tests/misc-test.cc - 3p/cheriot-rtos - Git at Google

 // Copyright CHERIoT Contributors.
 // SPDX-License-Identifier: MIT

 #define TEST_NAME "Test misc APIs"
 #include "tests.hh"
 #include <compartment-macros.h>
 #include <ds/pointer.h>
 #include <string.h>
 #include <timeout.h>

 using namespace CHERI;

 namespace
 {

 	/**
 	 * Test timeouts.
 	 *
 	 * This test checks the following:
 	 *
 	 * - A timeout of zero would not block.
 	 * - `elapse` saturates values, i.e., a `remaining` value of zero will still
 	 * be zero after a call to `elapse`, and an `elapsed` value of `UINT32_MAX`
 	 *   would still be `UINT32_MAX` after a call to `elapse`.
 	 * - An unlimited timeout is really unlimited, i.e., a call to `elapse` does
 	 *   not modify its `remaining` value, which blocks.
 	 */
 	void check_timeouts()
 	{
 		debug_log("Test timeouts.");

 		// Create a zero timeout.
 		Timeout t{0};
 		// Ensure that a zero timeout does not block.
 		TEST(!t.may_block(), "A zero timeout should not block.");

 		// Create a zero timer with maximum elapsed time.
 		t = Timeout{UINT32_MAX /* elapsed */, 0 /* remaining */};
 		// Ensure that a call to `elapse` saturates both `elapsed` and
 		// `remaining`.
 		t.elapse(42);
 		TEST(
 		  t.remaining == 0,
 		  "`elapse` does not saturate the `remaining` value of a zero timer.");
 		TEST(t.elapsed == UINT32_MAX,
 		     "`elapse` does not saturate the `elapsed` value of a zero timer.");

 		// Create an unlimited timeout.
 		t = Timeout{UnlimitedTimeout /* remaining */};
 		// Ensure that a call to `elapse` does not modify the `remaining` value
 		// of the unlimited timeout.
 		t.elapse(42);
 		TEST(t.remaining == UnlimitedTimeout,
 		     "`elapse` alters the remaining value of an unlimited timeout.");
 		// Ensure that an unlimited timeout blocks.
 		TEST(t.may_block(), "An unlimited timeout should block.");
 	}

 	/**
 	 * Test memchr.
 	 *
 	 * This test checks the following:
 	 *
 	 * - memchr finds the first occurrence of the character when it is present
 	 *   (test for different values, particularly the first and the last one).
 	 * - memchr returns NULL when the string does not contain the character
 	 * (test for non-NULL terminated string).
 	 * - memchr does not stop at \0 characters.
 	 * - memchr returns NULL for 0-size pointers.
 	 */
 	void check_memchr()
 	{
 		debug_log("Test memchr.");

 		char string[] = {'C', 'H', 'E', 'R', 'R', 'I', 'E', 'S'};

 		TEST(memchr(string, 'C', sizeof(string)) == &string[0],
 		     "memchr must return the first occurence of the character.");
 		TEST(memchr(string, 'R', sizeof(string)) == &string[3],
 		     "memchr must return the first occurence of the character.");
 		TEST(memchr(string, 'S', sizeof(string)) == &string[7],
 		     "memchr must return the first occurence of the character.");
 		TEST(memchr(string, 'X', sizeof(string)) == NULL,
 		     "memchr must return NULL when a character is not present.");

 		char stringWithNull[] = {'Y', 'E', 'S', '\0', 'N', 'O', '\0'};

 		TEST(memchr(stringWithNull, 'N', sizeof(stringWithNull)) ==
 		       &stringWithNull[4],
 		     "memchr must not stop at NULL characters.");

 		TEST(memchr(stringWithNull, 'N', 0) == NULL,
 		     "memchr must return NULL for zero-size pointers.");
 	}

 	/**
 	 * Test memrchr.
 	 *
 	 * This test checks the following:
 	 *
 	 * - memrchr finds the first occurrence of the character when it is present
 	 *   (test for different values, particularly the first and the last one).
 	 * - memrchr returns NULL when the string does not contain the character
 	 * (test for non-NULL terminated string).
 	 * - memrchr does not stop at \0 characters.
 	 * - memrchr returns NULL for 0-size pointers.
 	 */
 	void check_memrchr()
 	{
 		debug_log("Test memrchr.");

 		char string[] = {'C', 'H', 'E', 'R', 'R', 'I', 'O', 'T'};

 		TEST(memchr(string, 'C', sizeof(string)) == &string[0],
 		     "memrchr must return the first occurence of the character.");
 		TEST(memrchr(string, 'R', sizeof(string)) == &string[4],
 		     "memrchr must return the first occurence of the character.");
 		TEST(memrchr(string, 'T', sizeof(string)) == &string[7],
 		     "memrchr must return the first occurence of the character.");
 		TEST(memrchr(string, 'X', sizeof(string)) == NULL,
 		     "memrchr must return NULL when a character is not present.");

 		char stringWithNull[] = {'F', 'U', '\0', 'B', 'A', 'R', '\0'};

 		TEST(memrchr(stringWithNull, 'F', sizeof(stringWithNull)) ==
 		       &stringWithNull[0],
 		     "memrchr must not stop at NULL characters.");

 		TEST(memrchr(stringWithNull, 'Y', 0) == NULL,
 		     "memrchr must return NULL for zero-size pointers.");
 	}

 	/**
 	 * Test pointer utilities.
 	 *
 	 * Not comprehensive, would benefit from being expanded at some point.
 	 */
 	void check_pointer_utilities()
 	{
 		debug_log("Test pointer utilities.");

 		int                              integer        = 42;
 		int                             *integerPointer = &integer;
 		ds::pointer::proxy::Pointer<int> pointer{integerPointer};

 		TEST((pointer == integerPointer) && (*pointer == 42),
 		     "The pointer proxy does not return the value of its proxy.");

 		int  anotherInteger        = -100;
 		int *anotherIntegerPointer = &anotherInteger;
 		ds::pointer::proxy::Pointer<int> anotherPointer{anotherIntegerPointer};

 		pointer = anotherPointer;

 		TEST(
 		  (pointer == anotherIntegerPointer) && (*pointer == -100),
 		  "The pointer proxy `=` operator does not correctly set the pointer.");
 	}

 	void check_shared_object(const char      *name,
 	                         Capability<void> object,
 	                         size_t           size,
 	                         PermissionSet    permissions)
 	{
 		debug_log("Checking shared object {}.", object);
 		TEST(object.length() == size,
 		     "Object {} is {} bytes, expected {}",
 		     name,
 		     object.length(),
 		     size);
 		TEST(object.permissions() == permissions,
 		     "Object {} has permissions {}, expected {}",
 		     name,
 		     PermissionSet{object.permissions()},
 		     permissions);
 	}

 	// This test is somewhat intimately familiar with parameters of CHERIoT's
 	// capability encoding and so might need revision if that changes.
 	void check_capability_set_inexact_at_most()
 	{
 		void *p = malloc(3128);

 		debug_log("Test Capability::BoundsProxy::set_inexact_at_most with {}",
 		          p);

 		// Too many bits for mantissa, regardless of base alignment
 		{
 			Capability<void> q      = {p};
 			size_t           reqlen = 2047;
 			q.bounds().set_inexact_at_most(reqlen);
 			debug_log("Requesting 2047 gives {}: {}", q.length(), q);
 			TEST(q.is_valid(), "set_inexact_at_most untagged");
 			TEST(q.length() < 2047, "set_inexact_at_most failed to truncate");
 			TEST(q.base() == q.address(), "set_inexact_at_most nonzero offset");
 		}

 		// Fits in mantissa, but not reachable from misaligned base
 		{
 			Capability<void> q = {p};
 			q.address() += 2;
 			size_t reqlen = 1024;
 			q.bounds().set_inexact_at_most(reqlen);
 			debug_log("Requesting 1024 at align 2 gives {}: {}", q.length(), q);
 			TEST(q.is_valid(), "set_inexact_at_most untagged");
 			TEST(q.length() < 1024, "set_inexact_at_most failed to truncate");
 			TEST(q.base() == q.address(), "set_inexact_at_most nonzero offset");
 		}

 		// Fits in mantissa and reachable from misaligned base
 		{
 			Capability<void> q = {p};
 			q.address() += 1;
 			size_t reqlen = 511;
 			q.bounds().set_inexact_at_most(reqlen);
 			debug_log("Requesting 511 at align 1 gives {}: {}", q.length(), q);
 			TEST(q.is_valid(), "set_inexact_at_most untagged");
 			TEST(q.length() == 511,
 			     "set_inexact_at_most truncated unnecessarily");
 			TEST(q.base() == q.address(), "set_inexact_at_most nonzero offset");
 		}

 		free(p);
 	}

 	/**
 	 * This is a regression test for #368.  There are many different ways for
 	 * the compiler to generate a memcmp call and this manages to trigger one of
 	 * the ones that wasn't being mangled the same way as others.  The run-time
 	 * behaviour of this test is irrelevant, we should get a linker failure if
 	 * the freestanding library and the compiler disagree on function names.
 	 */
 	void check_odd_memcmp()
 	{
 		std::string first  = "first";
 		std::string second = "second";
 		TEST((first == second) == false,
 		     "This test should never fail but exists to make sure that a "
 		     "comparison result is used");
 	}
 } // namespace

 void check_sealed_scoping()
 {
 	Capability<void> o{switcher_current_thread()};
 	TEST(o.is_valid() && (o.type() == CheriSealTypeSealedTrustedStacks),
 	     "Shared object cap not as expected: {}",
 	     o);

 	// Take the address of the o cap, requiring that it go out to memory.
 	Capability<Capability<void>> oP{&o};

 	/*
 	 * Load a copy of our sealed o cap through an authority that lacks
 	 * LoadGlobal permission.  The result should be identical to the original
 	 * but without global permission.
 	 */
 	Capability<Capability<void>> oPNoLoadGlobal = oP;
 	oPNoLoadGlobal.without_permissions(Permission::LoadGlobal);
 	const Capability<void> OLocal1 = *oPNoLoadGlobal;

 	TEST(OLocal1.is_valid(),
 	     "Loading global sealed cap through non-LoadGlobal invalid");
 	TEST_EQUAL(OLocal1.type(),
 	           o.type(),
 	           "Loading global sealed cap through non-LoadGlobal bad type");
 	TEST_EQUAL(OLocal1.permissions(),
 	           o.permissions().without(Permission::Global),
 	           "Loading global sealed cap through non-LoadGlobal bad perms");

 	/*
 	 * Use CAndPerm to shed Global from our o cap.
 	 * Spell this a little oddly to make sure we get CAndPerm with a mask of
 	 * all 1s but Global.  Using oLocal2.permissions().without() would do a
 	 * cgetperm and then candperm.
 	 */
 	Capability<void> oLocal2 = o;
 	oLocal2.without_permissions(Permission::Global);

 	TEST_EQUAL(oLocal2, OLocal1, "CAndPerm ~GL gone wrong");
 }

 int test_misc()
 {
 	check_timeouts();
 	check_memchr();
 	check_memrchr();
 	check_pointer_utilities();
 	check_capability_set_inexact_at_most();
 	check_sealed_scoping();

 	debug_log("Testing shared objects.");
 	check_shared_object("exampleK",
 	                    SHARED_OBJECT(void, exampleK),
 	                    1024,
 	                    {Permission::Global,
 	                     Permission::Load,
 	                     Permission::Store,
 	                     Permission::LoadStoreCapability,
 	                     Permission::LoadMutable});
 	check_shared_object(
 	  "exampleK",
 	  SHARED_OBJECT_WITH_PERMISSIONS(void, exampleK, true, true, false, false),
 	  1024,
 	  {Permission::Global, Permission::Load, Permission::Store});
 	check_shared_object(
 	  "test_word",
 	  SHARED_OBJECT_WITH_PERMISSIONS(void, test_word, true, false, true, false),
 	  4,
 	  {Permission::Global, Permission::Load, Permission::LoadStoreCapability});
 	check_shared_object("test_word",
 	                    SHARED_OBJECT_WITH_PERMISSIONS(
 	                      void, test_word, true, false, false, false),
 	                    4,
 	                    {Permission::Global, Permission::Load});
 	check_odd_memcmp();
 	return 0;
 }
	// Copyright CHERIoT Contributors.
	// SPDX-License-Identifier: MIT

	#define TEST_NAME "Test misc APIs"
	#include "tests.hh"
	#include <compartment-macros.h>
	#include <ds/pointer.h>
	#include <string.h>
	#include <timeout.h>

	using namespace CHERI;

	namespace
	{

	/**
	* Test timeouts.
	*
	* This test checks the following:
	*
	* - A timeout of zero would not block.
	* - `elapse` saturates values, i.e., a `remaining` value of zero will still
	* be zero after a call to `elapse`, and an `elapsed` value of `UINT32_MAX`
	* would still be `UINT32_MAX` after a call to `elapse`.
	* - An unlimited timeout is really unlimited, i.e., a call to `elapse` does
	* not modify its `remaining` value, which blocks.
	*/
	void check_timeouts()
	{
	debug_log("Test timeouts.");

	// Create a zero timeout.
	Timeout t{0};
	// Ensure that a zero timeout does not block.
	TEST(!t.may_block(), "A zero timeout should not block.");

	// Create a zero timer with maximum elapsed time.
	t = Timeout{UINT32_MAX /* elapsed /, 0 / remaining */};
	// Ensure that a call to `elapse` saturates both `elapsed` and
	// `remaining`.
	t.elapse(42);
	TEST(
	t.remaining == 0,
	"`elapse` does not saturate the `remaining` value of a zero timer.");
	TEST(t.elapsed == UINT32_MAX,
	"`elapse` does not saturate the `elapsed` value of a zero timer.");

	// Create an unlimited timeout.
	t = Timeout{UnlimitedTimeout /* remaining */};
	// Ensure that a call to `elapse` does not modify the `remaining` value
	// of the unlimited timeout.
	t.elapse(42);
	TEST(t.remaining == UnlimitedTimeout,
	"`elapse` alters the remaining value of an unlimited timeout.");
	// Ensure that an unlimited timeout blocks.
	TEST(t.may_block(), "An unlimited timeout should block.");
	}

	/**
	* Test memchr.
	*
	* This test checks the following:
	*
	* - memchr finds the first occurrence of the character when it is present
	* (test for different values, particularly the first and the last one).
	* - memchr returns NULL when the string does not contain the character
	* (test for non-NULL terminated string).
	* - memchr does not stop at \0 characters.
	* - memchr returns NULL for 0-size pointers.
	*/
	void check_memchr()
	{
	debug_log("Test memchr.");

	char string[] = {'C', 'H', 'E', 'R', 'R', 'I', 'E', 'S'};

	TEST(memchr(string, 'C', sizeof(string)) == &string[0],
	"memchr must return the first occurence of the character.");
	TEST(memchr(string, 'R', sizeof(string)) == &string[3],
	"memchr must return the first occurence of the character.");
	TEST(memchr(string, 'S', sizeof(string)) == &string[7],
	"memchr must return the first occurence of the character.");
	TEST(memchr(string, 'X', sizeof(string)) == NULL,
	"memchr must return NULL when a character is not present.");

	char stringWithNull[] = {'Y', 'E', 'S', '\0', 'N', 'O', '\0'};

	TEST(memchr(stringWithNull, 'N', sizeof(stringWithNull)) ==
	&stringWithNull[4],
	"memchr must not stop at NULL characters.");

	TEST(memchr(stringWithNull, 'N', 0) == NULL,
	"memchr must return NULL for zero-size pointers.");
	}

	/**
	* Test memrchr.
	*
	* This test checks the following:
	*
	* - memrchr finds the first occurrence of the character when it is present
	* (test for different values, particularly the first and the last one).
	* - memrchr returns NULL when the string does not contain the character
	* (test for non-NULL terminated string).
	* - memrchr does not stop at \0 characters.
	* - memrchr returns NULL for 0-size pointers.
	*/
	void check_memrchr()
	{
	debug_log("Test memrchr.");

	char string[] = {'C', 'H', 'E', 'R', 'R', 'I', 'O', 'T'};

	TEST(memchr(string, 'C', sizeof(string)) == &string[0],
	"memrchr must return the first occurence of the character.");
	TEST(memrchr(string, 'R', sizeof(string)) == &string[4],
	"memrchr must return the first occurence of the character.");
	TEST(memrchr(string, 'T', sizeof(string)) == &string[7],
	"memrchr must return the first occurence of the character.");
	TEST(memrchr(string, 'X', sizeof(string)) == NULL,
	"memrchr must return NULL when a character is not present.");

	char stringWithNull[] = {'F', 'U', '\0', 'B', 'A', 'R', '\0'};

	TEST(memrchr(stringWithNull, 'F', sizeof(stringWithNull)) ==
	&stringWithNull[0],
	"memrchr must not stop at NULL characters.");

	TEST(memrchr(stringWithNull, 'Y', 0) == NULL,
	"memrchr must return NULL for zero-size pointers.");
	}

	/**
	* Test pointer utilities.
	*
	* Not comprehensive, would benefit from being expanded at some point.
	*/
	void check_pointer_utilities()
	{
	debug_log("Test pointer utilities.");

	int integer = 42;
	int *integerPointer = &integer;
	ds::pointer::proxy::Pointer<int> pointer{integerPointer};

	TEST((pointer == integerPointer) && (*pointer == 42),
	"The pointer proxy does not return the value of its proxy.");

	int anotherInteger = -100;
	int *anotherIntegerPointer = &anotherInteger;
	ds::pointer::proxy::Pointer<int> anotherPointer{anotherIntegerPointer};

	pointer = anotherPointer;

	TEST(
	(pointer == anotherIntegerPointer) && (*pointer == -100),
	"The pointer proxy `=` operator does not correctly set the pointer.");
	}

	void check_shared_object(const char *name,
	Capability<void> object,
	size_t size,
	PermissionSet permissions)
	{
	debug_log("Checking shared object {}.", object);
	TEST(object.length() == size,
	"Object {} is {} bytes, expected {}",
	name,
	object.length(),
	size);
	TEST(object.permissions() == permissions,
	"Object {} has permissions {}, expected {}",
	name,
	PermissionSet{object.permissions()},
	permissions);
	}

	// This test is somewhat intimately familiar with parameters of CHERIoT's
	// capability encoding and so might need revision if that changes.
	void check_capability_set_inexact_at_most()
	{
	void *p = malloc(3128);

	debug_log("Test Capability::BoundsProxy::set_inexact_at_most with {}",
	p);

	// Too many bits for mantissa, regardless of base alignment
	{
	Capability<void> q = {p};
	size_t reqlen = 2047;
	q.bounds().set_inexact_at_most(reqlen);
	debug_log("Requesting 2047 gives {}: {}", q.length(), q);
	TEST(q.is_valid(), "set_inexact_at_most untagged");
	TEST(q.length() < 2047, "set_inexact_at_most failed to truncate");
	TEST(q.base() == q.address(), "set_inexact_at_most nonzero offset");
	}

	// Fits in mantissa, but not reachable from misaligned base
	{
	Capability<void> q = {p};
	q.address() += 2;
	size_t reqlen = 1024;
	q.bounds().set_inexact_at_most(reqlen);
	debug_log("Requesting 1024 at align 2 gives {}: {}", q.length(), q);
	TEST(q.is_valid(), "set_inexact_at_most untagged");
	TEST(q.length() < 1024, "set_inexact_at_most failed to truncate");
	TEST(q.base() == q.address(), "set_inexact_at_most nonzero offset");
	}

	// Fits in mantissa and reachable from misaligned base
	{
	Capability<void> q = {p};
	q.address() += 1;
	size_t reqlen = 511;
	q.bounds().set_inexact_at_most(reqlen);
	debug_log("Requesting 511 at align 1 gives {}: {}", q.length(), q);
	TEST(q.is_valid(), "set_inexact_at_most untagged");
	TEST(q.length() == 511,
	"set_inexact_at_most truncated unnecessarily");
	TEST(q.base() == q.address(), "set_inexact_at_most nonzero offset");
	}

	free(p);
	}

	/**
	* This is a regression test for #368. There are many different ways for
	* the compiler to generate a memcmp call and this manages to trigger one of
	* the ones that wasn't being mangled the same way as others. The run-time
	* behaviour of this test is irrelevant, we should get a linker failure if
	* the freestanding library and the compiler disagree on function names.
	*/
	void check_odd_memcmp()
	{
	std::string first = "first";
	std::string second = "second";
	TEST((first == second) == false,
	"This test should never fail but exists to make sure that a "
	"comparison result is used");
	}
	} // namespace

	void check_sealed_scoping()
	{
	Capability<void> o{switcher_current_thread()};
	TEST(o.is_valid() && (o.type() == CheriSealTypeSealedTrustedStacks),
	"Shared object cap not as expected: {}",
	o);

	// Take the address of the o cap, requiring that it go out to memory.
	Capability<Capability<void>> oP{&o};

	/*
	* Load a copy of our sealed o cap through an authority that lacks
	* LoadGlobal permission. The result should be identical to the original
	* but without global permission.
	*/
	Capability<Capability<void>> oPNoLoadGlobal = oP;
	oPNoLoadGlobal.without_permissions(Permission::LoadGlobal);
	const Capability<void> OLocal1 = *oPNoLoadGlobal;

	TEST(OLocal1.is_valid(),
	"Loading global sealed cap through non-LoadGlobal invalid");
	TEST_EQUAL(OLocal1.type(),
	o.type(),
	"Loading global sealed cap through non-LoadGlobal bad type");
	TEST_EQUAL(OLocal1.permissions(),
	o.permissions().without(Permission::Global),
	"Loading global sealed cap through non-LoadGlobal bad perms");

	/*
	* Use CAndPerm to shed Global from our o cap.
	* Spell this a little oddly to make sure we get CAndPerm with a mask of
	* all 1s but Global. Using oLocal2.permissions().without() would do a
	* cgetperm and then candperm.
	*/
	Capability<void> oLocal2 = o;
	oLocal2.without_permissions(Permission::Global);

	TEST_EQUAL(oLocal2, OLocal1, "CAndPerm ~GL gone wrong");
	}

	int test_misc()
	{
	check_timeouts();
	check_memchr();
	check_memrchr();
	check_pointer_utilities();
	check_capability_set_inexact_at_most();
	check_sealed_scoping();

	debug_log("Testing shared objects.");
	check_shared_object("exampleK",
	SHARED_OBJECT(void, exampleK),
	1024,
	{Permission::Global,
	Permission::Load,
	Permission::Store,
	Permission::LoadStoreCapability,
	Permission::LoadMutable});
	check_shared_object(
	"exampleK",
	SHARED_OBJECT_WITH_PERMISSIONS(void, exampleK, true, true, false, false),
	1024,
	{Permission::Global, Permission::Load, Permission::Store});
	check_shared_object(
	"test_word",
	SHARED_OBJECT_WITH_PERMISSIONS(void, test_word, true, false, true, false),
	4,
	{Permission::Global, Permission::Load, Permission::LoadStoreCapability});
	check_shared_object("test_word",
	SHARED_OBJECT_WITH_PERMISSIONS(
	void, test_word, true, false, false, false),
	4,
	{Permission::Global, Permission::Load});
	check_odd_memcmp();
	return 0;
	}