From 1b294d0dbe7c4221ef6d65c72291ef33af9aea19 Mon Sep 17 00:00:00 2001
From: Ross Burton <ross.burton@arm.com>
Date: Thu, 20 Jun 2024 14:37:42 +0100
Subject: [PATCH] Add some automated GCS testing

---
 meta-arm-gcs/conf/layer.conf               |  2 +
 meta-arm-gcs/gcs.yml                       |  6 +++
 meta-arm-gcs/lib/oeqa/runtime/cases/gcs.py | 49 ++++++++++++++++++++++
 3 files changed, 57 insertions(+)
 create mode 100644 meta-arm-gcs/lib/oeqa/runtime/cases/gcs.py

diff --git a/meta-arm-gcs/conf/layer.conf b/meta-arm-gcs/conf/layer.conf
index f81e1838..b6badd37 100644
--- a/meta-arm-gcs/conf/layer.conf
+++ b/meta-arm-gcs/conf/layer.conf
@@ -11,3 +11,5 @@ BBFILE_PRIORITY_meta-arm-gcs = "5"
 
 LAYERDEPENDS_meta-arm-gcs = "core"
 LAYERSERIES_COMPAT_meta-arm-gcs = " scarthgap"
+
+addpylib ${LAYERDIR}/lib oeqa
diff --git a/meta-arm-gcs/gcs.yml b/meta-arm-gcs/gcs.yml
index e3d3d1c8..ace9a649 100644
--- a/meta-arm-gcs/gcs.yml
+++ b/meta-arm-gcs/gcs.yml
@@ -48,5 +48,11 @@ local_conf_header:
     FVP_CONFIG[cluster0.has_permission_indirection_s1] = "1"
     FVP_CONFIG[cluster1.has_permission_indirection_s1] = "1"
 
+  testimage: |
+    IMAGE_CLASSES += "testimage"
+    TEST_SUITES = "ping ssh gcs"
+    IMAGE_FEATURES += "ssh-server-dropbear debug-tweaks"
+    CORE_IMAGE_EXTRA_INSTALL += "ssh-pregen-hostkeys binutils"
+
 target:
   - core-image-full-cmdline
diff --git a/meta-arm-gcs/lib/oeqa/runtime/cases/gcs.py b/meta-arm-gcs/lib/oeqa/runtime/cases/gcs.py
new file mode 100644
index 00000000..1dc7d39e
--- /dev/null
+++ b/meta-arm-gcs/lib/oeqa/runtime/cases/gcs.py
@@ -0,0 +1,49 @@
+#
+# SPDX-License-Identifier: MIT
+#
+
+from oeqa.runtime.case import OERuntimeTestCase
+from oeqa.runtime.decorator.package import OEHasPackage
+
+class GCSTests(OERuntimeTestCase):
+
+    # TODO:
+    # - Need a test that fails if GCS is enabled.  kselftest most likely has tests here?
+
+    def test_dmesg(self):
+        """
+        Verify that the kernel detected the GCS processor feature.
+
+        If this fails the FVP configuration or kernel is at fault.
+        """
+        status, output = self.target.run("dmesg | grep 'CPU features'")
+        self.assertEqual(status, 0, f"dmesg failed: {output}")
+
+        self.assertIn("CPU features: detected: Guarded Control Stack (GCS)", output)
+
+
+    @OEHasPackage(['binutils'])
+    def test_elf_tags(self):
+        """
+        Verify that ELF binaries have the GCS feature enabled.
+        
+        If this fails the toolchain doesn't have GCS enabled, or the compilation
+        flags don't enable GCS.
+        """
+        status, output = self.target.run("readelf -n /bin/bash | grep 'AArch64 feature'")
+        self.assertEqual(status, 0, f"readelf failed: {output}")
+
+        self.assertIn("Properties: AArch64 feature: BTI, PAC, GCS", output)
+
+
+    def test_execution(self):
+        """
+        Verify that enabling GCS with the glibc tunables doesn't cause a crash.
+
+        This is an incredibly low bar, but if this fails then the GCS patches
+        are at fault.
+        """
+        cmd = "GLIBC_TUNABLES=glibc.cpu.aarch64_gcs=1:glibc.cpu.aarch64_gcs_policy=2 ls -d /u*"
+        status, output = self.target.run(cmd)
+        self.assertEqual(status, 0, f"ls failed: {output}")
+        self.assertEqual(output, "/usr")