From 8e660f56317d4b0182674c464a4652d9c61f9999 Mon Sep 17 00:00:00 2001 From: Greg Kroah-Hartman Date: Tue, 8 Jun 2021 17:59:13 +0200 Subject: [PATCH] 4.9-stable patches added patches: kvm-svm-truncate-gpr-value-for-dr-and-cr-accesses-in-64-bit-mode.patch --- ...or-dr-and-cr-accesses-in-64-bit-mode.patch | 66 +++++++++++++++++++ queue-4.9/series | 1 + 2 files changed, 67 insertions(+) create mode 100644 queue-4.9/kvm-svm-truncate-gpr-value-for-dr-and-cr-accesses-in-64-bit-mode.patch diff --git a/queue-4.9/kvm-svm-truncate-gpr-value-for-dr-and-cr-accesses-in-64-bit-mode.patch b/queue-4.9/kvm-svm-truncate-gpr-value-for-dr-and-cr-accesses-in-64-bit-mode.patch new file mode 100644 index 00000000000..3c9e4e88624 --- /dev/null +++ b/queue-4.9/kvm-svm-truncate-gpr-value-for-dr-and-cr-accesses-in-64-bit-mode.patch @@ -0,0 +1,66 @@ +From foo@baz Tue Jun 8 05:39:01 PM CEST 2021 +From: Sean Christopherson +Date: Wed, 21 Apr 2021 19:21:22 -0700 +Subject: KVM: SVM: Truncate GPR value for DR and CR accesses in !64-bit mode + +From: Sean Christopherson + +commit 0884335a2e653b8a045083aa1d57ce74269ac81d upstream. + +Drop bits 63:32 on loads/stores to/from DRs and CRs when the vCPU is not +in 64-bit mode. The APM states bits 63:32 are dropped for both DRs and +CRs: + + In 64-bit mode, the operand size is fixed at 64 bits without the need + for a REX prefix. In non-64-bit mode, the operand size is fixed at 32 + bits and the upper 32 bits of the destination are forced to 0. + +Fixes: 7ff76d58a9dc ("KVM: SVM: enhance MOV CR intercept handler") +Fixes: cae3797a4639 ("KVM: SVM: enhance mov DR intercept handler") +Cc: stable@vger.kernel.org +Signed-off-by: Sean Christopherson +Message-Id: <20210422022128.3464144-4-seanjc@google.com> +Signed-off-by: Paolo Bonzini +[sudip: manual backport to old file] +Signed-off-by: Sudip Mukherjee +Signed-off-by: Greg Kroah-Hartman +--- + arch/x86/kvm/svm.c | 8 ++++---- + 1 file changed, 4 insertions(+), 4 deletions(-) + +--- a/arch/x86/kvm/svm.c ++++ b/arch/x86/kvm/svm.c +@@ -3412,7 +3412,7 @@ static int cr_interception(struct vcpu_s + err = 0; + if (cr >= 16) { /* mov to cr */ + cr -= 16; +- val = kvm_register_read(&svm->vcpu, reg); ++ val = kvm_register_readl(&svm->vcpu, reg); + switch (cr) { + case 0: + if (!check_selective_cr0_intercepted(svm, val)) +@@ -3457,7 +3457,7 @@ static int cr_interception(struct vcpu_s + kvm_queue_exception(&svm->vcpu, UD_VECTOR); + return 1; + } +- kvm_register_write(&svm->vcpu, reg, val); ++ kvm_register_writel(&svm->vcpu, reg, val); + } + kvm_complete_insn_gp(&svm->vcpu, err); + +@@ -3489,13 +3489,13 @@ static int dr_interception(struct vcpu_s + if (dr >= 16) { /* mov to DRn */ + if (!kvm_require_dr(&svm->vcpu, dr - 16)) + return 1; +- val = kvm_register_read(&svm->vcpu, reg); ++ val = kvm_register_readl(&svm->vcpu, reg); + kvm_set_dr(&svm->vcpu, dr - 16, val); + } else { + if (!kvm_require_dr(&svm->vcpu, dr)) + return 1; + kvm_get_dr(&svm->vcpu, dr, &val); +- kvm_register_write(&svm->vcpu, reg, val); ++ kvm_register_writel(&svm->vcpu, reg, val); + } + + skip_emulated_instruction(&svm->vcpu); diff --git a/queue-4.9/series b/queue-4.9/series index dc7c7878cc2..aeefd6df0c3 100644 --- a/queue-4.9/series +++ b/queue-4.9/series @@ -24,3 +24,4 @@ nfc-fix-null-ptr-dereference-in-llcp_sock_getname-after-failed-connect.patch btrfs-fix-error-handling-in-btrfs_del_csums.patch btrfs-fixup-error-handling-in-fixup_inode_link_counts.patch bnxt_en-remove-the-setting-of-dev_port.patch +kvm-svm-truncate-gpr-value-for-dr-and-cr-accesses-in-64-bit-mode.patch -- 2.47.3