1 #if defined __amd64__ || defined __i386__ 2 /* 3 * Copyright (c) 2022 Alexey Dobriyan <adobriyan@gmail.com> 4 * 5 * Permission to use, copy, modify, and distribute this software for any 6 * purpose with or without fee is hereby granted, provided that the above 7 * copyright notice and this permission notice appear in all copies. 8 * 9 * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES 10 * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF 11 * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR 12 * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES 13 * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN 14 * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF 15 * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE. 16 */ 17 /* 18 * Create a process without mappings by unmapping everything at once and 19 * holding it with ptrace(2). See what happens to 20 * 21 * /proc/${pid}/maps 22 * /proc/${pid}/numa_maps 23 * /proc/${pid}/smaps 24 * /proc/${pid}/smaps_rollup 25 */ 26 #undef NDEBUG 27 #include <assert.h> 28 #include <errno.h> 29 #include <stdint.h> 30 #include <stdio.h> 31 #include <stdlib.h> 32 #include <string.h> 33 #include <fcntl.h> 34 #include <sys/mman.h> 35 #include <sys/ptrace.h> 36 #include <sys/resource.h> 37 #include <sys/types.h> 38 #include <sys/wait.h> 39 #include <unistd.h> 40 41 #ifdef __amd64__ 42 #define TEST_VSYSCALL 43 #endif 44 45 /* 46 * 0: vsyscall VMA doesn't exist vsyscall=none 47 * 1: vsyscall VMA is --xp vsyscall=xonly 48 * 2: vsyscall VMA is r-xp vsyscall=emulate 49 */ 50 static volatile int g_vsyscall; 51 static const char *g_proc_pid_maps_vsyscall; 52 static const char *g_proc_pid_smaps_vsyscall; 53 54 static const char proc_pid_maps_vsyscall_0[] = ""; 55 static const char proc_pid_maps_vsyscall_1[] = 56 "ffffffffff600000-ffffffffff601000 --xp 00000000 00:00 0 [vsyscall]\n"; 57 static const char proc_pid_maps_vsyscall_2[] = 58 "ffffffffff600000-ffffffffff601000 r-xp 00000000 00:00 0 [vsyscall]\n"; 59 60 static const char proc_pid_smaps_vsyscall_0[] = ""; 61 62 static const char proc_pid_smaps_vsyscall_1[] = 63 "ffffffffff600000-ffffffffff601000 r-xp 00000000 00:00 0 [vsyscall]\n" 64 "Size: 4 kB\n" 65 "KernelPageSize: 4 kB\n" 66 "MMUPageSize: 4 kB\n" 67 "Rss: 0 kB\n" 68 "Pss: 0 kB\n" 69 "Pss_Dirty: 0 kB\n" 70 "Shared_Clean: 0 kB\n" 71 "Shared_Dirty: 0 kB\n" 72 "Private_Clean: 0 kB\n" 73 "Private_Dirty: 0 kB\n" 74 "Referenced: 0 kB\n" 75 "Anonymous: 0 kB\n" 76 "LazyFree: 0 kB\n" 77 "AnonHugePages: 0 kB\n" 78 "ShmemPmdMapped: 0 kB\n" 79 "FilePmdMapped: 0 kB\n" 80 "Shared_Hugetlb: 0 kB\n" 81 "Private_Hugetlb: 0 kB\n" 82 "Swap: 0 kB\n" 83 "SwapPss: 0 kB\n" 84 "Locked: 0 kB\n" 85 "THPeligible: 0\n" 86 /* 87 * "ProtectionKey:" field is conditional. It is possible to check it as well, 88 * but I don't have such machine. 89 */ 90 ; 91 92 static const char proc_pid_smaps_vsyscall_2[] = 93 "ffffffffff600000-ffffffffff601000 --xp 00000000 00:00 0 [vsyscall]\n" 94 "Size: 4 kB\n" 95 "KernelPageSize: 4 kB\n" 96 "MMUPageSize: 4 kB\n" 97 "Rss: 0 kB\n" 98 "Pss: 0 kB\n" 99 "Pss_Dirty: 0 kB\n" 100 "Shared_Clean: 0 kB\n" 101 "Shared_Dirty: 0 kB\n" 102 "Private_Clean: 0 kB\n" 103 "Private_Dirty: 0 kB\n" 104 "Referenced: 0 kB\n" 105 "Anonymous: 0 kB\n" 106 "LazyFree: 0 kB\n" 107 "AnonHugePages: 0 kB\n" 108 "ShmemPmdMapped: 0 kB\n" 109 "FilePmdMapped: 0 kB\n" 110 "Shared_Hugetlb: 0 kB\n" 111 "Private_Hugetlb: 0 kB\n" 112 "Swap: 0 kB\n" 113 "SwapPss: 0 kB\n" 114 "Locked: 0 kB\n" 115 "THPeligible: 0\n" 116 /* 117 * "ProtectionKey:" field is conditional. It is possible to check it as well, 118 * but I'm too tired. 119 */ 120 ; 121 122 static void sigaction_SIGSEGV(int _, siginfo_t *__, void *___) 123 { 124 _exit(EXIT_FAILURE); 125 } 126 127 #ifdef TEST_VSYSCALL 128 static void sigaction_SIGSEGV_vsyscall(int _, siginfo_t *__, void *___) 129 { 130 _exit(g_vsyscall); 131 } 132 133 /* 134 * vsyscall page can't be unmapped, probe it directly. 135 */ 136 static void vsyscall(void) 137 { 138 pid_t pid; 139 int wstatus; 140 141 pid = fork(); 142 if (pid < 0) { 143 fprintf(stderr, "fork, errno %d\n", errno); 144 exit(1); 145 } 146 if (pid == 0) { 147 setrlimit(RLIMIT_CORE, &(struct rlimit){}); 148 149 /* Hide "segfault at ffffffffff600000" messages. */ 150 struct sigaction act = {}; 151 act.sa_flags = SA_SIGINFO; 152 act.sa_sigaction = sigaction_SIGSEGV_vsyscall; 153 sigaction(SIGSEGV, &act, NULL); 154 155 g_vsyscall = 0; 156 /* gettimeofday(NULL, NULL); */ 157 uint64_t rax = 0xffffffffff600000; 158 asm volatile ( 159 "call *%[rax]" 160 : [rax] "+a" (rax) 161 : "D" (NULL), "S" (NULL) 162 : "rcx", "r11" 163 ); 164 165 g_vsyscall = 1; 166 *(volatile int *)0xffffffffff600000UL; 167 168 g_vsyscall = 2; 169 exit(g_vsyscall); 170 } 171 waitpid(pid, &wstatus, 0); 172 if (WIFEXITED(wstatus)) { 173 g_vsyscall = WEXITSTATUS(wstatus); 174 } else { 175 fprintf(stderr, "error: vsyscall wstatus %08x\n", wstatus); 176 exit(1); 177 } 178 } 179 #endif 180 181 static int test_proc_pid_maps(pid_t pid) 182 { 183 char buf[4096]; 184 snprintf(buf, sizeof(buf), "/proc/%u/maps", pid); 185 int fd = open(buf, O_RDONLY); 186 if (fd == -1) { 187 perror("open /proc/${pid}/maps"); 188 return EXIT_FAILURE; 189 } else { 190 ssize_t rv = read(fd, buf, sizeof(buf)); 191 close(fd); 192 if (g_vsyscall == 0) { 193 assert(rv == 0); 194 } else { 195 size_t len = strlen(g_proc_pid_maps_vsyscall); 196 assert(rv == len); 197 assert(memcmp(buf, g_proc_pid_maps_vsyscall, len) == 0); 198 } 199 return EXIT_SUCCESS; 200 } 201 } 202 203 static int test_proc_pid_numa_maps(pid_t pid) 204 { 205 char buf[4096]; 206 snprintf(buf, sizeof(buf), "/proc/%u/numa_maps", pid); 207 int fd = open(buf, O_RDONLY); 208 if (fd == -1) { 209 if (errno == ENOENT) { 210 /* 211 * /proc/${pid}/numa_maps is under CONFIG_NUMA, 212 * it doesn't necessarily exist. 213 */ 214 return EXIT_SUCCESS; 215 } 216 perror("open /proc/${pid}/numa_maps"); 217 return EXIT_FAILURE; 218 } else { 219 ssize_t rv = read(fd, buf, sizeof(buf)); 220 close(fd); 221 assert(rv == 0); 222 return EXIT_SUCCESS; 223 } 224 } 225 226 static int test_proc_pid_smaps(pid_t pid) 227 { 228 char buf[4096]; 229 snprintf(buf, sizeof(buf), "/proc/%u/smaps", pid); 230 int fd = open(buf, O_RDONLY); 231 if (fd == -1) { 232 if (errno == ENOENT) { 233 /* 234 * /proc/${pid}/smaps is under CONFIG_PROC_PAGE_MONITOR, 235 * it doesn't necessarily exist. 236 */ 237 return EXIT_SUCCESS; 238 } 239 perror("open /proc/${pid}/smaps"); 240 return EXIT_FAILURE; 241 } else { 242 ssize_t rv = read(fd, buf, sizeof(buf)); 243 close(fd); 244 if (g_vsyscall == 0) { 245 assert(rv == 0); 246 } else { 247 size_t len = strlen(g_proc_pid_maps_vsyscall); 248 /* TODO "ProtectionKey:" */ 249 assert(rv > len); 250 assert(memcmp(buf, g_proc_pid_maps_vsyscall, len) == 0); 251 } 252 return EXIT_SUCCESS; 253 } 254 } 255 256 static const char g_smaps_rollup[] = 257 "00000000-00000000 ---p 00000000 00:00 0 [rollup]\n" 258 "Rss: 0 kB\n" 259 "Pss: 0 kB\n" 260 "Pss_Dirty: 0 kB\n" 261 "Pss_Anon: 0 kB\n" 262 "Pss_File: 0 kB\n" 263 "Pss_Shmem: 0 kB\n" 264 "Shared_Clean: 0 kB\n" 265 "Shared_Dirty: 0 kB\n" 266 "Private_Clean: 0 kB\n" 267 "Private_Dirty: 0 kB\n" 268 "Referenced: 0 kB\n" 269 "Anonymous: 0 kB\n" 270 "KSM: 0 kB\n" 271 "LazyFree: 0 kB\n" 272 "AnonHugePages: 0 kB\n" 273 "ShmemPmdMapped: 0 kB\n" 274 "FilePmdMapped: 0 kB\n" 275 "Shared_Hugetlb: 0 kB\n" 276 "Private_Hugetlb: 0 kB\n" 277 "Swap: 0 kB\n" 278 "SwapPss: 0 kB\n" 279 "Locked: 0 kB\n" 280 ; 281 282 static int test_proc_pid_smaps_rollup(pid_t pid) 283 { 284 char buf[4096]; 285 snprintf(buf, sizeof(buf), "/proc/%u/smaps_rollup", pid); 286 int fd = open(buf, O_RDONLY); 287 if (fd == -1) { 288 if (errno == ENOENT) { 289 /* 290 * /proc/${pid}/smaps_rollup is under CONFIG_PROC_PAGE_MONITOR, 291 * it doesn't necessarily exist. 292 */ 293 return EXIT_SUCCESS; 294 } 295 perror("open /proc/${pid}/smaps_rollup"); 296 return EXIT_FAILURE; 297 } else { 298 ssize_t rv = read(fd, buf, sizeof(buf)); 299 close(fd); 300 assert(rv == sizeof(g_smaps_rollup) - 1); 301 assert(memcmp(buf, g_smaps_rollup, sizeof(g_smaps_rollup) - 1) == 0); 302 return EXIT_SUCCESS; 303 } 304 } 305 306 static const char *parse_u64(const char *p, const char *const end, uint64_t *rv) 307 { 308 *rv = 0; 309 for (; p != end; p += 1) { 310 if ('0' <= *p && *p <= '9') { 311 assert(!__builtin_mul_overflow(*rv, 10, rv)); 312 assert(!__builtin_add_overflow(*rv, *p - '0', rv)); 313 } else { 314 break; 315 } 316 } 317 assert(p != end); 318 return p; 319 } 320 321 /* 322 * There seems to be 2 types of valid output: 323 * "0 A A B 0 0 0\n" for dynamic exeuctables, 324 * "0 0 0 B 0 0 0\n" for static executables. 325 */ 326 static int test_proc_pid_statm(pid_t pid) 327 { 328 char buf[4096]; 329 snprintf(buf, sizeof(buf), "/proc/%u/statm", pid); 330 int fd = open(buf, O_RDONLY); 331 if (fd == -1) { 332 perror("open /proc/${pid}/statm"); 333 return EXIT_FAILURE; 334 } 335 336 ssize_t rv = read(fd, buf, sizeof(buf)); 337 close(fd); 338 339 assert(rv >= 0); 340 assert(rv <= sizeof(buf)); 341 if (0) { 342 write(1, buf, rv); 343 } 344 345 const char *p = buf; 346 const char *const end = p + rv; 347 348 /* size */ 349 assert(p != end && *p++ == '0'); 350 assert(p != end && *p++ == ' '); 351 352 uint64_t resident; 353 p = parse_u64(p, end, &resident); 354 assert(p != end && *p++ == ' '); 355 356 uint64_t shared; 357 p = parse_u64(p, end, &shared); 358 assert(p != end && *p++ == ' '); 359 360 uint64_t text; 361 p = parse_u64(p, end, &text); 362 assert(p != end && *p++ == ' '); 363 364 assert(p != end && *p++ == '0'); 365 assert(p != end && *p++ == ' '); 366 367 /* data */ 368 assert(p != end && *p++ == '0'); 369 assert(p != end && *p++ == ' '); 370 371 assert(p != end && *p++ == '0'); 372 assert(p != end && *p++ == '\n'); 373 374 assert(p == end); 375 376 /* 377 * "text" is "mm->end_code - mm->start_code" at execve(2) time. 378 * munmap() doesn't change it. It can be anything (just link 379 * statically). It can't be 0 because executing to this point 380 * implies at least 1 page of code. 381 */ 382 assert(text > 0); 383 384 /* 385 * These two are always equal. Always 0 for statically linked 386 * executables and sometimes 0 for dynamically linked executables. 387 * There is no way to tell one from another without parsing ELF 388 * which is too much for this test. 389 */ 390 assert(resident == shared); 391 392 return EXIT_SUCCESS; 393 } 394 395 int main(void) 396 { 397 int rv = EXIT_SUCCESS; 398 399 #ifdef TEST_VSYSCALL 400 vsyscall(); 401 #endif 402 403 switch (g_vsyscall) { 404 case 0: 405 g_proc_pid_maps_vsyscall = proc_pid_maps_vsyscall_0; 406 g_proc_pid_smaps_vsyscall = proc_pid_smaps_vsyscall_0; 407 break; 408 case 1: 409 g_proc_pid_maps_vsyscall = proc_pid_maps_vsyscall_1; 410 g_proc_pid_smaps_vsyscall = proc_pid_smaps_vsyscall_1; 411 break; 412 case 2: 413 g_proc_pid_maps_vsyscall = proc_pid_maps_vsyscall_2; 414 g_proc_pid_smaps_vsyscall = proc_pid_smaps_vsyscall_2; 415 break; 416 default: 417 abort(); 418 } 419 420 pid_t pid = fork(); 421 if (pid == -1) { 422 perror("fork"); 423 return EXIT_FAILURE; 424 } else if (pid == 0) { 425 rv = ptrace(PTRACE_TRACEME, 0, NULL, NULL); 426 if (rv != 0) { 427 if (errno == EPERM) { 428 fprintf(stderr, 429 "Did you know? ptrace(PTRACE_TRACEME) doesn't work under strace.\n" 430 ); 431 kill(getppid(), SIGTERM); 432 return EXIT_FAILURE; 433 } 434 perror("ptrace PTRACE_TRACEME"); 435 return EXIT_FAILURE; 436 } 437 438 /* 439 * Hide "segfault at ..." messages. Signal handler won't run. 440 */ 441 struct sigaction act = {}; 442 act.sa_flags = SA_SIGINFO; 443 act.sa_sigaction = sigaction_SIGSEGV; 444 sigaction(SIGSEGV, &act, NULL); 445 446 #ifdef __amd64__ 447 munmap(NULL, ((size_t)1 << 47) - 4096); 448 #elif defined __i386__ 449 { 450 size_t len; 451 452 for (len = -4096;; len -= 4096) { 453 munmap(NULL, len); 454 } 455 } 456 #else 457 #error "implement 'unmap everything'" 458 #endif 459 return EXIT_FAILURE; 460 } else { 461 /* 462 * TODO find reliable way to signal parent that munmap(2) completed. 463 * Child can't do it directly because it effectively doesn't exist 464 * anymore. Looking at child's VM files isn't 100% reliable either: 465 * due to a bug they may not become empty or empty-like. 466 */ 467 sleep(1); 468 469 if (rv == EXIT_SUCCESS) { 470 rv = test_proc_pid_maps(pid); 471 } 472 if (rv == EXIT_SUCCESS) { 473 rv = test_proc_pid_numa_maps(pid); 474 } 475 if (rv == EXIT_SUCCESS) { 476 rv = test_proc_pid_smaps(pid); 477 } 478 if (rv == EXIT_SUCCESS) { 479 rv = test_proc_pid_smaps_rollup(pid); 480 } 481 if (rv == EXIT_SUCCESS) { 482 rv = test_proc_pid_statm(pid); 483 } 484 485 /* Cut the rope. */ 486 int wstatus; 487 waitpid(pid, &wstatus, 0); 488 assert(WIFSTOPPED(wstatus)); 489 assert(WSTOPSIG(wstatus) == SIGSEGV); 490 } 491 492 return rv; 493 } 494 #else 495 int main(void) 496 { 497 return 4; 498 } 499 #endif 500