mbox series

[kvm-unit-tests,v3,0/4] Tests for CR0.WP=0/1 r/o write access

Message ID 20230403105618.41118-1-minipli@grsecurity.net (mailing list archive)
Headers show
Series Tests for CR0.WP=0/1 r/o write access | expand

Message

Mathias Krause April 3, 2023, 10:56 a.m. UTC 
v2: https://lore.kernel.org/kvm/20230331135709.132713-1-minipli@grsecurity.net/

This series adds explicit tests that verify a page fault will occur for
attempts to write to an r/o page while CR0.WP is 1 as well as access is
granted when CR0.WP is 0.

There are existing tests already, e.g. in pks.c, pku.c, smap.c or even
access.c that implicitly test this. However, they all either explicitly
(via INVLPG) or implicitly (via CR3 reload) flush the TLB before doing
the access which might lead to false positives if the access succeeded
before, e.g. because CR0.WP was 0 before.

Better to have an explicit test, especially to back up the changes of
[1] which were missing the emulator case, initially.

Changes from v2 to v3 integrate Sean's feedback, especially the
changelogs were rewritten to avoid pronouns and the guts of the CR0.WP
toggling test were moved to a helper function.

Please apply!

Thanks,
Mathias

[1] https://lore.kernel.org/kvm/20230322013731.102955-1-minipli@grsecurity.net/

Mathias Krause (4):
  x86: Use existing CR0.WP / CR4.SMEP bit definitions
  x86/access: CR0.WP toggling write to r/o data test
  x86/access: Forced emulation support
  x86/access: Try emulation for CR0.WP test as well

 x86/access.c | 114 ++++++++++++++++++++++++++++++++++++++++++++-------
 x86/pks.c    |   5 +--
 x86/pku.c    |   5 +--
 3 files changed, 104 insertions(+), 20 deletions(-)