[v12,74/77] KVM: introspection: add KVMI_VCPU_EVENT_SINGLESTEP

Message ID	20211006173113.26445-75-alazar@bitdefender.com (mailing list archive)
State	New, archived
Headers	show Return-Path: <kvm-owner@kernel.org> From: =?utf-8?q?Adalbert_Laz=C4=83r?= <alazar@bitdefender.com> To: kvm@vger.kernel.org Cc: virtualization@lists.linux-foundation.org, Paolo Bonzini <pbonzini@redhat.com>, Sean Christopherson <seanjc@google.com>, Vitaly Kuznetsov <vkuznets@redhat.com>, Wanpeng Li <wanpengli@tencent.com>, Jim Mattson <jmattson@google.com>, Joerg Roedel <joro@8bytes.org>, Mathieu Tarral <mathieu.tarral@protonmail.com>, Tamas K Lengyel <tamas@tklengyel.com>, =?utf-8?b?TmljdciZb3IgQ8OuyJt1?= <nicu.citu@icloud.com>, =?utf-8?q?Adalbert?= =?utf-8?q?_Laz=C4=83r?= <alazar@bitdefender.com> Subject: [PATCH v12 74/77] KVM: introspection: add KVMI_VCPU_EVENT_SINGLESTEP Date: Wed, 6 Oct 2021 20:31:10 +0300 Message-Id: <20211006173113.26445-75-alazar@bitdefender.com> In-Reply-To: <20211006173113.26445-1-alazar@bitdefender.com> References: <20211006173113.26445-1-alazar@bitdefender.com> MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Precedence: bulk
Series	VM introspection \| expand [v12,00/77] VM introspection [v12,01/77] KVM: UAPI: add error codes used by the VM introspection code [v12,02/77] KVM: add kvm_vcpu_kick_and_wait() [v12,03/77] KVM: x86: add kvm_arch_vcpu_get_regs() and kvm_arch_vcpu_get_sregs() [v12,04/77] KVM: x86: add kvm_arch_vcpu_set_regs() [v12,05/77] KVM: x86: avoid injecting #PF when emulate the VMCALL instruction [v12,06/77] KVM: x86: add kvm_x86_ops.bp_intercepted() [v12,07/77] KVM: x86: add kvm_x86_ops.control_cr3_intercept() [v12,08/77] KVM: x86: add kvm_x86_ops.cr3_write_intercepted() [v12,09/77] KVM: x86: add kvm_x86_ops.desc_ctrl_supported() [v12,10/77] KVM: svm: add support for descriptor-table VM-exits [v12,11/77] KVM: x86: add kvm_x86_ops.control_desc_intercept() [v12,12/77] KVM: x86: add kvm_x86_ops.desc_intercepted() [v12,13/77] KVM: x86: add kvm_x86_ops.msr_write_intercepted() [v12,14/77] KVM: x86: svm: use the vmx convention to control the MSR interception [v12,15/77] KVM: x86: add kvm_x86_ops.control_msr_intercept() [v12,16/77] KVM: x86: save the error code during EPT/NPF exits handling [v12,17/77] KVM: x86: add kvm_x86_ops.fault_gla() [v12,18/77] KVM: x86: add kvm_x86_ops.control_singlestep() [v12,19/77] KVM: x86: export kvm_arch_vcpu_set_guest_debug() [v12,20/77] KVM: x86: extend kvm_mmu_gva_to_gpa_system() with the 'access' parameter [v12,21/77] KVM: x86: export kvm_inject_pending_exception() [v12,22/77] KVM: x86: export kvm_vcpu_ioctl_x86_get_xsave() [v12,23/77] KVM: x86: export kvm_vcpu_ioctl_x86_set_xsave() [v12,24/77] KVM: x86: page track: provide all callbacks with the guest virtual address [v12,25/77] KVM: x86: page track: add track_create_slot() callback [v12,26/77] KVM: x86: page_track: add support for preread, prewrite and preexec [v12,27/77] KVM: x86: wire in the preread/prewrite/preexec page trackers [v12,28/77] KVM: x86: disable gpa_available optimization for fetch and page-walk SPT violations [v12,29/77] KVM: introduce VM introspection [v12,30/77] KVM: introspection: add hook/unhook ioctls [v12,31/77] KVM: introspection: add permission access ioctls [v12,32/77] KVM: introspection: add the read/dispatch message function [v12,33/77] KVM: introspection: add KVMI_GET_VERSION [v12,34/77] KVM: introspection: add KVMI_VM_CHECK_COMMAND and KVMI_VM_CHECK_EVENT [v12,35/77] KVM: introspection: add KVMI_VM_GET_INFO [v12,36/77] KVM: introspection: add KVM_INTROSPECTION_PREUNHOOK [v12,37/77] KVM: introspection: add KVMI_VM_EVENT_UNHOOK [v12,38/77] KVM: introspection: add KVMI_VM_CONTROL_EVENTS [v12,39/77] KVM: introspection: add KVMI_VM_READ_PHYSICAL/KVMI_VM_WRITE_PHYSICAL [v12,40/77] KVM: introspection: add vCPU related data [v12,41/77] KVM: introspection: add a jobs list to every introspected vCPU [v12,42/77] KVM: introspection: handle vCPU introspection requests [v12,43/77] KVM: introspection: handle vCPU commands [v12,44/77] KVM: introspection: add KVMI_VCPU_GET_INFO [v12,45/77] KVM: introspection: add KVMI_VM_PAUSE_VCPU [v12,46/77] KVM: introspection: add support for vCPU events [v12,47/77] KVM: introspection: add KVMI_VCPU_EVENT_PAUSE [v12,48/77] KVM: introspection: add the crash action handling on the event reply [v12,49/77] KVM: introspection: add KVMI_VCPU_CONTROL_EVENTS [v12,50/77] KVM: introspection: add KVMI_VCPU_GET_REGISTERS [v12,51/77] KVM: introspection: add KVMI_VCPU_SET_REGISTERS [v12,52/77] KVM: introspection: add KVMI_VCPU_GET_CPUID [v12,53/77] KVM: introspection: add KVMI_VCPU_EVENT_HYPERCALL [v12,54/77] KVM: introspection: add KVMI_VCPU_EVENT_BREAKPOINT [v12,55/77] KVM: introspection: add cleanup support for vCPUs [v12,56/77] KVM: introspection: restore the state of #BP interception on unhook [v12,57/77] KVM: introspection: add KVMI_VM_CONTROL_CLEANUP [v12,58/77] KVM: introspection: add KVMI_VCPU_CONTROL_CR and KVMI_VCPU_EVENT_CR [v12,59/77] KVM: introspection: restore the state of CR3 interception on unhook [v12,60/77] KVM: introspection: add KVMI_VCPU_INJECT_EXCEPTION + KVMI_VCPU_EVENT_TRAP [v12,61/77] KVM: introspection: add KVMI_VCPU_EVENT_XSETBV [v12,62/77] KVM: introspection: add KVMI_VCPU_GET_XCR [v12,63/77] KVM: introspection: add KVMI_VCPU_GET_XSAVE [v12,64/77] KVM: introspection: add KVMI_VCPU_SET_XSAVE [v12,65/77] KVM: introspection: add KVMI_VCPU_GET_MTRR_TYPE [v12,66/77] KVM: introspection: add KVMI_VCPU_EVENT_DESCRIPTOR [v12,67/77] KVM: introspection: restore the state of descriptor-table register interception on unho… [v12,68/77] KVM: introspection: add KVMI_VCPU_CONTROL_MSR and KVMI_VCPU_EVENT_MSR [v12,69/77] KVM: introspection: restore the state of MSR interception on unhook [v12,70/77] KVM: introspection: add KVMI_VM_SET_PAGE_ACCESS [v12,71/77] KVM: introspection: add KVMI_VCPU_EVENT_PF [v12,72/77] KVM: introspection: extend KVMI_GET_VERSION with struct kvmi_features [v12,73/77] KVM: introspection: add KVMI_VCPU_CONTROL_SINGLESTEP [v12,74/77] KVM: introspection: add KVMI_VCPU_EVENT_SINGLESTEP [v12,75/77] KVM: introspection: add KVMI_VCPU_TRANSLATE_GVA [v12,76/77] KVM: introspection: emulate a guest page table walk on SPT violations due to A/D bit up… [v12,77/77] KVM: x86: call the page tracking code on emulation failure

diff --git a/Documentation/virt/kvm/kvmi.rst b/Documentation/virt/kvm/kvmi.rst index 7f70345ebaac..84922d327255 100644 --- a/Documentation/virt/kvm/kvmi.rst +++ b/Documentation/virt/kvm/kvmi.rst @@ -565,6 +565,7 @@ because these are sent as a result of certain commands (but they can be disallowed by the device manager) :: KVMI_VCPU_EVENT_PAUSE + KVMI_VCPU_EVENT_SINGLESTEP KVMI_VCPU_EVENT_TRAP The VM events (e.g. *KVMI_VM_EVENT_UNHOOK*) are controlled with @@ -1044,8 +1045,12 @@ Enables/disables singlestep for the selected vCPU. The introspection tool should use *KVMI_GET_VERSION*, to check if the hardware supports singlestep (see **KVMI_GET_VERSION**). +After every instruction, a *KVMI_VCPU_EVENT_SINGLESTEP* event is sent +to the introspection tool. + :Errors: +* -KVM_EPERM - the *KVMI_VCPU_EVENT_SINGLESTEP* event is disallowed * -KVM_EOPNOTSUPP - the hardware doesn't support singlestep * -KVM_EINVAL - the padding is not zero * -KVM_EAGAIN - the selected vCPU can't be introspected yet @@ -1489,3 +1494,29 @@ emulation). The *RETRY* action is used by the introspection tool to retry the execution of the current instruction, usually because it changed the instruction pointer or the page restrictions. + +11. KVMI_VCPU_EVENT_SINGLESTEP +------------------------------ + +:Architectures: x86 +:Versions: >= 1 +:Actions: CONTINUE, CRASH +:Parameters: + +:: + + struct kvmi_vcpu_event; + +:Returns: + +:: + + struct kvmi_vcpu_hdr; + struct kvmi_vcpu_event_reply; + struct kvmi_vcpu_event_singlestep { + __u8 failed; + __u8 padding[7]; + }; + +This event is sent after each instruction, as long as the singlestep is +enabled for the current vCPU (see **KVMI_VCPU_CONTROL_SINGLESTEP**). diff --git a/arch/x86/kvm/kvmi.c b/arch/x86/kvm/kvmi.c index e26a0eee1592..58c2debd8815 100644 --- a/arch/x86/kvm/kvmi.c +++ b/arch/x86/kvm/kvmi.c @@ -20,6 +20,7 @@ void kvmi_arch_init_vcpu_events_mask(unsigned long *supported) set_bit(KVMI_VCPU_EVENT_DESCRIPTOR, supported); set_bit(KVMI_VCPU_EVENT_MSR, supported); set_bit(KVMI_VCPU_EVENT_PF, supported); + set_bit(KVMI_VCPU_EVENT_SINGLESTEP, supported); set_bit(KVMI_VCPU_EVENT_TRAP, supported); set_bit(KVMI_VCPU_EVENT_XSETBV, supported); } diff --git a/arch/x86/kvm/kvmi_msg.c b/arch/x86/kvm/kvmi_msg.c index 6d3980e18281..ea38eb7ccb7c 100644 --- a/arch/x86/kvm/kvmi_msg.c +++ b/arch/x86/kvm/kvmi_msg.c @@ -284,6 +284,12 @@ static int handle_vcpu_control_singlestep(const struct kvmi_vcpu_msg_job *job, struct kvm_vcpu *vcpu = job->vcpu; int ec = 0; + if (!kvmi_is_event_allowed(KVMI(vcpu->kvm), + KVMI_VCPU_EVENT_SINGLESTEP)) { + ec = -KVM_EPERM; + goto reply; + } + if (non_zero_padding(req->padding, ARRAY_SIZE(req->padding)) || req->enable > 1) { ec = -KVM_EINVAL; diff --git a/arch/x86/kvm/vmx/vmx.c b/arch/x86/kvm/vmx/vmx.c index 1df0a29d1d8d..4f5b04fb1ede 100644 --- a/arch/x86/kvm/vmx/vmx.c +++ b/arch/x86/kvm/vmx/vmx.c @@ -5587,6 +5587,7 @@ static int handle_pause(struct kvm_vcpu *vcpu) static int handle_monitor_trap(struct kvm_vcpu *vcpu) { + kvmi_singlestep_done(vcpu); return 1; } @@ -6137,6 +6138,11 @@ static int __vmx_handle_exit(struct kvm_vcpu *vcpu, fastpath_t exit_fastpath) } } + if (kvmi_vcpu_running_singlestep(vcpu) && + exit_reason.basic != EXIT_REASON_EPT_VIOLATION && + exit_reason.basic != EXIT_REASON_MONITOR_TRAP_FLAG) + kvmi_singlestep_failed(vcpu); + if (exit_fastpath != EXIT_FASTPATH_NONE) return 1; diff --git a/include/linux/kvmi_host.h b/include/linux/kvmi_host.h index e2103ab9d0d5..ec38e434c8e9 100644 --- a/include/linux/kvmi_host.h +++ b/include/linux/kvmi_host.h @@ -81,6 +81,8 @@ void kvmi_handle_requests(struct kvm_vcpu *vcpu); bool kvmi_hypercall_event(struct kvm_vcpu *vcpu); bool kvmi_breakpoint_event(struct kvm_vcpu *vcpu, u64 gva, u8 insn_len); bool kvmi_vcpu_running_singlestep(struct kvm_vcpu *vcpu); +void kvmi_singlestep_done(struct kvm_vcpu *vcpu); +void kvmi_singlestep_failed(struct kvm_vcpu *vcpu); #else @@ -97,6 +99,8 @@ static inline bool kvmi_breakpoint_event(struct kvm_vcpu *vcpu, u64 gva, u8 insn_len) { return true; } static inline bool kvmi_vcpu_running_singlestep(struct kvm_vcpu *vcpu) { return false; } +static inline void kvmi_singlestep_done(struct kvm_vcpu *vcpu) { } +static inline void kvmi_singlestep_failed(struct kvm_vcpu *vcpu) { } #endif /* CONFIG_KVM_INTROSPECTION */ diff --git a/include/uapi/linux/kvmi.h b/include/uapi/linux/kvmi.h index 31bf2b6f3779..148d145ddea0 100644 --- a/include/uapi/linux/kvmi.h +++ b/include/uapi/linux/kvmi.h @@ -73,6 +73,7 @@ enum { KVMI_VCPU_EVENT_DESCRIPTOR = KVMI_VCPU_EVENT_ID(6), KVMI_VCPU_EVENT_MSR = KVMI_VCPU_EVENT_ID(7), KVMI_VCPU_EVENT_PF = KVMI_VCPU_EVENT_ID(8), + KVMI_VCPU_EVENT_SINGLESTEP = KVMI_VCPU_EVENT_ID(9), KVMI_NEXT_VCPU_EVENT }; @@ -222,4 +223,9 @@ struct kvmi_vcpu_control_singlestep { __u8 padding[7]; }; +struct kvmi_vcpu_event_singlestep { + __u8 failed; + __u8 padding[7]; +}; + #endif /* _UAPI__LINUX_KVMI_H */ diff --git a/tools/testing/selftests/kvm/x86_64/kvmi_test.c b/tools/testing/selftests/kvm/x86_64/kvmi_test.c index 1bd01115be31..faef908eeedd 100644 --- a/tools/testing/selftests/kvm/x86_64/kvmi_test.c +++ b/tools/testing/selftests/kvm/x86_64/kvmi_test.c @@ -1823,12 +1823,60 @@ static void cmd_vcpu_singlestep(struct kvm_vm *vm, __u8 enable, &req.hdr, sizeof(req), NULL, 0, expected_err); } +static void __control_singlestep(bool enable) +{ + struct { + struct kvmi_msg_hdr hdr; + struct kvmi_vcpu_hdr vcpu_hdr; + struct kvmi_vcpu_control_singlestep cmd; + } req = {}; + int r; + + req.cmd.enable = enable ? 1 : 0; + + r = __do_vcpu0_command(KVMI_VCPU_CONTROL_SINGLESTEP, + &req.hdr, sizeof(req), NULL, 0); + TEST_ASSERT(r == 0, + "KVMI_VCPU_CONTROL_SINGLESTEP failed, error %d(%s)\n", + -r, kvm_strerror(-r)); +} + +static void test_singlestep_event(__u16 event_id) +{ + struct { + struct vcpu_event vcpu_ev; + struct kvmi_vcpu_event_singlestep singlestep; + } ev; + bool enable = true, disable = false; + struct vcpu_reply rpl = { }; + struct kvmi_msg_hdr hdr; + + __control_singlestep(enable); + + receive_vcpu_event(&hdr, &ev.vcpu_ev, sizeof(ev), event_id); + + pr_debug("SINGLESTEP event, rip 0x%llx success %d\n", + ev.vcpu_ev.common.arch.regs.rip, !ev.singlestep.failed); + TEST_ASSERT(!ev.singlestep.failed, "Singlestep failed"); + + __control_singlestep(disable); + + reply_to_event(&hdr, &ev.vcpu_ev, KVMI_EVENT_ACTION_CONTINUE, + &rpl, sizeof(rpl)); +} + static void test_supported_singlestep(struct kvm_vm *vm) { - __u8 disable = 0, enable = 1, enable_inval = 2; + struct vcpu_worker_data data = {.vm = vm, .vcpu_id = VCPU_ID }; + __u16 event_id = KVMI_VCPU_EVENT_SINGLESTEP; + __u8 enable_inval = 2; + pthread_t vcpu_thread; - cmd_vcpu_singlestep(vm, enable, 0); - cmd_vcpu_singlestep(vm, disable, 0); + enable_vcpu_event(vm, event_id); + vcpu_thread = start_vcpu_worker(&data); + test_singlestep_event(event_id); + wait_vcpu_worker(vcpu_thread); + disable_vcpu_event(vm, event_id); cmd_vcpu_singlestep(vm, enable_inval, -KVM_EINVAL); } diff --git a/virt/kvm/introspection/kvmi.c b/virt/kvm/introspection/kvmi.c index c20c70547065..4ed145421d69 100644 --- a/virt/kvm/introspection/kvmi.c +++ b/virt/kvm/introspection/kvmi.c @@ -1194,3 +1194,46 @@ bool kvmi_vcpu_running_singlestep(struct kvm_vcpu *vcpu) return ret; } EXPORT_SYMBOL(kvmi_vcpu_running_singlestep); + +static void kvmi_singlestep_event(struct kvm_vcpu *vcpu, bool success) +{ + u32 action; + + action = kvmi_msg_send_vcpu_singlestep(vcpu, success); + switch (action) { + case KVMI_EVENT_ACTION_CONTINUE: + break; + default: + kvmi_handle_common_event_actions(vcpu, action); + } +} + +static void kvmi_handle_singlestep_exit(struct kvm_vcpu *vcpu, bool success) +{ + struct kvm_vcpu_introspection *vcpui; + struct kvm_introspection *kvmi; + struct kvm *kvm = vcpu->kvm; + + kvmi = kvmi_get(kvm); + if (!kvmi) + return; + + vcpui = VCPUI(vcpu); + + if (vcpui->singlestep.loop) + kvmi_singlestep_event(vcpu, success); + + kvmi_put(kvm); +} + +void kvmi_singlestep_done(struct kvm_vcpu *vcpu) +{ + kvmi_handle_singlestep_exit(vcpu, true); +} +EXPORT_SYMBOL(kvmi_singlestep_done); + +void kvmi_singlestep_failed(struct kvm_vcpu *vcpu) +{ + kvmi_handle_singlestep_exit(vcpu, false); +} +EXPORT_SYMBOL(kvmi_singlestep_failed); diff --git a/virt/kvm/introspection/kvmi_int.h b/virt/kvm/introspection/kvmi_int.h index 4815fa61b136..5f4bcdf27d6a 100644 --- a/virt/kvm/introspection/kvmi_int.h +++ b/virt/kvm/introspection/kvmi_int.h @@ -64,6 +64,7 @@ u32 kvmi_msg_send_vcpu_pause(struct kvm_vcpu *vcpu); u32 kvmi_msg_send_vcpu_hypercall(struct kvm_vcpu *vcpu); u32 kvmi_msg_send_vcpu_bp(struct kvm_vcpu *vcpu, u64 gpa, u8 insn_len); u32 kvmi_msg_send_vcpu_pf(struct kvm_vcpu *vcpu, u64 gpa, u64 gva, u8 access); +u32 kvmi_msg_send_vcpu_singlestep(struct kvm_vcpu *vcpu, bool success); /* kvmi.c */ void *kvmi_msg_alloc(void); diff --git a/virt/kvm/introspection/kvmi_msg.c b/virt/kvm/introspection/kvmi_msg.c index e2aef76bfd16..f280a4b9fee3 100644 --- a/virt/kvm/introspection/kvmi_msg.c +++ b/virt/kvm/introspection/kvmi_msg.c @@ -883,3 +883,20 @@ u32 kvmi_msg_send_vcpu_pf(struct kvm_vcpu *vcpu, u64 gpa, u64 gva, u8 access) return action; } + +u32 kvmi_msg_send_vcpu_singlestep(struct kvm_vcpu *vcpu, bool success) +{ + struct kvmi_vcpu_event_singlestep e; + u32 action; + int err; + + memset(&e, 0, sizeof(e)); + e.failed = success ? 0 : 1; + + err = kvmi_send_vcpu_event(vcpu, KVMI_VCPU_EVENT_SINGLESTEP, + &e, sizeof(e), NULL, 0, &action); + if (err) + return KVMI_EVENT_ACTION_CONTINUE; + + return action; +}

[v12,74/77] KVM: introspection: add KVMI_VCPU_EVENT_SINGLESTEP

Commit Message

Patch