Changes in v2: * Move pku.flat from config-x86-common.mak to config-x86_64.mak. The protection-key feature provides an additional mechanism by which IA-32e paging controls access to usermode addresses. The specification of Protection Keys can be found at SDM (4.6.2, volume 3) http://www.intel.com/content/dam/www/public/us/en/documents/manuals/64-ia-32-architectures-software-developer-manual-325462.pdf. Signed-off-by: Huaitong Han <huaitong.han@xxxxxxxxx> diff --git a/config/config-x86-common.mak b/config/config-x86-common.mak index c2f9908..a72055c 100644 --- a/config/config-x86-common.mak +++ b/config/config-x86-common.mak @@ -104,6 +104,8 @@ $(TEST_DIR)/pcid.elf: $(cstart.o) $(TEST_DIR)/pcid.o $(TEST_DIR)/smap.elf: $(cstart.o) $(TEST_DIR)/smap.o +$(TEST_DIR)/pku.elf: $(cstart.o) $(TEST_DIR)/pku.o + $(TEST_DIR)/vmx.elf: $(cstart.o) $(TEST_DIR)/vmx.o $(TEST_DIR)/vmx_tests.o $(TEST_DIR)/debug.elf: $(cstart.o) $(TEST_DIR)/debug.o diff --git a/config/config-x86_64.mak b/config/config-x86_64.mak index 7d4eb34..fcf4486 100644 --- a/config/config-x86_64.mak +++ b/config/config-x86_64.mak @@ -11,5 +11,6 @@ tests = $(TEST_DIR)/access.flat $(TEST_DIR)/apic.flat \ tests += $(TEST_DIR)/svm.flat tests += $(TEST_DIR)/vmx.flat tests += $(TEST_DIR)/tscdeadline_latency.flat +tests += $(TEST_DIR)/pku.flat include config/config-x86-common.mak diff --git a/lib/x86/processor.h b/lib/x86/processor.h index f6eb187..1816807 100644 --- a/lib/x86/processor.h +++ b/lib/x86/processor.h @@ -28,6 +28,7 @@ #define X86_CR4_PAE 0x00000020 #define X86_CR4_PCIDE 0x00020000 #define X86_CR4_SMAP 0x00200000 +#define X86_CR4_PKE 0x00400000 #define X86_EFLAGS_CF 0x00000001 #define X86_EFLAGS_ZF 0x00000040 diff --git a/x86/pku.c b/x86/pku.c new file mode 100644 index 0000000..4def60d --- /dev/null +++ b/x86/pku.c @@ -0,0 +1,162 @@ +#include "libcflat.h" +#include "x86/desc.h" +#include "x86/processor.h" +#include "x86/vm.h" +#include "x86/msr.h" + +#define X86_FEATURE_PKU 3 +#define CR0_WP_MASK (1UL << 16) +#define PTE_PKEY_BIT 59 +#define USER_BASE (1 << 24) +#define USER_VAR(v) (*((__typeof__(&(v))) (((unsigned long)&v) + USER_BASE))) + +volatile int pf_count = 0; +volatile unsigned save; +volatile unsigned test; + +void set_cr0_wp(int wp) +{ + unsigned long cr0 = read_cr0(); + + cr0 &= ~CR0_WP_MASK; + if (wp) + cr0 |= CR0_WP_MASK; + write_cr0(cr0); +} + +static inline u32 read_pkru(void) +{ + unsigned int eax, edx; + unsigned int ecx = 0; + unsigned int pkru; + + asm volatile(".byte 0x0f,0x01,0xee\n\t" + : "=a" (eax), "=d" (edx) + : "c" (ecx)); + pkru = eax; + return pkru; +} + +static void write_pkru(u32 pkru) +{ + unsigned int eax = pkru; + unsigned int ecx = 0; + unsigned int edx = 0; + + asm volatile(".byte 0x0f,0x01,0xef\n\t" + : : "a" (eax), "c" (ecx), "d" (edx)); +} + +void do_pf_tss(unsigned long error_code) +{ + pf_count++; + save = test; + write_pkru(0); +} + +extern void pf_tss(void); + +asm ("pf_tss: \n\t" +#ifdef __x86_64__ + // no task on x86_64, save/restore caller-save regs + "push %rax; push %rcx; push %rdx; push %rsi; push %rdi\n" + "push %r8; push %r9; push %r10; push %r11\n" +#endif + "call do_pf_tss \n\t" +#ifdef __x86_64__ + "pop %r11; pop %r10; pop %r9; pop %r8\n" + "pop %rdi; pop %rsi; pop %rdx; pop %rcx; pop %rax\n" +#endif + "add $"S", %"R "sp\n\t" // discard error code + "iret"W" \n\t" + "jmp pf_tss\n\t" + ); + +static void init_test() +{ + pf_count = 0; + + invlpg(&test); + invlpg(&USER_VAR(test)); + write_pkru(0); + set_cr0_wp(0); +} + +int main(int ac, char **av) +{ + unsigned long i; + unsigned int pkey = 0x2; + unsigned int pkru_ad = 0x10; + unsigned int pkru_wd = 0x20; + + if (!(cpuid_indexed(7, 0).c & (1 << X86_FEATURE_PKU))) { + printf("PKU not enabled, exiting\n"); + exit(1); + } + + setup_vm(); + setup_alt_stack(); + set_intr_alt_stack(14, pf_tss); + wrmsr(MSR_EFER, rdmsr(MSR_EFER) | EFER_LMA); + + for (i = 0; i < USER_BASE; i += PAGE_SIZE) { + *get_pte(phys_to_virt(read_cr3()), phys_to_virt(i)) &= ~PTE_USER; + *get_pte(phys_to_virt(read_cr3()), phys_to_virt(i)) |= ((unsigned long)pkey << PTE_PKEY_BIT); + invlpg((void *)i); + } + + for (i = USER_BASE; i < 2 * USER_BASE; i += PAGE_SIZE) { + *get_pte(phys_to_virt(read_cr3()), phys_to_virt(i)) &= ~USER_BASE; + *get_pte(phys_to_virt(read_cr3()), phys_to_virt(i)) |= ((unsigned long)pkey << PTE_PKEY_BIT); + invlpg((void *)i); + } + + write_cr4(read_cr4() | X86_CR4_PKE); + write_cr3(read_cr3()); + + init_test(); + set_cr0_wp(1); + write_pkru(pkru_ad); + test = 21; + report("write to supervisor page when pkru is ad and wp == 1", pf_count == 0 && test == 21); + + init_test(); + set_cr0_wp(0); + write_pkru(pkru_ad); + test = 22; + report("write to supervisor page when pkru is ad and wp == 0", pf_count == 0 && test == 22); + + init_test(); + set_cr0_wp(1); + write_pkru(pkru_wd); + test = 23; + report("write to supervisor page when pkru is wd and wp == 1", pf_count == 0 && test == 23); + + init_test(); + set_cr0_wp(0); + write_pkru(pkru_wd); + test = 24; + report("write to supervisor page when pkru is wd and wp == 0", pf_count == 0 && test == 24); + + init_test(); + write_pkru(pkru_wd); + set_cr0_wp(0); + USER_VAR(test) = 25; + report("write to user page when pkru is wd and wp == 0", pf_count == 0 && test == 25); + + init_test(); + write_pkru(pkru_wd); + set_cr0_wp(1); + USER_VAR(test) = 26; + report("write to user page when pkru is wd and wp == 1", pf_count == 1 && test == 26 && save == 25); + + init_test(); + write_pkru(pkru_ad); + (void)USER_VAR(test); + report("read from user page when pkru is ad", pf_count == 1 && save == 26); + + // TODO: implicit kernel access from ring 3 (e.g. int) + + return report_summary(); +} + diff --git a/x86/unittests.cfg b/x86/unittests.cfg index 8bb0e6a..2e89a6a 100644 --- a/x86/unittests.cfg +++ b/x86/unittests.cfg @@ -76,6 +76,11 @@ arch = x86_64 file = smap.flat extra_params = -cpu host +[pku] +file = pku.flat +arch = x86_64 +extra_params = -cpu host + #[asyncpf] #file = asyncpf.flat -- 2.4.3 -- To unsubscribe from this list: send the line "unsubscribe kvm" in the body of a message to majordomo@xxxxxxxxxxxxxxx More majordomo info at http://vger.kernel.org/majordomo-info.html
