From: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Date: Tue, 8 Jun 2021 16:01:29 +0000 (+0200)
Subject: 4.14-stable patches
X-Git-Tag: v4.4.272~20
X-Git-Url: http://git.ipfire.org/gitweb.cgi?a=commitdiff_plain;h=56d6073edc3cc59cecf1cd90b675408898262a97;p=thirdparty%2Fkernel%2Fstable-queue.git

4.14-stable patches

added patches:
	kvm-svm-truncate-gpr-value-for-dr-and-cr-accesses-in-64-bit-mode.patch
---

diff --git a/queue-4.14/kvm-svm-truncate-gpr-value-for-dr-and-cr-accesses-in-64-bit-mode.patch b/queue-4.14/kvm-svm-truncate-gpr-value-for-dr-and-cr-accesses-in-64-bit-mode.patch
new file mode 100644
index 00000000000..fcd6b8c5fc2
--- /dev/null
+++ b/queue-4.14/kvm-svm-truncate-gpr-value-for-dr-and-cr-accesses-in-64-bit-mode.patch
@@ -0,0 +1,66 @@
+From foo@baz Tue Jun  8 05:38:43 PM CEST 2021
+From: Sean Christopherson <seanjc@google.com>
+Date: Wed, 21 Apr 2021 19:21:22 -0700
+Subject: KVM: SVM: Truncate GPR value for DR and CR accesses in !64-bit mode
+
+From: Sean Christopherson <seanjc@google.com>
+
+commit 0884335a2e653b8a045083aa1d57ce74269ac81d upstream.
+
+Drop bits 63:32 on loads/stores to/from DRs and CRs when the vCPU is not
+in 64-bit mode.  The APM states bits 63:32 are dropped for both DRs and
+CRs:
+
+  In 64-bit mode, the operand size is fixed at 64 bits without the need
+  for a REX prefix. In non-64-bit mode, the operand size is fixed at 32
+  bits and the upper 32 bits of the destination are forced to 0.
+
+Fixes: 7ff76d58a9dc ("KVM: SVM: enhance MOV CR intercept handler")
+Fixes: cae3797a4639 ("KVM: SVM: enhance mov DR intercept handler")
+Cc: stable@vger.kernel.org
+Signed-off-by: Sean Christopherson <seanjc@google.com>
+Message-Id: <20210422022128.3464144-4-seanjc@google.com>
+Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
+[sudip: manual backport to old file]
+Signed-off-by: Sudip Mukherjee <sudipm.mukherjee@gmail.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ arch/x86/kvm/svm.c |    8 ++++----
+ 1 file changed, 4 insertions(+), 4 deletions(-)
+
+--- a/arch/x86/kvm/svm.c
++++ b/arch/x86/kvm/svm.c
+@@ -3532,7 +3532,7 @@ static int cr_interception(struct vcpu_s
+ 	err = 0;
+ 	if (cr >= 16) { /* mov to cr */
+ 		cr -= 16;
+-		val = kvm_register_read(&svm->vcpu, reg);
++		val = kvm_register_readl(&svm->vcpu, reg);
+ 		switch (cr) {
+ 		case 0:
+ 			if (!check_selective_cr0_intercepted(svm, val))
+@@ -3577,7 +3577,7 @@ static int cr_interception(struct vcpu_s
+ 			kvm_queue_exception(&svm->vcpu, UD_VECTOR);
+ 			return 1;
+ 		}
+-		kvm_register_write(&svm->vcpu, reg, val);
++		kvm_register_writel(&svm->vcpu, reg, val);
+ 	}
+ 	return kvm_complete_insn_gp(&svm->vcpu, err);
+ }
+@@ -3607,13 +3607,13 @@ static int dr_interception(struct vcpu_s
+ 	if (dr >= 16) { /* mov to DRn */
+ 		if (!kvm_require_dr(&svm->vcpu, dr - 16))
+ 			return 1;
+-		val = kvm_register_read(&svm->vcpu, reg);
++		val = kvm_register_readl(&svm->vcpu, reg);
+ 		kvm_set_dr(&svm->vcpu, dr - 16, val);
+ 	} else {
+ 		if (!kvm_require_dr(&svm->vcpu, dr))
+ 			return 1;
+ 		kvm_get_dr(&svm->vcpu, dr, &val);
+-		kvm_register_write(&svm->vcpu, reg, val);
++		kvm_register_writel(&svm->vcpu, reg, val);
+ 	}
+ 
+ 	return kvm_skip_emulated_instruction(&svm->vcpu);
diff --git a/queue-4.14/series b/queue-4.14/series
index 8ef9dff2ac4..a5a8b31531d 100644
--- a/queue-4.14/series
+++ b/queue-4.14/series
@@ -42,3 +42,4 @@ bpf-wrap-aux-data-inside-bpf_sanitize_info-container.patch
 bpf-fix-mask-direction-swap-upon-off-reg-sign-change.patch
 bpf-no-need-to-simulate-speculative-domain-for-immediates.patch
 bnxt_en-remove-the-setting-of-dev_port.patch
+kvm-svm-truncate-gpr-value-for-dr-and-cr-accesses-in-64-bit-mode.patch