Commit 15861d02 authored by Marc Zyngier's avatar Marc Zyngier Committed by Junhao He
Browse files

KVM: arm64: Fix TRFCR_EL1/PMSCR_EL1 access in hVHE mode 

mainline inclusion
from mainline-v6.9-rc1
commit 9a3bfb27ef65ad41d994765c031ca18217afb058
category: bugfix
bugzilla: https://gitee.com/openeuler/kernel/issues/I8EC9K
CVE: NA

Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id=9a3bfb27ef65ad41d994765c031ca18217afb058



--------------------------------

When running in hVHE mode, EL1 accesses are performed with the EL12
accessor, as we run with HCR_EL2.E2H=1.

Unfortunately, both PMSCR_EL1 and TRFCR_EL1 are used with the
EL1 accessor, meaning that we actually affect the EL2 state. Duh.

Switch to using the {read,write}_sysreg_el1() helpers that will do
the right thing in all circumstances.

Note that the 'Fixes:' tag doesn't represent the point where the bug
was introduced (there is no such point), but the first practical point
where the hVHE feature is usable.

Cc: James Clark <james.clark@arm.com>
Cc: Anshuman Khandual <anshuman.khandual@arm.com>
Fixes: 38cba550 ("KVM: arm64: Force HCR_E2H in guest context when ARM64_KVM_HVHE is set")
Signed-off-by: default avatarMarc Zyngier <maz@kernel.org>
Reviewed-by: default avatarOliver Upton <oliver.upton@linux.dev>
Link: https://lore.kernel.org/r/20240229145417.3606279-1-maz@kernel.org


Signed-off-by: default avatarOliver Upton <oliver.upton@linux.dev>
Signed-off-by: default avatarJunhao He <hejunhao3@huawei.com>
parent 6cc67194

arch/arm64/kvm/hyp/nvhe/debug-sr.c

+6 −6
Original line number Diff line number Diff line
@@ -31,8 +31,8 @@ static void __debug_save_spe(u64 *pmscr_el1) 
		return;



	/* Yes; save the control register and disable data generation */

	*pmscr_el1 = read_sysreg_s(SYS_PMSCR_EL1);

	write_sysreg_s(0, SYS_PMSCR_EL1);

	*pmscr_el1 = read_sysreg_el1(SYS_PMSCR);

	write_sysreg_el1(0, SYS_PMSCR);

	isb();



	/* Now drain all buffered data to memory */
@@ -48,7 +48,7 @@ static void __debug_restore_spe(u64 pmscr_el1) 
	isb();



	/* Re-enable data generation */

	write_sysreg_s(pmscr_el1, SYS_PMSCR_EL1);

	write_sysreg_el1(pmscr_el1, SYS_PMSCR);

}



static void __debug_save_trace(u64 *trfcr_el1)
@@ -63,8 +63,8 @@ static void __debug_save_trace(u64 *trfcr_el1) 
	 * Since access to TRFCR_EL1 is trapped, the guest can't

	 * modify the filtering set by the host.

	 */

	*trfcr_el1 = read_sysreg_s(SYS_TRFCR_EL1);

	write_sysreg_s(0, SYS_TRFCR_EL1);

	*trfcr_el1 = read_sysreg_el1(SYS_TRFCR);

	write_sysreg_el1(0, SYS_TRFCR);

	isb();

	/* Drain the trace buffer to memory */

	tsb_csync();
@@ -76,7 +76,7 @@ static void __debug_restore_trace(u64 trfcr_el1) 
		return;



	/* Restore trace filter controls */

	write_sysreg_s(trfcr_el1, SYS_TRFCR_EL1);

	write_sysreg_el1(trfcr_el1, SYS_TRFCR);

}



void __debug_save_host_buffers_nvhe(struct kvm_vcpu *vcpu)