171 lines · c
1// SPDX-License-Identifier: GPL-2.0+2/*3 * Copyright 2018, Michael Ellerman, IBM Corp.4 *5 * Test that an out-of-bounds branch to counter behaves as expected.6 */7 8#include <setjmp.h>9#include <stdio.h>10#include <stdlib.h>11#include <string.h>12#include <sys/mman.h>13#include <sys/types.h>14#include <sys/wait.h>15#include <ucontext.h>16#include <unistd.h>17 18#include "utils.h"19 20 21#define BAD_NIP 0x788c545a18000000ull22 23static struct pt_regs signal_regs;24static jmp_buf setjmp_env;25 26static void save_regs(ucontext_t *ctxt)27{28 struct pt_regs *regs = ctxt->uc_mcontext.regs;29 30 memcpy(&signal_regs, regs, sizeof(signal_regs));31}32 33static void segv_handler(int signum, siginfo_t *info, void *ctxt_v)34{35 save_regs(ctxt_v);36 longjmp(setjmp_env, 1);37}38 39static void usr2_handler(int signum, siginfo_t *info, void *ctxt_v)40{41 save_regs(ctxt_v);42}43 44static int ok(void)45{46 printf("Everything is OK in here.\n");47 return 0;48}49 50#define REG_POISON 0x5a5a51#define POISONED_REG(n) ((((unsigned long)REG_POISON) << 48) | ((n) << 32) | \52 (((unsigned long)REG_POISON) << 16) | (n))53 54static inline void poison_regs(void)55{56 #define POISON_REG(n) \57 "lis " __stringify(n) "," __stringify(REG_POISON) ";" \58 "addi " __stringify(n) "," __stringify(n) "," __stringify(n) ";" \59 "sldi " __stringify(n) "," __stringify(n) ", 32 ;" \60 "oris " __stringify(n) "," __stringify(n) "," __stringify(REG_POISON) ";" \61 "addi " __stringify(n) "," __stringify(n) "," __stringify(n) ";"62 63 asm (POISON_REG(15)64 POISON_REG(16)65 POISON_REG(17)66 POISON_REG(18)67 POISON_REG(19)68 POISON_REG(20)69 POISON_REG(21)70 POISON_REG(22)71 POISON_REG(23)72 POISON_REG(24)73 POISON_REG(25)74 POISON_REG(26)75 POISON_REG(27)76 POISON_REG(28)77 POISON_REG(29)78 : // inputs79 : // outputs80 : "15", "16", "17", "18", "19", "20", "21", "22", "23", "24", "25",81 "26", "27", "28", "29"82 );83 #undef POISON_REG84}85 86static int check_regs(void)87{88 unsigned long i;89 90 for (i = 15; i <= 29; i++)91 FAIL_IF(signal_regs.gpr[i] != POISONED_REG(i));92 93 printf("Regs OK\n");94 return 0;95}96 97static void dump_regs(void)98{99 for (int i = 0; i < 32; i += 4) {100 printf("r%02d 0x%016lx r%02d 0x%016lx " \101 "r%02d 0x%016lx r%02d 0x%016lx\n",102 i, signal_regs.gpr[i],103 i+1, signal_regs.gpr[i+1],104 i+2, signal_regs.gpr[i+2],105 i+3, signal_regs.gpr[i+3]);106 }107}108 109#ifdef _CALL_AIXDESC110struct opd {111 unsigned long ip;112 unsigned long toc;113 unsigned long env;114};115static struct opd bad_opd = {116 .ip = BAD_NIP,117};118#define BAD_FUNC (&bad_opd)119#else120#define BAD_FUNC BAD_NIP121#endif122 123int test_wild_bctr(void)124{125 int (*func_ptr)(void);126 struct sigaction segv = {127 .sa_sigaction = segv_handler,128 .sa_flags = SA_SIGINFO129 };130 struct sigaction usr2 = {131 .sa_sigaction = usr2_handler,132 .sa_flags = SA_SIGINFO133 };134 135 FAIL_IF(sigaction(SIGSEGV, &segv, NULL));136 FAIL_IF(sigaction(SIGUSR2, &usr2, NULL));137 138 bzero(&signal_regs, sizeof(signal_regs));139 140 if (setjmp(setjmp_env) == 0) {141 func_ptr = ok;142 func_ptr();143 144 kill(getpid(), SIGUSR2);145 printf("Regs before:\n");146 dump_regs();147 bzero(&signal_regs, sizeof(signal_regs));148 149 poison_regs();150 151 func_ptr = (int (*)(void))BAD_FUNC;152 func_ptr();153 154 FAIL_IF(1); /* we didn't segv? */155 }156 157 FAIL_IF(signal_regs.nip != BAD_NIP);158 159 printf("All good - took SEGV as expected branching to 0x%llx\n", BAD_NIP);160 161 dump_regs();162 FAIL_IF(check_regs());163 164 return 0;165}166 167int main(void)168{169 return test_harness(test_wild_bctr, "wild_bctr");170}171