5 files changed, 334 insertions, 3 deletions

diff --git a/tools/testing/selftests/powerpc/harness.c b/tools/testing/selftests/powerpc/harness.c
index 9d7166dfad1e..ba89353abfcc 100644
--- a/tools/testing/selftests/powerpc/harness.c
+++ b/tools/testing/selftests/powerpc/harness.c
@@ -21,6 +21,7 @@
 
 #define KILL_TIMEOUT    5
 
+/* Setting timeout to -1 disables the alarm */
 static uint64_t timeout = 120;
 
 int run_test(int (test_function)(void), char *name)
@@ -43,8 +44,9 @@ int run_test(int (test_function)(void), char *name)
 
         setpgid(pid, pid);
 
-        /* Wake us up in timeout seconds */
-        alarm(timeout);
+        if (timeout != -1)
+                /* Wake us up in timeout seconds */
+                alarm(timeout);
         terminated = false;
 
 wait:
diff --git a/tools/testing/selftests/powerpc/include/reg.h b/tools/testing/selftests/powerpc/include/reg.h
index 96043b9b9829..1e797ae396ee 100644
--- a/tools/testing/selftests/powerpc/include/reg.h
+++ b/tools/testing/selftests/powerpc/include/reg.h
@@ -79,11 +79,13 @@
 
 /* MSR register bits */
 #define MSR_TS_S_LG     33              /* Trans Mem state: Suspended */
+#define MSR_TS_T_LG     34              /* Trans Mem state: Active */
 
 #define __MASK(X)       (1UL<<(X))
 
 /* macro to check TM MSR bits */
 #define MSR_TS_S        __MASK(MSR_TS_S_LG)   /* Transaction Suspended */
+#define MSR_TS_T        __MASK(MSR_TS_T_LG)   /* Transaction Transactional */
 
 /* Vector Instructions */
 #define VSX_XX1(xs, ra, rb)     (((xs) & 0x1f) << 21 | ((ra) << 16) |  \
diff --git a/tools/testing/selftests/powerpc/signal/.gitignore b/tools/testing/selftests/powerpc/signal/.gitignore
index 1b89224a8aab..dca5852a1546 100644
--- a/tools/testing/selftests/powerpc/signal/.gitignore
+++ b/tools/testing/selftests/powerpc/signal/.gitignore
@@ -1,2 +1,3 @@
 signal
 signal_tm
+sigfuz
diff --git a/tools/testing/selftests/powerpc/signal/Makefile b/tools/testing/selftests/powerpc/signal/Makefile
index 209a958dca12..113838fbbe7f 100644
--- a/tools/testing/selftests/powerpc/signal/Makefile
+++ b/tools/testing/selftests/powerpc/signal/Makefile
@@ -1,8 +1,9 @@
 # SPDX-License-Identifier: GPL-2.0
-TEST_GEN_PROGS := signal signal_tm
+TEST_GEN_PROGS := signal signal_tm sigfuz
 
 CFLAGS += -maltivec
 $(OUTPUT)/signal_tm: CFLAGS += -mhtm
+$(OUTPUT)/sigfuz: CFLAGS += -pthread -m64
 
 top_srcdir = ../../../../..
 include ../../lib.mk
diff --git a/tools/testing/selftests/powerpc/signal/sigfuz.c b/tools/testing/selftests/powerpc/signal/sigfuz.c
new file mode 100644
index 000000000000..dade00c698c2
--- /dev/null
+++ b/tools/testing/selftests/powerpc/signal/sigfuz.c
@@ -0,0 +1,325 @@
+// SPDX-License-Identifier: GPL-2.0
+/*
+ * Copyright 2018, Breno Leitao, IBM Corp.
+ * Licensed under GPLv2.
+ *
+ * Sigfuz(tm): A PowerPC TM-aware signal fuzzer.
+ *
+ * This is a new selftest that raises SIGUSR1 signals and handles it in a set
+ * of different ways, trying to create different scenario for testing
+ * purpose.
+ *
+ * This test works raising a signal and calling sigreturn interleaved with
+ * TM operations, as starting, suspending and terminating a transaction. The
+ * test depends on random numbers, and, based on them, it sets different TM
+ * states.
+ *
+ * Other than that, the test fills out the user context struct that is passed
+ * to the sigreturn system call with random data, in order to make sure that
+ * the signal handler syscall can handle different and invalid states
+ * properly.
+ *
+ * This selftest has command line parameters to control what kind of tests the
+ * user wants to run, as for example, if a transaction should be started prior
+ * to signal being raised, or, after the signal being raised and before the
+ * sigreturn. If no parameter is given, the default is enabling all options.
+ *
+ * This test does not check if the user context is being read and set
+ * properly by the kernel. Its purpose, at this time, is basically
+ * guaranteeing that the kernel does not crash on invalid scenarios.
+ */
+
+#include <stdio.h>
+#include <limits.h>
+#include <sys/wait.h>
+#include <unistd.h>
+#include <stdlib.h>
+#include <signal.h>
+#include <string.h>
+#include <ucontext.h>
+#include <sys/mman.h>
+#include <pthread.h>
+#include "utils.h"
+
+/* Selftest defaults */
+#define COUNT_MAX       4000            /* Number of interactions */
+#define THREADS         16              /* Number of threads */
+
+/* Arguments options */
+#define ARG_MESS_WITH_TM_AT     0x1
+#define ARG_MESS_WITH_TM_BEFORE 0x2
+#define ARG_MESS_WITH_MSR_AT    0x4
+#define ARG_FOREVER             0x10
+#define ARG_COMPLETE            (ARG_MESS_WITH_TM_AT |          \
+                                ARG_MESS_WITH_TM_BEFORE |       \
+                                ARG_MESS_WITH_MSR_AT)
+
+static int args;
+static int nthread = THREADS;
+static int count_max = COUNT_MAX;
+
+/* checkpoint context */
+static ucontext_t *tmp_uc;
+
+/* Return true with 1/x probability */
+static int one_in_chance(int x)
+{
+        return rand() % x == 0;
+}
+
+/* Change TM states */
+static void mess_with_tm(void)
+{
+        /* Starts a transaction 33% of the time */
+        if (one_in_chance(3)) {
+                asm ("tbegin.   ;"
+                     "beq 8     ;");
+
+                /* And suspended half of them */
+                if (one_in_chance(2))
+                        asm("tsuspend.  ;");
+        }
+
+        /* Call 'tend' in 5% of the runs */
+        if (one_in_chance(20))
+                asm("tend.      ;");
+}
+
+/* Signal handler that will be invoked with raise() */
+static void trap_signal_handler(int signo, siginfo_t *si, void *uc)
+{
+        ucontext_t *ucp = uc;
+
+        ucp->uc_link = tmp_uc;
+
+        /*
+         * Set uc_link in three possible ways:
+         *  - Setting a single 'int' in the whole chunk
+         *  - Cloning ucp into uc_link
+         *  - Allocating a new memory chunk
+         */
+        if (one_in_chance(3)) {
+                memset(ucp->uc_link, rand(), sizeof(ucontext_t));
+        } else if (one_in_chance(2)) {
+                memcpy(ucp->uc_link, uc, sizeof(ucontext_t));
+        } else if (one_in_chance(2)) {
+                if (tmp_uc) {
+                        free(tmp_uc);
+                        tmp_uc = NULL;
+                }
+                tmp_uc = malloc(sizeof(ucontext_t));
+                ucp->uc_link = tmp_uc;
+                /* Trying to cause a major page fault at Kernel level */
+                madvise(ucp->uc_link, sizeof(ucontext_t), MADV_DONTNEED);
+        }
+
+        if (args & ARG_MESS_WITH_MSR_AT) {
+                /* Changing the checkpointed registers */
+                if (one_in_chance(4)) {
+                        ucp->uc_link->uc_mcontext.gp_regs[PT_MSR] |= MSR_TS_S;
+                } else {
+                        if (one_in_chance(2)) {
+                                ucp->uc_link->uc_mcontext.gp_regs[PT_MSR] |=
+                                                 MSR_TS_T;
+                        } else if (one_in_chance(2)) {
+                                ucp->uc_link->uc_mcontext.gp_regs[PT_MSR] |=
+                                                MSR_TS_T | MSR_TS_S;
+                        }
+                }
+
+                /* Checking the current register context */
+                if (one_in_chance(2)) {
+                        ucp->uc_mcontext.gp_regs[PT_MSR] |= MSR_TS_S;
+                } else if (one_in_chance(2)) {
+                        if (one_in_chance(2))
+                                ucp->uc_mcontext.gp_regs[PT_MSR] |=
+                                        MSR_TS_T;
+                        else if (one_in_chance(2))
+                                ucp->uc_mcontext.gp_regs[PT_MSR] |=
+                                        MSR_TS_T | MSR_TS_S;
+                }
+        }
+
+        if (one_in_chance(20)) {
+                /* Nested transaction start */
+                if (one_in_chance(5))
+                        mess_with_tm();
+
+                /* Return without changing any other context info */
+                return;
+        }
+
+        if (one_in_chance(10))
+                ucp->uc_mcontext.gp_regs[PT_MSR] = random();
+        if (one_in_chance(10))
+                ucp->uc_mcontext.gp_regs[PT_NIP] = random();
+        if (one_in_chance(10))
+                ucp->uc_link->uc_mcontext.gp_regs[PT_MSR] = random();
+        if (one_in_chance(10))
+                ucp->uc_link->uc_mcontext.gp_regs[PT_NIP] = random();
+
+        ucp->uc_mcontext.gp_regs[PT_TRAP] = random();
+        ucp->uc_mcontext.gp_regs[PT_DSISR] = random();
+        ucp->uc_mcontext.gp_regs[PT_DAR] = random();
+        ucp->uc_mcontext.gp_regs[PT_ORIG_R3] = random();
+        ucp->uc_mcontext.gp_regs[PT_XER] = random();
+        ucp->uc_mcontext.gp_regs[PT_RESULT] = random();
+        ucp->uc_mcontext.gp_regs[PT_SOFTE] = random();
+        ucp->uc_mcontext.gp_regs[PT_DSCR] = random();
+        ucp->uc_mcontext.gp_regs[PT_CTR] = random();
+        ucp->uc_mcontext.gp_regs[PT_LNK] = random();
+        ucp->uc_mcontext.gp_regs[PT_CCR] = random();
+        ucp->uc_mcontext.gp_regs[PT_REGS_COUNT] = random();
+
+        ucp->uc_link->uc_mcontext.gp_regs[PT_TRAP] = random();
+        ucp->uc_link->uc_mcontext.gp_regs[PT_DSISR] = random();
+        ucp->uc_link->uc_mcontext.gp_regs[PT_DAR] = random();
+        ucp->uc_link->uc_mcontext.gp_regs[PT_ORIG_R3] = random();
+        ucp->uc_link->uc_mcontext.gp_regs[PT_XER] = random();
+        ucp->uc_link->uc_mcontext.gp_regs[PT_RESULT] = random();
+        ucp->uc_link->uc_mcontext.gp_regs[PT_SOFTE] = random();
+        ucp->uc_link->uc_mcontext.gp_regs[PT_DSCR] = random();
+        ucp->uc_link->uc_mcontext.gp_regs[PT_CTR] = random();
+        ucp->uc_link->uc_mcontext.gp_regs[PT_LNK] = random();
+        ucp->uc_link->uc_mcontext.gp_regs[PT_CCR] = random();
+        ucp->uc_link->uc_mcontext.gp_regs[PT_REGS_COUNT] = random();
+
+        if (args & ARG_MESS_WITH_TM_BEFORE) {
+                if (one_in_chance(2))
+                        mess_with_tm();
+        }
+}
+
+static void seg_signal_handler(int signo, siginfo_t *si, void *uc)
+{
+        /* Clear exit for process that segfaults */
+        exit(0);
+}
+
+static void *sigfuz_test(void *thrid)
+{
+        struct sigaction trap_sa, seg_sa;
+        int ret, i = 0;
+        pid_t t;
+
+        tmp_uc = malloc(sizeof(ucontext_t));
+
+        /* Main signal handler */
+        trap_sa.sa_flags = SA_SIGINFO;
+        trap_sa.sa_sigaction = trap_signal_handler;
+
+        /* SIGSEGV signal handler */
+        seg_sa.sa_flags = SA_SIGINFO;
+        seg_sa.sa_sigaction = seg_signal_handler;
+
+        /* The signal handler will enable MSR_TS */
+        sigaction(SIGUSR1, &trap_sa, NULL);
+
+        /* If it does not crash, it will segfault, avoid it to retest */
+        sigaction(SIGSEGV, &seg_sa, NULL);
+
+        while (i < count_max) {
+                t = fork();
+
+                if (t == 0) {
+                        /* Once seed per process */
+                        srand(time(NULL) + getpid());
+                        if (args & ARG_MESS_WITH_TM_AT) {
+                                if (one_in_chance(2))
+                                        mess_with_tm();
+                        }
+                        raise(SIGUSR1);
+                        exit(0);
+                } else {
+                        waitpid(t, &ret, 0);
+                }
+                if (!(args & ARG_FOREVER))
+                        i++;
+        }
+
+        /* If not freed already, free now */
+        if (tmp_uc) {
+                free(tmp_uc);
+                tmp_uc = NULL;
+        }
+
+        return NULL;
+}
+
+static int signal_fuzzer(void)
+{
+        int t, rc;
+        pthread_t *threads;
+
+        threads = malloc(nthread * sizeof(pthread_t));
+
+        for (t = 0; t < nthread; t++) {
+                rc = pthread_create(&threads[t], NULL, sigfuz_test,
+                                    (void *)&t);
+                if (rc)
+                        perror("Thread creation error\n");
+        }
+
+        for (t = 0; t < nthread; t++) {
+                rc = pthread_join(threads[t], NULL);
+                if (rc)
+                        perror("Thread join error\n");
+        }
+
+        free(threads);
+
+        return EXIT_SUCCESS;
+}
+
+static void show_help(char *name)
+{
+        printf("%s: Sigfuzzer for powerpc\n", name);
+        printf("Usage:\n");
+        printf("\t-b\t Mess with TM before raising a SIGUSR1 signal\n");
+        printf("\t-a\t Mess with TM after raising a SIGUSR1 signal\n");
+        printf("\t-m\t Mess with MSR[TS] bits at mcontext\n");
+        printf("\t-x\t Mess with everything above\n");
+        printf("\t-f\t Run forever (Press ^C to Quit)\n");
+        printf("\t-i\t Amount of interactions.  (Default = %d)\n", COUNT_MAX);
+        printf("\t-t\t Amount of threads.       (Default = %d)\n", THREADS);
+        exit(-1);
+}
+
+int main(int argc, char **argv)
+{
+        int opt;
+
+        while ((opt = getopt(argc, argv, "bamxt:fi:h")) != -1) {
+                if (opt == 'b') {
+                        printf("Mess with TM before signal\n");
+                        args |= ARG_MESS_WITH_TM_BEFORE;
+                } else if (opt == 'a') {
+                        printf("Mess with TM at signal handler\n");
+                        args |= ARG_MESS_WITH_TM_AT;
+                } else if (opt == 'm') {
+                        printf("Mess with MSR[TS] bits in mcontext\n");
+                        args |= ARG_MESS_WITH_MSR_AT;
+                } else if (opt == 'x') {
+                        printf("Running with all options enabled\n");
+                        args |= ARG_COMPLETE;
+                } else if (opt == 't') {
+                        nthread = atoi(optarg);
+                        printf("Threads = %d\n", nthread);
+                } else if (opt == 'f') {
+                        args |= ARG_FOREVER;
+                        printf("Press ^C to stop\n");
+                        test_harness_set_timeout(-1);
+                } else if (opt == 'i') {
+                        count_max = atoi(optarg);
+                        printf("Running for %d interactions\n", count_max);
+                } else if (opt == 'h') {
+                        show_help(argv[0]);
+                }
+        }
+
+        /* Default test suite */
+        if (!args)
+                args = ARG_COMPLETE;
+
+        test_harness(signal_fuzzer, "signal_fuzzer");
+}