4.14-stable patches

added patches:
	kvm-svm-truncate-gpr-value-for-dr-and-cr-accesses-in-64-bit-mode.patch

diff --git a/queue-4.14/kvm-svm-truncate-gpr-value-for-dr-and-cr-accesses-in-64-bit-mode.patch b/queue-4.14/kvm-svm-truncate-gpr-value-for-dr-and-cr-accesses-in-64-bit-mode.patch
new file mode 100644 (file)
index 0000000..fcd6b8c
--- /dev/null
+++ b/queue-4.14/kvm-svm-truncate-gpr-value-for-dr-and-cr-accesses-in-64-bit-mode.patch
@@ -0,0 +1,66 @@
+From foo@baz Tue Jun  8 05:38:43 PM CEST 2021
+From: Sean Christopherson <seanjc@google.com>
+Date: Wed, 21 Apr 2021 19:21:22 -0700
+Subject: KVM: SVM: Truncate GPR value for DR and CR accesses in !64-bit mode
+
+From: Sean Christopherson <seanjc@google.com>
+
+commit 0884335a2e653b8a045083aa1d57ce74269ac81d upstream.
+
+Drop bits 63:32 on loads/stores to/from DRs and CRs when the vCPU is not
+in 64-bit mode.  The APM states bits 63:32 are dropped for both DRs and
+CRs:
+
+  In 64-bit mode, the operand size is fixed at 64 bits without the need
+  for a REX prefix. In non-64-bit mode, the operand size is fixed at 32
+  bits and the upper 32 bits of the destination are forced to 0.
+
+Fixes: 7ff76d58a9dc ("KVM: SVM: enhance MOV CR intercept handler")
+Fixes: cae3797a4639 ("KVM: SVM: enhance mov DR intercept handler")
+Cc: stable@vger.kernel.org
+Signed-off-by: Sean Christopherson <seanjc@google.com>
+Message-Id: <20210422022128.3464144-4-seanjc@google.com>
+Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
+[sudip: manual backport to old file]
+Signed-off-by: Sudip Mukherjee <sudipm.mukherjee@gmail.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ arch/x86/kvm/svm.c |    8 ++++----
+ 1 file changed, 4 insertions(+), 4 deletions(-)
+
+--- a/arch/x86/kvm/svm.c
++++ b/arch/x86/kvm/svm.c
+@@ -3532,7 +3532,7 @@ static int cr_interception(struct vcpu_s
+       err = 0;
+       if (cr >= 16) { /* mov to cr */
+               cr -= 16;
+-              val = kvm_register_read(&svm->vcpu, reg);
++              val = kvm_register_readl(&svm->vcpu, reg);
+               switch (cr) {
+               case 0:
+                       if (!check_selective_cr0_intercepted(svm, val))
+@@ -3577,7 +3577,7 @@ static int cr_interception(struct vcpu_s
+                       kvm_queue_exception(&svm->vcpu, UD_VECTOR);
+                       return 1;
+               }
+-              kvm_register_write(&svm->vcpu, reg, val);
++              kvm_register_writel(&svm->vcpu, reg, val);
+       }
+       return kvm_complete_insn_gp(&svm->vcpu, err);
+ }
+@@ -3607,13 +3607,13 @@ static int dr_interception(struct vcpu_s
+       if (dr >= 16) { /* mov to DRn */
+               if (!kvm_require_dr(&svm->vcpu, dr - 16))
+                       return 1;
+-              val = kvm_register_read(&svm->vcpu, reg);
++              val = kvm_register_readl(&svm->vcpu, reg);
+               kvm_set_dr(&svm->vcpu, dr - 16, val);
+       } else {
+               if (!kvm_require_dr(&svm->vcpu, dr))
+                       return 1;
+               kvm_get_dr(&svm->vcpu, dr, &val);
+-              kvm_register_write(&svm->vcpu, reg, val);
++              kvm_register_writel(&svm->vcpu, reg, val);
+       }
+ 
+       return kvm_skip_emulated_instruction(&svm->vcpu);

diff --git a/queue-4.14/series b/queue-4.14/series
index 8ef9dff2ac488446a96b95df0a116655a0bb79e3..a5a8b31531db5c924b035e320f833082574fd8a2 100644 (file)
--- a/queue-4.14/series
+++ b/queue-4.14/series
@@ -42,3 +42,4 @@ bpf-wrap-aux-data-inside-bpf_sanitize_info-container.patch
 bpf-fix-mask-direction-swap-upon-off-reg-sign-change.patch
 bpf-no-need-to-simulate-speculative-domain-for-immediates.patch
 bnxt_en-remove-the-setting-of-dev_port.patch
+kvm-svm-truncate-gpr-value-for-dr-and-cr-accesses-in-64-bit-mode.patch