linux-kernel - Re: [PATCH v3 03/18] arm64: KVM: Increment PC after handling an SMC trap

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:   Fri, 2 Feb 2018 13:33:03 +0100
From:   Christoffer Dall <christoffer.dall@...aro.org>
To:     Marc Zyngier <marc.zyngier@....com>
Cc:     linux-kernel@...r.kernel.org, linux-arm-kernel@...ts.infradead.org,
        kvmarm@...ts.cs.columbia.edu,
        Catalin Marinas <catalin.marinas@....com>,
        Will Deacon <will.deacon@....com>,
        Peter Maydell <peter.maydell@...aro.org>,
        Lorenzo Pieralisi <lorenzo.pieralisi@....com>,
        Mark Rutland <mark.rutland@....com>,
        Robin Murphy <robin.murphy@....com>,
        Ard Biesheuvel <ard.biesheuvel@...aro.org>,
        Andrew Jones <drjones@...hat.com>,
        Hanjun Guo <guohanjun@...wei.com>,
        Jayachandran C <jnair@...iumnetworks.com>,
        Jon Masters <jcm@...hat.com>,
        Russell King - ARM Linux <linux@...linux.org.uk>
Subject: Re: [PATCH v3 03/18] arm64: KVM: Increment PC after handling an SMC
 trap

On Thu, Feb 01, 2018 at 11:46:42AM +0000, Marc Zyngier wrote:
> When handling an SMC trap, the "preferred return address" is set
> to that of the SMC, and not the next PC (which is a departure from
> the behaviour of an SMC that isn't trapped).
> 
> Increment PC in the handler, as the guest is otherwise forever
> stuck...
> 

Reviewed-by: Christoffer Dall <christoffer.dall@...aro.org>

> Cc: stable@...r.kernel.org
> Fixes: acfb3b883f6d ("arm64: KVM: Fix SMCCC handling of unimplemented SMC/HVC calls")
> Signed-off-by: Marc Zyngier <marc.zyngier@....com>
> ---
>  arch/arm64/kvm/handle_exit.c | 9 +++++++++
>  1 file changed, 9 insertions(+)
> 
> diff --git a/arch/arm64/kvm/handle_exit.c b/arch/arm64/kvm/handle_exit.c
> index 520b0dad3c62..5493bbefbd0d 100644
> --- a/arch/arm64/kvm/handle_exit.c
> +++ b/arch/arm64/kvm/handle_exit.c
> @@ -62,7 +62,16 @@ static int handle_hvc(struct kvm_vcpu *vcpu, struct kvm_run *run)
>  
>  static int handle_smc(struct kvm_vcpu *vcpu, struct kvm_run *run)
>  {
> +	/*
> +	 * "If an SMC instruction executed at Non-secure EL1 is
> +	 * trapped to EL2 because HCR_EL2.TSC is 1, the exception is a
> +	 * Trap exception, not a Secure Monitor Call exception [...]"
> +	 *
> +	 * We need to advance the PC after the trap, as it would
> +	 * otherwise return to the same address...
> +	 */
>  	vcpu_set_reg(vcpu, 0, ~0UL);
> +	kvm_skip_instr(vcpu, kvm_vcpu_trap_il_is32bit(vcpu));
>  	return 1;
>  }
>  
> -- 
> 2.14.2
>