1 /*
2 * Tests x86 Memory Protection Keys (see Documentation/x86/protection-keys.txt)
3 *
4 * There are examples in here of:
5 * * how to set protection keys on memory
6 * * how to set/clear bits in PKRU (the rights register)
7 * * how to handle SEGV_PKRU signals and extract pkey-relevant
8 * information from the siginfo
9 *
10 * Things to add:
11 * make sure KSM and KSM COW breaking works
12 * prefault pages in at malloc, or not
13 * protect MPX bounds tables with protection keys?
14 * make sure VMA splitting/merging is working correctly
15 * OOMs can destroy mm->mmap (see exit_mmap()), so make sure it is immune to pkeys
16 * look for pkey "leaks" where it is still set on a VMA but "freed" back to the kernel
17 * do a plain mprotect() to a mprotect_pkey() area and make sure the pkey sticks
18 *
19 * Compile like this:
20 * gcc -o protection_keys -O2 -g -std=gnu99 -pthread -Wall protection_keys.c -lrt -ldl -lm
21 * gcc -m32 -o protection_keys_32 -O2 -g -std=gnu99 -pthread -Wall protection_keys.c -lrt -ldl -lm
22 */
23 #define _GNU_SOURCE
24 #include <errno.h>
25 #include <linux/futex.h>
26 #include <sys/time.h>
27 #include <sys/syscall.h>
28 #include <string.h>
29 #include <stdio.h>
30 #include <stdint.h>
31 #include <stdbool.h>
32 #include <signal.h>
33 #include <assert.h>
34 #include <stdlib.h>
35 #include <ucontext.h>
36 #include <sys/mman.h>
37 #include <sys/types.h>
38 #include <sys/wait.h>
39 #include <sys/stat.h>
40 #include <fcntl.h>
41 #include <unistd.h>
42 #include <sys/ptrace.h>
43 #include <setjmp.h>
44
45 #include "pkey-helpers.h"
46
47 int iteration_nr = 1;
48 int test_nr;
49
50 unsigned int shadow_pkru;
51
52 #define HPAGE_SIZE (1UL<<21)
53 #define ARRAY_SIZE(x) (sizeof(x) / sizeof(*(x)))
54 #define ALIGN_UP(x, align_to) (((x) + ((align_to)-1)) & ~((align_to)-1))
55 #define ALIGN_DOWN(x, align_to) ((x) & ~((align_to)-1))
56 #define ALIGN_PTR_UP(p, ptr_align_to) ((typeof(p))ALIGN_UP((unsigned long)(p), ptr_align_to))
57 #define ALIGN_PTR_DOWN(p, ptr_align_to) ((typeof(p))ALIGN_DOWN((unsigned long)(p), ptr_align_to))
58 #define __stringify_1(x...) #x
59 #define __stringify(x...) __stringify_1(x)
60
61 #define PTR_ERR_ENOTSUP ((void *)-ENOTSUP)
62
63 int dprint_in_signal;
64 char dprint_in_signal_buffer[DPRINT_IN_SIGNAL_BUF_SIZE];
65
66 extern void abort_hooks(void);
67 #define pkey_assert(condition) do { \
68 if (!(condition)) { \
69 dprintf0("assert() at %s::%d test_nr: %d iteration: %d\n", \
70 __FILE__, __LINE__, \
71 test_nr, iteration_nr); \
72 dprintf0("errno at assert: %d", errno); \
73 abort_hooks(); \
74 assert(condition); \
75 } \
76 } while (0)
77 #define raw_assert(cond) assert(cond)
78
cat_into_file(char * str,char * file)79 void cat_into_file(char *str, char *file)
80 {
81 int fd = open(file, O_RDWR);
82 int ret;
83
84 dprintf2("%s(): writing '%s' to '%s'\n", __func__, str, file);
85 /*
86 * these need to be raw because they are called under
87 * pkey_assert()
88 */
89 raw_assert(fd >= 0);
90 ret = write(fd, str, strlen(str));
91 if (ret != strlen(str)) {
92 perror("write to file failed");
93 fprintf(stderr, "filename: '%s' str: '%s'\n", file, str);
94 raw_assert(0);
95 }
96 close(fd);
97 }
98
99 #if CONTROL_TRACING > 0
100 static int warned_tracing;
tracing_root_ok(void)101 int tracing_root_ok(void)
102 {
103 if (geteuid() != 0) {
104 if (!warned_tracing)
105 fprintf(stderr, "WARNING: not run as root, "
106 "can not do tracing control\n");
107 warned_tracing = 1;
108 return 0;
109 }
110 return 1;
111 }
112 #endif
113
tracing_on(void)114 void tracing_on(void)
115 {
116 #if CONTROL_TRACING > 0
117 #define TRACEDIR "/sys/kernel/debug/tracing"
118 char pidstr[32];
119
120 if (!tracing_root_ok())
121 return;
122
123 sprintf(pidstr, "%d", getpid());
124 cat_into_file("0", TRACEDIR "/tracing_on");
125 cat_into_file("\n", TRACEDIR "/trace");
126 if (1) {
127 cat_into_file("function_graph", TRACEDIR "/current_tracer");
128 cat_into_file("1", TRACEDIR "/options/funcgraph-proc");
129 } else {
130 cat_into_file("nop", TRACEDIR "/current_tracer");
131 }
132 cat_into_file(pidstr, TRACEDIR "/set_ftrace_pid");
133 cat_into_file("1", TRACEDIR "/tracing_on");
134 dprintf1("enabled tracing\n");
135 #endif
136 }
137
tracing_off(void)138 void tracing_off(void)
139 {
140 #if CONTROL_TRACING > 0
141 if (!tracing_root_ok())
142 return;
143 cat_into_file("0", "/sys/kernel/debug/tracing/tracing_on");
144 #endif
145 }
146
abort_hooks(void)147 void abort_hooks(void)
148 {
149 fprintf(stderr, "running %s()...\n", __func__);
150 tracing_off();
151 #ifdef SLEEP_ON_ABORT
152 sleep(SLEEP_ON_ABORT);
153 #endif
154 }
155
__page_o_noops(void)156 static inline void __page_o_noops(void)
157 {
158 /* 8-bytes of instruction * 512 bytes = 1 page */
159 asm(".rept 512 ; nopl 0x7eeeeeee(%eax) ; .endr");
160 }
161
162 /*
163 * This attempts to have roughly a page of instructions followed by a few
164 * instructions that do a write, and another page of instructions. That
165 * way, we are pretty sure that the write is in the second page of
166 * instructions and has at least a page of padding behind it.
167 *
168 * *That* lets us be sure to madvise() away the write instruction, which
169 * will then fault, which makes sure that the fault code handles
170 * execute-only memory properly.
171 */
172 __attribute__((__aligned__(PAGE_SIZE)))
lots_o_noops_around_write(int * write_to_me)173 void lots_o_noops_around_write(int *write_to_me)
174 {
175 dprintf3("running %s()\n", __func__);
176 __page_o_noops();
177 /* Assume this happens in the second page of instructions: */
178 *write_to_me = __LINE__;
179 /* pad out by another page: */
180 __page_o_noops();
181 dprintf3("%s() done\n", __func__);
182 }
183
184 /* Define some kernel-like types */
185 #define u8 uint8_t
186 #define u16 uint16_t
187 #define u32 uint32_t
188 #define u64 uint64_t
189
190 #ifdef __i386__
191 #define SYS_mprotect_key 380
192 #define SYS_pkey_alloc 381
193 #define SYS_pkey_free 382
194 #define REG_IP_IDX REG_EIP
195 #define si_pkey_offset 0x14
196 #else
197 #define SYS_mprotect_key 329
198 #define SYS_pkey_alloc 330
199 #define SYS_pkey_free 331
200 #define REG_IP_IDX REG_RIP
201 #define si_pkey_offset 0x20
202 #endif
203
dump_mem(void * dumpme,int len_bytes)204 void dump_mem(void *dumpme, int len_bytes)
205 {
206 char *c = (void *)dumpme;
207 int i;
208
209 for (i = 0; i < len_bytes; i += sizeof(u64)) {
210 u64 *ptr = (u64 *)(c + i);
211 dprintf1("dump[%03d][@%p]: %016jx\n", i, ptr, *ptr);
212 }
213 }
214
215 #define __SI_FAULT (3 << 16)
216 #define SEGV_BNDERR (__SI_FAULT|3) /* failed address bound checks */
217 #define SEGV_PKUERR (__SI_FAULT|4)
218
si_code_str(int si_code)219 static char *si_code_str(int si_code)
220 {
221 if (si_code & SEGV_MAPERR)
222 return "SEGV_MAPERR";
223 if (si_code & SEGV_ACCERR)
224 return "SEGV_ACCERR";
225 if (si_code & SEGV_BNDERR)
226 return "SEGV_BNDERR";
227 if (si_code & SEGV_PKUERR)
228 return "SEGV_PKUERR";
229 return "UNKNOWN";
230 }
231
232 int pkru_faults;
233 int last_si_pkey = -1;
signal_handler(int signum,siginfo_t * si,void * vucontext)234 void signal_handler(int signum, siginfo_t *si, void *vucontext)
235 {
236 ucontext_t *uctxt = vucontext;
237 int trapno;
238 unsigned long ip;
239 char *fpregs;
240 u32 *pkru_ptr;
241 u64 si_pkey;
242 u32 *si_pkey_ptr;
243 int pkru_offset;
244 fpregset_t fpregset;
245
246 dprint_in_signal = 1;
247 dprintf1(">>>>===============SIGSEGV============================\n");
248 dprintf1("%s()::%d, pkru: 0x%x shadow: %x\n", __func__, __LINE__,
249 __rdpkru(), shadow_pkru);
250
251 trapno = uctxt->uc_mcontext.gregs[REG_TRAPNO];
252 ip = uctxt->uc_mcontext.gregs[REG_IP_IDX];
253 fpregset = uctxt->uc_mcontext.fpregs;
254 fpregs = (void *)fpregset;
255
256 dprintf2("%s() trapno: %d ip: 0x%lx info->si_code: %s/%d\n", __func__,
257 trapno, ip, si_code_str(si->si_code), si->si_code);
258 #ifdef __i386__
259 /*
260 * 32-bit has some extra padding so that userspace can tell whether
261 * the XSTATE header is present in addition to the "legacy" FPU
262 * state. We just assume that it is here.
263 */
264 fpregs += 0x70;
265 #endif
266 pkru_offset = pkru_xstate_offset();
267 pkru_ptr = (void *)(&fpregs[pkru_offset]);
268
269 dprintf1("siginfo: %p\n", si);
270 dprintf1(" fpregs: %p\n", fpregs);
271 /*
272 * If we got a PKRU fault, we *HAVE* to have at least one bit set in
273 * here.
274 */
275 dprintf1("pkru_xstate_offset: %d\n", pkru_xstate_offset());
276 if (DEBUG_LEVEL > 4)
277 dump_mem(pkru_ptr - 128, 256);
278 pkey_assert(*pkru_ptr);
279
280 si_pkey_ptr = (u32 *)(((u8 *)si) + si_pkey_offset);
281 dprintf1("si_pkey_ptr: %p\n", si_pkey_ptr);
282 dump_mem(si_pkey_ptr - 8, 24);
283 si_pkey = *si_pkey_ptr;
284 pkey_assert(si_pkey < NR_PKEYS);
285 last_si_pkey = si_pkey;
286
287 if ((si->si_code == SEGV_MAPERR) ||
288 (si->si_code == SEGV_ACCERR) ||
289 (si->si_code == SEGV_BNDERR)) {
290 printf("non-PK si_code, exiting...\n");
291 exit(4);
292 }
293
294 dprintf1("signal pkru from xsave: %08x\n", *pkru_ptr);
295 /* need __rdpkru() version so we do not do shadow_pkru checking */
296 dprintf1("signal pkru from pkru: %08x\n", __rdpkru());
297 dprintf1("si_pkey from siginfo: %jx\n", si_pkey);
298 *(u64 *)pkru_ptr = 0x00000000;
299 dprintf1("WARNING: set PRKU=0 to allow faulting instruction to continue\n");
300 pkru_faults++;
301 dprintf1("<<<<==================================================\n");
302 return;
303 if (trapno == 14) {
304 fprintf(stderr,
305 "ERROR: In signal handler, page fault, trapno = %d, ip = %016lx\n",
306 trapno, ip);
307 fprintf(stderr, "si_addr %p\n", si->si_addr);
308 fprintf(stderr, "REG_ERR: %lx\n",
309 (unsigned long)uctxt->uc_mcontext.gregs[REG_ERR]);
310 exit(1);
311 } else {
312 fprintf(stderr, "unexpected trap %d! at 0x%lx\n", trapno, ip);
313 fprintf(stderr, "si_addr %p\n", si->si_addr);
314 fprintf(stderr, "REG_ERR: %lx\n",
315 (unsigned long)uctxt->uc_mcontext.gregs[REG_ERR]);
316 exit(2);
317 }
318 dprint_in_signal = 0;
319 }
320
wait_all_children(void)321 int wait_all_children(void)
322 {
323 int status;
324 return waitpid(-1, &status, 0);
325 }
326
sig_chld(int x)327 void sig_chld(int x)
328 {
329 dprint_in_signal = 1;
330 dprintf2("[%d] SIGCHLD: %d\n", getpid(), x);
331 dprint_in_signal = 0;
332 }
333
setup_sigsegv_handler(void)334 void setup_sigsegv_handler(void)
335 {
336 int r, rs;
337 struct sigaction newact;
338 struct sigaction oldact;
339
340 /* #PF is mapped to sigsegv */
341 int signum = SIGSEGV;
342
343 newact.sa_handler = 0;
344 newact.sa_sigaction = signal_handler;
345
346 /*sigset_t - signals to block while in the handler */
347 /* get the old signal mask. */
348 rs = sigprocmask(SIG_SETMASK, 0, &newact.sa_mask);
349 pkey_assert(rs == 0);
350
351 /* call sa_sigaction, not sa_handler*/
352 newact.sa_flags = SA_SIGINFO;
353
354 newact.sa_restorer = 0; /* void(*)(), obsolete */
355 r = sigaction(signum, &newact, &oldact);
356 r = sigaction(SIGALRM, &newact, &oldact);
357 pkey_assert(r == 0);
358 }
359
setup_handlers(void)360 void setup_handlers(void)
361 {
362 signal(SIGCHLD, &sig_chld);
363 setup_sigsegv_handler();
364 }
365
fork_lazy_child(void)366 pid_t fork_lazy_child(void)
367 {
368 pid_t forkret;
369
370 forkret = fork();
371 pkey_assert(forkret >= 0);
372 dprintf3("[%d] fork() ret: %d\n", getpid(), forkret);
373
374 if (!forkret) {
375 /* in the child */
376 while (1) {
377 dprintf1("child sleeping...\n");
378 sleep(30);
379 }
380 }
381 return forkret;
382 }
383
davecmp(void * _a,void * _b,int len)384 void davecmp(void *_a, void *_b, int len)
385 {
386 int i;
387 unsigned long *a = _a;
388 unsigned long *b = _b;
389
390 for (i = 0; i < len / sizeof(*a); i++) {
391 if (a[i] == b[i])
392 continue;
393
394 dprintf3("[%3d]: a: %016lx b: %016lx\n", i, a[i], b[i]);
395 }
396 }
397
dumpit(char * f)398 void dumpit(char *f)
399 {
400 int fd = open(f, O_RDONLY);
401 char buf[100];
402 int nr_read;
403
404 dprintf2("maps fd: %d\n", fd);
405 do {
406 nr_read = read(fd, &buf[0], sizeof(buf));
407 write(1, buf, nr_read);
408 } while (nr_read > 0);
409 close(fd);
410 }
411
412 #define PKEY_DISABLE_ACCESS 0x1
413 #define PKEY_DISABLE_WRITE 0x2
414
pkey_get(int pkey,unsigned long flags)415 u32 pkey_get(int pkey, unsigned long flags)
416 {
417 u32 mask = (PKEY_DISABLE_ACCESS|PKEY_DISABLE_WRITE);
418 u32 pkru = __rdpkru();
419 u32 shifted_pkru;
420 u32 masked_pkru;
421
422 dprintf1("%s(pkey=%d, flags=%lx) = %x / %d\n",
423 __func__, pkey, flags, 0, 0);
424 dprintf2("%s() raw pkru: %x\n", __func__, pkru);
425
426 shifted_pkru = (pkru >> (pkey * PKRU_BITS_PER_PKEY));
427 dprintf2("%s() shifted_pkru: %x\n", __func__, shifted_pkru);
428 masked_pkru = shifted_pkru & mask;
429 dprintf2("%s() masked pkru: %x\n", __func__, masked_pkru);
430 /*
431 * shift down the relevant bits to the lowest two, then
432 * mask off all the other high bits.
433 */
434 return masked_pkru;
435 }
436
pkey_set(int pkey,unsigned long rights,unsigned long flags)437 int pkey_set(int pkey, unsigned long rights, unsigned long flags)
438 {
439 u32 mask = (PKEY_DISABLE_ACCESS|PKEY_DISABLE_WRITE);
440 u32 old_pkru = __rdpkru();
441 u32 new_pkru;
442
443 /* make sure that 'rights' only contains the bits we expect: */
444 assert(!(rights & ~mask));
445
446 /* copy old pkru */
447 new_pkru = old_pkru;
448 /* mask out bits from pkey in old value: */
449 new_pkru &= ~(mask << (pkey * PKRU_BITS_PER_PKEY));
450 /* OR in new bits for pkey: */
451 new_pkru |= (rights << (pkey * PKRU_BITS_PER_PKEY));
452
453 __wrpkru(new_pkru);
454
455 dprintf3("%s(pkey=%d, rights=%lx, flags=%lx) = %x pkru now: %x old_pkru: %x\n",
456 __func__, pkey, rights, flags, 0, __rdpkru(), old_pkru);
457 return 0;
458 }
459
pkey_disable_set(int pkey,int flags)460 void pkey_disable_set(int pkey, int flags)
461 {
462 unsigned long syscall_flags = 0;
463 int ret;
464 int pkey_rights;
465 u32 orig_pkru = rdpkru();
466
467 dprintf1("START->%s(%d, 0x%x)\n", __func__,
468 pkey, flags);
469 pkey_assert(flags & (PKEY_DISABLE_ACCESS | PKEY_DISABLE_WRITE));
470
471 pkey_rights = pkey_get(pkey, syscall_flags);
472
473 dprintf1("%s(%d) pkey_get(%d): %x\n", __func__,
474 pkey, pkey, pkey_rights);
475 pkey_assert(pkey_rights >= 0);
476
477 pkey_rights |= flags;
478
479 ret = pkey_set(pkey, pkey_rights, syscall_flags);
480 assert(!ret);
481 /*pkru and flags have the same format */
482 shadow_pkru |= flags << (pkey * 2);
483 dprintf1("%s(%d) shadow: 0x%x\n", __func__, pkey, shadow_pkru);
484
485 pkey_assert(ret >= 0);
486
487 pkey_rights = pkey_get(pkey, syscall_flags);
488 dprintf1("%s(%d) pkey_get(%d): %x\n", __func__,
489 pkey, pkey, pkey_rights);
490
491 dprintf1("%s(%d) pkru: 0x%x\n", __func__, pkey, rdpkru());
492 if (flags)
493 pkey_assert(rdpkru() > orig_pkru);
494 dprintf1("END<---%s(%d, 0x%x)\n", __func__,
495 pkey, flags);
496 }
497
pkey_disable_clear(int pkey,int flags)498 void pkey_disable_clear(int pkey, int flags)
499 {
500 unsigned long syscall_flags = 0;
501 int ret;
502 int pkey_rights = pkey_get(pkey, syscall_flags);
503 u32 orig_pkru = rdpkru();
504
505 pkey_assert(flags & (PKEY_DISABLE_ACCESS | PKEY_DISABLE_WRITE));
506
507 dprintf1("%s(%d) pkey_get(%d): %x\n", __func__,
508 pkey, pkey, pkey_rights);
509 pkey_assert(pkey_rights >= 0);
510
511 pkey_rights |= flags;
512
513 ret = pkey_set(pkey, pkey_rights, 0);
514 /* pkru and flags have the same format */
515 shadow_pkru &= ~(flags << (pkey * 2));
516 pkey_assert(ret >= 0);
517
518 pkey_rights = pkey_get(pkey, syscall_flags);
519 dprintf1("%s(%d) pkey_get(%d): %x\n", __func__,
520 pkey, pkey, pkey_rights);
521
522 dprintf1("%s(%d) pkru: 0x%x\n", __func__, pkey, rdpkru());
523 if (flags)
524 assert(rdpkru() > orig_pkru);
525 }
526
pkey_write_allow(int pkey)527 void pkey_write_allow(int pkey)
528 {
529 pkey_disable_clear(pkey, PKEY_DISABLE_WRITE);
530 }
pkey_write_deny(int pkey)531 void pkey_write_deny(int pkey)
532 {
533 pkey_disable_set(pkey, PKEY_DISABLE_WRITE);
534 }
pkey_access_allow(int pkey)535 void pkey_access_allow(int pkey)
536 {
537 pkey_disable_clear(pkey, PKEY_DISABLE_ACCESS);
538 }
pkey_access_deny(int pkey)539 void pkey_access_deny(int pkey)
540 {
541 pkey_disable_set(pkey, PKEY_DISABLE_ACCESS);
542 }
543
sys_mprotect_pkey(void * ptr,size_t size,unsigned long orig_prot,unsigned long pkey)544 int sys_mprotect_pkey(void *ptr, size_t size, unsigned long orig_prot,
545 unsigned long pkey)
546 {
547 int sret;
548
549 dprintf2("%s(0x%p, %zx, prot=%lx, pkey=%lx)\n", __func__,
550 ptr, size, orig_prot, pkey);
551
552 errno = 0;
553 sret = syscall(SYS_mprotect_key, ptr, size, orig_prot, pkey);
554 if (errno) {
555 dprintf2("SYS_mprotect_key sret: %d\n", sret);
556 dprintf2("SYS_mprotect_key prot: 0x%lx\n", orig_prot);
557 dprintf2("SYS_mprotect_key failed, errno: %d\n", errno);
558 if (DEBUG_LEVEL >= 2)
559 perror("SYS_mprotect_pkey");
560 }
561 return sret;
562 }
563
sys_pkey_alloc(unsigned long flags,unsigned long init_val)564 int sys_pkey_alloc(unsigned long flags, unsigned long init_val)
565 {
566 int ret = syscall(SYS_pkey_alloc, flags, init_val);
567 dprintf1("%s(flags=%lx, init_val=%lx) syscall ret: %d errno: %d\n",
568 __func__, flags, init_val, ret, errno);
569 return ret;
570 }
571
alloc_pkey(void)572 int alloc_pkey(void)
573 {
574 int ret;
575 unsigned long init_val = 0x0;
576
577 dprintf1("alloc_pkey()::%d, pkru: 0x%x shadow: %x\n",
578 __LINE__, __rdpkru(), shadow_pkru);
579 ret = sys_pkey_alloc(0, init_val);
580 /*
581 * pkey_alloc() sets PKRU, so we need to reflect it in
582 * shadow_pkru:
583 */
584 dprintf4("alloc_pkey()::%d, ret: %d pkru: 0x%x shadow: 0x%x\n",
585 __LINE__, ret, __rdpkru(), shadow_pkru);
586 if (ret) {
587 /* clear both the bits: */
588 shadow_pkru &= ~(0x3 << (ret * 2));
589 dprintf4("alloc_pkey()::%d, ret: %d pkru: 0x%x shadow: 0x%x\n",
590 __LINE__, ret, __rdpkru(), shadow_pkru);
591 /*
592 * move the new state in from init_val
593 * (remember, we cheated and init_val == pkru format)
594 */
595 shadow_pkru |= (init_val << (ret * 2));
596 }
597 dprintf4("alloc_pkey()::%d, ret: %d pkru: 0x%x shadow: 0x%x\n",
598 __LINE__, ret, __rdpkru(), shadow_pkru);
599 dprintf1("alloc_pkey()::%d errno: %d\n", __LINE__, errno);
600 /* for shadow checking: */
601 rdpkru();
602 dprintf4("alloc_pkey()::%d, ret: %d pkru: 0x%x shadow: 0x%x\n",
603 __LINE__, ret, __rdpkru(), shadow_pkru);
604 return ret;
605 }
606
sys_pkey_free(unsigned long pkey)607 int sys_pkey_free(unsigned long pkey)
608 {
609 int ret = syscall(SYS_pkey_free, pkey);
610 dprintf1("%s(pkey=%ld) syscall ret: %d\n", __func__, pkey, ret);
611 return ret;
612 }
613
614 /*
615 * I had a bug where pkey bits could be set by mprotect() but
616 * not cleared. This ensures we get lots of random bit sets
617 * and clears on the vma and pte pkey bits.
618 */
alloc_random_pkey(void)619 int alloc_random_pkey(void)
620 {
621 int max_nr_pkey_allocs;
622 int ret;
623 int i;
624 int alloced_pkeys[NR_PKEYS];
625 int nr_alloced = 0;
626 int random_index;
627 memset(alloced_pkeys, 0, sizeof(alloced_pkeys));
628
629 /* allocate every possible key and make a note of which ones we got */
630 max_nr_pkey_allocs = NR_PKEYS;
631 max_nr_pkey_allocs = 1;
632 for (i = 0; i < max_nr_pkey_allocs; i++) {
633 int new_pkey = alloc_pkey();
634 if (new_pkey < 0)
635 break;
636 alloced_pkeys[nr_alloced++] = new_pkey;
637 }
638
639 pkey_assert(nr_alloced > 0);
640 /* select a random one out of the allocated ones */
641 random_index = rand() % nr_alloced;
642 ret = alloced_pkeys[random_index];
643 /* now zero it out so we don't free it next */
644 alloced_pkeys[random_index] = 0;
645
646 /* go through the allocated ones that we did not want and free them */
647 for (i = 0; i < nr_alloced; i++) {
648 int free_ret;
649 if (!alloced_pkeys[i])
650 continue;
651 free_ret = sys_pkey_free(alloced_pkeys[i]);
652 pkey_assert(!free_ret);
653 }
654 dprintf1("%s()::%d, ret: %d pkru: 0x%x shadow: 0x%x\n", __func__,
655 __LINE__, ret, __rdpkru(), shadow_pkru);
656 return ret;
657 }
658
mprotect_pkey(void * ptr,size_t size,unsigned long orig_prot,unsigned long pkey)659 int mprotect_pkey(void *ptr, size_t size, unsigned long orig_prot,
660 unsigned long pkey)
661 {
662 int nr_iterations = random() % 100;
663 int ret;
664
665 while (0) {
666 int rpkey = alloc_random_pkey();
667 ret = sys_mprotect_pkey(ptr, size, orig_prot, pkey);
668 dprintf1("sys_mprotect_pkey(%p, %zx, prot=0x%lx, pkey=%ld) ret: %d\n",
669 ptr, size, orig_prot, pkey, ret);
670 if (nr_iterations-- < 0)
671 break;
672
673 dprintf1("%s()::%d, ret: %d pkru: 0x%x shadow: 0x%x\n", __func__,
674 __LINE__, ret, __rdpkru(), shadow_pkru);
675 sys_pkey_free(rpkey);
676 dprintf1("%s()::%d, ret: %d pkru: 0x%x shadow: 0x%x\n", __func__,
677 __LINE__, ret, __rdpkru(), shadow_pkru);
678 }
679 pkey_assert(pkey < NR_PKEYS);
680
681 ret = sys_mprotect_pkey(ptr, size, orig_prot, pkey);
682 dprintf1("mprotect_pkey(%p, %zx, prot=0x%lx, pkey=%ld) ret: %d\n",
683 ptr, size, orig_prot, pkey, ret);
684 pkey_assert(!ret);
685 dprintf1("%s()::%d, ret: %d pkru: 0x%x shadow: 0x%x\n", __func__,
686 __LINE__, ret, __rdpkru(), shadow_pkru);
687 return ret;
688 }
689
690 struct pkey_malloc_record {
691 void *ptr;
692 long size;
693 };
694 struct pkey_malloc_record *pkey_malloc_records;
695 long nr_pkey_malloc_records;
record_pkey_malloc(void * ptr,long size)696 void record_pkey_malloc(void *ptr, long size)
697 {
698 long i;
699 struct pkey_malloc_record *rec = NULL;
700
701 for (i = 0; i < nr_pkey_malloc_records; i++) {
702 rec = &pkey_malloc_records[i];
703 /* find a free record */
704 if (rec)
705 break;
706 }
707 if (!rec) {
708 /* every record is full */
709 size_t old_nr_records = nr_pkey_malloc_records;
710 size_t new_nr_records = (nr_pkey_malloc_records * 2 + 1);
711 size_t new_size = new_nr_records * sizeof(struct pkey_malloc_record);
712 dprintf2("new_nr_records: %zd\n", new_nr_records);
713 dprintf2("new_size: %zd\n", new_size);
714 pkey_malloc_records = realloc(pkey_malloc_records, new_size);
715 pkey_assert(pkey_malloc_records != NULL);
716 rec = &pkey_malloc_records[nr_pkey_malloc_records];
717 /*
718 * realloc() does not initialize memory, so zero it from
719 * the first new record all the way to the end.
720 */
721 for (i = 0; i < new_nr_records - old_nr_records; i++)
722 memset(rec + i, 0, sizeof(*rec));
723 }
724 dprintf3("filling malloc record[%d/%p]: {%p, %ld}\n",
725 (int)(rec - pkey_malloc_records), rec, ptr, size);
726 rec->ptr = ptr;
727 rec->size = size;
728 nr_pkey_malloc_records++;
729 }
730
free_pkey_malloc(void * ptr)731 void free_pkey_malloc(void *ptr)
732 {
733 long i;
734 int ret;
735 dprintf3("%s(%p)\n", __func__, ptr);
736 for (i = 0; i < nr_pkey_malloc_records; i++) {
737 struct pkey_malloc_record *rec = &pkey_malloc_records[i];
738 dprintf4("looking for ptr %p at record[%ld/%p]: {%p, %ld}\n",
739 ptr, i, rec, rec->ptr, rec->size);
740 if ((ptr < rec->ptr) ||
741 (ptr >= rec->ptr + rec->size))
742 continue;
743
744 dprintf3("found ptr %p at record[%ld/%p]: {%p, %ld}\n",
745 ptr, i, rec, rec->ptr, rec->size);
746 nr_pkey_malloc_records--;
747 ret = munmap(rec->ptr, rec->size);
748 dprintf3("munmap ret: %d\n", ret);
749 pkey_assert(!ret);
750 dprintf3("clearing rec->ptr, rec: %p\n", rec);
751 rec->ptr = NULL;
752 dprintf3("done clearing rec->ptr, rec: %p\n", rec);
753 return;
754 }
755 pkey_assert(false);
756 }
757
758
malloc_pkey_with_mprotect(long size,int prot,u16 pkey)759 void *malloc_pkey_with_mprotect(long size, int prot, u16 pkey)
760 {
761 void *ptr;
762 int ret;
763
764 rdpkru();
765 dprintf1("doing %s(size=%ld, prot=0x%x, pkey=%d)\n", __func__,
766 size, prot, pkey);
767 pkey_assert(pkey < NR_PKEYS);
768 ptr = mmap(NULL, size, prot, MAP_ANONYMOUS|MAP_PRIVATE, -1, 0);
769 pkey_assert(ptr != (void *)-1);
770 ret = mprotect_pkey((void *)ptr, PAGE_SIZE, prot, pkey);
771 pkey_assert(!ret);
772 record_pkey_malloc(ptr, size);
773 rdpkru();
774
775 dprintf1("%s() for pkey %d @ %p\n", __func__, pkey, ptr);
776 return ptr;
777 }
778
malloc_pkey_anon_huge(long size,int prot,u16 pkey)779 void *malloc_pkey_anon_huge(long size, int prot, u16 pkey)
780 {
781 int ret;
782 void *ptr;
783
784 dprintf1("doing %s(size=%ld, prot=0x%x, pkey=%d)\n", __func__,
785 size, prot, pkey);
786 /*
787 * Guarantee we can fit at least one huge page in the resulting
788 * allocation by allocating space for 2:
789 */
790 size = ALIGN_UP(size, HPAGE_SIZE * 2);
791 ptr = mmap(NULL, size, PROT_NONE, MAP_ANONYMOUS|MAP_PRIVATE, -1, 0);
792 pkey_assert(ptr != (void *)-1);
793 record_pkey_malloc(ptr, size);
794 mprotect_pkey(ptr, size, prot, pkey);
795
796 dprintf1("unaligned ptr: %p\n", ptr);
797 ptr = ALIGN_PTR_UP(ptr, HPAGE_SIZE);
798 dprintf1(" aligned ptr: %p\n", ptr);
799 ret = madvise(ptr, HPAGE_SIZE, MADV_HUGEPAGE);
800 dprintf1("MADV_HUGEPAGE ret: %d\n", ret);
801 ret = madvise(ptr, HPAGE_SIZE, MADV_WILLNEED);
802 dprintf1("MADV_WILLNEED ret: %d\n", ret);
803 memset(ptr, 0, HPAGE_SIZE);
804
805 dprintf1("mmap()'d thp for pkey %d @ %p\n", pkey, ptr);
806 return ptr;
807 }
808
809 int hugetlb_setup_ok;
810 #define GET_NR_HUGE_PAGES 10
setup_hugetlbfs(void)811 void setup_hugetlbfs(void)
812 {
813 int err;
814 int fd;
815 char buf[] = "123";
816
817 if (geteuid() != 0) {
818 fprintf(stderr, "WARNING: not run as root, can not do hugetlb test\n");
819 return;
820 }
821
822 cat_into_file(__stringify(GET_NR_HUGE_PAGES), "/proc/sys/vm/nr_hugepages");
823
824 /*
825 * Now go make sure that we got the pages and that they
826 * are 2M pages. Someone might have made 1G the default.
827 */
828 fd = open("/sys/kernel/mm/hugepages/hugepages-2048kB/nr_hugepages", O_RDONLY);
829 if (fd < 0) {
830 perror("opening sysfs 2M hugetlb config");
831 return;
832 }
833
834 /* -1 to guarantee leaving the trailing \0 */
835 err = read(fd, buf, sizeof(buf)-1);
836 close(fd);
837 if (err <= 0) {
838 perror("reading sysfs 2M hugetlb config");
839 return;
840 }
841
842 if (atoi(buf) != GET_NR_HUGE_PAGES) {
843 fprintf(stderr, "could not confirm 2M pages, got: '%s' expected %d\n",
844 buf, GET_NR_HUGE_PAGES);
845 return;
846 }
847
848 hugetlb_setup_ok = 1;
849 }
850
malloc_pkey_hugetlb(long size,int prot,u16 pkey)851 void *malloc_pkey_hugetlb(long size, int prot, u16 pkey)
852 {
853 void *ptr;
854 int flags = MAP_ANONYMOUS|MAP_PRIVATE|MAP_HUGETLB;
855
856 if (!hugetlb_setup_ok)
857 return PTR_ERR_ENOTSUP;
858
859 dprintf1("doing %s(%ld, %x, %x)\n", __func__, size, prot, pkey);
860 size = ALIGN_UP(size, HPAGE_SIZE * 2);
861 pkey_assert(pkey < NR_PKEYS);
862 ptr = mmap(NULL, size, PROT_NONE, flags, -1, 0);
863 pkey_assert(ptr != (void *)-1);
864 mprotect_pkey(ptr, size, prot, pkey);
865
866 record_pkey_malloc(ptr, size);
867
868 dprintf1("mmap()'d hugetlbfs for pkey %d @ %p\n", pkey, ptr);
869 return ptr;
870 }
871
malloc_pkey_mmap_dax(long size,int prot,u16 pkey)872 void *malloc_pkey_mmap_dax(long size, int prot, u16 pkey)
873 {
874 void *ptr;
875 int fd;
876
877 dprintf1("doing %s(size=%ld, prot=0x%x, pkey=%d)\n", __func__,
878 size, prot, pkey);
879 pkey_assert(pkey < NR_PKEYS);
880 fd = open("/dax/foo", O_RDWR);
881 pkey_assert(fd >= 0);
882
883 ptr = mmap(0, size, prot, MAP_SHARED, fd, 0);
884 pkey_assert(ptr != (void *)-1);
885
886 mprotect_pkey(ptr, size, prot, pkey);
887
888 record_pkey_malloc(ptr, size);
889
890 dprintf1("mmap()'d for pkey %d @ %p\n", pkey, ptr);
891 close(fd);
892 return ptr;
893 }
894
895 void *(*pkey_malloc[])(long size, int prot, u16 pkey) = {
896
897 malloc_pkey_with_mprotect,
898 malloc_pkey_anon_huge,
899 malloc_pkey_hugetlb
900 /* can not do direct with the pkey_mprotect() API:
901 malloc_pkey_mmap_direct,
902 malloc_pkey_mmap_dax,
903 */
904 };
905
malloc_pkey(long size,int prot,u16 pkey)906 void *malloc_pkey(long size, int prot, u16 pkey)
907 {
908 void *ret;
909 static int malloc_type;
910 int nr_malloc_types = ARRAY_SIZE(pkey_malloc);
911
912 pkey_assert(pkey < NR_PKEYS);
913
914 while (1) {
915 pkey_assert(malloc_type < nr_malloc_types);
916
917 ret = pkey_malloc[malloc_type](size, prot, pkey);
918 pkey_assert(ret != (void *)-1);
919
920 malloc_type++;
921 if (malloc_type >= nr_malloc_types)
922 malloc_type = (random()%nr_malloc_types);
923
924 /* try again if the malloc_type we tried is unsupported */
925 if (ret == PTR_ERR_ENOTSUP)
926 continue;
927
928 break;
929 }
930
931 dprintf3("%s(%ld, prot=%x, pkey=%x) returning: %p\n", __func__,
932 size, prot, pkey, ret);
933 return ret;
934 }
935
936 int last_pkru_faults;
expected_pk_fault(int pkey)937 void expected_pk_fault(int pkey)
938 {
939 dprintf2("%s(): last_pkru_faults: %d pkru_faults: %d\n",
940 __func__, last_pkru_faults, pkru_faults);
941 dprintf2("%s(%d): last_si_pkey: %d\n", __func__, pkey, last_si_pkey);
942 pkey_assert(last_pkru_faults + 1 == pkru_faults);
943 pkey_assert(last_si_pkey == pkey);
944 /*
945 * The signal handler shold have cleared out PKRU to let the
946 * test program continue. We now have to restore it.
947 */
948 if (__rdpkru() != 0)
949 pkey_assert(0);
950
951 __wrpkru(shadow_pkru);
952 dprintf1("%s() set PKRU=%x to restore state after signal nuked it\n",
953 __func__, shadow_pkru);
954 last_pkru_faults = pkru_faults;
955 last_si_pkey = -1;
956 }
957
do_not_expect_pk_fault(void)958 void do_not_expect_pk_fault(void)
959 {
960 pkey_assert(last_pkru_faults == pkru_faults);
961 }
962
963 int test_fds[10] = { -1 };
964 int nr_test_fds;
__save_test_fd(int fd)965 void __save_test_fd(int fd)
966 {
967 pkey_assert(fd >= 0);
968 pkey_assert(nr_test_fds < ARRAY_SIZE(test_fds));
969 test_fds[nr_test_fds] = fd;
970 nr_test_fds++;
971 }
972
get_test_read_fd(void)973 int get_test_read_fd(void)
974 {
975 int test_fd = open("/etc/passwd", O_RDONLY);
976 __save_test_fd(test_fd);
977 return test_fd;
978 }
979
close_test_fds(void)980 void close_test_fds(void)
981 {
982 int i;
983
984 for (i = 0; i < nr_test_fds; i++) {
985 if (test_fds[i] < 0)
986 continue;
987 close(test_fds[i]);
988 test_fds[i] = -1;
989 }
990 nr_test_fds = 0;
991 }
992
993 #define barrier() __asm__ __volatile__("": : :"memory")
read_ptr(int * ptr)994 __attribute__((noinline)) int read_ptr(int *ptr)
995 {
996 /*
997 * Keep GCC from optimizing this away somehow
998 */
999 barrier();
1000 return *ptr;
1001 }
1002
test_read_of_write_disabled_region(int * ptr,u16 pkey)1003 void test_read_of_write_disabled_region(int *ptr, u16 pkey)
1004 {
1005 int ptr_contents;
1006
1007 dprintf1("disabling write access to PKEY[1], doing read\n");
1008 pkey_write_deny(pkey);
1009 ptr_contents = read_ptr(ptr);
1010 dprintf1("*ptr: %d\n", ptr_contents);
1011 dprintf1("\n");
1012 }
test_read_of_access_disabled_region(int * ptr,u16 pkey)1013 void test_read_of_access_disabled_region(int *ptr, u16 pkey)
1014 {
1015 int ptr_contents;
1016
1017 dprintf1("disabling access to PKEY[%02d], doing read @ %p\n", pkey, ptr);
1018 rdpkru();
1019 pkey_access_deny(pkey);
1020 ptr_contents = read_ptr(ptr);
1021 dprintf1("*ptr: %d\n", ptr_contents);
1022 expected_pk_fault(pkey);
1023 }
test_write_of_write_disabled_region(int * ptr,u16 pkey)1024 void test_write_of_write_disabled_region(int *ptr, u16 pkey)
1025 {
1026 dprintf1("disabling write access to PKEY[%02d], doing write\n", pkey);
1027 pkey_write_deny(pkey);
1028 *ptr = __LINE__;
1029 expected_pk_fault(pkey);
1030 }
test_write_of_access_disabled_region(int * ptr,u16 pkey)1031 void test_write_of_access_disabled_region(int *ptr, u16 pkey)
1032 {
1033 dprintf1("disabling access to PKEY[%02d], doing write\n", pkey);
1034 pkey_access_deny(pkey);
1035 *ptr = __LINE__;
1036 expected_pk_fault(pkey);
1037 }
test_kernel_write_of_access_disabled_region(int * ptr,u16 pkey)1038 void test_kernel_write_of_access_disabled_region(int *ptr, u16 pkey)
1039 {
1040 int ret;
1041 int test_fd = get_test_read_fd();
1042
1043 dprintf1("disabling access to PKEY[%02d], "
1044 "having kernel read() to buffer\n", pkey);
1045 pkey_access_deny(pkey);
1046 ret = read(test_fd, ptr, 1);
1047 dprintf1("read ret: %d\n", ret);
1048 pkey_assert(ret);
1049 }
test_kernel_write_of_write_disabled_region(int * ptr,u16 pkey)1050 void test_kernel_write_of_write_disabled_region(int *ptr, u16 pkey)
1051 {
1052 int ret;
1053 int test_fd = get_test_read_fd();
1054
1055 pkey_write_deny(pkey);
1056 ret = read(test_fd, ptr, 100);
1057 dprintf1("read ret: %d\n", ret);
1058 if (ret < 0 && (DEBUG_LEVEL > 0))
1059 perror("verbose read result (OK for this to be bad)");
1060 pkey_assert(ret);
1061 }
1062
test_kernel_gup_of_access_disabled_region(int * ptr,u16 pkey)1063 void test_kernel_gup_of_access_disabled_region(int *ptr, u16 pkey)
1064 {
1065 int pipe_ret, vmsplice_ret;
1066 struct iovec iov;
1067 int pipe_fds[2];
1068
1069 pipe_ret = pipe(pipe_fds);
1070
1071 pkey_assert(pipe_ret == 0);
1072 dprintf1("disabling access to PKEY[%02d], "
1073 "having kernel vmsplice from buffer\n", pkey);
1074 pkey_access_deny(pkey);
1075 iov.iov_base = ptr;
1076 iov.iov_len = PAGE_SIZE;
1077 vmsplice_ret = vmsplice(pipe_fds[1], &iov, 1, SPLICE_F_GIFT);
1078 dprintf1("vmsplice() ret: %d\n", vmsplice_ret);
1079 pkey_assert(vmsplice_ret == -1);
1080
1081 close(pipe_fds[0]);
1082 close(pipe_fds[1]);
1083 }
1084
test_kernel_gup_write_to_write_disabled_region(int * ptr,u16 pkey)1085 void test_kernel_gup_write_to_write_disabled_region(int *ptr, u16 pkey)
1086 {
1087 int ignored = 0xdada;
1088 int futex_ret;
1089 int some_int = __LINE__;
1090
1091 dprintf1("disabling write to PKEY[%02d], "
1092 "doing futex gunk in buffer\n", pkey);
1093 *ptr = some_int;
1094 pkey_write_deny(pkey);
1095 futex_ret = syscall(SYS_futex, ptr, FUTEX_WAIT, some_int-1, NULL,
1096 &ignored, ignored);
1097 if (DEBUG_LEVEL > 0)
1098 perror("futex");
1099 dprintf1("futex() ret: %d\n", futex_ret);
1100 }
1101
1102 /* Assumes that all pkeys other than 'pkey' are unallocated */
test_pkey_syscalls_on_non_allocated_pkey(int * ptr,u16 pkey)1103 void test_pkey_syscalls_on_non_allocated_pkey(int *ptr, u16 pkey)
1104 {
1105 int err;
1106 int i;
1107
1108 /* Note: 0 is the default pkey, so don't mess with it */
1109 for (i = 1; i < NR_PKEYS; i++) {
1110 if (pkey == i)
1111 continue;
1112
1113 dprintf1("trying get/set/free to non-allocated pkey: %2d\n", i);
1114 err = sys_pkey_free(i);
1115 pkey_assert(err);
1116
1117 err = sys_pkey_free(i);
1118 pkey_assert(err);
1119
1120 err = sys_mprotect_pkey(ptr, PAGE_SIZE, PROT_READ, i);
1121 pkey_assert(err);
1122 }
1123 }
1124
1125 /* Assumes that all pkeys other than 'pkey' are unallocated */
test_pkey_syscalls_bad_args(int * ptr,u16 pkey)1126 void test_pkey_syscalls_bad_args(int *ptr, u16 pkey)
1127 {
1128 int err;
1129 int bad_pkey = NR_PKEYS+99;
1130
1131 /* pass a known-invalid pkey in: */
1132 err = sys_mprotect_pkey(ptr, PAGE_SIZE, PROT_READ, bad_pkey);
1133 pkey_assert(err);
1134 }
1135
1136 /* Assumes that all pkeys other than 'pkey' are unallocated */
test_pkey_alloc_exhaust(int * ptr,u16 pkey)1137 void test_pkey_alloc_exhaust(int *ptr, u16 pkey)
1138 {
1139 int err;
1140 int allocated_pkeys[NR_PKEYS] = {0};
1141 int nr_allocated_pkeys = 0;
1142 int i;
1143
1144 for (i = 0; i < NR_PKEYS*2; i++) {
1145 int new_pkey;
1146 dprintf1("%s() alloc loop: %d\n", __func__, i);
1147 new_pkey = alloc_pkey();
1148 dprintf4("%s()::%d, err: %d pkru: 0x%x shadow: 0x%x\n", __func__,
1149 __LINE__, err, __rdpkru(), shadow_pkru);
1150 rdpkru(); /* for shadow checking */
1151 dprintf2("%s() errno: %d ENOSPC: %d\n", __func__, errno, ENOSPC);
1152 if ((new_pkey == -1) && (errno == ENOSPC)) {
1153 dprintf2("%s() failed to allocate pkey after %d tries\n",
1154 __func__, nr_allocated_pkeys);
1155 break;
1156 }
1157 pkey_assert(nr_allocated_pkeys < NR_PKEYS);
1158 allocated_pkeys[nr_allocated_pkeys++] = new_pkey;
1159 }
1160
1161 dprintf3("%s()::%d\n", __func__, __LINE__);
1162
1163 /*
1164 * ensure it did not reach the end of the loop without
1165 * failure:
1166 */
1167 pkey_assert(i < NR_PKEYS*2);
1168
1169 /*
1170 * There are 16 pkeys supported in hardware. One is taken
1171 * up for the default (0) and another can be taken up by
1172 * an execute-only mapping. Ensure that we can allocate
1173 * at least 14 (16-2).
1174 */
1175 pkey_assert(i >= NR_PKEYS-2);
1176
1177 for (i = 0; i < nr_allocated_pkeys; i++) {
1178 err = sys_pkey_free(allocated_pkeys[i]);
1179 pkey_assert(!err);
1180 rdpkru(); /* for shadow checking */
1181 }
1182 }
1183
test_ptrace_of_child(int * ptr,u16 pkey)1184 void test_ptrace_of_child(int *ptr, u16 pkey)
1185 {
1186 __attribute__((__unused__)) int peek_result;
1187 pid_t child_pid;
1188 void *ignored = 0;
1189 long ret;
1190 int status;
1191 /*
1192 * This is the "control" for our little expermient. Make sure
1193 * we can always access it when ptracing.
1194 */
1195 int *plain_ptr_unaligned = malloc(HPAGE_SIZE);
1196 int *plain_ptr = ALIGN_PTR_UP(plain_ptr_unaligned, PAGE_SIZE);
1197
1198 /*
1199 * Fork a child which is an exact copy of this process, of course.
1200 * That means we can do all of our tests via ptrace() and then plain
1201 * memory access and ensure they work differently.
1202 */
1203 child_pid = fork_lazy_child();
1204 dprintf1("[%d] child pid: %d\n", getpid(), child_pid);
1205
1206 ret = ptrace(PTRACE_ATTACH, child_pid, ignored, ignored);
1207 if (ret)
1208 perror("attach");
1209 dprintf1("[%d] attach ret: %ld %d\n", getpid(), ret, __LINE__);
1210 pkey_assert(ret != -1);
1211 ret = waitpid(child_pid, &status, WUNTRACED);
1212 if ((ret != child_pid) || !(WIFSTOPPED(status))) {
1213 fprintf(stderr, "weird waitpid result %ld stat %x\n",
1214 ret, status);
1215 pkey_assert(0);
1216 }
1217 dprintf2("waitpid ret: %ld\n", ret);
1218 dprintf2("waitpid status: %d\n", status);
1219
1220 pkey_access_deny(pkey);
1221 pkey_write_deny(pkey);
1222
1223 /* Write access, untested for now:
1224 ret = ptrace(PTRACE_POKEDATA, child_pid, peek_at, data);
1225 pkey_assert(ret != -1);
1226 dprintf1("poke at %p: %ld\n", peek_at, ret);
1227 */
1228
1229 /*
1230 * Try to access the pkey-protected "ptr" via ptrace:
1231 */
1232 ret = ptrace(PTRACE_PEEKDATA, child_pid, ptr, ignored);
1233 /* expect it to work, without an error: */
1234 pkey_assert(ret != -1);
1235 /* Now access from the current task, and expect an exception: */
1236 peek_result = read_ptr(ptr);
1237 expected_pk_fault(pkey);
1238
1239 /*
1240 * Try to access the NON-pkey-protected "plain_ptr" via ptrace:
1241 */
1242 ret = ptrace(PTRACE_PEEKDATA, child_pid, plain_ptr, ignored);
1243 /* expect it to work, without an error: */
1244 pkey_assert(ret != -1);
1245 /* Now access from the current task, and expect NO exception: */
1246 peek_result = read_ptr(plain_ptr);
1247 do_not_expect_pk_fault();
1248
1249 ret = ptrace(PTRACE_DETACH, child_pid, ignored, 0);
1250 pkey_assert(ret != -1);
1251
1252 ret = kill(child_pid, SIGKILL);
1253 pkey_assert(ret != -1);
1254
1255 wait(&status);
1256
1257 free(plain_ptr_unaligned);
1258 }
1259
test_executing_on_unreadable_memory(int * ptr,u16 pkey)1260 void test_executing_on_unreadable_memory(int *ptr, u16 pkey)
1261 {
1262 void *p1;
1263 int scratch;
1264 int ptr_contents;
1265 int ret;
1266
1267 p1 = ALIGN_PTR_UP(&lots_o_noops_around_write, PAGE_SIZE);
1268 dprintf3("&lots_o_noops: %p\n", &lots_o_noops_around_write);
1269 /* lots_o_noops_around_write should be page-aligned already */
1270 assert(p1 == &lots_o_noops_around_write);
1271
1272 /* Point 'p1' at the *second* page of the function: */
1273 p1 += PAGE_SIZE;
1274
1275 madvise(p1, PAGE_SIZE, MADV_DONTNEED);
1276 lots_o_noops_around_write(&scratch);
1277 ptr_contents = read_ptr(p1);
1278 dprintf2("ptr (%p) contents@%d: %x\n", p1, __LINE__, ptr_contents);
1279
1280 ret = mprotect_pkey(p1, PAGE_SIZE, PROT_EXEC, (u64)pkey);
1281 pkey_assert(!ret);
1282 pkey_access_deny(pkey);
1283
1284 dprintf2("pkru: %x\n", rdpkru());
1285
1286 /*
1287 * Make sure this is an *instruction* fault
1288 */
1289 madvise(p1, PAGE_SIZE, MADV_DONTNEED);
1290 lots_o_noops_around_write(&scratch);
1291 do_not_expect_pk_fault();
1292 ptr_contents = read_ptr(p1);
1293 dprintf2("ptr (%p) contents@%d: %x\n", p1, __LINE__, ptr_contents);
1294 expected_pk_fault(pkey);
1295 }
1296
test_mprotect_pkey_on_unsupported_cpu(int * ptr,u16 pkey)1297 void test_mprotect_pkey_on_unsupported_cpu(int *ptr, u16 pkey)
1298 {
1299 int size = PAGE_SIZE;
1300 int sret;
1301
1302 if (cpu_has_pku()) {
1303 dprintf1("SKIP: %s: no CPU support\n", __func__);
1304 return;
1305 }
1306
1307 sret = syscall(SYS_mprotect_key, ptr, size, PROT_READ, pkey);
1308 pkey_assert(sret < 0);
1309 }
1310
1311 void (*pkey_tests[])(int *ptr, u16 pkey) = {
1312 test_read_of_write_disabled_region,
1313 test_read_of_access_disabled_region,
1314 test_write_of_write_disabled_region,
1315 test_write_of_access_disabled_region,
1316 test_kernel_write_of_access_disabled_region,
1317 test_kernel_write_of_write_disabled_region,
1318 test_kernel_gup_of_access_disabled_region,
1319 test_kernel_gup_write_to_write_disabled_region,
1320 test_executing_on_unreadable_memory,
1321 test_ptrace_of_child,
1322 test_pkey_syscalls_on_non_allocated_pkey,
1323 test_pkey_syscalls_bad_args,
1324 test_pkey_alloc_exhaust,
1325 };
1326
run_tests_once(void)1327 void run_tests_once(void)
1328 {
1329 int *ptr;
1330 int prot = PROT_READ|PROT_WRITE;
1331
1332 for (test_nr = 0; test_nr < ARRAY_SIZE(pkey_tests); test_nr++) {
1333 int pkey;
1334 int orig_pkru_faults = pkru_faults;
1335
1336 dprintf1("======================\n");
1337 dprintf1("test %d preparing...\n", test_nr);
1338
1339 tracing_on();
1340 pkey = alloc_random_pkey();
1341 dprintf1("test %d starting with pkey: %d\n", test_nr, pkey);
1342 ptr = malloc_pkey(PAGE_SIZE, prot, pkey);
1343 dprintf1("test %d starting...\n", test_nr);
1344 pkey_tests[test_nr](ptr, pkey);
1345 dprintf1("freeing test memory: %p\n", ptr);
1346 free_pkey_malloc(ptr);
1347 sys_pkey_free(pkey);
1348
1349 dprintf1("pkru_faults: %d\n", pkru_faults);
1350 dprintf1("orig_pkru_faults: %d\n", orig_pkru_faults);
1351
1352 tracing_off();
1353 close_test_fds();
1354
1355 printf("test %2d PASSED (iteration %d)\n", test_nr, iteration_nr);
1356 dprintf1("======================\n\n");
1357 }
1358 iteration_nr++;
1359 }
1360
pkey_setup_shadow(void)1361 void pkey_setup_shadow(void)
1362 {
1363 shadow_pkru = __rdpkru();
1364 }
1365
main(void)1366 int main(void)
1367 {
1368 int nr_iterations = 22;
1369
1370 setup_handlers();
1371
1372 printf("has pku: %d\n", cpu_has_pku());
1373
1374 if (!cpu_has_pku()) {
1375 int size = PAGE_SIZE;
1376 int *ptr;
1377
1378 printf("running PKEY tests for unsupported CPU/OS\n");
1379
1380 ptr = mmap(NULL, size, PROT_NONE, MAP_ANONYMOUS|MAP_PRIVATE, -1, 0);
1381 assert(ptr != (void *)-1);
1382 test_mprotect_pkey_on_unsupported_cpu(ptr, 1);
1383 exit(0);
1384 }
1385
1386 pkey_setup_shadow();
1387 printf("startup pkru: %x\n", rdpkru());
1388 setup_hugetlbfs();
1389
1390 while (nr_iterations-- > 0)
1391 run_tests_once();
1392
1393 printf("done (all tests OK)\n");
1394 return 0;
1395 }
1396