KVM: x86/emulator: Fix wrong privilege check for code segment in __load_segment_descr...

Code segment descriptor can be loaded by jmp/call/ret, iret
and int. The privilege checks are different between those
instructions above realmode. Although, the emulator has
use x86_transfer_type enumerate to differentiate them, but
it is not really used in __load_segment_descriptor(). Note,
far jump/call to call gate, task gate or task state segment
are not implemented in emulator.

As for far jump/call to code segment, if DPL > CPL for conforming
code or (RPL > CPL or DPL != CPL) for non-conforming code, it
should trigger #GP. The current checks are ok.

As for far return, if RPL < CPL or DPL > RPL for conforming
code or DPL != RPL for non-conforming code, it should trigger #GP.
Outer level return is not implemented above virtual-8086 mode in
emulator. So it implies that RPL <= CPL, but the current checks
wouldn't trigger #GP if RPL < CPL.

As for code segment loading in task switch, if DPL > RPL for conforming
code or DPL != RPL for non-conforming code, it should trigger #TS. Since
segment selector is loaded before segment descriptor when load state from
tss, it implies that RPL = CPL, so the current checks are ok.

The only problem in current implementation is missing RPL < CPL check for
far return. However, change code to follow the manual is better.

Reviewed-by: Sean Christopherson <seanjc@google.com>
Signed-off-by: Hou Wenlong <houwenlong.hwl@antgroup.com>
Message-Id: <e01f5ea70fc1f18f23da1182acdbc5c97c0e5886.1644292363.git.houwenlong.hwl@antgroup.com>
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>

diff --git a/arch/x86/kvm/emulate.c b/arch/x86/kvm/emulate.c
index a6c54b8fdbc7b0f8e51841e07333d43bd9469988..35e69c2adec26078c8802250ebda07b34b7e4685 100644 (file)
--- a/arch/x86/kvm/emulate.c
+++ b/arch/x86/kvm/emulate.c
@@ -1623,14 +1623,29 @@ static int __load_segment_descriptor(struct x86_emulate_ctxt *ctxt,
                if (!(seg_desc.type & 8))
                        goto exception;
 
-               if (seg_desc.type & 4) {
-                       /* conforming */
-                       if (dpl > cpl)
-                               goto exception;
-               } else {
-                       /* nonconforming */
-                       if (rpl > cpl || dpl != cpl)
-                               goto exception;
+               /* RET can never return to an inner privilege level. */
+               if (transfer == X86_TRANSFER_RET && rpl < cpl)
+                       goto exception;
+               if (transfer == X86_TRANSFER_RET || transfer == X86_TRANSFER_TASK_SWITCH) {
+                       if (seg_desc.type & 4) {
+                               /* conforming */
+                               if (dpl > rpl)
+                                       goto exception;
+                       } else {
+                               /* nonconforming */
+                               if (dpl != rpl)
+                                       goto exception;
+                       }
+               } else { /* X86_TRANSFER_CALL_JMP */
+                       if (seg_desc.type & 4) {
+                               /* conforming */
+                               if (dpl > cpl)
+                                       goto exception;
+                       } else {
+                               /* nonconforming */
+                               if (rpl > cpl || dpl != cpl)
+                                       goto exception;
+                       }
                }
                /* in long-mode d/b must be clear if l is set */
                if (seg_desc.d && seg_desc.l) {