1 #include "libcflat.h" 2 #include "x86/desc.h" 3 #include "x86/processor.h" 4 #include "x86/vm.h" 5 6 #define X86_FEATURE_SMAP 20 7 #define X86_EFLAGS_AC (1 << 18) 8 9 volatile int pf_count = 0; 10 volatile int save; 11 volatile unsigned test; 12 13 14 // When doing ring 3 tests, page fault handlers will always run on a 15 // separate stack (the ring 0 stack). Seems easier to use the alt_stack 16 // mechanism for both ring 0 and ring 3. 17 18 void do_pf_tss(unsigned long error_code) 19 { 20 pf_count++; 21 save = test; 22 23 #ifndef __x86_64__ 24 tss.eflags |= X86_EFLAGS_AC; 25 #endif 26 } 27 28 extern void pf_tss(void); 29 asm ("pf_tss:\n" 30 #ifdef __x86_64__ 31 // no task on x86_64, save/restore caller-save regs 32 "push %rax; push %rcx; push %rdx; push %rsi; push %rdi\n" 33 "push %r8; push %r9; push %r10; push %r11\n" 34 "mov 9*8(%rsp),%rsi\n" 35 #endif 36 "call do_pf_tss\n" 37 #ifdef __x86_64__ 38 "pop %r11; pop %r10; pop %r9; pop %r8\n" 39 "pop %rdi; pop %rsi; pop %rdx; pop %rcx; pop %rax\n" 40 #endif 41 "add $"S", %"R "sp\n" 42 #ifdef __x86_64__ 43 "orl $" xstr(X86_EFLAGS_AC) ", 2*"S"(%"R "sp)\n" // set EFLAGS.AC and retry 44 #endif 45 "iret"W" \n\t" 46 "jmp pf_tss\n\t"); 47 48 49 #define USER_BASE (1 << 24) 50 #define USER_VAR(v) (*((__typeof__(&(v))) (((unsigned long)&v) + USER_BASE))) 51 #define USER_ADDR(v) ((void *)((unsigned long)(&v) + USER_BASE)) 52 53 static void init_test(int i) 54 { 55 pf_count = 0; 56 if (i) { 57 invlpg(&test); 58 invlpg(&USER_VAR(test)); 59 } 60 } 61 62 static void check_smap_nowp(void) 63 { 64 test = 0x99; 65 66 *get_pte(phys_to_virt(read_cr3()), USER_ADDR(test)) &= ~PTE_WRITE; 67 68 write_cr4(read_cr4() & ~X86_CR4_SMAP); 69 write_cr0(read_cr0() & ~X86_CR0_WP); 70 clac(); 71 write_cr3(read_cr3()); 72 73 init_test(0); 74 USER_VAR(test) = 0x99; 75 report("write from user page with SMAP=0, AC=0, WP=0, PTE.U=1 && PTE.W=0", pf_count == 0); 76 77 write_cr4(read_cr4() | X86_CR4_SMAP); 78 write_cr3(read_cr3()); 79 80 init_test(0); 81 (void)USER_VAR(test); 82 report("read from user page with SMAP=1, AC=0, WP=0, PTE.U=1 && PTE.W=0", pf_count == 1 && save == 0x99); 83 } 84 85 int main(int ac, char **av) 86 { 87 unsigned long i; 88 89 if (!(cpuid_indexed(7, 0).b & (1 << X86_FEATURE_SMAP))) { 90 printf("SMAP not enabled, exiting\n"); 91 exit(1); 92 } 93 94 setup_vm(); 95 setup_alt_stack(); 96 set_intr_alt_stack(14, pf_tss); 97 98 // Map first 16MB as supervisor pages 99 for (i = 0; i < USER_BASE; i += PAGE_SIZE) { 100 *get_pte(phys_to_virt(read_cr3()), phys_to_virt(i)) &= ~PTE_USER; 101 invlpg((void *)i); 102 } 103 104 // Present the same 16MB as user pages in the 16MB-32MB range 105 for (i = USER_BASE; i < 2 * USER_BASE; i += PAGE_SIZE) { 106 *get_pte(phys_to_virt(read_cr3()), phys_to_virt(i)) &= ~USER_BASE; 107 invlpg((void *)i); 108 } 109 110 clac(); 111 write_cr4(read_cr4() | X86_CR4_SMAP); 112 write_cr3(read_cr3()); 113 114 for (i = 0; i < 2; i++) { 115 if (i) 116 printf("testing with INVLPG\n"); 117 else 118 printf("testing without INVLPG\n"); 119 120 init_test(i); 121 clac(); 122 test = 42; 123 report("write to supervisor page", pf_count == 0 && test == 42); 124 125 init_test(i); 126 stac(); 127 (void)USER_VAR(test); 128 report("read from user page with AC=1", pf_count == 0); 129 130 init_test(i); 131 clac(); 132 (void)USER_VAR(test); 133 report("read from user page with AC=0", pf_count == 1 && save == 42); 134 135 init_test(i); 136 stac(); 137 save = 0; 138 USER_VAR(test) = 43; 139 report("write to user page with AC=1", pf_count == 0 && test == 43); 140 141 init_test(i); 142 clac(); 143 USER_VAR(test) = 44; 144 report("read from user page with AC=0", pf_count == 1 && test == 44 && save == 43); 145 146 init_test(i); 147 stac(); 148 test = -1; 149 asm("or $(" xstr(USER_BASE) "), %"R "sp \n" 150 "push $44 \n " 151 "decl test\n" 152 "and $~(" xstr(USER_BASE) "), %"R "sp \n" 153 "pop %"R "ax\n" 154 "movl %eax, test"); 155 report("write to user stack with AC=1", pf_count == 0 && test == 44); 156 157 init_test(i); 158 clac(); 159 test = -1; 160 asm("or $(" xstr(USER_BASE) "), %"R "sp \n" 161 "push $45 \n " 162 "decl test\n" 163 "and $~(" xstr(USER_BASE) "), %"R "sp \n" 164 "pop %"R "ax\n" 165 "movl %eax, test"); 166 report("write to user stack with AC=0", pf_count == 1 && test == 45 && save == -1); 167 168 /* This would be trapped by SMEP */ 169 init_test(i); 170 clac(); 171 asm("jmp 1f + "xstr(USER_BASE)" \n" 172 "1: jmp 2f - "xstr(USER_BASE)" \n" 173 "2:"); 174 report("executing on user page with AC=0", pf_count == 0); 175 } 176 177 check_smap_nowp(); 178 179 // TODO: implicit kernel access from ring 3 (e.g. int) 180 181 return report_summary(); 182 } 183