1 #include "libcflat.h" 2 #include "x86/desc.h" 3 #include "x86/processor.h" 4 #include "x86/vm.h" 5 6 #define X86_FEATURE_SMAP 20 7 #define X86_EFLAGS_AC (1 << 18) 8 9 volatile int pf_count = 0; 10 volatile int save; 11 volatile unsigned test; 12 13 14 // When doing ring 3 tests, page fault handlers will always run on a 15 // separate stack (the ring 0 stack). Seems easier to use the alt_stack 16 // mechanism for both ring 0 and ring 3. 17 18 void do_pf_tss(unsigned long error_code) 19 { 20 pf_count++; 21 save = test; 22 23 #ifndef __x86_64__ 24 tss.eflags |= X86_EFLAGS_AC; 25 #endif 26 } 27 28 extern void pf_tss(void); 29 asm ("pf_tss:\n" 30 #ifdef __x86_64__ 31 // no task on x86_64, save/restore caller-save regs 32 "push %rax; push %rcx; push %rdx; push %rsi; push %rdi\n" 33 "push %r8; push %r9; push %r10; push %r11\n" 34 "mov 9*8(%rsp),%rsi\n" 35 #endif 36 "call do_pf_tss\n" 37 #ifdef __x86_64__ 38 "pop %r11; pop %r10; pop %r9; pop %r8\n" 39 "pop %rdi; pop %rsi; pop %rdx; pop %rcx; pop %rax\n" 40 #endif 41 "add $"S", %"R "sp\n" 42 #ifdef __x86_64__ 43 "orl $" xstr(X86_EFLAGS_AC) ", 2*"S"(%"R "sp)\n" // set EFLAGS.AC and retry 44 #endif 45 "iret"W" \n\t" 46 "jmp pf_tss\n\t"); 47 48 49 #define USER_BASE (1 << 24) 50 #define USER_VAR(v) (*((__typeof__(&(v))) (((unsigned long)&v) + USER_BASE))) 51 52 static void init_test(int i) 53 { 54 pf_count = 0; 55 if (i) { 56 invlpg(&test); 57 invlpg(&USER_VAR(test)); 58 } 59 } 60 61 int main(int ac, char **av) 62 { 63 unsigned long i; 64 65 if (!(cpuid_indexed(7, 0).b & (1 << X86_FEATURE_SMAP))) { 66 printf("SMAP not enabled, exiting\n"); 67 exit(1); 68 } 69 70 setup_vm(); 71 setup_alt_stack(); 72 set_intr_alt_stack(14, pf_tss); 73 74 // Map first 16MB as supervisor pages 75 for (i = 0; i < USER_BASE; i += PAGE_SIZE) { 76 *get_pte(phys_to_virt(read_cr3()), phys_to_virt(i)) &= ~PTE_USER; 77 invlpg((void *)i); 78 } 79 80 // Present the same 16MB as user pages in the 16MB-32MB range 81 for (i = USER_BASE; i < 2 * USER_BASE; i += PAGE_SIZE) { 82 *get_pte(phys_to_virt(read_cr3()), phys_to_virt(i)) &= ~USER_BASE; 83 invlpg((void *)i); 84 } 85 86 clac(); 87 write_cr4(read_cr4() | X86_CR4_SMAP); 88 write_cr3(read_cr3()); 89 90 for (i = 0; i < 2; i++) { 91 if (i) 92 printf("testing with INVLPG\n"); 93 else 94 printf("testing without INVLPG\n"); 95 96 init_test(i); 97 clac(); 98 test = 42; 99 report("write to supervisor page", pf_count == 0 && test == 42); 100 101 init_test(i); 102 stac(); 103 (void)USER_VAR(test); 104 report("read from user page with AC=1", pf_count == 0); 105 106 init_test(i); 107 clac(); 108 (void)USER_VAR(test); 109 report("read from user page with AC=0", pf_count == 1 && save == 42); 110 111 init_test(i); 112 stac(); 113 save = 0; 114 USER_VAR(test) = 43; 115 report("write to user page with AC=1", pf_count == 0 && test == 43); 116 117 init_test(i); 118 clac(); 119 USER_VAR(test) = 44; 120 report("read from user page with AC=0", pf_count == 1 && test == 44 && save == 43); 121 122 init_test(i); 123 stac(); 124 test = -1; 125 asm("or $(" xstr(USER_BASE) "), %"R "sp \n" 126 "push $44 \n " 127 "decl test\n" 128 "and $~(" xstr(USER_BASE) "), %"R "sp \n" 129 "pop %"R "ax\n" 130 "movl %eax, test"); 131 report("write to user stack with AC=1", pf_count == 0 && test == 44); 132 133 init_test(i); 134 clac(); 135 test = -1; 136 asm("or $(" xstr(USER_BASE) "), %"R "sp \n" 137 "push $45 \n " 138 "decl test\n" 139 "and $~(" xstr(USER_BASE) "), %"R "sp \n" 140 "pop %"R "ax\n" 141 "movl %eax, test"); 142 report("write to user stack with AC=0", pf_count == 1 && test == 45 && save == -1); 143 144 /* This would be trapped by SMEP */ 145 init_test(i); 146 clac(); 147 asm("jmp 1f + "xstr(USER_BASE)" \n" 148 "1: jmp 2f - "xstr(USER_BASE)" \n" 149 "2:"); 150 report("executing on user page with AC=0", pf_count == 0); 151 } 152 153 // TODO: implicit kernel access from ring 3 (e.g. int) 154 155 return report_summary(); 156 } 157