KVM: arm64: Fix AArch32 register narrowing on userspace write
authorMarc Zyngier <maz@kernel.org>
Fri, 24 May 2024 14:19:54 +0000 (15:19 +0100)
committerMarc Zyngier <maz@kernel.org>
Mon, 27 May 2024 16:45:21 +0000 (17:45 +0100)
commit947051e361d551e0590777080ffc4926190f62f2
treecafb741da4d737ef5ac97088badb3a66a7f89db2
parent1613e604df0cd359cf2a7fbd9be7a0bcfacfabd0
KVM: arm64: Fix AArch32 register narrowing on userspace write

When userspace writes to one of the core registers, we make
sure to narrow the corresponding GPRs if PSTATE indicates
an AArch32 context.

The code tries to check whether the context is EL0 or EL1 so
that it narrows the correct registers. But it does so by checking
the full PSTATE instead of PSTATE.M.

As a consequence, and if we are restoring an AArch32 EL0 context
in a 64bit guest, and that PSTATE has *any* bit set outside of
PSTATE.M, we narrow *all* registers instead of only the first 15,
destroying the 64bit state.

Obviously, this is not something the guest is likely to enjoy.

Correctly masking PSTATE to only evaluate PSTATE.M fixes it.

Fixes: 90c1f934ed71 ("KVM: arm64: Get rid of the AArch32 register mapping code")
Reported-by: Nina Schoetterl-Glausch <nsg@linux.ibm.com>
Cc: stable@vger.kernel.org
Reviewed-by: Nina Schoetterl-Glausch <nsg@linux.ibm.com>
Acked-by: Oliver Upton <oliver.upton@linux.dev>
Link: https://lore.kernel.org/r/20240524141956.1450304-2-maz@kernel.org
Signed-off-by: Marc Zyngier <maz@kernel.org>
arch/arm64/kvm/guest.c