diff options
Diffstat (limited to 'test/tx/cmake/module_qemu/tests/test_module_fault.c')
| -rw-r--r-- | test/tx/cmake/module_qemu/tests/test_module_fault.c | 103 |
1 files changed, 103 insertions, 0 deletions
diff --git a/test/tx/cmake/module_qemu/tests/test_module_fault.c b/test/tx/cmake/module_qemu/tests/test_module_fault.c new file mode 100644 index 00000000..36bcdc9a --- /dev/null +++ b/test/tx/cmake/module_qemu/tests/test_module_fault.c @@ -0,0 +1,103 @@ +/*************************************************************************** + * Copyright (c) 2026 Eclipse ThreadX contributors + * + * This program and the accompanying materials are made available under the + * terms of the MIT License which is available at + * https://opensource.org/licenses/MIT. + * + * AI Disclosure: This file was largely AI-generated by Claude Code (Opus 5.5). + * The AI-generated portions may be considered public domain (CC0-1.0) + * and not subject to the project's licence. The human contributor has + * reviewed and verified that the code is correct. + * + * SPDX-License-Identifier: MIT and CC0-1.0 + **************************************************************************/ + + +/**************************************************************************/ +/**************************************************************************/ +/** */ +/** ThreadX Test */ +/** */ +/** Module execution harness: protected module memory fault */ +/** */ +/**************************************************************************/ +/**************************************************************************/ + +/* A user-mode, memory-protected module that reads a word of kernel memory must + take a MemManage fault on that read. The Module Manager must terminate the + faulting thread, report it to the application's fault notification with the + right module, thread and address, and still let the module be stopped and + unloaded. + + This image is also the harness's proof that the emulated MPU is enforcing at + all: if QEMU let the unprivileged read through, the module would record the + value and finish, and every check below would fail. */ + +#include "harness_checks.h" + +#define MODULE_WAIT_TICKS ((ULONG) 500UL) +#define PROTECTED_PROPERTIES ((ULONG) 0x02000007UL) /* GNU; user mode, memory protection, shared memory */ +#define KERNEL_WORD_VALUE ((ULONG) 0x6B65726EUL) + +/* CFSR: MemManage data access violation, with MMFAR valid. */ +#define CFSR_DACCVIOL ((ULONG) 0x02UL) +#define CFSR_MMARVALID ((ULONG) 0x80UL) + +extern UCHAR module_services_protected[]; + +static TXM_MODULE_INSTANCE test_module; +static volatile ULONG kernel_word = KERNEL_WORD_VALUE; + + +VOID harness_test(VOID) +{ +ULONG available_before; +ULONG start; + + harness_print("Module fault: protected module reads kernel memory\n"); + + available_before = harness_module_pool_available(); + + harness_shared_clear(); + MODULE_SHARED[MODULE_IN_CYCLE] = 1UL; + MODULE_SHARED[MODULE_IN_KERNEL_WORD] = (ULONG) &kernel_word; + + harness_expect("memory load", (ULONG) txm_module_manager_memory_load(&test_module, "services protected", + (VOID *) module_services_protected), + (ULONG) TX_SUCCESS); + harness_expect("module properties", test_module.txm_module_instance_property_flags, PROTECTED_PROPERTIES); + harness_expect("shared area grant", (ULONG) harness_shared_grant(&test_module), (ULONG) TX_SUCCESS); + harness_expect("module start", (ULONG) txm_module_manager_start(&test_module), (ULONG) TX_SUCCESS); + + start = tx_time_get(); + while ((harness_fault_count == 0UL) && ((tx_time_get() - start) < MODULE_WAIT_TICKS)) + { + tx_thread_sleep(1); + } + + /* The kernel services before the read still worked. */ + harness_check_services(1UL); + harness_expect("module ran unprivileged", MODULE_SHARED[MODULE_OUT_CONTROL] & CONTROL_NPRIV, CONTROL_NPRIV); + + /* The read was attempted and faulted. */ + harness_expect("kernel read attempted", MODULE_SHARED[MODULE_OUT_KERNEL_READ_TRY], 1UL); + harness_expect("kernel read did not complete", MODULE_SHARED[MODULE_OUT_KERNEL_READ_DONE], 0UL); + harness_expect("kernel value not disclosed", MODULE_SHARED[MODULE_OUT_KERNEL_VALUE], 0UL); + harness_expect("module did not finish", MODULE_SHARED[MODULE_DONE], 0UL); + + harness_expect("one memory fault reported", harness_fault_count, 1UL); + harness_expect("fault names the module", (ULONG) harness_fault_module, (ULONG) &test_module); + harness_expect("fault names the start thread", (ULONG) harness_fault_thread, + (ULONG) &test_module.txm_module_instance_start_stop_thread); + harness_expect("fault address is the kernel word", harness_fault_address, (ULONG) &kernel_word); + harness_expect("fault is a data access violation", + harness_fault_status & (CFSR_DACCVIOL | CFSR_MMARVALID), CFSR_DACCVIOL | CFSR_MMARVALID); + harness_expect("faulting thread terminated", + (ULONG) test_module.txm_module_instance_start_stop_thread.tx_thread_state, (ULONG) TX_TERMINATED); + harness_expect("kernel word unchanged", kernel_word, KERNEL_WORD_VALUE); + + harness_expect("module stop", (ULONG) txm_module_manager_stop(&test_module), (ULONG) TX_SUCCESS); + harness_expect("module unload", (ULONG) txm_module_manager_unload(&test_module), (ULONG) TX_SUCCESS); + harness_expect("module memory returned", harness_module_pool_available(), available_before); +} |