Messages in this thread | | | Date | Thu, 22 Apr 2021 16:55:42 +0000 | From | Sean Christopherson <> | Subject | Re: [PATCH v2 2/9] KVM: x86: Check CR3 GPA for validity regardless of vCPU mode |
| |
On Thu, Apr 22, 2021, Paolo Bonzini wrote: > On 22/04/21 04:21, Sean Christopherson wrote: > > Check CR3 for an invalid GPA even if the vCPU isn't in long mode. For > > bigger emulation flows, notably RSM, the vCPU mode may not be accurate > > if CR0/CR4 are loaded after CR3. For MOV CR3 and similar flows, the > > caller is responsible for truncating the value. > > > > Note, SMRAM.CR3 is read-only, so this is mostly a theoretical bug since > > KVM will not have stored an illegal CR3 into SMRAM during SMI emulation. > > Well, the guest could have changed it...
That's what I tried to address with "SMRAM.CR3 is read-only". Both Intel and AMD state that modifying read-only fields will result in unpredictable behavior, i.e. KVM going into the weeds would be within spec. IIRC, there's no real danger to the host, it'll "just" fail VM-Enter.
SDM: Some register images are read-only, and must not be modified (modifying these registers will result in unpredictable behavior)
APM:
Software should not modify offsets specified as read-only or reserved, otherwise unpredictable results can occur.
| |