@@ -447,6 +447,26 @@ static inline bool fixup_guest_exit(struct kvm_vcpu *vcpu, u64 *exit_code)
write_sysreg_el2(read_sysreg_el2(SYS_ELR) - 4, SYS_ELR);
}
+ /*
+ * Protected VMs are not allowed to run in AArch32. The check below is
+ * based on the one in kvm_arch_vcpu_ioctl_run().
+ * The ARMv8 architecture doesn't give the hypervisor a mechanism to
+ * prevent a guest from dropping to AArch32 EL0 if implemented by the
+ * CPU. If the hypervisor spots a guest in such a state ensure it is
+ * handled, and don't trust the host to spot or fix it.
+ */
+ if (unlikely(is_nvhe_hyp_code() &&
+ kvm_vm_is_protected(kern_hyp_va(vcpu->kvm)) &&
+ vcpu_mode_is_32bit(vcpu))) {
+ /*
+ * As we have caught the guest red-handed, decide that it isn't
+ * fit for purpose anymore by making the vcpu invalid.
+ */
+ vcpu->arch.target = -1;
+ *exit_code = ARM_EXCEPTION_IL;
+ goto exit;
+ }
+
/*
* We're using the raw exception code in order to only process
* the trap if no SError is pending. We will come back to the
Protected KVM does not support protected AArch32 guests. However, it is possible for the guest to force run AArch32, potentially causing problems. Add an extra check so that if the hypervisor catches the guest doing that, it can prevent the guest from running again by resetting vcpu->arch.target and returning ARM_EXCEPTION_IL. Adapted from commit 22f553842b14 ("KVM: arm64: Handle Asymmetric AArch32 systems") Signed-off-by: Fuad Tabba <tabba@google.com> --- arch/arm64/kvm/hyp/include/hyp/switch.h | 20 ++++++++++++++++++++ 1 file changed, 20 insertions(+)