Hash MMU maps execute-only pages as readable at the PTE level, so reading
from a PROT_EXEC-only mapping does not fault there. The exec_prot test
currently treats that as a failure, while the rest of the permission
checks are still valid.
Use the existing using_hash_mmu() helper and skip only the read-on-
execute-only subtest on Hash MMU. Keep the rest of the test unchanged so
the fix stays local to the unsupported execute-only-read expectation.
Signed-off-by: Chris Chiu <redacted>
---
.../testing/selftests/powerpc/mm/exec_prot.c | 21 ++++++++++++-------
1 file changed, 14 insertions(+), 7 deletions(-)
diff --git a/tools/testing/selftests/powerpc/mm/exec_prot.c b/tools/testing/selftests/powerpc/mm/exec_prot.c
index db75b2225de1..bd44f49d8449 100644
--- a/tools/testing/selftests/powerpc/mm/exec_prot.c
+++ b/tools/testing/selftests/powerpc/mm/exec_prot.c
@@ -108,11 +108,14 @@ static int check_exec_fault(int rights)
static int test(void)
{
struct sigaction segv_act, trap_act;
+ bool hash_mmu;
int i;
/* Skip the test if the CPU doesn't support Radix */
SKIP_IF(!have_hwcap2(PPC_FEATURE2_ARCH_3_00));
+ FAIL_IF(using_hash_mmu(&hash_mmu));
+
/* Check if pkeys are supported */
pkeys_supported = pkeys_unsupported() == 0;
@@ -167,13 +170,17 @@ static int test(void)
* Read an instruction word from the address when the page
* is execute only. This should generate an access fault.
*/
- fault_code = -1;
- remaining_faults = 1;
- printf("Testing read on --x, should fault...");
- FAIL_IF(mprotect(insns, pgsize, PROT_EXEC) != 0);
- i = *fault_addr;
- FAIL_IF(remaining_faults != 0 || !is_fault_expected(fault_code));
- printf("ok!\n");
+ if (!hash_mmu) {
+ fault_code = -1;
+ remaining_faults = 1;
+ printf("Testing read on --x, should fault...");
+ FAIL_IF(mprotect(insns, pgsize, PROT_EXEC) != 0);
+ i = *fault_addr;
+ FAIL_IF(remaining_faults != 0 || !is_fault_expected(fault_code));
+ printf("ok!\n");
+ } else {
+ printf("Testing read on --x, skipped on Hash MMU\n");
+ }
/*
* Write an instruction word to the address when the page--
2.43.0
On Wed, Sep 9, 2026 at 1:09 PM Chris Chiu [off-list ref] wrote:
quoted hunk
Hash MMU maps execute-only pages as readable at the PTE level, so reading
from a PROT_EXEC-only mapping does not fault there. The exec_prot test
currently treats that as a failure, while the rest of the permission
checks are still valid.
Use the existing using_hash_mmu() helper and skip only the read-on-
execute-only subtest on Hash MMU. Keep the rest of the test unchanged so
the fix stays local to the unsupported execute-only-read expectation.
Signed-off-by: Chris Chiu <redacted>
---
.../testing/selftests/powerpc/mm/exec_prot.c | 21 ++++++++++++-------
1 file changed, 14 insertions(+), 7 deletions(-)
diff --git a/tools/testing/selftests/powerpc/mm/exec_prot.c b/tools/testing/selftests/powerpc/mm/exec_prot.c
index db75b2225de1..bd44f49d8449 100644
--- a/tools/testing/selftests/powerpc/mm/exec_prot.c
+++ b/tools/testing/selftests/powerpc/mm/exec_prot.c
@@ -108,11 +108,14 @@ static int check_exec_fault(int rights)
static int test(void)
{
struct sigaction segv_act, trap_act;
+ bool hash_mmu;
int i;
/* Skip the test if the CPU doesn't support Radix */
SKIP_IF(!have_hwcap2(PPC_FEATURE2_ARCH_3_00));
+ FAIL_IF(using_hash_mmu(&hash_mmu));
+
/* Check if pkeys are supported */
pkeys_supported = pkeys_unsupported() == 0;
@@ -167,13 +170,17 @@ static int test(void)
* Read an instruction word from the address when the page
* is execute only. This should generate an access fault.
*/
- fault_code = -1;
- remaining_faults = 1;
- printf("Testing read on --x, should fault...");
- FAIL_IF(mprotect(insns, pgsize, PROT_EXEC) != 0);
- i = *fault_addr;
- FAIL_IF(remaining_faults != 0 || !is_fault_expected(fault_code));
- printf("ok!\n");
+ if (!hash_mmu) {
+ fault_code = -1;
+ remaining_faults = 1;
+ printf("Testing read on --x, should fault...");
+ FAIL_IF(mprotect(insns, pgsize, PROT_EXEC) != 0);
+ i = *fault_addr;
+ FAIL_IF(remaining_faults != 0 || !is_fault_expected(fault_code));
+ printf("ok!\n");
+ } else {
+ printf("Testing read on --x, skipped on Hash MMU\n");
+ }
/*
* Write an instruction word to the address when the page
--2.43.0
Gentle ping.
Chris Chiu [off-list ref] writes:
Hash MMU maps execute-only pages as readable at the PTE level, so reading
from a PROT_EXEC-only mapping does not fault there. The exec_prot test
currently treats that as a failure, while the rest of the permission
checks are still valid.
Use the existing using_hash_mmu() helper and skip only the read-on-
execute-only subtest on Hash MMU. Keep the rest of the test unchanged so
the fix stays local to the unsupported execute-only-read expectation.
Hi Chris,
Thanks for the patch. However the patch is not entirely correct.
Do you mind me asking - how did you find this problem? Did you run this
on an actual Power Hardware? Can you share the details of that please?
Also - from your .config can you share the following?
cat .config |grep -iE "_PPC_"
So what you described in the commit msg is correct but only when PKEY
support is disabled with Hash mmu. However when pkey is enabled, and
when the process does mprotect(PROT_EXEC), kernel assigns a execute only
pkey for that mapping. With that - we can still get a fault when we try
to load from that PROT_EXEC mapping and the test should work fine.
So, I think what we need here is:
diff --git a/tools/testing/selftests/powerpc/mm/exec_prot.c b/tools/testing/selftests/powerpc/mm/exec_prot.c
index db75b2225de1..51ac2f9c14a6 100644
--- a/tools/testing/selftests/powerpc/mm/exec_prot.c
+++ b/tools/testing/selftests/powerpc/mm/exec_prot.c
@@ -167,13 +167,17 @@ static int test(void)
* Read an instruction word from the address when the page
* is execute only. This should generate an access fault.
*/
- fault_code = -1;
- remaining_faults = 1;
- printf("Testing read on --x, should fault...");
- FAIL_IF(mprotect(insns, pgsize, PROT_EXEC) != 0);
- i = *fault_addr;
- FAIL_IF(remaining_faults != 0 || !is_fault_expected(fault_code));
- printf("ok!\n");
+ if (pkeys_supported) {
+ fault_code = -1;
+ remaining_faults = 1;
+ printf("Testing read on --x, should fault...");
+ FAIL_IF(mprotect(insns, pgsize, PROT_EXEC) != 0);
+ i = *fault_addr;
+ FAIL_IF(remaining_faults != 0 || !is_fault_expected(fault_code));
+ printf("ok!\n");
+ } else {
+ printf("Testing read on --x, skipped on Hash MMU without pkeys\n");
+ }
w/o the above diff when PKEYS are disabled on Hash
(# CONFIG_PPC_MEM_KEYS is not set) we get the following error:
test: exec_prot
tags: git_version:v7.3-rc3-9-g704340f1cd0d
[SKIP] Test skipped on line 100
[FAIL] Test FAILED on line 175
Testing read on --x, should fault...failure: exec_prot
But with the above diff:
test: exec_prot
tags: git_version:v7.3-rc3-9-g704340f1cd0d-dirty
[SKIP] Test skipped on line 100
Testing read on --x, skipped on Hash MMU without pkeys
Testing write on --x, should fault...ok!
Testing exec on ---, should fault...ok!
Testing exec on r--, should fault...ok!
Testing exec on -w-, should fault...ok!
Testing exec on rw-, should fault...ok!
Testing exec on --x, should succeed...ok!
Testing exec on r-x, should succeed...ok!
Testing exec on -wx, should succeed...ok!
Testing exec on rwx, should succeed...ok!
success: exec_prot
Care to verify this from your end on your hardware and submit a v2 with
this change?
-ritesh
quoted hunk
Signed-off-by: Chris Chiu <redacted>
---
.../testing/selftests/powerpc/mm/exec_prot.c | 21 ++++++++++++-------
1 file changed, 14 insertions(+), 7 deletions(-)
diff --git a/tools/testing/selftests/powerpc/mm/exec_prot.c b/tools/testing/selftests/powerpc/mm/exec_prot.c
index db75b2225de1..bd44f49d8449 100644
--- a/tools/testing/selftests/powerpc/mm/exec_prot.c
+++ b/tools/testing/selftests/powerpc/mm/exec_prot.c
@@ -108,11 +108,14 @@ static int check_exec_fault(int rights)
static int test(void)
{
struct sigaction segv_act, trap_act;
+ bool hash_mmu;
int i;
/* Skip the test if the CPU doesn't support Radix */
SKIP_IF(!have_hwcap2(PPC_FEATURE2_ARCH_3_00));
+ FAIL_IF(using_hash_mmu(&hash_mmu));
+
/* Check if pkeys are supported */
pkeys_supported = pkeys_unsupported() == 0;
@@ -167,13 +170,17 @@ static int test(void)
* Read an instruction word from the address when the page
* is execute only. This should generate an access fault.
*/
- fault_code = -1;
- remaining_faults = 1;
- printf("Testing read on --x, should fault...");
- FAIL_IF(mprotect(insns, pgsize, PROT_EXEC) != 0);
- i = *fault_addr;
- FAIL_IF(remaining_faults != 0 || !is_fault_expected(fault_code));
- printf("ok!\n");
+ if (!hash_mmu) {
+ fault_code = -1;
+ remaining_faults = 1;
+ printf("Testing read on --x, should fault...");
+ FAIL_IF(mprotect(insns, pgsize, PROT_EXEC) != 0);
+ i = *fault_addr;
+ FAIL_IF(remaining_faults != 0 || !is_fault_expected(fault_code));
+ printf("ok!\n");
+ } else {
+ printf("Testing read on --x, skipped on Hash MMU\n");
+ }
/*
* Write an instruction word to the address when the page--
2.43.0
Ritesh Harjani (IBM) [off-list ref] writes:
quoted hunk
So, I think what we need here is:
diff --git a/tools/testing/selftests/powerpc/mm/exec_prot.c b/tools/testing/selftests/powerpc/mm/exec_prot.c
index db75b2225de1..51ac2f9c14a6 100644
--- a/tools/testing/selftests/powerpc/mm/exec_prot.c
+++ b/tools/testing/selftests/powerpc/mm/exec_prot.c
@@ -167,13 +167,17 @@ static int test(void)
* Read an instruction word from the address when the page
* is execute only. This should generate an access fault.
*/
- fault_code = -1;
- remaining_faults = 1;
- printf("Testing read on --x, should fault...");
- FAIL_IF(mprotect(insns, pgsize, PROT_EXEC) != 0);
- i = *fault_addr;
- FAIL_IF(remaining_faults != 0 || !is_fault_expected(fault_code));
- printf("ok!\n");
+ if (pkeys_supported) {
One quick correction - I think this should be
if (!hash_mmu || pkeys_supported)
quoted hunk
+ fault_code = -1;
+ remaining_faults = 1;
+ printf("Testing read on --x, should fault...");
+ FAIL_IF(mprotect(insns, pgsize, PROT_EXEC) != 0);
+ i = *fault_addr;
+ FAIL_IF(remaining_faults != 0 || !is_fault_expected(fault_code));
+ printf("ok!\n");
+ } else {
+ printf("Testing read on --x, skipped on Hash MMU without pkeys\n");
+ }
-ritesh