADSPFUNC
void *threadspfunc(void *);     /* threadspfunc.S assembly routine */
#endif

ATF_TC(threadsp);
ATF_TC_HEAD(threadsp, tc)
{
        atf_tc_set_md_var(tc, "descr",
            "Verify stack pointer is aligned on thread start");
}
ATF_TC_BODY(threadsp, tc)
{
#if defined STACK_ALIGNBYTES && defined HAVE_THREADSPFUNC
        pthread_t t;
        void *sp;
        char *stack;
        unsigned i;

        REQUIRE_LIBC(stack = malloc(SIGSTKSZ + STACK_ALIGNBYTES), NULL);
        fprintf(stderr, "stack @ [%p,%p)\n", stack,
            stack + SIGSTKSZ + STACK_ALIGNBYTES);

        RZ(pthread_create(&t, NULL, &threadspfunc, NULL));

        alarm(1);
        RZ(pthread_join(t, &sp));
        alarm(0);

        ATF_CHECK(sp != NULL);
        ATF_CHECK_MSG(((uintptr_t)sp & STACK_ALIGNBYTES) == 0,
            "thread called with misaligned sp: %p", sp);

        for (i = 0; i <= STACK_ALIGNBYTES; i++) {
                pthread_attr_t attr;

                RZ(pthread_attr_init(&attr));
                RZ(pthread_attr_setstack(&attr, stack, SIGSTKSZ + i));
                RZ(pthread_create(&t, &attr, &threadspfunc, NULL));
                RZ(pthread_attr_destroy(&attr));

                alarm(1);
                RZ(pthread_join(t, &sp));
                alarm(0);

                ATF_CHECK(sp != NULL);
                ATF_CHECK_MSG((uintptr_t)stack <= (uintptr_t)sp &&
                    (uintptr_t)sp <= (uintptr_t)stack + SIGSTKSZ + i,
                    "sp=%p", sp);
                ATF_CHECK_MSG(((uintptr_t)sp & STACK_ALIGNBYTES) == 0,
                    "[%u] thread called with misaligned sp: %p", i, sp);
        }

        for (i = 0; i <= STACK_ALIGNBYTES; i++) {
                pthread_attr_t attr;

                RZ(pthread_attr_init(&attr));
                RZ(pthread_attr_setstack(&attr, stack + i, SIGSTKSZ));
                RZ(pthread_create(&t, &attr, &threadspfunc, NULL));
                RZ(pthread_attr_destroy(&attr));

                alarm(1);
                RZ(pthread_join(t, &sp));
                alarm(0);

                ATF_CHECK(sp != NULL);
                ATF_CHECK_MSG((uintptr_t)stack + i <= (uintptr_t)sp &&
                    (uintptr_t)sp <= (uintptr_t)stack + i + SIGSTKSZ,
                    "sp=%p", sp);
                ATF_CHECK_MSG(((uintptr_t)sp & STACK_ALIGNBYTES) == 0,
                    "[%u] thread called with misaligned sp: %p", i, sp);
        }
#else
        atf_tc_skip("Not implemented on this platform");
#endif
}

ATF_TC(misaligned_sp_and_signal);
ATF_TC_HEAD(misaligned_sp_and_signal, tc)
{
        atf_tc_set_md_var(tc, "descr", "process can return from a signal"
            " handler even if the stack pointer is misaligned when a signal"
            " arrives");
}
ATF_TC_BODY(misaligned_sp_and_signal, tc)
{
#if defined STACK_ALIGNBYTES && defined HAVE_STACK_POINTER_H
#if defined(__sh__)
        atf_tc_expect_fail(PR_59327);
#endif

        /*
         * Set up a handler for SIGALRM.
         */
        struct sigaction sa;
        memset(&sa, 0, sizeof(sa));
        sa.sa_handler = &signalsphandler;
        RL(sigaction(SIGALRM, &sa, NULL));

        /*
         * Set up an interval timer so that we receive SIGALRM after 50 ms.
         */
        struct itimerval itv;
        memset(&itv, 0, sizeof(itv));
        itv.it_value.tv_usec = 1000 * 50;
        RL(setitimer(ITIMER_MONOTONIC, &itv, NULL));

        /*
         * Now misalign the SP. Wait for the signal to arrive and see what
         * happens. This should be fine as long as we don't use it to
         * access memory.
         */
        MISALIGN_SP;
        while (signalsp == NULL) {
                /*
                 * Make sure the compiler does not optimize this busy loop
                 * away.
                 */
                __asm__("" ::: "memory");
        }
        /*
         * We could successfully return from a signal handler. Now we
         * should fix the SP before calling any functions.
         */
        FIX_SP;

        /*
         * But was the stack pointer aligned when we were on the signal
         * handler?
         */
        ATF_CHECK_MSG(((uintptr_t)signalsp & STACK_ALIGNBYTES) == 0,
            "signal handler was called with a misaligned sp: %p",
            signalsp);
#else
        atf_tc_skip("Not implemented for this platform");
#endif
}

ATF_TP_ADD_TCS(tp)
{

        ATF_TP_ADD_TC(tp, contextsp);
        ATF_TP_ADD_TC(tp, contextsplink);
        ATF_TP_ADD_TC(tp, execsp_dynamic);
        ATF_TP_ADD_TC(tp, execsp_static);
        ATF_TP_ADD_TC(tp, misaligned_sp_and_signal);
        ATF_TP_ADD_TC(tp, signalsp);
        ATF_TP_ADD_TC(tp, signalsp_sigaltstack);
        ATF_TP_ADD_TC(tp, threadsp);
        return atf_no_error();
}