From: Chaitanya S Prakash chaitanyas.prakash@arm.com

Wrapper functions for syscalls that are frequently invoked are added in order to improve usability. Making use of the newly added wrapper functions, Morello kselftests can be re-written in a manner that avoids directly interacting with syscalls. Required datatypes have been defined.

Signed-off-by: Chaitanya S Prakash chaitanyas.prakash@arm.com --- .../selftests/arm64/morello/freestanding.h | 59 ++++++++++++++++++- tools/testing/selftests/arm64/morello/mmap.c | 11 ++-- 2 files changed, 63 insertions(+), 7 deletions(-)

diff --git a/tools/testing/selftests/arm64/morello/freestanding.h b/tools/testing/selftests/arm64/morello/freestanding.h index 8dab905d2b54..6ec299ed4cae 100644 --- a/tools/testing/selftests/arm64/morello/freestanding.h +++ b/tools/testing/selftests/arm64/morello/freestanding.h @@ -21,6 +21,7 @@ typedef __kernel_timer_t timer_t; typedef __kernel_clockid_t clockid_t; typedef __kernel_uid_t uid_t; typedef __kernel_mode_t mode_t; +typedef __kernel_off_t off_t; #ifndef __clang__ typedef __uintcap_t uintcap_t; #endif @@ -164,6 +165,16 @@ static inline ssize_t write(int fd, const void *buf, size_t count) return syscall(__NR_write, fd, buf, count); }

+static inline off_t lseek(int fd, off_t offset, int whence) +{ + return syscall(__NR_lseek, fd, offset, whence); +} + +static inline int openat(int dirfd, const char *pathname, int flags, mode_t mode) +{ + return syscall(__NR_openat, dirfd, pathname, flags, mode); +} + long __clone(int (*fn)(void *), uintcap_t stack, int flags, void *arg, pid_t *parent_tid, void *tls, pid_t *child_tid);

@@ -178,8 +189,49 @@ static inline int munmap(void *addr, size_t length) return syscall(__NR_munmap, addr, length); }

+static inline int madvise(void *addr, size_t length, int advise) +{ + return syscall(__NR_madvise, addr, length, advise); +} + +static inline int mincore(void *addr, size_t length, unsigned char *vec) +{ + return syscall(__NR_mincore, addr, length, vec); +} + +static inline int mlock(const void *addr, size_t len) +{ + return syscall(__NR_mlock, addr, len); +} + +static inline int mlock2(const void *addr, size_t len, unsigned int flags) +{ + return syscall(__NR_mlock2, addr, len, flags); +} + +static inline int munlock(const void *addr, size_t len) +{ + return syscall(__NR_munlock, addr, len); +} + +static inline int msync(void *addr, size_t length, int flags) +{ + return syscall(__NR_msync, addr, length, flags); +} + +static inline int mprotect(void *addr, size_t length, int prot) +{ + return syscall(__NR_mprotect, addr, length, prot); +} + +static inline void *mremap(void *old_address, size_t old_size, size_t new_size, + int flags, void *new_address) +{ + return (void *)syscall(__NR_mremap, old_address, old_size, new_size, flags, new_address); +} + static inline void *mmap_verified(void *addr, size_t length, int prot, int flags, - int fd, int offset, unsigned int perms) + int fd, int offset, unsigned int perms) { void *__addr = mmap(addr, length, prot, flags, fd, offset);

@@ -204,6 +256,11 @@ static inline void *mmap_verified(void *addr, size_t length, int prot, int flags return NULL; }

+static inline int brk(void *addr) +{ + return syscall(__NR_brk, addr); +} + static inline int close(int fd) { return syscall(__NR_close, fd); diff --git a/tools/testing/selftests/arm64/morello/mmap.c b/tools/testing/selftests/arm64/morello/mmap.c index 5d259c336f55..2dd4ccdb0d2a 100644 --- a/tools/testing/selftests/arm64/morello/mmap.c +++ b/tools/testing/selftests/arm64/morello/mmap.c @@ -71,11 +71,11 @@ void syscall_mmap2(void) int retval;

/* create a sample file to map onto with mmap */ - fd = syscall(__NR_openat, 0, sample_file, O_RDWR | O_CREAT, FILE_PERM); + fd = openat(0, sample_file, O_RDWR | O_CREAT, FILE_PERM);

ASSERT_GE(fd, 0);

- retval = syscall(__NR_lseek, fd, MMAP_SIZE, SEEK_SET); + retval = lseek(fd, MMAP_SIZE, SEEK_SET); ASSERT_EQ(retval, MMAP_SIZE);

/* attempt to write arbitrary data to file */ @@ -92,18 +92,17 @@ void syscall_mmap2(void) PROBE_MODE_TOUCH | PROBE_MODE_VERIFY));

/* Attempt to change bounds of memory mapping, shrink by factor of 2 */ - addr = (void *)syscall(__NR_mremap, addr, MMAP_SIZE, - MMAP_SIZE_REDUCED, 0, 0); + addr = mremap(addr, MMAP_SIZE, MMAP_SIZE_REDUCED, 0, 0);

ASSERT_FALSE(IS_ERR_VALUE(addr)); /* advise kernel about how to handle paging of mapped memory.*/ - retval = syscall(__NR_madvise, addr, MMAP_SIZE_REDUCED, MADV_WILLNEED); + retval = madvise(addr, MMAP_SIZE_REDUCED, MADV_WILLNEED); ASSERT_EQ(retval, 0);

EXPECT_EQ(0, probe_mem_range(addr, MMAP_SIZE_REDUCED, PROBE_MODE_TOUCH | PROBE_MODE_VERIFY)); /* An attempt to change permissions to RO */ - retval = syscall(__NR_mprotect, addr, MMAP_SIZE_REDUCED, PROT_READ); + retval = mprotect(addr, MMAP_SIZE_REDUCED, PROT_READ); ASSERT_EQ(retval, 0); /* Write permission should be revoked - verify mode only */ /* To be extended when signals are fully supported */

From: Chaitanya S Prakash chaitanyas.prakash@arm.com

Helper functions for syscall_mmap and syscall_mmap2 have been removed and the code is rewritten directly in testcase functions. The pointer variable "addr" is renamed to "ptr" in order to avoid confusion when manipulating both addresses and pointers.

Signed-off-by: Chaitanya S Prakash chaitanyas.prakash@arm.com --- tools/testing/selftests/arm64/morello/mmap.c | 54 ++++++++------------ 1 file changed, 21 insertions(+), 33 deletions(-)

diff --git a/tools/testing/selftests/arm64/morello/mmap.c b/tools/testing/selftests/arm64/morello/mmap.c index ff5391b5b65b..96fceadba6da 100644 --- a/tools/testing/selftests/arm64/morello/mmap.c +++ b/tools/testing/selftests/arm64/morello/mmap.c @@ -26,9 +26,9 @@

static unsigned long pagesize;

-static inline int probe_mem_range(void *addr, size_t size, int mode) +static inline int probe_mem_range(void *ptr, size_t size, int mode) { - unsigned int *p = (unsigned int *)addr; + unsigned int *p = (unsigned int *)ptr; size_t probe_size = size / sizeof(unsigned int);

if (mode & PROBE_MODE_TOUCH) { @@ -46,33 +46,31 @@ static inline int probe_mem_range(void *addr, size_t size, int mode) /* Simple test to check our ability to create a new anonymous mapping * in the virtual address space of the calling process */ -static inline __attribute__((always_inline)) -void syscall_mmap(void) +TEST(test_syscall_mmap) {

- void *addr = mmap_verified(NULL, MMAP_SIZE, PROT_READ | PROT_WRITE, + void *ptr = mmap_verified(NULL, MMAP_SIZE, PROT_READ | PROT_WRITE, MAP_ANONYMOUS | MAP_PRIVATE, -1, 0, CAP_LOAD_PERMS | CAP_STORE_PERMS);

- ASSERT_NE(addr, NULL); + ASSERT_NE(ptr, NULL);

- EXPECT_EQ(0, probe_mem_range(addr, MMAP_SIZE, - PROBE_MODE_TOUCH | PROBE_MODE_VERIFY)) { + EXPECT_EQ(0, probe_mem_range(ptr, MMAP_SIZE, + PROBE_MODE_TOUCH | PROBE_MODE_VERIFY)) { TH_LOG("Failed on probing allocated mem range\n"); } - EXPECT_EQ(0, munmap(addr, MMAP_SIZE)); + EXPECT_EQ(0, munmap(ptr, MMAP_SIZE)); }

/* test mmap providing it with a file descriptor, testing related * functionality */ -static inline __attribute__((always_inline)) -void syscall_mmap2(void) +TEST(test_syscall_mmap2) { const char *msg = "foo"; unsigned int msg_len = sizeof(msg); /* No need for the terminator */ const char *sample_file = "/limbo.dat"; - void *addr; + void *ptr; int fd; int retval;

@@ -88,51 +86,41 @@ void syscall_mmap2(void) retval = write(fd, msg, msg_len); ASSERT_EQ(retval, (int)msg_len);

- addr = mmap_verified(NULL, MMAP_SIZE, PROT_READ | PROT_WRITE, MAP_SHARED, fd, + ptr = mmap_verified(NULL, MMAP_SIZE, PROT_READ | PROT_WRITE, MAP_SHARED, fd, 0, CAP_LOAD_PERMS | CAP_STORE_PERMS);

- EXPECT_NE(addr, NULL) + EXPECT_NE(ptr, NULL) goto clean_up;

- EXPECT_EQ(0, probe_mem_range(addr, MMAP_SIZE, - PROBE_MODE_TOUCH | PROBE_MODE_VERIFY)); + EXPECT_EQ(0, probe_mem_range(ptr, MMAP_SIZE, + PROBE_MODE_TOUCH | PROBE_MODE_VERIFY));

/* Attempt to change bounds of memory mapping, shrink by factor of 2 */ - addr = mremap(addr, MMAP_SIZE, MMAP_SIZE_REDUCED, 0, 0); + ptr = mremap(ptr, MMAP_SIZE, MMAP_SIZE_REDUCED, 0, 0);

- ASSERT_FALSE(IS_ERR_VALUE(addr)); + ASSERT_FALSE(IS_ERR_VALUE(ptr)); /* advise kernel about how to handle paging of mapped memory.*/ - retval = madvise(addr, MMAP_SIZE_REDUCED, MADV_WILLNEED); + retval = madvise(ptr, MMAP_SIZE_REDUCED, MADV_WILLNEED); ASSERT_EQ(retval, 0);

- EXPECT_EQ(0, probe_mem_range(addr, MMAP_SIZE_REDUCED, + EXPECT_EQ(0, probe_mem_range(ptr, MMAP_SIZE_REDUCED, PROBE_MODE_TOUCH | PROBE_MODE_VERIFY)); /* An attempt to change permissions to RO */ - retval = mprotect(addr, MMAP_SIZE_REDUCED, PROT_READ); + retval = mprotect(ptr, MMAP_SIZE_REDUCED, PROT_READ); ASSERT_EQ(retval, 0); /* Write permission should be revoked - verify mode only */ /* To be extended when signals are fully supported */ - EXPECT_EQ(0, probe_mem_range(addr, MMAP_SIZE_REDUCED, PROBE_MODE_VERIFY)); + EXPECT_EQ(0, probe_mem_range(ptr, MMAP_SIZE_REDUCED, PROBE_MODE_VERIFY));

clean_up: /* do unmap */ - munmap(addr, MMAP_SIZE_REDUCED); + munmap(ptr, MMAP_SIZE_REDUCED); ASSERT_EQ(retval, 0);

/* do file close */ close(fd); }

-TEST(test_syscall_mmap) -{ - syscall_mmap(); -} - -TEST(test_syscall_mmap2) -{ - syscall_mmap2(); -} - int main(int argc __maybe_unused, char **argv __maybe_unused, char **envp __maybe_unused, struct morello_auxv *auxv) {

From: Chaitanya S Prakash chaitanyas.prakash@arm.com

Only valid owning capabilities are allowed to manage memory mappings. Passing a capability with its tag bit cleared will result in failure of the syscall. Tests to verify this behaviour have been added.

Signed-off-by: Chaitanya S Prakash chaitanyas.prakash@arm.com --- tools/testing/selftests/arm64/morello/mmap.c | 95 ++++++++++++++++++++ 1 file changed, 95 insertions(+)

diff --git a/tools/testing/selftests/arm64/morello/mmap.c b/tools/testing/selftests/arm64/morello/mmap.c index 49b6f787f2a2..a1a9ffe9b88a 100644 --- a/tools/testing/selftests/arm64/morello/mmap.c +++ b/tools/testing/selftests/arm64/morello/mmap.c @@ -132,6 +132,100 @@ TEST(test_map_growsdown) EXPECT_EQ((unsigned long)ptr, (unsigned long)-EOPNOTSUPP); }

+/* test to verify invalid capability passed to address space management syscalls + * results in failure of the syscall. + */ +TEST(test_validity_tag_check) +{ + void *ptr, *new_ptr; + int retval; + int prot = PROT_READ | PROT_WRITE; + int flags = MAP_PRIVATE | MAP_ANONYMOUS; + unsigned char vec[MMAP_SIZE / pagesize]; + + /* passing invalid capability to mmap() */ + ptr = mmap(NULL, MMAP_SIZE, prot, flags, -1, 0); + ASSERT_FALSE(IS_ERR_VALUE(ptr)); + new_ptr = mmap(cheri_tag_clear(ptr), MMAP_SIZE_REDUCED, prot, + flags | MAP_FIXED, -1, 0); + EXPECT_EQ((unsigned long)new_ptr, (unsigned long)-EINVAL); + + retval = munmap(ptr, MMAP_SIZE); + ASSERT_EQ(retval, 0); + + /* passing invalid capability to munmap() */ + ptr = mmap(NULL, MMAP_SIZE, prot, flags, -1, 0); + ASSERT_FALSE(IS_ERR_VALUE(ptr)); + EXPECT_EQ(0, probe_mem_range(ptr, MMAP_SIZE, + PROBE_MODE_TOUCH | PROBE_MODE_VERIFY)); + + retval = munmap(cheri_tag_clear(ptr), MMAP_SIZE); + EXPECT_EQ(retval, -EINVAL); + + retval = munmap(ptr, MMAP_SIZE); + ASSERT_EQ(retval, 0); + + /* passing invalid capability to mremap() */ + ptr = mmap(NULL, MMAP_SIZE_REDUCED, prot, flags, -1, 0); + ASSERT_FALSE(IS_ERR_VALUE(ptr)); + new_ptr = mremap(cheri_tag_clear(ptr), MMAP_SIZE_REDUCED, MMAP_SIZE, + MREMAP_MAYMOVE, 0); + EXPECT_EQ((unsigned long)new_ptr, (unsigned long)-EINVAL); + + retval = munmap(ptr, MMAP_SIZE_REDUCED); + ASSERT_EQ(retval, 0); + + /* passing invalid capability to mprotect() */ + ptr = mmap(NULL, MMAP_SIZE, PROT_MAX(prot) | PROT_READ, flags, -1, 0); + ASSERT_FALSE(IS_ERR_VALUE(ptr)); + retval = mprotect(cheri_tag_clear(ptr), MMAP_SIZE, PROT_WRITE); + EXPECT_EQ(retval, -EINVAL); + + retval = munmap(ptr, MMAP_SIZE); + ASSERT_EQ(retval, 0); + + /* as the remaining syscalls are expected to fail in a similar manner, + * have a common mapping. + */ + ptr = mmap(NULL, MMAP_SIZE, prot, flags, -1, 0); + ASSERT_FALSE(IS_ERR_VALUE(ptr)); + + /* passing invalid capability to madvise() */ + retval = madvise(cheri_tag_clear(ptr), MMAP_SIZE, MADV_WILLNEED); + EXPECT_EQ(retval, -EINVAL); + + /* passing invalid capability to mincore() */ + retval = mincore(cheri_tag_clear(ptr), MMAP_SIZE, vec); + EXPECT_EQ(retval, -EINVAL); + + /* passing invalid capability to mlock() */ + retval = mlock(cheri_tag_clear(ptr), MMAP_SIZE); + EXPECT_EQ(retval, -EINVAL); + + /* passing invalid capability to mlock2() */ + retval = mlock2(cheri_tag_clear(ptr), MMAP_SIZE, MLOCK_ONFAULT); + EXPECT_EQ(retval, -EINVAL); + + /* passing invalid capability to munlock() */ + EXPECT_EQ(0, mlock(ptr, MMAP_SIZE_REDUCED)); + EXPECT_EQ(0, probe_mem_range(ptr, MMAP_SIZE_REDUCED, + PROBE_MODE_TOUCH | PROBE_MODE_VERIFY)); + + retval = munlock(cheri_tag_clear(ptr), MMAP_SIZE_REDUCED); + EXPECT_EQ(retval, -EINVAL); + + retval = munlock(ptr, MMAP_SIZE_REDUCED); + ASSERT_EQ(retval, 0); + + /* passing invalid capability to msync() */ + retval = msync(cheri_tag_clear(ptr), MMAP_SIZE, MS_SYNC); + EXPECT_EQ(retval, -EINVAL); + + /* unmap the common mapping */ + retval = munmap(ptr, MMAP_SIZE); + ASSERT_EQ(retval, 0); +} + int main(int argc __maybe_unused, char **argv __maybe_unused, char **envp __maybe_unused, struct morello_auxv *auxv) { @@ -140,5 +234,6 @@ int main(int argc __maybe_unused, char **argv __maybe_unused, char **envp __mayb test_syscall_mmap(); test_syscall_mmap2(); test_map_growsdown(); + test_validity_tag_check(); return 0; }

From: Chaitanya S Prakash chaitanyas.prakash@arm.com

Reservations are contiguous ranges of virtual addresses that exactly match the bounds of an owning capability. When an owning capability is passed to a syscall, its bounds are first verified against the existing reservation. If the reservation that would be created for the null derived capability is found to overlap with any existing reservation, the syscall fails with a -ERESERVATION error code.

According to the spec, the lifetime of reservations is generally undefined. While the reservation is eventually destroyed and the address range is made available, there should be no assumption as to when that will happen. But in the current implementation, the reservation is destroyed as soon as the last mapping is unmapped. Here a test is added to ensure that mmap(owning_cap, ...MAP_FIXED) fails because the underlying reservation is destroyed synchronously.

A partial unmap within a particular reservation still allows the rest of the region to be accessible. Tests to verify the same have been added.

Signed-off-by: Chaitanya S Prakash chaitanyas.prakash@arm.com --- tools/testing/selftests/arm64/morello/mmap.c | 52 ++++++++++++++++++++ 1 file changed, 52 insertions(+)

diff --git a/tools/testing/selftests/arm64/morello/mmap.c b/tools/testing/selftests/arm64/morello/mmap.c index 4dbecc85e68b..408c96d5befa 100644 --- a/tools/testing/selftests/arm64/morello/mmap.c +++ b/tools/testing/selftests/arm64/morello/mmap.c @@ -306,6 +306,57 @@ TEST(test_range_check) ASSERT_EQ(retval, 0); }

+/* test to verify mmap() reservation semantics */ +TEST(test_check_mmap_reservation) +{ + void *ptr, *new_ptr; + size_t size; + int retval; + int prot = PROT_READ | PROT_WRITE; + int flags = MAP_PRIVATE | MAP_ANONYMOUS; + + /* test to verify rest of reservation region is accessible after a partial + * unmap + */ + ptr = mmap(NULL, MMAP_SIZE, prot, flags, -1, 0); + ASSERT_FALSE(IS_ERR_VALUE(ptr)); + + retval = munmap(ptr, pagesize); + ASSERT_EQ(retval, 0); + + ptr = ptr + pagesize; + size = MMAP_SIZE - pagesize; + EXPECT_EQ(0, probe_mem_range(ptr, size, + PROBE_MODE_TOUCH | PROBE_MODE_VERIFY)); + + retval = munmap(ptr, size); + ASSERT_EQ(retval, 0); + + /* test to verify that a subsequent mmap() call to the same region whose + * reservation has been destroyed fails. This test is in accordance with + * the current implementation. + */ + ptr = mmap(NULL, MMAP_SIZE, prot, flags, -1, 0); + ASSERT_FALSE(IS_ERR_VALUE(ptr)); + + retval = munmap(ptr, MMAP_SIZE); + ASSERT_EQ(retval, 0); + + new_ptr = mmap(ptr, MMAP_SIZE_REDUCED, prot, flags | MAP_FIXED, -1, 0); + EXPECT_EQ((unsigned long)new_ptr, (unsigned long)-ERESERVATION); + + /* null-derived ptr overlaps with an existing reservation */ + ptr = mmap((void *)(uintptr_t)min_addr, MMAP_SIZE, prot, flags, -1, 0); + ASSERT_FALSE(IS_ERR_VALUE(ptr)); + + new_ptr = mmap((void *)(uintptr_t)min_addr + MMAP_SIZE_REDUCED, MMAP_SIZE, prot, + flags | MAP_FIXED, -1, 0); + EXPECT_EQ((unsigned long)new_ptr, (unsigned long)-ERESERVATION); + + retval = munmap(ptr, MMAP_SIZE); + ASSERT_EQ(retval, 0); +} + int main(int argc __maybe_unused, char **argv __maybe_unused, char **envp __maybe_unused, struct morello_auxv *auxv) { @@ -316,5 +367,6 @@ int main(int argc __maybe_unused, char **argv __maybe_unused, char **envp __mayb test_map_growsdown(); test_validity_tag_check(); test_range_check(); + test_check_mmap_reservation(); return 0; }

From: Chaitanya S Prakash chaitanyas.prakash@arm.com

When a capability is created it is assigned the maximum permissions it may ever have by passing PROT_MAX(max_prot) as one of the prot flags. Any attempt to increase the permissions beyond this would result in failure of the syscall. An owning capability returned by mmap() does not include LoadCap and StoreCap permissions if the mapping is shared. A check to verify the same has been added.

mremap() doesn't take a prot argument and retains the permissions of the original capability. If the permissions of the new capability exceed the the set of permissions of the old capability, the syscall fails with a -EINVAL error code. Tests to verify the above behaviour have been added.

Signed-off-by: Chaitanya S Prakash chaitanyas.prakash@arm.com --- tools/testing/selftests/arm64/morello/mmap.c | 143 +++++++++++++++++++ 1 file changed, 143 insertions(+)

diff --git a/tools/testing/selftests/arm64/morello/mmap.c b/tools/testing/selftests/arm64/morello/mmap.c index 7db778deafd5..e07067f0470a 100644 --- a/tools/testing/selftests/arm64/morello/mmap.c +++ b/tools/testing/selftests/arm64/morello/mmap.c @@ -15,6 +15,7 @@ #define MMAP_SIZE ((1ULL << 16) << 1) /* 64k x 2 */ #define MMAP_SIZE_REDUCED (MMAP_SIZE >> 1) #define FILE_PERM 0666 +#define PROT_ALL (PROT_READ | PROT_WRITE | PROT_EXEC)

#define PROBE_MODE_TOUCH 0x01 #define PROBE_MODE_VERIFY 0x02 @@ -412,6 +413,147 @@ TEST(test_check_mremap_reservation) EXPECT_EQ(retval, 0); }

+/* test to verify address space management syscall behaviour when permissions + * are modified. + */ +TEST(test_permissions) +{ + void *ptr, *old_ptr, *new_ptr, *ret; + int flags, retval; + int prot, max_prot; + size_t perms; + + /* increase permission beyond the maximum prot specified for the mapping */ + flags = MAP_PRIVATE | MAP_ANONYMOUS; + max_prot = PROT_READ | PROT_WRITE; + prot = PROT_READ; + + ptr = mmap(NULL, MMAP_SIZE, PROT_MAX(max_prot) | prot, + flags, -1, 0); + ASSERT_FALSE(IS_ERR_VALUE(ptr)); + + retval = mprotect(ptr, MMAP_SIZE, PROT_EXEC); + ASSERT_EQ(retval, -EINVAL); + + retval = munmap(ptr, MMAP_SIZE); + ASSERT_EQ(retval, 0); + + /* max_prot has fewer permissions than prot */ + flags = MAP_PRIVATE | MAP_ANONYMOUS; + max_prot = PROT_WRITE | PROT_EXEC; + prot = PROT_ALL; + + ptr = mmap(NULL, MMAP_SIZE, PROT_MAX(max_prot) | prot, flags, -1, 0); + EXPECT_EQ((unsigned long)ptr, (unsigned long)-EINVAL); + + /* max_prot has more permissions than prot */ + flags = MAP_PRIVATE | MAP_ANONYMOUS; + max_prot = PROT_ALL; + prot = PROT_READ | PROT_EXEC; + + ptr = mmap(NULL, MMAP_SIZE, PROT_MAX(max_prot) | prot, flags, -1, 0); + ASSERT_FALSE(IS_ERR_VALUE(ptr)); + + retval = mprotect(ptr, MMAP_SIZE, PROT_WRITE); + ASSERT_EQ(retval, 0); + + EXPECT_EQ(0, probe_mem_range(ptr, MMAP_SIZE, + PROBE_MODE_TOUCH | PROBE_MODE_VERIFY)); + + retval = munmap(ptr, MMAP_SIZE); + ASSERT_EQ(retval, 0); + + /* repeat positive max_prot test with fixed address */ + flags = MAP_PRIVATE | MAP_ANONYMOUS; + max_prot = PROT_ALL; + prot = PROT_READ | PROT_EXEC; + + ptr = mmap((void *)(uintptr_t)min_addr, MMAP_SIZE, PROT_MAX(max_prot) | prot, + flags | MAP_FIXED, -1, 0); + ASSERT_FALSE(IS_ERR_VALUE(ptr)); + + retval = mprotect(ptr, MMAP_SIZE, PROT_WRITE); + ASSERT_EQ(retval, 0); + + retval = munmap(ptr, MMAP_SIZE); + ASSERT_EQ(retval, 0); + + /* LoadCap and StoreCap permissions must not be given to a shared mapping */ + flags = MAP_SHARED | MAP_ANONYMOUS; + prot = PROT_READ | PROT_WRITE; + + ptr = mmap(NULL, MMAP_SIZE, PROT_MAX(prot) | PROT_READ, flags, -1, 0); + ASSERT_FALSE(IS_ERR_VALUE(ptr)); + + perms = cheri_perms_get(ptr); + EXPECT_EQ((perms & (CHERI_PERM_LOAD_CAP | CHERI_PERM_STORE_CAP)), 0); + + retval = munmap(ptr, MMAP_SIZE); + ASSERT_EQ(retval, 0); + + /* permissions of capability returned by mremap must match the permissions + * returned by the original mapping. + */ + flags = MAP_PRIVATE | MAP_ANONYMOUS; + prot = PROT_READ | PROT_WRITE; + + old_ptr = mmap(NULL, MMAP_SIZE_REDUCED, prot, flags, -1, 0); + ASSERT_FALSE(IS_ERR_VALUE(old_ptr)); + + new_ptr = mremap(old_ptr, MMAP_SIZE_REDUCED, MMAP_SIZE, + MREMAP_MAYMOVE, 0); + ASSERT_FALSE(IS_ERR_VALUE(new_ptr)); + + ASSERT_EQ(cheri_perms_get(old_ptr), cheri_perms_get(new_ptr)); + EXPECT_EQ(0, probe_mem_range(new_ptr, MMAP_SIZE, + PROBE_MODE_TOUCH | PROBE_MODE_VERIFY)); + + retval = munmap(new_ptr, MMAP_SIZE); + ASSERT_EQ(retval, 0); + + /* remapping to a new_ptr having reduced permissions from old_ptr */ + flags = MAP_PRIVATE | MAP_ANONYMOUS; + prot = PROT_READ | PROT_WRITE; + + old_ptr = mmap(NULL, MMAP_SIZE_REDUCED, PROT_MAX(prot | PROT_EXEC) | + prot, flags, -1, 0); + ASSERT_FALSE(IS_ERR_VALUE(old_ptr)); + + new_ptr = mmap(NULL, MMAP_SIZE, PROT_MAX(prot) | PROT_READ, flags, -1, 0); + ASSERT_FALSE(IS_ERR_VALUE(new_ptr)); + + ret = mremap(old_ptr, MMAP_SIZE_REDUCED, MMAP_SIZE, + MREMAP_MAYMOVE | MREMAP_FIXED, new_ptr); + ASSERT_FALSE(IS_ERR_VALUE(ret)); + EXPECT_EQ(0, probe_mem_range(new_ptr, MMAP_SIZE, + PROBE_MODE_TOUCH | PROBE_MODE_VERIFY)); + + retval = munmap(ret, MMAP_SIZE); + ASSERT_EQ(retval, 0); + + /* remapping to new_ptr having increased permissions from old_ptr */ + flags = MAP_PRIVATE | MAP_ANONYMOUS; + prot = PROT_READ | PROT_WRITE; + + old_ptr = mmap(NULL, MMAP_SIZE_REDUCED, PROT_MAX(prot) | PROT_READ, + flags, -1, 0); + ASSERT_FALSE(IS_ERR_VALUE(old_ptr)); + + new_ptr = mmap(NULL, MMAP_SIZE, PROT_MAX(prot | PROT_EXEC) | prot, + flags, -1, 0); + ASSERT_FALSE(IS_ERR_VALUE(new_ptr)); + + ret = mremap(old_ptr, MMAP_SIZE_REDUCED, MMAP_SIZE, + MREMAP_MAYMOVE | MREMAP_FIXED, new_ptr); + EXPECT_EQ((unsigned long)ret, (unsigned long)-EINVAL); + + retval = munmap(new_ptr, MMAP_SIZE); + ASSERT_EQ(retval, 0); + + retval = munmap(old_ptr, MMAP_SIZE_REDUCED); + ASSERT_EQ(retval, 0); +} + int main(int argc __maybe_unused, char **argv __maybe_unused, char **envp __maybe_unused, struct morello_auxv *auxv) { @@ -424,5 +566,6 @@ int main(int argc __maybe_unused, char **argv __maybe_unused, char **envp __mayb test_range_check(); test_check_mmap_reservation(); test_check_mremap_reservation(); + test_permissions(); return 0; }

From: Amit Daniel Kachhap amit.kachhap@arm.com

Morello uses a compressed capability format which makes it difficult to represent bounds with arbitrary precision. As the corresponding address range of a given memory mapping may not be exactly representable as valid capability bounds, a test to verify that the PCuABI kernel is able to mmap/munmap those addresses has been added.

Signed-off-by: Amit Daniel Kachhap amit.kachhap@arm.com Signed-off-by: Chaitanya S Prakash ChaitanyaS.Prakash@arm.com --- tools/testing/selftests/arm64/morello/mmap.c | 45 ++++++++++++++++++++ 1 file changed, 45 insertions(+)

diff --git a/tools/testing/selftests/arm64/morello/mmap.c b/tools/testing/selftests/arm64/morello/mmap.c index 8dc4e1dedef3..936e64fe8708 100644 --- a/tools/testing/selftests/arm64/morello/mmap.c +++ b/tools/testing/selftests/arm64/morello/mmap.c @@ -563,6 +563,50 @@ TEST(test_brk_check) EXPECT_EQ(retval, -ENOSYS); }

+/* test to verify the CHERI unrepresentable address/length */ +TEST(test_cheri_unrepresentability) +{ + void *ptr1, *ptr2; + int retval; + int count = 0; + int prot = PROT_READ | PROT_WRITE; + int flags = MAP_PRIVATE | MAP_ANONYMOUS; + size_t len, representable_base; + + /* Use pageshift 16 for 64K pages so as to use as mmap fixed address */ + unsigned long pageshift = 16; + + /* Generate an unrepresentable length/address */ + do { + len = (1 << (pageshift++)) + ((count++ % pagesize) * pagesize); + } while (len == cheri_representable_length(len)); + + /* Create a memory mapping with reserved memory at the end */ + ptr1 = mmap(NULL, len, prot, flags, -1, 0); + ASSERT_FALSE(IS_ERR_VALUE(ptr1)); + EXPECT_EQ(1, cheri_tag_get(ptr1)); + EXPECT_EQ(cheri_length_get(ptr1), cheri_representable_length(len)); + representable_base = (cheri_address_get(ptr1) & cheri_representable_alignment_mask(len)); + EXPECT_EQ(representable_base, cheri_base_get(ptr1)); + EXPECT_EQ(0, probe_mem_range(ptr1, len, PROBE_MODE_TOUCH | PROBE_MODE_VERIFY)); + + /* Create a memory mapping with reserved memory at the front */ + ptr2 = mmap((void *)(uintcap_t)len, len, prot, flags, -1, 0); + ASSERT_FALSE(IS_ERR_VALUE(ptr2)); + EXPECT_EQ(1, cheri_tag_get(ptr2)); + EXPECT_EQ(cheri_length_get(ptr2), cheri_representable_length(len)); + representable_base = (cheri_address_get(ptr2) & cheri_representable_alignment_mask(len)); + EXPECT_EQ(representable_base, cheri_base_get(ptr2)); + ASSERT_EQ(len, cheri_address_get(ptr2)); + EXPECT_EQ(0, probe_mem_range(ptr2, len, PROBE_MODE_TOUCH | PROBE_MODE_VERIFY)); + + retval = munmap(ptr1, len); + ASSERT_EQ(retval, 0); + + retval = munmap(ptr2, len); + ASSERT_EQ(retval, 0); +} + int main(int argc __maybe_unused, char **argv __maybe_unused, char **envp __maybe_unused, struct morello_auxv *auxv) { @@ -577,5 +621,6 @@ int main(int argc __maybe_unused, char **argv __maybe_unused, char **envp __mayb test_check_mremap_reservation(); test_permissions(); test_brk_check(); + test_cheri_unrepresentability(); return 0; }

On 2/27/24 13:59, Kevin Brodsky wrote:

On 23/02/2024 12:07, Chaitanya S Prakash wrote:

...

From: Amit Daniel Kachhap amit.kachhap@arm.com

Morello uses a compressed capability format which makes it difficult to represent bounds with arbitrary precision. As the corresponding address range of a given memory mapping may not be exactly representable as valid capability bounds, a test to verify that the PCuABI kernel is able to mmap/munmap those addresses has been added.

Signed-off-by: Amit Daniel Kachhap amit.kachhap@arm.com Signed-off-by: Chaitanya S Prakash ChaitanyaS.Prakash@arm.com

Assuming you wrote / modified part of this patch, you should add your Co-developed-by, above your Signed-off-by.

...

---

tools/testing/selftests/arm64/morello/mmap.c | 45 ++++++++++++++++++++ 1 file changed, 45 insertions(+)

diff --git a/tools/testing/selftests/arm64/morello/mmap.c b/tools/testing/selftests/arm64/morello/mmap.c index 8dc4e1dedef3..936e64fe8708 100644 --- a/tools/testing/selftests/arm64/morello/mmap.c +++ b/tools/testing/selftests/arm64/morello/mmap.c @@ -563,6 +563,50 @@ TEST(test_brk_check) EXPECT_EQ(retval, -ENOSYS); } +/* test to verify the CHERI unrepresentable address/length */ +TEST(test_cheri_unrepresentability) +{

• void *ptr1, *ptr2;
• int retval;
• int count = 0;
• int prot = PROT_READ | PROT_WRITE;
• int flags = MAP_PRIVATE | MAP_ANONYMOUS;
• size_t len, representable_base;
• /* Use pageshift 16 for 64K pages so as to use as mmap fixed address */
• unsigned long pageshift = 16;
• /* Generate an unrepresentable length/address */
• do {

• len = (1 << (pageshift++)) + ((count++ % pagesize) * pagesize);
  

Is there a particular rationale for the added multiplier (count++ % pagesize)? Does that yield an unrepresentable length faster?

Kevin

It was done to randomize the generation of the unrepresentable length/address.

...

• } while (len == cheri_representable_length(len));
• /* Create a memory mapping with reserved memory at the end */
• ptr1 = mmap(NULL, len, prot, flags, -1, 0);
• ASSERT_FALSE(IS_ERR_VALUE(ptr1));
• EXPECT_EQ(1, cheri_tag_get(ptr1));
• EXPECT_EQ(cheri_length_get(ptr1), cheri_representable_length(len));
• representable_base = (cheri_address_get(ptr1) & cheri_representable_alignment_mask(len));
• EXPECT_EQ(representable_base, cheri_base_get(ptr1));
• EXPECT_EQ(0, probe_mem_range(ptr1, len, PROBE_MODE_TOUCH | PROBE_MODE_VERIFY));
• /* Create a memory mapping with reserved memory at the front */
• ptr2 = mmap((void *)(uintcap_t)len, len, prot, flags, -1, 0);
• ASSERT_FALSE(IS_ERR_VALUE(ptr2));
• EXPECT_EQ(1, cheri_tag_get(ptr2));
• EXPECT_EQ(cheri_length_get(ptr2), cheri_representable_length(len));
• representable_base = (cheri_address_get(ptr2) & cheri_representable_alignment_mask(len));
• EXPECT_EQ(representable_base, cheri_base_get(ptr2));
• ASSERT_EQ(len, cheri_address_get(ptr2));
• EXPECT_EQ(0, probe_mem_range(ptr2, len, PROBE_MODE_TOUCH | PROBE_MODE_VERIFY));
• retval = munmap(ptr1, len);
• ASSERT_EQ(retval, 0);
• retval = munmap(ptr2, len);
• ASSERT_EQ(retval, 0);

+}

• int main(int argc __maybe_unused, char **argv __maybe_unused, char **envp __maybe_unused, struct morello_auxv *auxv) {

@@ -577,5 +621,6 @@ int main(int argc __maybe_unused, char **argv __maybe_unused, char **envp __mayb test_check_mremap_reservation(); test_permissions(); test_brk_check();

• test_cheri_unrepresentability(); return 0; }