From mboxrd@z Thu Jan 1 00:00:00 1970 Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.remote-ip=209.85.216.47 ARC-Seal: i=1; d=subspace.kernel.org; s=arc20261015; a=rsa-sha256; cv=none; t=1793719091; b=kgvPNqezYqOPnTjETdtyFogDpdzayUHcIQgE/ppm5oIM/QZ4L9shmzE1Z2KrMKsZHz1u 60kcdahZr/101ILeSi9LgOyeAX5E8o7IgUe9Bpk/noE6x3WcAarktk3U2oPE7pSN/6mQR 1WQmmzEdQU3EYAZ78l8rHMkKWhcTpQRaWN24XhzTqfqo7pq8g7wwlGbSmlXEV5rb082Aj RUDPmbo2XA4nEkOkENOAixr0VnhmVS+eK+N6f385cCWGEOK4NxaOTDpixfBb5uTGFQ5gm Ab2kbAKNrpRPTBX/gQoH3xF0O9pepLWtqRtp47snuaImMVVohHiM+kAtxuUby3gAUlg== ARC-Message-Signature: i=1; d=subspace.kernel.org; s=arc20261015; a=rsa-sha256; c=relaxed/relaxed; t=1793719091; h=DMARC-Filter:Received:DKIM-Signature:X-Google-DKIM-Signature: X-Forwarded-Encrypted:X-Gm-Message-State:X-Gm-Gg:X-Received:Received: Date:From:To:Cc:Subject:Message-ID:References:MIME-Version: Content-Type:Content-Disposition:In-Reply-To:User-Agent; bh=qMbUoE7myG/GAn/bAOasbXOTltQ3YhdGAnoaT+YPoYA=; b=K/emP9HlwXPZqzeNhdajlZyN+QOfd9prjrqjIFMUl0lAbuqKjTBbOIBYxXxW4uqA4jQd yZmiczMiUTprRuhrH+OOP+0EBp3opvFhuXDy6C49vW8OnbUvTrZ6NppQ2rm/1BPs+oFCW frd2UI0LFoz45wf2SGmevzQ3MqJvhjK9/UsXP4MVmRdOv2/ocP0RClYugF+J6QLh4tc08 2mQABeUpJVoW3RcePqw0TaBkfU7LbaqAyRCSx8ub8IeFIeJErARqCcG0GRrq2Soc+gsFN SqUnAEjyqj5mCM4NPT0E0AVBlXzyoFANOiqSFAlswKKO+GxHETSpm6PbYSFfL9HfNUg== ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass header.from=chrisdown.name; spf=pass smtp.mailfrom=chrisdown.name; dkim=pass header.d=chrisdown.name header.i=@chrisdown.name header.a=rsa-sha256 header.s=google header.b="p/kCuN20"; arc=none smtp.remote-ip=209.85.216.47 Received: from mail-pj1-f47.google.com (mail-pj1-f47.google.com [209.85.216.47]) (using TLSv1.3 with cipher TLS_AES_128_GCM_SHA256 (128/128 bits) key-exchange X25519 server-signature ECDSA (prime256v1) server-digest SHA256) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 892ED606B273 for ; Tue, 3 Nov 2026 15:18:10 +0000 (UTC) DMARC-Filter: OpenDMARC Filter v1.4.2 smtp.subspace.kernel.org 892ED606B273 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=quarantine dis=none) header.from=chrisdown.name Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=chrisdown.name Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key, unprotected) header.d=chrisdown.name header.i=@chrisdown.name header.a=rsa-sha256 header.s=google header.b=p/kCuN20 Received: by mail-pj1-f47.google.com with SMTP id 98e67ed59e1d1-3ac9f49b984so554000a91.1 for ; Tue, 03 Nov 2026 07:18:10 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=chrisdown.name; s=google; t=1793719090; x=1794323890; darn=vger.kernel.org; h=user-agent:in-reply-to:content-disposition:content-type :mime-version:references:message-id:subject:cc:to:from:date:from:to :cc:subject:date:message-id:reply-to:content-type; bh=qMbUoE7myG/GAn/bAOasbXOTltQ3YhdGAnoaT+YPoYA=; b=p/kCuN20gyAkrSvljj3hdsphluitU8f5J8am+KboA8ZLs9tHk1gPwvR8KdkfAMjdm7 10OwgpsxuZ5weZnwdFdepjEmZYfJ3mDeoPWjZWPSTjQ9u2KNp5OTXv+A8t6bfArOeZRp fp+8CF4kYPuQhEUcrVqcHLikxSKgicQY+GkUE= X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20260707; t=1793719090; x=1794323890; h=user-agent:in-reply-to:content-disposition:content-type :mime-version:references:message-id:subject:cc:to:from:date:x-gm-gg :x-gm-message-state:from:to:cc:subject:date:message-id:reply-to :content-type; bh=qMbUoE7myG/GAn/bAOasbXOTltQ3YhdGAnoaT+YPoYA=; b=1DFTiqmfKKtL+QBIfXIuY+Cq18BaGCr/c3Mcoj9V8zcF6qVxSfExo7hyoqNAYU/6+w TczMdebjqG39E/Q50/pndvNyi0Xo20sAvL8hGX4PR2JIFnG1XSHj6lRff2/M/jj99110 fdaCszrdT/+u5Y32eCj52V81KA25s4jNqJQf4IrSL4HnPjL8XCP3vYJWMrq+Qid5Opd9 15J4OMNfkjMJIHynfhO11bC+ZxNMafUtiIZluZGmfCYuzfEg6frLclX/q9fAAnaAyNw4 VnIrJs0jeT8h+UTtlgQ6ZXbPRZzW5CyfNmuxp0fTQFXoWmHf06ihUxsK1ZtOTxKRwKAa cUoA== X-Forwarded-Encrypted: i=1; AKwUvBwKvra3EdzC3LHwCMmcJddxUjvvrepdBR+BfTA62xf2Kmj4wroh2mGqQ0Ng3fNVL8crXspkBsmoVCjbW9E=@vger.kernel.org X-Gm-Message-State: APuU4Z8wmHWO/ADvq/WSJ0PWaMHvPIqfOE+AXZTQSAtoCnmjdhS3jCh6 BKWZ0RZqdJtqYj9mapC24Df76YhhGMPXYcGAYaIs36B65q0C/lxEFGUwobMFpYw4Tec= X-Gm-Gg: AYBFou02TPzdkdviSGb1d5+Cqb5ffpJjXXcmU+KM77QiJeufnv00OYTZ/08mJP2DlOU OKDOMvHMWDZNH2OuyN6zuuBBptyjT6jtnBVGmf6wqa16eidc62fBeSPjRomJr9tVUiuCQuMyeSi 7kd+SHFgmEbp41fdX0mSmFwAZoqqopGfQ142Qn1lfeAKQnlByPR358CKykMdMmQ9EyMvT3LlBhp zG3G+30LaWljq59PcRp1MZ8WjBZzkLw+AFqJyRqnCoYActzYGLMt6BebTUXoYDqN1Fn2afqsNDc mPZMg7MciRcsn5OnOINTho43g3Wra6A2o8nXBsZ/VOvIN52vaA9o6QDEzRSA28usV7xl1E8nZI5 lDaQMGkvLL80ulYG4a9GUa5jGkIM5Mc8tVJ2A4gwaoKuFmX1AtLWa7qiD1CjnRDhZxumz0gAOkD VDoXakWdqwsqTzaTd6wD6/SgURg+VBLmtDjokdOfcJPFVG3EET3PmyEKtRnGNH/9lks9pnytfUf T6cEaDc95a/4k26CWO+aqemiNg8TDGenhoaLcUvhjLiOPPfCLIM0N+z6QnR3j3P6eXeQaDvtXF/ 3DFBQDlwbK8eZ+6Jno8ixOyEmya6vObZBZixOFmSfykKZwYopBWP++Kg6tkiR6UFReB7VtFzq/m p1m2fW4RVwzz0WXJ4yeyiDd4DbQo9OaRoUB0ltwGbqUVPGw28QMqRUlZsQm0oXvQ+IpAJJOgN X-Received: by 2002:a17:90b:3ec7:b0:3ac:7406:b49 with SMTP id 98e67ed59e1d1-3ae896d7a1cmr6969572a91.15.1793719089722; Tue, 03 Nov 2026 07:18:09 -0800 (PST) Received: from localhost ([116.86.153.182]) by smtp.gmail.com with ESMTPSA id 98e67ed59e1d1-3b07c903d0dsm4842349a91.12.2026.11.03.07.18.06 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Tue, 03 Nov 2026 07:18:07 -0800 (PST) Date: Tue, 3 Nov 2026 23:18:04 +0800 From: Chris Down To: Andrew Morton , "Liam R. Howlett" , Lorenzo Stoakes Cc: Jeff Xu , David Hildenbrand , Vlastimil Babka , Jann Horn , Pedro Falcato , Mike Rapoport , Suren Baghdasaryan , Michal Hocko , Kees Cook , Andrey Vagin , Alexander Mikhalitsyn , Shuah Khan , Oleg Nesterov , Masami Hiramatsu , Peter Zijlstra , Jiri Olsa , Thomas Gleixner , Ingo Molnar , Borislav Petkov , Dave Hansen , "H. Peter Anvin" , Andy Lutomirski , Catalin Marinas , Will Deacon , Mark Rutland , Huacai Chen , WANG Xuerui , Paul Walmsley , Palmer Dabbelt , Albert Ou , Alexandre Ghiti , Heiko Carstens , Vasily Gorbik , Alexander Gordeev , Christian Borntraeger , Sven Schnelle , Vincenzo Frascino , Paul Moore , James Morris , "Serge E. Hallyn" , Jonathan Corbet , Randy Dunlap , linux-mm@kvack.org, linux-hardening@vger.kernel.org, linux-kselftest@vger.kernel.org, linux-doc@vger.kernel.org, linux-security-module@vger.kernel.org, linux-trace-kernel@vger.kernel.org, x86@kernel.org, linux-arm-kernel@lists.infradead.org, loongarch@lists.linux.dev, linux-riscv@lists.infradead.org, linux-s390@vger.kernel.org, linux-kernel@vger.kernel.org, kernel-team@meta.com Subject: [PATCH v2 2/8] selftests/mm: Skip sysmap_is_sealed when system mappings aren't sealed Message-ID: <6b11e9f77d8ede7ef2f16fef173970a7fa1978e5.1793718940.git.chris@chrisdown.name> References: X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Post: List-Help: List-Subscribe: List-Unsubscribe: List-Owner: Precedence: list MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline In-Reply-To: User-Agent: Mutt/2.3.3 (9073d26d) (2026-06-12) Now that sysmap_is_sealed runs with the other mm tests, it also runs on kernels built without CONFIG_MSEAL_SYSTEM_MAPPINGS, where it fails. Userspace can't tell whether the option is enabled, but a sealed [vdso] in a new process means that it is. So let's use [vdso] as the reference: skip if it isn't sealed, and otherwise expect the other system mappings to be sealed too, and [stack] not to be. Signed-off-by: Chris Down --- tools/testing/selftests/mm/run_vmtests.sh | 7 +++++- tools/testing/selftests/mm/sysmap_is_sealed.c | 22 +++++++++++++++++++ tools/testing/selftests/mm/vm_util.c | 5 +++++ tools/testing/selftests/mm/vm_util.h | 1 + 4 files changed, 34 insertions(+), 1 deletion(-) diff --git a/tools/testing/selftests/mm/run_vmtests.sh b/tools/testing/selftests/mm/run_vmtests.sh index 573da5006268..1134a2e82610 100755 --- a/tools/testing/selftests/mm/run_vmtests.sh +++ b/tools/testing/selftests/mm/run_vmtests.sh @@ -307,7 +307,12 @@ fi CATEGORY="mmap" run_test ./map_populate CATEGORY="mmap" run_test ./droppable -CATEGORY="mmap" run_test ./sysmap_is_sealed +if gzip -dcfq /proc/config.gz "/boot/config-$(uname -r)" 2>/dev/null | + grep -q "^CONFIG_MSEAL_SYSTEM_MAPPINGS=y"; then + CATEGORY="mmap" run_test ./sysmap_is_sealed +else + CATEGORY="mmap" run_test ./sysmap_is_sealed -T expect_sealed +fi CATEGORY="mlock" run_test ./mlock-random-test diff --git a/tools/testing/selftests/mm/sysmap_is_sealed.c b/tools/testing/selftests/mm/sysmap_is_sealed.c index cb0ca6ed7ebe..d5ab2b0d8ca7 100644 --- a/tools/testing/selftests/mm/sysmap_is_sealed.c +++ b/tools/testing/selftests/mm/sysmap_is_sealed.c @@ -10,9 +10,11 @@ #include #include #include +#include #include "kselftest.h" #include "kselftest_harness.h" +#include "vm_util.h" #define VMFLAGS "VmFlags:" #define MSEAL_FLAGS "sl" @@ -46,6 +48,23 @@ bool mapping_is_sealed(char *name, FILE *maps) return false; } +static bool sysmaps_sealed(void) +{ + void *vdso = (void *)getauxval(AT_SYSINFO_EHDR); + + return vdso && check_vmflag_sealed(vdso); +} + +/* + * Kernels built without CONFIG_MSEAL_SYSTEM_MAPPINGS don't seal system + * mappings either, so check_sealed skips if they aren't sealed. This fails + * instead, so run_vmtests.sh only runs it when that's set. + */ +TEST(expect_sealed) +{ + EXPECT_TRUE(sysmaps_sealed()); +} + FIXTURE(basic) { FILE *maps; }; @@ -107,6 +126,9 @@ FIXTURE_VARIANT_ADD(basic, stack) { TEST_F(basic, check_sealed) { + if (!sysmaps_sealed()) + SKIP(return, "system mappings are not sealed"); + if (!has_mapping(variant->name, self->maps)) { SKIP(return, "could not find the mapping, %s", variant->name); diff --git a/tools/testing/selftests/mm/vm_util.c b/tools/testing/selftests/mm/vm_util.c index 8ef226107d78..6732f76b7e61 100644 --- a/tools/testing/selftests/mm/vm_util.c +++ b/tools/testing/selftests/mm/vm_util.c @@ -785,6 +785,11 @@ bool check_vmflag_guard(void *addr) return check_vmflag(addr, "gu"); } +bool check_vmflag_sealed(void *addr) +{ + return check_vmflag(addr, "sl"); +} + bool softdirty_supported(void) { char *addr; diff --git a/tools/testing/selftests/mm/vm_util.h b/tools/testing/selftests/mm/vm_util.h index d32cb79d9905..0e94793b0d21 100644 --- a/tools/testing/selftests/mm/vm_util.h +++ b/tools/testing/selftests/mm/vm_util.h @@ -117,6 +117,7 @@ int uffd_register_with_ioctls(int uffd, void *addr, uint64_t len, bool check_vmflag_io(void *addr); bool check_vmflag_pfnmap(void *addr); bool check_vmflag_guard(void *addr); +bool check_vmflag_sealed(void *addr); int open_procmap(pid_t pid, struct procmap_fd *procmap_out); int query_procmap(struct procmap_fd *procmap); bool find_vma_procmap(struct procmap_fd *procmap, void *address); -- 2.54.0