linux-kernel - [PATCH v2 0/5] KVM: VMX: Fix single stepping with emulated instructions

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Message-Id: <20161129204041.8839-1-khuey@kylehuey.com>
Date:   Tue, 29 Nov 2016 12:40:36 -0800
From:   Kyle Huey <me@...ehuey.com>
To:     Paolo Bonzini <pbonzini@...hat.com>,
        Radim Krčmář <rkrcmar@...hat.com>,
        Thomas Gleixner <tglx@...utronix.de>,
        Ingo Molnar <mingo@...hat.com>,
        "H. Peter Anvin" <hpa@...or.com>, x86@...nel.org,
        Joerg Roedel <joro@...tes.org>
Cc:     kvm@...r.kernel.org, linux-kernel@...r.kernel.org
Subject: [PATCH v2 0/5] KVM: VMX: Fix single stepping with emulated instructions

KVM does not currently honor the trap flag when emulating instructions that
cause VM exits. This is observable from guest userspace, try stepping on a
CPUID instruction in gdb in a KVM guest. The program will stop two
instructions after CPUID.

To fix this, add kvm_skip_emulated_instruction that calls
kvm_x86_ops->skip_emulated_instruction and then kvm_vcpu_check_singlestep to
check for RFLAGS.TF. Patch 4 does this. To handle both the guest setting TF
and the KVM_GUESTDBG_SINGLESTEP cases we need to be able to indicate to
callees that an exit to userspace is required. Patches 1-3 are largely
plumbing to make this possible.

Traps triggered by task switch instructions require some additional handling
and are not implemented. KVM_GUESTDBG_SINGLESTEP traps can be squashed by
certain instructions which also trigger userspace exits, such as HALT,
MOV CR8, and IO instructions. I believe (although I have not tested) that
KVM will simply generate another trap on the next instruction, so this is
no worse than the current behavior.

Patch 5 fixes an existing bug where kvm_vcpu_check_singlestep clears
RFLAGS.TF when generating a singlestep trap. Bare silicon does not do this.

These patches only fix this issue for VMX, and the handful of SVM cases that
call the shared kvm_complete_insn_gp. I don't have AMD silicon to test on.

Since v1:
Patch 3: KVM: VMX: Move skip_emulated_instruction out of nested_vmx_check_vmcs12
- No longer creates a separate skip_emulated_instruction_no_trap variant.

Patch 4: KVM: x86: Add kvm_skip_emulated_instruction and use it.
- Instead the existing skip_emulated_instruction continues to not check the TF
  flag.
- kvm_skip_emulated_instruction is added to skip_emulated_instruction and then
  deal with any singlestep traps that should be generated.
- The patch 5 from v1 is effectively subsumed by this patch.

Patch 5: KVM: x86: Do not clear RFLAGS.TF when a singlestep trap occurs.
- New in this version, fixes an existing bug visible to the kvm-unit-tests
  test I wrote for this patch series.