| #if defined __amd64__ || defined __i386__ |
| /* |
| * Copyright (c) 2022 Alexey Dobriyan <adobriyan@gmail.com> |
| * |
| * Permission to use, copy, modify, and distribute this software for any |
| * purpose with or without fee is hereby granted, provided that the above |
| * copyright notice and this permission notice appear in all copies. |
| * |
| * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES |
| * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF |
| * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR |
| * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES |
| * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN |
| * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF |
| * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE. |
| */ |
| /* |
| * Create a process without mappings by unmapping everything at once and |
| * holding it with ptrace(2). See what happens to |
| * |
| * /proc/${pid}/maps |
| * /proc/${pid}/numa_maps |
| * /proc/${pid}/smaps |
| * /proc/${pid}/smaps_rollup |
| */ |
| #undef NDEBUG |
| #include <assert.h> |
| #include <errno.h> |
| #include <stdint.h> |
| #include <stdio.h> |
| #include <stdlib.h> |
| #include <string.h> |
| #include <fcntl.h> |
| #include <sys/mman.h> |
| #include <sys/ptrace.h> |
| #include <sys/resource.h> |
| #include <sys/types.h> |
| #include <sys/wait.h> |
| #include <unistd.h> |
| |
| #ifdef __amd64__ |
| #define TEST_VSYSCALL |
| #endif |
| |
| /* |
| * 0: vsyscall VMA doesn't exist vsyscall=none |
| * 1: vsyscall VMA is --xp vsyscall=xonly |
| * 2: vsyscall VMA is r-xp vsyscall=emulate |
| */ |
| static volatile int g_vsyscall; |
| static const char *g_proc_pid_maps_vsyscall; |
| static const char *g_proc_pid_smaps_vsyscall; |
| |
| static const char proc_pid_maps_vsyscall_0[] = ""; |
| static const char proc_pid_maps_vsyscall_1[] = |
| "ffffffffff600000-ffffffffff601000 --xp 00000000 00:00 0 [vsyscall]\n"; |
| static const char proc_pid_maps_vsyscall_2[] = |
| "ffffffffff600000-ffffffffff601000 r-xp 00000000 00:00 0 [vsyscall]\n"; |
| |
| static const char proc_pid_smaps_vsyscall_0[] = ""; |
| |
| static const char proc_pid_smaps_vsyscall_1[] = |
| "ffffffffff600000-ffffffffff601000 r-xp 00000000 00:00 0 [vsyscall]\n" |
| "Size: 4 kB\n" |
| "KernelPageSize: 4 kB\n" |
| "MMUPageSize: 4 kB\n" |
| "Rss: 0 kB\n" |
| "Pss: 0 kB\n" |
| "Pss_Dirty: 0 kB\n" |
| "Shared_Clean: 0 kB\n" |
| "Shared_Dirty: 0 kB\n" |
| "Private_Clean: 0 kB\n" |
| "Private_Dirty: 0 kB\n" |
| "Referenced: 0 kB\n" |
| "Anonymous: 0 kB\n" |
| "LazyFree: 0 kB\n" |
| "AnonHugePages: 0 kB\n" |
| "ShmemPmdMapped: 0 kB\n" |
| "FilePmdMapped: 0 kB\n" |
| "Shared_Hugetlb: 0 kB\n" |
| "Private_Hugetlb: 0 kB\n" |
| "Swap: 0 kB\n" |
| "SwapPss: 0 kB\n" |
| "Locked: 0 kB\n" |
| "THPeligible: 0\n" |
| /* |
| * "ProtectionKey:" field is conditional. It is possible to check it as well, |
| * but I don't have such machine. |
| */ |
| ; |
| |
| static const char proc_pid_smaps_vsyscall_2[] = |
| "ffffffffff600000-ffffffffff601000 --xp 00000000 00:00 0 [vsyscall]\n" |
| "Size: 4 kB\n" |
| "KernelPageSize: 4 kB\n" |
| "MMUPageSize: 4 kB\n" |
| "Rss: 0 kB\n" |
| "Pss: 0 kB\n" |
| "Pss_Dirty: 0 kB\n" |
| "Shared_Clean: 0 kB\n" |
| "Shared_Dirty: 0 kB\n" |
| "Private_Clean: 0 kB\n" |
| "Private_Dirty: 0 kB\n" |
| "Referenced: 0 kB\n" |
| "Anonymous: 0 kB\n" |
| "LazyFree: 0 kB\n" |
| "AnonHugePages: 0 kB\n" |
| "ShmemPmdMapped: 0 kB\n" |
| "FilePmdMapped: 0 kB\n" |
| "Shared_Hugetlb: 0 kB\n" |
| "Private_Hugetlb: 0 kB\n" |
| "Swap: 0 kB\n" |
| "SwapPss: 0 kB\n" |
| "Locked: 0 kB\n" |
| "THPeligible: 0\n" |
| /* |
| * "ProtectionKey:" field is conditional. It is possible to check it as well, |
| * but I'm too tired. |
| */ |
| ; |
| |
| static void sigaction_SIGSEGV(int _, siginfo_t *__, void *___) |
| { |
| _exit(EXIT_FAILURE); |
| } |
| |
| #ifdef TEST_VSYSCALL |
| static void sigaction_SIGSEGV_vsyscall(int _, siginfo_t *__, void *___) |
| { |
| _exit(g_vsyscall); |
| } |
| |
| /* |
| * vsyscall page can't be unmapped, probe it directly. |
| */ |
| static void vsyscall(void) |
| { |
| pid_t pid; |
| int wstatus; |
| |
| pid = fork(); |
| if (pid < 0) { |
| fprintf(stderr, "fork, errno %d\n", errno); |
| exit(1); |
| } |
| if (pid == 0) { |
| setrlimit(RLIMIT_CORE, &(struct rlimit){}); |
| |
| /* Hide "segfault at ffffffffff600000" messages. */ |
| struct sigaction act = {}; |
| act.sa_flags = SA_SIGINFO; |
| act.sa_sigaction = sigaction_SIGSEGV_vsyscall; |
| sigaction(SIGSEGV, &act, NULL); |
| |
| g_vsyscall = 0; |
| /* gettimeofday(NULL, NULL); */ |
| uint64_t rax = 0xffffffffff600000; |
| asm volatile ( |
| "call *%[rax]" |
| : [rax] "+a" (rax) |
| : "D" (NULL), "S" (NULL) |
| : "rcx", "r11" |
| ); |
| |
| g_vsyscall = 1; |
| *(volatile int *)0xffffffffff600000UL; |
| |
| g_vsyscall = 2; |
| exit(g_vsyscall); |
| } |
| waitpid(pid, &wstatus, 0); |
| if (WIFEXITED(wstatus)) { |
| g_vsyscall = WEXITSTATUS(wstatus); |
| } else { |
| fprintf(stderr, "error: vsyscall wstatus %08x\n", wstatus); |
| exit(1); |
| } |
| } |
| #endif |
| |
| static int test_proc_pid_maps(pid_t pid) |
| { |
| char buf[4096]; |
| snprintf(buf, sizeof(buf), "/proc/%u/maps", pid); |
| int fd = open(buf, O_RDONLY); |
| if (fd == -1) { |
| perror("open /proc/${pid}/maps"); |
| return EXIT_FAILURE; |
| } else { |
| ssize_t rv = read(fd, buf, sizeof(buf)); |
| close(fd); |
| if (g_vsyscall == 0) { |
| assert(rv == 0); |
| } else { |
| size_t len = strlen(g_proc_pid_maps_vsyscall); |
| assert(rv == len); |
| assert(memcmp(buf, g_proc_pid_maps_vsyscall, len) == 0); |
| } |
| return EXIT_SUCCESS; |
| } |
| } |
| |
| static int test_proc_pid_numa_maps(pid_t pid) |
| { |
| char buf[4096]; |
| snprintf(buf, sizeof(buf), "/proc/%u/numa_maps", pid); |
| int fd = open(buf, O_RDONLY); |
| if (fd == -1) { |
| if (errno == ENOENT) { |
| /* |
| * /proc/${pid}/numa_maps is under CONFIG_NUMA, |
| * it doesn't necessarily exist. |
| */ |
| return EXIT_SUCCESS; |
| } |
| perror("open /proc/${pid}/numa_maps"); |
| return EXIT_FAILURE; |
| } else { |
| ssize_t rv = read(fd, buf, sizeof(buf)); |
| close(fd); |
| assert(rv == 0); |
| return EXIT_SUCCESS; |
| } |
| } |
| |
| static int test_proc_pid_smaps(pid_t pid) |
| { |
| char buf[4096]; |
| snprintf(buf, sizeof(buf), "/proc/%u/smaps", pid); |
| int fd = open(buf, O_RDONLY); |
| if (fd == -1) { |
| if (errno == ENOENT) { |
| /* |
| * /proc/${pid}/smaps is under CONFIG_PROC_PAGE_MONITOR, |
| * it doesn't necessarily exist. |
| */ |
| return EXIT_SUCCESS; |
| } |
| perror("open /proc/${pid}/smaps"); |
| return EXIT_FAILURE; |
| } else { |
| ssize_t rv = read(fd, buf, sizeof(buf)); |
| close(fd); |
| if (g_vsyscall == 0) { |
| assert(rv == 0); |
| } else { |
| size_t len = strlen(g_proc_pid_maps_vsyscall); |
| /* TODO "ProtectionKey:" */ |
| assert(rv > len); |
| assert(memcmp(buf, g_proc_pid_maps_vsyscall, len) == 0); |
| } |
| return EXIT_SUCCESS; |
| } |
| } |
| |
| static const char g_smaps_rollup[] = |
| "00000000-00000000 ---p 00000000 00:00 0 [rollup]\n" |
| "Rss: 0 kB\n" |
| "Pss: 0 kB\n" |
| "Pss_Dirty: 0 kB\n" |
| "Pss_Anon: 0 kB\n" |
| "Pss_File: 0 kB\n" |
| "Pss_Shmem: 0 kB\n" |
| "Shared_Clean: 0 kB\n" |
| "Shared_Dirty: 0 kB\n" |
| "Private_Clean: 0 kB\n" |
| "Private_Dirty: 0 kB\n" |
| "Referenced: 0 kB\n" |
| "Anonymous: 0 kB\n" |
| "KSM: 0 kB\n" |
| "LazyFree: 0 kB\n" |
| "AnonHugePages: 0 kB\n" |
| "ShmemPmdMapped: 0 kB\n" |
| "FilePmdMapped: 0 kB\n" |
| "Shared_Hugetlb: 0 kB\n" |
| "Private_Hugetlb: 0 kB\n" |
| "Swap: 0 kB\n" |
| "SwapPss: 0 kB\n" |
| "Locked: 0 kB\n" |
| ; |
| |
| static int test_proc_pid_smaps_rollup(pid_t pid) |
| { |
| char buf[4096]; |
| snprintf(buf, sizeof(buf), "/proc/%u/smaps_rollup", pid); |
| int fd = open(buf, O_RDONLY); |
| if (fd == -1) { |
| if (errno == ENOENT) { |
| /* |
| * /proc/${pid}/smaps_rollup is under CONFIG_PROC_PAGE_MONITOR, |
| * it doesn't necessarily exist. |
| */ |
| return EXIT_SUCCESS; |
| } |
| perror("open /proc/${pid}/smaps_rollup"); |
| return EXIT_FAILURE; |
| } else { |
| ssize_t rv = read(fd, buf, sizeof(buf)); |
| close(fd); |
| assert(rv == sizeof(g_smaps_rollup) - 1); |
| assert(memcmp(buf, g_smaps_rollup, sizeof(g_smaps_rollup) - 1) == 0); |
| return EXIT_SUCCESS; |
| } |
| } |
| |
| int main(void) |
| { |
| int rv = EXIT_SUCCESS; |
| |
| #ifdef TEST_VSYSCALL |
| vsyscall(); |
| #endif |
| |
| switch (g_vsyscall) { |
| case 0: |
| g_proc_pid_maps_vsyscall = proc_pid_maps_vsyscall_0; |
| g_proc_pid_smaps_vsyscall = proc_pid_smaps_vsyscall_0; |
| break; |
| case 1: |
| g_proc_pid_maps_vsyscall = proc_pid_maps_vsyscall_1; |
| g_proc_pid_smaps_vsyscall = proc_pid_smaps_vsyscall_1; |
| break; |
| case 2: |
| g_proc_pid_maps_vsyscall = proc_pid_maps_vsyscall_2; |
| g_proc_pid_smaps_vsyscall = proc_pid_smaps_vsyscall_2; |
| break; |
| default: |
| abort(); |
| } |
| |
| pid_t pid = fork(); |
| if (pid == -1) { |
| perror("fork"); |
| return EXIT_FAILURE; |
| } else if (pid == 0) { |
| rv = ptrace(PTRACE_TRACEME, 0, NULL, NULL); |
| if (rv != 0) { |
| if (errno == EPERM) { |
| fprintf(stderr, |
| "Did you know? ptrace(PTRACE_TRACEME) doesn't work under strace.\n" |
| ); |
| kill(getppid(), SIGTERM); |
| return EXIT_FAILURE; |
| } |
| perror("ptrace PTRACE_TRACEME"); |
| return EXIT_FAILURE; |
| } |
| |
| /* |
| * Hide "segfault at ..." messages. Signal handler won't run. |
| */ |
| struct sigaction act = {}; |
| act.sa_flags = SA_SIGINFO; |
| act.sa_sigaction = sigaction_SIGSEGV; |
| sigaction(SIGSEGV, &act, NULL); |
| |
| #ifdef __amd64__ |
| munmap(NULL, ((size_t)1 << 47) - 4096); |
| #elif defined __i386__ |
| { |
| size_t len; |
| |
| for (len = -4096;; len -= 4096) { |
| munmap(NULL, len); |
| } |
| } |
| #else |
| #error "implement 'unmap everything'" |
| #endif |
| return EXIT_FAILURE; |
| } else { |
| /* |
| * TODO find reliable way to signal parent that munmap(2) completed. |
| * Child can't do it directly because it effectively doesn't exist |
| * anymore. Looking at child's VM files isn't 100% reliable either: |
| * due to a bug they may not become empty or empty-like. |
| */ |
| sleep(1); |
| |
| if (rv == EXIT_SUCCESS) { |
| rv = test_proc_pid_maps(pid); |
| } |
| if (rv == EXIT_SUCCESS) { |
| rv = test_proc_pid_numa_maps(pid); |
| } |
| if (rv == EXIT_SUCCESS) { |
| rv = test_proc_pid_smaps(pid); |
| } |
| if (rv == EXIT_SUCCESS) { |
| rv = test_proc_pid_smaps_rollup(pid); |
| } |
| /* |
| * TODO test /proc/${pid}/statm, task_statm() |
| * ->start_code, ->end_code aren't updated by munmap(). |
| * Output can be "0 0 0 2 0 0 0\n" where "2" can be anything. |
| */ |
| |
| /* Cut the rope. */ |
| int wstatus; |
| waitpid(pid, &wstatus, 0); |
| assert(WIFSTOPPED(wstatus)); |
| assert(WSTOPSIG(wstatus) == SIGSEGV); |
| } |
| |
| return rv; |
| } |
| #else |
| int main(void) |
| { |
| return 4; |
| } |
| #endif |