## Host environment - Operating system: Kali Linux 2025.4 - OS/kernel version: Linux kali 6.16.8+kali-amd64 #1 SMP PREEMPT_DYNAMIC Kali 6.16.8-1kali1 (2025-09-24) x86_64 GNU/Linux - Architecture: i386, x86_64 - QEMU flavor: qemu-system-i386, qemu-system-x86_64 - QEMU version: 10.1.91 (v10.2.0-rc1-11-g5a5b06d2f6-dirty) (built from source) - QEMU command line: ``` qemu-system-x86_64 ./poc ``` ## Emulated/Virtualized environment - Operating system: Does not matter - OS/kernel version: Does not matter - Architecture: i386, x86_64 ## Description of problem QEMU ignores the attempts to read or write unimplemented MSRs using `rdmsr` and `wrmsr` instructions, although both Intel and AMD manuals state that these instructions should raise `#GP(0)` exception in this case. Both [`helper_rdmsr`](https://gitlab.com/qemu-project/qemu/-/blob/master/target/i386/tcg/system/misc_helper.c#L496) and [`helper_wrmsr`](https://gitlab.com/qemu-project/qemu/-/blob/master/target/i386/tcg/system/misc_helper.c#L321) functions seem to simply ignore unimplemented MSRs. ## Steps to reproduce 1. Compile the following source code with `nasm -f bin ./poc.asm` (example is running in real mode, but `rdmsr` and `wrmsr` behave the same in protected and long modes): ```nasm bits 16 org 0x7c00 cli xor eax, eax mov ds, eax mov es, eax mov fs, eax mov gs, eax mov ss, eax mov esp, 0x7c00 jmp 0:reload_cs_16 reload_cs_16: lidt [idtr] xor esi, esi not esi xor eax, eax xor edx, edx mov edi, do_wrmsr ; Intel SDM Vol.4 2-86 ; Register Address: 4000_0000H−4000_00FFH Reserved MSR Address Space ; All existing and future processors will not implement MSRs in this range. mov ecx, 0x40000000 rdmsr do_wrmsr: mov edi, infinite_loop wrmsr infinite_loop: hlt jmp infinite_loop ivt: dd div_err_handler dd debug_exc_handler dd nmi_handler dd breakpoint_handler dd overflow_exc_handler dd bound_range_exceeded_handler dd invalid_opcode_handler dd device_not_available_handler dd double_fault_handler dd reserved9_handler dd invalid_tss_handler dd segment_not_present_handler dd stack_fault_handler dd general_protection_handler dd page_fault_handler dd reserved15_handler dd fpu_fp_error_handler dd alignment_check_handler dd machine_check_handler dd simd_fp_exc_handler dd virtualization_exc_handler dd control_protection_handler idtr: .limit: dw idtr - ivt .base: dd ivt %macro CREATE_STUB_EXCEPTION_HANDLER 2 %1: shl esi, 8 or esi, %2 jmp edi %endmacro CREATE_STUB_EXCEPTION_HANDLER div_err_handler, 0 CREATE_STUB_EXCEPTION_HANDLER debug_exc_handler, 1 CREATE_STUB_EXCEPTION_HANDLER nmi_handler, 2 CREATE_STUB_EXCEPTION_HANDLER breakpoint_handler, 3 CREATE_STUB_EXCEPTION_HANDLER overflow_exc_handler, 4 CREATE_STUB_EXCEPTION_HANDLER bound_range_exceeded_handler, 5 CREATE_STUB_EXCEPTION_HANDLER invalid_opcode_handler, 6 CREATE_STUB_EXCEPTION_HANDLER device_not_available_handler, 7 CREATE_STUB_EXCEPTION_HANDLER double_fault_handler, 8 CREATE_STUB_EXCEPTION_HANDLER reserved9_handler, 9 CREATE_STUB_EXCEPTION_HANDLER invalid_tss_handler, 10 CREATE_STUB_EXCEPTION_HANDLER segment_not_present_handler, 11 CREATE_STUB_EXCEPTION_HANDLER stack_fault_handler, 12 CREATE_STUB_EXCEPTION_HANDLER general_protection_handler, 13 CREATE_STUB_EXCEPTION_HANDLER page_fault_handler, 14 CREATE_STUB_EXCEPTION_HANDLER reserved15_handler, 15 CREATE_STUB_EXCEPTION_HANDLER fpu_fp_error_handler, 16 CREATE_STUB_EXCEPTION_HANDLER alignment_check_handler, 17 CREATE_STUB_EXCEPTION_HANDLER machine_check_handler, 18 CREATE_STUB_EXCEPTION_HANDLER simd_fp_exc_handler, 19 CREATE_STUB_EXCEPTION_HANDLER virtualization_exc_handler, 20 CREATE_STUB_EXCEPTION_HANDLER control_protection_handler, 21 times 510 - ($-$$) db 0 dw 0xaa55 ``` 2. Start qemu-system: ``` qemu-system-x86_64 ./poc # or qemu-system-i386, does not matter really ``` 3. Observe that `eip` points to `jmp 0x7c40` (`eip == 0x7c41`) and `esi == 0xffffffff` (either via qemu monitor or gdb), which means there were no exceptions while executing the reproducer (If qemu was started with `-enable-kvm`, `esi == 0xffff0d0d`, indicating there were 2 `#GP`s while executing reproducer. See the source code of `CREATE_STUB_EXCEPTION_HANDLER` macro for details on `esi` value) ## Additional information 3c1cf9fa865927759a78d476a218a7759fb38fb4 seems to be the commit which introduced this bug. (in file [helper-i386.c:963](https://gitlab.com/qemu-project/qemu/-/commit/3c1cf9fa865927759a78d476a218a7759fb38fb4#0fc5737b58647d7b397a7fb5e11a681799cba9e9_950_963) and [helper-i386.c:984](https://gitlab.com/qemu-project/qemu/-/commit/3c1cf9fa865927759a78d476a218a7759fb38fb4#0fc5737b58647d7b397a7fb5e11a681799cba9e9_950_984) for `wrmsr` and `rdmsr` respectively)