Commit 31c66dab authored Feb 08, 2022 by Hou Wenlong Committed by Paolo Bonzini Mar 01, 2022

KVM: x86/emulator: Fix wrong privilege check for code segment in __load_segment_descriptor()



Code segment descriptor can be loaded by jmp/call/ret, iret
and int. The privilege checks are different between those
instructions above realmode. Although, the emulator has
use x86_transfer_type enumerate to differentiate them, but
it is not really used in __load_segment_descriptor(). Note,
far jump/call to call gate, task gate or task state segment
are not implemented in emulator.

As for far jump/call to code segment, if DPL > CPL for conforming
code or (RPL > CPL or DPL != CPL) for non-conforming code, it
should trigger #GP. The current checks are ok.

As for far return, if RPL < CPL or DPL > RPL for conforming
code or DPL != RPL for non-conforming code, it should trigger #GP.
Outer level return is not implemented above virtual-8086 mode in
emulator. So it implies that RPL <= CPL, but the current checks
wouldn't trigger #GP if RPL < CPL.

As for code segment loading in task switch, if DPL > RPL for conforming
code or DPL != RPL for non-conforming code, it should trigger #TS. Since
segment selector is loaded before segment descriptor when load state from
tss, it implies that RPL = CPL, so the current checks are ok.

The only problem in current implementation is missing RPL < CPL check for
far return. However, change code to follow the manual is better.

Reviewed-by: Sean Christopherson <seanjc@google.com>
Signed-off-by: Hou Wenlong <houwenlong.hwl@antgroup.com>
Message-Id: <e01f5ea70fc1f18f23da1182acdbc5c97c0e5886.1644292363.git.houwenlong.hwl@antgroup.com>
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>

parent ca85f002

arch/x86/kvm/emulate.c

+23 −8

Original line number	Diff line number	Diff line
		@@ -1623,6 +1623,20 @@ static int __load_segment_descriptor(struct x86_emulate_ctxt *ctxt,
		if (!(seg_desc.type & 8))
		goto exception;

		/* RET can never return to an inner privilege level. */
		if (transfer == X86_TRANSFER_RET && rpl < cpl)
		goto exception;
		if (transfer == X86_TRANSFER_RET \|\| transfer == X86_TRANSFER_TASK_SWITCH) {
		if (seg_desc.type & 4) {
		/* conforming */
		if (dpl > rpl)
		goto exception;
		} else {
		/* nonconforming */
		if (dpl != rpl)
		goto exception;
		}
		} else { /* X86_TRANSFER_CALL_JMP */
		if (seg_desc.type & 4) {
		/* conforming */
		if (dpl > cpl)
		@@ -1632,6 +1646,7 @@ static int __load_segment_descriptor(struct x86_emulate_ctxt *ctxt,
		if (rpl > cpl \|\| dpl != cpl)
		goto exception;
		}
		}
		/* in long-mode d/b must be clear if l is set */
		if (seg_desc.d && seg_desc.l) {
		u64 efer = 0;