1 #include "libcflat.h" 2 #include "x86/desc.h" 3 #include "x86/processor.h" 4 #include "x86/vm.h" 5 6 volatile int pf_count = 0; 7 volatile int save; 8 volatile unsigned test; 9 10 void do_pf_tss(unsigned long error_code); 11 12 // When doing ring 3 tests, page fault handlers will always run on a 13 // separate stack (the ring 0 stack). Seems easier to use the alt_stack 14 // mechanism for both ring 0 and ring 3. 15 16 void do_pf_tss(unsigned long error_code) 17 { 18 pf_count++; 19 save = test; 20 21 #ifndef __x86_64__ 22 tss.eflags |= X86_EFLAGS_AC; 23 #endif 24 } 25 26 extern void pf_tss(void); 27 asm ("pf_tss:\n" 28 #ifdef __x86_64__ 29 // no task on x86_64, save/restore caller-save regs 30 "push %rax; push %rcx; push %rdx; push %rsi; push %rdi\n" 31 "push %r8; push %r9; push %r10; push %r11\n" 32 "mov 9*8(%rsp),%rdi\n" 33 #endif 34 "call do_pf_tss\n" 35 #ifdef __x86_64__ 36 "pop %r11; pop %r10; pop %r9; pop %r8\n" 37 "pop %rdi; pop %rsi; pop %rdx; pop %rcx; pop %rax\n" 38 #endif 39 "add $"S", %"R "sp\n" 40 #ifdef __x86_64__ 41 "orl $" xstr(X86_EFLAGS_AC) ", 2*"S"(%"R "sp)\n" // set EFLAGS.AC and retry 42 #endif 43 "iret"W" \n\t" 44 "jmp pf_tss\n\t"); 45 46 47 #define USER_BASE (1 << 24) 48 #define USER_VAR(v) (*((__typeof__(&(v))) (((unsigned long)&v) + USER_BASE))) 49 #define USER_ADDR(v) ((void *)((unsigned long)(&v) + USER_BASE)) 50 51 static void init_test(int i) 52 { 53 pf_count = 0; 54 if (i) { 55 invlpg(&test); 56 invlpg(&USER_VAR(test)); 57 } 58 } 59 60 static void check_smap_nowp(void) 61 { 62 test = 0x99; 63 64 *get_pte(phys_to_virt(read_cr3()), USER_ADDR(test)) &= ~PT_WRITABLE_MASK; 65 66 write_cr4(read_cr4() & ~X86_CR4_SMAP); 67 write_cr0(read_cr0() & ~X86_CR0_WP); 68 clac(); 69 write_cr3(read_cr3()); 70 71 init_test(0); 72 USER_VAR(test) = 0x99; 73 report(pf_count == 0, 74 "write from user page with SMAP=0, AC=0, WP=0, PTE.U=1 && PTE.W=0"); 75 76 write_cr4(read_cr4() | X86_CR4_SMAP); 77 write_cr3(read_cr3()); 78 79 init_test(0); 80 (void)USER_VAR(test); 81 report(pf_count == 1 && save == 0x99, 82 "read from user page with SMAP=1, AC=0, WP=0, PTE.U=1 && PTE.W=0"); 83 84 /* Undo changes */ 85 *get_pte(phys_to_virt(read_cr3()), USER_ADDR(test)) |= PT_WRITABLE_MASK; 86 87 write_cr0(read_cr0() | X86_CR0_WP); 88 write_cr3(read_cr3()); 89 } 90 91 int main(int ac, char **av) 92 { 93 unsigned long i; 94 95 if (!this_cpu_has(X86_FEATURE_SMAP)) { 96 printf("SMAP not enabled\n"); 97 return report_summary(); 98 } 99 100 setup_vm(); 101 setup_alt_stack(); 102 set_intr_alt_stack(14, pf_tss); 103 104 // Map first 16MB as supervisor pages 105 for (i = 0; i < USER_BASE; i += PAGE_SIZE) { 106 *get_pte(phys_to_virt(read_cr3()), phys_to_virt(i)) &= ~PT_USER_MASK; 107 invlpg((void *)i); 108 } 109 110 // Present the same 16MB as user pages in the 16MB-32MB range 111 for (i = USER_BASE; i < 2 * USER_BASE; i += PAGE_SIZE) { 112 *get_pte(phys_to_virt(read_cr3()), phys_to_virt(i)) &= ~USER_BASE; 113 invlpg((void *)i); 114 } 115 116 clac(); 117 write_cr4(read_cr4() | X86_CR4_SMAP); 118 write_cr3(read_cr3()); 119 120 for (i = 0; i < 2; i++) { 121 if (i) 122 printf("testing with INVLPG\n"); 123 else 124 printf("testing without INVLPG\n"); 125 126 init_test(i); 127 clac(); 128 test = 42; 129 report(pf_count == 0 && test == 42, 130 "write to supervisor page"); 131 132 init_test(i); 133 stac(); 134 (void)USER_VAR(test); 135 report(pf_count == 0, "read from user page with AC=1"); 136 137 init_test(i); 138 clac(); 139 (void)USER_VAR(test); 140 report(pf_count == 1 && save == 42, 141 "read from user page with AC=0"); 142 143 init_test(i); 144 stac(); 145 save = 0; 146 USER_VAR(test) = 43; 147 report(pf_count == 0 && test == 43, 148 "write to user page with AC=1"); 149 150 init_test(i); 151 clac(); 152 USER_VAR(test) = 44; 153 report(pf_count == 1 && test == 44 && save == 43, 154 "read from user page with AC=0"); 155 156 init_test(i); 157 stac(); 158 test = -1; 159 asm("or $(" xstr(USER_BASE) "), %"R "sp \n" 160 "push $44 \n " 161 "decl test\n" 162 "and $~(" xstr(USER_BASE) "), %"R "sp \n" 163 "pop %"R "ax\n" 164 "movl %eax, test"); 165 report(pf_count == 0 && test == 44, 166 "write to user stack with AC=1"); 167 168 init_test(i); 169 clac(); 170 test = -1; 171 asm("or $(" xstr(USER_BASE) "), %"R "sp \n" 172 "push $45 \n " 173 "decl test\n" 174 "and $~(" xstr(USER_BASE) "), %"R "sp \n" 175 "pop %"R "ax\n" 176 "movl %eax, test"); 177 report(pf_count == 1 && test == 45 && save == -1, 178 "write to user stack with AC=0"); 179 180 /* This would be trapped by SMEP */ 181 init_test(i); 182 clac(); 183 asm("jmp 1f + "xstr(USER_BASE)" \n" 184 "1: jmp 2f - "xstr(USER_BASE)" \n" 185 "2:"); 186 report(pf_count == 0, "executing on user page with AC=0"); 187 } 188 189 check_smap_nowp(); 190 191 // TODO: implicit kernel access from ring 3 (e.g. int) 192 193 return report_summary(); 194 } 195