selftests/powerpc: Add a signal fuzzer selftest (83e367f9) · Commits · 戴 / test

tools/testing/selftests/powerpc/harness.c

+4 −2

Original line number	Diff line number	Diff line
		@@ -21,6 +21,7 @@

		#define KILL_TIMEOUT 5

		/* Setting timeout to -1 disables the alarm */
		static uint64_t timeout = 120;

		int run_test(int (test_function)(void), char *name)
		@@ -43,6 +44,7 @@ int run_test(int (test_function)(void), char *name)

		setpgid(pid, pid);

		if (timeout != -1)
		/* Wake us up in timeout seconds */
		alarm(timeout);
		terminated = false;

tools/testing/selftests/powerpc/include/reg.h

+2 −0

Original line number	Diff line number	Diff line
		@@ -79,11 +79,13 @@

		/* MSR register bits */
		#define MSR_TS_S_LG 33 /* Trans Mem state: Suspended */
		#define MSR_TS_T_LG 34 /* Trans Mem state: Active */

		#define __MASK(X) (1UL<<(X))

		/* macro to check TM MSR bits */
		#define MSR_TS_S __MASK(MSR_TS_S_LG) /* Transaction Suspended */
		#define MSR_TS_T __MASK(MSR_TS_T_LG) /* Transaction Transactional */

		/* Vector Instructions */
		#define VSX_XX1(xs, ra, rb) (((xs) & 0x1f) << 21 \| ((ra) << 16) \| \

tools/testing/selftests/powerpc/signal/.gitignore

+1 −0

Original line number	Diff line number	Diff line
		signal
		signal_tm
		sigfuz

tools/testing/selftests/powerpc/signal/Makefile

+2 −1

Original line number	Diff line number	Diff line
		# SPDX-License-Identifier: GPL-2.0
		TEST_GEN_PROGS := signal signal_tm
		TEST_GEN_PROGS := signal signal_tm sigfuz

		CFLAGS += -maltivec
		$(OUTPUT)/signal_tm: CFLAGS += -mhtm
		$(OUTPUT)/sigfuz: CFLAGS += -pthread -m64

		top_srcdir = ../../../../..
		include ../../lib.mk

tools/testing/selftests/powerpc/signal/sigfuz.c

0 → 100644

+325 −0

Original line number	Diff line number	Diff line
		// SPDX-License-Identifier: GPL-2.0
		/*
		* Copyright 2018, Breno Leitao, IBM Corp.
		* Licensed under GPLv2.
		*
		* Sigfuz(tm): A PowerPC TM-aware signal fuzzer.
		*
		* This is a new selftest that raises SIGUSR1 signals and handles it in a set
		* of different ways, trying to create different scenario for testing
		* purpose.
		*
		* This test works raising a signal and calling sigreturn interleaved with
		* TM operations, as starting, suspending and terminating a transaction. The
		* test depends on random numbers, and, based on them, it sets different TM
		* states.
		*
		* Other than that, the test fills out the user context struct that is passed
		* to the sigreturn system call with random data, in order to make sure that
		* the signal handler syscall can handle different and invalid states
		* properly.
		*
		* This selftest has command line parameters to control what kind of tests the
		* user wants to run, as for example, if a transaction should be started prior
		* to signal being raised, or, after the signal being raised and before the
		* sigreturn. If no parameter is given, the default is enabling all options.
		*
		* This test does not check if the user context is being read and set
		* properly by the kernel. Its purpose, at this time, is basically
		* guaranteeing that the kernel does not crash on invalid scenarios.
		*/

		#include <stdio.h>
		#include <limits.h>
		#include <sys/wait.h>
		#include <unistd.h>
		#include <stdlib.h>
		#include <signal.h>
		#include <string.h>
		#include <ucontext.h>
		#include <sys/mman.h>
		#include <pthread.h>
		#include "utils.h"

		/* Selftest defaults */
		#define COUNT_MAX 4000 /* Number of interactions */
		#define THREADS 16 /* Number of threads */

		/* Arguments options */
		#define ARG_MESS_WITH_TM_AT 0x1
		#define ARG_MESS_WITH_TM_BEFORE 0x2
		#define ARG_MESS_WITH_MSR_AT 0x4
		#define ARG_FOREVER 0x10
		#define ARG_COMPLETE (ARG_MESS_WITH_TM_AT \| \
		ARG_MESS_WITH_TM_BEFORE \| \
		ARG_MESS_WITH_MSR_AT)

		static int args;
		static int nthread = THREADS;
		static int count_max = COUNT_MAX;

		/* checkpoint context */
		static ucontext_t *tmp_uc;

		/* Return true with 1/x probability */
		static int one_in_chance(int x)
		{
		return rand() % x == 0;
		}

		/* Change TM states */
		static void mess_with_tm(void)
		{
		/* Starts a transaction 33% of the time */
		if (one_in_chance(3)) {
		asm ("tbegin. ;"
		"beq 8 ;");

		/* And suspended half of them */
		if (one_in_chance(2))
		asm("tsuspend. ;");
		}

		/* Call 'tend' in 5% of the runs */
		if (one_in_chance(20))
		asm("tend. ;");
		}

		/* Signal handler that will be invoked with raise() */
		static void trap_signal_handler(int signo, siginfo_t si, void uc)
		{
		ucontext_t *ucp = uc;

		ucp->uc_link = tmp_uc;

		/*
		* Set uc_link in three possible ways:
		* - Setting a single 'int' in the whole chunk
		* - Cloning ucp into uc_link
		* - Allocating a new memory chunk
		*/
		if (one_in_chance(3)) {
		memset(ucp->uc_link, rand(), sizeof(ucontext_t));
		} else if (one_in_chance(2)) {
		memcpy(ucp->uc_link, uc, sizeof(ucontext_t));
		} else if (one_in_chance(2)) {
		if (tmp_uc) {
		free(tmp_uc);
		tmp_uc = NULL;
		}
		tmp_uc = malloc(sizeof(ucontext_t));
		ucp->uc_link = tmp_uc;
		/* Trying to cause a major page fault at Kernel level */
		madvise(ucp->uc_link, sizeof(ucontext_t), MADV_DONTNEED);
		}

		if (args & ARG_MESS_WITH_MSR_AT) {
		/* Changing the checkpointed registers */
		if (one_in_chance(4)) {
		ucp->uc_link->uc_mcontext.gp_regs[PT_MSR] \|= MSR_TS_S;
		} else {
		if (one_in_chance(2)) {
		ucp->uc_link->uc_mcontext.gp_regs[PT_MSR] \|=
		MSR_TS_T;
		} else if (one_in_chance(2)) {
		ucp->uc_link->uc_mcontext.gp_regs[PT_MSR] \|=
		MSR_TS_T \| MSR_TS_S;
		}
		}

		/* Checking the current register context */
		if (one_in_chance(2)) {
		ucp->uc_mcontext.gp_regs[PT_MSR] \|= MSR_TS_S;
		} else if (one_in_chance(2)) {
		if (one_in_chance(2))
		ucp->uc_mcontext.gp_regs[PT_MSR] \|=
		MSR_TS_T;
		else if (one_in_chance(2))
		ucp->uc_mcontext.gp_regs[PT_MSR] \|=
		MSR_TS_T \| MSR_TS_S;
		}
		}

		if (one_in_chance(20)) {
		/* Nested transaction start */
		if (one_in_chance(5))
		mess_with_tm();

		/* Return without changing any other context info */
		return;
		}

		if (one_in_chance(10))
		ucp->uc_mcontext.gp_regs[PT_MSR] = random();
		if (one_in_chance(10))
		ucp->uc_mcontext.gp_regs[PT_NIP] = random();
		if (one_in_chance(10))
		ucp->uc_link->uc_mcontext.gp_regs[PT_MSR] = random();
		if (one_in_chance(10))
		ucp->uc_link->uc_mcontext.gp_regs[PT_NIP] = random();

		ucp->uc_mcontext.gp_regs[PT_TRAP] = random();
		ucp->uc_mcontext.gp_regs[PT_DSISR] = random();
		ucp->uc_mcontext.gp_regs[PT_DAR] = random();
		ucp->uc_mcontext.gp_regs[PT_ORIG_R3] = random();
		ucp->uc_mcontext.gp_regs[PT_XER] = random();
		ucp->uc_mcontext.gp_regs[PT_RESULT] = random();
		ucp->uc_mcontext.gp_regs[PT_SOFTE] = random();
		ucp->uc_mcontext.gp_regs[PT_DSCR] = random();
		ucp->uc_mcontext.gp_regs[PT_CTR] = random();
		ucp->uc_mcontext.gp_regs[PT_LNK] = random();
		ucp->uc_mcontext.gp_regs[PT_CCR] = random();
		ucp->uc_mcontext.gp_regs[PT_REGS_COUNT] = random();

		ucp->uc_link->uc_mcontext.gp_regs[PT_TRAP] = random();
		ucp->uc_link->uc_mcontext.gp_regs[PT_DSISR] = random();
		ucp->uc_link->uc_mcontext.gp_regs[PT_DAR] = random();
		ucp->uc_link->uc_mcontext.gp_regs[PT_ORIG_R3] = random();
		ucp->uc_link->uc_mcontext.gp_regs[PT_XER] = random();
		ucp->uc_link->uc_mcontext.gp_regs[PT_RESULT] = random();
		ucp->uc_link->uc_mcontext.gp_regs[PT_SOFTE] = random();
		ucp->uc_link->uc_mcontext.gp_regs[PT_DSCR] = random();
		ucp->uc_link->uc_mcontext.gp_regs[PT_CTR] = random();
		ucp->uc_link->uc_mcontext.gp_regs[PT_LNK] = random();
		ucp->uc_link->uc_mcontext.gp_regs[PT_CCR] = random();
		ucp->uc_link->uc_mcontext.gp_regs[PT_REGS_COUNT] = random();

		if (args & ARG_MESS_WITH_TM_BEFORE) {
		if (one_in_chance(2))
		mess_with_tm();
		}
		}

		static void seg_signal_handler(int signo, siginfo_t si, void uc)
		{
		/* Clear exit for process that segfaults */
		exit(0);
		}

		static void sigfuz_test(void thrid)
		{
		struct sigaction trap_sa, seg_sa;
		int ret, i = 0;
		pid_t t;

		tmp_uc = malloc(sizeof(ucontext_t));

		/* Main signal handler */
		trap_sa.sa_flags = SA_SIGINFO;
		trap_sa.sa_sigaction = trap_signal_handler;

		/* SIGSEGV signal handler */
		seg_sa.sa_flags = SA_SIGINFO;
		seg_sa.sa_sigaction = seg_signal_handler;

		/* The signal handler will enable MSR_TS */
		sigaction(SIGUSR1, &trap_sa, NULL);

		/* If it does not crash, it will segfault, avoid it to retest */
		sigaction(SIGSEGV, &seg_sa, NULL);

		while (i < count_max) {
		t = fork();

		if (t == 0) {
		/* Once seed per process */
		srand(time(NULL) + getpid());
		if (args & ARG_MESS_WITH_TM_AT) {
		if (one_in_chance(2))
		mess_with_tm();
		}
		raise(SIGUSR1);
		exit(0);
		} else {
		waitpid(t, &ret, 0);
		}
		if (!(args & ARG_FOREVER))
		i++;
		}

		/* If not freed already, free now */
		if (tmp_uc) {
		free(tmp_uc);
		tmp_uc = NULL;
		}

		return NULL;
		}

		static int signal_fuzzer(void)
		{
		int t, rc;
		pthread_t *threads;

		threads = malloc(nthread * sizeof(pthread_t));

		for (t = 0; t < nthread; t++) {
		rc = pthread_create(&threads[t], NULL, sigfuz_test,
		(void *)&t);
		if (rc)
		perror("Thread creation error\n");
		}

		for (t = 0; t < nthread; t++) {
		rc = pthread_join(threads[t], NULL);
		if (rc)
		perror("Thread join error\n");
		}

		free(threads);

		return EXIT_SUCCESS;
		}

		static void show_help(char *name)
		{
		printf("%s: Sigfuzzer for powerpc\n", name);
		printf("Usage:\n");
		printf("\t-b\t Mess with TM before raising a SIGUSR1 signal\n");
		printf("\t-a\t Mess with TM after raising a SIGUSR1 signal\n");
		printf("\t-m\t Mess with MSR[TS] bits at mcontext\n");
		printf("\t-x\t Mess with everything above\n");
		printf("\t-f\t Run forever (Press ^C to Quit)\n");
		printf("\t-i\t Amount of interactions. (Default = %d)\n", COUNT_MAX);
		printf("\t-t\t Amount of threads. (Default = %d)\n", THREADS);
		exit(-1);
		}

		int main(int argc, char **argv)
		{
		int opt;

		while ((opt = getopt(argc, argv, "bamxt:fi:h")) != -1) {
		if (opt == 'b') {
		printf("Mess with TM before signal\n");
		args \|= ARG_MESS_WITH_TM_BEFORE;
		} else if (opt == 'a') {
		printf("Mess with TM at signal handler\n");
		args \|= ARG_MESS_WITH_TM_AT;
		} else if (opt == 'm') {
		printf("Mess with MSR[TS] bits in mcontext\n");
		args \|= ARG_MESS_WITH_MSR_AT;
		} else if (opt == 'x') {
		printf("Running with all options enabled\n");
		args \|= ARG_COMPLETE;
		} else if (opt == 't') {
		nthread = atoi(optarg);
		printf("Threads = %d\n", nthread);
		} else if (opt == 'f') {
		args \|= ARG_FOREVER;
		printf("Press ^C to stop\n");
		test_harness_set_timeout(-1);
		} else if (opt == 'i') {
		count_max = atoi(optarg);
		printf("Running for %d interactions\n", count_max);
		} else if (opt == 'h') {
		show_help(argv[0]);
		}
		}

		/* Default test suite */
		if (!args)
		args = ARG_COMPLETE;

		test_harness(signal_fuzzer, "signal_fuzzer");
		}

Admin message