From b3580e7cb20b9a49e63846b30b63eb47b6f1c58f Mon Sep 17 00:00:00 2001 From: Greg Kroah-Hartman Date: Tue, 2 Oct 2018 10:49:38 -0700 Subject: [PATCH] 3.18-stable patches added patches: arm64-kvm-sanitize-pstate.m-when-being-set-from-userspace.patch --- ...tate.m-when-being-set-from-userspace.patch | 72 +++++++++++++++++++ queue-3.18/series | 1 + 2 files changed, 73 insertions(+) create mode 100644 queue-3.18/arm64-kvm-sanitize-pstate.m-when-being-set-from-userspace.patch diff --git a/queue-3.18/arm64-kvm-sanitize-pstate.m-when-being-set-from-userspace.patch b/queue-3.18/arm64-kvm-sanitize-pstate.m-when-being-set-from-userspace.patch new file mode 100644 index 00000000000..9227606c17e --- /dev/null +++ b/queue-3.18/arm64-kvm-sanitize-pstate.m-when-being-set-from-userspace.patch @@ -0,0 +1,72 @@ +From 2a3f93459d689d990b3ecfbe782fec89b97d3279 Mon Sep 17 00:00:00 2001 +From: Marc Zyngier +Date: Thu, 27 Sep 2018 16:53:22 +0100 +Subject: arm64: KVM: Sanitize PSTATE.M when being set from userspace + +From: Marc Zyngier + +commit 2a3f93459d689d990b3ecfbe782fec89b97d3279 upstream. + +Not all execution modes are valid for a guest, and some of them +depend on what the HW actually supports. Let's verify that what +userspace provides is compatible with both the VM settings and +the HW capabilities. + +Cc: +Fixes: 0d854a60b1d7 ("arm64: KVM: enable initialization of a 32bit vcpu") +Reviewed-by: Christoffer Dall +Reviewed-by: Mark Rutland +Reviewed-by: Dave Martin +Signed-off-by: Marc Zyngier +Signed-off-by: Will Deacon +Signed-off-by: Greg Kroah-Hartman + + +--- + arch/arm64/include/asm/kvm_emulate.h | 5 +++++ + arch/arm64/kvm/guest.c | 10 +++++++++- + 2 files changed, 14 insertions(+), 1 deletion(-) + +--- a/arch/arm64/include/asm/kvm_emulate.h ++++ b/arch/arm64/include/asm/kvm_emulate.h +@@ -38,6 +38,11 @@ void kvm_inject_undefined(struct kvm_vcp + void kvm_inject_dabt(struct kvm_vcpu *vcpu, unsigned long addr); + void kvm_inject_pabt(struct kvm_vcpu *vcpu, unsigned long addr); + ++static inline bool vcpu_el1_is_32bit(struct kvm_vcpu *vcpu) ++{ ++ return !(vcpu->arch.hcr_el2 & HCR_RW); ++} ++ + static inline void vcpu_reset_hcr(struct kvm_vcpu *vcpu) + { + vcpu->arch.hcr_el2 = HCR_GUEST_FLAGS; +--- a/arch/arm64/kvm/guest.c ++++ b/arch/arm64/kvm/guest.c +@@ -141,17 +141,25 @@ static int set_core_reg(struct kvm_vcpu + } + + if (off == KVM_REG_ARM_CORE_REG(regs.pstate)) { +- u32 mode = (*(u32 *)valp) & COMPAT_PSR_MODE_MASK; ++ u64 mode = (*(u64 *)valp) & COMPAT_PSR_MODE_MASK; + switch (mode) { + case COMPAT_PSR_MODE_USR: ++ if ((read_cpuid(ID_AA64PFR0_EL1) & 0xf) != 2) ++ return -EINVAL; ++ break; + case COMPAT_PSR_MODE_FIQ: + case COMPAT_PSR_MODE_IRQ: + case COMPAT_PSR_MODE_SVC: + case COMPAT_PSR_MODE_ABT: + case COMPAT_PSR_MODE_UND: ++ if (!vcpu_el1_is_32bit(vcpu)) ++ return -EINVAL; ++ break; + case PSR_MODE_EL0t: + case PSR_MODE_EL1t: + case PSR_MODE_EL1h: ++ if (vcpu_el1_is_32bit(vcpu)) ++ return -EINVAL; + break; + default: + err = -EINVAL; diff --git a/queue-3.18/series b/queue-3.18/series index 2d6dbf8fe1e..05826ea4365 100644 --- a/queue-3.18/series +++ b/queue-3.18/series @@ -66,3 +66,4 @@ thermal-of-thermal-disable-passive-polling-when-thermal-zone-is-disabled.patch e1000-check-on-netif_running-before-calling-e1000_up.patch e1000-ensure-to-free-old-tx-rx-rings-in-set_ringparam.patch hwmon-adt7475-make-adt7475_read_word-return-errors.patch +arm64-kvm-sanitize-pstate.m-when-being-set-from-userspace.patch -- 2.47.2