Am 30.01.2012 11:39, schrieb Avi Kivity:
> On 01/27/2012 09:23 PM, Kevin Wolf wrote:
>> Currently, all task switches check privileges against the DPL of the
>> TSS. This is only correct for jmp/call to a TSS. If a task gate is used,
>> the DPL of this take gate is used for the check instead. Exceptions,
>> external interrupts and iret shouldn't perform any check.
>>
>>
>> @@ -2372,12 +2389,32 @@ static int emulator_do_task_switch(struct x86_emulate_ctxt *ctxt,
>>
>> /* FIXME: check that next_tss_desc is tss */
>>
>> - if (reason != TASK_SWITCH_IRET) {
>> - if ((tss_selector & 3) > next_tss_desc.dpl ||
>> - ops->cpl(ctxt) > next_tss_desc.dpl)
>> - return emulate_gp(ctxt, 0);
>> + /*
>> + * Check privileges. The three cases are task switch caused by...
>> + *
>> + * 1. Software interrupt: Check against DPL of the task gate
>> + * 2. Exception/IRQ/iret: No check is performed
>> + * 3. jmp/call: Check agains DPL of the TSS
>> + */
>> + dpl = -1;
>> + if (reason == TASK_SWITCH_GATE) {
>> + if (idt_index != -1) {
>> + struct kvm_desc_struct task_gate_desc;
>> +
>> + ret = read_interrupt_descriptor(ctxt, idt_index,
>> + &task_gate_desc);
>> + if (ret != X86EMUL_CONTINUE)
>> + return ret;
>> +
>> + dpl = task_gate_desc.dpl;
>> + }
>> + } else if (reason != TASK_SWITCH_IRET) {
>> + dpl = next_tss_desc.dpl;
>> }
>>
>> + if (dpl != -1 && ((tss_selector & 3) > dpl || ops->cpl(ctxt) > dpl))
>> + return emulate_gp(ctxt, 0);
>
> Should be #GP(selector), no?
This line is just moved code, but without looking it up I would expect
the selector, yes. Would be an independent bug. I can add a patch to the
series if you like.
> The TASK-GATE: branch of the CALL instruction documentation lists many
> other conditions which we don't check, so I'll accept this, otherwise
> we'll never make any progress.
Hm, I didn't really look at call, just iret and exceptions.
Seems there are many test cases left to write.
Kevin
--
To unsubscribe from this list: send the line "unsubscribe kvm" in
the body of a message to majordomo@xxxxxxxxxxxxxxx
More majordomo info at http://vger.kernel.org/majordomo-info.html
