2  * mpx-mini-test.c: routines to test Intel MPX (Memory Protection eXtentions)
15  * 2014-12-05: Dave Hansen: fixed all of the compiler warnings, and made sure
16  *	       it works on 32-bit.
19 int inspect_every_this_many_mallocs = 100;
39 #include "mpx-hw.h"
40 #include "mpx-debug.h"
41 #include "mpx-mm.h"
53 	char buf[100];  in write_int_to()
181 static __always_inline void xrstor_state(struct xsave_struct *fx, uint64_t mask)  in xrstor_state()  argument
187 		     : : "D" (fx), "m" (*fx), "a" (lmask), "d" (hmask)  in xrstor_state()
195 	unsigned char *fx = _fx;  in xsave_state_1()  local
198 		     : : "D" (fx), "m" (*fx), "a" (lmask), "d" (hmask)  in xsave_state_1()
216 		(uint8_t *)uctxt->uc_mcontext.fpregs + XSAVE_OFFSET_IN_FPMEM,  in read_mpx_status_sig()
219 	return xsave_buf->bndcsr.status_reg;  in read_mpx_status_sig()
230 	uint8_t base;  in get_next_inst_ip()  local
261 	base = 8;  in get_next_inst_ip()
269 			base = sib & 7;  in get_next_inst_ip()
272 				if (base == 5)  in get_next_inst_ip()
289 				/* DISP32 addressing, no base */  in get_next_inst_ip()
310 	return si->si_lower;  in __si_bounds_lower()
315 	return si->si_upper;  in __si_bounds_upper()
346 	void *sigfault = &si->_sifields._sigfault;  in __si_bounds_hack()
347 	void *end_sigfault = sigfault + sizeof(si->_sifields._sigfault);  in __si_bounds_hack()
367 static int expected_bnd_index = -1;
416 	trapno = uctxt->uc_mcontext.gregs[REG_TRAPNO];  in handler()
417 	ip = uctxt->uc_mcontext.gregs[REG_IP_IDX];  in handler()
420 		typeof(si->si_addr) *si_addr_ptr = &si->si_addr;  in handler()
429 		dprintf2("si_signo: %d\n", si->si_signo);  in handler()
431 		dprintf2("info->si_code == SEGV_BNDERR: %d\n",  in handler()
432 				(si->si_code == SEGV_BNDERR));  in handler()
433 		dprintf2("info->si_code: %d\n", si->si_code);  in handler()
434 		dprintf2("info->si_lower: %p\n", __si_bounds_lower(si));  in handler()
435 		dprintf2("info->si_upper: %p\n", __si_bounds_upper(si));  in handler()
451 				status, (void *)ip, si->si_addr);  in handler()
453 			uctxt->uc_mcontext.gregs[REG_IP_IDX] =  in handler()
465 			uctxt->uc_mcontext.gregs[REG_IP_IDX] =  in handler()
467 			fprintf(stderr, "bound check error: si_addr %p\n", si->si_addr);  in handler()
473 		eprintf("si_addr %p\n", si->si_addr);  in handler()
474 		eprintf("REG_ERR: %lx\n", (unsigned long)uctxt->uc_mcontext.gregs[REG_ERR]);  in handler()
478 		eprintf("si_addr %p\n", si->si_addr);  in handler()
479 		eprintf("REG_ERR: %lx\n", (unsigned long)uctxt->uc_mcontext.gregs[REG_ERR]);  in handler()
549 /* Intel-defined CPU features, CPUID level 0x00000001 (ecx) */
611 	xsave_buf->xsave_hdr.xstate_bv = 0x10;  in enable_mpx()
612 	xsave_buf->bndcsr.cfg_reg_u = (unsigned long)l1base | 1;  in enable_mpx()
613 	xsave_buf->bndcsr.status_reg = 0;  in enable_mpx()
617 	       xsave_buf->bndcsr.status_reg, xsave_buf->bndcsr.cfg_reg_u);  in enable_mpx()
624 	       xsave_buf->bndcsr.status_reg, xsave_buf->bndcsr.cfg_reg_u);  in enable_mpx()
685 				MAP_ANONYMOUS|MAP_PRIVATE, -1, 0);  in process_specific_init()
686 		if (dir == (void *)-1) {  in process_specific_init()
695 	dprintf1("bounds directory: 0x%p -> 0x%p\n", bounds_dir_ptr,  in process_specific_init()
729 	/*sigset_t - signals to block while in the handler */  in setup_handler()
755 /*-------------- the following is test case ---------------*/
769 #define TEST_ROUNDS 100
772       0F 1A /r BNDLDX-Load
773       0F 1B /r BNDSTX-Store Extended Bounds Using Address Translation
786 	unsigned char *fx = _fx;  in xsave_state()  local
789 		     : : "D" (fx), "m" (*fx), "a" (lmask), "d" (hmask)  in xsave_state()
800 		     : : "c" (ptr), "d" (size-1)  in mpx_clear_bnd0()
810 		     : : "c" (ptr), "d" (size-1)  in mpx_make_bound_helper()
861 	/* 0F 1B /r	BNDSTX-Store Extended Bounds Using Address Translation	*/  in mpx_store_dsc_helper()
871 	/* 0F 1A /r	BNDLDX-Load			*/  in mpx_load_dsc_helper()
928 	return (addr - (unsigned long)addr % sizeof(uint8_t *));  in get_random_addr()
958 	*upper = (unsigned long)ptr + offset - 1;  in mkbnd_shadow()
1042 	/* these are hard-coded to check bnd0 */  in mpx_test_helper1()
1044 	mpx_check_lowerbound_helper((unsigned long)(ptr-1));  in mpx_test_helper1()
1047 	expected_bnd_index = -1;  in mpx_test_helper1()
1052 	check_lowerbound_shadow(ptr-1, 0);  in mpx_test_helper1_shadow()
1163 	/* Fill about 1/100 of the space with bt entries */  in cover_buf_with_bt_entries()
1172 		buf_len--;  in cover_buf_with_bt_entries()
1200 	return alignme & ~(align_to-1);  in align_down()
1205 	return (alignme + align_to - 1) & ~(align_to-1);  in align_up()
1242 				MAP_ANONYMOUS|MAP_PRIVATE, -1, 0);  in mpx_mini_alloc()
1243 		if (ptr == (void *)-1)  in mpx_mini_alloc()
1252 		 * This isn't quite correct for 32-bit binaries  in mpx_mini_alloc()
1253 		 * on 64-bit kernels since they can use the  in mpx_mini_alloc()
1254 		 * entire 32-bit address space, but it's close  in mpx_mini_alloc()
1283 #define NR_MALLOCS 100
1303 	mask = alignment-1;  in free_one_malloc()
1364 	/* 1->~1M */  in do_one_malloc()
1397 		if ((now - start) > TEST_DURATION_SECS)  in run_timed_test()
1403 		if ((now - last_print > 1) || done) {  in run_timed_test()
1436 		printf("bte[0]: %lx\n", bte->contents[0]);  in insn_test_failed()
1437 		printf("bte[1]: %lx\n", bte->contents[1]);  in insn_test_failed()
1438 		printf("bte[2]: %lx\n", bte->contents[2]);  in insn_test_failed()
1439 		printf("bte[3]: %lx\n", bte->contents[3]);  in insn_test_failed()
1502 		eprintf("ERROR: non-zero number of failures\n");  in check_mpx_insns_and_tables()
1530 	unsigned long skip = MPX_BOUNDS_TABLE_SIZE_BYTES - PAGE_SIZE;  in exhaust_vaddr_space()
1548 				MAP_ANONYMOUS|MAP_PRIVATE, -1, 0);  in exhaust_vaddr_space()
1616 #include "mpx-dig.c"