Commit 00d5101b authored by Alexandru Elisei's avatar Alexandru Elisei Committed by Marc Zyngier
Browse files

KVM: arm64: Return early from read_id_reg() if register is RAZ 



If read_id_reg() is called for an ID register which is Read-As-Zero (RAZ),
it initializes the return value to zero, then goes through a list of
registers which require special handling before returning the final value.

By not returning as soon as it checks that the register should be RAZ, the
function creates the opportunity for bugs, if, for example, a patch changes
a register to RAZ (like has happened with PMSWINC_EL0 in commit
11663111), but doesn't remove the special handling from read_id_reg();
or if a register is RAZ in certain situations, but readable in others.

Return early to make it impossible for a RAZ register to be anything other
than zero.

Reviewed-by: default avatarAndrew Jones <drjones@redhat.com>
Signed-off-by: default avatarAlexandru Elisei <alexandru.elisei@arm.com>
Signed-off-by: default avatarMarc Zyngier <maz@kernel.org>
Link: https://lore.kernel.org/r/20211011105840.155815-2-alexandru.elisei@arm.com
parent 9e1ff307

arch/arm64/kvm/sys_regs.c

+6 −1
Original line number Diff line number Diff line
@@ -1064,7 +1064,12 @@ static u64 read_id_reg(const struct kvm_vcpu *vcpu, 
		struct sys_reg_desc const *r, bool raz)

{

	u32 id = reg_to_encoding(r);

	u64 val = raz ? 0 : read_sanitised_ftr_reg(id);

	u64 val;



	if (raz)

		return 0;



	val = read_sanitised_ftr_reg(id);



	switch (id) {

	case SYS_ID_AA64PFR0_EL1: