/* Tests for memory protection keys.

   Copyright (C) 2017-2018 Free Software Foundation, Inc.

   This file is part of the GNU C Library.

   The GNU C Library is free software; you can redistribute it and/or

   modify it under the terms of the GNU Lesser General Public

   License as published by the Free Software Foundation; either

   version 2.1 of the License, or (at your option) any later version.

   The GNU C Library is distributed in the hope that it will be useful,

   but WITHOUT ANY WARRANTY; without even the implied warranty of

   MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU

   Lesser General Public License for more details.

   You should have received a copy of the GNU Lesser General Public

   License along with the GNU C Library; if not, see

   <http://www.gnu.org/licenses/>.  */

#include <errno.h>

#include <inttypes.h>

#include <setjmp.h>

#include <stdbool.h>

#include <stdio.h>

#include <stdlib.h>

#include <string.h>

#include <support/check.h>

#include <support/support.h>

#include <support/test-driver.h>

#include <support/xsignal.h>

#include <support/xthread.h>

#include <support/xunistd.h>

#include <sys/mman.h>

/* Used to force threads to wait until the main thread has set up the

   keys as intended.  */

static pthread_barrier_t barrier;

/* The keys used for testing.  These have been allocated with access

   rights set based on their array index.  */

enum { key_count = 4 };

static int keys[key_count];

static volatile int *pages[key_count];

/* Used to report results from the signal handler.  */

static volatile void *sigsegv_addr;

static volatile int sigsegv_code;

static volatile int sigsegv_pkey;

static sigjmp_buf sigsegv_jmp;

/* Used to handle expected read or write faults.  */

static void

sigsegv_handler (int signum, siginfo_t *info, void *context)

{

  sigsegv_addr = info->si_addr;

  sigsegv_code = info->si_code;

  sigsegv_pkey = info->si_pkey;

  siglongjmp (sigsegv_jmp, 2);

}

static const struct sigaction sigsegv_sigaction =

  {

    .sa_flags = SA_RESETHAND | SA_SIGINFO,

    .sa_sigaction = &sigsegv_handler,

  };

/* Check if PAGE is readable (if !WRITE) or writable (if WRITE).  */

static bool

check_page_access (int page, bool write)

{

  /* This is needed to work around bug 22396: On x86-64, siglongjmp

     does not restore the protection key access rights for the current

     thread.  We restore only the access rights for the keys under

     test.  (This is not a general solution to this problem, but it

     allows testing to proceed after a fault.)  */

  unsigned saved_rights[key_count];

  for (int i = 0; i < key_count; ++i)

    saved_rights[i] = pkey_get (keys[i]);

  volatile int *addr = pages[page];

  if (test_verbose > 0)

    {

      printf ("info: checking access at %p (page %d) for %s\n",

              addr, page, write ? "writing" : "reading");

    }

  int result = sigsetjmp (sigsegv_jmp, 1);

  if (result == 0)

    {

      xsigaction (SIGSEGV, &sigsegv_sigaction, NULL);

      if (write)

        *addr = 3;

      else

        (void) *addr;

      xsignal (SIGSEGV, SIG_DFL);

      if (test_verbose > 0)

        puts ("  --> access allowed");

      return true;

    }

  else

    {

      xsignal (SIGSEGV, SIG_DFL);

      if (test_verbose > 0)

        puts ("  --> access denied");

      TEST_COMPARE (result, 2);

      TEST_COMPARE ((uintptr_t) sigsegv_addr, (uintptr_t) addr);

      TEST_COMPARE (sigsegv_code, SEGV_PKUERR);

      TEST_COMPARE (sigsegv_pkey, keys[page]);

      for (int i = 0; i < key_count; ++i)

        TEST_COMPARE (pkey_set (keys[i], saved_rights[i]), 0);

      return false;

    }

}

static volatile sig_atomic_t sigusr1_handler_ran;

/* Used to check that access is revoked in signal handlers.  */

static void

sigusr1_handler (int signum)

{

  TEST_COMPARE (signum, SIGUSR1);

  for (int i = 0; i < key_count; ++i)

    TEST_COMPARE (pkey_get (keys[i]), PKEY_DISABLE_ACCESS);

  sigusr1_handler_ran = 1;

}

/* Used to report results from other threads.  */

struct thread_result

{

  int access_rights[key_count];

  pthread_t next_thread;

};

/* Return the thread's access rights for the keys under test.  */

static void *

get_thread_func (void *closure)

{

  struct thread_result *result = xmalloc (sizeof (*result));

  for (int i = 0; i < key_count; ++i)

    result->access_rights[i] = pkey_get (keys[i]);

  memset (&result->next_thread, 0, sizeof (result->next_thread));

  return result;

}

/* Wait for initialization and then check that the current thread does

   not have access through the keys under test.  */

static void *

delayed_thread_func (void *closure)

{

  bool check_access = *(bool *) closure;

  pthread_barrier_wait (&barrier);

  struct thread_result *result = get_thread_func (NULL);

  if (check_access)

    {

      /* Also check directly.  This code should not run with other

         threads in parallel because of the SIGSEGV handler which is

         installed by check_page_access.  */

      for (int i = 0; i < key_count; ++i)

        {

          TEST_VERIFY (!check_page_access (i, false));

          TEST_VERIFY (!check_page_access (i, true));

        }

    }

  result->next_thread = xpthread_create (NULL, get_thread_func, NULL);

  return result;

}

static int

do_test (void)

{

  long pagesize = xsysconf (_SC_PAGESIZE);

  /* pkey_mprotect with key -1 should work even when there is no

     protection key support.  */

  {

    int *page = xmmap (NULL, pagesize, PROT_NONE,

                       MAP_ANONYMOUS | MAP_PRIVATE, -1);

    TEST_COMPARE (pkey_mprotect (page, pagesize, PROT_READ | PROT_WRITE, -1),

                  0);

    volatile int *vpage = page;

    *vpage = 5;

    TEST_COMPARE (*vpage, 5);

    xmunmap (page, pagesize);

  }

  xpthread_barrier_init (&barrier, NULL, 2);

  bool delayed_thread_check_access = true;

  pthread_t delayed_thread = xpthread_create

    (NULL, &delayed_thread_func, &delayed_thread_check_access);

  keys[0] = pkey_alloc (0, 0);

  if (keys[0] < 0)

    {

      if (errno == ENOSYS)

        FAIL_UNSUPPORTED

          ("kernel does not support memory protection keys");

      if (errno == EINVAL)

        FAIL_UNSUPPORTED

          ("CPU does not support memory protection keys: %m");

      FAIL_EXIT1 ("pkey_alloc: %m");

    }

  TEST_COMPARE (pkey_get (keys[0]), 0);

  for (int i = 1; i < key_count; ++i)

    {

      keys[i] = pkey_alloc (0, i);

      if (keys[i] < 0)

        FAIL_EXIT1 ("pkey_alloc (0, %d): %m", i);

      /* pkey_alloc is supposed to change the current thread's access

         rights for the new key.  */

      TEST_COMPARE (pkey_get (keys[i]), i);

    }

  /* Check that all the keys have the expected access rights for the

     current thread.  */

  for (int i = 0; i < key_count; ++i)

    TEST_COMPARE (pkey_get (keys[i]), i);

  /* Allocate a test page for each key.  */

  for (int i = 0; i < key_count; ++i)

    {

      pages[i] = xmmap (NULL, pagesize, PROT_READ | PROT_WRITE,

                        MAP_ANONYMOUS | MAP_PRIVATE, -1);

      TEST_COMPARE (pkey_mprotect ((void *) pages[i], pagesize,

                                   PROT_READ | PROT_WRITE, keys[i]), 0);

    }

  /* Check that the initial thread does not have access to the new

     keys.  */

  {

    pthread_barrier_wait (&barrier);

    struct thread_result *result = xpthread_join (delayed_thread);

    for (int i = 0; i < key_count; ++i)

      TEST_COMPARE (result->access_rights[i],

                    PKEY_DISABLE_ACCESS);

    struct thread_result *result2 = xpthread_join (result->next_thread);

    for (int i = 0; i < key_count; ++i)

      TEST_COMPARE (result->access_rights[i],

                    PKEY_DISABLE_ACCESS);

    free (result);

    free (result2);

  }

  /* Check that the current thread access rights are inherited by new

     threads.  */

  {

    pthread_t get_thread = xpthread_create (NULL, get_thread_func, NULL);

    struct thread_result *result = xpthread_join (get_thread);

    for (int i = 0; i < key_count; ++i)

      TEST_COMPARE (result->access_rights[i], i);

    free (result);

  }

  for (int i = 0; i < key_count; ++i)

    TEST_COMPARE (pkey_get (keys[i]), i);

  /* Check that in a signal handler, there is no access.  */

  xsignal (SIGUSR1, &sigusr1_handler);

  xraise (SIGUSR1);

  xsignal (SIGUSR1, SIG_DFL);

  TEST_COMPARE (sigusr1_handler_ran, 1);

  /* The first key results in a writable page.  */

  TEST_VERIFY (check_page_access (0, false));

  TEST_VERIFY (check_page_access (0, true));

  /* The other keys do not.   */

  for (int i = 1; i < key_count; ++i)

    {

      if (test_verbose)

        printf ("info: checking access for key %d, bits 0x%x\n",

                i, pkey_get (keys[i]));

      for (int j = 0; j < key_count; ++j)

        TEST_COMPARE (pkey_get (keys[j]), j);

      if (i & PKEY_DISABLE_ACCESS)

        {

          TEST_VERIFY (!check_page_access (i, false));

          TEST_VERIFY (!check_page_access (i, true));

        }

      else

        {

          TEST_VERIFY (i & PKEY_DISABLE_WRITE);

          TEST_VERIFY (check_page_access (i, false));

          TEST_VERIFY (!check_page_access (i, true));

        }

    }

  /* But if we set the current thread's access rights, we gain

     access.  */

  for (int do_write = 0; do_write < 2; ++do_write)

    for (int allowed_key = 0; allowed_key < key_count; ++allowed_key)

      {

        for (int i = 0; i < key_count; ++i)

          if (i == allowed_key)

            {

              if (do_write)

                TEST_COMPARE (pkey_set (keys[i], 0), 0);

              else

                TEST_COMPARE (pkey_set (keys[i], PKEY_DISABLE_WRITE), 0);

            }

          else

            TEST_COMPARE (pkey_set (keys[i], PKEY_DISABLE_ACCESS), 0);

        if (test_verbose)

          printf ("info: key %d is allowed access for %s\n",

                  allowed_key, do_write ? "writing" : "reading");

        for (int i = 0; i < key_count; ++i)

          if (i == allowed_key)

            {

              TEST_VERIFY (check_page_access (i, false));

              TEST_VERIFY (check_page_access (i, true) == do_write);

            }

          else

            {

              TEST_VERIFY (!check_page_access (i, false));

              TEST_VERIFY (!check_page_access (i, true));

            }

      }

  /* Restore access to all keys, and launch a thread which should

     inherit that access.  */

  for (int i = 0; i < key_count; ++i)

    {

      TEST_COMPARE (pkey_set (keys[i], 0), 0);

      TEST_VERIFY (check_page_access (i, false));

      TEST_VERIFY (check_page_access (i, true));

    }

  delayed_thread_check_access = false;

  delayed_thread = xpthread_create

    (NULL, delayed_thread_func, &delayed_thread_check_access);

  TEST_COMPARE (pkey_free (keys[0]), 0);

  /* Second pkey_free will fail because the key has already been

     freed.  */

  TEST_COMPARE (pkey_free (keys[0]),-1);

  TEST_COMPARE (errno, EINVAL);

  for (int i = 1; i < key_count; ++i)

    TEST_COMPARE (pkey_free (keys[i]), 0);

  /* Check what happens to running threads which have access to

     previously allocated protection keys.  The implemented behavior

     is somewhat dubious: Ideally, pkey_free should revoke access to

     that key and pkey_alloc of the same (numeric) key should not

     implicitly confer access to already-running threads, but this is

     not what happens in practice.  */

  {

    /* The limit is in place to avoid running indefinitely in case

       there many keys available.  */

    int *keys_array = xcalloc (100000, sizeof (*keys_array));

    int keys_allocated = 0;

    while (keys_allocated < 100000)

      {

        int new_key = pkey_alloc (0, PKEY_DISABLE_WRITE);

        if (new_key < 0)

          {

            /* No key reuse observed before running out of keys.  */

            TEST_COMPARE (errno, ENOSPC);

            break;

          }

        for (int i = 0; i < key_count; ++i)

          if (new_key == keys[i])

            {

              /* We allocated the key with disabled write access.

                 This should affect the protection state of the

                 existing page.  */

              TEST_VERIFY (check_page_access (i, false));

              TEST_VERIFY (!check_page_access (i, true));

              xpthread_barrier_wait (&barrier);

              struct thread_result *result = xpthread_join (delayed_thread);

              /* The thread which was launched before should still have

                 access to the key.  */

              TEST_COMPARE (result->access_rights[i], 0);

              struct thread_result *result2

                = xpthread_join (result->next_thread);

              /* Same for a thread which is launched afterwards from

                 the old thread.  */

              TEST_COMPARE (result2->access_rights[i], 0);

              free (result);

              free (result2);

              keys_array[keys_allocated++] = new_key;

              goto after_key_search;

            }

        /* Save key for later deallocation.  */

        keys_array[keys_allocated++] = new_key;

      }

  after_key_search:

    /* Deallocate the keys allocated for testing purposes.  */

    for (int j = 0; j < keys_allocated; ++j)

      TEST_COMPARE (pkey_free (keys_array[j]), 0);

    free (keys_array);

  }

  for (int i = 0; i < key_count; ++i)

    xmunmap ((void *) pages[i], pagesize);

  xpthread_barrier_destroy (&barrier);

  return 0;

}

#include <support/test-driver.c>