[RFC PATCH v5 17/18] mm: Add basic tests for kpkeys_hardened_pgtables

Kevin Brodsky
2025-08-15T11:00:03Z

Add basic tests for the kpkeys_hardened_pgtables feature: try to
perform a direct write to kernel and user page table entries and
ensure it fails.

Signed-off-by: Kevin Brodsky <kevin.brodsky@arm.com>
---
mm/Makefile | 1 +
mm/tests/kpkeys_hardened_pgtables_kunit.c | 106 ++++++++++++++++++++++
security/Kconfig.hardening | 12 +++
3 files changed, 119 insertions(+)
create mode 100644 mm/tests/kpkeys_hardened_pgtables_kunit.c

diff --git a/mm/Makefile b/mm/Makefile
index 10848df0ca85..b1e6cf7f753c 100644
--- a/mm/Makefile
+++ b/mm/Makefile
@@ -148,3 +148,4 @@ obj-$(CONFIG_EXECMEM) += execmem.o
obj-$(CONFIG_TMPFS_QUOTA) += shmem_quota.o
obj-$(CONFIG_PT_RECLAIM) += pt_reclaim.o
obj-$(CONFIG_KPKEYS_HARDENED_PGTABLES) += kpkeys_hardened_pgtables.o
+obj-$(CONFIG_KPKEYS_HARDENED_PGTABLES_KUNIT_TEST) += tests/kpkeys_hardened_pgtables_kunit.o
diff --git a/mm/tests/kpkeys_hardened_pgtables_kunit.c b/mm/tests/kpkeys_hardened_pgtables_kunit.c
new file mode 100644
index 000000000000..3d916f0719d0
--- /dev/null
+++ b/mm/tests/kpkeys_hardened_pgtables_kunit.c
@@ -0,0 +1,106 @@
+// SPDX-License-Identifier: GPL-2.0-only
+#include <kunit/test.h>
+#include <linux/mman.h>
+#include <linux/pgtable.h>
+#include <linux/vmalloc.h>
+
+KUNIT_DEFINE_ACTION_WRAPPER(vfree_wrapper, vfree, const void *);
+
+static inline pte_t *get_kernel_pte(unsigned long addr)
+{
+ pmd_t *pmdp = pmd_off_k(addr);
+
+ if (!pmdp || pmd_leaf(*pmdp))
+ return NULL;
+
+ return pte_offset_kernel(pmdp, addr);
+}
+
+static void write_linear_map_pte(struct kunit *test)
+{
+ pte_t *ptep;
+ pte_t pte;
+ int ret;
+
+ if (!arch_kpkeys_enabled())
+ kunit_skip(test, "kpkeys are not supported");
+
+ /*
+ * The choice of address is mostly arbitrary - we just need something
+ * that is PTE-mapped, such as a global variable.
+ */
+ ptep = get_kernel_pte((unsigned long)&init_mm);
+ KUNIT_ASSERT_NOT_NULL_MSG(test, ptep, "Failed to get PTE");
+
+ pte = ptep_get(ptep);
+ pte = set_pte_bit(pte, __pgprot(PTE_WRITE));
+ ret = copy_to_kernel_nofault(ptep, &pte, sizeof(pte));
+ KUNIT_EXPECT_EQ_MSG(test, ret, -EFAULT,
+ "Direct PTE write wasn't prevented");
+}
+
+static void write_kernel_vmalloc_pte(struct kunit *test)
+{
+ void *mem;
+ pte_t *ptep;
+ pte_t pte;
+ int ret;
+
+ if (!arch_kpkeys_enabled())
+ kunit_skip(test, "kpkeys are not supported");
+
+ mem = vmalloc(PAGE_SIZE);
+ KUNIT_ASSERT_NOT_NULL(test, mem);
+ ret = kunit_add_action_or_reset(test, vfree_wrapper, mem);
+ KUNIT_ASSERT_EQ(test, ret, 0);
+
+ ptep = get_kernel_pte((unsigned long)mem);
+ KUNIT_ASSERT_NOT_NULL_MSG(test, ptep, "Failed to get PTE");
+
+ pte = ptep_get(ptep);
+ pte = set_pte_bit(pte, __pgprot(PTE_WRITE));
+ ret = copy_to_kernel_nofault(ptep, &pte, sizeof(pte));
+ KUNIT_EXPECT_EQ_MSG(test, ret, -EFAULT,
+ "Direct PTE write wasn't prevented");
+}
+
+static void write_user_pmd(struct kunit *test)
+{
+ pmd_t *pmdp;
+ pmd_t pmd;
+ unsigned long uaddr;
+ int ret;
+
+ if (!arch_kpkeys_enabled())
+ kunit_skip(test, "kpkeys are not supported");
+
+ uaddr = kunit_vm_mmap(test, NULL, 0, PAGE_SIZE, PROT_READ,
+ MAP_ANONYMOUS | MAP_PRIVATE | MAP_POPULATE, 0);
+ KUNIT_ASSERT_NE_MSG(test, uaddr, 0, "Could not create userspace mm");
+
+ /* We passed MAP_POPULATE so a PMD should already be allocated */
+ pmdp = pmd_off(current->mm, uaddr);
+ KUNIT_ASSERT_NOT_NULL_MSG(test, pmdp, "Failed to get PMD");
+
+ pmd = pmdp_get(pmdp);
+ pmd = set_pmd_bit(pmd, __pgprot(PROT_SECT_NORMAL));
+ ret = copy_to_kernel_nofault(pmdp, &pmd, sizeof(pmd));
+ KUNIT_EXPECT_EQ_MSG(test, ret, -EFAULT,
+ "Direct PMD write wasn't prevented");
+}
+
+static struct kunit_case kpkeys_hardened_pgtables_test_cases[] = {
+ KUNIT_CASE(write_linear_map_pte),
+ KUNIT_CASE(write_kernel_vmalloc_pte),
+ KUNIT_CASE(write_user_pmd),
+ {}
+};
+
+static struct kunit_suite kpkeys_hardened_pgtables_test_suite = {
+ .name = "Hardened pgtables using kpkeys",
+ .test_cases = kpkeys_hardened_pgtables_test_cases,
+};
+kunit_test_suite(kpkeys_hardened_pgtables_test_suite);
+
+MODULE_DESCRIPTION("Tests for the kpkeys_hardened_pgtables feature");
+MODULE_LICENSE("GPL");
diff --git a/security/Kconfig.hardening b/security/Kconfig.hardening
index 41b7530530b7..653663008096 100644
--- a/security/Kconfig.hardening
+++ b/security/Kconfig.hardening
@@ -277,6 +277,18 @@ config KPKEYS_HARDENED_PGTABLES
This option has no effect if the system does not support
kernel pkeys.

+config KPKEYS_HARDENED_PGTABLES_KUNIT_TEST
+ tristate "KUnit tests for kpkeys_hardened_pgtables" if !KUNIT_ALL_TESTS
+ depends on KPKEYS_HARDENED_PGTABLES
+ depends on KUNIT
+ default KUNIT_ALL_TESTS
+ help
+ Enable this option to check that the kpkeys_hardened_pgtables feature
+ functions as intended, i.e. prevents arbitrary writes to user and
+ kernel page tables.
+
+ If unsure, say N.
+
endmenu

config CC_HAS_RANDSTRUCT
--
2.47.0