diff options
Diffstat (limited to 'test/tx/cmake/module_qemu/tests')
| -rw-r--r-- | test/tx/cmake/module_qemu/tests/harness_checks.c | 57 | ||||
| -rw-r--r-- | test/tx/cmake/module_qemu/tests/harness_checks.h | 45 | ||||
| -rw-r--r-- | test/tx/cmake/module_qemu/tests/module_services.c | 133 | ||||
| -rw-r--r-- | test/tx/cmake/module_qemu/tests/test_module_fault.c | 103 | ||||
| -rw-r--r-- | test/tx/cmake/module_qemu/tests/test_module_lifecycle.c | 76 | ||||
| -rw-r--r-- | test/tx/cmake/module_qemu/tests/test_module_privileged.c | 73 |
6 files changed, 487 insertions, 0 deletions
diff --git a/test/tx/cmake/module_qemu/tests/harness_checks.c b/test/tx/cmake/module_qemu/tests/harness_checks.c new file mode 100644 index 00000000..4b7cff05 --- /dev/null +++ b/test/tx/cmake/module_qemu/tests/harness_checks.c @@ -0,0 +1,57 @@ +/*************************************************************************** + * Copyright (c) 2026 Eclipse ThreadX contributors + * + * This program and the accompanying materials are made available under the + * terms of the MIT License which is available at + * https://opensource.org/licenses/MIT. + * + * AI Disclosure: This file was largely AI-generated by Claude Code (Opus 5.5). + * The AI-generated portions may be considered public domain (CC0-1.0) + * and not subject to the project's licence. The human contributor has + * reviewed and verified that the code is correct. + * + * SPDX-License-Identifier: MIT and CC0-1.0 + **************************************************************************/ + + +/**************************************************************************/ +/**************************************************************************/ +/** */ +/** ThreadX Test */ +/** */ +/** Module execution harness: checks shared by the test images */ +/** */ +/**************************************************************************/ +/**************************************************************************/ + +#include "harness_checks.h" + + +VOID harness_check_services(ULONG cycle) +{ + harness_expect("module start thread ran", MODULE_SHARED[MODULE_OUT_STARTED], MODULE_STARTED_MAGIC); + harness_expect("module saw the load cycle", MODULE_SHARED[MODULE_OUT_CYCLE_SEEN], cycle); + harness_expect("module object allocation", MODULE_SHARED[MODULE_OUT_OBJECT_STATUS], (ULONG) TX_SUCCESS); + harness_expect("module object creation and queue send", MODULE_SHARED[MODULE_OUT_CREATE_STATUS], (ULONG) TX_SUCCESS); + harness_expect("module worker received the message", MODULE_SHARED[MODULE_OUT_QUEUE_VALUE], MODULE_QUEUE_MESSAGE); + harness_expect("module worker ran once", MODULE_SHARED[MODULE_OUT_WORKER_RUNS], 1UL); + harness_expect("module semaphore get", MODULE_SHARED[MODULE_OUT_SEMAPHORE_STATUS], (ULONG) TX_SUCCESS); + harness_expect("module sleep lasted its ticks", + (ULONG) (MODULE_SHARED[MODULE_OUT_SLEEP_TICKS] >= EXPECTED_SLEEP_TICKS), (ULONG) TX_TRUE); +} + + +ULONG harness_module_pool_available(VOID) +{ +TX_NAME_CONST CHAR *name; +ULONG available; +ULONG fragments; +TX_THREAD *first_suspended; +ULONG suspended_count; +TX_BYTE_POOL *next_pool; + + available = 0UL; + (VOID) tx_byte_pool_info_get(&_txm_module_manager_byte_pool, &name, &available, &fragments, + &first_suspended, &suspended_count, &next_pool); + return(available); +} diff --git a/test/tx/cmake/module_qemu/tests/harness_checks.h b/test/tx/cmake/module_qemu/tests/harness_checks.h new file mode 100644 index 00000000..19ad68ae --- /dev/null +++ b/test/tx/cmake/module_qemu/tests/harness_checks.h @@ -0,0 +1,45 @@ +/*************************************************************************** + * Copyright (c) 2026 Eclipse ThreadX contributors + * + * This program and the accompanying materials are made available under the + * terms of the MIT License which is available at + * https://opensource.org/licenses/MIT. + * + * AI Disclosure: This file was largely AI-generated by Claude Code (Opus 5.5). + * The AI-generated portions may be considered public domain (CC0-1.0) + * and not subject to the project's licence. The human contributor has + * reviewed and verified that the code is correct. + * + * SPDX-License-Identifier: MIT and CC0-1.0 + **************************************************************************/ + + +/**************************************************************************/ +/**************************************************************************/ +/** */ +/** ThreadX Test */ +/** */ +/** Module execution harness: checks shared by the test images */ +/** */ +/**************************************************************************/ +/**************************************************************************/ + +#ifndef HARNESS_CHECKS_H +#define HARNESS_CHECKS_H + +#include "harness.h" +#include "module_shared.h" + +/* CONTROL.nPRIV: set when a thread runs unprivileged. */ +#define CONTROL_NPRIV ((ULONG) 1UL) + +/* The module's sleep must have lasted at least this many ticks. */ +#define EXPECTED_SLEEP_TICKS ((ULONG) 5UL) + +/* The kernel services part of the test module, common to every image. */ +VOID harness_check_services(ULONG cycle); + +/* Available bytes in the Module Manager's pool. */ +ULONG harness_module_pool_available(VOID); + +#endif diff --git a/test/tx/cmake/module_qemu/tests/module_services.c b/test/tx/cmake/module_qemu/tests/module_services.c new file mode 100644 index 00000000..e2fcce44 --- /dev/null +++ b/test/tx/cmake/module_qemu/tests/module_services.c @@ -0,0 +1,133 @@ +/*************************************************************************** + * Copyright (c) 2026 Eclipse ThreadX contributors + * + * This program and the accompanying materials are made available under the + * terms of the MIT License which is available at + * https://opensource.org/licenses/MIT. + * + * AI Disclosure: This file was largely AI-generated by Claude Code (Opus 5.5). + * The AI-generated portions may be considered public domain (CC0-1.0) + * and not subject to the project's licence. The human contributor has + * reviewed and verified that the code is correct. + * + * SPDX-License-Identifier: MIT and CC0-1.0 + **************************************************************************/ + + +/**************************************************************************/ +/**************************************************************************/ +/** */ +/** ThreadX Test */ +/** */ +/** Module execution harness: the test module */ +/** */ +/**************************************************************************/ +/**************************************************************************/ + +/* One module, built twice: once user mode with memory protection and once + privileged without it, from the same source; only the preamble's property + word differs. + + The start thread exercises the kernel through the module's dispatcher: it + allocates and creates a queue, a semaphore and a worker thread, hands the + worker a message, waits for the worker to signal back, sleeps on the timer, + and records what it saw in the area the manager shared with it. Then, if + the manager supplied the address of a word in kernel memory, it reads that + word. A protected module must fault on the read and never record its + result; a privileged one reads it. The done word is written last, so a + module that faults never sets it. + + MISRA C:2023 deviations, confined to this test module: Rule 1.2 and + Directive 4.3 (inline assembly to read CONTROL), and Rule 11.4 (the shared + area and the kernel word are integer addresses supplied at run time). */ + +#define TXM_MODULE +#include "txm_module.h" +#include "module_shared.h" + +#define WORKER_STACK_SIZE ((ULONG) 1024UL) +#define SLEEP_TICKS ((ULONG) 5UL) +#define WAIT_TICKS ((ULONG) 100UL) + +static TX_THREAD *worker_thread; +static TX_QUEUE *message_queue; +static TX_SEMAPHORE *done_semaphore; +static ULONG worker_stack[WORKER_STACK_SIZE / sizeof(ULONG)]; +static ULONG queue_storage[4]; + +VOID module_start(ULONG id); + + +/* Keep the first failing status rather than the last. */ +static VOID record_status(ULONG word, UINT status) +{ + if ((MODULE_SHARED[word] == (ULONG) TX_SUCCESS) && (status != TX_SUCCESS)) + { + MODULE_SHARED[word] = (ULONG) status; + } +} + + +static VOID worker_entry(ULONG thread_input) +{ +ULONG message; + + (VOID) thread_input; + + for (;;) + { + message = 0UL; + if (tx_queue_receive(message_queue, &message, TX_WAIT_FOREVER) == TX_SUCCESS) + { + MODULE_SHARED[MODULE_OUT_QUEUE_VALUE] = message; + MODULE_SHARED[MODULE_OUT_WORKER_RUNS] = MODULE_SHARED[MODULE_OUT_WORKER_RUNS] + 1UL; + (VOID) tx_semaphore_put(done_semaphore); + } + } +} + + +VOID module_start(ULONG id) +{ +ULONG message; +ULONG start_time; +ULONG control; +ULONG kernel_word; + + (VOID) id; + + MODULE_SHARED[MODULE_OUT_STARTED] = MODULE_STARTED_MAGIC; + MODULE_SHARED[MODULE_OUT_CYCLE_SEEN] = MODULE_SHARED[MODULE_IN_CYCLE]; + + __asm__ volatile ("mrs %0, control" : "=r"(control)); + MODULE_SHARED[MODULE_OUT_CONTROL] = control; + + record_status(MODULE_OUT_OBJECT_STATUS, txm_module_object_allocate((VOID **) &message_queue, sizeof(TX_QUEUE))); + record_status(MODULE_OUT_OBJECT_STATUS, txm_module_object_allocate((VOID **) &done_semaphore, sizeof(TX_SEMAPHORE))); + record_status(MODULE_OUT_OBJECT_STATUS, txm_module_object_allocate((VOID **) &worker_thread, sizeof(TX_THREAD))); + + record_status(MODULE_OUT_CREATE_STATUS, tx_queue_create(message_queue, "module queue", TX_1_ULONG, + queue_storage, sizeof(queue_storage))); + record_status(MODULE_OUT_CREATE_STATUS, tx_semaphore_create(done_semaphore, "module semaphore", 0UL)); + record_status(MODULE_OUT_CREATE_STATUS, tx_thread_create(worker_thread, "module worker", worker_entry, 0UL, + worker_stack, sizeof(worker_stack), + 2U, 2U, TX_NO_TIME_SLICE, TX_AUTO_START)); + + message = MODULE_QUEUE_MESSAGE; + record_status(MODULE_OUT_CREATE_STATUS, tx_queue_send(message_queue, &message, TX_NO_WAIT)); + MODULE_SHARED[MODULE_OUT_SEMAPHORE_STATUS] = (ULONG) tx_semaphore_get(done_semaphore, WAIT_TICKS); + + start_time = tx_time_get(); + (VOID) tx_thread_sleep(SLEEP_TICKS); + MODULE_SHARED[MODULE_OUT_SLEEP_TICKS] = tx_time_get() - start_time; + + kernel_word = MODULE_SHARED[MODULE_IN_KERNEL_WORD]; + if (kernel_word != 0UL) + { + MODULE_SHARED[MODULE_OUT_KERNEL_READ_TRY] = 1UL; + MODULE_SHARED[MODULE_OUT_KERNEL_VALUE] = *((volatile ULONG *) kernel_word); + MODULE_SHARED[MODULE_OUT_KERNEL_READ_DONE] = 1UL; + } + + MODULE_SHARED[MODULE_DONE] = MODULE_DONE_MAGIC; +} diff --git a/test/tx/cmake/module_qemu/tests/test_module_fault.c b/test/tx/cmake/module_qemu/tests/test_module_fault.c new file mode 100644 index 00000000..36bcdc9a --- /dev/null +++ b/test/tx/cmake/module_qemu/tests/test_module_fault.c @@ -0,0 +1,103 @@ +/*************************************************************************** + * Copyright (c) 2026 Eclipse ThreadX contributors + * + * This program and the accompanying materials are made available under the + * terms of the MIT License which is available at + * https://opensource.org/licenses/MIT. + * + * AI Disclosure: This file was largely AI-generated by Claude Code (Opus 5.5). + * The AI-generated portions may be considered public domain (CC0-1.0) + * and not subject to the project's licence. The human contributor has + * reviewed and verified that the code is correct. + * + * SPDX-License-Identifier: MIT and CC0-1.0 + **************************************************************************/ + + +/**************************************************************************/ +/**************************************************************************/ +/** */ +/** ThreadX Test */ +/** */ +/** Module execution harness: protected module memory fault */ +/** */ +/**************************************************************************/ +/**************************************************************************/ + +/* A user-mode, memory-protected module that reads a word of kernel memory must + take a MemManage fault on that read. The Module Manager must terminate the + faulting thread, report it to the application's fault notification with the + right module, thread and address, and still let the module be stopped and + unloaded. + + This image is also the harness's proof that the emulated MPU is enforcing at + all: if QEMU let the unprivileged read through, the module would record the + value and finish, and every check below would fail. */ + +#include "harness_checks.h" + +#define MODULE_WAIT_TICKS ((ULONG) 500UL) +#define PROTECTED_PROPERTIES ((ULONG) 0x02000007UL) /* GNU; user mode, memory protection, shared memory */ +#define KERNEL_WORD_VALUE ((ULONG) 0x6B65726EUL) + +/* CFSR: MemManage data access violation, with MMFAR valid. */ +#define CFSR_DACCVIOL ((ULONG) 0x02UL) +#define CFSR_MMARVALID ((ULONG) 0x80UL) + +extern UCHAR module_services_protected[]; + +static TXM_MODULE_INSTANCE test_module; +static volatile ULONG kernel_word = KERNEL_WORD_VALUE; + + +VOID harness_test(VOID) +{ +ULONG available_before; +ULONG start; + + harness_print("Module fault: protected module reads kernel memory\n"); + + available_before = harness_module_pool_available(); + + harness_shared_clear(); + MODULE_SHARED[MODULE_IN_CYCLE] = 1UL; + MODULE_SHARED[MODULE_IN_KERNEL_WORD] = (ULONG) &kernel_word; + + harness_expect("memory load", (ULONG) txm_module_manager_memory_load(&test_module, "services protected", + (VOID *) module_services_protected), + (ULONG) TX_SUCCESS); + harness_expect("module properties", test_module.txm_module_instance_property_flags, PROTECTED_PROPERTIES); + harness_expect("shared area grant", (ULONG) harness_shared_grant(&test_module), (ULONG) TX_SUCCESS); + harness_expect("module start", (ULONG) txm_module_manager_start(&test_module), (ULONG) TX_SUCCESS); + + start = tx_time_get(); + while ((harness_fault_count == 0UL) && ((tx_time_get() - start) < MODULE_WAIT_TICKS)) + { + tx_thread_sleep(1); + } + + /* The kernel services before the read still worked. */ + harness_check_services(1UL); + harness_expect("module ran unprivileged", MODULE_SHARED[MODULE_OUT_CONTROL] & CONTROL_NPRIV, CONTROL_NPRIV); + + /* The read was attempted and faulted. */ + harness_expect("kernel read attempted", MODULE_SHARED[MODULE_OUT_KERNEL_READ_TRY], 1UL); + harness_expect("kernel read did not complete", MODULE_SHARED[MODULE_OUT_KERNEL_READ_DONE], 0UL); + harness_expect("kernel value not disclosed", MODULE_SHARED[MODULE_OUT_KERNEL_VALUE], 0UL); + harness_expect("module did not finish", MODULE_SHARED[MODULE_DONE], 0UL); + + harness_expect("one memory fault reported", harness_fault_count, 1UL); + harness_expect("fault names the module", (ULONG) harness_fault_module, (ULONG) &test_module); + harness_expect("fault names the start thread", (ULONG) harness_fault_thread, + (ULONG) &test_module.txm_module_instance_start_stop_thread); + harness_expect("fault address is the kernel word", harness_fault_address, (ULONG) &kernel_word); + harness_expect("fault is a data access violation", + harness_fault_status & (CFSR_DACCVIOL | CFSR_MMARVALID), CFSR_DACCVIOL | CFSR_MMARVALID); + harness_expect("faulting thread terminated", + (ULONG) test_module.txm_module_instance_start_stop_thread.tx_thread_state, (ULONG) TX_TERMINATED); + harness_expect("kernel word unchanged", kernel_word, KERNEL_WORD_VALUE); + + harness_expect("module stop", (ULONG) txm_module_manager_stop(&test_module), (ULONG) TX_SUCCESS); + harness_expect("module unload", (ULONG) txm_module_manager_unload(&test_module), (ULONG) TX_SUCCESS); + harness_expect("module memory returned", harness_module_pool_available(), available_before); +} diff --git a/test/tx/cmake/module_qemu/tests/test_module_lifecycle.c b/test/tx/cmake/module_qemu/tests/test_module_lifecycle.c new file mode 100644 index 00000000..8c241e79 --- /dev/null +++ b/test/tx/cmake/module_qemu/tests/test_module_lifecycle.c @@ -0,0 +1,76 @@ +/*************************************************************************** + * Copyright (c) 2026 Eclipse ThreadX contributors + * + * This program and the accompanying materials are made available under the + * terms of the MIT License which is available at + * https://opensource.org/licenses/MIT. + * + * AI Disclosure: This file was largely AI-generated by Claude Code (Opus 5.5). + * The AI-generated portions may be considered public domain (CC0-1.0) + * and not subject to the project's licence. The human contributor has + * reviewed and verified that the code is correct. + * + * SPDX-License-Identifier: MIT and CC0-1.0 + **************************************************************************/ + + +/**************************************************************************/ +/**************************************************************************/ +/** */ +/** ThreadX Test */ +/** */ +/** Module execution harness: protected module lifecycle */ +/** */ +/**************************************************************************/ +/**************************************************************************/ + +/* A user-mode, memory-protected module is loaded, granted the shared area, + started, left to exercise the kernel through its dispatcher, stopped and + unloaded -- twice, so that the second cycle shows the first gave back what + it took. The module must run unprivileged and must not fault. */ + +#include "harness_checks.h" + +#define LIFECYCLE_CYCLES ((ULONG) 2UL) +#define MODULE_WAIT_TICKS ((ULONG) 500UL) +#define PROTECTED_PROPERTIES ((ULONG) 0x02000007UL) /* GNU; user mode, memory protection, shared memory */ + +extern UCHAR module_services_protected[]; + +static TXM_MODULE_INSTANCE test_module; + + +VOID harness_test(VOID) +{ +ULONG cycle; +ULONG available_before; + + harness_print("Module lifecycle: protected module, load/start/stop/unload twice\n"); + + available_before = harness_module_pool_available(); + + for (cycle = 1UL; cycle <= LIFECYCLE_CYCLES; cycle++) + { + harness_value("cycle", cycle); + + harness_shared_clear(); + MODULE_SHARED[MODULE_IN_CYCLE] = cycle; + + harness_expect("memory load", (ULONG) txm_module_manager_memory_load(&test_module, "services protected", + (VOID *) module_services_protected), + (ULONG) TX_SUCCESS); + harness_expect("module properties", test_module.txm_module_instance_property_flags, PROTECTED_PROPERTIES); + harness_expect("shared area grant", (ULONG) harness_shared_grant(&test_module), (ULONG) TX_SUCCESS); + harness_expect("module start", (ULONG) txm_module_manager_start(&test_module), (ULONG) TX_SUCCESS); + harness_expect("module finished", (ULONG) harness_wait_for_module(MODULE_WAIT_TICKS), (ULONG) TX_TRUE); + + harness_check_services(cycle); + harness_expect("module ran unprivileged", + MODULE_SHARED[MODULE_OUT_CONTROL] & CONTROL_NPRIV, CONTROL_NPRIV); + harness_expect("no memory fault", harness_fault_count, 0UL); + + harness_expect("module stop", (ULONG) txm_module_manager_stop(&test_module), (ULONG) TX_SUCCESS); + harness_expect("module unload", (ULONG) txm_module_manager_unload(&test_module), (ULONG) TX_SUCCESS); + harness_expect("module memory returned", harness_module_pool_available(), available_before); + } +} diff --git a/test/tx/cmake/module_qemu/tests/test_module_privileged.c b/test/tx/cmake/module_qemu/tests/test_module_privileged.c new file mode 100644 index 00000000..288117dd --- /dev/null +++ b/test/tx/cmake/module_qemu/tests/test_module_privileged.c @@ -0,0 +1,73 @@ +/*************************************************************************** + * Copyright (c) 2026 Eclipse ThreadX contributors + * + * This program and the accompanying materials are made available under the + * terms of the MIT License which is available at + * https://opensource.org/licenses/MIT. + * + * AI Disclosure: This file was largely AI-generated by Claude Code (Opus 5.5). + * The AI-generated portions may be considered public domain (CC0-1.0) + * and not subject to the project's licence. The human contributor has + * reviewed and verified that the code is correct. + * + * SPDX-License-Identifier: MIT and CC0-1.0 + **************************************************************************/ + + +/**************************************************************************/ +/**************************************************************************/ +/** */ +/** ThreadX Test */ +/** */ +/** Module execution harness: privileged, unprotected module */ +/** */ +/**************************************************************************/ +/**************************************************************************/ + +/* The same module built privileged and without memory protection. It runs + with the kernel's privileges, so the read that faults in the protected image + succeeds here, which shows that the fault in that image comes from the + module's protection and not from the address itself. Its kernel services + must work just as the protected module's do. */ + +#include "harness_checks.h" + +#define MODULE_WAIT_TICKS ((ULONG) 500UL) +#define PRIVILEGED_PROPERTIES ((ULONG) 0x02000000UL) /* GNU; privileged, no memory protection */ +#define KERNEL_WORD_VALUE ((ULONG) 0x6B65726EUL) + +extern UCHAR module_services_privileged[]; + +static TXM_MODULE_INSTANCE test_module; +static volatile ULONG kernel_word = KERNEL_WORD_VALUE; + + +VOID harness_test(VOID) +{ +ULONG available_before; + + harness_print("Module privileged: unprotected module reads kernel memory\n"); + + available_before = harness_module_pool_available(); + + harness_shared_clear(); + MODULE_SHARED[MODULE_IN_CYCLE] = 1UL; + MODULE_SHARED[MODULE_IN_KERNEL_WORD] = (ULONG) &kernel_word; + + harness_expect("memory load", (ULONG) txm_module_manager_memory_load(&test_module, "services privileged", + (VOID *) module_services_privileged), + (ULONG) TX_SUCCESS); + harness_expect("module properties", test_module.txm_module_instance_property_flags, PRIVILEGED_PROPERTIES); + harness_expect("module start", (ULONG) txm_module_manager_start(&test_module), (ULONG) TX_SUCCESS); + harness_expect("module finished", (ULONG) harness_wait_for_module(MODULE_WAIT_TICKS), (ULONG) TX_TRUE); + + harness_check_services(1UL); + harness_expect("module ran privileged", MODULE_SHARED[MODULE_OUT_CONTROL] & CONTROL_NPRIV, 0UL); + harness_expect("kernel read completed", MODULE_SHARED[MODULE_OUT_KERNEL_READ_DONE], 1UL); + harness_expect("kernel value read", MODULE_SHARED[MODULE_OUT_KERNEL_VALUE], KERNEL_WORD_VALUE); + harness_expect("no memory fault", harness_fault_count, 0UL); + + harness_expect("module stop", (ULONG) txm_module_manager_stop(&test_module), (ULONG) TX_SUCCESS); + harness_expect("module unload", (ULONG) txm_module_manager_unload(&test_module), (ULONG) TX_SUCCESS); + harness_expect("module memory returned", harness_module_pool_available(), available_before); +} |