1 // SPDX-License-Identifier: GPL-2.0
3  * Tests Memory Protection Keys (see Documentation/core-api/protection-keys.rst)
8  *  * how to handle SEGV_PKUERR signals and extract pkey-relevant
14  *	protect MPX bounds tables with protection keys?
16  *	OOMs can destroy mm->mmap (see exit_mmap()), so make sure it is immune to pkeys
21  *	gcc      -o protection_keys    -O2 -g -std=gnu99 -pthread -Wall protection_keys.c -lrt -ldl -lm
22  *	gcc -m32 -o protection_keys_32 -O2 -g -std=gnu99 -pthread -Wall protection_keys.c -lrt -ldl -lm
48 #include "pkey-helpers.h"
111 		cat_into_file("1", TRACEDIR "/options/funcgraph-proc");  in tracing_on()
147  * execute-only memory properly.
216 	dprintf1("START->%s(%d, 0x%x)\n", __func__,  in pkey_disable_set()
246 	dprintf1("END<---%s(%d, 0x%x)\n", __func__,  in pkey_disable_set()
319 int last_si_pkey = -1;
339 	trapno = uctxt->uc_mcontext.gregs[REG_TRAPNO];  in signal_handler()
340 	ip = uctxt->uc_mcontext.gregs[REG_IP_IDX];  in signal_handler()
341 	fpregs = (char *) uctxt->uc_mcontext.fpregs;  in signal_handler()
343 	dprintf2("%s() trapno: %d ip: 0x%016lx info->si_code: %s/%d\n",  in signal_handler()
344 			__func__, trapno, ip, si_code_str(si->si_code),  in signal_handler()
345 			si->si_code);  in signal_handler()
350 	 * 32-bit has some extra padding so that userspace can tell whether  in signal_handler()
365 		dump_mem(pkey_reg_ptr - 128, 256);  in signal_handler()
372 	if ((si->si_code == SEGV_MAPERR) ||  in signal_handler()
373 	    (si->si_code == SEGV_ACCERR) ||  in signal_handler()
374 	    (si->si_code == SEGV_BNDERR)) {  in signal_handler()
375 		printf("non-PK si_code, exiting...\n");  in signal_handler()
381 	dump_mem((u8 *)si_pkey_ptr - 8, 24);  in signal_handler()
409 	return waitpid(-1, &status, 0);  in wait_all_children()
431 	/*sigset_t - signals to block while in the handler */  in setup_sigsegv_handler()
607 		if (nr_iterations-- < 0)  in mprotect_pkey()
665 		for (i = 0; i < new_nr_records - old_nr_records; i++)  in record_pkey_malloc()
669 		(int)(rec - pkey_malloc_records), rec, ptr, size);  in record_pkey_malloc()
670 	rec->ptr = ptr;  in record_pkey_malloc()
671 	rec->size = size;  in record_pkey_malloc()
672 	rec->prot = prot;  in record_pkey_malloc()
685 				ptr, i, rec, rec->ptr, rec->size);  in free_pkey_malloc()
686 		if ((ptr <  rec->ptr) ||  in free_pkey_malloc()
687 		    (ptr >= rec->ptr + rec->size))  in free_pkey_malloc()
691 				ptr, i, rec, rec->ptr, rec->size);  in free_pkey_malloc()
692 		nr_pkey_malloc_records--;  in free_pkey_malloc()
693 		ret = munmap(rec->ptr, rec->size);  in free_pkey_malloc()
696 		dprintf3("clearing rec->ptr, rec: %p\n", rec);  in free_pkey_malloc()
697 		rec->ptr = NULL;  in free_pkey_malloc()
698 		dprintf3("done clearing rec->ptr, rec: %p\n", rec);  in free_pkey_malloc()
714 	ptr = mmap(NULL, size, prot, MAP_ANONYMOUS|MAP_PRIVATE, -1, 0);  in malloc_pkey_with_mprotect()
715 	pkey_assert(ptr != (void *)-1);  in malloc_pkey_with_mprotect()
737 	ptr = mmap(NULL, size, PROT_NONE, MAP_ANONYMOUS|MAP_PRIVATE, -1, 0);  in malloc_pkey_anon_huge()
738 	pkey_assert(ptr != (void *)-1);  in malloc_pkey_anon_huge()
756 #define SYSFS_FMT_NR_HUGE_PAGES "/sys/kernel/mm/hugepages/hugepages-%ldkB/nr_hugepages"
775 	 * are PMD-level pages. Someone might have made PUD-level  in setup_hugetlbfs()
788 	/* -1 to guarantee leaving the trailing \0 */  in setup_hugetlbfs()
789 	err = read(fd, buf, sizeof(buf)-1);  in setup_hugetlbfs()
817 	ptr = mmap(NULL, size, PROT_NONE, flags, -1, 0);  in malloc_pkey_hugetlb()
818 	pkey_assert(ptr != (void *)-1);  in malloc_pkey_hugetlb()
839 	pkey_assert(ptr != (void *)-1);  in malloc_pkey_mmap_dax()
874 		pkey_assert(ret != (void *)-1);  in malloc_pkey()
893 #define UNKNOWN_PKEY -2
902 	* For exec-only memory, we do not know the pkey in  in expected_pkey_fault()
923 	last_si_pkey = -1;  in expected_pkey_fault()
932 int test_fds[10] = { -1 };
957 		test_fds[i] = -1;  in close_test_fds()
981 	size = pkey_last_malloc_record->size;  in test_pkey_alloc_free_attach_pkey0()
984 	 * huge-page-aligned sizes when operating on hugetlbfs.  in test_pkey_alloc_free_attach_pkey0()
991 	/* allocate every possible key and make sure key-0 never got allocated */  in test_pkey_alloc_free_attach_pkey0()
1011 	/* attach key-0 in various modes */  in test_pkey_alloc_free_attach_pkey0()
1141 	pkey_assert(vmsplice_ret == -1);  in test_kernel_gup_of_access_disabled_region()
1157 	futex_ret = syscall(SYS_futex, ptr, FUTEX_WAIT, some_int-1, NULL,  in test_kernel_gup_write_to_write_disabled_region()
1175 		dprintf1("trying get/set/free to non-allocated pkey: %2d\n", i);  in test_pkey_syscalls_on_non_allocated_pkey()
1193 	/* pass a known-invalid pkey in: */  in test_pkey_syscalls_bad_args()
1231 		if ((new_pkey == -1) && (errno == ENOSPC)) {  in test_pkey_alloc_exhaust()
1259 	 *   2. One possibly consumed by an execute-only mapping.  in test_pkey_alloc_exhaust()
1262 	 * Ensure that we can allocate at least another 13 (16-3).  in test_pkey_alloc_exhaust()
1268 	 * the time we get here. These include pkey-0, pkey-1,  in test_pkey_alloc_exhaust()
1269 	 * exec-only pkey and the one allocated by the test code.  in test_pkey_alloc_exhaust()
1272 	pkey_assert(i >= (NR_PKEYS - get_arch_reserved_keys() - 1));  in test_pkey_alloc_exhaust()
1292 	size = pkey_last_malloc_record->size;  in test_mprotect_with_pkey_0()
1295 	 * huge-page-aligned sizes when operating on hugetlbfs.  in test_mprotect_with_pkey_0()
1301 	prot = pkey_last_malloc_record->prot;  in test_mprotect_with_pkey_0()
1336 	pkey_assert(ret != -1);  in test_ptrace_of_child()
1351 	pkey_assert(ret != -1);  in test_ptrace_of_child()
1356 	 * Try to access the pkey-protected "ptr" via ptrace:  in test_ptrace_of_child()
1360 	pkey_assert(ret != -1);  in test_ptrace_of_child()
1366 	 * Try to access the NON-pkey-protected "plain_ptr" via ptrace:  in test_ptrace_of_child()
1370 	pkey_assert(ret != -1);  in test_ptrace_of_child()
1376 	pkey_assert(ret != -1);  in test_ptrace_of_child()
1379 	pkey_assert(ret != -1);  in test_ptrace_of_child()
1392 	/* lots_o_noops_around_write should be page-aligned already */  in get_pointer_to_instructions()
1461 	 * Put the memory back to non-PROT_EXEC.  Should clear the  in test_implicit_mprotect_exec_only_memory()
1462 	 * exec-only pkey off the VMA and allow it to be readable  in test_implicit_mprotect_exec_only_memory()
1565 		ptr  = mmap(NULL, size, PROT_NONE, MAP_ANONYMOUS|MAP_PRIVATE, -1, 0);  in main()
1566 		assert(ptr != (void *)-1);  in main()
1575 	while (nr_iterations-- > 0)  in main()