2  * mpx-mini-test.c: routines to test Intel MPX (Memory Protection eXtentions)
15  * 2014-12-05: Dave Hansen: fixed all of the compiler warnings, and made sure
16  *	       it works on 32-bit.
20 int zap_all_every_this_many_mallocs = 1000;
39 #include "mpx-hw.h"
40 #include "mpx-debug.h"
41 #include "mpx-mm.h"
109 		unsigned int *ecx, unsigned int *edx)  in __cpuid()  argument
111 	/* ecx is often an input as well as an output. */  in __cpuid()
119 		  "=c" (*ecx),  in __cpuid()
121 		: "0" (*eax), "2" (*ecx));  in __cpuid()
135 		unsigned int *ecx, unsigned int *edx)  in __cpuid()  argument
137 	/* ecx is often an input as well as an output. */  in __cpuid()
142 		  "=c" (*ecx),  in __cpuid()
144 		: "0" (*eax), "2" (*ecx));  in __cpuid()
216 		(uint8_t *)uctxt->uc_mcontext.fpregs + XSAVE_OFFSET_IN_FPMEM,  in read_mpx_status_sig()
219 	return xsave_buf->bndcsr.status_reg;  in read_mpx_status_sig()
310 	return si->si_lower;  in __si_bounds_lower()
315 	return si->si_upper;  in __si_bounds_upper()
346 	void *sigfault = &si->_sifields._sigfault;  in __si_bounds_hack()
347 	void *end_sigfault = sigfault + sizeof(si->_sifields._sigfault);  in __si_bounds_hack()
367 static int expected_bnd_index = -1;
416 	trapno = uctxt->uc_mcontext.gregs[REG_TRAPNO];  in handler()
417 	ip = uctxt->uc_mcontext.gregs[REG_IP_IDX];  in handler()
420 		typeof(si->si_addr) *si_addr_ptr = &si->si_addr;  in handler()
429 		dprintf2("si_signo: %d\n", si->si_signo);  in handler()
431 		dprintf2("info->si_code == SEGV_BNDERR: %d\n",  in handler()
432 				(si->si_code == SEGV_BNDERR));  in handler()
433 		dprintf2("info->si_code: %d\n", si->si_code);  in handler()
434 		dprintf2("info->si_lower: %p\n", __si_bounds_lower(si));  in handler()
435 		dprintf2("info->si_upper: %p\n", __si_bounds_upper(si));  in handler()
451 				status, (void *)ip, si->si_addr);  in handler()
453 			uctxt->uc_mcontext.gregs[REG_IP_IDX] =  in handler()
465 			uctxt->uc_mcontext.gregs[REG_IP_IDX] =  in handler()
467 			fprintf(stderr, "bound check error: si_addr %p\n", si->si_addr);  in handler()
473 		eprintf("si_addr %p\n", si->si_addr);  in handler()
474 		eprintf("REG_ERR: %lx\n", (unsigned long)uctxt->uc_mcontext.gregs[REG_ERR]);  in handler()
478 		eprintf("si_addr %p\n", si->si_addr);  in handler()
479 		eprintf("REG_ERR: %lx\n", (unsigned long)uctxt->uc_mcontext.gregs[REG_ERR]);  in handler()
486 			       unsigned int *ecx, unsigned int *edx)  in cpuid_count()  argument
489 	*ecx = count;  in cpuid_count()
490 	__cpuid(eax, ebx, ecx, edx);  in cpuid_count()
529 	unsigned int eax, ebx, ecx, edx;  in print_state_component()  local
536 	cpuid_count(XSTATE_CPUID, state_bit_nr, &eax, &ebx, &ecx, &edx);  in print_state_component()
537 	assert(eax || ebx || ecx);  in print_state_component()
539 	state_component_supervisor = ((!ebx) && one_bit(ecx, 0));  in print_state_component()
540 	state_component_user = !one_bit(ecx, 0);  in print_state_component()
541 	state_component_aligned = one_bit(ecx, 1);  in print_state_component()
549 /* Intel-defined CPU features, CPUID level 0x00000001 (ecx) */
555 	unsigned int eax, ebx, ecx, edx;  in check_mpx_support()  local
557 	cpuid_count(1, 0, &eax, &ebx, &ecx, &edx);  in check_mpx_support()
560 	if (!one_bit(ecx, XSAVE_FEATURE_BIT)) {  in check_mpx_support()
565 	if (!one_bit(ecx, OSXSAVE_FEATURE_BIT)) {  in check_mpx_support()
572 	cpuid_count(0, 0, &eax, &ebx, &ecx, &edx);  in check_mpx_support()
581 	cpuid_count(XSTATE_CPUID, 0, &eax, &ebx, &ecx, &edx);  in check_mpx_support()
611 	xsave_buf->xsave_hdr.xstate_bv = 0x10;  in enable_mpx()
612 	xsave_buf->bndcsr.cfg_reg_u = (unsigned long)l1base | 1;  in enable_mpx()
613 	xsave_buf->bndcsr.status_reg = 0;  in enable_mpx()
617 	       xsave_buf->bndcsr.status_reg, xsave_buf->bndcsr.cfg_reg_u);  in enable_mpx()
624 	       xsave_buf->bndcsr.status_reg, xsave_buf->bndcsr.cfg_reg_u);  in enable_mpx()
685 				MAP_ANONYMOUS|MAP_PRIVATE, -1, 0);  in process_specific_init()
686 		if (dir == (void *)-1) {  in process_specific_init()
695 	dprintf1("bounds directory: 0x%p -> 0x%p\n", bounds_dir_ptr,  in process_specific_init()
729 	/*sigset_t - signals to block while in the handler */  in setup_handler()
755 /*-------------- the following is test case ---------------*/
772       0F 1A /r BNDLDX-Load
773       0F 1B /r BNDSTX-Store Extended Bounds Using Address Translation
800 		     : : "c" (ptr), "d" (size-1)  in mpx_clear_bnd0()
810 		     : : "c" (ptr), "d" (size-1)  in mpx_make_bound_helper()
861 	/* 0F 1B /r	BNDSTX-Store Extended Bounds Using Address Translation	*/  in mpx_store_dsc_helper()
871 	/* 0F 1A /r	BNDLDX-Load			*/  in mpx_load_dsc_helper()
928 	return (addr - (unsigned long)addr % sizeof(uint8_t *));  in get_random_addr()
958 	*upper = (unsigned long)ptr + offset - 1;  in mkbnd_shadow()
1042 	/* these are hard-coded to check bnd0 */  in mpx_test_helper1()
1044 	mpx_check_lowerbound_helper((unsigned long)(ptr-1));  in mpx_test_helper1()
1047 	expected_bnd_index = -1;  in mpx_test_helper1()
1052 	check_lowerbound_shadow(ptr-1, 0);  in mpx_test_helper1_shadow()
1160 	int ratio = 1000;  in cover_buf_with_bt_entries()
1172 		buf_len--;  in cover_buf_with_bt_entries()
1200 	return alignme & ~(align_to-1);  in align_down()
1205 	return (alignme + align_to - 1) & ~(align_to-1);  in align_up()
1242 				MAP_ANONYMOUS|MAP_PRIVATE, -1, 0);  in mpx_mini_alloc()
1243 		if (ptr == (void *)-1)  in mpx_mini_alloc()
1252 		 * This isn't quite correct for 32-bit binaries  in mpx_mini_alloc()
1253 		 * on 64-bit kernels since they can use the  in mpx_mini_alloc()
1254 		 * entire 32-bit address space, but it's close  in mpx_mini_alloc()
1303 	mask = alignment-1;  in free_one_malloc()
1364 	/* 1->~1M */  in do_one_malloc()
1365 	sz = (1 + mpx_random() % 1000) * 1000;  in do_one_malloc()
1397 		if ((now - start) > TEST_DURATION_SECS)  in run_timed_test()
1403 		if ((now - last_print > 1) || done) {  in run_timed_test()
1436 		printf("bte[0]: %lx\n", bte->contents[0]);  in insn_test_failed()
1437 		printf("bte[1]: %lx\n", bte->contents[1]);  in insn_test_failed()
1438 		printf("bte[2]: %lx\n", bte->contents[2]);  in insn_test_failed()
1439 		printf("bte[3]: %lx\n", bte->contents[3]);  in insn_test_failed()
1502 		eprintf("ERROR: non-zero number of failures\n");  in check_mpx_insns_and_tables()
1530 	unsigned long skip = MPX_BOUNDS_TABLE_SIZE_BYTES - PAGE_SIZE;  in exhaust_vaddr_space()
1548 				MAP_ANONYMOUS|MAP_PRIVATE, -1, 0);  in exhaust_vaddr_space()
1616 #include "mpx-dig.c"