* [PATCH] check smap and !cr0.wp
@ 2015-05-07 8:30 Xiao Guangrong
2015-05-07 8:39 ` Xiao Guangrong
0 siblings, 1 reply; 6+ messages in thread
From: Xiao Guangrong @ 2015-05-07 8:30 UTC (permalink / raw)
To: pbonzini; +Cc: gleb, mtosatti, kvm, linux-kernel, root, Xiao Guangrong
From: root <root@lyu2-mobl2.ccr.corp.intel.com>
This test case is used to produce the bug that:
KVM may turn a user page to a kernel page when kernel writes a readonly
user page if CR0.WP = 1. This shadow page entry will be reused after
SMAP is enabled so that kernel is allowed to access this user page
Signed-off-by: Xiao Guangrong <guangrong.xiao@linux.intel.com>
---
x86/smap.c | 26 ++++++++++++++++++++++++++
1 file changed, 26 insertions(+)
diff --git a/x86/smap.c b/x86/smap.c
index 042c5aa..66f97b8 100644
--- a/x86/smap.c
+++ b/x86/smap.c
@@ -48,6 +48,7 @@ asm ("pf_tss:\n"
#define USER_BASE (1 << 24)
#define USER_VAR(v) (*((__typeof__(&(v))) (((unsigned long)&v) + USER_BASE)))
+#define USER_ADDR(v) ((void *)((unsigned long)(&v) + USER_BASE))
static void init_test(int i)
{
@@ -58,6 +59,29 @@ static void init_test(int i)
}
}
+static void check_smap_nowp(void)
+{
+ test = 0x99;
+
+ *get_pte(phys_to_virt(read_cr3()), USER_ADDR(test)) &= ~PTE_WRITE;
+
+ write_cr4(read_cr4() & ~X86_CR4_SMAP);
+ write_cr0(read_cr0() & ~X86_CR0_WP);
+ clac();
+ write_cr3(read_cr3());
+
+ init_test(0);
+ USER_VAR(test) = 0x99;
+ report("write from user page with SMAP=0, AC=0, WP=0, PTE.U=1 && PTE.W=0", pf_count == 0);
+
+ write_cr4(read_cr4() | X86_CR4_SMAP);
+ write_cr3(read_cr3());
+
+ init_test(0);
+ (void)USER_VAR(test);
+ report("read from user page with SMAP=1, AC=0, WP=0, PTE.U=1 && PTE.W=0", pf_count == 1 && save == 0x99);
+}
+
int main(int ac, char **av)
{
unsigned long i;
@@ -150,6 +174,8 @@ int main(int ac, char **av)
report("executing on user page with AC=0", pf_count == 0);
}
+ check_smap_nowp();
+
// TODO: implicit kernel access from ring 3 (e.g. int)
return report_summary();
--
1.8.3.1
^ permalink raw reply related [flat|nested] 6+ messages in thread* [PATCH] check smap and !cr0.wp
@ 2015-05-07 8:44 Xiao Guangrong
2015-05-12 3:13 ` Xiao Guangrong
0 siblings, 1 reply; 6+ messages in thread
From: Xiao Guangrong @ 2015-05-07 8:44 UTC (permalink / raw)
To: pbonzini; +Cc: gleb, mtosatti, kvm, linux-kernel, Xiao Guangrong
This test case is used to produce the bug that:
KVM may turn a user page to a kernel page when kernel writes a readonly
user page if CR0.WP = 1. This shadow page entry will be reused after
SMAP is enabled so that kernel is allowed to access this user page
Signed-off-by: Xiao Guangrong <guangrong.xiao@linux.intel.com>
---
x86/smap.c | 26 ++++++++++++++++++++++++++
1 file changed, 26 insertions(+)
diff --git a/x86/smap.c b/x86/smap.c
index 042c5aa..66f97b8 100644
--- a/x86/smap.c
+++ b/x86/smap.c
@@ -48,6 +48,7 @@ asm ("pf_tss:\n"
#define USER_BASE (1 << 24)
#define USER_VAR(v) (*((__typeof__(&(v))) (((unsigned long)&v) + USER_BASE)))
+#define USER_ADDR(v) ((void *)((unsigned long)(&v) + USER_BASE))
static void init_test(int i)
{
@@ -58,6 +59,29 @@ static void init_test(int i)
}
}
+static void check_smap_nowp(void)
+{
+ test = 0x99;
+
+ *get_pte(phys_to_virt(read_cr3()), USER_ADDR(test)) &= ~PTE_WRITE;
+
+ write_cr4(read_cr4() & ~X86_CR4_SMAP);
+ write_cr0(read_cr0() & ~X86_CR0_WP);
+ clac();
+ write_cr3(read_cr3());
+
+ init_test(0);
+ USER_VAR(test) = 0x99;
+ report("write from user page with SMAP=0, AC=0, WP=0, PTE.U=1 && PTE.W=0", pf_count == 0);
+
+ write_cr4(read_cr4() | X86_CR4_SMAP);
+ write_cr3(read_cr3());
+
+ init_test(0);
+ (void)USER_VAR(test);
+ report("read from user page with SMAP=1, AC=0, WP=0, PTE.U=1 && PTE.W=0", pf_count == 1 && save == 0x99);
+}
+
int main(int ac, char **av)
{
unsigned long i;
@@ -150,6 +174,8 @@ int main(int ac, char **av)
report("executing on user page with AC=0", pf_count == 0);
}
+ check_smap_nowp();
+
// TODO: implicit kernel access from ring 3 (e.g. int)
return report_summary();
--
2.1.0
^ permalink raw reply related [flat|nested] 6+ messages in thread* Re: [PATCH] check smap and !cr0.wp
2015-05-07 8:44 Xiao Guangrong
@ 2015-05-12 3:13 ` Xiao Guangrong
2015-05-12 9:19 ` Paolo Bonzini
0 siblings, 1 reply; 6+ messages in thread
From: Xiao Guangrong @ 2015-05-12 3:13 UTC (permalink / raw)
To: pbonzini; +Cc: gleb, mtosatti, kvm, linux-kernel
Hi Paolo,
Could you please apply this patch to kvm-unit-tests if it looks good to you?
Thanks!
On 05/07/2015 04:44 PM, Xiao Guangrong wrote:
> This test case is used to produce the bug that:
>
> KVM may turn a user page to a kernel page when kernel writes a readonly
> user page if CR0.WP = 1. This shadow page entry will be reused after
> SMAP is enabled so that kernel is allowed to access this user page
>
> Signed-off-by: Xiao Guangrong <guangrong.xiao@linux.intel.com>
> ---
> x86/smap.c | 26 ++++++++++++++++++++++++++
> 1 file changed, 26 insertions(+)
>
> diff --git a/x86/smap.c b/x86/smap.c
> index 042c5aa..66f97b8 100644
> --- a/x86/smap.c
> +++ b/x86/smap.c
> @@ -48,6 +48,7 @@ asm ("pf_tss:\n"
>
> #define USER_BASE (1 << 24)
> #define USER_VAR(v) (*((__typeof__(&(v))) (((unsigned long)&v) + USER_BASE)))
> +#define USER_ADDR(v) ((void *)((unsigned long)(&v) + USER_BASE))
>
> static void init_test(int i)
> {
> @@ -58,6 +59,29 @@ static void init_test(int i)
> }
> }
>
> +static void check_smap_nowp(void)
> +{
> + test = 0x99;
> +
> + *get_pte(phys_to_virt(read_cr3()), USER_ADDR(test)) &= ~PTE_WRITE;
> +
> + write_cr4(read_cr4() & ~X86_CR4_SMAP);
> + write_cr0(read_cr0() & ~X86_CR0_WP);
> + clac();
> + write_cr3(read_cr3());
> +
> + init_test(0);
> + USER_VAR(test) = 0x99;
> + report("write from user page with SMAP=0, AC=0, WP=0, PTE.U=1 && PTE.W=0", pf_count == 0);
> +
> + write_cr4(read_cr4() | X86_CR4_SMAP);
> + write_cr3(read_cr3());
> +
> + init_test(0);
> + (void)USER_VAR(test);
> + report("read from user page with SMAP=1, AC=0, WP=0, PTE.U=1 && PTE.W=0", pf_count == 1 && save == 0x99);
> +}
> +
> int main(int ac, char **av)
> {
> unsigned long i;
> @@ -150,6 +174,8 @@ int main(int ac, char **av)
> report("executing on user page with AC=0", pf_count == 0);
> }
>
> + check_smap_nowp();
> +
> // TODO: implicit kernel access from ring 3 (e.g. int)
>
> return report_summary();
>
^ permalink raw reply [flat|nested] 6+ messages in thread
end of thread, other threads:[~2015-05-12 9:19 UTC | newest]
Thread overview: 6+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2015-05-07 8:30 [PATCH] check smap and !cr0.wp Xiao Guangrong
2015-05-07 8:39 ` Xiao Guangrong
2015-05-07 8:43 ` Paolo Bonzini
-- strict thread matches above, loose matches on Subject: below --
2015-05-07 8:44 Xiao Guangrong
2015-05-12 3:13 ` Xiao Guangrong
2015-05-12 9:19 ` Paolo Bonzini
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).