1 // SPDX-License-Identifier: GPL-2.0+
2 
3 /*
4  * Copyright 2020, Sandipan Das, IBM Corp.
5  *
6  * Test if applying execute protection on pages using memory
7  * protection keys works as expected.
8  */
9 
10 #define _GNU_SOURCE
11 #include <stdio.h>
12 #include <stdlib.h>
13 #include <string.h>
14 #include <signal.h>
15 
16 #include <unistd.h>
17 
18 #include "pkeys.h"
19 
20 #define PPC_INST_NOP	0x60000000
21 #define PPC_INST_TRAP	0x7fe00008
22 #define PPC_INST_BLR	0x4e800020
23 
24 static volatile sig_atomic_t fault_pkey, fault_code, fault_type;
25 static volatile sig_atomic_t remaining_faults;
26 static volatile unsigned int *fault_addr;
27 static unsigned long pgsize, numinsns;
28 static unsigned int *insns;
29 
30 static void trap_handler(int signum, siginfo_t *sinfo, void *ctx)
31 {
32 	/* Check if this fault originated from the expected address */
33 	if (sinfo->si_addr != (void *) fault_addr)
34 		sigsafe_err("got a fault for an unexpected address\n");
35 
36 	_exit(1);
37 }
38 
39 static void segv_handler(int signum, siginfo_t *sinfo, void *ctx)
40 {
41 	int signal_pkey;
42 
43 	signal_pkey = siginfo_pkey(sinfo);
44 	fault_code = sinfo->si_code;
45 
46 	/* Check if this fault originated from the expected address */
47 	if (sinfo->si_addr != (void *) fault_addr) {
48 		sigsafe_err("got a fault for an unexpected address\n");
49 		_exit(1);
50 	}
51 
52 	/* Check if too many faults have occurred for a single test case */
53 	if (!remaining_faults) {
54 		sigsafe_err("got too many faults for the same address\n");
55 		_exit(1);
56 	}
57 
58 
59 	/* Restore permissions in order to continue */
60 	switch (fault_code) {
61 	case SEGV_ACCERR:
62 		if (mprotect(insns, pgsize, PROT_READ | PROT_WRITE)) {
63 			sigsafe_err("failed to set access permissions\n");
64 			_exit(1);
65 		}
66 		break;
67 	case SEGV_PKUERR:
68 		if (signal_pkey != fault_pkey) {
69 			sigsafe_err("got a fault for an unexpected pkey\n");
70 			_exit(1);
71 		}
72 
73 		switch (fault_type) {
74 		case PKEY_DISABLE_ACCESS:
75 			pkey_set_rights(fault_pkey, 0);
76 			break;
77 		case PKEY_DISABLE_EXECUTE:
78 			/*
79 			 * Reassociate the exec-only pkey with the region
80 			 * to be able to continue. Unlike AMR, we cannot
81 			 * set IAMR directly from userspace to restore the
82 			 * permissions.
83 			 */
84 			if (mprotect(insns, pgsize, PROT_EXEC)) {
85 				sigsafe_err("failed to set execute permissions\n");
86 				_exit(1);
87 			}
88 			break;
89 		default:
90 			sigsafe_err("got a fault with an unexpected type\n");
91 			_exit(1);
92 		}
93 		break;
94 	default:
95 		sigsafe_err("got a fault with an unexpected code\n");
96 		_exit(1);
97 	}
98 
99 	remaining_faults--;
100 }
101 
102 static int test(void)
103 {
104 	struct sigaction segv_act, trap_act;
105 	unsigned long rights;
106 	int pkey, ret, i;
107 
108 	ret = pkeys_unsupported();
109 	if (ret)
110 		return ret;
111 
112 	/* Setup SIGSEGV handler */
113 	segv_act.sa_handler = 0;
114 	segv_act.sa_sigaction = segv_handler;
115 	FAIL_IF(sigprocmask(SIG_SETMASK, 0, &segv_act.sa_mask) != 0);
116 	segv_act.sa_flags = SA_SIGINFO;
117 	segv_act.sa_restorer = 0;
118 	FAIL_IF(sigaction(SIGSEGV, &segv_act, NULL) != 0);
119 
120 	/* Setup SIGTRAP handler */
121 	trap_act.sa_handler = 0;
122 	trap_act.sa_sigaction = trap_handler;
123 	FAIL_IF(sigprocmask(SIG_SETMASK, 0, &trap_act.sa_mask) != 0);
124 	trap_act.sa_flags = SA_SIGINFO;
125 	trap_act.sa_restorer = 0;
126 	FAIL_IF(sigaction(SIGTRAP, &trap_act, NULL) != 0);
127 
128 	/* Setup executable region */
129 	pgsize = getpagesize();
130 	numinsns = pgsize / sizeof(unsigned int);
131 	insns = (unsigned int *) mmap(NULL, pgsize, PROT_READ | PROT_WRITE,
132 				      MAP_PRIVATE | MAP_ANONYMOUS, -1, 0);
133 	FAIL_IF(insns == MAP_FAILED);
134 
135 	/* Write the instruction words */
136 	for (i = 1; i < numinsns - 1; i++)
137 		insns[i] = PPC_INST_NOP;
138 
139 	/*
140 	 * Set the first instruction as an unconditional trap. If
141 	 * the last write to this address succeeds, this should
142 	 * get overwritten by a no-op.
143 	 */
144 	insns[0] = PPC_INST_TRAP;
145 
146 	/*
147 	 * Later, to jump to the executable region, we use a branch
148 	 * and link instruction (bctrl) which sets the return address
149 	 * automatically in LR. Use that to return back.
150 	 */
151 	insns[numinsns - 1] = PPC_INST_BLR;
152 
153 	/* Allocate a pkey that restricts execution */
154 	rights = PKEY_DISABLE_EXECUTE;
155 	pkey = sys_pkey_alloc(0, rights);
156 	FAIL_IF(pkey < 0);
157 
158 	/*
159 	 * Pick the first instruction's address from the executable
160 	 * region.
161 	 */
162 	fault_addr = insns;
163 
164 	/* The following two cases will avoid SEGV_PKUERR */
165 	fault_type = -1;
166 	fault_pkey = -1;
167 
168 	/*
169 	 * Read an instruction word from the address when AMR bits
170 	 * are not set i.e. the pkey permits both read and write
171 	 * access.
172 	 *
173 	 * This should not generate a fault as having PROT_EXEC
174 	 * implies PROT_READ on GNU systems. The pkey currently
175 	 * restricts execution only based on the IAMR bits. The
176 	 * AMR bits are cleared.
177 	 */
178 	remaining_faults = 0;
179 	FAIL_IF(sys_pkey_mprotect(insns, pgsize, PROT_EXEC, pkey) != 0);
180 	printf("read from %p, pkey permissions are %s\n", fault_addr,
181 	       pkey_rights(rights));
182 	i = *fault_addr;
183 	FAIL_IF(remaining_faults != 0);
184 
185 	/*
186 	 * Write an instruction word to the address when AMR bits
187 	 * are not set i.e. the pkey permits both read and write
188 	 * access.
189 	 *
190 	 * This should generate an access fault as having just
191 	 * PROT_EXEC also restricts writes. The pkey currently
192 	 * restricts execution only based on the IAMR bits. The
193 	 * AMR bits are cleared.
194 	 */
195 	remaining_faults = 1;
196 	FAIL_IF(sys_pkey_mprotect(insns, pgsize, PROT_EXEC, pkey) != 0);
197 	printf("write to %p, pkey permissions are %s\n", fault_addr,
198 	       pkey_rights(rights));
199 	*fault_addr = PPC_INST_TRAP;
200 	FAIL_IF(remaining_faults != 0 || fault_code != SEGV_ACCERR);
201 
202 	/* The following three cases will generate SEGV_PKUERR */
203 	rights |= PKEY_DISABLE_ACCESS;
204 	fault_type = PKEY_DISABLE_ACCESS;
205 	fault_pkey = pkey;
206 
207 	/*
208 	 * Read an instruction word from the address when AMR bits
209 	 * are set i.e. the pkey permits neither read nor write
210 	 * access.
211 	 *
212 	 * This should generate a pkey fault based on AMR bits only
213 	 * as having PROT_EXEC implicitly allows reads.
214 	 */
215 	remaining_faults = 1;
216 	FAIL_IF(sys_pkey_mprotect(insns, pgsize, PROT_EXEC, pkey) != 0);
217 	pkey_set_rights(pkey, rights);
218 	printf("read from %p, pkey permissions are %s\n", fault_addr,
219 	       pkey_rights(rights));
220 	i = *fault_addr;
221 	FAIL_IF(remaining_faults != 0 || fault_code != SEGV_PKUERR);
222 
223 	/*
224 	 * Write an instruction word to the address when AMR bits
225 	 * are set i.e. the pkey permits neither read nor write
226 	 * access.
227 	 *
228 	 * This should generate two faults. First, a pkey fault
229 	 * based on AMR bits and then an access fault since
230 	 * PROT_EXEC does not allow writes.
231 	 */
232 	remaining_faults = 2;
233 	FAIL_IF(sys_pkey_mprotect(insns, pgsize, PROT_EXEC, pkey) != 0);
234 	pkey_set_rights(pkey, rights);
235 	printf("write to %p, pkey permissions are %s\n", fault_addr,
236 	       pkey_rights(rights));
237 	*fault_addr = PPC_INST_NOP;
238 	FAIL_IF(remaining_faults != 0 || fault_code != SEGV_ACCERR);
239 
240 	/* Free the current pkey */
241 	sys_pkey_free(pkey);
242 
243 	rights = 0;
244 	do {
245 		/*
246 		 * Allocate pkeys with all valid combinations of read,
247 		 * write and execute restrictions.
248 		 */
249 		pkey = sys_pkey_alloc(0, rights);
250 		FAIL_IF(pkey < 0);
251 
252 		/*
253 		 * Jump to the executable region. AMR bits may or may not
254 		 * be set but they should not affect execution.
255 		 *
256 		 * This should generate pkey faults based on IAMR bits which
257 		 * may be set to restrict execution.
258 		 *
259 		 * The first iteration also checks if the overwrite of the
260 		 * first instruction word from a trap to a no-op succeeded.
261 		 */
262 		fault_pkey = pkey;
263 		fault_type = -1;
264 		remaining_faults = 0;
265 		if (rights & PKEY_DISABLE_EXECUTE) {
266 			fault_type = PKEY_DISABLE_EXECUTE;
267 			remaining_faults = 1;
268 		}
269 
270 		FAIL_IF(sys_pkey_mprotect(insns, pgsize, PROT_EXEC, pkey) != 0);
271 		printf("execute at %p, pkey permissions are %s\n", fault_addr,
272 		       pkey_rights(rights));
273 		asm volatile("mtctr	%0; bctrl" : : "r"(insns));
274 		FAIL_IF(remaining_faults != 0);
275 		if (rights & PKEY_DISABLE_EXECUTE)
276 			FAIL_IF(fault_code != SEGV_PKUERR);
277 
278 		/* Free the current pkey */
279 		sys_pkey_free(pkey);
280 
281 		/* Find next valid combination of pkey rights */
282 		rights = next_pkey_rights(rights);
283 	} while (rights);
284 
285 	/* Cleanup */
286 	munmap((void *) insns, pgsize);
287 
288 	return 0;
289 }
290 
291 int main(void)
292 {
293 	return test_harness(test, "pkey_exec_prot");
294 }
295