From nobody Thu Aug 27 14:03:17 2026 X-Original-To: dev-commits-src-all@mlmmj.nyi.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2610:1c1:1:606c::19:1]) by mlmmj.nyi.freebsd.org (Postfix) with ESMTP id 4hW3Bt6rC2z6q1Td for ; Thu, 27 Aug 2026 14:03:18 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from mxrelay.nyi.freebsd.org (mxrelay.nyi.freebsd.org [IPv6:2610:1c1:1:606c::19:3]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (4096 bits) server-digest SHA256 client-signature RSA-PSS (4096 bits) client-digest SHA256) (Client CN "mxrelay.nyi.freebsd.org", Issuer "YR2" (not verified)) by mx1.freebsd.org (Postfix) with ESMTPS id 4hW3Bt2X78z3fXX for ; Thu, 27 Aug 2026 14:03:18 +0000 (UTC) (envelope-from git@FreeBSD.org) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1787839398; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=Yhhs0r9cTH0Nves8apczFkHjAm7XpfZgaz4cBWK4zrw=; b=RJD072fLWz9qhRUEsm6BM6xfw7EYrEMEatvsqLIPxUzIvJXGNNxts9OtC9DUWRZ3gaFwpF EsNPasjej2KGqNWcr2Mjs7s+3DH2xxA5V307pctIFMgAC9eWTurxonY6xV/ziHWAuXj1yH 9MubQuo0pxdDMBx3IIrL8DrKcbPQirtxFw4HdG1r81ma7VPQKus1RpMps73rSzxPbjIgkC C0jH3lKaMVIoNB+ePGh+8MyYNY5YleI/9xttufWaxYmPvAW0z0+gLrkCv99wBF+wFiso23 R9lhOUwQEMzXIoH57b2yX0v3W9rQcBpdYQ8TFyTkL+lRGBU70hvMLCmeZTGY0g== ARC-Seal: i=1; s=dkim; d=freebsd.org; t=1787839398; a=rsa-sha256; cv=none; b=UBenhfOsGmW+K2A/7SSxQvAacRc0hrwiiZwHVKccgy5ppfO+3Iu5aXI71XgH9YIs+B2Z0Q TP7RsSCaTjakjkik6hmyo1YteaskpF05ckgEzWaxQFUhCCj+daQ0mtLHjQsm7tbvI6lpKd 4RHXrsiZwIG0r5V2nVerdbxQ/xYcN3U5k9XIvG6m0BVc7YMPHWUKux/hpxeaXxmBOumKGt RVXiiVNMV58Z6JXNdt4RbLA8YKK5vsN398abeOLhWb9C14/WruVTdycNfjZT9RHPP/FwPA 12g4NMKJHG7EJxuEM9L0carayjKfBLIYjSnV4QatolQkbx7ynV18gpryHUKEHA== ARC-Authentication-Results: i=1; mx1.freebsd.org; none ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1787839398; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=Yhhs0r9cTH0Nves8apczFkHjAm7XpfZgaz4cBWK4zrw=; b=eJ4SI/NfLxKvbMKt+uXpUZtPA581/gvq4t27/Oh/wufoMs8H+mCDtnnUIwVgZu9wat/9Gs Os36XDy9pTw2XHaNZzmoTnK6tq3Y42gl87NxdREZU8cWsEv7w5UyXkFi4895OqnOaUYKCY R9v2iJguBKP3SpqcZL6EQNDmeOVoM0RbdqBQdPs0qdZoFoIegXL6dZ6fysQ0TySw4v8fwE A+x9lX8JVvhlsePijgtF9VByRbh+FSEtnstfKxc1Yqps2nDCHOsMlPAh9SZQOuhqMhrQxB IEVnDoyNd8x9GMNTP+IVpq7x0UrCQeRoo3BDK81u2sFD/F6jXz2+WVnmCK+nsw== Received: from gitrepo.freebsd.org (gitrepo.freebsd.org [IPv6:2610:1c1:1:6068::e6a:5]) by mxrelay.nyi.freebsd.org (Postfix) with ESMTP id 4hW3Bt0RMFz9cQ for ; Thu, 27 Aug 2026 14:03:18 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from git (uid 1279) (envelope-from git@FreeBSD.org) id 27c9c by gitrepo.freebsd.org (DragonFly Mail Agent v0.13+ on gitrepo.freebsd.org); Thu, 27 Aug 2026 14:03:17 +0000 To: src-committers@FreeBSD.org, dev-commits-src-all@FreeBSD.org, dev-commits-src-main@FreeBSD.org From: Alexander Leidinger Subject: git: 17fca802ded1 - main - hwpmc: add tests for handle validation and the privilege boundaries List-Id: Commit messages for all branches of the src repository List-Archive: https://lists.freebsd.org/archives/dev-commits-src-all List-Help: List-Post: List-Subscribe: List-Unsubscribe: X-BeenThere: dev-commits-src-all@freebsd.org Sender: owner-dev-commits-src-all@FreeBSD.org List-Id: List-Post: List-Help: List-Subscribe: List-Unsubscribe: List-Owner: Precedence: list MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: 8bit X-Git-Committer: netchild X-Git-Repository: src X-Git-Refname: refs/heads/main X-Git-Reftype: branch X-Git-Commit: 17fca802ded118102d04a7a0bbc0c076de18c4d8 Auto-Submitted: auto-generated Date: Thu, 27 Aug 2026 14:03:17 +0000 Message-Id: <6a9043a5.27c9c.7fc7e9c4@gitrepo.freebsd.org> The branch main has been updated by netchild: URL: https://cgit.FreeBSD.org/src/commit/?id=17fca802ded118102d04a7a0bbc0c076de18c4d8 commit 17fca802ded118102d04a7a0bbc0c076de18c4d8 Author: Alexander Leidinger AuthorDate: 2026-08-25 18:55:23 +0000 Commit: Alexander Leidinger CommitDate: 2026-08-27 14:02:39 +0000 hwpmc: add tests for handle validation and the privilege boundaries A pmc_id_t is a packed integer that the driver hands to userland and accepts back on eleven operations, and nothing tested what happens when one comes back forged, stale, or belonging to another process. Neither was there a test that an unprivileged caller is refused the operations that need a privilege. The cases use a SOFT-class PMC wherever the counter itself does not matter, so they run on a machine with no PMU. MFC after: 1 month MFC to: stable/15 MFC to: stable/14 Assisted-by: Claude Code (Opus 5) --- tests/sys/pmc/Makefile | 1 + tests/sys/pmc/pmc_api_test.c | 507 +++++++++++++++++++++++++++++++++++++++++++ 2 files changed, 508 insertions(+) diff --git a/tests/sys/pmc/Makefile b/tests/sys/pmc/Makefile index 8b99a4c21bff..c4fc98e3b6d4 100644 --- a/tests/sys/pmc/Makefile +++ b/tests/sys/pmc/Makefile @@ -1,5 +1,6 @@ TESTSDIR= ${TESTSBASE}/sys/pmc +ATF_TESTS_C+= pmc_api_test ATF_TESTS_C+= pmc_detach_test ATF_TESTS_C+= pmc_exec_test ATF_TESTS_C+= pmc_wrap_test diff --git a/tests/sys/pmc/pmc_api_test.c b/tests/sys/pmc/pmc_api_test.c new file mode 100644 index 000000000000..4c8e48c94fef --- /dev/null +++ b/tests/sys/pmc/pmc_api_test.c @@ -0,0 +1,507 @@ +/*- + * SPDX-License-Identifier: BSD-2-Clause + * + * Copyright (c) 2026 Alexander Leidinger + * + * Redistribution and use in source and binary forms, with or without + * modification, are permitted provided that the following conditions + * are met: + * 1. Redistributions of source code must retain the above copyright + * notice, this list of conditions and the following disclaimer. + * 2. Redistributions in binary form must reproduce the above copyright + * notice, this list of conditions and the following disclaimer in the + * documentation and/or other advertising materials provided with the + * distribution. + * + * THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND + * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE + * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE + * ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE + * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL + * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS + * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) + * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT + * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY + * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF + * SUCH DAMAGE. + */ + +/** + * @file + * Tests for hwpmc(4)'s handling of the PMC handle and for the privilege + * boundaries around the operations that do not take one. + * + * A pmc_id_t packs CPU, mode, class and row index into one 32-bit word, + * which the kernel hands to userland and accepts back on eleven + * operations. The cases pass ids that were never allocated, ids that were + * released, and ids belonging to a different process, and require each + * operation to refuse cleanly rather than act on a wrong PMC. + * + * Two properties are asserted because a refactor could break either with + * every existing test still passing: the CPU field is 12 bits, so a caller + * may name CPU 4095 on a machine that has four; and ids are unique per + * owner rather than globally, so two processes are given the same numeric + * id and only the per-owner lookup keeps them apart. + * + * The PMCs are SOFT-class, so nothing here needs a hardware counter. The + * privilege cases need an unprivileged subject - as root the checks under + * test are never reached - hence require.user. + */ + +#include +#include +#include +#include + +#include +#include +#include +#include +#include +#include +#include +#include + +#include + +/** + * @internal + * The operations that take a pmc_id_t and reach the kernel with it. + * pmc_width() is deliberately absent: it answers from a userland copy of + * the CPU info and never enters the driver. + */ +static int op_attach(pmc_id_t id) { return (pmc_attach(id, getpid())); } +static int op_detach(pmc_id_t id) { return (pmc_detach(id, getpid())); } +static int op_start(pmc_id_t id) { return (pmc_start(id)); } +static int op_stop(pmc_id_t id) { return (pmc_stop(id)); } +static int op_write(pmc_id_t id) { return (pmc_write(id, 0)); } +static int op_set(pmc_id_t id) { return (pmc_set(id, 0)); } +static int op_release(pmc_id_t id) { return (pmc_release(id)); } + +static int +op_read(pmc_id_t id) +{ + pmc_value_t v; + + return (pmc_read(id, &v)); +} + +static int +op_rw(pmc_id_t id) +{ + pmc_value_t v; + + return (pmc_rw(id, 0, &v)); +} + +static int +op_caps(pmc_id_t id) +{ + uint32_t c; + + return (pmc_capabilities(id, &c)); +} + +static int +op_getmsr(pmc_id_t id) +{ + uint32_t msr; + + return (pmc_get_msr(id, &msr)); +} + +static const struct { + const char *name; + int (*fn)(pmc_id_t); +} id_ops[] = { + { "attach", op_attach }, + { "detach", op_detach }, + { "start", op_start }, + { "stop", op_stop }, + { "read", op_read }, + { "write", op_write }, + { "rw", op_rw }, + { "set", op_set }, + { "caps", op_caps }, + { "getmsr", op_getmsr }, + { "release", op_release }, +}; + +static void +require_hwpmc(void) +{ + + if (pmc_init() != 0) + atf_tc_skip("hwpmc(4) is not available"); +} + +static void +require_unprivileged(void) +{ + + if (geteuid() == 0) + atf_tc_skip("the subject must be unprivileged: root passes " + "the check under test"); +} + +/** + * @internal + * Allocate the first SOFT event this mode accepts. Every SOFT event takes + * the same allocate/attach/detach/release path, so which one it is does not + * matter; that one exists at all is what the case needs. + */ +static pmc_id_t +allocate_soft_pmc(enum pmc_mode mode) +{ + const char **names; + char spec[128]; + pmc_id_t id; + int nnames, i; + + if (pmc_event_names_of_class(PMC_CLASS_SOFT, &names, &nnames) != 0) + return (PMC_ID_INVALID); + for (i = 0; i < nnames; i++) { + (void)snprintf(spec, sizeof(spec), "SOFT-%s", names[i]); + if (pmc_allocate(spec, mode, 0, PMC_CPU_ANY, &id, 0) == 0) + return (id); + } + return (PMC_ID_INVALID); +} + +static pmc_id_t +require_soft_pmc(enum pmc_mode mode) +{ + pmc_id_t id; + + if ((id = allocate_soft_pmc(mode)) == PMC_ID_INVALID) + atf_tc_skip("no SOFT-class PMC is allocatable"); + return (id); +} + +/** + * @internal + * Every id-taking operation must refuse this id. Checks rather than + * requires, so one operation that wrongly accepts does not hide the rest. + */ +static void +check_all_ops_refuse(pmc_id_t id, const char *what) +{ + size_t i; + + for (i = 0; i < nitems(id_ops); i++) { + errno = 0; + ATF_CHECK_MSG(id_ops[i].fn(id) != 0, + "pmc_%s() accepted %s id 0x%08x", id_ops[i].name, what, + id); + } +} + +ATF_TC_WITHOUT_HEAD(never_allocated_id); +ATF_TC_BODY(never_allocated_id, tc) +{ + pmc_id_t forged[6]; + size_t i; + int ncpu; + + require_hwpmc(); + ncpu = pmc_ncpu(); + ATF_REQUIRE(ncpu > 0); + + /* + * Nothing has been allocated in this process, so every one of these + * has to be refused - including the two that are well-formed apart + * from naming a CPU that does not exist. + */ + forged[0] = PMC_ID_INVALID; + forged[1] = PMC_ID_MAKE_ID(0xFFF, PMC_MODE_TC, PMC_CLASS_SOFT, 0); + forged[2] = PMC_ID_MAKE_ID(PMC_CPU_ANY, PMC_MODE_TC, PMC_CLASS_SOFT, + 0xFF); + forged[3] = PMC_ID_MAKE_ID(ncpu, PMC_MODE_TC, PMC_CLASS_SOFT, 0); + forged[4] = 0; + forged[5] = PMC_ID_MAKE_ID(PMC_CPU_ANY, 0xF, 0xFF, 0); + + for (i = 0; i < nitems(forged); i++) + check_all_ops_refuse(forged[i], "never-allocated"); +} + +ATF_TC_WITHOUT_HEAD(released_id); +ATF_TC_BODY(released_id, tc) +{ + pmc_id_t id; + + require_hwpmc(); + id = require_soft_pmc(PMC_MODE_TC); + + ATF_REQUIRE_MSG(pmc_attach(id, getpid()) == 0, "pmc_attach: %s", + strerror(errno)); + ATF_REQUIRE_MSG(pmc_start(id) == 0, "pmc_start: %s", strerror(errno)); + ATF_REQUIRE_MSG(pmc_stop(id) == 0, "pmc_stop: %s", strerror(errno)); + ATF_REQUIRE_MSG(pmc_detach(id, getpid()) == 0, "pmc_detach: %s", + strerror(errno)); + ATF_REQUIRE_MSG(pmc_release(id) == 0, "pmc_release: %s", + strerror(errno)); + + /* The same value is now stale. Reusing it is the double-free shape. */ + check_all_ops_refuse(id, "released"); +} + +ATF_TC_WITHOUT_HEAD(another_owners_id); +ATF_TC_BODY(another_owners_id, tc) +{ + pmc_id_t id, mine; + pmc_value_t v; + pid_t child; + ssize_t n; + int down[2], up[2], status; + char token; + + require_hwpmc(); + ATF_REQUIRE(pipe(down) == 0); + ATF_REQUIRE(pipe(up) == 0); + ATF_REQUIRE((child = fork()) >= 0); + + if (child == 0) { + pmc_value_t cv; + pmc_id_t cid; + + (void)close(down[1]); + (void)close(up[0]); + if (pmc_init() != 0) + _exit(2); + if ((cid = allocate_soft_pmc(PMC_MODE_TC)) == PMC_ID_INVALID) + _exit(3); + if (pmc_attach(cid, getpid()) != 0 || pmc_start(cid) != 0) + _exit(4); + if (write(up[1], &cid, sizeof(cid)) != (ssize_t)sizeof(cid)) + _exit(5); + if (read(down[0], &token, 1) != 1) + _exit(6); + /* Untouched by anything the parent did? */ + _exit(pmc_read(cid, &cv) == 0 ? 0 : 7); + } + (void)close(down[0]); + (void)close(up[1]); + + n = read(up[0], &id, sizeof(id)); + if (n != (ssize_t)sizeof(id)) { + (void)kill(child, SIGKILL); + (void)waitpid(child, &status, 0); + atf_tc_skip("the child could not allocate a SOFT-class PMC"); + } + + /* We own nothing, so the child's id must not resolve for us. */ + check_all_ops_refuse(id, "another owner's"); + + /* + * Now hold one of our own. Ids are per owner, so ours is very + * likely the same number; operating on it must still reach only + * ours, which the child's exit status confirms. + */ + mine = allocate_soft_pmc(PMC_MODE_TC); + if (mine != PMC_ID_INVALID) { + ATF_CHECK_MSG(pmc_attach(mine, getpid()) == 0, "pmc_attach: %s", + strerror(errno)); + ATF_CHECK(pmc_read(mine, &v) == 0); + ATF_CHECK(pmc_detach(mine, getpid()) == 0); + ATF_CHECK(pmc_release(mine) == 0); + } + + ATF_REQUIRE(write(down[1], "g", 1) == 1); + (void)close(down[1]); + ATF_REQUIRE(waitpid(child, &status, 0) == child); + ATF_REQUIRE_MSG(WIFEXITED(status) && WEXITSTATUS(status) == 0, + "the child's own PMC did not survive our use of its id " + "(child exit %d)", WIFEXITED(status) ? WEXITSTATUS(status) : -1); +} + +ATF_TC_WITHOUT_HEAD(read_write_before_start); +ATF_TC_BODY(read_write_before_start, tc) +{ + pmc_value_t old, v; + pmc_id_t id; + + require_hwpmc(); + id = require_soft_pmc(PMC_MODE_TC); + ATF_REQUIRE_MSG(pmc_attach(id, getpid()) == 0, "pmc_attach: %s", + strerror(errno)); + + /* Allocated and attached, never started: a read must still work. */ + ATF_CHECK_MSG(pmc_read(id, &v) == 0, "pmc_read before start: %s", + strerror(errno)); + + ATF_CHECK_MSG(pmc_write(id, 42) == 0, "pmc_write before start: %s", + strerror(errno)); + ATF_CHECK_MSG(pmc_read(id, &v) == 0, "pmc_read: %s", strerror(errno)); + ATF_CHECK_MSG(v == 42, "wrote 42, read back %ju", (uintmax_t)v); + + ATF_CHECK(pmc_rw(id, 7, &old) == 0); + ATF_CHECK_MSG(old == 42, "pmc_rw returned %ju, expected the 42 " + "written before it", (uintmax_t)old); + + ATF_REQUIRE(pmc_start(id) == 0); + ATF_REQUIRE(pmc_stop(id) == 0); + ATF_CHECK(pmc_detach(id, getpid()) == 0); + ATF_CHECK(pmc_release(id) == 0); +} + +ATF_TC(pmcadmin_requires_privilege); +ATF_TC_HEAD(pmcadmin_requires_privilege, tc) +{ + + atf_tc_set_md_var(tc, "descr", + "PMC_OP_PMCADMIN is refused to an unprivileged caller"); + atf_tc_set_md_var(tc, "require.user", "unprivileged"); +} +ATF_TC_BODY(pmcadmin_requires_privilege, tc) +{ + + require_hwpmc(); + require_unprivileged(); + + errno = 0; + ATF_CHECK_MSG(pmc_disable(0, 0) != 0, + "an unprivileged process disabled a PMC row"); + ATF_CHECK_MSG(errno == EPERM, "pmc_disable: expected EPERM, got %s", + strerror(errno)); + + errno = 0; + ATF_CHECK_MSG(pmc_enable(0, 0) != 0, + "an unprivileged process enabled a PMC row"); + ATF_CHECK_MSG(errno == EPERM, "pmc_enable: expected EPERM, got %s", + strerror(errno)); +} + +ATF_TC(system_mode_requires_privilege); +ATF_TC_HEAD(system_mode_requires_privilege, tc) +{ + + atf_tc_set_md_var(tc, "descr", + "a system-wide PMC is refused to an unprivileged caller"); + atf_tc_set_md_var(tc, "require.user", "unprivileged"); +} +ATF_TC_BODY(system_mode_requires_privilege, tc) +{ + const char **names; + char spec[128]; + pmc_id_t id; + size_t len; + int nnames, i, unpriv; + + require_hwpmc(); + require_unprivileged(); + + len = sizeof(unpriv); + if (sysctlbyname("security.bsd.unprivileged_syspmcs", &unpriv, &len, + NULL, 0) != 0) + atf_tc_skip("security.bsd.unprivileged_syspmcs is unreadable"); + if (unpriv != 0) + atf_tc_skip("security.bsd.unprivileged_syspmcs is set: " + "unprivileged system-wide PMCs are permitted here"); + + if (pmc_event_names_of_class(PMC_CLASS_SOFT, &names, &nnames) != 0 || + nnames == 0) + atf_tc_skip("no SOFT-class events"); + + /* + * A system-mode PMC must name a real CPU: PMC_CPU_ANY is rejected + * before the privilege check is reached, which would make this case + * pass for the wrong reason. + */ + for (i = 0; i < nnames; i++) { + (void)snprintf(spec, sizeof(spec), "SOFT-%s", names[i]); + errno = 0; + if (pmc_allocate(spec, PMC_MODE_SC, 0, 0, &id, 0) == 0) { + (void)pmc_release(id); + atf_tc_fail("an unprivileged process allocated a " + "system-wide PMC (%s)", spec); + } + ATF_CHECK_MSG(errno == EPERM, + "%s: expected EPERM, got %s", spec, strerror(errno)); + } +} + +/** + * @internal + * A target that has exec'ed a set-id binary carries P_SUGID, which + * p_candebug() refuses to an unprivileged subject - the same rule + * PMC_OP_PMCATTACH inherits. wall(1) is set-gid and reads its message from + * stdin, so it stays alive on a pipe long enough to be attached to. + */ +ATF_TC(attach_to_sugid_target); +ATF_TC_HEAD(attach_to_sugid_target, tc) +{ + + atf_tc_set_md_var(tc, "descr", + "attaching a PMC to a process that has exec'ed a set-id binary " + "is refused to an unprivileged owner"); + atf_tc_set_md_var(tc, "require.user", "unprivileged"); +} +ATF_TC_BODY(attach_to_sugid_target, tc) +{ + static const char *const argv[] = { "wall", NULL }; + static const char path[] = "/usr/bin/wall"; + struct stat sb; + pmc_id_t id; + pid_t target; + int gopipe[2], inpipe[2], status, rc; + char token; + + require_hwpmc(); + require_unprivileged(); + + if (stat(path, &sb) != 0 || (sb.st_mode & S_ISGID) == 0) + atf_tc_skip("%s is not set-gid here", path); + if (getegid() == sb.st_gid) + atf_tc_skip("the subject is already in %s's group, so it may " + "trace the target", path); + + ATF_REQUIRE(pipe(gopipe) == 0); + ATF_REQUIRE(pipe(inpipe) == 0); + ATF_REQUIRE((target = fork()) >= 0); + if (target == 0) { + (void)close(gopipe[1]); + (void)dup2(inpipe[0], STDIN_FILENO); + (void)close(inpipe[1]); + if (read(gopipe[0], &token, 1) != 1) + _exit(1); + (void)execv(path, __DECONST(char **, argv)); + _exit(1); + } + (void)close(gopipe[0]); + (void)close(inpipe[0]); + + id = require_soft_pmc(PMC_MODE_TC); + + /* Let it exec, then give it time to get there. */ + ATF_REQUIRE(write(gopipe[1], "g", 1) == 1); + (void)close(gopipe[1]); + (void)usleep(400000); + + errno = 0; + rc = pmc_attach(id, target); + if (rc == 0) + (void)pmc_detach(id, target); + (void)kill(target, SIGKILL); + (void)close(inpipe[1]); + (void)waitpid(target, &status, 0); + (void)pmc_release(id); + + ATF_CHECK_MSG(rc != 0, + "an unprivileged owner attached a PMC to a set-id target"); + ATF_CHECK_MSG(errno == EPERM, "pmc_attach: expected EPERM, got %s", + strerror(errno)); +} + +ATF_TP_ADD_TCS(tp) +{ + + ATF_TP_ADD_TC(tp, never_allocated_id); + ATF_TP_ADD_TC(tp, released_id); + ATF_TP_ADD_TC(tp, another_owners_id); + ATF_TP_ADD_TC(tp, read_write_before_start); + ATF_TP_ADD_TC(tp, pmcadmin_requires_privilege); + ATF_TP_ADD_TC(tp, system_mode_requires_privilege); + ATF_TP_ADD_TC(tp, attach_to_sugid_target); + + return (atf_no_error()); +}