diff mbox

check smap and !cr0.wp

Message ID 1430987456-6790-1-git-send-email-guangrong.xiao@linux.intel.com (mailing list archive)
State New, archived
Headers show

Commit Message

Xiao Guangrong May 7, 2015, 8:30 a.m. UTC 
From: root <root@lyu2-mobl2.ccr.corp.intel.com>

This test case is used to produce the bug that:

KVM may turn a user page to a kernel page when kernel writes a readonly
user page if CR0.WP = 1. This shadow page entry will be reused after
SMAP is enabled so that kernel is allowed to access this user page

Signed-off-by: Xiao Guangrong <guangrong.xiao@linux.intel.com>
---
 x86/smap.c | 26 ++++++++++++++++++++++++++
 1 file changed, 26 insertions(+)

Comments

Xiao Guangrong May 7, 2015, 8:39 a.m. UTC | #1 
On 05/07/2015 04:30 PM, Xiao Guangrong wrote:
> From: root <root@lyu2-mobl2.ccr.corp.intel.com>

Sorry for the noise... I miss configured this git repo. Please ignore
this patch, i will repost it.
--
To unsubscribe from this list: send the line "unsubscribe kvm" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Paolo Bonzini May 7, 2015, 8:43 a.m. UTC | #2 
On 07/05/2015 10:39, Xiao Guangrong wrote:
> 
> 
> On 05/07/2015 04:30 PM, Xiao Guangrong wrote:
>> From: root <root@lyu2-mobl2.ccr.corp.intel.com>
> 
> Sorry for the noise... I miss configured this git repo. Please ignore
> this patch, i will repost it.

No problem, can be fixed.

Paolo
--
To unsubscribe from this list: send the line "unsubscribe kvm" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
diff mbox

Patch

diff --git a/x86/smap.c b/x86/smap.c
index 042c5aa..66f97b8 100644
--- a/x86/smap.c
+++ b/x86/smap.c
@@ -48,6 +48,7 @@  asm ("pf_tss:\n"
 
 #define USER_BASE	(1 << 24)
 #define USER_VAR(v)	(*((__typeof__(&(v))) (((unsigned long)&v) + USER_BASE)))
+#define USER_ADDR(v)   ((void *)((unsigned long)(&v) + USER_BASE))
 
 static void init_test(int i)
 {
@@ -58,6 +59,29 @@  static void init_test(int i)
 	}
 }
 
+static void check_smap_nowp(void)
+{
+	test = 0x99;
+
+	*get_pte(phys_to_virt(read_cr3()), USER_ADDR(test)) &= ~PTE_WRITE;
+
+	write_cr4(read_cr4() & ~X86_CR4_SMAP);
+	write_cr0(read_cr0() & ~X86_CR0_WP);
+	clac();
+	write_cr3(read_cr3());
+
+	init_test(0);
+	USER_VAR(test) = 0x99;
+	report("write from user page with SMAP=0, AC=0, WP=0, PTE.U=1 && PTE.W=0", pf_count == 0);
+
+	write_cr4(read_cr4() | X86_CR4_SMAP);
+	write_cr3(read_cr3());
+
+	init_test(0);
+	(void)USER_VAR(test);
+	report("read from user page with SMAP=1, AC=0, WP=0, PTE.U=1 && PTE.W=0", pf_count == 1 && save == 0x99);
+}
+
 int main(int ac, char **av)
 {
 	unsigned long i;
@@ -150,6 +174,8 @@  int main(int ac, char **av)
 		report("executing on user page with AC=0", pf_count == 0);
 	}
 
+	check_smap_nowp();
+
 	// TODO: implicit kernel access from ring 3 (e.g. int)
 
 	return report_summary();