linux-kernel - Re: [PATCH v2 0/5] KVM: VMX: Fix single stepping with emulated instructions

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:   Wed, 30 Nov 2016 10:52:49 -0800
From:   Kyle Huey <me@...ehuey.com>
To:     Radim Krčmář <rkrcmar@...hat.com>
Cc:     Paolo Bonzini <pbonzini@...hat.com>,
        Thomas Gleixner <tglx@...utronix.de>,
        Ingo Molnar <mingo@...hat.com>,
        "H. Peter Anvin" <hpa@...or.com>,
        "maintainer:X86 ARCHITECTURE (32-BIT AND 64-BIT)" <x86@...nel.org>,
        Joerg Roedel <joro@...tes.org>, kvm list <kvm@...r.kernel.org>,
        open list <linux-kernel@...r.kernel.org>
Subject: Re: [PATCH v2 0/5] KVM: VMX: Fix single stepping with emulated instructions

On Wed, Nov 30, 2016 at 10:41 AM, Radim Krčmář <rkrcmar@...hat.com> wrote:
> 2016-11-29 12:40-0800, Kyle Huey:
>> KVM does not currently honor the trap flag when emulating instructions that
>> cause VM exits. This is observable from guest userspace, try stepping on a
>> CPUID instruction in gdb in a KVM guest. The program will stop two
>> instructions after CPUID.
>>
>> To fix this, add kvm_skip_emulated_instruction that calls
>> kvm_x86_ops->skip_emulated_instruction and then kvm_vcpu_check_singlestep to
>> check for RFLAGS.TF. Patch 4 does this. To handle both the guest setting TF
>> and the KVM_GUESTDBG_SINGLESTEP cases we need to be able to indicate to
>> callees that an exit to userspace is required. Patches 1-3 are largely
>> plumbing to make this possible.
>>
>> Traps triggered by task switch instructions require some additional handling
>> and are not implemented. KVM_GUESTDBG_SINGLESTEP traps can be squashed by
>> certain instructions which also trigger userspace exits, such as HALT,
>> MOV CR8, and IO instructions. I believe (although I have not tested) that
>> KVM will simply generate another trap on the next instruction, so this is
>> no worse than the current behavior.
>>
>> Patch 5 fixes an existing bug where kvm_vcpu_check_singlestep clears
>> RFLAGS.TF when generating a singlestep trap. Bare silicon does not do this.
>
> Looks good, applied to kvm/queue.

Great!  Thank you.

>> These patches only fix this issue for VMX, and the handful of SVM cases that
>> call the shared kvm_complete_insn_gp. I don't have AMD silicon to test on.
>
> Added to TODO,
>
> Thanks.

- Kyle