linux-kernel - Re: [PATCH v16 4/6] KVM: arm64: Validate GCS exception lock when emulating ERET

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <864it7dge5.wl-maz@kernel.org>
Date: Fri, 12 Sep 2025 13:06:26 +0100
From: Marc Zyngier <maz@...nel.org>
To: Mark Brown <broonie@...nel.org>
Cc: Catalin Marinas <catalin.marinas@....com>,
	Will Deacon <will@...nel.org>,
	Oliver Upton <oliver.upton@...ux.dev>,
	Joey Gouly <joey.gouly@....com>,
	Suzuki K Poulose <suzuki.poulose@....com>,
	Shuah Khan <shuah@...nel.org>,
	linux-arm-kernel@...ts.infradead.org,
	linux-doc@...r.kernel.org,
	kvmarm@...ts.linux.dev,
	linux-kselftest@...r.kernel.org,
	linux-kernel@...r.kernel.org
Subject: Re: [PATCH v16 4/6] KVM: arm64: Validate GCS exception lock when emulating ERET

On Fri, 12 Sep 2025 10:25:30 +0100,
Mark Brown <broonie@...nel.org> wrote:
> 
> As per DDI0487 R_TYTWB GCS adds an additional case where an illegal
> exception return can be generated. If all of:
> 
>  - PSTATE.EXLOCK is 0.
>  - The EL is not being changed by the ERET.
>  - GCSCR_ELx.EXLOCKEN is 1.
> 
> are true then the return is illegal. Emulate this behaviour when
> emulating ERET for nested guests.
> 
> Signed-off-by: Mark Brown <broonie@...nel.org>
> ---
>  arch/arm64/kvm/emulate-nested.c | 40 +++++++++++++++++++++++++++++++++++++++-
>  1 file changed, 39 insertions(+), 1 deletion(-)
> 
> diff --git a/arch/arm64/kvm/emulate-nested.c b/arch/arm64/kvm/emulate-nested.c
> index 90cb4b7ae0ff..9b02b85eda64 100644
> --- a/arch/arm64/kvm/emulate-nested.c
> +++ b/arch/arm64/kvm/emulate-nested.c
> @@ -2632,6 +2632,41 @@ bool forward_debug_exception(struct kvm_vcpu *vcpu)
>  	return forward_mdcr_traps(vcpu, MDCR_EL2_TDE);
>  }
>  
> +/*
> + * A subset of the pseudocode ELFromSPSR(), validity checks are
> + * assumed to have been done in code that is not GCS specific.
> + */
> +static inline int exlock_el_from_spsr(u64 spsr)
> +{
> +	return FIELD_GET(GENMASK(3, 2), spsr);
> +}
> +
> +/* See IllegalExceptionReturn() pseudocode */
> +static bool kvm_check_illegal_exlock_return(struct kvm_vcpu *vcpu, u64 spsr)
> +{
> +	u64 cur_el, target_el;
> +	u64 gcscr;
> +
> +	if (!kvm_has_gcs(vcpu->kvm))
> +		return false;
> +
> +	if (spsr & PSR_EXLOCK_BIT)
> +		return false;
> +
> +	cur_el = exlock_el_from_spsr(vcpu->arch.ctxt.regs.pstate);
> +	target_el = exlock_el_from_spsr(spsr);
> +
> +	if (cur_el != target_el)
> +		return false;
> +
> +	if (vcpu_is_el2(vcpu))
> +		gcscr = __vcpu_sys_reg(vcpu, GCSCR_EL2);
> +	else
> +		gcscr = __vcpu_sys_reg(vcpu, GCSCR_EL1);

At the point where we check for an illegal exception return, the state
is live on the CPU. How does this work? Also, we only handle ERET
traps for EL2, not EL1.

> +
> +	return gcscr & GCSCR_ELx_EXLOCKEN;
> +}
> +
>  static u64 kvm_check_illegal_exception_return(struct kvm_vcpu *vcpu, u64 spsr)
>  {
>  	u64 mode = spsr & PSR_MODE_MASK;
> @@ -2642,12 +2677,15 @@ static u64 kvm_check_illegal_exception_return(struct kvm_vcpu *vcpu, u64 spsr)
>  	 * - trying to return to an illegal M value
>  	 * - trying to return to a 32bit EL
>  	 * - trying to return to EL1 with HCR_EL2.TGE set
> +	 * - GCSCR_ELx.EXLOCKEN is 1 and PSTATE.EXLOCK is 0 when attempting
> +	 *   to return from ELx the same EL.
>  	 */
>  	if (mode == PSR_MODE_EL3t   || mode == PSR_MODE_EL3h ||
>  	    mode == 0b00001         || (mode & BIT(1))       ||
>  	    (spsr & PSR_MODE32_BIT) ||
>  	    (vcpu_el2_tge_is_set(vcpu) && (mode == PSR_MODE_EL1t ||
> -					   mode == PSR_MODE_EL1h))) {
> +					   mode == PSR_MODE_EL1h)) ||
> +	    kvm_check_illegal_exlock_return(vcpu, spsr)) {

This code is simply never reached. Hint: kvm_hyp_handle_eret().

	M.

-- 
Without deviation from the norm, progress is not possible.