On 01/27/2012 09:23 PM, Kevin Wolf wrote:
> Currently, all task switches check privileges against the DPL of the
> TSS. This is only correct for jmp/call to a TSS. If a task gate is used,
> the DPL of this take gate is used for the check instead. Exceptions,
> external interrupts and iret shouldn't perform any check.
>
>
> @@ -2372,12 +2389,32 @@ static int emulator_do_task_switch(struct x86_emulate_ctxt *ctxt,
>
> /* FIXME: check that next_tss_desc is tss */
>
> - if (reason != TASK_SWITCH_IRET) {
> - if ((tss_selector & 3) > next_tss_desc.dpl ||
> - ops->cpl(ctxt) > next_tss_desc.dpl)
> - return emulate_gp(ctxt, 0);
> + /*
> + * Check privileges. The three cases are task switch caused by...
> + *
> + * 1. Software interrupt: Check against DPL of the task gate
> + * 2. Exception/IRQ/iret: No check is performed
> + * 3. jmp/call: Check agains DPL of the TSS
> + */
> + dpl = -1;
> + if (reason == TASK_SWITCH_GATE) {
> + if (idt_index != -1) {
> + struct kvm_desc_struct task_gate_desc;
> +
> + ret = read_interrupt_descriptor(ctxt, idt_index,
> + &task_gate_desc);
> + if (ret != X86EMUL_CONTINUE)
> + return ret;
> +
> + dpl = task_gate_desc.dpl;
> + }
> + } else if (reason != TASK_SWITCH_IRET) {
> + dpl = next_tss_desc.dpl;
> }
>
> + if (dpl != -1 && ((tss_selector & 3) > dpl || ops->cpl(ctxt) > dpl))
> + return emulate_gp(ctxt, 0);
Should be #GP(selector), no?
The TASK-GATE: branch of the CALL instruction documentation lists many
other conditions which we don't check, so I'll accept this, otherwise
we'll never make any progress.
--
error compiling committee.c: too many arguments to function
--
To unsubscribe from this list: send the line "unsubscribe kvm" in
the body of a message to majordomo@xxxxxxxxxxxxxxx
More majordomo info at http://vger.kernel.org/majordomo-info.html
