Commit fd0898ba authored by Xiao Guangrong's avatar Xiao Guangrong Committed by Paolo Bonzini
Browse files

x86: smap: check smap and !cr0.wp



This test case is used to produce the bug that:

KVM may turn a user page to a kernel page when kernel writes a readonly
user page if CR0.WP = 1. This shadow page entry will be reused after
SMAP is enabled so that kernel is allowed to access this user page
Signed-off-by: default avatarXiao Guangrong <guangrong.xiao@linux.intel.com>
Message-Id: <1430988242-7186-1-git-send-email-guangrong.xiao@linux.intel.com>
Signed-off-by: default avatarPaolo Bonzini <pbonzini@redhat.com>
parent d9a05378
......@@ -48,6 +48,7 @@ asm ("pf_tss:\n"
#define USER_BASE (1 << 24)
#define USER_VAR(v) (*((__typeof__(&(v))) (((unsigned long)&v) + USER_BASE)))
#define USER_ADDR(v) ((void *)((unsigned long)(&v) + USER_BASE))
static void init_test(int i)
{
......@@ -58,6 +59,29 @@ static void init_test(int i)
}
}
static void check_smap_nowp(void)
{
test = 0x99;
*get_pte(phys_to_virt(read_cr3()), USER_ADDR(test)) &= ~PTE_WRITE;
write_cr4(read_cr4() & ~X86_CR4_SMAP);
write_cr0(read_cr0() & ~X86_CR0_WP);
clac();
write_cr3(read_cr3());
init_test(0);
USER_VAR(test) = 0x99;
report("write from user page with SMAP=0, AC=0, WP=0, PTE.U=1 && PTE.W=0", pf_count == 0);
write_cr4(read_cr4() | X86_CR4_SMAP);
write_cr3(read_cr3());
init_test(0);
(void)USER_VAR(test);
report("read from user page with SMAP=1, AC=0, WP=0, PTE.U=1 && PTE.W=0", pf_count == 1 && save == 0x99);
}
int main(int ac, char **av)
{
unsigned long i;
......@@ -150,6 +174,8 @@ int main(int ac, char **av)
report("executing on user page with AC=0", pf_count == 0);
}
check_smap_nowp();
// TODO: implicit kernel access from ring 3 (e.g. int)
return report_summary();
......
Supports Markdown
0% or .
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment