Patch Detail
get:
Show a patch.
patch:
Update a patch.
put:
Update a patch.
GET /api/patches/2196285/?format=api
{ "id": 2196285, "url": "http://patchwork.ozlabs.org/api/patches/2196285/?format=api", "web_url": "http://patchwork.ozlabs.org/project/kvm-riscv/patch/20260213103557.3207335-2-xujiakai2025@iscas.ac.cn/", "project": { "id": 70, "url": "http://patchwork.ozlabs.org/api/projects/70/?format=api", "name": "Linux KVM RISC-V", "link_name": "kvm-riscv", "list_id": "kvm-riscv.lists.infradead.org", "list_email": "kvm-riscv@lists.infradead.org", "web_url": "", "scm_url": "", "webscm_url": "", "list_archive_url": "http://lists.infradead.org/pipermail/kvm-riscv/", "list_archive_url_format": "", "commit_url_format": "" }, "msgid": "<20260213103557.3207335-2-xujiakai2025@iscas.ac.cn>", "list_archive_url": null, "date": "2026-02-13T10:35:55", "name": "[v7,1/3] RISC-V: KVM: Validate SBI STA shmem alignment in kvm_sbi_ext_sta_set_reg()", "commit_ref": null, "pull_url": null, "state": "new", "archived": false, "hash": "fef7043f13cf1b363ef9248655750ac8e82d2e8e", "submitter": { "id": 92543, "url": "http://patchwork.ozlabs.org/api/people/92543/?format=api", "name": "Jiakai Xu", "email": "xujiakai2025@iscas.ac.cn" }, "delegate": null, "mbox": "http://patchwork.ozlabs.org/project/kvm-riscv/patch/20260213103557.3207335-2-xujiakai2025@iscas.ac.cn/mbox/", "series": [ { "id": 492078, "url": "http://patchwork.ozlabs.org/api/series/492078/?format=api", "web_url": "http://patchwork.ozlabs.org/project/kvm-riscv/list/?series=492078", "date": "2026-02-13T10:35:56", "name": "RISC-V: KVM: Validate SBI STA shmem alignment", "version": 7, "mbox": "http://patchwork.ozlabs.org/series/492078/mbox/" } ], "comments": "http://patchwork.ozlabs.org/api/patches/2196285/comments/", "check": "pending", "checks": "http://patchwork.ozlabs.org/api/patches/2196285/checks/", "tags": {}, "related": [], "headers": { "Return-Path": "\n <kvm-riscv-bounces+incoming=patchwork.ozlabs.org@lists.infradead.org>", "X-Original-To": "incoming@patchwork.ozlabs.org", "Delivered-To": "patchwork-incoming@legolas.ozlabs.org", "Authentication-Results": [ "legolas.ozlabs.org;\n\tdkim=pass (2048-bit key;\n secure) header.d=lists.infradead.org header.i=@lists.infradead.org\n header.a=rsa-sha256 header.s=bombadil.20210309 header.b=TEm7jeSf;\n\tdkim-atps=neutral", "legolas.ozlabs.org;\n spf=none (no SPF record) smtp.mailfrom=lists.infradead.org\n (client-ip=2607:7c80:54:3::133; helo=bombadil.infradead.org;\n envelope-from=kvm-riscv-bounces+incoming=patchwork.ozlabs.org@lists.infradead.org;\n receiver=patchwork.ozlabs.org)" ], "Received": [ "from bombadil.infradead.org (bombadil.infradead.org\n [IPv6:2607:7c80:54:3::133])\n\t(using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits)\n\t key-exchange x25519 server-signature ECDSA (secp384r1) server-digest SHA384)\n\t(No client certificate requested)\n\tby legolas.ozlabs.org (Postfix) with ESMTPS id 4fC7rt22qZz1xxc\n\tfor <incoming@patchwork.ozlabs.org>; Fri, 13 Feb 2026 21:36:57 +1100 (AEDT)", "from localhost ([::1] helo=bombadil.infradead.org)\n\tby bombadil.infradead.org with esmtp (Exim 4.98.2 #2 (Red Hat Linux))\n\tid 1vqqXf-00000003KKO-3gn9;\n\tFri, 13 Feb 2026 10:36:55 +0000", "from smtp25.cstnet.cn ([159.226.251.25] helo=cstnet.cn)\n\tby bombadil.infradead.org with esmtps (Exim 4.98.2 #2 (Red Hat Linux))\n\tid 1vqqXY-00000003KDg-31ye;\n\tFri, 13 Feb 2026 10:36:52 +0000", "from fric.. (unknown [210.73.43.101])\n\tby APP-05 (Coremail) with SMTP id zQCowAC3RgqO_o5pQN4uCA--.25463S3;\n\tFri, 13 Feb 2026 18:36:00 +0800 (CST)" ], "DKIM-Signature": "v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed;\n\td=lists.infradead.org; s=bombadil.20210309; h=Sender:\n\tContent-Transfer-Encoding:Content-Type:List-Subscribe:List-Help:List-Post:\n\tList-Archive:List-Unsubscribe:List-Id:MIME-Version:References:In-Reply-To:\n\tMessage-Id:Date:Subject:Cc:To:From:Reply-To:Content-ID:Content-Description:\n\tResent-Date:Resent-From:Resent-Sender:Resent-To:Resent-Cc:Resent-Message-ID:\n\tList-Owner; bh=9rjH/YhYWwB43QNCp5cORfmS9AfknaXGVlMIqDzm85w=; b=TEm7jeSfHGRwRZ\n\ty9ZXAVnhdfCk9mgD1y6Zxx2j38NiNcA2Eix0HfMs4XyC/MqZkVOEH4WmMp7fbUP7BIeKXJdqWwC5p\n\tVhOxUtal4WhOwaTIlobarcFQ3nt1L41MmTU2pLoiUVcltN76gR6bxplODkXvaxtabhB6ryAE6yFde\n\tEOtT7EmcHwEYsla0t2Q97rUHVmygXigHtWmVXPDz7+TR6sUKobZdBPmt6fqp5avJZTLhV7IC6fzhn\n\tk3gg7Mzp5Ju8uX5KQVtWg8QSk22Rglqg80UOKryccGPLD1/IVfNGqOiADhTCWlWNIvM+dUukd5sZp\n\tNwR/jgjxasZGYrPPRHfA==;", "From": "Jiakai Xu <xujiakai2025@iscas.ac.cn>", "To": "linux-kernel@vger.kernel.org,\n\tkvm@vger.kernel.org,\n\tkvm-riscv@lists.infradead.org,\n\tlinux-riscv@lists.infradead.org,\n\tlinux-kselftest@vger.kernel.org", "Cc": "Anup Patel <anup@brainfault.org>,\n\tAtish Patra <atish.patra@linux.dev>,\n\tPaul Walmsley <pjw@kernel.org>,\n\tPalmer Dabbelt <palmer@dabbelt.com>,\n\tAlbert Ou <aou@eecs.berkeley.edu>,\n\tAlexandre Ghiti <alex@ghiti.fr>,\n\tAndrew Jones <ajones@ventanamicro.com>,\n\tPaolo Bonzini <pbonzini@redhat.com>,\n\tShuah Khan <shuah@kernel.org>,\n\tJiakai Xu <xujiakai2025@iscas.ac.cn>,\n\tJiakai Xu <jiakaiPeanut@gmail.com>,\n\tAndrew Jones <andrew.jones@oss.qualcomm.com>", "Subject": "[PATCH v7 1/3] RISC-V: KVM: Validate SBI STA shmem alignment in\n kvm_sbi_ext_sta_set_reg()", "Date": "Fri, 13 Feb 2026 10:35:55 +0000", "Message-Id": "<20260213103557.3207335-2-xujiakai2025@iscas.ac.cn>", "X-Mailer": "git-send-email 2.34.1", "In-Reply-To": "<20260213103557.3207335-1-xujiakai2025@iscas.ac.cn>", "References": "<20260213103557.3207335-1-xujiakai2025@iscas.ac.cn>", "MIME-Version": "1.0", "X-CM-TRANSID": "zQCowAC3RgqO_o5pQN4uCA--.25463S3", "X-Coremail-Antispam": "1UD129KBjvJXoWxXF4xXFyfKw4fZrW5Cry7trb_yoWrJF1UpF\n\t42kw15ZrW8tFZ2k39rZw4vgr15u3ykKr1jqFy3W34xZF4kta4Yyrna93y7ZF98JryvvFWI\n\tyF10vF1DCw45AaDanT9S1TB71UUUUU7qnTZGkaVYY2UrUUUUjbIjqfuFe4nvWSU5nxnvy2\n\t9KBjDU0xBIdaVrnRJUUUHYb7Iv0xC_Kw4lb4IE77IF4wAFF20E14v26rWj6s0DM7CY07I2\n\t0VC2zVCF04k26cxKx2IYs7xG6rWj6s0DM7CIcVAFz4kK6r1j6r18M28IrcIa0xkI8VA2jI\n\t8067AKxVWUGwA2048vs2IY020Ec7CjxVAFwI0_Gr0_Xr1l8cAvFVAK0II2c7xJM28CjxkF\n\t64kEwVA0rcxSw2x7M28EF7xvwVC0I7IYx2IY67AKxVWUCVW8JwA2z4x0Y4vE2Ix0cI8IcV\n\tCY1x0267AKxVW8JVWxJwA2z4x0Y4vEx4A2jsIE14v26rxl6s0DM28EF7xvwVC2z280aVCY\n\t1x0267AKxVW0oVCq3wAac4AC62xK8xCEY4vEwIxC4wAS0I0E0xvYzxvE52x082IY62kv04\n\t87Mc02F40EFcxC0VAKzVAqx4xG6I80ewAv7VC0I7IYx2IY67AKxVWUJVWUGwAv7VC2z280\n\taVAFwI0_Jr0_Gr1lOx8S6xCaFVCjc4AY6r1j6r4UM4x0Y48IcxkI7VAKI48JM4x0x7Aq67\n\tIIx4CEVc8vx2IErcIFxwACI402YVCY1x02628vn2kIc2xKxwCY1x0262kKe7AKxVW8ZVWr\n\tXwCF04k20xvY0x0EwIxGrwCFx2IqxVCFs4IE7xkEbVWUJVW8JwC20s026c02F40E14v26r\n\t1j6r18MI8I3I0E7480Y4vE14v26r106r1rMI8E67AF67kF1VAFwI0_GFv_WrylIxkGc2Ij\n\t64vIr41lIxAIcVC0I7IYx2IY67AKxVWUJVWUCwCI42IY6xIIjxv20xvEc7CjxVAFwI0_Gr\n\t0_Cr1lIxAIcVCF04k26cxKx2IYs7xG6r1j6r1xMIIF0xvEx4A2jsIE14v26r1j6r4UMIIF\n\t0xvEx4A2jsIEc7CjxVAFwI0_Gr0_Gr1UYxBIdaVFxhVjvjDU0xZFpf9x07je-erUUUUU=", "X-Originating-IP": "[210.73.43.101]", "X-CM-SenderInfo": "50xmxthndljiysv6x2xfdvhtffof0/1tbiCRARCWmOigf8bAAAs7", "X-CRM114-Version": "20100106-BlameMichelson ( TRE 0.8.0 (BSD) ) MR-646709E3 ", "X-CRM114-CacheID": "sfid-20260213_023649_133558_3B6AF693 ", "X-CRM114-Status": "GOOD ( 15.47 )", "X-Spam-Score": "-1.9 (-)", "X-Spam-Report": "Spam detection software,\n running on the system \"bombadil.infradead.org\",\n has NOT identified this incoming email as spam. The original\n message has been attached to this so you can view it or label\n similar future email. If you have any questions, see\n the administrator of that system for details.\n Content preview: The RISC-V SBI Steal-Time Accounting (STA) extension\n requires\n the shared memory physical address to be 64-byte aligned,\n or set to all-ones\n to explicitly disable steal-time accounting. KVM exposes the SBI STA\n shared\n memory configuration to userspace via KVM_SET_ONE_REG. However,\n the current\n implementation of kvm_sbi_ext_sta_set_reg() does not validate the\n alignment\n of the configured [...]\n Content analysis details: (-1.9 points, 5.0 required)\n pts rule name description\n ---- ----------------------\n --------------------------------------------------\n 0.0 RCVD_IN_VALIDITY_CERTIFIED_BLOCKED RBL: ADMINISTRATOR NOTICE: The\n query to Validity was blocked. See\n https://knowledge.validity.com/hc/en-us/articles/20961730681243\n for more information.\n [159.226.251.25 listed in\n sa-trusted.bondedsender.org]\n 0.0 RCVD_IN_VALIDITY_RPBL_BLOCKED RBL: ADMINISTRATOR NOTICE: The query to\n Validity was blocked. See\n https://knowledge.validity.com/hc/en-us/articles/20961730681243\n for more information.\n [159.226.251.25 listed in\n bl.score.senderscore.com]\n 0.0 RCVD_IN_VALIDITY_SAFE_BLOCKED RBL: ADMINISTRATOR NOTICE: The query to\n Validity was blocked. See\n https://knowledge.validity.com/hc/en-us/articles/20961730681243\n for more information.\n [159.226.251.25 listed in sa-accredit.habeas.com]\n -0.0 RCVD_IN_DNSWL_NONE RBL: Sender listed at https://www.dnswl.org/, no\n trust\n [159.226.251.25 listed in list.dnswl.org]\n -0.0 SPF_HELO_PASS SPF: HELO matches SPF record\n -0.0 SPF_PASS SPF: sender matches SPF record\n -1.9 BAYES_00 BODY: Bayes spam probability is 0 to 1%\n [score: 0.0000]", "X-BeenThere": "kvm-riscv@lists.infradead.org", "X-Mailman-Version": "2.1.34", "Precedence": "list", "List-Id": "<kvm-riscv.lists.infradead.org>", "List-Unsubscribe": "<http://lists.infradead.org/mailman/options/kvm-riscv>,\n <mailto:kvm-riscv-request@lists.infradead.org?subject=unsubscribe>", "List-Archive": "<http://lists.infradead.org/pipermail/kvm-riscv/>", "List-Post": "<mailto:kvm-riscv@lists.infradead.org>", "List-Help": "<mailto:kvm-riscv-request@lists.infradead.org?subject=help>", "List-Subscribe": "<http://lists.infradead.org/mailman/listinfo/kvm-riscv>,\n <mailto:kvm-riscv-request@lists.infradead.org?subject=subscribe>", "Content-Type": "text/plain; charset=\"us-ascii\"", "Content-Transfer-Encoding": "7bit", "Sender": "\"kvm-riscv\" <kvm-riscv-bounces@lists.infradead.org>", "Errors-To": "kvm-riscv-bounces+incoming=patchwork.ozlabs.org@lists.infradead.org" }, "content": "The RISC-V SBI Steal-Time Accounting (STA) extension requires the shared\nmemory physical address to be 64-byte aligned, or set to all-ones to\nexplicitly disable steal-time accounting.\n\nKVM exposes the SBI STA shared memory configuration to userspace via\nKVM_SET_ONE_REG. However, the current implementation of\nkvm_sbi_ext_sta_set_reg() does not validate the alignment of the configured\nshared memory address. As a result, userspace can install a misaligned\nshared memory address that violates the SBI specification.\n\nSuch an invalid configuration may later reach runtime code paths that\nassume a valid and properly aligned shared memory region. In particular,\nKVM_RUN can trigger the following WARN_ON in\nkvm_riscv_vcpu_record_steal_time():\n\n WARNING: arch/riscv/kvm/vcpu_sbi_sta.c:49 at\n kvm_riscv_vcpu_record_steal_time\n\nWARN_ON paths are not expected to be reachable during normal runtime\nexecution, and may result in a kernel panic when panic_on_warn is enabled.\n\nFix this by validating the computed shared memory GPA at the\nKVM_SET_ONE_REG boundary. A temporary GPA is constructed and checked\nbefore committing it to vcpu->arch.sta.shmem. The validation allows\neither a 64-byte aligned GPA or INVALID_GPA (all-ones), which disables\nSTA as defined by the SBI specification.\n\nThis prevents invalid userspace state from reaching runtime code paths\nthat assume SBI STA invariants and avoids unexpected WARN_ON behavior.\n\nFixes: f61ce890b1f074 (\"RISC-V: KVM: Add support for SBI STA registers\")\nSigned-off-by: Jiakai Xu <xujiakai2025@iscas.ac.cn>\nSigned-off-by: Jiakai Xu <jiakaiPeanut@gmail.com>\nReviewed-by: Andrew Jones <andrew.jones@oss.qualcomm.com>\n---\nV5 -> V6: Initialized new_shmem to INVALID_GPA as suggested.\nV4 -> V5: Added parentheses to function name in subject.\nV3 -> V4: Declared new_shmem at the top of kvm_sbi_ext_sta_set_reg().\n Initialized new_shmem to 0 instead of vcpu->arch.sta.shmem.\n Added blank lines per review feedback.\nV2 -> V3: Added parentheses to function name in subject.\nV1 -> V2: Added Fixes tag.\n---\n arch/riscv/kvm/vcpu_sbi_sta.c | 16 +++++++++++-----\n 1 file changed, 11 insertions(+), 5 deletions(-)", "diff": "diff --git a/arch/riscv/kvm/vcpu_sbi_sta.c b/arch/riscv/kvm/vcpu_sbi_sta.c\nindex afa0545c3bcfc..3b834709b429f 100644\n--- a/arch/riscv/kvm/vcpu_sbi_sta.c\n+++ b/arch/riscv/kvm/vcpu_sbi_sta.c\n@@ -181,6 +181,7 @@ static int kvm_sbi_ext_sta_set_reg(struct kvm_vcpu *vcpu, unsigned long reg_num,\n \t\t\t\t unsigned long reg_size, const void *reg_val)\n {\n \tunsigned long value;\n+\tgpa_t new_shmem = INVALID_GPA;\n \n \tif (reg_size != sizeof(unsigned long))\n \t\treturn -EINVAL;\n@@ -191,18 +192,18 @@ static int kvm_sbi_ext_sta_set_reg(struct kvm_vcpu *vcpu, unsigned long reg_num,\n \t\tif (IS_ENABLED(CONFIG_32BIT)) {\n \t\t\tgpa_t hi = upper_32_bits(vcpu->arch.sta.shmem);\n \n-\t\t\tvcpu->arch.sta.shmem = value;\n-\t\t\tvcpu->arch.sta.shmem |= hi << 32;\n+\t\t\tnew_shmem = value;\n+\t\t\tnew_shmem |= hi << 32;\n \t\t} else {\n-\t\t\tvcpu->arch.sta.shmem = value;\n+\t\t\tnew_shmem = value;\n \t\t}\n \t\tbreak;\n \tcase KVM_REG_RISCV_SBI_STA_REG(shmem_hi):\n \t\tif (IS_ENABLED(CONFIG_32BIT)) {\n \t\t\tgpa_t lo = lower_32_bits(vcpu->arch.sta.shmem);\n \n-\t\t\tvcpu->arch.sta.shmem = ((gpa_t)value << 32);\n-\t\t\tvcpu->arch.sta.shmem |= lo;\n+\t\t\tnew_shmem = ((gpa_t)value << 32);\n+\t\t\tnew_shmem |= lo;\n \t\t} else if (value != 0) {\n \t\t\treturn -EINVAL;\n \t\t}\n@@ -211,6 +212,11 @@ static int kvm_sbi_ext_sta_set_reg(struct kvm_vcpu *vcpu, unsigned long reg_num,\n \t\treturn -ENOENT;\n \t}\n \n+\tif (new_shmem != INVALID_GPA && !IS_ALIGNED(new_shmem, 64))\n+\t\treturn -EINVAL;\n+\n+\tvcpu->arch.sta.shmem = new_shmem;\n+\n \treturn 0;\n }\n \n", "prefixes": [ "v7", "1/3" ] }