1 /* 1 /*
2 * memfd_create system call and file sealing s 2 * memfd_create system call and file sealing support
3 * 3 *
4 * Code was originally included in shmem.c, an 4 * Code was originally included in shmem.c, and broken out to facilitate
5 * use by hugetlbfs as well as tmpfs. 5 * use by hugetlbfs as well as tmpfs.
6 * 6 *
7 * This file is released under the GPL. 7 * This file is released under the GPL.
8 */ 8 */
9 9
10 #include <linux/fs.h> 10 #include <linux/fs.h>
11 #include <linux/vfs.h> 11 #include <linux/vfs.h>
12 #include <linux/pagemap.h> 12 #include <linux/pagemap.h>
13 #include <linux/file.h> 13 #include <linux/file.h>
14 #include <linux/mm.h> 14 #include <linux/mm.h>
15 #include <linux/sched/signal.h> 15 #include <linux/sched/signal.h>
16 #include <linux/khugepaged.h> 16 #include <linux/khugepaged.h>
17 #include <linux/syscalls.h> 17 #include <linux/syscalls.h>
18 #include <linux/hugetlb.h> 18 #include <linux/hugetlb.h>
19 #include <linux/shmem_fs.h> 19 #include <linux/shmem_fs.h>
20 #include <linux/memfd.h> 20 #include <linux/memfd.h>
21 #include <linux/pid_namespace.h> <<
22 #include <uapi/linux/memfd.h> 21 #include <uapi/linux/memfd.h>
23 22
24 /* 23 /*
25 * We need a tag: a new tag would expand every !! 24 * We need a tag: a new tag would expand every radix_tree_node by 8 bytes,
26 * so reuse a tag which we firmly believe is n 25 * so reuse a tag which we firmly believe is never set or cleared on tmpfs
27 * or hugetlbfs because they are memory only f 26 * or hugetlbfs because they are memory only filesystems.
28 */ 27 */
29 #define MEMFD_TAG_PINNED PAGECACHE_TAG_ 28 #define MEMFD_TAG_PINNED PAGECACHE_TAG_TOWRITE
30 #define LAST_SCAN 4 /* abo 29 #define LAST_SCAN 4 /* about 150ms max */
31 30
32 static bool memfd_folio_has_extra_refs(struct !! 31 static void memfd_tag_pins(struct address_space *mapping)
33 { 32 {
34 return folio_ref_count(folio) - folio_ !! 33 struct radix_tree_iter iter;
35 folio_nr_pages(folio); !! 34 void __rcu **slot;
36 } !! 35 pgoff_t start;
37 !! 36 struct page *page;
38 static void memfd_tag_pins(struct xa_state *xa <<
39 { <<
40 struct folio *folio; <<
41 int latency = 0; <<
42 37
43 lru_add_drain(); 38 lru_add_drain();
>> 39 start = 0;
>> 40 rcu_read_lock();
44 41
45 xas_lock_irq(xas); !! 42 radix_tree_for_each_slot(slot, &mapping->i_pages, &iter, start) {
46 xas_for_each(xas, folio, ULONG_MAX) { !! 43 page = radix_tree_deref_slot(slot);
47 if (!xa_is_value(folio) && mem !! 44 if (!page || radix_tree_exception(page)) {
48 xas_set_mark(xas, MEMF !! 45 if (radix_tree_deref_retry(page)) {
49 !! 46 slot = radix_tree_iter_retry(&iter);
50 if (++latency < XA_CHECK_SCHED !! 47 continue;
51 continue; <<
52 latency = 0; <<
53 <<
54 xas_pause(xas); <<
55 xas_unlock_irq(xas); <<
56 cond_resched(); <<
57 xas_lock_irq(xas); <<
58 } <<
59 xas_unlock_irq(xas); <<
60 } <<
61 <<
62 /* <<
63 * This is a helper function used by memfd_pin <<
64 * It is mainly called to allocate a folio in <<
65 * (memfd_pin_folios()) cannot find a folio in <<
66 * index in the mapping. <<
67 */ <<
68 struct folio *memfd_alloc_folio(struct file *m <<
69 { <<
70 #ifdef CONFIG_HUGETLB_PAGE <<
71 struct folio *folio; <<
72 gfp_t gfp_mask; <<
73 int err; <<
74 <<
75 if (is_file_hugepages(memfd)) { <<
76 /* <<
77 * The folio would most likely <<
78 * therefore, we have zone mem <<
79 * alloc from. Also, the folio <<
80 * amount of time, so it is no <<
81 */ <<
82 struct hstate *h = hstate_file <<
83 <<
84 gfp_mask = htlb_alloc_mask(h); <<
85 gfp_mask &= ~(__GFP_HIGHMEM | <<
86 idx >>= huge_page_order(h); <<
87 <<
88 folio = alloc_hugetlb_folio_re <<
89 <<
90 <<
91 <<
92 if (folio) { <<
93 err = hugetlb_add_to_p <<
94 <<
95 <<
96 if (err) { <<
97 folio_put(foli <<
98 return ERR_PTR <<
99 } 48 }
100 folio_unlock(folio); !! 49 } else if (page_count(page) - page_mapcount(page) > 1) {
101 return folio; !! 50 xa_lock_irq(&mapping->i_pages);
>> 51 radix_tree_tag_set(&mapping->i_pages, iter.index,
>> 52 MEMFD_TAG_PINNED);
>> 53 xa_unlock_irq(&mapping->i_pages);
>> 54 }
>> 55
>> 56 if (need_resched()) {
>> 57 slot = radix_tree_iter_resume(slot, &iter);
>> 58 cond_resched_rcu();
102 } 59 }
103 return ERR_PTR(-ENOMEM); <<
104 } 60 }
105 #endif !! 61 rcu_read_unlock();
106 return shmem_read_folio(memfd->f_mappi <<
107 } 62 }
108 63
109 /* 64 /*
110 * Setting SEAL_WRITE requires us to verify th 65 * Setting SEAL_WRITE requires us to verify there's no pending writer. However,
111 * via get_user_pages(), drivers might have so 66 * via get_user_pages(), drivers might have some pending I/O without any active
112 * user-space mappings (eg., direct-IO, AIO). !! 67 * user-space mappings (eg., direct-IO, AIO). Therefore, we look at all pages
113 * and see whether it has an elevated ref-coun 68 * and see whether it has an elevated ref-count. If so, we tag them and wait for
114 * them to be dropped. 69 * them to be dropped.
115 * The caller must guarantee that no new user 70 * The caller must guarantee that no new user will acquire writable references
116 * to those folios to avoid races. !! 71 * to those pages to avoid races.
117 */ 72 */
118 static int memfd_wait_for_pins(struct address_ 73 static int memfd_wait_for_pins(struct address_space *mapping)
119 { 74 {
120 XA_STATE(xas, &mapping->i_pages, 0); !! 75 struct radix_tree_iter iter;
121 struct folio *folio; !! 76 void __rcu **slot;
>> 77 pgoff_t start;
>> 78 struct page *page;
122 int error, scan; 79 int error, scan;
123 80
124 memfd_tag_pins(&xas); !! 81 memfd_tag_pins(mapping);
125 82
126 error = 0; 83 error = 0;
127 for (scan = 0; scan <= LAST_SCAN; scan 84 for (scan = 0; scan <= LAST_SCAN; scan++) {
128 int latency = 0; !! 85 if (!radix_tree_tagged(&mapping->i_pages, MEMFD_TAG_PINNED))
129 <<
130 if (!xas_marked(&xas, MEMFD_TA <<
131 break; 86 break;
132 87
133 if (!scan) 88 if (!scan)
134 lru_add_drain_all(); 89 lru_add_drain_all();
135 else if (schedule_timeout_kill 90 else if (schedule_timeout_killable((HZ << scan) / 200))
136 scan = LAST_SCAN; 91 scan = LAST_SCAN;
137 92
138 xas_set(&xas, 0); !! 93 start = 0;
139 xas_lock_irq(&xas); !! 94 rcu_read_lock();
140 xas_for_each_marked(&xas, foli !! 95 radix_tree_for_each_tagged(slot, &mapping->i_pages, &iter,
141 bool clear = true; !! 96 start, MEMFD_TAG_PINNED) {
>> 97
>> 98 page = radix_tree_deref_slot(slot);
>> 99 if (radix_tree_exception(page)) {
>> 100 if (radix_tree_deref_retry(page)) {
>> 101 slot = radix_tree_iter_retry(&iter);
>> 102 continue;
>> 103 }
>> 104
>> 105 page = NULL;
>> 106 }
>> 107
>> 108 if (page &&
>> 109 page_count(page) - page_mapcount(page) != 1) {
>> 110 if (scan < LAST_SCAN)
>> 111 goto continue_resched;
142 112
143 if (!xa_is_value(folio <<
144 memfd_folio_has_ex <<
145 /* 113 /*
146 * On the last 114 * On the last scan, we clean up all those tags
147 * we inserted 115 * we inserted; but make a note that we still
148 * found folio !! 116 * found pages pinned.
149 */ 117 */
150 if (scan == LA !! 118 error = -EBUSY;
151 error <<
152 else <<
153 clear <<
154 } 119 }
155 if (clear) <<
156 xas_clear_mark <<
157 <<
158 if (++latency < XA_CHE <<
159 continue; <<
160 latency = 0; <<
161 120
162 xas_pause(&xas); !! 121 xa_lock_irq(&mapping->i_pages);
163 xas_unlock_irq(&xas); !! 122 radix_tree_tag_clear(&mapping->i_pages,
164 cond_resched(); !! 123 iter.index, MEMFD_TAG_PINNED);
165 xas_lock_irq(&xas); !! 124 xa_unlock_irq(&mapping->i_pages);
>> 125 continue_resched:
>> 126 if (need_resched()) {
>> 127 slot = radix_tree_iter_resume(slot, &iter);
>> 128 cond_resched_rcu();
>> 129 }
166 } 130 }
167 xas_unlock_irq(&xas); !! 131 rcu_read_unlock();
168 } 132 }
169 133
170 return error; 134 return error;
171 } 135 }
172 136
173 static unsigned int *memfd_file_seals_ptr(stru 137 static unsigned int *memfd_file_seals_ptr(struct file *file)
174 { 138 {
175 if (shmem_file(file)) 139 if (shmem_file(file))
176 return &SHMEM_I(file_inode(fil 140 return &SHMEM_I(file_inode(file))->seals;
177 141
178 #ifdef CONFIG_HUGETLBFS 142 #ifdef CONFIG_HUGETLBFS
179 if (is_file_hugepages(file)) 143 if (is_file_hugepages(file))
180 return &HUGETLBFS_I(file_inode 144 return &HUGETLBFS_I(file_inode(file))->seals;
181 #endif 145 #endif
182 146
183 return NULL; 147 return NULL;
184 } 148 }
185 149
186 #define F_ALL_SEALS (F_SEAL_SEAL | \ 150 #define F_ALL_SEALS (F_SEAL_SEAL | \
187 F_SEAL_EXEC | \ <<
188 F_SEAL_SHRINK | \ 151 F_SEAL_SHRINK | \
189 F_SEAL_GROW | \ 152 F_SEAL_GROW | \
190 F_SEAL_WRITE | \ !! 153 F_SEAL_WRITE)
191 F_SEAL_FUTURE_WRITE) <<
192 154
193 static int memfd_add_seals(struct file *file, 155 static int memfd_add_seals(struct file *file, unsigned int seals)
194 { 156 {
195 struct inode *inode = file_inode(file) 157 struct inode *inode = file_inode(file);
196 unsigned int *file_seals; 158 unsigned int *file_seals;
197 int error; 159 int error;
198 160
199 /* 161 /*
200 * SEALING 162 * SEALING
201 * Sealing allows multiple parties to 163 * Sealing allows multiple parties to share a tmpfs or hugetlbfs file
202 * but restrict access to a specific s 164 * but restrict access to a specific subset of file operations. Seals
203 * can only be added, but never remove 165 * can only be added, but never removed. This way, mutually untrusted
204 * parties can share common memory reg 166 * parties can share common memory regions with a well-defined policy.
205 * A malicious peer can thus never per 167 * A malicious peer can thus never perform unwanted operations on a
206 * shared object. 168 * shared object.
207 * 169 *
208 * Seals are only supported on special 170 * Seals are only supported on special tmpfs or hugetlbfs files and
209 * always affect the whole underlying 171 * always affect the whole underlying inode. Once a seal is set, it
210 * may prevent some kinds of access to 172 * may prevent some kinds of access to the file. Currently, the
211 * following seals are defined: 173 * following seals are defined:
212 * SEAL_SEAL: Prevent further seals 174 * SEAL_SEAL: Prevent further seals from being set on this file
213 * SEAL_SHRINK: Prevent the file fro 175 * SEAL_SHRINK: Prevent the file from shrinking
214 * SEAL_GROW: Prevent the file from 176 * SEAL_GROW: Prevent the file from growing
215 * SEAL_WRITE: Prevent write access 177 * SEAL_WRITE: Prevent write access to the file
216 * SEAL_EXEC: Prevent modification o <<
217 * 178 *
218 * As we don't require any trust relat 179 * As we don't require any trust relationship between two parties, we
219 * must prevent seals from being remov 180 * must prevent seals from being removed. Therefore, sealing a file
220 * only adds a given set of seals to t 181 * only adds a given set of seals to the file, it never touches
221 * existing seals. Furthermore, the "s 182 * existing seals. Furthermore, the "setting seals"-operation can be
222 * sealed itself, which basically prev 183 * sealed itself, which basically prevents any further seal from being
223 * added. 184 * added.
224 * 185 *
225 * Semantics of sealing are only defin 186 * Semantics of sealing are only defined on volatile files. Only
226 * anonymous tmpfs and hugetlbfs files 187 * anonymous tmpfs and hugetlbfs files support sealing. More
227 * importantly, seals are never writte 188 * importantly, seals are never written to disk. Therefore, there's
228 * no plan to support it on other file 189 * no plan to support it on other file types.
229 */ 190 */
230 191
231 if (!(file->f_mode & FMODE_WRITE)) 192 if (!(file->f_mode & FMODE_WRITE))
232 return -EPERM; 193 return -EPERM;
233 if (seals & ~(unsigned int)F_ALL_SEALS 194 if (seals & ~(unsigned int)F_ALL_SEALS)
234 return -EINVAL; 195 return -EINVAL;
235 196
236 inode_lock(inode); 197 inode_lock(inode);
237 198
238 file_seals = memfd_file_seals_ptr(file 199 file_seals = memfd_file_seals_ptr(file);
239 if (!file_seals) { 200 if (!file_seals) {
240 error = -EINVAL; 201 error = -EINVAL;
241 goto unlock; 202 goto unlock;
242 } 203 }
243 204
244 if (*file_seals & F_SEAL_SEAL) { 205 if (*file_seals & F_SEAL_SEAL) {
245 error = -EPERM; 206 error = -EPERM;
246 goto unlock; 207 goto unlock;
247 } 208 }
248 209
249 if ((seals & F_SEAL_WRITE) && !(*file_ 210 if ((seals & F_SEAL_WRITE) && !(*file_seals & F_SEAL_WRITE)) {
250 error = mapping_deny_writable( 211 error = mapping_deny_writable(file->f_mapping);
251 if (error) 212 if (error)
252 goto unlock; 213 goto unlock;
253 214
254 error = memfd_wait_for_pins(fi 215 error = memfd_wait_for_pins(file->f_mapping);
255 if (error) { 216 if (error) {
256 mapping_allow_writable 217 mapping_allow_writable(file->f_mapping);
257 goto unlock; 218 goto unlock;
258 } 219 }
259 } 220 }
260 221
261 /* <<
262 * SEAL_EXEC implys SEAL_WRITE, making <<
263 */ <<
264 if (seals & F_SEAL_EXEC && inode->i_mo <<
265 seals |= F_SEAL_SHRINK|F_SEAL_ <<
266 <<
267 *file_seals |= seals; 222 *file_seals |= seals;
268 error = 0; 223 error = 0;
269 224
270 unlock: 225 unlock:
271 inode_unlock(inode); 226 inode_unlock(inode);
272 return error; 227 return error;
273 } 228 }
274 229
275 static int memfd_get_seals(struct file *file) 230 static int memfd_get_seals(struct file *file)
276 { 231 {
277 unsigned int *seals = memfd_file_seals 232 unsigned int *seals = memfd_file_seals_ptr(file);
278 233
279 return seals ? *seals : -EINVAL; 234 return seals ? *seals : -EINVAL;
280 } 235 }
281 236
282 long memfd_fcntl(struct file *file, unsigned i !! 237 long memfd_fcntl(struct file *file, unsigned int cmd, unsigned long arg)
283 { 238 {
284 long error; 239 long error;
285 240
286 switch (cmd) { 241 switch (cmd) {
287 case F_ADD_SEALS: 242 case F_ADD_SEALS:
>> 243 /* disallow upper 32bit */
>> 244 if (arg > UINT_MAX)
>> 245 return -EINVAL;
>> 246
288 error = memfd_add_seals(file, 247 error = memfd_add_seals(file, arg);
289 break; 248 break;
290 case F_GET_SEALS: 249 case F_GET_SEALS:
291 error = memfd_get_seals(file); 250 error = memfd_get_seals(file);
292 break; 251 break;
293 default: 252 default:
294 error = -EINVAL; 253 error = -EINVAL;
295 break; 254 break;
296 } 255 }
297 256
298 return error; 257 return error;
299 } 258 }
300 259
301 #define MFD_NAME_PREFIX "memfd:" 260 #define MFD_NAME_PREFIX "memfd:"
302 #define MFD_NAME_PREFIX_LEN (sizeof(MFD_NAME_P 261 #define MFD_NAME_PREFIX_LEN (sizeof(MFD_NAME_PREFIX) - 1)
303 #define MFD_NAME_MAX_LEN (NAME_MAX - MFD_NAME_ 262 #define MFD_NAME_MAX_LEN (NAME_MAX - MFD_NAME_PREFIX_LEN)
304 263
305 #define MFD_ALL_FLAGS (MFD_CLOEXEC | MFD_ALLOW !! 264 #define MFD_ALL_FLAGS (MFD_CLOEXEC | MFD_ALLOW_SEALING | MFD_HUGETLB)
306 <<
307 static int check_sysctl_memfd_noexec(unsigned <<
308 { <<
309 #ifdef CONFIG_SYSCTL <<
310 struct pid_namespace *ns = task_active <<
311 int sysctl = pidns_memfd_noexec_scope( <<
312 <<
313 if (!(*flags & (MFD_EXEC | MFD_NOEXEC_ <<
314 if (sysctl >= MEMFD_NOEXEC_SCO <<
315 *flags |= MFD_NOEXEC_S <<
316 else <<
317 *flags |= MFD_EXEC; <<
318 } <<
319 <<
320 if (!(*flags & MFD_NOEXEC_SEAL) && sys <<
321 pr_err_ratelimited( <<
322 "%s[%d]: memfd_create( <<
323 current->comm, task_pi <<
324 return -EACCES; <<
325 } <<
326 #endif <<
327 return 0; <<
328 } <<
329 265
330 SYSCALL_DEFINE2(memfd_create, 266 SYSCALL_DEFINE2(memfd_create,
331 const char __user *, uname, 267 const char __user *, uname,
332 unsigned int, flags) 268 unsigned int, flags)
333 { 269 {
334 unsigned int *file_seals; 270 unsigned int *file_seals;
335 struct file *file; 271 struct file *file;
336 int fd, error; 272 int fd, error;
337 char *name; 273 char *name;
338 long len; 274 long len;
339 275
340 if (!(flags & MFD_HUGETLB)) { 276 if (!(flags & MFD_HUGETLB)) {
341 if (flags & ~(unsigned int)MFD 277 if (flags & ~(unsigned int)MFD_ALL_FLAGS)
342 return -EINVAL; 278 return -EINVAL;
343 } else { 279 } else {
344 /* Allow huge page size encodi 280 /* Allow huge page size encoding in flags. */
345 if (flags & ~(unsigned int)(MF 281 if (flags & ~(unsigned int)(MFD_ALL_FLAGS |
346 (MFD_HUGE_MASK 282 (MFD_HUGE_MASK << MFD_HUGE_SHIFT)))
347 return -EINVAL; 283 return -EINVAL;
348 } 284 }
349 285
350 /* Invalid if both EXEC and NOEXEC_SEA <<
351 if ((flags & MFD_EXEC) && (flags & MFD <<
352 return -EINVAL; <<
353 <<
354 error = check_sysctl_memfd_noexec(&fla <<
355 if (error < 0) <<
356 return error; <<
357 <<
358 /* length includes terminating zero */ 286 /* length includes terminating zero */
359 len = strnlen_user(uname, MFD_NAME_MAX 287 len = strnlen_user(uname, MFD_NAME_MAX_LEN + 1);
360 if (len <= 0) 288 if (len <= 0)
361 return -EFAULT; 289 return -EFAULT;
362 if (len > MFD_NAME_MAX_LEN + 1) 290 if (len > MFD_NAME_MAX_LEN + 1)
363 return -EINVAL; 291 return -EINVAL;
364 292
365 name = kmalloc(len + MFD_NAME_PREFIX_L 293 name = kmalloc(len + MFD_NAME_PREFIX_LEN, GFP_KERNEL);
366 if (!name) 294 if (!name)
367 return -ENOMEM; 295 return -ENOMEM;
368 296
369 strcpy(name, MFD_NAME_PREFIX); 297 strcpy(name, MFD_NAME_PREFIX);
370 if (copy_from_user(&name[MFD_NAME_PREF 298 if (copy_from_user(&name[MFD_NAME_PREFIX_LEN], uname, len)) {
371 error = -EFAULT; 299 error = -EFAULT;
372 goto err_name; 300 goto err_name;
373 } 301 }
374 302
375 /* terminating-zero may have changed a 303 /* terminating-zero may have changed after strnlen_user() returned */
376 if (name[len + MFD_NAME_PREFIX_LEN - 1 304 if (name[len + MFD_NAME_PREFIX_LEN - 1]) {
377 error = -EFAULT; 305 error = -EFAULT;
378 goto err_name; 306 goto err_name;
379 } 307 }
380 308
381 fd = get_unused_fd_flags((flags & MFD_ 309 fd = get_unused_fd_flags((flags & MFD_CLOEXEC) ? O_CLOEXEC : 0);
382 if (fd < 0) { 310 if (fd < 0) {
383 error = fd; 311 error = fd;
384 goto err_name; 312 goto err_name;
385 } 313 }
386 314
387 if (flags & MFD_HUGETLB) { 315 if (flags & MFD_HUGETLB) {
388 file = hugetlb_file_setup(name !! 316 struct user_struct *user = NULL;
>> 317
>> 318 file = hugetlb_file_setup(name, 0, VM_NORESERVE, &user,
389 HUGETL 319 HUGETLB_ANONHUGE_INODE,
390 (flags 320 (flags >> MFD_HUGE_SHIFT) &
391 MFD_HU 321 MFD_HUGE_MASK);
392 } else 322 } else
393 file = shmem_file_setup(name, 323 file = shmem_file_setup(name, 0, VM_NORESERVE);
394 if (IS_ERR(file)) { 324 if (IS_ERR(file)) {
395 error = PTR_ERR(file); 325 error = PTR_ERR(file);
396 goto err_fd; 326 goto err_fd;
397 } 327 }
398 file->f_mode |= FMODE_LSEEK | FMODE_PR 328 file->f_mode |= FMODE_LSEEK | FMODE_PREAD | FMODE_PWRITE;
399 file->f_flags |= O_LARGEFILE; !! 329 file->f_flags |= O_RDWR | O_LARGEFILE;
400 <<
401 if (flags & MFD_NOEXEC_SEAL) { <<
402 struct inode *inode = file_ino <<
403 330
404 inode->i_mode &= ~0111; !! 331 if (flags & MFD_ALLOW_SEALING) {
405 file_seals = memfd_file_seals_ <<
406 if (file_seals) { <<
407 *file_seals &= ~F_SEAL <<
408 *file_seals |= F_SEAL_ <<
409 } <<
410 } else if (flags & MFD_ALLOW_SEALING) <<
411 /* MFD_EXEC and MFD_ALLOW_SEAL <<
412 file_seals = memfd_file_seals_ 332 file_seals = memfd_file_seals_ptr(file);
413 if (file_seals) !! 333 *file_seals &= ~F_SEAL_SEAL;
414 *file_seals &= ~F_SEAL <<
415 } 334 }
416 335
417 fd_install(fd, file); 336 fd_install(fd, file);
418 kfree(name); 337 kfree(name);
419 return fd; 338 return fd;
420 339
421 err_fd: 340 err_fd:
422 put_unused_fd(fd); 341 put_unused_fd(fd);
423 err_name: 342 err_name:
424 kfree(name); 343 kfree(name);
425 return error; 344 return error;
426 } 345 }
427 346
Linux® is a registered trademark of Linus Torvalds in the United States and other countries.
TOMOYO® is a registered trademark of NTT DATA CORPORATION.