diff options
Diffstat (limited to 'test/tx')
17 files changed, 1579 insertions, 0 deletions
diff --git a/test/tx/cmake/module_qemu/CMakeLists.txt b/test/tx/cmake/module_qemu/CMakeLists.txt new file mode 100644 index 00000000..bbf7c74c --- /dev/null +++ b/test/tx/cmake/module_qemu/CMakeLists.txt @@ -0,0 +1,224 @@ +# Copyright (c) 2026 Eclipse ThreadX contributors +# +# This program and the accompanying materials are made available under the +# terms of the MIT License which is available at +# https://opensource.org/licenses/MIT. +# +# AI Disclosure: This file was largely AI-generated by Claude Code (Opus 5.5). +# The AI-generated portions may be considered public domain (CC0-1.0) +# and not subject to the project's licence. The human contributor has +# reviewed and verified that the code is correct. +# +# SPDX-License-Identifier: MIT and CC0-1.0 + +# Module execution harness. +# +# Builds a module manager image per test, each embedding the modules it loads, +# for one Cortex-M module port, and runs every image on QEMU's MPS2 board for +# that core, asserting the result each image reports over semihosting. +# +# Why this exists: the host tests under test/tx/module_manager compile a few +# module manager sources against stubs, and nothing else in CI runs a Cortex-M +# module port at all. A module's start-up, its kernel calls through the +# supervisor call, the MPU programming on every context switch and the fault +# path that terminates a misbehaving module are only exercised by executing +# them. This is the per-architecture part of the module test strategy; the +# portable module manager code is meant to be covered on the host. +# +# Its own top-level project, like test/tx/cmake/riscv, because it cross-builds +# with a bare-metal toolchain and runs under an emulator, which the host suite +# beside it does neither of. +# +# Configure once per port: +# +# cmake -S test/tx/cmake/module_qemu -B build/module_qemu_m3 -G Ninja \ +# -DCMAKE_TOOLCHAIN_FILE=$PWD/test/tx/cmake/module_qemu/arm-none-eabi-qemu.cmake \ +# -DMODULE_QEMU_PORT=cortex_m3 +# cmake --build build/module_qemu_m3 +# ctest --test-dir build/module_qemu_m3 --output-on-failure +# +# MODULE_QEMU_PORT is cortex_m3 (QEMU mps2-an385) or cortex_m4 (mps2-an386, +# built for its FPU with the hard-float ABI). + +cmake_minimum_required(VERSION 3.20 FATAL_ERROR) + +project(threadx_module_qemu LANGUAGES C ASM) + +set(MODULE_QEMU_PORT "cortex_m3" CACHE STRING "Cortex-M module port to build and run") +set_property(CACHE MODULE_QEMU_PORT PROPERTY STRINGS cortex_m3 cortex_m4) + +if(MODULE_QEMU_PORT STREQUAL "cortex_m3") + set(PORT_CPU_FLAGS -mcpu=cortex-m3 -mthumb) + set(QEMU_MACHINE mps2-an385) +elseif(MODULE_QEMU_PORT STREQUAL "cortex_m4") + set(PORT_CPU_FLAGS -mcpu=cortex-m4 -mthumb -mfpu=fpv4-sp-d16 -mfloat-abi=hard) + set(QEMU_MACHINE mps2-an386) +else() + message(FATAL_ERROR "MODULE_QEMU_PORT must be cortex_m3 or cortex_m4, not '${MODULE_QEMU_PORT}'") +endif() + +set(REPO_ROOT ${CMAKE_CURRENT_LIST_DIR}/../../../..) +set(PORT_DIR ${REPO_ROOT}/ports_module/${MODULE_QEMU_PORT}/gnu) +set(HARNESS_SRC ${CMAKE_CURRENT_LIST_DIR}/src) +set(HARNESS_TESTS ${CMAKE_CURRENT_LIST_DIR}/tests) + +message(STATUS "Module port: ${MODULE_QEMU_PORT}, QEMU machine: ${QEMU_MACHINE}") + +add_compile_options(${PORT_CPU_FLAGS} -g -O0 -ffunction-sections -fdata-sections) +add_link_options(${PORT_CPU_FLAGS}) + +# --------------------------------------------------------------------------- +# The kernel and the Module Manager, built with the module port's headers. +# +# One library, not the threadx library plus the manager: the module port's +# tx_port.h adds the owning module to the kernel's control blocks, so a kernel +# built against the base port and a manager built against this one would +# disagree about every object while linking without complaint. tx_misra.c is +# left out because nothing here builds with TX_MISRA_ENABLE. +# --------------------------------------------------------------------------- + +file(GLOB TX_COMMON_SRC ${REPO_ROOT}/common/src/*.c) +list(FILTER TX_COMMON_SRC EXCLUDE REGEX ".*/tx_misra\\.c$") +file(GLOB TXM_PORT_SRC + ${PORT_DIR}/module_manager/src/*.S + ${PORT_DIR}/module_manager/src/*.s + ${PORT_DIR}/module_manager/src/*.c) +file(GLOB TXM_MANAGER_SRC ${REPO_ROOT}/common_modules/module_manager/src/*.c) + +add_library(threadx_module STATIC ${TX_COMMON_SRC} ${TXM_PORT_SRC} ${TXM_MANAGER_SRC}) +target_include_directories(threadx_module PUBLIC + ${PORT_DIR}/inc + ${REPO_ROOT}/common/inc + ${REPO_ROOT}/common_modules/inc + ${REPO_ROOT}/common_modules/module_manager/inc) + +# --------------------------------------------------------------------------- +# The module-side library: the API shims that run inside a module. It belongs +# to the module images only; linked into a manager it would redirect the +# manager's own service calls into a module. +# +# Position independent, as everything in a module must be: +# -fpic / -fpie data references go through the GOT +# -msingle-pic-base r9 is the GOT base, set by the manager's +# thread stack build +# -mno-pic-data-is-text-relative data is allocated from the manager's pool, +# not at a fixed offset from the code +# -fno-plt no procedure linkage table to populate +# --------------------------------------------------------------------------- + +set(MODULE_PIC_FLAGS -fno-plt -mno-pic-data-is-text-relative -msingle-pic-base) + +file(GLOB TXM_MODULE_LIB_SRC + ${REPO_ROOT}/common_modules/module_lib/src/*.c + ${PORT_DIR}/module_lib/src/*.c) + +add_library(txm_module_lib STATIC ${TXM_MODULE_LIB_SRC}) +target_include_directories(txm_module_lib PUBLIC + ${PORT_DIR}/inc + ${REPO_ROOT}/common/inc + ${REPO_ROOT}/common_modules/inc) +target_compile_options(txm_module_lib PRIVATE -fpic ${MODULE_PIC_FLAGS}) + +# --------------------------------------------------------------------------- +# A test module: one source, built with a given preamble property word, linked +# with the port's module linker script, and reduced to the raw image a manager +# embeds. The script defines the code and data sizes the preamble reports. +# --------------------------------------------------------------------------- + +function(module_qemu_add_module name source properties) + add_executable(${name}.elf + ${HARNESS_SRC}/module_preamble.S + ${PORT_DIR}/example_build/gcc_setup.s + ${source}) + target_include_directories(${name}.elf PRIVATE ${HARNESS_SRC}) + target_compile_definitions(${name}.elf PRIVATE TEST_MODULE_PROPERTIES=${properties}) + target_compile_options(${name}.elf PRIVATE -fpie ${MODULE_PIC_FLAGS}) + target_link_libraries(${name}.elf PRIVATE txm_module_lib) + target_link_options(${name}.elf PRIVATE + -T${PORT_DIR}/example_build/sample_threadx_module.ld + -nostartfiles + -nostdlib + -Wl,-pie + -Wl,--no-dynamic-linker + -Wl,-e,_txm_module_thread_shell_entry + -Wl,--no-warn-rwx-segments + -Wl,-Map=${name}.map) + set_target_properties(${name}.elf PROPERTIES + LINK_DEPENDS ${PORT_DIR}/example_build/sample_threadx_module.ld) + + set(bin ${CMAKE_CURRENT_BINARY_DIR}/${name}.bin) + add_custom_command( + OUTPUT ${bin} + COMMAND ${CMAKE_OBJCOPY} -O binary $<TARGET_FILE:${name}.elf> ${bin} + DEPENDS ${name}.elf + COMMENT "Converting ${name} to a raw module image" + VERBATIM) + add_custom_target(${name}_bin DEPENDS ${bin}) + + # The blob that embeds the image in a manager, as bytes, under the module's + # name as its symbol. + set(BLOB_SYMBOL ${name}) + set(BLOB_FILE ${bin}) + configure_file(${HARNESS_SRC}/module_blob.S.in ${CMAKE_CURRENT_BINARY_DIR}/${name}_blob.S @ONLY) + set_source_files_properties(${CMAKE_CURRENT_BINARY_DIR}/${name}_blob.S PROPERTIES OBJECT_DEPENDS ${bin}) +endfunction() + +# GNU compiler ID in bits 31-24; bit 0 user mode, bit 1 memory protection, +# bit 2 shared memory access. +module_qemu_add_module(module_services_protected ${HARNESS_TESTS}/module_services.c 0x02000007) +module_qemu_add_module(module_services_privileged ${HARNESS_TESTS}/module_services.c 0x02000000) + +# --------------------------------------------------------------------------- +# The manager images, one per test, and the CTest entries that run them. +# --------------------------------------------------------------------------- + +find_package(Python3 COMPONENTS Interpreter) +find_program(QEMU_SYSTEM_ARM qemu-system-arm) + +enable_testing() + +function(module_qemu_add_test name test_source) + set(blobs ${ARGN}) + set(blob_sources "") + foreach(blob IN LISTS blobs) + list(APPEND blob_sources ${CMAKE_CURRENT_BINARY_DIR}/${blob}_blob.S) + endforeach() + + add_executable(${name}.elf + ${HARNESS_SRC}/startup.S + ${HARNESS_SRC}/tx_initialize_low_level.S + ${HARNESS_SRC}/harness.c + ${HARNESS_TESTS}/harness_checks.c + ${test_source} + ${blob_sources}) + target_include_directories(${name}.elf PRIVATE ${HARNESS_SRC} ${HARNESS_TESTS}) + target_link_libraries(${name}.elf PRIVATE threadx_module) + target_link_options(${name}.elf PRIVATE + -T${HARNESS_SRC}/manager.ld + -nostartfiles + --specs=nano.specs + --specs=nosys.specs + -Wl,--gc-sections + -Wl,--no-warn-rwx-segments + -Wl,-Map=${name}.map) + set_target_properties(${name}.elf PROPERTIES LINK_DEPENDS ${HARNESS_SRC}/manager.ld) + foreach(blob IN LISTS blobs) + add_dependencies(${name}.elf ${blob}_bin) + endforeach() + + if(Python3_FOUND AND QEMU_SYSTEM_ARM) + add_test(NAME ${MODULE_QEMU_PORT}::${name} + COMMAND ${Python3_EXECUTABLE} ${CMAKE_CURRENT_LIST_DIR}/run_qemu_test.py + --qemu ${QEMU_SYSTEM_ARM} + --machine ${QEMU_MACHINE} + --elf $<TARGET_FILE:${name}.elf>) + endif() +endfunction() + +module_qemu_add_test(test_module_lifecycle ${HARNESS_TESTS}/test_module_lifecycle.c module_services_protected) +module_qemu_add_test(test_module_fault ${HARNESS_TESTS}/test_module_fault.c module_services_protected) +module_qemu_add_test(test_module_privileged ${HARNESS_TESTS}/test_module_privileged.c module_services_privileged) + +if(NOT (Python3_FOUND AND QEMU_SYSTEM_ARM)) + message(STATUS "qemu-system-arm or Python 3 not found; the images build but no tests are registered.") +endif() diff --git a/test/tx/cmake/module_qemu/arm-none-eabi-qemu.cmake b/test/tx/cmake/module_qemu/arm-none-eabi-qemu.cmake new file mode 100644 index 00000000..a543c9d4 --- /dev/null +++ b/test/tx/cmake/module_qemu/arm-none-eabi-qemu.cmake @@ -0,0 +1,37 @@ +# Copyright (c) 2026 Eclipse ThreadX contributors +# +# This program and the accompanying materials are made available under the +# terms of the MIT License which is available at +# https://opensource.org/licenses/MIT. +# +# AI Disclosure: This file was largely AI-generated by Claude Code (Opus 5.5). +# The AI-generated portions may be considered public domain (CC0-1.0) +# and not subject to the project's licence. The human contributor has +# reviewed and verified that the code is correct. +# +# SPDX-License-Identifier: MIT and CC0-1.0 + +# Toolchain for the module execution harness. +# +# Deliberately not cmake/cortex_m3.cmake or cmake/cortex_m4.cmake. Those add +# -mlong-calls to every C file, and under -fpic that routes every call in a +# module through its GOT, including the shell entry's call to the function that +# fills the GOT in; and they leave the floating-point unit off, which the +# Cortex-M4 module port needs on to exercise its lazy-stacking paths. The CPU +# and FPU flags are chosen per port in CMakeLists.txt instead. + +set(CMAKE_SYSTEM_NAME Generic) +set(CMAKE_SYSTEM_PROCESSOR arm) + +set(CMAKE_C_COMPILER arm-none-eabi-gcc) +set(CMAKE_ASM_COMPILER arm-none-eabi-gcc) +set(CMAKE_OBJCOPY arm-none-eabi-objcopy CACHE FILEPATH "objcopy") + +set(CMAKE_FIND_ROOT_PATH_MODE_PROGRAM NEVER) +set(CMAKE_FIND_ROOT_PATH_MODE_LIBRARY ONLY) +set(CMAKE_FIND_ROOT_PATH_MODE_INCLUDE ONLY) +set(CMAKE_FIND_ROOT_PATH_MODE_PACKAGE ONLY) + +# Compiler checks build a static library, so they need no startup code or +# linker script. +set(CMAKE_TRY_COMPILE_TARGET_TYPE STATIC_LIBRARY) diff --git a/test/tx/cmake/module_qemu/run_qemu_test.py b/test/tx/cmake/module_qemu/run_qemu_test.py new file mode 100755 index 00000000..b2533c5d --- /dev/null +++ b/test/tx/cmake/module_qemu/run_qemu_test.py @@ -0,0 +1,105 @@ +#!/usr/bin/env python3 +# +# Copyright (c) 2026 Eclipse ThreadX contributors +# +# This program and the accompanying materials are made available under the +# terms of the MIT License which is available at +# https://opensource.org/licenses/MIT. +# +# AI Disclosure: This file was largely AI-generated by Claude Code (Opus 5.5). +# The AI-generated portions may be considered public domain (CC0-1.0) +# and not subject to the project's licence. The human contributor has +# reviewed and verified that the code is correct. +# +# SPDX-License-Identifier: MIT and CC0-1.0 +# +"""Run a module harness image on QEMU and assert its result. + +Modelled on the Cortex-R52 FVP runner. Every image reports through Arm +semihosting and ends the simulation itself with SYS_EXIT, so the runner only +launches QEMU, captures what the image printed, and judges it. Both the +result line and QEMU's exit status must say the image passed. + +A missing result line is a failure, never a pass: a hang, or a crash before +the first check, must not be able to look like success. +""" + +import argparse +import subprocess +import sys + +PASS_MARK = "ALL CHECKS PASSED" +FAIL_MARK = "RESULT: FAILED" +FAULT_MARK = "[FAULT]" + + +def as_text(stream): + """Normalise a captured stream to str; a timeout hands back bytes.""" + if stream is None: + return "" + if isinstance(stream, bytes): + return stream.decode(errors="replace") + return stream + + +def run(qemu, machine, elf, timeout): + command = [ + qemu, + "-M", machine, + "-nographic", + "-monitor", "none", + "-serial", "none", + "-semihosting-config", "enable=on,target=native", + "-kernel", elf, + ] + + print("Running:", " ".join(command), flush=True) + + try: + completed = subprocess.run( + command, capture_output=True, text=True, timeout=timeout + ) + except subprocess.TimeoutExpired as expired: + print(as_text(expired.stdout) + as_text(expired.stderr)) + print( + f"FAIL: QEMU did not terminate within {timeout}s. Every image is " + "expected to exit through semihosting SYS_EXIT, so this is a hang.", + file=sys.stderr, + ) + return 1 + + output = as_text(completed.stdout) + as_text(completed.stderr) + print(output) + + if FAULT_MARK in output: + print("FAIL: the image reported an unexpected exception.", file=sys.stderr) + return 1 + if FAIL_MARK in output: + print("FAIL: the image reported failing checks.", file=sys.stderr) + return 1 + if PASS_MARK not in output: + print("FAIL: the image printed no result line.", file=sys.stderr) + return 1 + if completed.returncode != 0: + print( + f"FAIL: the image reported success but QEMU exited with " + f"{completed.returncode}.", + file=sys.stderr, + ) + return 1 + + return 0 + + +def main(): + parser = argparse.ArgumentParser(description=__doc__) + parser.add_argument("--qemu", required=True, help="qemu-system-arm executable") + parser.add_argument("--machine", required=True, help="QEMU machine, e.g. mps2-an385") + parser.add_argument("--elf", required=True, help="image to run") + parser.add_argument("--timeout", type=int, default=60, help="seconds before a hang is declared") + args = parser.parse_args() + return run(args.qemu, args.machine, args.elf, args.timeout) + + +if __name__ == "__main__": + sys.exit(main()) diff --git a/test/tx/cmake/module_qemu/src/harness.c b/test/tx/cmake/module_qemu/src/harness.c new file mode 100644 index 00000000..1285de13 --- /dev/null +++ b/test/tx/cmake/module_qemu/src/harness.c @@ -0,0 +1,252 @@ +/*************************************************************************** + * Copyright (c) 2026 Eclipse ThreadX contributors + * + * This program and the accompanying materials are made available under the + * terms of the MIT License which is available at + * https://opensource.org/licenses/MIT. + * + * AI Disclosure: This file was largely AI-generated by Claude Code (Opus 5.5). + * The AI-generated portions may be considered public domain (CC0-1.0) + * and not subject to the project's licence. The human contributor has + * reviewed and verified that the code is correct. + * + * SPDX-License-Identifier: MIT and CC0-1.0 + **************************************************************************/ + + +/**************************************************************************/ +/**************************************************************************/ +/** */ +/** ThreadX Test */ +/** */ +/** Module execution harness: manager side */ +/** */ +/**************************************************************************/ +/**************************************************************************/ + +/* The part of every manager image that is not the test: startup into ThreadX, + the Module Manager's memory, the fault notification, and reporting. + + Output and exit go through Arm semihosting rather than the board's UART, so + the same image reports identically on any QEMU machine with semihosting + enabled, and the simulation's exit status carries the verdict as well as the + result line the runner matches. Semihosting is only ever called from the + privileged manager thread or from a fault handler, never from a module. + + MISRA C:2023 deviations, confined to this test scaffolding: Rule 1.2 and + Directive 4.3 (inline assembly for the semihosting trap), and Rule 11.4 + (integer addresses of the shared area and of semihosting arguments). */ + +#include "harness.h" +#include "module_shared.h" + +#define HARNESS_STACK_SIZE ((ULONG) 2048UL) + +#define SEMIHOSTING_SYS_WRITE0 ((ULONG) 0x04UL) +#define SEMIHOSTING_SYS_EXIT ((ULONG) 0x18UL) +#define SEMIHOSTING_EXIT_SUCCESS ((ULONG) 0x20026UL) /* ADP_Stopped_ApplicationExit */ +#define SEMIHOSTING_EXIT_FAILURE ((ULONG) 0x20023UL) /* ADP_Stopped_RunTimeErrorUnknown */ + +UCHAR harness_module_memory[HARNESS_MODULE_MEMORY_SIZE]; +UCHAR harness_object_memory[HARNESS_OBJECT_MEMORY_SIZE]; + +volatile ULONG harness_fault_count; +TX_THREAD * volatile harness_fault_thread; +TXM_MODULE_INSTANCE * volatile harness_fault_module; +volatile ULONG harness_fault_address; +volatile ULONG harness_fault_status; + +static TX_THREAD harness_thread; +static ULONG harness_checks; +static ULONG harness_failures; + +extern TXM_MODULE_MANAGER_MEMORY_FAULT_INFO _txm_module_manager_memory_fault_info; + +int main(void); +VOID harness_hard_fault(VOID); +VOID harness_unexpected_exception(VOID); + + +/* Issue a semihosting call. */ +static ULONG harness_semihost(ULONG operation, ULONG parameter) +{ +register ULONG r0 __asm__("r0") = operation; +register ULONG r1 __asm__("r1") = parameter; + + __asm__ volatile ("bkpt 0xab" : "+r"(r0) : "r"(r1) : "memory"); + return(r0); +} + + +VOID harness_print(const CHAR *text) +{ + (VOID) harness_semihost(SEMIHOSTING_SYS_WRITE0, (ULONG) text); +} + + +VOID harness_value(const CHAR *label, ULONG value) +{ +static const CHAR digits[] = "0123456789abcdef"; +CHAR text[11]; +UINT index; + + text[0] = '0'; + text[1] = 'x'; + for (index = 0U; index < 8U; index++) + { + text[2U + index] = digits[(value >> (28U - (index * 4U))) & 0xFUL]; + } + text[10] = '\0'; + + harness_print(label); + harness_print(" = "); + harness_print(text); + harness_print("\n"); +} + + +VOID harness_expect(const CHAR *description, ULONG actual, ULONG expected) +{ + harness_checks++; + + if (actual != expected) + { + harness_failures++; + harness_print("FAIL: "); + harness_print(description); + harness_print("\n"); + harness_value(" expected", expected); + harness_value(" actual ", actual); + } +} + + +VOID harness_finish(VOID) +{ + harness_value("checks", harness_checks); + harness_value("failures", harness_failures); + + if ((harness_failures == 0UL) && (harness_checks != 0UL)) + { + harness_print("ALL CHECKS PASSED\n"); + (VOID) harness_semihost(SEMIHOSTING_SYS_EXIT, SEMIHOSTING_EXIT_SUCCESS); + } + else + { + harness_print("RESULT: FAILED\n"); + (VOID) harness_semihost(SEMIHOSTING_SYS_EXIT, SEMIHOSTING_EXIT_FAILURE); + } + + for (;;) + { + } +} + + +/* A fault the module port does not handle is a harness failure, whatever the + test was doing. */ +VOID harness_hard_fault(VOID) +{ + harness_print("[FAULT] HardFault\n"); + harness_print("RESULT: FAILED\n"); + (VOID) harness_semihost(SEMIHOSTING_SYS_EXIT, SEMIHOSTING_EXIT_FAILURE); + for (;;) + { + } +} + + +VOID harness_unexpected_exception(VOID) +{ + harness_print("[FAULT] unexpected exception\n"); + harness_print("RESULT: FAILED\n"); + (VOID) harness_semihost(SEMIHOSTING_SYS_EXIT, SEMIHOSTING_EXIT_FAILURE); + for (;;) + { + } +} + + +/* Called by the Module Manager after it has terminated a faulting module thread. */ +VOID harness_fault_notify(TX_THREAD *thread_ptr, TXM_MODULE_INSTANCE *module_instance) +{ + harness_fault_thread = thread_ptr; + harness_fault_module = module_instance; + harness_fault_address = _txm_module_manager_memory_fault_info.txm_module_manager_memory_fault_info_mmfar; + harness_fault_status = _txm_module_manager_memory_fault_info.txm_module_manager_memory_fault_info_cfsr; + harness_fault_count++; +} + + +VOID harness_shared_clear(VOID) +{ +ULONG index; + + for (index = 0UL; index < MODULE_SHARED_WORDS; index++) + { + MODULE_SHARED[index] = 0UL; + } +} + + +UINT harness_shared_grant(TXM_MODULE_INSTANCE *module_instance) +{ + return(txm_module_manager_external_memory_enable(module_instance, (VOID *) MODULE_SHARED_BASE, + MODULE_SHARED_SIZE, TXM_MODULE_MANAGER_SHARED_ATTRIBUTE_WRITE)); +} + + +UINT harness_wait_for_module(ULONG limit_ticks) +{ +ULONG start; +UINT done; + + start = tx_time_get(); + done = TX_FALSE; + while ((done == TX_FALSE) && ((tx_time_get() - start) < limit_ticks)) + { + if (MODULE_SHARED[MODULE_DONE] == MODULE_DONE_MAGIC) + { + done = TX_TRUE; + } + else + { + tx_thread_sleep(1); + } + } + + return(done); +} + + +static VOID harness_thread_entry(ULONG thread_input) +{ + (VOID) thread_input; + + harness_expect("txm_module_manager_initialize", + (ULONG) txm_module_manager_initialize((VOID *) harness_module_memory, HARNESS_MODULE_MEMORY_SIZE), + (ULONG) TX_SUCCESS); + harness_expect("txm_module_manager_object_pool_create", + (ULONG) txm_module_manager_object_pool_create(harness_object_memory, HARNESS_OBJECT_MEMORY_SIZE), + (ULONG) TX_SUCCESS); + harness_expect("txm_module_manager_memory_fault_notify", + (ULONG) txm_module_manager_memory_fault_notify(harness_fault_notify), + (ULONG) TX_SUCCESS); + + harness_test(); + harness_finish(); +} + + +int main(void) +{ + tx_kernel_enter(); + return(0); +} + + +VOID tx_application_define(VOID *first_unused_memory) +{ + (VOID) tx_thread_create(&harness_thread, "Module Manager Thread", harness_thread_entry, 0UL, + first_unused_memory, HARNESS_STACK_SIZE, 1U, 1U, TX_NO_TIME_SLICE, TX_AUTO_START); +} diff --git a/test/tx/cmake/module_qemu/src/harness.h b/test/tx/cmake/module_qemu/src/harness.h new file mode 100644 index 00000000..9145531b --- /dev/null +++ b/test/tx/cmake/module_qemu/src/harness.h @@ -0,0 +1,70 @@ +/*************************************************************************** + * Copyright (c) 2026 Eclipse ThreadX contributors + * + * This program and the accompanying materials are made available under the + * terms of the MIT License which is available at + * https://opensource.org/licenses/MIT. + * + * AI Disclosure: This file was largely AI-generated by Claude Code (Opus 5.5). + * The AI-generated portions may be considered public domain (CC0-1.0) + * and not subject to the project's licence. The human contributor has + * reviewed and verified that the code is correct. + * + * SPDX-License-Identifier: MIT and CC0-1.0 + **************************************************************************/ + + +/**************************************************************************/ +/**************************************************************************/ +/** */ +/** ThreadX Test */ +/** */ +/** Module execution harness: manager-side reporting */ +/** */ +/**************************************************************************/ +/**************************************************************************/ + +#ifndef HARNESS_H +#define HARNESS_H + +#include "tx_api.h" +#include "txm_module.h" + +/* Record one expectation; a failed one is printed and makes the image fail. */ +VOID harness_expect(const CHAR *description, ULONG actual, ULONG expected); + +/* Print a line, or a labelled value, over semihosting. */ +VOID harness_print(const CHAR *text); +VOID harness_value(const CHAR *label, ULONG value); + +/* Print the verdict and end the simulation; never returns. */ +VOID harness_finish(VOID); + +/* Wait, in ticks, until a module writes the done word or the limit passes. + Returns TX_TRUE if the module finished. */ +UINT harness_wait_for_module(ULONG limit_ticks); + +/* Clear the shared area and grant it to a module. */ +VOID harness_shared_clear(VOID); +UINT harness_shared_grant(TXM_MODULE_INSTANCE *module_instance); + +/* What the memory fault notification has seen. */ +extern volatile ULONG harness_fault_count; +extern TX_THREAD * volatile harness_fault_thread; +extern TXM_MODULE_INSTANCE * volatile harness_fault_module; +extern volatile ULONG harness_fault_address; +extern volatile ULONG harness_fault_status; + +VOID harness_fault_notify(TX_THREAD *thread_ptr, TXM_MODULE_INSTANCE *module_instance); + +/* The memory handed to the Module Manager, shared by every test image. */ +extern UCHAR harness_module_memory[]; +extern UCHAR harness_object_memory[]; + +#define HARNESS_MODULE_MEMORY_SIZE ((ULONG) 65536UL) +#define HARNESS_OBJECT_MEMORY_SIZE ((ULONG) 16384UL) + +/* Each test image defines this; it runs on the manager thread. */ +VOID harness_test(VOID); + +#endif diff --git a/test/tx/cmake/module_qemu/src/manager.ld b/test/tx/cmake/module_qemu/src/manager.ld new file mode 100644 index 00000000..9f6580e9 --- /dev/null +++ b/test/tx/cmake/module_qemu/src/manager.ld @@ -0,0 +1,77 @@ +/*************************************************************************** + * Copyright (c) 2026 Eclipse ThreadX contributors + * + * This program and the accompanying materials are made available under the + * terms of the MIT License which is available at + * https://opensource.org/licenses/MIT. + * + * AI Disclosure: This file was largely AI-generated by Claude Code (Opus 5.5). + * The AI-generated portions may be considered public domain (CC0-1.0) + * and not subject to the project's licence. The human contributor has + * reviewed and verified that the code is correct. + * + * SPDX-License-Identifier: MIT and CC0-1.0 + **************************************************************************/ + +/* Module manager image for QEMU's MPS2 AN385 and AN386. Code, read-only data + and the embedded module images go in the 4 MB SSRAM1 at address 0, which the + board boots from; data, the main stack and the memory ThreadX hands out go + in the first megabyte of SSRAM2 at 0x20000000. The megabyte above that holds + the area the manager shares with its modules (module_shared.h), and nothing + the linker places reaches it. */ + +MEMORY +{ + CODE (rx) : ORIGIN = 0x00000000, LENGTH = 0x00400000 + RAM (rwx) : ORIGIN = 0x20000000, LENGTH = 0x00100000 +} + +ENTRY(reset_handler) + +SECTIONS +{ + .vectors : + { + KEEP(*(.vectors)) + } > CODE + + .text : + { + *(.text .text.*) + *(.rodata .rodata.*) + . = ALIGN(4); + } > CODE + + .ARM.exidx : + { + *(.ARM.exidx*) + } > CODE + + __data_load_start__ = LOADADDR(.data); + + .data : ALIGN(4) + { + __data_start__ = .; + *(.data .data.*) + . = ALIGN(4); + __data_end__ = .; + } > RAM AT > CODE + + .bss (NOLOAD) : ALIGN(4) + { + __bss_start__ = .; + *(.bss .bss.*) + *(COMMON) + . = ALIGN(4); + __bss_end__ = .; + } > RAM + + .stack (NOLOAD) : ALIGN(8) + { + __stack_start__ = .; + . = . + 2048; + __stack_end__ = .; + } > RAM + + __RAM_segment_used_end__ = .; +} diff --git a/test/tx/cmake/module_qemu/src/module_blob.S.in b/test/tx/cmake/module_qemu/src/module_blob.S.in new file mode 100644 index 00000000..cd395df5 --- /dev/null +++ b/test/tx/cmake/module_qemu/src/module_blob.S.in @@ -0,0 +1,26 @@ +/*************************************************************************** + * Copyright (c) 2026 Eclipse ThreadX contributors + * + * This program and the accompanying materials are made available under the + * terms of the MIT License which is available at + * https://opensource.org/licenses/MIT. + * + * AI Disclosure: This file was largely AI-generated by Claude Code (Opus 5.5). + * The AI-generated portions may be considered public domain (CC0-1.0) + * and not subject to the project's licence. The human contributor has + * reviewed and verified that the code is correct. + * + * SPDX-License-Identifier: MIT and CC0-1.0 + **************************************************************************/ + +// Generated by CMake from module_blob.S.in: embeds one module's raw image in +// the manager image, as bytes rather than objects, so none of the module's +// symbols enter the manager's link. The manager loads it from here with +// txm_module_manager_memory_load. + + .section .rodata.@BLOB_SYMBOL@, "a" + .align 4 + .global @BLOB_SYMBOL@ +@BLOB_SYMBOL@: + .incbin "@BLOB_FILE@" + .align 4 diff --git a/test/tx/cmake/module_qemu/src/module_preamble.S b/test/tx/cmake/module_qemu/src/module_preamble.S new file mode 100644 index 00000000..4991544e --- /dev/null +++ b/test/tx/cmake/module_qemu/src/module_preamble.S @@ -0,0 +1,53 @@ +/*************************************************************************** + * Copyright (c) 2026 Eclipse ThreadX contributors + * + * This program and the accompanying materials are made available under the + * terms of the MIT License which is available at + * https://opensource.org/licenses/MIT. + * + * AI Disclosure: This file was largely AI-generated by Claude Code (Opus 5.5). + * The AI-generated portions may be considered public domain (CC0-1.0) + * and not subject to the project's licence. The human contributor has + * reviewed and verified that the code is correct. + * + * SPDX-License-Identifier: MIT and CC0-1.0 + **************************************************************************/ + +@ Module preamble shared by every test module. The property word comes from +@ the build, as TEST_MODULE_PROPERTIES, so one source serves the protected and +@ the privileged modules; everything else is the layout the Cortex-M module +@ ports document. Every module names its start function module_start. + +#ifndef TEST_MODULE_PROPERTIES +#error "TEST_MODULE_PROPERTIES must be defined by the build" +#endif + + .syntax unified + .section .preamble, "ax" + .align 4 + + .global __txm_module_preamble + .global module_start + .global _txm_module_thread_shell_entry + .global _txm_module_callback_request_thread_entry + +__txm_module_preamble: + .dc.l 0x4D4F4455 @ Module ID + .dc.l 0x6 @ Module major version + .dc.l 0x1 @ Module minor version + .dc.l 32 @ Preamble size in 32-bit words + .dc.l 0x7E57C0DE @ Application-defined module ID + .dc.l TEST_MODULE_PROPERTIES @ Properties: GNU, and the test's mode + .dc.l _txm_module_thread_shell_entry - . - 0 @ Shell entry + .dc.l module_start - . - 0 @ Start thread entry + .dc.l 0 @ Stop thread entry, none + .dc.l 1 @ Start/stop thread priority + .dc.l 1024 @ Start/stop thread stack size + .dc.l _txm_module_callback_request_thread_entry - . - 0 @ Callback thread entry + .dc.l 1 @ Callback thread priority + .dc.l 1024 @ Callback thread stack size + .dc.l __code_size__ @ Code size, from the link + .dc.l __data_size__ @ Data size, from the link + .rept 16 + .dc.l 0 @ Reserved + .endr diff --git a/test/tx/cmake/module_qemu/src/module_shared.h b/test/tx/cmake/module_qemu/src/module_shared.h new file mode 100644 index 00000000..7d239ce6 --- /dev/null +++ b/test/tx/cmake/module_qemu/src/module_shared.h @@ -0,0 +1,68 @@ +/*************************************************************************** + * Copyright (c) 2026 Eclipse ThreadX contributors + * + * This program and the accompanying materials are made available under the + * terms of the MIT License which is available at + * https://opensource.org/licenses/MIT. + * + * AI Disclosure: This file was largely AI-generated by Claude Code (Opus 5.5). + * The AI-generated portions may be considered public domain (CC0-1.0) + * and not subject to the project's licence. The human contributor has + * reviewed and verified that the code is correct. + * + * SPDX-License-Identifier: MIT and CC0-1.0 + **************************************************************************/ + + +/**************************************************************************/ +/**************************************************************************/ +/** */ +/** ThreadX Test */ +/** */ +/** Module execution harness: manager/module shared area */ +/** */ +/**************************************************************************/ +/**************************************************************************/ + +/* A module reports what it did through a small area of RAM that the manager + grants it with txm_module_manager_external_memory_enable. The area is at a + fixed address, outside everything the manager image links, so that both + images can name it without either knowing the other's layout. Its base and + size meet the Cortex-M MPU's rule that a region is a power of two in size + and aligned to that size. */ + +#ifndef MODULE_SHARED_H +#define MODULE_SHARED_H + +#define MODULE_SHARED_BASE ((ULONG) 0x20100000UL) +#define MODULE_SHARED_SIZE ((ULONG) 256UL) +#define MODULE_SHARED_WORDS (MODULE_SHARED_SIZE / ((ULONG) sizeof(ULONG))) + +#define MODULE_SHARED ((volatile ULONG *) MODULE_SHARED_BASE) + +/* Word indices. The manager writes the inputs before it starts a module; the + module writes the rest. A module writes MODULE_DONE_MAGIC to MODULE_DONE + last, after every other word it reports. */ + +#define MODULE_IN_KERNEL_WORD ((ULONG) 0UL) /* Address of a kernel-only word */ +#define MODULE_IN_CYCLE ((ULONG) 1UL) /* Load cycle number, from 1 */ + +#define MODULE_OUT_STARTED ((ULONG) 8UL) /* Start thread ran */ +#define MODULE_OUT_OBJECT_STATUS ((ULONG) 9UL) /* Worst object allocation status */ +#define MODULE_OUT_CREATE_STATUS ((ULONG) 10UL) /* Worst object creation status */ +#define MODULE_OUT_QUEUE_VALUE ((ULONG) 11UL) /* Message received back */ +#define MODULE_OUT_SEMAPHORE_STATUS ((ULONG) 12UL) /* Semaphore get status */ +#define MODULE_OUT_SLEEP_TICKS ((ULONG) 13UL) /* Ticks elapsed across tx_thread_sleep */ +#define MODULE_OUT_WORKER_RUNS ((ULONG) 14UL) /* Worker thread iterations */ +#define MODULE_OUT_CYCLE_SEEN ((ULONG) 15UL) /* Load cycle the module observed */ +#define MODULE_OUT_KERNEL_READ_TRY ((ULONG) 16UL) /* Kernel word read about to happen */ +#define MODULE_OUT_KERNEL_READ_DONE ((ULONG) 17UL) /* Kernel word read completed */ +#define MODULE_OUT_KERNEL_VALUE ((ULONG) 18UL) /* Value read from the kernel word */ +#define MODULE_OUT_CONTROL ((ULONG) 19UL) /* CONTROL as seen by the start thread */ +#define MODULE_DONE ((ULONG) 31UL) + +#define MODULE_DONE_MAGIC ((ULONG) 0x0D0E0D0EUL) +#define MODULE_STARTED_MAGIC ((ULONG) 0x57A27EDUL) +#define MODULE_QUEUE_MESSAGE ((ULONG) 0x12345678UL) + +#endif diff --git a/test/tx/cmake/module_qemu/src/startup.S b/test/tx/cmake/module_qemu/src/startup.S new file mode 100644 index 00000000..f2f8442b --- /dev/null +++ b/test/tx/cmake/module_qemu/src/startup.S @@ -0,0 +1,93 @@ +/*************************************************************************** + * Copyright (c) 2026 Eclipse ThreadX contributors + * + * This program and the accompanying materials are made available under the + * terms of the MIT License which is available at + * https://opensource.org/licenses/MIT. + * + * AI Disclosure: This file was largely AI-generated by Claude Code (Opus 5.5). + * The AI-generated portions may be considered public domain (CC0-1.0) + * and not subject to the project's licence. The human contributor has + * reviewed and verified that the code is correct. + * + * SPDX-License-Identifier: MIT and CC0-1.0 + **************************************************************************/ + +@ Vector table and reset handler for the module execution harness on QEMU's +@ MPS2 boards. The fault vectors go to the module port's handlers, which is +@ the point: a module's MemManage fault has to reach the Module Manager for the +@ fault-notification test to mean anything. HardFault is never expected and +@ goes to the harness, which reports it and fails the image. + + .syntax unified + .thumb + + .section .vectors, "a" + .align 2 + .global _vectors +_vectors: + .word __stack_end__ @ Initial main stack pointer + .word reset_handler @ Reset + .word harness_unexpected_exception @ NMI + .word harness_hard_fault @ HardFault + .word MemManage_Handler @ MemManage, module port + .word BusFault_Handler @ BusFault, module port + .word UsageFault_Handler @ UsageFault, module port + .word 0 + .word 0 + .word 0 + .word 0 + .word __tx_SVCallHandler @ SVCall, module port + .word harness_unexpected_exception @ Debug monitor + .word 0 + .word __tx_PendSVHandler @ PendSV, module port + .word __tx_SysTickHandler @ SysTick, tx_initialize_low_level.S + .rept 32 + .word harness_unexpected_exception @ External interrupts, none enabled + .endr + + .section .text.reset_handler, "ax" + .align 2 + .global reset_handler + .thumb_func +reset_handler: + + @ Copy initialised data from its load address to RAM. + + LDR r0, =__data_load_start__ + LDR r1, =__data_start__ + LDR r2, =__data_end__ +copy_data: + CMP r1, r2 + BHS copy_data_done + LDR r3, [r0], #4 + STR r3, [r1], #4 + B copy_data +copy_data_done: + + @ Zero the uninitialised data. + + LDR r1, =__bss_start__ + LDR r2, =__bss_end__ + MOV r3, #0 +zero_bss: + CMP r1, r2 + BHS zero_bss_done + STR r3, [r1], #4 + B zero_bss +zero_bss_done: + +#ifdef __ARM_FP + @ Grant full access to CP10 and CP11 before anything touches the FPU. + + LDR r0, =0xE000ED88 @ CPACR + LDR r1, [r0] + ORR r1, r1, #(0xF << 20) + STR r1, [r0] + DSB + ISB +#endif + + BL main +reset_hang: + B reset_hang diff --git a/test/tx/cmake/module_qemu/src/tx_initialize_low_level.S b/test/tx/cmake/module_qemu/src/tx_initialize_low_level.S new file mode 100644 index 00000000..2e6ecfdf --- /dev/null +++ b/test/tx/cmake/module_qemu/src/tx_initialize_low_level.S @@ -0,0 +1,87 @@ +/*************************************************************************** + * Copyright (c) 2026 Eclipse ThreadX contributors + * + * This program and the accompanying materials are made available under the + * terms of the MIT License which is available at + * https://opensource.org/licenses/MIT. + * + * AI Disclosure: This file was largely AI-generated by Claude Code (Opus 5.5). + * The AI-generated portions may be considered public domain (CC0-1.0) + * and not subject to the project's licence. The human contributor has + * reviewed and verified that the code is correct. + * + * SPDX-License-Identifier: MIT and CC0-1.0 + **************************************************************************/ + +@ Low-level initialisation for the module execution harness on QEMU's MPS2 +@ AN385 (Cortex-M3) and AN386 (Cortex-M4) boards, both clocked at 25 MHz. + + .syntax unified + .thumb + + .global _tx_initialize_unused_memory + .global _tx_timer_interrupt + .global __RAM_segment_used_end__ + +SYSTEM_CLOCK = 25000000 +SYSTICK_CYCLES = ((SYSTEM_CLOCK / 100) - 1) + + .text + .align 2 + +@ VOID _tx_initialize_low_level(VOID) + + .global _tx_initialize_low_level + .thumb_func +_tx_initialize_low_level: + + CPSID i @ Interrupts stay off until the scheduler starts + + @ First free memory follows everything the image uses. + + LDR r0, =_tx_initialize_unused_memory + LDR r1, =__RAM_segment_used_end__ + ADD r1, r1, #4 + STR r1, [r0] + + @ Vector table base, in case the board boots with another. + + LDR r0, =0xE000ED08 @ VTOR + LDR r1, =_vectors + STR r1, [r0] + + @ SysTick at 100 Hz. + + LDR r0, =0xE000E000 + MOV r1, #0 + STR r1, [r0, #0x10] @ SysTick control: off + STR r1, [r0, #0x18] @ SysTick current value + LDR r1, =SYSTICK_CYCLES + STR r1, [r0, #0x14] @ SysTick reload + MOV r1, #0x7 + STR r1, [r0, #0x10] @ SysTick control: on, interrupt, core clock + + @ Handler priorities: the faults highest, SVCall and PendSV lowest, as the + @ module port requires. + + LDR r1, =0x00000000 @ Reserved, UsageFault, BusFault, MemManage + STR r1, [r0, #0xD18] + LDR r1, =0xFF000000 @ SVCall, reserved x3 + STR r1, [r0, #0xD1C] + LDR r1, =0x40FF0000 @ SysTick, PendSV, reserved, debug monitor + STR r1, [r0, #0xD20] + + BX lr + +@ SysTick: drive the ThreadX timer. + + .global __tx_SysTickHandler + .global SysTick_Handler + .thumb_func +__tx_SysTickHandler: + .thumb_func +SysTick_Handler: + PUSH {r0, lr} + BL _tx_timer_interrupt + POP {r0, lr} + BX lr diff --git a/test/tx/cmake/module_qemu/tests/harness_checks.c b/test/tx/cmake/module_qemu/tests/harness_checks.c new file mode 100644 index 00000000..4b7cff05 --- /dev/null +++ b/test/tx/cmake/module_qemu/tests/harness_checks.c @@ -0,0 +1,57 @@ +/*************************************************************************** + * Copyright (c) 2026 Eclipse ThreadX contributors + * + * This program and the accompanying materials are made available under the + * terms of the MIT License which is available at + * https://opensource.org/licenses/MIT. + * + * AI Disclosure: This file was largely AI-generated by Claude Code (Opus 5.5). + * The AI-generated portions may be considered public domain (CC0-1.0) + * and not subject to the project's licence. The human contributor has + * reviewed and verified that the code is correct. + * + * SPDX-License-Identifier: MIT and CC0-1.0 + **************************************************************************/ + + +/**************************************************************************/ +/**************************************************************************/ +/** */ +/** ThreadX Test */ +/** */ +/** Module execution harness: checks shared by the test images */ +/** */ +/**************************************************************************/ +/**************************************************************************/ + +#include "harness_checks.h" + + +VOID harness_check_services(ULONG cycle) +{ + harness_expect("module start thread ran", MODULE_SHARED[MODULE_OUT_STARTED], MODULE_STARTED_MAGIC); + harness_expect("module saw the load cycle", MODULE_SHARED[MODULE_OUT_CYCLE_SEEN], cycle); + harness_expect("module object allocation", MODULE_SHARED[MODULE_OUT_OBJECT_STATUS], (ULONG) TX_SUCCESS); + harness_expect("module object creation and queue send", MODULE_SHARED[MODULE_OUT_CREATE_STATUS], (ULONG) TX_SUCCESS); + harness_expect("module worker received the message", MODULE_SHARED[MODULE_OUT_QUEUE_VALUE], MODULE_QUEUE_MESSAGE); + harness_expect("module worker ran once", MODULE_SHARED[MODULE_OUT_WORKER_RUNS], 1UL); + harness_expect("module semaphore get", MODULE_SHARED[MODULE_OUT_SEMAPHORE_STATUS], (ULONG) TX_SUCCESS); + harness_expect("module sleep lasted its ticks", + (ULONG) (MODULE_SHARED[MODULE_OUT_SLEEP_TICKS] >= EXPECTED_SLEEP_TICKS), (ULONG) TX_TRUE); +} + + +ULONG harness_module_pool_available(VOID) +{ +TX_NAME_CONST CHAR *name; +ULONG available; +ULONG fragments; +TX_THREAD *first_suspended; +ULONG suspended_count; +TX_BYTE_POOL *next_pool; + + available = 0UL; + (VOID) tx_byte_pool_info_get(&_txm_module_manager_byte_pool, &name, &available, &fragments, + &first_suspended, &suspended_count, &next_pool); + return(available); +} diff --git a/test/tx/cmake/module_qemu/tests/harness_checks.h b/test/tx/cmake/module_qemu/tests/harness_checks.h new file mode 100644 index 00000000..19ad68ae --- /dev/null +++ b/test/tx/cmake/module_qemu/tests/harness_checks.h @@ -0,0 +1,45 @@ +/*************************************************************************** + * Copyright (c) 2026 Eclipse ThreadX contributors + * + * This program and the accompanying materials are made available under the + * terms of the MIT License which is available at + * https://opensource.org/licenses/MIT. + * + * AI Disclosure: This file was largely AI-generated by Claude Code (Opus 5.5). + * The AI-generated portions may be considered public domain (CC0-1.0) + * and not subject to the project's licence. The human contributor has + * reviewed and verified that the code is correct. + * + * SPDX-License-Identifier: MIT and CC0-1.0 + **************************************************************************/ + + +/**************************************************************************/ +/**************************************************************************/ +/** */ +/** ThreadX Test */ +/** */ +/** Module execution harness: checks shared by the test images */ +/** */ +/**************************************************************************/ +/**************************************************************************/ + +#ifndef HARNESS_CHECKS_H +#define HARNESS_CHECKS_H + +#include "harness.h" +#include "module_shared.h" + +/* CONTROL.nPRIV: set when a thread runs unprivileged. */ +#define CONTROL_NPRIV ((ULONG) 1UL) + +/* The module's sleep must have lasted at least this many ticks. */ +#define EXPECTED_SLEEP_TICKS ((ULONG) 5UL) + +/* The kernel services part of the test module, common to every image. */ +VOID harness_check_services(ULONG cycle); + +/* Available bytes in the Module Manager's pool. */ +ULONG harness_module_pool_available(VOID); + +#endif diff --git a/test/tx/cmake/module_qemu/tests/module_services.c b/test/tx/cmake/module_qemu/tests/module_services.c new file mode 100644 index 00000000..e2fcce44 --- /dev/null +++ b/test/tx/cmake/module_qemu/tests/module_services.c @@ -0,0 +1,133 @@ +/*************************************************************************** + * Copyright (c) 2026 Eclipse ThreadX contributors + * + * This program and the accompanying materials are made available under the + * terms of the MIT License which is available at + * https://opensource.org/licenses/MIT. + * + * AI Disclosure: This file was largely AI-generated by Claude Code (Opus 5.5). + * The AI-generated portions may be considered public domain (CC0-1.0) + * and not subject to the project's licence. The human contributor has + * reviewed and verified that the code is correct. + * + * SPDX-License-Identifier: MIT and CC0-1.0 + **************************************************************************/ + + +/**************************************************************************/ +/**************************************************************************/ +/** */ +/** ThreadX Test */ +/** */ +/** Module execution harness: the test module */ +/** */ +/**************************************************************************/ +/**************************************************************************/ + +/* One module, built twice: once user mode with memory protection and once + privileged without it, from the same source; only the preamble's property + word differs. + + The start thread exercises the kernel through the module's dispatcher: it + allocates and creates a queue, a semaphore and a worker thread, hands the + worker a message, waits for the worker to signal back, sleeps on the timer, + and records what it saw in the area the manager shared with it. Then, if + the manager supplied the address of a word in kernel memory, it reads that + word. A protected module must fault on the read and never record its + result; a privileged one reads it. The done word is written last, so a + module that faults never sets it. + + MISRA C:2023 deviations, confined to this test module: Rule 1.2 and + Directive 4.3 (inline assembly to read CONTROL), and Rule 11.4 (the shared + area and the kernel word are integer addresses supplied at run time). */ + +#define TXM_MODULE +#include "txm_module.h" +#include "module_shared.h" + +#define WORKER_STACK_SIZE ((ULONG) 1024UL) +#define SLEEP_TICKS ((ULONG) 5UL) +#define WAIT_TICKS ((ULONG) 100UL) + +static TX_THREAD *worker_thread; +static TX_QUEUE *message_queue; +static TX_SEMAPHORE *done_semaphore; +static ULONG worker_stack[WORKER_STACK_SIZE / sizeof(ULONG)]; +static ULONG queue_storage[4]; + +VOID module_start(ULONG id); + + +/* Keep the first failing status rather than the last. */ +static VOID record_status(ULONG word, UINT status) +{ + if ((MODULE_SHARED[word] == (ULONG) TX_SUCCESS) && (status != TX_SUCCESS)) + { + MODULE_SHARED[word] = (ULONG) status; + } +} + + +static VOID worker_entry(ULONG thread_input) +{ +ULONG message; + + (VOID) thread_input; + + for (;;) + { + message = 0UL; + if (tx_queue_receive(message_queue, &message, TX_WAIT_FOREVER) == TX_SUCCESS) + { + MODULE_SHARED[MODULE_OUT_QUEUE_VALUE] = message; + MODULE_SHARED[MODULE_OUT_WORKER_RUNS] = MODULE_SHARED[MODULE_OUT_WORKER_RUNS] + 1UL; + (VOID) tx_semaphore_put(done_semaphore); + } + } +} + + +VOID module_start(ULONG id) +{ +ULONG message; +ULONG start_time; +ULONG control; +ULONG kernel_word; + + (VOID) id; + + MODULE_SHARED[MODULE_OUT_STARTED] = MODULE_STARTED_MAGIC; + MODULE_SHARED[MODULE_OUT_CYCLE_SEEN] = MODULE_SHARED[MODULE_IN_CYCLE]; + + __asm__ volatile ("mrs %0, control" : "=r"(control)); + MODULE_SHARED[MODULE_OUT_CONTROL] = control; + + record_status(MODULE_OUT_OBJECT_STATUS, txm_module_object_allocate((VOID **) &message_queue, sizeof(TX_QUEUE))); + record_status(MODULE_OUT_OBJECT_STATUS, txm_module_object_allocate((VOID **) &done_semaphore, sizeof(TX_SEMAPHORE))); + record_status(MODULE_OUT_OBJECT_STATUS, txm_module_object_allocate((VOID **) &worker_thread, sizeof(TX_THREAD))); + + record_status(MODULE_OUT_CREATE_STATUS, tx_queue_create(message_queue, "module queue", TX_1_ULONG, + queue_storage, sizeof(queue_storage))); + record_status(MODULE_OUT_CREATE_STATUS, tx_semaphore_create(done_semaphore, "module semaphore", 0UL)); + record_status(MODULE_OUT_CREATE_STATUS, tx_thread_create(worker_thread, "module worker", worker_entry, 0UL, + worker_stack, sizeof(worker_stack), + 2U, 2U, TX_NO_TIME_SLICE, TX_AUTO_START)); + + message = MODULE_QUEUE_MESSAGE; + record_status(MODULE_OUT_CREATE_STATUS, tx_queue_send(message_queue, &message, TX_NO_WAIT)); + MODULE_SHARED[MODULE_OUT_SEMAPHORE_STATUS] = (ULONG) tx_semaphore_get(done_semaphore, WAIT_TICKS); + + start_time = tx_time_get(); + (VOID) tx_thread_sleep(SLEEP_TICKS); + MODULE_SHARED[MODULE_OUT_SLEEP_TICKS] = tx_time_get() - start_time; + + kernel_word = MODULE_SHARED[MODULE_IN_KERNEL_WORD]; + if (kernel_word != 0UL) + { + MODULE_SHARED[MODULE_OUT_KERNEL_READ_TRY] = 1UL; + MODULE_SHARED[MODULE_OUT_KERNEL_VALUE] = *((volatile ULONG *) kernel_word); + MODULE_SHARED[MODULE_OUT_KERNEL_READ_DONE] = 1UL; + } + + MODULE_SHARED[MODULE_DONE] = MODULE_DONE_MAGIC; +} diff --git a/test/tx/cmake/module_qemu/tests/test_module_fault.c b/test/tx/cmake/module_qemu/tests/test_module_fault.c new file mode 100644 index 00000000..36bcdc9a --- /dev/null +++ b/test/tx/cmake/module_qemu/tests/test_module_fault.c @@ -0,0 +1,103 @@ +/*************************************************************************** + * Copyright (c) 2026 Eclipse ThreadX contributors + * + * This program and the accompanying materials are made available under the + * terms of the MIT License which is available at + * https://opensource.org/licenses/MIT. + * + * AI Disclosure: This file was largely AI-generated by Claude Code (Opus 5.5). + * The AI-generated portions may be considered public domain (CC0-1.0) + * and not subject to the project's licence. The human contributor has + * reviewed and verified that the code is correct. + * + * SPDX-License-Identifier: MIT and CC0-1.0 + **************************************************************************/ + + +/**************************************************************************/ +/**************************************************************************/ +/** */ +/** ThreadX Test */ +/** */ +/** Module execution harness: protected module memory fault */ +/** */ +/**************************************************************************/ +/**************************************************************************/ + +/* A user-mode, memory-protected module that reads a word of kernel memory must + take a MemManage fault on that read. The Module Manager must terminate the + faulting thread, report it to the application's fault notification with the + right module, thread and address, and still let the module be stopped and + unloaded. + + This image is also the harness's proof that the emulated MPU is enforcing at + all: if QEMU let the unprivileged read through, the module would record the + value and finish, and every check below would fail. */ + +#include "harness_checks.h" + +#define MODULE_WAIT_TICKS ((ULONG) 500UL) +#define PROTECTED_PROPERTIES ((ULONG) 0x02000007UL) /* GNU; user mode, memory protection, shared memory */ +#define KERNEL_WORD_VALUE ((ULONG) 0x6B65726EUL) + +/* CFSR: MemManage data access violation, with MMFAR valid. */ +#define CFSR_DACCVIOL ((ULONG) 0x02UL) +#define CFSR_MMARVALID ((ULONG) 0x80UL) + +extern UCHAR module_services_protected[]; + +static TXM_MODULE_INSTANCE test_module; +static volatile ULONG kernel_word = KERNEL_WORD_VALUE; + + +VOID harness_test(VOID) +{ +ULONG available_before; +ULONG start; + + harness_print("Module fault: protected module reads kernel memory\n"); + + available_before = harness_module_pool_available(); + + harness_shared_clear(); + MODULE_SHARED[MODULE_IN_CYCLE] = 1UL; + MODULE_SHARED[MODULE_IN_KERNEL_WORD] = (ULONG) &kernel_word; + + harness_expect("memory load", (ULONG) txm_module_manager_memory_load(&test_module, "services protected", + (VOID *) module_services_protected), + (ULONG) TX_SUCCESS); + harness_expect("module properties", test_module.txm_module_instance_property_flags, PROTECTED_PROPERTIES); + harness_expect("shared area grant", (ULONG) harness_shared_grant(&test_module), (ULONG) TX_SUCCESS); + harness_expect("module start", (ULONG) txm_module_manager_start(&test_module), (ULONG) TX_SUCCESS); + + start = tx_time_get(); + while ((harness_fault_count == 0UL) && ((tx_time_get() - start) < MODULE_WAIT_TICKS)) + { + tx_thread_sleep(1); + } + + /* The kernel services before the read still worked. */ + harness_check_services(1UL); + harness_expect("module ran unprivileged", MODULE_SHARED[MODULE_OUT_CONTROL] & CONTROL_NPRIV, CONTROL_NPRIV); + + /* The read was attempted and faulted. */ + harness_expect("kernel read attempted", MODULE_SHARED[MODULE_OUT_KERNEL_READ_TRY], 1UL); + harness_expect("kernel read did not complete", MODULE_SHARED[MODULE_OUT_KERNEL_READ_DONE], 0UL); + harness_expect("kernel value not disclosed", MODULE_SHARED[MODULE_OUT_KERNEL_VALUE], 0UL); + harness_expect("module did not finish", MODULE_SHARED[MODULE_DONE], 0UL); + + harness_expect("one memory fault reported", harness_fault_count, 1UL); + harness_expect("fault names the module", (ULONG) harness_fault_module, (ULONG) &test_module); + harness_expect("fault names the start thread", (ULONG) harness_fault_thread, + (ULONG) &test_module.txm_module_instance_start_stop_thread); + harness_expect("fault address is the kernel word", harness_fault_address, (ULONG) &kernel_word); + harness_expect("fault is a data access violation", + harness_fault_status & (CFSR_DACCVIOL | CFSR_MMARVALID), CFSR_DACCVIOL | CFSR_MMARVALID); + harness_expect("faulting thread terminated", + (ULONG) test_module.txm_module_instance_start_stop_thread.tx_thread_state, (ULONG) TX_TERMINATED); + harness_expect("kernel word unchanged", kernel_word, KERNEL_WORD_VALUE); + + harness_expect("module stop", (ULONG) txm_module_manager_stop(&test_module), (ULONG) TX_SUCCESS); + harness_expect("module unload", (ULONG) txm_module_manager_unload(&test_module), (ULONG) TX_SUCCESS); + harness_expect("module memory returned", harness_module_pool_available(), available_before); +} diff --git a/test/tx/cmake/module_qemu/tests/test_module_lifecycle.c b/test/tx/cmake/module_qemu/tests/test_module_lifecycle.c new file mode 100644 index 00000000..8c241e79 --- /dev/null +++ b/test/tx/cmake/module_qemu/tests/test_module_lifecycle.c @@ -0,0 +1,76 @@ +/*************************************************************************** + * Copyright (c) 2026 Eclipse ThreadX contributors + * + * This program and the accompanying materials are made available under the + * terms of the MIT License which is available at + * https://opensource.org/licenses/MIT. + * + * AI Disclosure: This file was largely AI-generated by Claude Code (Opus 5.5). + * The AI-generated portions may be considered public domain (CC0-1.0) + * and not subject to the project's licence. The human contributor has + * reviewed and verified that the code is correct. + * + * SPDX-License-Identifier: MIT and CC0-1.0 + **************************************************************************/ + + +/**************************************************************************/ +/**************************************************************************/ +/** */ +/** ThreadX Test */ +/** */ +/** Module execution harness: protected module lifecycle */ +/** */ +/**************************************************************************/ +/**************************************************************************/ + +/* A user-mode, memory-protected module is loaded, granted the shared area, + started, left to exercise the kernel through its dispatcher, stopped and + unloaded -- twice, so that the second cycle shows the first gave back what + it took. The module must run unprivileged and must not fault. */ + +#include "harness_checks.h" + +#define LIFECYCLE_CYCLES ((ULONG) 2UL) +#define MODULE_WAIT_TICKS ((ULONG) 500UL) +#define PROTECTED_PROPERTIES ((ULONG) 0x02000007UL) /* GNU; user mode, memory protection, shared memory */ + +extern UCHAR module_services_protected[]; + +static TXM_MODULE_INSTANCE test_module; + + +VOID harness_test(VOID) +{ +ULONG cycle; +ULONG available_before; + + harness_print("Module lifecycle: protected module, load/start/stop/unload twice\n"); + + available_before = harness_module_pool_available(); + + for (cycle = 1UL; cycle <= LIFECYCLE_CYCLES; cycle++) + { + harness_value("cycle", cycle); + + harness_shared_clear(); + MODULE_SHARED[MODULE_IN_CYCLE] = cycle; + + harness_expect("memory load", (ULONG) txm_module_manager_memory_load(&test_module, "services protected", + (VOID *) module_services_protected), + (ULONG) TX_SUCCESS); + harness_expect("module properties", test_module.txm_module_instance_property_flags, PROTECTED_PROPERTIES); + harness_expect("shared area grant", (ULONG) harness_shared_grant(&test_module), (ULONG) TX_SUCCESS); + harness_expect("module start", (ULONG) txm_module_manager_start(&test_module), (ULONG) TX_SUCCESS); + harness_expect("module finished", (ULONG) harness_wait_for_module(MODULE_WAIT_TICKS), (ULONG) TX_TRUE); + + harness_check_services(cycle); + harness_expect("module ran unprivileged", + MODULE_SHARED[MODULE_OUT_CONTROL] & CONTROL_NPRIV, CONTROL_NPRIV); + harness_expect("no memory fault", harness_fault_count, 0UL); + + harness_expect("module stop", (ULONG) txm_module_manager_stop(&test_module), (ULONG) TX_SUCCESS); + harness_expect("module unload", (ULONG) txm_module_manager_unload(&test_module), (ULONG) TX_SUCCESS); + harness_expect("module memory returned", harness_module_pool_available(), available_before); + } +} diff --git a/test/tx/cmake/module_qemu/tests/test_module_privileged.c b/test/tx/cmake/module_qemu/tests/test_module_privileged.c new file mode 100644 index 00000000..288117dd --- /dev/null +++ b/test/tx/cmake/module_qemu/tests/test_module_privileged.c @@ -0,0 +1,73 @@ +/*************************************************************************** + * Copyright (c) 2026 Eclipse ThreadX contributors + * + * This program and the accompanying materials are made available under the + * terms of the MIT License which is available at + * https://opensource.org/licenses/MIT. + * + * AI Disclosure: This file was largely AI-generated by Claude Code (Opus 5.5). + * The AI-generated portions may be considered public domain (CC0-1.0) + * and not subject to the project's licence. The human contributor has + * reviewed and verified that the code is correct. + * + * SPDX-License-Identifier: MIT and CC0-1.0 + **************************************************************************/ + + +/**************************************************************************/ +/**************************************************************************/ +/** */ +/** ThreadX Test */ +/** */ +/** Module execution harness: privileged, unprotected module */ +/** */ +/**************************************************************************/ +/**************************************************************************/ + +/* The same module built privileged and without memory protection. It runs + with the kernel's privileges, so the read that faults in the protected image + succeeds here, which shows that the fault in that image comes from the + module's protection and not from the address itself. Its kernel services + must work just as the protected module's do. */ + +#include "harness_checks.h" + +#define MODULE_WAIT_TICKS ((ULONG) 500UL) +#define PRIVILEGED_PROPERTIES ((ULONG) 0x02000000UL) /* GNU; privileged, no memory protection */ +#define KERNEL_WORD_VALUE ((ULONG) 0x6B65726EUL) + +extern UCHAR module_services_privileged[]; + +static TXM_MODULE_INSTANCE test_module; +static volatile ULONG kernel_word = KERNEL_WORD_VALUE; + + +VOID harness_test(VOID) +{ +ULONG available_before; + + harness_print("Module privileged: unprotected module reads kernel memory\n"); + + available_before = harness_module_pool_available(); + + harness_shared_clear(); + MODULE_SHARED[MODULE_IN_CYCLE] = 1UL; + MODULE_SHARED[MODULE_IN_KERNEL_WORD] = (ULONG) &kernel_word; + + harness_expect("memory load", (ULONG) txm_module_manager_memory_load(&test_module, "services privileged", + (VOID *) module_services_privileged), + (ULONG) TX_SUCCESS); + harness_expect("module properties", test_module.txm_module_instance_property_flags, PRIVILEGED_PROPERTIES); + harness_expect("module start", (ULONG) txm_module_manager_start(&test_module), (ULONG) TX_SUCCESS); + harness_expect("module finished", (ULONG) harness_wait_for_module(MODULE_WAIT_TICKS), (ULONG) TX_TRUE); + + harness_check_services(1UL); + harness_expect("module ran privileged", MODULE_SHARED[MODULE_OUT_CONTROL] & CONTROL_NPRIV, 0UL); + harness_expect("kernel read completed", MODULE_SHARED[MODULE_OUT_KERNEL_READ_DONE], 1UL); + harness_expect("kernel value read", MODULE_SHARED[MODULE_OUT_KERNEL_VALUE], KERNEL_WORD_VALUE); + harness_expect("no memory fault", harness_fault_count, 0UL); + + harness_expect("module stop", (ULONG) txm_module_manager_stop(&test_module), (ULONG) TX_SUCCESS); + harness_expect("module unload", (ULONG) txm_module_manager_unload(&test_module), (ULONG) TX_SUCCESS); + harness_expect("module memory returned", harness_module_pool_available(), available_before); +} |