main.c

Go to the documentation of this file.

 
#include <xtf.h>
 
const char test_title[] = "XSA-191 PoC";
 
bool test_needs_fep = true;
 
void test_main(void)
{
    unsigned long tmp;
    exinfo_t fault;
 
    printk("Testing read through NULL segment:\n");
    write_fs(0);
    asm volatile (_ASM_XEN_FEP
                  "1: mov %%fs:0, %[dst]; 2:"
                  _ASM_EXTABLE_HANDLER(1b, 2b, %P[rec])
                  : "=D" (fault),
                    [dst] "=r" (tmp)
                  : "D" (0),
                    [rec] "p" (ex_record_fault_edi));
 
    switch ( fault )
    {
    case 0:
        xtf_failure("  Fail: Access via NULL segment didn't fault\n");
        break;
 
    case EXINFO_SYM(GP, 0):
        printk("  Success: Got #GP fault\n");
        break;
 
    default:
        xtf_error("  Error: Unexpected fault %#x, %pe\n", fault, _p(fault));
        break;
    }
 
    printk("Testing stale LDT:\n");
 
    user_desc ldt[1] = { gdt[__KERN_DS >> 3] };
 
    pack_ldt_desc(&gdt[GDTE_AVAIL0], ldt, sizeof(ldt) - 1);
 
    lldt(GDTE_AVAIL0 << 3);
    lldt(0);
 
    asm volatile (_ASM_XEN_FEP
                  "1: mov %[sel], %%fs; 2:"
                  _ASM_EXTABLE_HANDLER(1b, 2b, %P[rec])
                  : "=a" (fault)
                  : "a" (0),
                    [sel] "r" (4),
                    [rec] "p" (ex_record_fault_eax));
 
    switch ( fault )
    {
    case 0:
        xtf_failure("  Fail: Loaded selector from stale LDT\n");
        break;
 
    case EXINFO_SYM(GP, SEL_EC_SYM(0, LDT)):
        printk("  Success: Got #GP fault\n");
        break;
 
    default:
        xtf_error("  Error: Unexpected fault %#x, %pe\n", fault, _p(fault));
        break;
    }
 
    xtf_success(NULL);
}
 
/*
 * Local variables:
 * mode: C
 * c-file-style: "BSD"
 * c-basic-offset: 4
 * tab-width: 4
 * indent-tabs-mode: nil
 * End:
 */