KVM: VMX: Check cpl before emulating debug register access

commit 0a79b009525b160081d75cef5dbf45817956acf2 upstream.

Debug registers may only be accessed from cpl 0.  Unfortunately, vmx will
code to emulate the instruction even though it was issued from guest
userspace, possibly leading to an unexpected trap later.

Signed-off-by: Avi Kivity <avi@redhat.com>
Signed-off-by: Marcelo Tosatti <mtosatti@redhat.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>

diff --git a/arch/x86/kvm/vmx.c b/arch/x86/kvm/vmx.c
index 4cee61a464e472f3ed36018a5647e3cfa6e5cc34..7981dbe4eecb2435d77a5d32895ab47b19f01b9a 100644 (file)
--- a/arch/x86/kvm/vmx.c
+++ b/arch/x86/kvm/vmx.c
@@ -2464,6 +2464,9 @@ static int handle_dr(struct kvm_vcpu *vcpu, struct kvm_run *kvm_run)
        unsigned long val;
        int dr, reg;
 
+       if (!kvm_require_cpl(vcpu, 0))
+               return 1;
+
        /*
         * FIXME: this code assumes the host is debugging the guest.
         *        need to deal with guest debugging itself too.

diff --git a/arch/x86/kvm/x86.c b/arch/x86/kvm/x86.c
index bf872f2728907ca85756440e05ec46b96a6b5b79..994722494215c197c555c82c6d8b30e3ef534bf8 100644 (file)
--- a/arch/x86/kvm/x86.c
+++ b/arch/x86/kvm/x86.c
@@ -197,6 +197,19 @@ static void __queue_exception(struct kvm_vcpu *vcpu)
                                     vcpu->arch.exception.error_code);
 }
 
+/*
+ * Checks if cpl <= required_cpl; if true, return true.  Otherwise queue
+ * a #GP and return false.
+ */
+bool kvm_require_cpl(struct kvm_vcpu *vcpu, int required_cpl)
+{
+       if (kvm_x86_ops->get_cpl(vcpu) <= required_cpl)
+               return true;
+       kvm_queue_exception_e(vcpu, GP_VECTOR, 0);
+       return false;
+}
+EXPORT_SYMBOL_GPL(kvm_require_cpl);
+
 /*
  * Load the pae pdptrs.  Return true is they are all valid.
  */

diff --git a/include/asm-x86/kvm_host.h b/include/asm-x86/kvm_host.h
index cf7c887165c4e8eddf44a11d760551ecb2231dee..69d4de9b2bbc2e66c996f8d206c93903c9b143e4 100644 (file)
--- a/include/asm-x86/kvm_host.h
+++ b/include/asm-x86/kvm_host.h
@@ -537,6 +537,7 @@ void kvm_queue_exception(struct kvm_vcpu *vcpu, unsigned nr);
 void kvm_queue_exception_e(struct kvm_vcpu *vcpu, unsigned nr, u32 error_code);
 void kvm_inject_page_fault(struct kvm_vcpu *vcpu, unsigned long cr2,
                           u32 error_code);
+bool kvm_require_cpl(struct kvm_vcpu *vcpu, int required_cpl);
 
 void kvm_inject_nmi(struct kvm_vcpu *vcpu);