1 // SPDX-License-Identifier: LGPL-2.1-or-later
2 /*
3 * Copyright (C) 2005-2006 David Gibson & Adam Litke, IBM Corporation.
4 * Author: David Gibson & Adam Litke
5 */
6
7 /*\
8 * [Description]
9 * On some old ppc64 kernel, when huge page is mapped at below touching
10 * 32 bit boundary (4GB - hpage_size), and normal page is mmaped
11 * at just above it, it triggers a bug caused by off-by-one error.
12 *
13 * WARNING: The offsets and addresses used within are specifically
14 * calculated to trigger the bug as it existed. Don't mess with them
15 * unless you *really* know what you're doing.
16 */
17
18 #define _GNU_SOURCE
19 #include <stdio.h>
20 #include <sys/mount.h>
21 #include <limits.h>
22 #include <sys/param.h>
23 #include <sys/types.h>
24
25 #include "hugetlb.h"
26
27 #define FOURGB (1ULL << 32)
28 #define MNTPOINT "hugetlbfs/"
29 static int fd = -1;
30 static unsigned long long hpage_size;
31 static int page_size;
32
run_test(void)33 static void run_test(void)
34 {
35 void *p, *q = NULL, *r = NULL;
36 unsigned long long lowaddr, highaddr;
37 unsigned long long below_start;
38 unsigned long long above_end;
39
40 /*
41 * We use a low address right below 4GB so we can test for
42 * off-by-one errors
43 */
44 lowaddr = FOURGB - hpage_size;
45 tst_res(TINFO, "Mapping hugepage at %llx...", lowaddr);
46 p = mmap((void *)lowaddr, hpage_size, PROT_READ|PROT_WRITE,
47 MAP_SHARED|MAP_FIXED, fd, 0);
48 if (p == MAP_FAILED) {
49 /* This is last low slice - 256M just before 4G */
50 below_start = FOURGB - 256ULL*1024*1024;
51 above_end = FOURGB;
52
53 if (range_is_mapped(below_start, above_end) == 1) {
54 tst_res(TINFO|TERRNO, "region (4G-256M)-4G is not free & "
55 "mmap() failed expected");
56 tst_res(TPASS, "Successful but inconclusive");
57 } else
58 tst_res(TFAIL|TERRNO, "mmap() huge failed unexpected");
59 goto cleanup;
60 }
61 if (p != (void *)lowaddr) {
62 tst_res(TFAIL, "Wrong address with MAP_FIXED huge");
63 goto cleanup;
64 }
65 memset(p, 0, hpage_size);
66
67 /* Test for off by one errors */
68 highaddr = FOURGB;
69 tst_res(TINFO, "Mapping normal page at %llx...", highaddr);
70 q = mmap((void *)highaddr, page_size, PROT_READ|PROT_WRITE,
71 MAP_SHARED|MAP_FIXED|MAP_ANONYMOUS, 0, 0);
72 if (q == MAP_FAILED) {
73 below_start = FOURGB;
74 above_end = FOURGB + page_size;
75
76 if (range_is_mapped(below_start, above_end) == 1) {
77 tst_res(TINFO|TERRNO, "region 4G-(4G+page) is not free & "
78 "mmap() failed expected");
79 tst_res(TPASS, "Successful but inconclusive");
80 } else
81 tst_res(TFAIL|TERRNO, "mmap() normal 1 failed unexpected");
82 goto cleanup;
83 }
84 if (q != (void *)highaddr) {
85 tst_res(TFAIL, "Wrong address with MAP_FIXED normal 1");
86 goto cleanup;
87 }
88 memset(q, 0, page_size);
89
90 /*
91 * Why this address? Well on ppc64, we're working with 256MB
92 * segment numbers, hence >>28. In practice the shift
93 * instructions only start wrapping around with shifts 128 or
94 * greater.
95 */
96 highaddr = ((lowaddr >> 28) + 128) << 28;
97 tst_res(TINFO, "Mapping normal page at %llx...", highaddr);
98 r = mmap((void *)highaddr, page_size, PROT_READ|PROT_WRITE,
99 MAP_SHARED|MAP_FIXED|MAP_ANONYMOUS, 0, 0);
100 if (r == MAP_FAILED) {
101 below_start = highaddr;
102 above_end = highaddr + page_size;
103
104 if (range_is_mapped(below_start, above_end) == 1) {
105 tst_res(TINFO|TERRNO, "region haddr-(haddr+page) not free & "
106 "mmap() failed unexpected");
107 tst_res(TPASS, "Successful but inconclusive");
108 }
109 tst_res(TFAIL|TERRNO, "mmap() normal 2 failed unexpected");
110 goto cleanup;
111 }
112 if (r != (void *)highaddr) {
113 tst_res(TFAIL, "Wrong address with MAP_FIXED normal 2");
114 goto cleanup;
115 }
116 memset(r, 0, page_size);
117 tst_res(TPASS, "Successful");
118
119 cleanup:
120 if (p && p != MAP_FAILED)
121 SAFE_MUNMAP(p, hpage_size);
122 if (q && q != MAP_FAILED)
123 SAFE_MUNMAP(q, page_size);
124 if (r && r != MAP_FAILED)
125 SAFE_MUNMAP(r, page_size);
126 }
127
setup(void)128 static void setup(void)
129 {
130 page_size = getpagesize();
131 hpage_size = SAFE_READ_MEMINFO("Hugepagesize:")*1024;
132
133 if (sizeof(void *) <= 4)
134 tst_brk(TCONF, "Machine must be >32 bit");
135 if (hpage_size > FOURGB)
136 tst_brk(TCONF, "Huge page size is too large");
137 fd = tst_creat_unlinked(MNTPOINT, 0);
138 }
139
cleanup(void)140 static void cleanup(void)
141 {
142 if (fd > 0)
143 SAFE_CLOSE(fd);
144 }
145
146 static struct tst_test test = {
147 .tags = (struct tst_tag[]) {
148 {"linux-git", "9a94c5793a7b"},
149 {}
150 },
151 .needs_root = 1,
152 .mntpoint = MNTPOINT,
153 .needs_hugetlbfs = 1,
154 .needs_tmpdir = 1,
155 .setup = setup,
156 .cleanup = cleanup,
157 .test_all = run_test,
158 .hugepages = {2, TST_NEEDS},
159 };
160