1 #include "libcflat.h" 2 #include "x86/desc.h" 3 #include "x86/processor.h" 4 #include "x86/vm.h" 5 6 #define X86_FEATURE_SMAP 20 7 #define X86_EFLAGS_AC (1 << 18) 8 9 volatile int pf_count = 0; 10 volatile int save; 11 volatile unsigned test; 12 13 14 // When doing ring 3 tests, page fault handlers will always run on a 15 // separate stack (the ring 0 stack). Seems easier to use the alt_stack 16 // mechanism for both ring 0 and ring 3. 17 18 void do_pf_tss(unsigned long error_code) 19 { 20 pf_count++; 21 save = test; 22 23 #ifndef __x86_64__ 24 tss.eflags |= X86_EFLAGS_AC; 25 #endif 26 } 27 28 extern void pf_tss(void); 29 asm ("pf_tss:\n" 30 #ifdef __x86_64__ 31 // no task on x86_64, save/restore caller-save regs 32 "push %rax; push %rcx; push %rdx; push %rsi; push %rdi\n" 33 "push %r8; push %r9; push %r10; push %r11\n" 34 "mov 9*8(%rsp),%rsi\n" 35 #endif 36 "call do_pf_tss\n" 37 #ifdef __x86_64__ 38 "pop %r11; pop %r10; pop %r9; pop %r8\n" 39 "pop %rdi; pop %rsi; pop %rdx; pop %rcx; pop %rax\n" 40 #endif 41 "add $"S", %"R "sp\n" 42 #ifdef __x86_64__ 43 "orl $" xstr(X86_EFLAGS_AC) ", 2*"S"(%"R "sp)\n" // set EFLAGS.AC and retry 44 #endif 45 "iret"W" \n\t" 46 "jmp pf_tss\n\t"); 47 48 49 #define USER_BASE (1 << 24) 50 #define USER_VAR(v) (*((__typeof__(&(v))) (((unsigned long)&v) + USER_BASE))) 51 #define USER_ADDR(v) ((void *)((unsigned long)(&v) + USER_BASE)) 52 53 static void init_test(int i) 54 { 55 pf_count = 0; 56 if (i) { 57 invlpg(&test); 58 invlpg(&USER_VAR(test)); 59 } 60 } 61 62 static void check_smap_nowp(void) 63 { 64 test = 0x99; 65 66 *get_pte(phys_to_virt(read_cr3()), USER_ADDR(test)) &= ~PTE_WRITE; 67 68 write_cr4(read_cr4() & ~X86_CR4_SMAP); 69 write_cr0(read_cr0() & ~X86_CR0_WP); 70 clac(); 71 write_cr3(read_cr3()); 72 73 init_test(0); 74 USER_VAR(test) = 0x99; 75 report("write from user page with SMAP=0, AC=0, WP=0, PTE.U=1 && PTE.W=0", pf_count == 0); 76 77 write_cr4(read_cr4() | X86_CR4_SMAP); 78 write_cr3(read_cr3()); 79 80 init_test(0); 81 (void)USER_VAR(test); 82 report("read from user page with SMAP=1, AC=0, WP=0, PTE.U=1 && PTE.W=0", pf_count == 1 && save == 0x99); 83 84 /* Undo changes */ 85 *get_pte(phys_to_virt(read_cr3()), USER_ADDR(test)) |= PTE_WRITE; 86 87 write_cr0(read_cr0() | X86_CR0_WP); 88 write_cr3(read_cr3()); 89 } 90 91 int main(int ac, char **av) 92 { 93 unsigned long i; 94 95 if (!(cpuid_indexed(7, 0).b & (1 << X86_FEATURE_SMAP))) { 96 printf("SMAP not enabled, exiting\n"); 97 exit(1); 98 } 99 100 setup_vm(); 101 setup_alt_stack(); 102 set_intr_alt_stack(14, pf_tss); 103 104 // Map first 16MB as supervisor pages 105 for (i = 0; i < USER_BASE; i += PAGE_SIZE) { 106 *get_pte(phys_to_virt(read_cr3()), phys_to_virt(i)) &= ~PTE_USER; 107 invlpg((void *)i); 108 } 109 110 // Present the same 16MB as user pages in the 16MB-32MB range 111 for (i = USER_BASE; i < 2 * USER_BASE; i += PAGE_SIZE) { 112 *get_pte(phys_to_virt(read_cr3()), phys_to_virt(i)) &= ~USER_BASE; 113 invlpg((void *)i); 114 } 115 116 clac(); 117 write_cr4(read_cr4() | X86_CR4_SMAP); 118 write_cr3(read_cr3()); 119 120 for (i = 0; i < 2; i++) { 121 if (i) 122 printf("testing with INVLPG\n"); 123 else 124 printf("testing without INVLPG\n"); 125 126 init_test(i); 127 clac(); 128 test = 42; 129 report("write to supervisor page", pf_count == 0 && test == 42); 130 131 init_test(i); 132 stac(); 133 (void)USER_VAR(test); 134 report("read from user page with AC=1", pf_count == 0); 135 136 init_test(i); 137 clac(); 138 (void)USER_VAR(test); 139 report("read from user page with AC=0", pf_count == 1 && save == 42); 140 141 init_test(i); 142 stac(); 143 save = 0; 144 USER_VAR(test) = 43; 145 report("write to user page with AC=1", pf_count == 0 && test == 43); 146 147 init_test(i); 148 clac(); 149 USER_VAR(test) = 44; 150 report("read from user page with AC=0", pf_count == 1 && test == 44 && save == 43); 151 152 init_test(i); 153 stac(); 154 test = -1; 155 asm("or $(" xstr(USER_BASE) "), %"R "sp \n" 156 "push $44 \n " 157 "decl test\n" 158 "and $~(" xstr(USER_BASE) "), %"R "sp \n" 159 "pop %"R "ax\n" 160 "movl %eax, test"); 161 report("write to user stack with AC=1", pf_count == 0 && test == 44); 162 163 init_test(i); 164 clac(); 165 test = -1; 166 asm("or $(" xstr(USER_BASE) "), %"R "sp \n" 167 "push $45 \n " 168 "decl test\n" 169 "and $~(" xstr(USER_BASE) "), %"R "sp \n" 170 "pop %"R "ax\n" 171 "movl %eax, test"); 172 report("write to user stack with AC=0", pf_count == 1 && test == 45 && save == -1); 173 174 /* This would be trapped by SMEP */ 175 init_test(i); 176 clac(); 177 asm("jmp 1f + "xstr(USER_BASE)" \n" 178 "1: jmp 2f - "xstr(USER_BASE)" \n" 179 "2:"); 180 report("executing on user page with AC=0", pf_count == 0); 181 } 182 183 check_smap_nowp(); 184 185 // TODO: implicit kernel access from ring 3 (e.g. int) 186 187 return report_summary(); 188 } 189