Code segment descriptor can be loaded by jmp/call/ret, iret
and int. The privilege checks are different between those
instructions above realmode. Although, the emulator has
use x86_transfer_type enumerate to differentiate them, but
it is not really used in __load_segment_descriptor(). Note,
far jump/call to call gate, task gate or task state segment
are not implemented in emulator.
As for far jump/call to code segment, if DPL > CPL for conforming
code or (RPL > CPL or DPL != CPL) for non-conforming code, it
should trigger #GP. The current checks are ok.
As for far return, if RPL < CPL or DPL > RPL for conforming
code or DPL != RPL for non-conforming code, it should trigger #GP.
Outer level return is not implemented above virtual-8086 mode in
emulator. So it implies that RPL <= CPL, but the current checks
wouldn't trigger #GP if RPL < CPL.
As for code segment loading in task switch, if DPL > RPL for conforming
code or DPL != RPL for non-conforming code, it should trigger #TS. Since
segment selector is loaded before segment descriptor when load state from
tss, it implies that RPL = CPL, so the current checks are ok.
The only problem in current implementation is mssing RPL < CPL check for
far return. However, change code to follow the manual is better.
Signed-off-by: Hou Wenlong <[email protected]>
---
arch/x86/kvm/emulate.c | 30 ++++++++++++++++++++++--------
1 file changed, 22 insertions(+), 8 deletions(-)
diff --git a/arch/x86/kvm/emulate.c b/arch/x86/kvm/emulate.c
index 864db6fbe8db..b7ce2a85e58e 100644
--- a/arch/x86/kvm/emulate.c
+++ b/arch/x86/kvm/emulate.c
@@ -1631,14 +1631,28 @@ static int __load_segment_descriptor(struct x86_emulate_ctxt *ctxt,
if (!(seg_desc.type & 8))
goto exception;
- if (seg_desc.type & 4) {
- /* conforming */
- if (dpl > cpl)
- goto exception;
- } else {
- /* nonconforming */
- if (rpl > cpl || dpl != cpl)
- goto exception;
+ if (transfer == X86_TRANSFER_RET && rpl < cpl)
+ goto exception;
+ if (transfer == X86_TRANSFER_RET || X86_TRANSFER_TASK_SWITCH) {
+ if (seg_desc.type & 4) {
+ /* conforming */
+ if (dpl > rpl)
+ goto exception;
+ } else {
+ /* nonconforming */
+ if (dpl != rpl)
+ goto exception;
+ }
+ } else { /* X86_TRANSFER_CALL_JMP */
+ if (seg_desc.type & 4) {
+ /* conforming */
+ if (dpl > cpl)
+ goto exception;
+ } else {
+ /* nonconforming */
+ if (rpl > cpl || dpl != cpl)
+ goto exception;
+ }
}
/* in long-mode d/b must be clear if l is set */
if (seg_desc.d && seg_desc.l) {
--
2.31.1
On Thu, Jan 20, 2022, Hou Wenlong wrote:
> Code segment descriptor can be loaded by jmp/call/ret, iret
> and int. The privilege checks are different between those
> instructions above realmode. Although, the emulator has
> use x86_transfer_type enumerate to differentiate them, but
> it is not really used in __load_segment_descriptor(). Note,
> far jump/call to call gate, task gate or task state segment
> are not implemented in emulator.
>
> As for far jump/call to code segment, if DPL > CPL for conforming
> code or (RPL > CPL or DPL != CPL) for non-conforming code, it
> should trigger #GP. The current checks are ok.
>
> As for far return, if RPL < CPL or DPL > RPL for conforming
> code or DPL != RPL for non-conforming code, it should trigger #GP.
> Outer level return is not implemented above virtual-8086 mode in
> emulator. So it implies that RPL <= CPL, but the current checks
> wouldn't trigger #GP if RPL < CPL.
>
> As for code segment loading in task switch, if DPL > RPL for conforming
> code or DPL != RPL for non-conforming code, it should trigger #TS. Since
> segment selector is loaded before segment descriptor when load state from
> tss, it implies that RPL = CPL, so the current checks are ok.
>
> The only problem in current implementation is mssing RPL < CPL check for
> far return. However, change code to follow the manual is better.
>
> Signed-off-by: Hou Wenlong <[email protected]>
> ---
Reviewed-by: Sean Christopherson <[email protected]>
> arch/x86/kvm/emulate.c | 30 ++++++++++++++++++++++--------
> 1 file changed, 22 insertions(+), 8 deletions(-)
>
> diff --git a/arch/x86/kvm/emulate.c b/arch/x86/kvm/emulate.c
> index 864db6fbe8db..b7ce2a85e58e 100644
> --- a/arch/x86/kvm/emulate.c
> +++ b/arch/x86/kvm/emulate.c
> @@ -1631,14 +1631,28 @@ static int __load_segment_descriptor(struct x86_emulate_ctxt *ctxt,
> if (!(seg_desc.type & 8))
> goto exception;
>
> - if (seg_desc.type & 4) {
> - /* conforming */
> - if (dpl > cpl)
> - goto exception;
> - } else {
> - /* nonconforming */
> - if (rpl > cpl || dpl != cpl)
> - goto exception;
A comment here would be mildly helpful, e.g.
/* RET can never return to an inner privilege level. */
> + if (transfer == X86_TRANSFER_RET && rpl < cpl)
> + goto exception;
And then as a follow-up patch, I think we can/should move the unhandled outer
privilege level logic here to make it easier to understand why the checks for RET
are incomplete, e.g.
diff --git a/arch/x86/kvm/emulate.c b/arch/x86/kvm/emulate.c
index a885b53dc7cc..a7cecd7beb91 100644
--- a/arch/x86/kvm/emulate.c
+++ b/arch/x86/kvm/emulate.c
@@ -1631,8 +1631,15 @@ static int __load_segment_descriptor(struct x86_emulate_ctxt *ctxt,
if (!(seg_desc.type & 8))
goto exception;
- if (transfer == X86_TRANSFER_RET && rpl < cpl)
- goto exception;
+ if (transfer == X86_TRANSFER_RET) {
+ /* RET can never return to an inner privilege level. */
+ if (rpl < cpl)
+ goto exception;
+ /* Outer-privilege level return is not implemented */
+ if (rpl > cpl)
+ return X86EMUL_UNHANDLEABLE;
+ }
+
if (transfer == X86_TRANSFER_RET || X86_TRANSFER_TASK_SWITCH) {
if (seg_desc.type & 4) {
/* conforming */
@@ -2227,9 +2234,6 @@ static int em_ret_far(struct x86_emulate_ctxt *ctxt)
rc = emulate_pop(ctxt, &cs, ctxt->op_bytes);
if (rc != X86EMUL_CONTINUE)
return rc;
- /* Outer-privilege level return is not implemented */
- if (ctxt->mode >= X86EMUL_MODE_PROT16 && (cs & 3) > cpl)
- return X86EMUL_UNHANDLEABLE;
rc = __load_segment_descriptor(ctxt, (u16)cs, VCPU_SREG_CS, cpl,
X86_TRANSFER_RET,
&new_desc);