linux-kernel - Re: [PATCH v2 0/5] KVM: VMX: Fix single stepping with emulated instructions

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:   Wed, 30 Nov 2016 19:41:57 +0100
From:   Radim Krčmář <rkrcmar@...hat.com>
To:     Kyle Huey <me@...ehuey.com>
Cc:     Paolo Bonzini <pbonzini@...hat.com>,
        Thomas Gleixner <tglx@...utronix.de>,
        Ingo Molnar <mingo@...hat.com>,
        "H. Peter Anvin" <hpa@...or.com>, x86@...nel.org,
        Joerg Roedel <joro@...tes.org>, kvm@...r.kernel.org,
        linux-kernel@...r.kernel.org
Subject: Re: [PATCH v2 0/5] KVM: VMX: Fix single stepping with emulated
 instructions

2016-11-29 12:40-0800, Kyle Huey:
> KVM does not currently honor the trap flag when emulating instructions that
> cause VM exits. This is observable from guest userspace, try stepping on a
> CPUID instruction in gdb in a KVM guest. The program will stop two
> instructions after CPUID.
> 
> To fix this, add kvm_skip_emulated_instruction that calls
> kvm_x86_ops->skip_emulated_instruction and then kvm_vcpu_check_singlestep to
> check for RFLAGS.TF. Patch 4 does this. To handle both the guest setting TF
> and the KVM_GUESTDBG_SINGLESTEP cases we need to be able to indicate to
> callees that an exit to userspace is required. Patches 1-3 are largely
> plumbing to make this possible.
> 
> Traps triggered by task switch instructions require some additional handling
> and are not implemented. KVM_GUESTDBG_SINGLESTEP traps can be squashed by
> certain instructions which also trigger userspace exits, such as HALT,
> MOV CR8, and IO instructions. I believe (although I have not tested) that
> KVM will simply generate another trap on the next instruction, so this is
> no worse than the current behavior.
> 
> Patch 5 fixes an existing bug where kvm_vcpu_check_singlestep clears
> RFLAGS.TF when generating a singlestep trap. Bare silicon does not do this.

Looks good, applied to kvm/queue.

> These patches only fix this issue for VMX, and the handful of SVM cases that
> call the shared kvm_complete_insn_gp. I don't have AMD silicon to test on.

Added to TODO,

Thanks.