Received-SPF: pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) client-ip=2620:137:e000::1:20;
Date:   Mon, 7 Feb 2022 19:51:05 +0000
From:   Sean Christopherson <seanjc@google.com>
To:     Hou Wenlong <houwenlong.hwl@antgroup.com>
Cc:     kvm@vger.kernel.org, Paolo Bonzini <pbonzini@redhat.com>,
        Vitaly Kuznetsov <vkuznets@redhat.com>,
        Wanpeng Li <wanpengli@tencent.com>,
        Jim Mattson <jmattson@google.com>,
        Joerg Roedel <joro@8bytes.org>,
        Thomas Gleixner <tglx@linutronix.de>,
        Ingo Molnar <mingo@redhat.com>, Borislav Petkov <bp@alien8.de>,
        Dave Hansen <dave.hansen@linux.intel.com>, x86@kernel.org,
        "H. Peter Anvin" <hpa@zytor.com>, linux-kernel@vger.kernel.org
Subject: Re: [PATCH 2/2] KVM: x86: Fix wrong privilege check for code segment
 in __load_segment_descriptor()
Message-ID: <YgF4KX90nxxyaDcN@google.com>
References: <cover.1642669684.git.houwenlong.hwl@antgroup.com>
 <ed8917d7bab80a1c1a130beae45c7d6ecdef47fc.1642669684.git.houwenlong.hwl@antgroup.com>
MIME-Version: 1.0
Content-Type: text/plain; charset=us-ascii
Content-Disposition: inline
In-Reply-To: <ed8917d7bab80a1c1a130beae45c7d6ecdef47fc.1642669684.git.houwenlong.hwl@antgroup.com>
Precedence: bulk

On Thu, Jan 20, 2022, Hou Wenlong wrote:
> Code segment descriptor can be loaded by jmp/call/ret, iret
> and int. The privilege checks are different between those
> instructions above realmode. Although, the emulator has
> use x86_transfer_type enumerate to differentiate them, but
> it is not really used in __load_segment_descriptor(). Note,
> far jump/call to call gate, task gate or task state segment
> are not implemented in emulator.
> 
> As for far jump/call to code segment, if DPL > CPL for conforming
> code or (RPL > CPL or DPL != CPL) for non-conforming code, it
> should trigger #GP. The current checks are ok.
> 
> As for far return, if RPL < CPL or DPL > RPL for conforming
> code or DPL != RPL for non-conforming code, it should trigger #GP.
> Outer level return is not implemented above virtual-8086 mode in
> emulator. So it implies that RPL <= CPL, but the current checks
> wouldn't trigger #GP if RPL < CPL.
> 
> As for code segment loading in task switch, if DPL > RPL for conforming
> code or DPL != RPL for non-conforming code, it should trigger #TS. Since
> segment selector is loaded before segment descriptor when load state from
> tss, it implies that RPL = CPL, so the current checks are ok.
> 
> The only problem in current implementation is mssing RPL < CPL check for
> far return. However, change code to follow the manual is better.
> 
> Signed-off-by: Hou Wenlong <houwenlong.hwl@antgroup.com>
> ---

Reviewed-by: Sean Christopherson <seanjc@google.com>

>  arch/x86/kvm/emulate.c | 30 ++++++++++++++++++++++--------
>  1 file changed, 22 insertions(+), 8 deletions(-)
> 
> diff --git a/arch/x86/kvm/emulate.c b/arch/x86/kvm/emulate.c
> index 864db6fbe8db..b7ce2a85e58e 100644
> --- a/arch/x86/kvm/emulate.c
> +++ b/arch/x86/kvm/emulate.c
> @@ -1631,14 +1631,28 @@ static int __load_segment_descriptor(struct x86_emulate_ctxt *ctxt,
>  		if (!(seg_desc.type & 8))
>  			goto exception;
>  
> -		if (seg_desc.type & 4) {
> -			/* conforming */
> -			if (dpl > cpl)
> -				goto exception;
> -		} else {
> -			/* nonconforming */
> -			if (rpl > cpl || dpl != cpl)
> -				goto exception;

A comment here would be mildly helpful, e.g.

		/* RET can never return to an inner privilege level. */
> +		if (transfer == X86_TRANSFER_RET && rpl < cpl)
> +			goto exception;

And then as a follow-up patch, I think we can/should move the unhandled outer
privilege level logic here to make it easier to understand why the checks for RET
are incomplete, e.g.

diff --git a/arch/x86/kvm/emulate.c b/arch/x86/kvm/emulate.c
index a885b53dc7cc..a7cecd7beb91 100644
--- a/arch/x86/kvm/emulate.c
+++ b/arch/x86/kvm/emulate.c
@@ -1631,8 +1631,15 @@ static int __load_segment_descriptor(struct x86_emulate_ctxt *ctxt,
                if (!(seg_desc.type & 8))
                        goto exception;

-               if (transfer == X86_TRANSFER_RET && rpl < cpl)
-                       goto exception;
+               if (transfer == X86_TRANSFER_RET) {
+                       /* RET can never return to an inner privilege level. */
+                       if (rpl < cpl)
+                               goto exception;
+                       /* Outer-privilege level return is not implemented */
+                       if (rpl > cpl)
+                               return X86EMUL_UNHANDLEABLE;
+               }
+
                if (transfer == X86_TRANSFER_RET || X86_TRANSFER_TASK_SWITCH) {
                        if (seg_desc.type & 4) {
                                /* conforming */
@@ -2227,9 +2234,6 @@ static int em_ret_far(struct x86_emulate_ctxt *ctxt)
        rc = emulate_pop(ctxt, &cs, ctxt->op_bytes);
        if (rc != X86EMUL_CONTINUE)
                return rc;
-       /* Outer-privilege level return is not implemented */
-       if (ctxt->mode >= X86EMUL_MODE_PROT16 && (cs & 3) > cpl)
-               return X86EMUL_UNHANDLEABLE;
        rc = __load_segment_descriptor(ctxt, (u16)cs, VCPU_SREG_CS, cpl,
                                       X86_TRANSFER_RET,
                                       &new_desc);