Re: [PATCH] x86/vPMU: constrain MSR_IA32_DS_AREA loads

[Boris Ostrovsky <boris.ostrovsky@oracle.com>]

On 12/17/2015 09:01 AM, Jan Beulich wrote:
> For one, loading the MSR with a possibly non-canonical address was
> possible since the verification is conditional, while the MSR load
> wasn't. And then for PV guests we need to further limit the range of
> valid addresses to exclude the hypervisor range.
>
> Signed-off-by: Jan Beulich <jbeulich@suse.com>
>
> --- a/xen/arch/x86/cpu/vpmu_intel.c
> +++ b/xen/arch/x86/cpu/vpmu_intel.c
> @@ -366,7 +366,8 @@ static inline void __core2_vpmu_load(str
>       }
>   
>       wrmsrl(MSR_CORE_PERF_FIXED_CTR_CTRL, core2_vpmu_cxt->fixed_ctrl);
> -    wrmsrl(MSR_IA32_DS_AREA, core2_vpmu_cxt->ds_area);
> +    if ( vpmu_is_set(vcpu_vpmu(v), VPMU_CPU_HAS_DS) )
> +        wrmsrl(MSR_IA32_DS_AREA, core2_vpmu_cxt->ds_area);
>       wrmsrl(MSR_IA32_PEBS_ENABLE, core2_vpmu_cxt->pebs_enable);
>   
>       if ( !has_hvm_container_vcpu(v) )
> @@ -415,8 +416,10 @@ static int core2_vpmu_verify(struct vcpu
>               enabled_cntrs |= (1ULL << i);
>       }
>   
> -    if ( vpmu_is_set(vcpu_vpmu(v), VPMU_CPU_HAS_DS) &&
> -         !is_canonical_address(core2_vpmu_cxt->ds_area) )
> +    if ( vpmu_is_set(vpmu, VPMU_CPU_HAS_DS) &&
> +         !(has_hvm_container_vcpu(v)
> +           ? is_canonical_address(core2_vpmu_cxt->ds_area)
> +           : __addr_ok(core2_vpmu_cxt->ds_area)) )

Should we instead of (or in addition to) this also make the same change 
in core2_vpmu_do_wrmsr()?

-boris

>           return -EINVAL;
>   
>       if ( (core2_vpmu_cxt->global_ctrl & enabled_cntrs) ||
>
>
>