From patchwork Tue Mar 3 14:19:43 2026 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 8bit X-Patchwork-Submitter: Lukas Gerlach X-Patchwork-Id: 2204288 Return-Path: X-Original-To: incoming@patchwork.ozlabs.org Delivered-To: patchwork-incoming@legolas.ozlabs.org Authentication-Results: legolas.ozlabs.org; dkim=pass (2048-bit key; secure) header.d=lists.infradead.org header.i=@lists.infradead.org header.a=rsa-sha256 header.s=bombadil.20210309 header.b=xLlFwpbE; dkim=fail reason="signature verification failed" (2048-bit key; unprotected) header.d=cispa.de header.i=@cispa.de header.a=rsa-sha256 header.s=2023-rsa header.b=RnSE4LFc; dkim-atps=neutral Authentication-Results: legolas.ozlabs.org; spf=none (no SPF record) smtp.mailfrom=lists.infradead.org (client-ip=2607:7c80:54:3::133; helo=bombadil.infradead.org; envelope-from=kvm-riscv-bounces+incoming=patchwork.ozlabs.org@lists.infradead.org; receiver=patchwork.ozlabs.org) Received: from bombadil.infradead.org (bombadil.infradead.org [IPv6:2607:7c80:54:3::133]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange x25519 server-signature ECDSA (secp384r1) server-digest SHA384) (No client certificate requested) by legolas.ozlabs.org (Postfix) with ESMTPS id 4fQHxz74Fwz1xwp for ; Wed, 04 Mar 2026 01:20:07 +1100 (AEDT) DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=lists.infradead.org; s=bombadil.20210309; h=Sender: Content-Transfer-Encoding:Content-Type:List-Subscribe:List-Help:List-Post: List-Archive:List-Unsubscribe:List-Id:CC:To:In-Reply-To:References:Message-ID :MIME-Version:Subject:Date:From:Reply-To:Content-ID:Content-Description: Resent-Date:Resent-From:Resent-Sender:Resent-To:Resent-Cc:Resent-Message-ID: List-Owner; bh=FXiSrblvFHpc/uYsd1DGCM/iCUjdg0vOXDPFey7f4KM=; b=xLlFwpbERqOL/k JcOLt2lB9wg7j6jNX50aZRFY+2ApOTTTodbjZofoS8axIM5YcZ2S7npDbf132M4q0CfEvqIRu0TC5 lRMnhCP5HVzj3CaaoRmL9CFKJ3auINnIoj94b+GeVNTViwlxHRX5a4KzAAq97aXmH8MwL3hZd1EPp iI4REEuLGSt/Nf1IfHHTvtuCwZzi3aRbalC99bPGtz9CuyS4QfW2GAp8UBUnq/ADUfc0DdYidz3Z5 L3wYY8f0KlusrJhl6E8CdzmqoZ1SBMsfK+5JnMjc+EvD78ro85kkAN1ntO0BVtoBczJ6dg8H88RSZ iSPbeMZ+BUJgg05aFl3A==; Received: from localhost ([::1] helo=bombadil.infradead.org) by bombadil.infradead.org with esmtp (Exim 4.98.2 #2 (Red Hat Linux)) id 1vxQbW-0000000FJIo-1YIm; Tue, 03 Mar 2026 14:20:06 +0000 Received: from mx-2023-1.gwdg.de ([134.76.10.21]) by bombadil.infradead.org with esmtps (Exim 4.98.2 #2 (Red Hat Linux)) id 1vxQbS-0000000FJD2-1Feh; Tue, 03 Mar 2026 14:20:04 +0000 DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=cispa.de; s=2023-rsa; h=CC:To:In-Reply-To:References:Message-ID: Content-Transfer-Encoding:Content-Type:MIME-Version:Subject:Date:From:Sender: Reply-To:Content-ID:Content-Description:Resent-Date:Resent-From:Resent-Sender :Resent-To:Resent-Cc:Resent-Message-ID:List-Id:List-Help:List-Unsubscribe: List-Subscribe:List-Post:List-Owner:List-Archive; bh=evQ738m5JttBj+gPIuFYJobVsWsJ7zXSUvfhaD0owBA=; b=RnSE4LFcCzWkOaKFYLcMgodKeL Ny0/rCrW5yuTNCZmfkPlfhGNn6O3Oq53za1rYD+fyUXyFVgGcg7LjObOmkBZwXfQJI5bMTGKJG+IL mUjZ/kJdFu19rdoPI0RJZApaeuGy0bMX6mJUV2LJaJuPl02DPqI6uf44WHU1yMwFp7jYL7wfeDqFc mX3TX+1QS99jcpPjpNXDymDNzazISQ9Ap1iM51O8H40YOwTadTRIHRiCfGU0WUswqi2zn4eEXlJXK wx1eALBvdrwpwoCENCoj5jPKtzT83fXTm4EP1drUOxrZRjm+6ItM+5oXuO6rLAux9mrf63tjXhWj0 Xsy/BeBA==; Received: from mailer.gwdg.de ([134.76.10.26]:33561) by mailer.gwdg.de with esmtp (GWDG Mailer) (envelope-from ) id 1vxQb9-00850W-0W; Tue, 03 Mar 2026 15:19:43 +0100 Received: from mbx19-sub-05.um.gwdg.de ([10.108.142.70] helo=email.gwdg.de) by mailer.gwdg.de with esmtps (TLS1.2:ECDHE-RSA-AES128-GCM-SHA256:128) (GWDG Mailer) (envelope-from ) id 1vxQb9-0006kf-2q; Tue, 03 Mar 2026 15:19:43 +0100 Received: from lukass-mbp-7.lan (10.250.9.200) by MBX19-SUB-05.um.gwdg.de (10.108.142.70) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256) id 15.2.2562.37; Tue, 3 Mar 2026 15:19:43 +0100 From: Lukas Gerlach Date: Tue, 3 Mar 2026 15:19:43 +0100 Subject: [PATCH v2 3/4] KVM: riscv: Fix Spectre-v1 in floating-point register access MIME-Version: 1.0 Message-ID: <20260303-kvm-riscv-spectre-v1-v2-3-192caab8e0dc@cispa.de> References: <20260303-kvm-riscv-spectre-v1-v2-0-192caab8e0dc@cispa.de> In-Reply-To: <20260303-kvm-riscv-spectre-v1-v2-0-192caab8e0dc@cispa.de> To: Anup Patel , Atish Patra , Paul Walmsley , Palmer Dabbelt , Albert Ou , Alexandre Ghiti , Andrew Jones CC: =?utf-8?b?UmFkaW0gS3LEjW3DocWZ?= , , , , , Daniel Weber , Michael Schwarz , Marton Bognar , Jo Van Bulck , Lukas Gerlach X-Mailer: b4 0.14.3 X-Developer-Signature: v=1; a=openpgp-sha256; l=2605; i=lukas.gerlach@cispa.de; h=from:subject:message-id; bh=R92BAr2kqx5spiyvOG2j2jtmK0XMGCxxNze/Hhxk7C0=; b=owGbwMvMwCGWoTIjqP/42kTG02pJDJnL3v71qeE88bRvtcBki9R24ekFUhNfzZf4L3vS+7Zs2 v6AJZdud5SyMIhxMMiKKbJMFXzN2LfHgScp8/A5mDmsTCBDGLg4BWAibCcY/or0qoSYX/jy3HHH Rb0gc+aNj6RdD3z0WJI17dwvo7I/J14z/NNg+bFIXtg6PfBLxKKXH7zmfVz98tG6misylzYXPpQ 7tocDAA== X-Developer-Key: i=lukas.gerlach@cispa.de; a=openpgp; fpr=9511EB018EBC400C6269C3CE682498528FC7AD61 X-Originating-IP: [10.250.9.200] X-ClientProxiedBy: MBX19-SUB-05.um.gwdg.de (10.108.142.70) To MBX19-SUB-05.um.gwdg.de (10.108.142.70) X-Virus-Scanned: (clean) by clamav X-Spam-Level: - X-CRM114-Version: 20100106-BlameMichelson ( TRE 0.8.0 (BSD) ) MR-646709E3 X-CRM114-CacheID: sfid-20260303_062002_346240_A34F0208 X-CRM114-Status: UNSURE ( 8.33 ) X-CRM114-Notice: Please train this message. X-Spam-Score: -2.3 (--) X-Spam-Report: =?unknown-8bit?q?Spam_detection_software=2C_running_on_the_sy?= =?unknown-8bit?q?stem_=22bombadil=2Einfradead=2Eorg=22=2C?= =?unknown-8bit?q?_has_NOT_identified_this_incoming_email_as_spam=2E__The_ori?= =?unknown-8bit?q?ginal?= =?unknown-8bit?q?_message_has_been_attached_to_this_so_you_can_view_it_or_la?= =?unknown-8bit?q?bel?= =?unknown-8bit?q?_similar_future_email=2E__If_you_have_any_questions=2C_see?= =?unknown-8bit?q?_the_administrator_of_that_system_for_details=2E?= =?unknown-8bit?q?_?= =?unknown-8bit?q?_Content_preview=3A__User-controlled_indices_are_used_to_in?= =?unknown-8bit?q?dex_into_floating-point?= =?unknown-8bit?q?_registers=2E_Sanitize_them_with_array=5Findex=5Fnospec=28?= =?unknown-8bit?q?=29_to_prevent_speculative?= =?unknown-8bit?q?_out-of-bounds_access=2E_Reviewed-by=3A_Radim_Kr=C4=8Dm=C3?= =?unknown-8bit?q?=A1=C5=99_=3Cradim=2Ekrcmar=40oss=2Equalcomm=2Ecom=3E?= =?unknown-8bit?q?_Signed-off-by=3A_Lukas_Gerlach_=3Clukas=2Egerlach=40cispa?= =?unknown-8bit?q?=2Ede=3E_---_arch/riscv/kvm/vcpu=5Ffp=2Ec?= =?unknown-8bit?q?_=7C_17_+++++++++++++----_1_file_changed=2C_13_insertions?= =?unknown-8bit?q?=28+=29=2C_=5B=2E=2E=2E=5D_?= =?unknown-8bit?q?_?= =?unknown-8bit?q?_Content_analysis_details=3A___=28-2=2E3_points=2C_5=2E0_re?= =?unknown-8bit?q?quired=29?= =?unknown-8bit?q?_?= =?unknown-8bit?q?_pts_rule_name______________description?= =?unknown-8bit?q?_----_----------------------_------------------------------?= =?unknown-8bit?q?--------------------?= =?unknown-8bit?q?_-2=2E3_RCVD=5FIN=5FDNSWL=5FMED______RBL=3A_Sender_listed_a?= =?unknown-8bit?q?t_https=3A//www=2Ednswl=2Eorg/=2C?= =?unknown-8bit?q?_medium_trust?= =?unknown-8bit?q?_=5B134=2E76=2E10=2E21_listed_in_list=2Ednswl=2Eorg=5D?= =?unknown-8bit?q?_0=2E7_RCVD=5FIN=5FVALIDITY=5FCERTIFIED=5FBLOCKED_RBL=3A_AD?= =?unknown-8bit?q?MINISTRATOR_NOTICE=3A_The?= =?unknown-8bit?q?_query_to_Validity_was_blocked=2E__See?= =?unknown-8bit?q?_https=3A//knowledge=2Evalidity=2Ecom/hc/en-us/articles/209?= =?unknown-8bit?q?61730681243?= =?unknown-8bit?q?_for_more_information=2E?= =?unknown-8bit?q?_=5B134=2E76=2E10=2E21_listed_in_sa-trusted=2Ebondedsender?= =?unknown-8bit?q?=2Eorg=5D?= =?unknown-8bit?q?_0=2E3_RCVD=5FIN=5FVALIDITY=5FRPBL=5FBLOCKED_RBL=3A_ADMINIS?= =?unknown-8bit?q?TRATOR_NOTICE=3A_The_query_to?= =?unknown-8bit?q?_Validity_was_blocked=2E__See?= =?unknown-8bit?q?_https=3A//knowledge=2Evalidity=2Ecom/hc/en-us/articles/209?= =?unknown-8bit?q?61730681243?= =?unknown-8bit?q?_for_more_information=2E?= =?unknown-8bit?q?_=5B134=2E76=2E10=2E21_listed_in_bl=2Escore=2Esenderscore?= =?unknown-8bit?q?=2Ecom=5D?= =?unknown-8bit?q?_1=2E1_RCVD=5FIN=5FVALIDITY=5FSAFE=5FBLOCKED_RBL=3A_ADMINIS?= =?unknown-8bit?q?TRATOR_NOTICE=3A_The_query_to?= =?unknown-8bit?q?_Validity_was_blocked=2E__See?= =?unknown-8bit?q?_https=3A//knowledge=2Evalidity=2Ecom/hc/en-us/articles/209?= =?unknown-8bit?q?61730681243?= =?unknown-8bit?q?_for_more_information=2E?= =?unknown-8bit?q?_=5B134=2E76=2E10=2E21_listed_in_sa-accredit=2Ehabeas=2Ecom?= =?unknown-8bit?q?=5D?= =?unknown-8bit?q?_0=2E0_SPF=5FHELO=5FNONE__________SPF=3A_HELO_does_not_publ?= =?unknown-8bit?q?ish_an_SPF_Record?= =?unknown-8bit?q?_-0=2E0_SPF=5FPASS_______________SPF=3A_sender_matches_SPF_?= =?unknown-8bit?q?record?= =?unknown-8bit?q?_-0=2E1_DKIM=5FVALID=5FAU__________Message_has_a_valid_DKIM?= =?unknown-8bit?q?_or_DK_signature_from_author=27s?= =?unknown-8bit?q?_domain?= =?unknown-8bit?q?_0=2E1_DKIM=5FSIGNED____________Message_has_a_DKIM_or_DK_si?= =?unknown-8bit?q?gnature=2C_not_necessarily_valid?= =?unknown-8bit?q?_-0=2E1_DKIM=5FVALID_____________Message_has_at_least_one_v?= =?unknown-8bit?q?alid_DKIM_or_DK_signature?= =?unknown-8bit?q?_-0=2E1_DKIM=5FVALID=5FEF__________Message_has_a_valid_DKIM?= =?unknown-8bit?q?_or_DK_signature_from?= =?unknown-8bit?q?_envelope-from_domain?= =?unknown-8bit?q?_-1=2E9_BAYES=5F00_______________BODY=3A_Bayes_spam_probabi?= =?unknown-8bit?q?lity_is_0_to_1=25?= =?unknown-8bit?q?_=5Bscore=3A_0=2E0000=5D?= X-BeenThere: kvm-riscv@lists.infradead.org X-Mailman-Version: 2.1.34 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Sender: "kvm-riscv" Errors-To: kvm-riscv-bounces+incoming=patchwork.ozlabs.org@lists.infradead.org User-controlled indices are used to index into floating-point registers. Sanitize them with array_index_nospec() to prevent speculative out-of-bounds access. Reviewed-by: Radim Krčmář Signed-off-by: Lukas Gerlach --- arch/riscv/kvm/vcpu_fp.c | 17 +++++++++++++---- 1 file changed, 13 insertions(+), 4 deletions(-) diff --git a/arch/riscv/kvm/vcpu_fp.c b/arch/riscv/kvm/vcpu_fp.c index 030904d82b58..bd5a9e7e7165 100644 --- a/arch/riscv/kvm/vcpu_fp.c +++ b/arch/riscv/kvm/vcpu_fp.c @@ -10,6 +10,7 @@ #include #include #include +#include #include #include @@ -93,9 +94,11 @@ int kvm_riscv_vcpu_get_reg_fp(struct kvm_vcpu *vcpu, if (reg_num == KVM_REG_RISCV_FP_F_REG(fcsr)) reg_val = &cntx->fp.f.fcsr; else if ((KVM_REG_RISCV_FP_F_REG(f[0]) <= reg_num) && - reg_num <= KVM_REG_RISCV_FP_F_REG(f[31])) + reg_num <= KVM_REG_RISCV_FP_F_REG(f[31])) { + reg_num = array_index_nospec(reg_num, + ARRAY_SIZE(cntx->fp.f.f)); reg_val = &cntx->fp.f.f[reg_num]; - else + } else return -ENOENT; } else if ((rtype == KVM_REG_RISCV_FP_D) && riscv_isa_extension_available(vcpu->arch.isa, d)) { @@ -107,6 +110,8 @@ int kvm_riscv_vcpu_get_reg_fp(struct kvm_vcpu *vcpu, reg_num <= KVM_REG_RISCV_FP_D_REG(f[31])) { if (KVM_REG_SIZE(reg->id) != sizeof(u64)) return -EINVAL; + reg_num = array_index_nospec(reg_num, + ARRAY_SIZE(cntx->fp.d.f)); reg_val = &cntx->fp.d.f[reg_num]; } else return -ENOENT; @@ -138,9 +143,11 @@ int kvm_riscv_vcpu_set_reg_fp(struct kvm_vcpu *vcpu, if (reg_num == KVM_REG_RISCV_FP_F_REG(fcsr)) reg_val = &cntx->fp.f.fcsr; else if ((KVM_REG_RISCV_FP_F_REG(f[0]) <= reg_num) && - reg_num <= KVM_REG_RISCV_FP_F_REG(f[31])) + reg_num <= KVM_REG_RISCV_FP_F_REG(f[31])) { + reg_num = array_index_nospec(reg_num, + ARRAY_SIZE(cntx->fp.f.f)); reg_val = &cntx->fp.f.f[reg_num]; - else + } else return -ENOENT; } else if ((rtype == KVM_REG_RISCV_FP_D) && riscv_isa_extension_available(vcpu->arch.isa, d)) { @@ -152,6 +159,8 @@ int kvm_riscv_vcpu_set_reg_fp(struct kvm_vcpu *vcpu, reg_num <= KVM_REG_RISCV_FP_D_REG(f[31])) { if (KVM_REG_SIZE(reg->id) != sizeof(u64)) return -EINVAL; + reg_num = array_index_nospec(reg_num, + ARRAY_SIZE(cntx->fp.d.f)); reg_val = &cntx->fp.d.f[reg_num]; } else return -ENOENT;