| From 947051e361d551e0590777080ffc4926190f62f2 Mon Sep 17 00:00:00 2001 |
| From: Marc Zyngier <maz@kernel.org> |
| Date: Fri, 24 May 2024 15:19:54 +0100 |
| Subject: KVM: arm64: Fix AArch32 register narrowing on userspace write |
| |
| From: Marc Zyngier <maz@kernel.org> |
| |
| commit 947051e361d551e0590777080ffc4926190f62f2 upstream. |
| |
| When userspace writes to one of the core registers, we make |
| sure to narrow the corresponding GPRs if PSTATE indicates |
| an AArch32 context. |
| |
| The code tries to check whether the context is EL0 or EL1 so |
| that it narrows the correct registers. But it does so by checking |
| the full PSTATE instead of PSTATE.M. |
| |
| As a consequence, and if we are restoring an AArch32 EL0 context |
| in a 64bit guest, and that PSTATE has *any* bit set outside of |
| PSTATE.M, we narrow *all* registers instead of only the first 15, |
| destroying the 64bit state. |
| |
| Obviously, this is not something the guest is likely to enjoy. |
| |
| Correctly masking PSTATE to only evaluate PSTATE.M fixes it. |
| |
| Fixes: 90c1f934ed71 ("KVM: arm64: Get rid of the AArch32 register mapping code") |
| Reported-by: Nina Schoetterl-Glausch <nsg@linux.ibm.com> |
| Cc: stable@vger.kernel.org |
| Reviewed-by: Nina Schoetterl-Glausch <nsg@linux.ibm.com> |
| Acked-by: Oliver Upton <oliver.upton@linux.dev> |
| Link: https://lore.kernel.org/r/20240524141956.1450304-2-maz@kernel.org |
| Signed-off-by: Marc Zyngier <maz@kernel.org> |
| Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> |
| --- |
| arch/arm64/kvm/guest.c | 2 +- |
| 1 file changed, 1 insertion(+), 1 deletion(-) |
| |
| --- a/arch/arm64/kvm/guest.c |
| +++ b/arch/arm64/kvm/guest.c |
| @@ -270,7 +270,7 @@ static int set_core_reg(struct kvm_vcpu |
| if (*vcpu_cpsr(vcpu) & PSR_MODE32_BIT) { |
| int i, nr_reg; |
| |
| - switch (*vcpu_cpsr(vcpu)) { |
| + switch (*vcpu_cpsr(vcpu) & PSR_AA32_MODE_MASK) { |
| /* |
| * Either we are dealing with user mode, and only the |
| * first 15 registers (+ PC) must be narrowed to 32bit. |
