scalar.c

The Valgrind distribution has multiple tools. The most popular is the memory checking tool (called M

#include "../../memcheck.h"
#include "scalar.h"

// Here we are trying to trigger every syscall error (scalar errors and
// memory errors) for every syscall.  We do this by passing a lot of bogus
// arguments, mostly 0 and 1 (often it's 1 because NULL ptr args often aren't
// checked for memory errors, or in order to have a non-zero length used
// with some buffer).  So most of the syscalls don't actually succeed and do
// anything.
//
// Occasionally we have to be careful not to cause Valgrind to seg fault in
// its pre-syscall wrappers;  it does so because it can't know in general
// when memory is unaddressable, and so tries to dereference it when doing
// PRE_MEM_READ/PRE_MEM_WRITE calls.  (Note that Memcheck will
// always issue an error message immediately before these seg faults occur).

//#include <asm/ipc.h>
#include <sched.h>
#include <signal.h>

int main(void)
{
   // uninitialised, but we know px[0] is 0x0
   long* px  = malloc(sizeof(long));
   long  x0  = px[0];
   long  res;

   // All __NR_xxx numbers are taken from x86

   // __NR_restart_syscall 0  // XXX: not yet handled, perhaps should be...
   GO(__NR_restart_syscall, "n/a");
 //SY(__NR_restart_syscall); // (Not yet handled by Valgrind) FAIL;

   // __NR_exit 1 
   GO(__NR_exit, "below");
   // (see below)

   // __NR_fork 2
   GO(__NR_fork, "other");
   // (sse scalar_fork.c)

   // __NR_read 3
   // Nb: here we are also getting an error from the syscall arg itself.
   GO(__NR_read, "1+3s 1m");
   SY(__NR_read+x0, x0, x0, x0+1); FAILx(EFAULT);

   // __NR_write 4
   GO(__NR_write, "3s 1m");
   SY(__NR_write, x0, x0, x0+1); FAIL;

   // __NR_open 5
   GO(__NR_open, "(2-args) 2s 1m");
   SY(__NR_open, x0, x0); FAIL;

   // Only 1s 0m errors, because 2s 1m are ignored, being dups of the
   // earlier 2-arg open call.
   GO(__NR_open, "(3-args) 1s 0m");    
   SY(__NR_open, x0, x0+O_CREAT, x0); FAIL;

   // __NR_close 6
   GO(__NR_close, "1s 0m");
   SY(__NR_close, x0-1); FAIL;

   // __NR_waitpid 7
   GO(__NR_waitpid, "3s 1m");
   SY(__NR_waitpid, x0, x0+1, x0); FAIL;

   // __NR_creat 8
   GO(__NR_creat, "2s 1m");
   SY(__NR_creat, x0, x0); FAIL;

   // __NR_link 9
   GO(__NR_link, "2s 2m");
   SY(__NR_link, x0, x0); FAIL;

   // __NR_unlink 10
   GO(__NR_unlink, "1s 1m");
   SY(__NR_unlink, x0); FAIL;

   // __NR_execve 11
   // Nb: could have 3 memory errors if we pass x0+1 as the 2nd and 3rd
   // args, except for bug #93174.
   GO(__NR_execve, "3s 1m");
   SY(__NR_execve, x0, x0, x0); FAIL;

   // __NR_chdir 12
   GO(__NR_chdir, "1s 1m");
   SY(__NR_chdir, x0); FAIL;

   // __NR_time 13
   GO(__NR_time, "1s 1m");
   SY(__NR_time, x0+1); FAIL;

   // __NR_mknod 14
   GO(__NR_mknod, "3s 1m");
   SY(__NR_mknod, x0, x0, x0); FAIL;

   // __NR_chmod 15
   GO(__NR_chmod, "2s 1m");
   SY(__NR_chmod, x0, x0); FAIL;

   // __NR_lchown 16
   GO(__NR_lchown, "n/a");
 //SY(__NR_lchown); // (Not yet handled by Valgrind) FAIL;

   // __NR_break 17
   GO(__NR_break, "ni");
   SY(__NR_break); FAIL;

   // __NR_oldstat 18
   GO(__NR_oldstat, "n/a");
   // (obsolete, not handled by Valgrind)

   // __NR_lseek 19
   GO(__NR_lseek, "3s 0m");
   SY(__NR_lseek, x0-1, x0, x0); FAILx(EBADF);

   // __NR_getpid 20
   GO(__NR_getpid, "0s 0m");
   SY(__NR_getpid); SUCC;

   // __NR_mount 21
   GO(__NR_mount, "5s 3m");
   SY(__NR_mount, x0, x0, x0, x0, x0); FAIL;
   
   // __NR_umount 22
   GO(__NR_umount, "1s 1m");
   SY(__NR_umount, x0); FAIL;

   // __NR_setuid 23
   GO(__NR_setuid, "1s 0m");
   SY(__NR_setuid, x0); FAIL;

   // __NR_getuid 24
   GO(__NR_getuid, "0s 0m");
   SY(__NR_getuid); SUCC;

   // __NR_stime 25
   GO(__NR_stime, "n/a");
 //SY(__NR_stime); // (Not yet handled by Valgrind) FAIL;

   // __NR_ptrace 26
   // XXX: memory pointed to be arg3 goes unchecked... otherwise would be 2m
   GO(__NR_ptrace, "4s 1m");
   SY(__NR_ptrace, x0+PTRACE_GETREGS, x0, x0, x0); FAIL;

   // __NR_alarm 27
   GO(__NR_alarm, "1s 0m");
   SY(__NR_alarm, x0); SUCC;

   // __NR_oldfstat 28
   GO(__NR_oldfstat, "n/a");
   // (obsolete, not handled by Valgrind)

   // __NR_pause 29
   GO(__NR_pause, "ignore");
   // (hard to test, and no args so not much to be gained -- don't bother)

   // __NR_utime 30
   GO(__NR_utime, "2s 2m");
   SY(__NR_utime, x0, x0+1); FAIL;

   // __NR_stty 31
   GO(__NR_stty, "ni");
   SY(__NR_stty); FAIL;

   // __NR_gtty 32
   GO(__NR_gtty, "ni");
   SY(__NR_gtty); FAIL;

   // __NR_access 33
   GO(__NR_access, "2s 1m");
   SY(__NR_access, x0, x0); FAIL;

   // __NR_nice 34
   GO(__NR_nice, "1s 0m");
   SY(__NR_nice, x0); SUCC;

   // __NR_ftime 35
   GO(__NR_ftime, "ni");
   SY(__NR_ftime); FAIL;

   // __NR_sync 36
   GO(__NR_sync, "0s 0m");
   SY(__NR_sync); SUCC;

   // __NR_kill 37
   GO(__NR_kill, "2s 0m");
   SY(__NR_kill, x0, x0); SUCC;

   // __NR_rename 38
   GO(__NR_rename, "2s 2m");
   SY(__NR_rename, x0, x0); FAIL;

   // __NR_mkdir 39
   GO(__NR_mkdir, "2s 1m");
   SY(__NR_mkdir, x0, x0); FAIL;

   // __NR_rmdir 40
   GO(__NR_rmdir, "1s 1m");
   SY(__NR_rmdir, x0); FAIL;

   // __NR_dup 41
   GO(__NR_dup, "1s 0m");
   SY(__NR_dup, x0-1); FAIL;

   // __NR_pipe 42
   GO(__NR_pipe, "1s 1m");
   SY(__NR_pipe, x0); FAIL;

   // __NR_times 43
   GO(__NR_times, "1s 1m");
   SY(__NR_times, x0+1); FAIL;

   // __NR_prof 44
   GO(__NR_prof, "ni");
   SY(__NR_prof); FAIL;

   // __NR_brk 45
   GO(__NR_brk, "1s 0m");
   SY(__NR_brk, x0); SUCC;

   // __NR_setgid 46
   GO(__NR_setgid, "1s 0m");
   SY(__NR_setgid, x0); FAIL;

   // __NR_getgid 47
   GO(__NR_getgid, "0s 0m");
   SY(__NR_getgid); SUCC;

   // __NR_signal 48
   GO(__NR_signal, "n/a");
 //SY(__NR_signal); // (Not yet handled by Valgrind) FAIL;

   // __NR_geteuid 49
   GO(__NR_geteuid, "0s 0m");
   SY(__NR_geteuid); SUCC;

   // __NR_getegid 50
   GO(__NR_getegid, "0s 0m");
   SY(__NR_getegid); SUCC;

   // __NR_acct 51
   GO(__NR_acct, "1s 1m");
   SY(__NR_acct, x0); FAIL;

   // __NR_umount2 52
   GO(__NR_umount2, "2s 1m");
   SY(__NR_umount2, x0, x0); FAIL;

   // __NR_lock 53
   GO(__NR_lock, "ni");
   SY(__NR_lock); FAIL;

   // __NR_ioctl 54
   #include <asm/ioctls.h>
   GO(__NR_ioctl, "3s 1m");
   SY(__NR_ioctl, x0, x0+TCSETS, x0); FAIL;

   // __NR_fcntl 55
   // As with sys_open(), the 'fd' error is suppressed for the later ones.
   // For F_GETFD the 3rd arg is ignored
   GO(__NR_fcntl, "(GETFD) 2s 0m");
   SY(__NR_fcntl, x0-1, x0+F_GETFD, x0); FAILx(EBADF);

   // For F_DUPFD the 3rd arg is 'arg'
   GO(__NR_fcntl, "(DUPFD) 1s 0m");
   SY(__NR_fcntl, x0-1, x0+F_DUPFD, x0); FAILx(EBADF);

   // For F_GETLK the 3rd arg is 'lock'
   // on x86, this fails with EBADF.  But on amd64 in 32-bit mode
   // it fails with EFAULT.
   GO(__NR_fcntl, "(GETLK) 1s 0m");
   SY(__NR_fcntl, x0-1, x0+F_GETLK, x0); FAIL; //FAILx(EBADF);

   // __NR_mpx 56
   GO(__NR_mpx, "ni");
   SY(__NR_mpx); FAIL;

   // __NR_setpgid 57
   GO(__NR_setpgid, "2s 0m");
   SY(__NR_setpgid, x0, x0-1); FAIL;

   // __NR_ulimit 58
   GO(__NR_ulimit, "ni");
   SY(__NR_ulimit); FAIL;

   // __NR_oldolduname 59
   GO(__NR_oldolduname, "n/a");
   // (obsolete, not handled by Valgrind)

   // __NR_umask 60
   GO(__NR_umask, "1s 0m");
   SY(__NR_umask, x0+022); SUCC;

   // __NR_chroot 61
   GO(__NR_chroot, "1s 1m");
   SY(__NR_chroot, x0); FAIL;

   // __NR_ustat 62
   GO(__NR_ustat, "n/a");
   // (deprecated, not handled by Valgrind)

   // __NR_dup2 63
   GO(__NR_dup2, "2s 0m");
   SY(__NR_dup2, x0-1, x0); FAIL;

   // __NR_getppid 64
   GO(__NR_getppid, "0s 0m");
   SY(__NR_getppid); SUCC;

   // __NR_getpgrp 65
   GO(__NR_getpgrp, "0s 0m");
   SY(__NR_getpgrp); SUCC;

   // __NR_setsid 66
   GO(__NR_setsid, "0s 0m");
   SY(__NR_setsid); SUCC_OR_FAIL;

   // __NR_sigaction 67
   GO(__NR_sigaction, "3s 4m");
   SY(__NR_sigaction, x0, x0+&px[1], x0+&px[1]); FAIL;

   // __NR_sgetmask 68 sys_sgetmask()
   GO(__NR_sgetmask, "n/a");
 //SY(__NR_sgetmask); // (Not yet handled by Valgrind) FAIL;

   // __NR_ssetmask 69
   GO(__NR_ssetmask, "n/a");
 //SY(__NR_ssetmask); // (Not yet handled by Valgrind) FAIL;

   // __NR_setreuid 70
   GO(__NR_setreuid, "2s 0m");
   SY(__NR_setreuid, x0, x0); FAIL;

   // __NR_setregid 71
   GO(__NR_setregid, "2s 0m");
   SY(__NR_setregid, x0, x0); FAIL;

   // __NR_sigsuspend 72
   // XXX: how do you use this function?
   GO(__NR_sigsuspend, "ignore");
   // (I don't know how to test this...)

   // __NR_sigpending 73
   GO(__NR_sigpending, "1s 1m");
   SY(__NR_sigpending, x0); FAIL;

   // __NR_sethostname 74
   GO(__NR_sethostname, "n/a");
 //SY(__NR_sethostname); // (Not yet handled by Valgrind) FAIL;

   // __NR_setrlimit 75
   GO(__NR_setrlimit, "2s 1m");
   SY(__NR_setrlimit, x0, x0); FAIL;

   // __NR_getrlimit 76
   GO(__NR_getrlimit, "2s 1m");
   SY(__NR_getrlimit, x0, x0); FAIL;

   // __NR_getrusage 77
   GO(__NR_getrusage, "2s 1m");
   SY(__NR_getrusage, x0, x0); FAIL;

   // __NR_gettimeofday 78
   GO(__NR_gettimeofday, "2s 2m");
   SY(__NR_gettimeofday, x0, x0+1); FAIL;

   // __NR_settimeofday 79
   GO(__NR_settimeofday, "2s 2m");
   SY(__NR_settimeofday, x0, x0+1); FAIL;

   // __NR_getgroups 80
   GO(__NR_getgroups, "2s 1m");
   SY(__NR_getgroups, x0+1, x0+1); FAIL;

   // __NR_setgroups 81
   GO(__NR_setgroups, "2s 1m");
   SY(__NR_setgroups, x0+1, x0+1); FAIL;

   // __NR_select 82
   {
      long args[5] = { x0+8, x0+0xffffffee, x0+1, x0+1, x0+1 };
      GO(__NR_select, "1s 4m");
      SY(__NR_select, args+x0); FAIL;
   }

   // __NR_symlink 83
   GO(__NR_symlink, "2s 2m");
   SY(__NR_symlink, x0, x0); FAIL;

   // __NR_oldlstat 84
   GO(__NR_oldlstat, "n/a");
   // (obsolete, not handled by Valgrind)

   // __NR_readlink 85
   GO(__NR_readlink, "3s 2m");
   SY(__NR_readlink, x0+1, x0+1, x0+1); FAIL;

   // __NR_uselib 86
   GO(__NR_uselib, "n/a");
 //SY(__NR_uselib); // (Not yet handled by Valgrind) FAIL;

   // __NR_swapon 87
   GO(__NR_swapon, "n/a");
 //SY(__NR_swapon); // (Not yet handled by Valgrind) FAIL;

   // __NR_reboot 88
   GO(__NR_reboot, "n/a");
 //SY(__NR_reboot); // (Not yet handled by Valgrind) FAIL;

   // __NR_readdir 89
   GO(__NR_readdir, "n/a");
   // (superseded, not handled by Valgrind)

   // __NR_mmap 90
   {
      long args[6] = { x0, x0, x0, x0, x0-1, x0 };
      GO(__NR_mmap, "1s 0m");
      SY(__NR_mmap, args+x0); FAIL;