* [Bug 204177] New: PT: Missing filtering on the MSRs
@ 2019-07-14 16:08 bugzilla-daemon
0 siblings, 0 replies; only message in thread
From: bugzilla-daemon @ 2019-07-14 16:08 UTC (permalink / raw)
To: kvm
https://bugzilla.kernel.org/show_bug.cgi?id=204177
Bug ID: 204177
Summary: PT: Missing filtering on the MSRs
Product: Virtualization
Version: unspecified
Kernel Version: 5.*
Hardware: Intel
OS: Linux
Tree: Mainline
Status: NEW
Severity: normal
Priority: P1
Component: kvm
Assignee: virtualization_kvm@kernel-bugs.osdl.org
Reporter: max@m00nbsd.net
Regression: No
In vmx.c::vmx_get_msr(), there is some missing filtering on the PT (RTIT) MSRs.
For example RTIT_CR3_MATCH:
case MSR_IA32_RTIT_CR3_MATCH:
if ((pt_mode != PT_MODE_HOST_GUEST) ||
(vmx->pt_desc.guest.ctl & RTIT_CTL_TRACEEN) ||
!intel_pt_validate_cap(vmx->pt_desc.caps,
PT_CAP_cr3_filtering))
return 1;
vmx->pt_desc.guest.cr3_match = data;
break;
Here, 'cr3_match' is set to the value given by the guest. Later, in
pt_load_msr(), there is a blunt WRMSR:
wrmsrl(MSR_IA32_RTIT_CR3_MATCH, ctx->cr3_match);
The Intel SDM indicates that
"IA32_RTIT_CR3_MATCH[4:0] are reserved and must be 0; an attempt to
set those bits using WRMSR causes a #GP."
Given that KVM does not ensure that the aforementioned bits are zero, it seems
that the guest could #GP the host.
--
You are receiving this mail because:
You are watching the assignee of the bug.
^ permalink raw reply [flat|nested] only message in thread
only message in thread, other threads:[~2019-07-14 16:08 UTC | newest]
Thread overview: (only message) (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2019-07-14 16:08 [Bug 204177] New: PT: Missing filtering on the MSRs bugzilla-daemon
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.