linux-kernel - Re: [PATCH v15 3/6] KVM: arm64: Forward GCS exceptions to nested guests

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <e1c3bee5-6521-4dbd-a207-4ec3e4ff19fe@sirena.org.uk>
Date: Thu, 21 Aug 2025 22:25:50 +0100
From: Mark Brown <broonie@...nel.org>
To: Marc Zyngier <maz@...nel.org>
Cc: Catalin Marinas <catalin.marinas@....com>,
	Will Deacon <will@...nel.org>,
	Oliver Upton <oliver.upton@...ux.dev>,
	Joey Gouly <joey.gouly@....com>,
	Suzuki K Poulose <suzuki.poulose@....com>,
	Shuah Khan <shuah@...nel.org>, linux-arm-kernel@...ts.infradead.org,
	linux-doc@...r.kernel.org, kvmarm@...ts.linux.dev,
	linux-kselftest@...r.kernel.org, linux-kernel@...r.kernel.org
Subject: Re: [PATCH v15 3/6] KVM: arm64: Forward GCS exceptions to nested
 guests

On Wed, Aug 20, 2025 at 11:15:25PM +0100, Marc Zyngier wrote:
> Mark Brown <broonie@...nel.org> wrote:

> > GCS can generate exceptions with an EC of 0x2D (GCS Data Check
> > Exception) when data validation checks fail.  When running a nested
> > guest which has access to GCS such exceptions can be directed from EL0
> > to EL2 and therefore need to be forwarded to the guest hypervisor, add
> > handling for this.

> Why is it so? A GCS exception from EL0 should be routed to EL1, no
> matter what (either this is an L1 guest with EL1 pretending to be EL2,
> or this is an L2 guest that has its own EL1).

> Can you describe the case where we need to reinject the exception?

I think I'd got myself confused while looking at the HCR_EL2.TGE case
thinking we enabled that in some case.  I can't now see what I was
looking at there, pretty sure I'm just mistaken - thanks for spotting
that, unless I work out what I was thinking I'll drop this.

Download attachment "signature.asc" of type "application/pgp-signature" (489 bytes)