From patchwork Tue Mar 3 14:19:44 2026 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 8bit X-Patchwork-Submitter: Lukas Gerlach X-Patchwork-Id: 2204287 Return-Path: X-Original-To: incoming@patchwork.ozlabs.org Delivered-To: patchwork-incoming@legolas.ozlabs.org Authentication-Results: legolas.ozlabs.org; dkim=pass (2048-bit key; secure) header.d=lists.infradead.org header.i=@lists.infradead.org header.a=rsa-sha256 header.s=bombadil.20210309 header.b=eXWZyDNO; dkim=fail reason="signature verification failed" (2048-bit key; unprotected) header.d=cispa.de header.i=@cispa.de header.a=rsa-sha256 header.s=2023-rsa header.b=EBVS+Nlz; dkim-atps=neutral Authentication-Results: legolas.ozlabs.org; spf=none (no SPF record) smtp.mailfrom=lists.infradead.org (client-ip=2607:7c80:54:3::133; helo=bombadil.infradead.org; envelope-from=kvm-riscv-bounces+incoming=patchwork.ozlabs.org@lists.infradead.org; receiver=patchwork.ozlabs.org) Received: from bombadil.infradead.org (bombadil.infradead.org [IPv6:2607:7c80:54:3::133]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange x25519 server-signature ECDSA (secp384r1) server-digest SHA384) (No client certificate requested) by legolas.ozlabs.org (Postfix) with ESMTPS id 4fQHxx4yb0z1xwp for ; Wed, 04 Mar 2026 01:20:05 +1100 (AEDT) DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=lists.infradead.org; s=bombadil.20210309; h=Sender: Content-Transfer-Encoding:Content-Type:List-Subscribe:List-Help:List-Post: List-Archive:List-Unsubscribe:List-Id:CC:To:In-Reply-To:References:Message-ID :MIME-Version:Subject:Date:From:Reply-To:Content-ID:Content-Description: Resent-Date:Resent-From:Resent-Sender:Resent-To:Resent-Cc:Resent-Message-ID: List-Owner; bh=Zlv/Dgc5QqiYVIMAyldDzkzIcYDteLB84YNOlWBW6SY=; b=eXWZyDNOKCJwEZ UFnXNAwe1JVsbhhASuJ/QDJv/S/ztg/yQMvjRo3hFA/p0SPmI0LM4ujxmojSsQ+6ZDNJg5qSB+2cO HSFGJIw1d2qbzOlNK0YCm+ocqQnd036QyitjOXQKvVbECebCJtiVKcAkOJctw4N+wb6+834amVRLa MjNhs6KPr0kjLgM/mpF8rhSlOoBjMc2z8iSKAUNspB37V4KJn54EGUWxAy2PIX/ZcdCxNNOWTzxaR wwlQPwJcSnpmL3IQq4Fs178T+i2rEtBIbqqeVf2nt37+QHvlRtCqGFC6SsWr2tCrE1UT01mlt5s59 kunIS6v2JD/sT2yYkyiQ==; Received: from localhost ([::1] helo=bombadil.infradead.org) by bombadil.infradead.org with esmtp (Exim 4.98.2 #2 (Red Hat Linux)) id 1vxQbT-0000000FJH4-45n7; Tue, 03 Mar 2026 14:20:03 +0000 Received: from mx-2023-1.gwdg.de ([134.76.10.21]) by bombadil.infradead.org with esmtps (Exim 4.98.2 #2 (Red Hat Linux)) id 1vxQbP-0000000FJD3-49PA; Tue, 03 Mar 2026 14:20:01 +0000 DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=cispa.de; s=2023-rsa; h=CC:To:In-Reply-To:References:Message-ID: Content-Transfer-Encoding:Content-Type:MIME-Version:Subject:Date:From:Sender: Reply-To:Content-ID:Content-Description:Resent-Date:Resent-From:Resent-Sender :Resent-To:Resent-Cc:Resent-Message-ID:List-Id:List-Help:List-Unsubscribe: List-Subscribe:List-Post:List-Owner:List-Archive; bh=+0uYMpZbsgaMKEIZnZgI88fnqM5GbA0UO9KY1vw0gjA=; b=EBVS+NlzRtcZ4E+eQClFKUQtX8 1t+c+PlLot5fCoWxRwUO7nyYWyf51x90+R5uF12XcDXeRq2pM6xvFcy2AP1fd41K2HUeya14IvhCM Rvk9c6bSu5KjHYwDAuOGan9H0IGndWO5Y5qAGnCFoKUGMB08yTA1KftI8qQuKftNzyzp1ONMz3q/r ccANOmndKUSkX7zvjfYCitHc6T4V39UP4j/6ux+19NvAqcJxh93y1M8YxfBz/MhQnEAbuCSBdzjtH aJniGVA01jhnRSBdFxmCPhxbLY0a9ZV0L+yybSt5NGPUvd4qYVYOC3S/LWS4pF29chI0rCoKckl1Y 7gLDMDpQ==; Received: from mailer.gwdg.de ([134.76.10.26]:36952) by mailer.gwdg.de with esmtp (GWDG Mailer) (envelope-from ) id 1vxQb9-00850c-1k; Tue, 03 Mar 2026 15:19:44 +0100 Received: from mbx19-sub-05.um.gwdg.de ([10.108.142.70] helo=email.gwdg.de) by mailer.gwdg.de with esmtps (TLS1.2:ECDHE-RSA-AES128-GCM-SHA256:128) (GWDG Mailer) (envelope-from ) id 1vxQbA-0006kx-0w; Tue, 03 Mar 2026 15:19:44 +0100 Received: from lukass-mbp-7.lan (10.250.9.200) by MBX19-SUB-05.um.gwdg.de (10.108.142.70) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256) id 15.2.2562.37; Tue, 3 Mar 2026 15:19:43 +0100 From: Lukas Gerlach Date: Tue, 3 Mar 2026 15:19:44 +0100 Subject: [PATCH v2 4/4] KVM: riscv: Fix Spectre-v1 in PMU counter access MIME-Version: 1.0 Message-ID: <20260303-kvm-riscv-spectre-v1-v2-4-192caab8e0dc@cispa.de> References: <20260303-kvm-riscv-spectre-v1-v2-0-192caab8e0dc@cispa.de> In-Reply-To: <20260303-kvm-riscv-spectre-v1-v2-0-192caab8e0dc@cispa.de> To: Anup Patel , Atish Patra , Paul Walmsley , Palmer Dabbelt , Albert Ou , Alexandre Ghiti , Andrew Jones CC: =?utf-8?b?UmFkaW0gS3LEjW3DocWZ?= , , , , , Daniel Weber , Michael Schwarz , Marton Bognar , Jo Van Bulck , Lukas Gerlach X-Mailer: b4 0.14.3 X-Developer-Signature: v=1; a=openpgp-sha256; l=3343; i=lukas.gerlach@cispa.de; h=from:subject:message-id; bh=KM1k/pQ3/foiyLLSfk5MnnCFsDCB/OLME+w81duj1l4=; b=owGbwMvMwCGWoTIjqP/42kTG02pJDJnL3v5LFkybm1cn++/BAa0/yy6plymyz2XsiHav9FCs7 F00VV+no5SFQYyDQVZMkWWq4GvGvj0OPEmZh8/BzGFlAhnCwMUpABPpVGP4K3bE+fdtt5DF//PS FCKMdr14WR1mWraSv2Lzx/O/Y7sOFjL891YXFWVRiuje7OpjffjZfD8OH76yFT8uBJya9/Xeibf JPAA= X-Developer-Key: i=lukas.gerlach@cispa.de; a=openpgp; fpr=9511EB018EBC400C6269C3CE682498528FC7AD61 X-Originating-IP: [10.250.9.200] X-ClientProxiedBy: MBX19-SUB-05.um.gwdg.de (10.108.142.70) To MBX19-SUB-05.um.gwdg.de (10.108.142.70) X-Virus-Scanned: (clean) by clamav X-Spam-Level: - X-CRM114-Version: 20100106-BlameMichelson ( TRE 0.8.0 (BSD) ) MR-646709E3 X-CRM114-CacheID: sfid-20260303_062000_055364_6458BF96 X-CRM114-Status: GOOD ( 11.30 ) X-Spam-Score: -2.3 (--) X-Spam-Report: Spam detection software, running on the system "bombadil.infradead.org", has NOT identified this incoming email as spam. The original message has been attached to this so you can view it or label similar future email. If you have any questions, see the administrator of that system for details. Content preview: Guest-controlled counter indices received via SBI ecalls are used to index into the PMC array. Sanitize them with array_index_nospec() to prevent speculative out-of-bounds access. Similar to x86 commit 13c5183a4e64 ("KVM: x86: Protect MSR-based index computations in pmu.h from Spectre-v1/L1TF attacks"). Content analysis details: (-2.3 points, 5.0 required) pts rule name description ---- ---------------------- -------------------------------------------------- -2.3 RCVD_IN_DNSWL_MED RBL: Sender listed at https://www.dnswl.org/, medium trust [134.76.10.21 listed in list.dnswl.org] 1.1 RCVD_IN_VALIDITY_SAFE_BLOCKED RBL: ADMINISTRATOR NOTICE: The query to Validity was blocked. See https://knowledge.validity.com/hc/en-us/articles/20961730681243 for more information. [134.76.10.21 listed in sa-accredit.habeas.com] 0.7 RCVD_IN_VALIDITY_CERTIFIED_BLOCKED RBL: ADMINISTRATOR NOTICE: The query to Validity was blocked. See https://knowledge.validity.com/hc/en-us/articles/20961730681243 for more information. [134.76.10.21 listed in sa-trusted.bondedsender.org] 0.3 RCVD_IN_VALIDITY_RPBL_BLOCKED RBL: ADMINISTRATOR NOTICE: The query to Validity was blocked. See https://knowledge.validity.com/hc/en-us/articles/20961730681243 for more information. [134.76.10.21 listed in bl.score.senderscore.com] 0.0 SPF_HELO_NONE SPF: HELO does not publish an SPF Record -0.0 SPF_PASS SPF: sender matches SPF record -0.1 DKIM_VALID_AU Message has a valid DKIM or DK signature from author's domain 0.1 DKIM_SIGNED Message has a DKIM or DK signature, not necessarily valid -0.1 DKIM_VALID Message has at least one valid DKIM or DK signature -0.1 DKIM_VALID_EF Message has a valid DKIM or DK signature from envelope-from domain -1.9 BAYES_00 BODY: Bayes spam probability is 0 to 1% [score: 0.0000] X-BeenThere: kvm-riscv@lists.infradead.org X-Mailman-Version: 2.1.34 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Sender: "kvm-riscv" Errors-To: kvm-riscv-bounces+incoming=patchwork.ozlabs.org@lists.infradead.org Guest-controlled counter indices received via SBI ecalls are used to index into the PMC array. Sanitize them with array_index_nospec() to prevent speculative out-of-bounds access. Similar to x86 commit 13c5183a4e64 ("KVM: x86: Protect MSR-based index computations in pmu.h from Spectre-v1/L1TF attacks"). Fixes: 8f0153ecd3bf ("RISC-V: KVM: Add skeleton support for perf") Reviewed-by: Radim Krčmář Signed-off-by: Lukas Gerlach --- arch/riscv/kvm/vcpu_pmu.c | 14 +++++++++++--- 1 file changed, 11 insertions(+), 3 deletions(-) diff --git a/arch/riscv/kvm/vcpu_pmu.c b/arch/riscv/kvm/vcpu_pmu.c index 4d8d5e9aa53d..0d626f67d08f 100644 --- a/arch/riscv/kvm/vcpu_pmu.c +++ b/arch/riscv/kvm/vcpu_pmu.c @@ -10,6 +10,7 @@ #include #include #include +#include #include #include #include @@ -87,7 +88,8 @@ static void kvm_pmu_release_perf_event(struct kvm_pmc *pmc) static u64 kvm_pmu_get_perf_event_hw_config(u32 sbi_event_code) { - return hw_event_perf_map[sbi_event_code]; + return hw_event_perf_map[array_index_nospec(sbi_event_code, + SBI_PMU_HW_GENERAL_MAX)]; } static u64 kvm_pmu_get_perf_event_cache_config(u32 sbi_event_code) @@ -218,6 +220,7 @@ static int pmu_fw_ctr_read_hi(struct kvm_vcpu *vcpu, unsigned long cidx, return -EINVAL; } + cidx = array_index_nospec(cidx, RISCV_KVM_MAX_COUNTERS); pmc = &kvpmu->pmc[cidx]; if (pmc->cinfo.type != SBI_PMU_CTR_TYPE_FW) @@ -244,6 +247,7 @@ static int pmu_ctr_read(struct kvm_vcpu *vcpu, unsigned long cidx, return -EINVAL; } + cidx = array_index_nospec(cidx, RISCV_KVM_MAX_COUNTERS); pmc = &kvpmu->pmc[cidx]; if (pmc->cinfo.type == SBI_PMU_CTR_TYPE_FW) { @@ -525,6 +529,7 @@ int kvm_riscv_vcpu_pmu_ctr_info(struct kvm_vcpu *vcpu, unsigned long cidx, return 0; } + cidx = array_index_nospec(cidx, RISCV_KVM_MAX_COUNTERS); retdata->out_val = kvpmu->pmc[cidx].cinfo.value; return 0; @@ -559,7 +564,8 @@ int kvm_riscv_vcpu_pmu_ctr_start(struct kvm_vcpu *vcpu, unsigned long ctr_base, } /* Start the counters that have been configured and requested by the guest */ for_each_set_bit(i, &ctr_mask, RISCV_MAX_COUNTERS) { - pmc_index = i + ctr_base; + pmc_index = array_index_nospec(i + ctr_base, + RISCV_KVM_MAX_COUNTERS); if (!test_bit(pmc_index, kvpmu->pmc_in_use)) continue; /* The guest started the counter again. Reset the overflow status */ @@ -630,7 +636,8 @@ int kvm_riscv_vcpu_pmu_ctr_stop(struct kvm_vcpu *vcpu, unsigned long ctr_base, /* Stop the counters that have been configured and requested by the guest */ for_each_set_bit(i, &ctr_mask, RISCV_MAX_COUNTERS) { - pmc_index = i + ctr_base; + pmc_index = array_index_nospec(i + ctr_base, + RISCV_KVM_MAX_COUNTERS); if (!test_bit(pmc_index, kvpmu->pmc_in_use)) continue; pmc = &kvpmu->pmc[pmc_index]; @@ -761,6 +768,7 @@ int kvm_riscv_vcpu_pmu_ctr_cfg_match(struct kvm_vcpu *vcpu, unsigned long ctr_ba } } + ctr_idx = array_index_nospec(ctr_idx, RISCV_KVM_MAX_COUNTERS); pmc = &kvpmu->pmc[ctr_idx]; pmc->idx = ctr_idx;