[PATCH] selftests/powerpc: Fix exec_prot test failure on Hash MMU

[PATCH] selftests/powerpc: Fix exec_prot test failure on Hash MMU

[Chris Chiu]

Hash MMU maps execute-only pages as readable at the PTE level, so reading
from a PROT_EXEC-only mapping does not fault there. The exec_prot test
currently treats that as a failure, while the rest of the permission
checks are still valid.

Use the existing using_hash_mmu() helper and skip only the read-on-
execute-only subtest on Hash MMU. Keep the rest of the test unchanged so
the fix stays local to the unsupported execute-only-read expectation.

Signed-off-by: Chris Chiu <chris.chiu@canonical.com>
---
 .../testing/selftests/powerpc/mm/exec_prot.c  | 21 ++++++++++++-------
 1 file changed, 14 insertions(+), 7 deletions(-)

diff --git a/tools/testing/selftests/powerpc/mm/exec_prot.c b/tools/testing/selftests/powerpc/mm/exec_prot.c
index db75b2225de1..bd44f49d8449 100644
--- a/tools/testing/selftests/powerpc/mm/exec_prot.c
+++ b/tools/testing/selftests/powerpc/mm/exec_prot.c
@@ -108,11 +108,14 @@ static int check_exec_fault(int rights)
 static int test(void)
 {
 	struct sigaction segv_act, trap_act;
+	bool hash_mmu;
 	int i;
 
 	/* Skip the test if the CPU doesn't support Radix */
 	SKIP_IF(!have_hwcap2(PPC_FEATURE2_ARCH_3_00));
 
+	FAIL_IF(using_hash_mmu(&hash_mmu));
+
 	/* Check if pkeys are supported */
 	pkeys_supported = pkeys_unsupported() == 0;
 
@@ -167,13 +170,17 @@ static int test(void)
 	 * Read an instruction word from the address when the page
 	 * is execute only. This should generate an access fault.
 	 */
-	fault_code = -1;
-	remaining_faults = 1;
-	printf("Testing read on --x, should fault...");
-	FAIL_IF(mprotect(insns, pgsize, PROT_EXEC) != 0);
-	i = *fault_addr;
-	FAIL_IF(remaining_faults != 0 || !is_fault_expected(fault_code));
-	printf("ok!\n");
+	if (!hash_mmu) {
+		fault_code = -1;
+		remaining_faults = 1;
+		printf("Testing read on --x, should fault...");
+		FAIL_IF(mprotect(insns, pgsize, PROT_EXEC) != 0);
+		i = *fault_addr;
+		FAIL_IF(remaining_faults != 0 || !is_fault_expected(fault_code));
+		printf("ok!\n");
+	} else {
+		printf("Testing read on --x, skipped on Hash MMU\n");
+	}
 
 	/*
 	 * Write an instruction word to the address when the page
-- 
2.43.0

Re: [PATCH] selftests/powerpc: Fix exec_prot test failure on Hash MMU

[Chris Chiu]

On Wed, Sep 9, 2026 at 1:09 PM Chris Chiu <chris.chiu@canonical.com> wrote:
>
> Hash MMU maps execute-only pages as readable at the PTE level, so reading
> from a PROT_EXEC-only mapping does not fault there. The exec_prot test
> currently treats that as a failure, while the rest of the permission
> checks are still valid.
>
> Use the existing using_hash_mmu() helper and skip only the read-on-
> execute-only subtest on Hash MMU. Keep the rest of the test unchanged so
> the fix stays local to the unsupported execute-only-read expectation.
>
> Signed-off-by: Chris Chiu <chris.chiu@canonical.com>
> ---
>  .../testing/selftests/powerpc/mm/exec_prot.c  | 21 ++++++++++++-------
>  1 file changed, 14 insertions(+), 7 deletions(-)
>
> diff --git a/tools/testing/selftests/powerpc/mm/exec_prot.c b/tools/testing/selftests/powerpc/mm/exec_prot.c
> index db75b2225de1..bd44f49d8449 100644
> --- a/tools/testing/selftests/powerpc/mm/exec_prot.c
> +++ b/tools/testing/selftests/powerpc/mm/exec_prot.c
> @@ -108,11 +108,14 @@ static int check_exec_fault(int rights)
>  static int test(void)
>  {
>         struct sigaction segv_act, trap_act;
> +       bool hash_mmu;
>         int i;
>
>         /* Skip the test if the CPU doesn't support Radix */
>         SKIP_IF(!have_hwcap2(PPC_FEATURE2_ARCH_3_00));
>
> +       FAIL_IF(using_hash_mmu(&hash_mmu));
> +
>         /* Check if pkeys are supported */
>         pkeys_supported = pkeys_unsupported() == 0;
>
> @@ -167,13 +170,17 @@ static int test(void)
>          * Read an instruction word from the address when the page
>          * is execute only. This should generate an access fault.
>          */
> -       fault_code = -1;
> -       remaining_faults = 1;
> -       printf("Testing read on --x, should fault...");
> -       FAIL_IF(mprotect(insns, pgsize, PROT_EXEC) != 0);
> -       i = *fault_addr;
> -       FAIL_IF(remaining_faults != 0 || !is_fault_expected(fault_code));
> -       printf("ok!\n");
> +       if (!hash_mmu) {
> +               fault_code = -1;
> +               remaining_faults = 1;
> +               printf("Testing read on --x, should fault...");
> +               FAIL_IF(mprotect(insns, pgsize, PROT_EXEC) != 0);
> +               i = *fault_addr;
> +               FAIL_IF(remaining_faults != 0 || !is_fault_expected(fault_code));
> +               printf("ok!\n");
> +       } else {
> +               printf("Testing read on --x, skipped on Hash MMU\n");
> +       }
>
>         /*
>          * Write an instruction word to the address when the page
> --
> 2.43.0
>

Gentle ping.

Re: [PATCH] selftests/powerpc: Fix exec_prot test failure on Hash MMU

[Ritesh Harjani]

Chris Chiu <chris.chiu@canonical.com> writes:

> Hash MMU maps execute-only pages as readable at the PTE level, so reading
> from a PROT_EXEC-only mapping does not fault there. The exec_prot test
> currently treats that as a failure, while the rest of the permission
> checks are still valid.
>
> Use the existing using_hash_mmu() helper and skip only the read-on-
> execute-only subtest on Hash MMU. Keep the rest of the test unchanged so
> the fix stays local to the unsupported execute-only-read expectation.
>

Hi Chris,

Thanks for the patch. However the patch is not entirely correct.
Do you mind me asking - how did you find this problem? Did you run this
on an actual Power Hardware? Can you share the details of that please?

Also - from your .config can you share the following?

cat .config |grep -iE "_PPC_"


So what you described in the commit msg is correct but only when PKEY
support is disabled with Hash mmu. However when pkey is enabled, and
when the process does mprotect(PROT_EXEC), kernel assigns a execute only
pkey for that mapping. With that - we can still get a fault when we try
to load from that PROT_EXEC mapping and the test should work fine.

So, I think what we need here is:

diff --git a/tools/testing/selftests/powerpc/mm/exec_prot.c b/tools/testing/selftests/powerpc/mm/exec_prot.c
index db75b2225de1..51ac2f9c14a6 100644
--- a/tools/testing/selftests/powerpc/mm/exec_prot.c
+++ b/tools/testing/selftests/powerpc/mm/exec_prot.c
@@ -167,13 +167,17 @@ static int test(void)
         * Read an instruction word from the address when the page
         * is execute only. This should generate an access fault.
         */
-       fault_code = -1;
-       remaining_faults = 1;
-       printf("Testing read on --x, should fault...");
-       FAIL_IF(mprotect(insns, pgsize, PROT_EXEC) != 0);
-       i = *fault_addr;
-       FAIL_IF(remaining_faults != 0 || !is_fault_expected(fault_code));
-       printf("ok!\n");
+       if (pkeys_supported) {
+               fault_code = -1;
+               remaining_faults = 1;
+               printf("Testing read on --x, should fault...");
+               FAIL_IF(mprotect(insns, pgsize, PROT_EXEC) != 0);
+               i = *fault_addr;
+               FAIL_IF(remaining_faults != 0 || !is_fault_expected(fault_code));
+               printf("ok!\n");
+       } else {
+               printf("Testing read on --x, skipped on Hash MMU without pkeys\n");
+       }


w/o the above diff when PKEYS are disabled on Hash
(# CONFIG_PPC_MEM_KEYS is not set) we get the following error:

test: exec_prot
tags: git_version:v7.3-rc3-9-g704340f1cd0d
[SKIP] Test skipped on line 100
[FAIL] Test FAILED on line 175
Testing read on --x, should fault...failure: exec_prot

But with the above diff:

test: exec_prot
tags: git_version:v7.3-rc3-9-g704340f1cd0d-dirty
[SKIP] Test skipped on line 100
Testing read on --x, skipped on Hash MMU without pkeys
Testing write on --x, should fault...ok!
Testing exec on ---, should fault...ok!
Testing exec on r--, should fault...ok!
Testing exec on -w-, should fault...ok!
Testing exec on rw-, should fault...ok!
Testing exec on --x, should succeed...ok!
Testing exec on r-x, should succeed...ok!
Testing exec on -wx, should succeed...ok!
Testing exec on rwx, should succeed...ok!
success: exec_prot


Care to verify this from your end on your hardware and submit a v2 with
this change?

-ritesh


> Signed-off-by: Chris Chiu <chris.chiu@canonical.com>
> ---
>  .../testing/selftests/powerpc/mm/exec_prot.c  | 21 ++++++++++++-------
>  1 file changed, 14 insertions(+), 7 deletions(-)
>
> diff --git a/tools/testing/selftests/powerpc/mm/exec_prot.c b/tools/testing/selftests/powerpc/mm/exec_prot.c
> index db75b2225de1..bd44f49d8449 100644
> --- a/tools/testing/selftests/powerpc/mm/exec_prot.c
> +++ b/tools/testing/selftests/powerpc/mm/exec_prot.c
> @@ -108,11 +108,14 @@ static int check_exec_fault(int rights)
>  static int test(void)
>  {
>  	struct sigaction segv_act, trap_act;
> +	bool hash_mmu;
>  	int i;
>  
>  	/* Skip the test if the CPU doesn't support Radix */
>  	SKIP_IF(!have_hwcap2(PPC_FEATURE2_ARCH_3_00));
>  
> +	FAIL_IF(using_hash_mmu(&hash_mmu));
> +
>  	/* Check if pkeys are supported */
>  	pkeys_supported = pkeys_unsupported() == 0;
>  
> @@ -167,13 +170,17 @@ static int test(void)
>  	 * Read an instruction word from the address when the page
>  	 * is execute only. This should generate an access fault.
>  	 */
> -	fault_code = -1;
> -	remaining_faults = 1;
> -	printf("Testing read on --x, should fault...");
> -	FAIL_IF(mprotect(insns, pgsize, PROT_EXEC) != 0);
> -	i = *fault_addr;
> -	FAIL_IF(remaining_faults != 0 || !is_fault_expected(fault_code));
> -	printf("ok!\n");
> +	if (!hash_mmu) {
> +		fault_code = -1;
> +		remaining_faults = 1;
> +		printf("Testing read on --x, should fault...");
> +		FAIL_IF(mprotect(insns, pgsize, PROT_EXEC) != 0);
> +		i = *fault_addr;
> +		FAIL_IF(remaining_faults != 0 || !is_fault_expected(fault_code));
> +		printf("ok!\n");
> +	} else {
> +		printf("Testing read on --x, skipped on Hash MMU\n");
> +	}
>  
>  	/*
>  	 * Write an instruction word to the address when the page
> -- 
> 2.43.0

Re: [PATCH] selftests/powerpc: Fix exec_prot test failure on Hash MMU

[Ritesh Harjani]

Ritesh Harjani (IBM) <ritesh.list@gmail.com> writes:

> So, I think what we need here is:
>
> diff --git a/tools/testing/selftests/powerpc/mm/exec_prot.c b/tools/testing/selftests/powerpc/mm/exec_prot.c
> index db75b2225de1..51ac2f9c14a6 100644
> --- a/tools/testing/selftests/powerpc/mm/exec_prot.c
> +++ b/tools/testing/selftests/powerpc/mm/exec_prot.c
> @@ -167,13 +167,17 @@ static int test(void)
>          * Read an instruction word from the address when the page
>          * is execute only. This should generate an access fault.
>          */
> -       fault_code = -1;
> -       remaining_faults = 1;
> -       printf("Testing read on --x, should fault...");
> -       FAIL_IF(mprotect(insns, pgsize, PROT_EXEC) != 0);
> -       i = *fault_addr;
> -       FAIL_IF(remaining_faults != 0 || !is_fault_expected(fault_code));
> -       printf("ok!\n");
> +       if (pkeys_supported) {
One quick correction - I think this should be
            if (!hash_mmu || pkeys_supported)

> +               fault_code = -1;
> +               remaining_faults = 1;
> +               printf("Testing read on --x, should fault...");
> +               FAIL_IF(mprotect(insns, pgsize, PROT_EXEC) != 0);
> +               i = *fault_addr;
> +               FAIL_IF(remaining_faults != 0 || !is_fault_expected(fault_code));
> +               printf("ok!\n");
> +       } else {
> +               printf("Testing read on --x, skipped on Hash MMU without pkeys\n");
> +       }
>
>

-ritesh