1 // SPDX-License-Identifier: GPL-2.0-only
2 /*
3 * Copyright 2019, Gustavo Romero, Michael Neuling, IBM Corp.
4 *
5 * This test will spawn two processes. Both will be attached to the same
6 * CPU (CPU 0). The child will be in a loop writing to FP register f31 and
7 * VMX/VEC/Altivec register vr31 a known value, called poison, calling
8 * sched_yield syscall after to allow the parent to switch on the CPU.
9 * Parent will set f31 and vr31 to 1 and in a loop will check if f31 and
10 * vr31 remain 1 as expected until a given timeout (2m). If the issue is
11 * present child's poison will leak into parent's f31 or vr31 registers,
12 * otherwise, poison will never leak into parent's f31 and vr31 registers.
13 */
14
15 #define _GNU_SOURCE
16 #include <stdio.h>
17 #include <stdlib.h>
18 #include <unistd.h>
19 #include <inttypes.h>
20 #include <sched.h>
21 #include <sys/types.h>
22 #include <signal.h>
23
24 #include "tm.h"
25
26 int tm_poison_test(void)
27 {
28 int cpu, pid;
29 cpu_set_t cpuset;
30 uint64_t poison = 0xdeadbeefc0dec0fe;
31 uint64_t unknown = 0;
32 bool fail_fp = false;
33 bool fail_vr = false;
34
35 SKIP_IF(!have_htm());
36 SKIP_IF(htm_is_synthetic());
37
38 cpu = pick_online_cpu();
39 FAIL_IF(cpu < 0);
40
41 // Attach both Child and Parent to the same CPU
42 CPU_ZERO(&cpuset);
43 CPU_SET(cpu, &cpuset);
44 FAIL_IF(sched_setaffinity(0, sizeof(cpuset), &cpuset) != 0);
45
46 pid = fork();
47 if (!pid) {
48 /**
49 * child
50 */
51 while (1) {
52 sched_yield();
53 asm (
54 "mtvsrd 31, %[poison];" // f31 = poison
55 "mtvsrd 63, %[poison];" // vr31 = poison
56
57 : : [poison] "r" (poison) : );
58 }
59 }
60
61 /**
62 * parent
63 */
64 asm (
65 /*
66 * Set r3, r4, and f31 to known value 1 before entering
67 * in transaction. They won't be written after that.
68 */
69 " li 3, 0x1 ;"
70 " li 4, 0x1 ;"
71 " mtvsrd 31, 4 ;"
72
73 /*
74 * The Time Base (TB) is a 64-bit counter register that is
75 * independent of the CPU clock and which is incremented
76 * at a frequency of 512000000 Hz, so every 1.953125ns.
77 * So it's necessary 120s/0.000000001953125s = 61440000000
78 * increments to get a 2 minutes timeout. Below we set that
79 * value in r5 and then use r6 to track initial TB value,
80 * updating TB values in r7 at every iteration and comparing it
81 * to r6. When r7 (current) - r6 (initial) > 61440000000 we bail
82 * out since for sure we spent already 2 minutes in the loop.
83 * SPR 268 is the TB register.
84 */
85 " lis 5, 14 ;"
86 " ori 5, 5, 19996 ;"
87 " sldi 5, 5, 16 ;" // r5 = 61440000000
88
89 " mfspr 6, 268 ;" // r6 (TB initial)
90 "1: mfspr 7, 268 ;" // r7 (TB current)
91 " subf 7, 6, 7 ;" // r7 - r6 > 61440000000 ?
92 " cmpd 7, 5 ;"
93 " bgt 3f ;" // yes, exit
94
95 /*
96 * Main loop to check f31
97 */
98 " tbegin. ;" // no, try again
99 " beq 1b ;" // restart if no timeout
100 " mfvsrd 3, 31 ;" // read f31
101 " cmpd 3, 4 ;" // f31 == 1 ?
102 " bne 2f ;" // broken :-(
103 " tabort. 3 ;" // try another transaction
104 "2: tend. ;" // commit transaction
105 "3: mr %[unknown], 3 ;" // record r3
106
107 : [unknown] "=r" (unknown)
108 :
109 : "cr0", "r3", "r4", "r5", "r6", "r7", "vs31"
110
111 );
112
113 /*
114 * On leak 'unknown' will contain 'poison' value from child,
115 * otherwise (no leak) 'unknown' will contain the same value
116 * as r3 before entering in transactional mode, i.e. 0x1.
117 */
118 fail_fp = unknown != 0x1;
119 if (fail_fp)
120 printf("Unknown value %#"PRIx64" leaked into f31!\n", unknown);
121 else
122 printf("Good, no poison or leaked value into FP registers\n");
123
124 asm (
125 /*
126 * Set r3, r4, and vr31 to known value 1 before entering
127 * in transaction. They won't be written after that.
128 */
129 " li 3, 0x1 ;"
130 " li 4, 0x1 ;"
131 " mtvsrd 63, 4 ;"
132
133 " lis 5, 14 ;"
134 " ori 5, 5, 19996 ;"
135 " sldi 5, 5, 16 ;" // r5 = 61440000000
136
137 " mfspr 6, 268 ;" // r6 (TB initial)
138 "1: mfspr 7, 268 ;" // r7 (TB current)
139 " subf 7, 6, 7 ;" // r7 - r6 > 61440000000 ?
140 " cmpd 7, 5 ;"
141 " bgt 3f ;" // yes, exit
142
143 /*
144 * Main loop to check vr31
145 */
146 " tbegin. ;" // no, try again
147 " beq 1b ;" // restart if no timeout
148 " mfvsrd 3, 63 ;" // read vr31
149 " cmpd 3, 4 ;" // vr31 == 1 ?
150 " bne 2f ;" // broken :-(
151 " tabort. 3 ;" // try another transaction
152 "2: tend. ;" // commit transaction
153 "3: mr %[unknown], 3 ;" // record r3
154
155 : [unknown] "=r" (unknown)
156 :
157 : "cr0", "r3", "r4", "r5", "r6", "r7", "vs63"
158
159 );
160
161 /*
162 * On leak 'unknown' will contain 'poison' value from child,
163 * otherwise (no leak) 'unknown' will contain the same value
164 * as r3 before entering in transactional mode, i.e. 0x1.
165 */
166 fail_vr = unknown != 0x1;
167 if (fail_vr)
168 printf("Unknown value %#"PRIx64" leaked into vr31!\n", unknown);
169 else
170 printf("Good, no poison or leaked value into VEC registers\n");
171
172 kill(pid, SIGKILL);
173
174 return (fail_fp | fail_vr);
175 }
176
177 int main(int argc, char *argv[])
178 {
179 /* Test completes in about 4m */
180 test_harness_set_timeout(250);
181 return test_harness(tm_poison_test, "tm_poison_test");
182 }
183
Linux® is a registered trademark of Linus Torvalds in the United States and other countries.
TOMOYO® is a registered trademark of NTT DATA CORPORATION.