| /* Tests for memory protection keys. |
| Copyright (C) 2017-2018 Free Software Foundation, Inc. |
| This file is part of the GNU C Library. |
| |
| The GNU C Library is free software; you can redistribute it and/or |
| modify it under the terms of the GNU Lesser General Public |
| License as published by the Free Software Foundation; either |
| version 2.1 of the License, or (at your option) any later version. |
| |
| The GNU C Library is distributed in the hope that it will be useful, |
| but WITHOUT ANY WARRANTY; without even the implied warranty of |
| MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU |
| Lesser General Public License for more details. |
| |
| You should have received a copy of the GNU Lesser General Public |
| License along with the GNU C Library; if not, see |
| <http://www.gnu.org/licenses/>. */ |
| |
| #include <errno.h> |
| #include <inttypes.h> |
| #include <setjmp.h> |
| #include <stdbool.h> |
| #include <stdio.h> |
| #include <stdlib.h> |
| #include <string.h> |
| #include <support/check.h> |
| #include <support/support.h> |
| #include <support/test-driver.h> |
| #include <support/xsignal.h> |
| #include <support/xthread.h> |
| #include <support/xunistd.h> |
| #include <sys/mman.h> |
| |
| /* Used to force threads to wait until the main thread has set up the |
| keys as intended. */ |
| static pthread_barrier_t barrier; |
| |
| /* The keys used for testing. These have been allocated with access |
| rights set based on their array index. */ |
| enum { key_count = 4 }; |
| static int keys[key_count]; |
| static volatile int *pages[key_count]; |
| |
| /* Used to report results from the signal handler. */ |
| static volatile void *sigsegv_addr; |
| static volatile int sigsegv_code; |
| static volatile int sigsegv_pkey; |
| static sigjmp_buf sigsegv_jmp; |
| |
| /* Used to handle expected read or write faults. */ |
| static void |
| sigsegv_handler (int signum, siginfo_t *info, void *context) |
| { |
| sigsegv_addr = info->si_addr; |
| sigsegv_code = info->si_code; |
| sigsegv_pkey = info->si_pkey; |
| siglongjmp (sigsegv_jmp, 2); |
| } |
| |
| static const struct sigaction sigsegv_sigaction = |
| { |
| .sa_flags = SA_RESETHAND | SA_SIGINFO, |
| .sa_sigaction = &sigsegv_handler, |
| }; |
| |
| /* Check if PAGE is readable (if !WRITE) or writable (if WRITE). */ |
| static bool |
| check_page_access (int page, bool write) |
| { |
| /* This is needed to work around bug 22396: On x86-64, siglongjmp |
| does not restore the protection key access rights for the current |
| thread. We restore only the access rights for the keys under |
| test. (This is not a general solution to this problem, but it |
| allows testing to proceed after a fault.) */ |
| unsigned saved_rights[key_count]; |
| for (int i = 0; i < key_count; ++i) |
| saved_rights[i] = pkey_get (keys[i]); |
| |
| volatile int *addr = pages[page]; |
| if (test_verbose > 0) |
| { |
| printf ("info: checking access at %p (page %d) for %s\n", |
| addr, page, write ? "writing" : "reading"); |
| } |
| int result = sigsetjmp (sigsegv_jmp, 1); |
| if (result == 0) |
| { |
| xsigaction (SIGSEGV, &sigsegv_sigaction, NULL); |
| if (write) |
| *addr = 3; |
| else |
| (void) *addr; |
| xsignal (SIGSEGV, SIG_DFL); |
| if (test_verbose > 0) |
| puts (" --> access allowed"); |
| return true; |
| } |
| else |
| { |
| xsignal (SIGSEGV, SIG_DFL); |
| if (test_verbose > 0) |
| puts (" --> access denied"); |
| TEST_COMPARE (result, 2); |
| TEST_COMPARE ((uintptr_t) sigsegv_addr, (uintptr_t) addr); |
| TEST_COMPARE (sigsegv_code, SEGV_PKUERR); |
| TEST_COMPARE (sigsegv_pkey, keys[page]); |
| for (int i = 0; i < key_count; ++i) |
| TEST_COMPARE (pkey_set (keys[i], saved_rights[i]), 0); |
| return false; |
| } |
| } |
| |
| static volatile sig_atomic_t sigusr1_handler_ran; |
| |
| /* Used to check that access is revoked in signal handlers. */ |
| static void |
| sigusr1_handler (int signum) |
| { |
| TEST_COMPARE (signum, SIGUSR1); |
| for (int i = 0; i < key_count; ++i) |
| TEST_COMPARE (pkey_get (keys[i]), PKEY_DISABLE_ACCESS); |
| sigusr1_handler_ran = 1; |
| } |
| |
| /* Used to report results from other threads. */ |
| struct thread_result |
| { |
| int access_rights[key_count]; |
| pthread_t next_thread; |
| }; |
| |
| /* Return the thread's access rights for the keys under test. */ |
| static void * |
| get_thread_func (void *closure) |
| { |
| struct thread_result *result = xmalloc (sizeof (*result)); |
| for (int i = 0; i < key_count; ++i) |
| result->access_rights[i] = pkey_get (keys[i]); |
| memset (&result->next_thread, 0, sizeof (result->next_thread)); |
| return result; |
| } |
| |
| /* Wait for initialization and then check that the current thread does |
| not have access through the keys under test. */ |
| static void * |
| delayed_thread_func (void *closure) |
| { |
| bool check_access = *(bool *) closure; |
| pthread_barrier_wait (&barrier); |
| struct thread_result *result = get_thread_func (NULL); |
| |
| if (check_access) |
| { |
| /* Also check directly. This code should not run with other |
| threads in parallel because of the SIGSEGV handler which is |
| installed by check_page_access. */ |
| for (int i = 0; i < key_count; ++i) |
| { |
| TEST_VERIFY (!check_page_access (i, false)); |
| TEST_VERIFY (!check_page_access (i, true)); |
| } |
| } |
| |
| result->next_thread = xpthread_create (NULL, get_thread_func, NULL); |
| return result; |
| } |
| |
| static int |
| do_test (void) |
| { |
| long pagesize = xsysconf (_SC_PAGESIZE); |
| |
| /* pkey_mprotect with key -1 should work even when there is no |
| protection key support. */ |
| { |
| int *page = xmmap (NULL, pagesize, PROT_NONE, |
| MAP_ANONYMOUS | MAP_PRIVATE, -1); |
| TEST_COMPARE (pkey_mprotect (page, pagesize, PROT_READ | PROT_WRITE, -1), |
| 0); |
| volatile int *vpage = page; |
| *vpage = 5; |
| TEST_COMPARE (*vpage, 5); |
| xmunmap (page, pagesize); |
| } |
| |
| xpthread_barrier_init (&barrier, NULL, 2); |
| bool delayed_thread_check_access = true; |
| pthread_t delayed_thread = xpthread_create |
| (NULL, &delayed_thread_func, &delayed_thread_check_access); |
| |
| keys[0] = pkey_alloc (0, 0); |
| if (keys[0] < 0) |
| { |
| if (errno == ENOSYS) |
| FAIL_UNSUPPORTED |
| ("kernel does not support memory protection keys"); |
| if (errno == EINVAL) |
| FAIL_UNSUPPORTED |
| ("CPU does not support memory protection keys: %m"); |
| FAIL_EXIT1 ("pkey_alloc: %m"); |
| } |
| TEST_COMPARE (pkey_get (keys[0]), 0); |
| for (int i = 1; i < key_count; ++i) |
| { |
| keys[i] = pkey_alloc (0, i); |
| if (keys[i] < 0) |
| FAIL_EXIT1 ("pkey_alloc (0, %d): %m", i); |
| /* pkey_alloc is supposed to change the current thread's access |
| rights for the new key. */ |
| TEST_COMPARE (pkey_get (keys[i]), i); |
| } |
| /* Check that all the keys have the expected access rights for the |
| current thread. */ |
| for (int i = 0; i < key_count; ++i) |
| TEST_COMPARE (pkey_get (keys[i]), i); |
| |
| /* Allocate a test page for each key. */ |
| for (int i = 0; i < key_count; ++i) |
| { |
| pages[i] = xmmap (NULL, pagesize, PROT_READ | PROT_WRITE, |
| MAP_ANONYMOUS | MAP_PRIVATE, -1); |
| TEST_COMPARE (pkey_mprotect ((void *) pages[i], pagesize, |
| PROT_READ | PROT_WRITE, keys[i]), 0); |
| } |
| |
| /* Check that the initial thread does not have access to the new |
| keys. */ |
| { |
| pthread_barrier_wait (&barrier); |
| struct thread_result *result = xpthread_join (delayed_thread); |
| for (int i = 0; i < key_count; ++i) |
| TEST_COMPARE (result->access_rights[i], |
| PKEY_DISABLE_ACCESS); |
| struct thread_result *result2 = xpthread_join (result->next_thread); |
| for (int i = 0; i < key_count; ++i) |
| TEST_COMPARE (result->access_rights[i], |
| PKEY_DISABLE_ACCESS); |
| free (result); |
| free (result2); |
| } |
| |
| /* Check that the current thread access rights are inherited by new |
| threads. */ |
| { |
| pthread_t get_thread = xpthread_create (NULL, get_thread_func, NULL); |
| struct thread_result *result = xpthread_join (get_thread); |
| for (int i = 0; i < key_count; ++i) |
| TEST_COMPARE (result->access_rights[i], i); |
| free (result); |
| } |
| |
| for (int i = 0; i < key_count; ++i) |
| TEST_COMPARE (pkey_get (keys[i]), i); |
| |
| /* Check that in a signal handler, there is no access. */ |
| xsignal (SIGUSR1, &sigusr1_handler); |
| xraise (SIGUSR1); |
| xsignal (SIGUSR1, SIG_DFL); |
| TEST_COMPARE (sigusr1_handler_ran, 1); |
| |
| /* The first key results in a writable page. */ |
| TEST_VERIFY (check_page_access (0, false)); |
| TEST_VERIFY (check_page_access (0, true)); |
| |
| /* The other keys do not. */ |
| for (int i = 1; i < key_count; ++i) |
| { |
| if (test_verbose) |
| printf ("info: checking access for key %d, bits 0x%x\n", |
| i, pkey_get (keys[i])); |
| for (int j = 0; j < key_count; ++j) |
| TEST_COMPARE (pkey_get (keys[j]), j); |
| if (i & PKEY_DISABLE_ACCESS) |
| { |
| TEST_VERIFY (!check_page_access (i, false)); |
| TEST_VERIFY (!check_page_access (i, true)); |
| } |
| else |
| { |
| TEST_VERIFY (i & PKEY_DISABLE_WRITE); |
| TEST_VERIFY (check_page_access (i, false)); |
| TEST_VERIFY (!check_page_access (i, true)); |
| } |
| } |
| |
| /* But if we set the current thread's access rights, we gain |
| access. */ |
| for (int do_write = 0; do_write < 2; ++do_write) |
| for (int allowed_key = 0; allowed_key < key_count; ++allowed_key) |
| { |
| for (int i = 0; i < key_count; ++i) |
| if (i == allowed_key) |
| { |
| if (do_write) |
| TEST_COMPARE (pkey_set (keys[i], 0), 0); |
| else |
| TEST_COMPARE (pkey_set (keys[i], PKEY_DISABLE_WRITE), 0); |
| } |
| else |
| TEST_COMPARE (pkey_set (keys[i], PKEY_DISABLE_ACCESS), 0); |
| |
| if (test_verbose) |
| printf ("info: key %d is allowed access for %s\n", |
| allowed_key, do_write ? "writing" : "reading"); |
| for (int i = 0; i < key_count; ++i) |
| if (i == allowed_key) |
| { |
| TEST_VERIFY (check_page_access (i, false)); |
| TEST_VERIFY (check_page_access (i, true) == do_write); |
| } |
| else |
| { |
| TEST_VERIFY (!check_page_access (i, false)); |
| TEST_VERIFY (!check_page_access (i, true)); |
| } |
| } |
| |
| /* Restore access to all keys, and launch a thread which should |
| inherit that access. */ |
| for (int i = 0; i < key_count; ++i) |
| { |
| TEST_COMPARE (pkey_set (keys[i], 0), 0); |
| TEST_VERIFY (check_page_access (i, false)); |
| TEST_VERIFY (check_page_access (i, true)); |
| } |
| delayed_thread_check_access = false; |
| delayed_thread = xpthread_create |
| (NULL, delayed_thread_func, &delayed_thread_check_access); |
| |
| TEST_COMPARE (pkey_free (keys[0]), 0); |
| /* Second pkey_free will fail because the key has already been |
| freed. */ |
| TEST_COMPARE (pkey_free (keys[0]),-1); |
| TEST_COMPARE (errno, EINVAL); |
| for (int i = 1; i < key_count; ++i) |
| TEST_COMPARE (pkey_free (keys[i]), 0); |
| |
| /* Check what happens to running threads which have access to |
| previously allocated protection keys. The implemented behavior |
| is somewhat dubious: Ideally, pkey_free should revoke access to |
| that key and pkey_alloc of the same (numeric) key should not |
| implicitly confer access to already-running threads, but this is |
| not what happens in practice. */ |
| { |
| /* The limit is in place to avoid running indefinitely in case |
| there many keys available. */ |
| int *keys_array = xcalloc (100000, sizeof (*keys_array)); |
| int keys_allocated = 0; |
| while (keys_allocated < 100000) |
| { |
| int new_key = pkey_alloc (0, PKEY_DISABLE_WRITE); |
| if (new_key < 0) |
| { |
| /* No key reuse observed before running out of keys. */ |
| TEST_COMPARE (errno, ENOSPC); |
| break; |
| } |
| for (int i = 0; i < key_count; ++i) |
| if (new_key == keys[i]) |
| { |
| /* We allocated the key with disabled write access. |
| This should affect the protection state of the |
| existing page. */ |
| TEST_VERIFY (check_page_access (i, false)); |
| TEST_VERIFY (!check_page_access (i, true)); |
| |
| xpthread_barrier_wait (&barrier); |
| struct thread_result *result = xpthread_join (delayed_thread); |
| /* The thread which was launched before should still have |
| access to the key. */ |
| TEST_COMPARE (result->access_rights[i], 0); |
| struct thread_result *result2 |
| = xpthread_join (result->next_thread); |
| /* Same for a thread which is launched afterwards from |
| the old thread. */ |
| TEST_COMPARE (result2->access_rights[i], 0); |
| free (result); |
| free (result2); |
| keys_array[keys_allocated++] = new_key; |
| goto after_key_search; |
| } |
| /* Save key for later deallocation. */ |
| keys_array[keys_allocated++] = new_key; |
| } |
| after_key_search: |
| /* Deallocate the keys allocated for testing purposes. */ |
| for (int j = 0; j < keys_allocated; ++j) |
| TEST_COMPARE (pkey_free (keys_array[j]), 0); |
| free (keys_array); |
| } |
| |
| for (int i = 0; i < key_count; ++i) |
| xmunmap ((void *) pages[i], pagesize); |
| |
| xpthread_barrier_destroy (&barrier); |
| return 0; |
| } |
| |
| #include <support/test-driver.c> |
