XSA-333 PoC

Signed-off-by: Andrew Cooper <andrew.cooper3@citrix.com>

diff --git a/arch/x86/include/arch/msr-index.h b/arch/x86/include/arch/msr-index.h
index 6a70bcfdb26355ee16f58601c3ffd7ba0f542417..4b7f8e516b94a7bb138e83b5fa37dd1855ae4a22 100644 (file)
--- a/arch/x86/include/arch/msr-index.h
+++ b/arch/x86/include/arch/msr-index.h
@@ -25,6 +25,8 @@
 
 #define MSR_PERFEVTSEL(n)              (0x00000186 + (n))
 
+#define MSR_MISC_ENABLE                 0x000001a0
+
 #define MSR_DEBUGCTL                    0x000001d9
 #define DEBUGCTL_LBR                    (_AC(1, ULL) <<  0) /* Last Branch Record */
 #define DEBUGCTL_TR                     (_AC(1, ULL) <<  6) /* Trace Message Enable */

diff --git a/docs/all-tests.dox b/docs/all-tests.dox
index be5e9945edd461acd91f70180b858c061502a8f1..dafd77333b14e0e810653207e2ff8dc97e9cae3d 100644 (file)
--- a/docs/all-tests.dox
+++ b/docs/all-tests.dox
@@ -154,6 +154,8 @@ states.
 
 @subpage test-xsa-317 - Incorrect error handling in event channel port allocation.
 
+@subpage test-xsa-333 - x86 pv: Crash when handling guest access to MSR_MISC_ENABLE.
+
 @subpage test-xsa-339 - x86 pv guest kernel DoS via SYSENTER.
 
 

diff --git a/tests/xsa-333/Makefile b/tests/xsa-333/Makefile
new file mode 100644 (file)
index 0000000..3944207
--- /dev/null
+++ b/tests/xsa-333/Makefile
@@ -0,0 +1,9 @@
+include $(ROOT)/build/common.mk
+
+NAME      := xsa-333
+CATEGORY  := xsa
+TEST-ENVS := pv64
+
+obj-perenv += main.o
+
+include $(ROOT)/build/gen.mk

diff --git a/tests/xsa-333/main.c b/tests/xsa-333/main.c
new file mode 100644 (file)
index 0000000..ac1d74e
--- /dev/null
+++ b/tests/xsa-333/main.c
@@ -0,0 +1,43 @@
+/**
+ * @file tests/xsa-333/main.c
+ * @ref test-xsa-333
+ *
+ * @page test-xsa-333 XSA-333
+ *
+ * Advisory: [XSA-333](https://xenbits.xen.org/xsa/advisory-333.html)
+ *
+ * Xen, after
+ * [4fdc932b3cc](https://xenbits.xen.org/gitweb/?p=xen.git;a=commitdiff;h=4fdc932b3cced15d6e73c94ae0192d989fefdc90)
+ * (Introduced in Xen 4.11) had no WRMSR-safety for guest accesses to
+ * MSR_MISC_ENABLE.  This MSR doesn't exist on AMD hardware, and Xen would
+ * crash on access.
+ *
+ * @see tests/xsa-333/main.c
+ */
+#include <xtf.h>
+
+const char test_title[] = "XSA-333 PoC";
+
+void test_main(void)
+{
+    unsigned long val;
+
+    rdmsr_safe(MSR_MISC_ENABLE, &val);
+
+    /*
+     * If Xen is still alive at this point, it didn't take a #GP fault
+     * handling the MSR emulation.
+     */
+
+    xtf_success("Success: Not vulnerable to XSA-333\n");
+}
+
+/*
+ * Local variables:
+ * mode: C
+ * c-file-style: "BSD"
+ * c-basic-offset: 4
+ * tab-width: 4
+ * indent-tabs-mode: nil
+ * End:
+ */