Spaces:
Runtime error
Runtime error
File size: 4,497 Bytes
8df6da4 |
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 73 74 75 76 77 78 79 80 81 82 83 84 85 86 87 88 89 90 91 92 93 94 95 96 97 98 99 100 101 102 103 104 105 106 107 108 109 110 111 112 113 114 115 116 117 118 119 120 121 122 123 124 125 126 127 128 129 130 131 132 133 134 135 136 137 138 139 140 141 142 143 144 145 146 147 148 149 150 151 152 153 154 155 156 157 158 159 160 161 162 163 164 165 166 167 168 169 170 171 172 173 174 175 176 177 178 179 180 181 182 183 184 185 186 187 188 |
#include "libcflat.h"
#include "x86/desc.h"
#include "x86/processor.h"
#include "x86/vm.h"
#define X86_FEATURE_SMAP 20
volatile int pf_count = 0;
volatile int save;
volatile unsigned test;
// When doing ring 3 tests, page fault handlers will always run on a
// separate stack (the ring 0 stack). Seems easier to use the alt_stack
// mechanism for both ring 0 and ring 3.
void do_pf_tss(unsigned long error_code)
{
pf_count++;
save = test;
#ifndef __x86_64__
tss.eflags |= X86_EFLAGS_AC;
#endif
}
extern void pf_tss(void);
asm ("pf_tss:\n"
#ifdef __x86_64__
// no task on x86_64, save/restore caller-save regs
"push %rax; push %rcx; push %rdx; push %rsi; push %rdi\n"
"push %r8; push %r9; push %r10; push %r11\n"
"mov 9*8(%rsp),%rsi\n"
#endif
"call do_pf_tss\n"
#ifdef __x86_64__
"pop %r11; pop %r10; pop %r9; pop %r8\n"
"pop %rdi; pop %rsi; pop %rdx; pop %rcx; pop %rax\n"
#endif
"add $"S", %"R "sp\n"
#ifdef __x86_64__
"orl $" xstr(X86_EFLAGS_AC) ", 2*"S"(%"R "sp)\n" // set EFLAGS.AC and retry
#endif
"iret"W" \n\t"
"jmp pf_tss\n\t");
#define USER_BASE (1 << 24)
#define USER_VAR(v) (*((__typeof__(&(v))) (((unsigned long)&v) + USER_BASE)))
#define USER_ADDR(v) ((void *)((unsigned long)(&v) + USER_BASE))
static void init_test(int i)
{
pf_count = 0;
if (i) {
invlpg(&test);
invlpg(&USER_VAR(test));
}
}
static void check_smap_nowp(void)
{
test = 0x99;
*get_pte(phys_to_virt(read_cr3()), USER_ADDR(test)) &= ~PT_WRITABLE_MASK;
write_cr4(read_cr4() & ~X86_CR4_SMAP);
write_cr0(read_cr0() & ~X86_CR0_WP);
clac();
write_cr3(read_cr3());
init_test(0);
USER_VAR(test) = 0x99;
report("write from user page with SMAP=0, AC=0, WP=0, PTE.U=1 && PTE.W=0", pf_count == 0);
write_cr4(read_cr4() | X86_CR4_SMAP);
write_cr3(read_cr3());
init_test(0);
(void)USER_VAR(test);
report("read from user page with SMAP=1, AC=0, WP=0, PTE.U=1 && PTE.W=0", pf_count == 1 && save == 0x99);
/* Undo changes */
*get_pte(phys_to_virt(read_cr3()), USER_ADDR(test)) |= PT_WRITABLE_MASK;
write_cr0(read_cr0() | X86_CR0_WP);
write_cr3(read_cr3());
}
int main(int ac, char **av)
{
unsigned long i;
if (!(cpuid_indexed(7, 0).b & (1 << X86_FEATURE_SMAP))) {
printf("SMAP not enabled\n");
return report_summary();
}
setup_vm();
setup_alt_stack();
set_intr_alt_stack(14, pf_tss);
// Map first 16MB as supervisor pages
for (i = 0; i < USER_BASE; i += PAGE_SIZE) {
*get_pte(phys_to_virt(read_cr3()), phys_to_virt(i)) &= ~PT_USER_MASK;
invlpg((void *)i);
}
// Present the same 16MB as user pages in the 16MB-32MB range
for (i = USER_BASE; i < 2 * USER_BASE; i += PAGE_SIZE) {
*get_pte(phys_to_virt(read_cr3()), phys_to_virt(i)) &= ~USER_BASE;
invlpg((void *)i);
}
clac();
write_cr4(read_cr4() | X86_CR4_SMAP);
write_cr3(read_cr3());
for (i = 0; i < 2; i++) {
if (i)
printf("testing with INVLPG\n");
else
printf("testing without INVLPG\n");
init_test(i);
clac();
test = 42;
report("write to supervisor page", pf_count == 0 && test == 42);
init_test(i);
stac();
(void)USER_VAR(test);
report("read from user page with AC=1", pf_count == 0);
init_test(i);
clac();
(void)USER_VAR(test);
report("read from user page with AC=0", pf_count == 1 && save == 42);
init_test(i);
stac();
save = 0;
USER_VAR(test) = 43;
report("write to user page with AC=1", pf_count == 0 && test == 43);
init_test(i);
clac();
USER_VAR(test) = 44;
report("read from user page with AC=0", pf_count == 1 && test == 44 && save == 43);
init_test(i);
stac();
test = -1;
asm("or $(" xstr(USER_BASE) "), %"R "sp \n"
"push $44 \n "
"decl test\n"
"and $~(" xstr(USER_BASE) "), %"R "sp \n"
"pop %"R "ax\n"
"movl %eax, test");
report("write to user stack with AC=1", pf_count == 0 && test == 44);
init_test(i);
clac();
test = -1;
asm("or $(" xstr(USER_BASE) "), %"R "sp \n"
"push $45 \n "
"decl test\n"
"and $~(" xstr(USER_BASE) "), %"R "sp \n"
"pop %"R "ax\n"
"movl %eax, test");
report("write to user stack with AC=0", pf_count == 1 && test == 45 && save == -1);
/* This would be trapped by SMEP */
init_test(i);
clac();
asm("jmp 1f + "xstr(USER_BASE)" \n"
"1: jmp 2f - "xstr(USER_BASE)" \n"
"2:");
report("executing on user page with AC=0", pf_count == 0);
}
check_smap_nowp();
// TODO: implicit kernel access from ring 3 (e.g. int)
return report_summary();
}
|