smap.c 3.6 KB
Newer Older
Paolo Bonzini's avatar
Paolo Bonzini committed
1
#include "libcflat.h"
Andrew Jones's avatar
Andrew Jones committed
2
3
4
#include "x86/desc.h"
#include "x86/processor.h"
#include "x86/vm.h"
Paolo Bonzini's avatar
Paolo Bonzini committed
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156

#define X86_FEATURE_SMAP	20
#define X86_EFLAGS_AC		(1 << 18)

volatile int pf_count = 0;
volatile int save;
volatile unsigned test;


// When doing ring 3 tests, page fault handlers will always run on a
// separate stack (the ring 0 stack).  Seems easier to use the alt_stack
// mechanism for both ring 0 and ring 3.

void do_pf_tss(unsigned long error_code)
{
	pf_count++;
	save = test;

#ifndef __x86_64__
	tss.eflags |= X86_EFLAGS_AC;
#endif
}

extern void pf_tss(void);
asm ("pf_tss:\n"
#ifdef __x86_64__
        // no task on x86_64, save/restore caller-save regs
        "push %rax; push %rcx; push %rdx; push %rsi; push %rdi\n"
        "push %r8; push %r9; push %r10; push %r11\n"
	"mov 9*8(%rsp),%rsi\n"
#endif
	"call do_pf_tss\n"
#ifdef __x86_64__
        "pop %r11; pop %r10; pop %r9; pop %r8\n"
        "pop %rdi; pop %rsi; pop %rdx; pop %rcx; pop %rax\n"
#endif
	"add $"S", %"R "sp\n"
#ifdef __x86_64__
	"orl $" xstr(X86_EFLAGS_AC) ", 2*"S"(%"R "sp)\n"  // set EFLAGS.AC and retry
#endif
        "iret"W" \n\t"
        "jmp pf_tss\n\t");


#define USER_BASE	(1 << 24)
#define USER_VAR(v)	(*((__typeof__(&(v))) (((unsigned long)&v) + USER_BASE)))

static void init_test(int i)
{
	pf_count = 0;
	if (i) {
		invlpg(&test);
		invlpg(&USER_VAR(test));
	}
}

int main(int ac, char **av)
{
	unsigned long i;

	if (!(cpuid_indexed(7, 0).b & (1 << X86_FEATURE_SMAP))) {
		printf("SMAP not enabled, exiting\n");
		exit(1);
	}

	setup_vm();
	setup_alt_stack();
	set_intr_alt_stack(14, pf_tss);

	// Map first 16MB as supervisor pages
	for (i = 0; i < USER_BASE; i += PAGE_SIZE) {
		*get_pte(phys_to_virt(read_cr3()), phys_to_virt(i)) &= ~PTE_USER;
		invlpg((void *)i);
	}

	// Present the same 16MB as user pages in the 16MB-32MB range
	for (i = USER_BASE; i < 2 * USER_BASE; i += PAGE_SIZE) {
		*get_pte(phys_to_virt(read_cr3()), phys_to_virt(i)) &= ~USER_BASE;
		invlpg((void *)i);
	}

	clac();
	write_cr4(read_cr4() | X86_CR4_SMAP);
	write_cr3(read_cr3());

	for (i = 0; i < 2; i++) {
		if (i)
			printf("testing with INVLPG\n");
		else
			printf("testing without INVLPG\n");

		init_test(i);
		clac();
		test = 42;
		report("write to supervisor page", pf_count == 0 && test == 42);

		init_test(i);
		stac();
		(void)USER_VAR(test);
		report("read from user page with AC=1", pf_count == 0);

		init_test(i);
		clac();
		(void)USER_VAR(test);
		report("read from user page with AC=0", pf_count == 1 && save == 42);

		init_test(i);
		stac();
		save = 0;
		USER_VAR(test) = 43;
		report("write to user page with AC=1", pf_count == 0 && test == 43);

		init_test(i);
		clac();
		USER_VAR(test) = 44;
		report("read from user page with AC=0", pf_count == 1 && test == 44 && save == 43);

		init_test(i);
		stac();
		test = -1;
		asm("or $(" xstr(USER_BASE) "), %"R "sp \n"
		    "push $44 \n "
		    "decl test\n"
		    "and $~(" xstr(USER_BASE) "), %"R "sp \n"
		    "pop %"R "ax\n"
		    "movl %eax, test");
		report("write to user stack with AC=1", pf_count == 0 && test == 44);

		init_test(i);
		clac();
		test = -1;
		asm("or $(" xstr(USER_BASE) "), %"R "sp \n"
		    "push $45 \n "
		    "decl test\n"
		    "and $~(" xstr(USER_BASE) "), %"R "sp \n"
		    "pop %"R "ax\n"
		    "movl %eax, test");
		report("write to user stack with AC=0", pf_count == 1 && test == 45 && save == -1);

		/* This would be trapped by SMEP */
		init_test(i);
		clac();
		asm("jmp 1f + "xstr(USER_BASE)" \n"
		    "1: jmp 2f - "xstr(USER_BASE)" \n"
		    "2:");
		report("executing on user page with AC=0", pf_count == 0);
	}

	// TODO: implicit kernel access from ring 3 (e.g. int)

	return report_summary();
}