From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from mx0a-0031df01.pphosted.com (mx0a-0031df01.pphosted.com [205.220.168.131]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 3A852248F72 for ; Fri, 27 Feb 2026 13:28:56 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=205.220.168.131 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1772198937; cv=none; b=LM5J6lVDHOiSjBqDNpllHVao5N5aCSeeH8jyPjSqzCgMbE/3N8kGmfRM+BmHHLFNqNgBOl6rzptfxNkSBoK3mgoWDDd1bKIPikHgGimJn17PrvcsAurX5mJSwT8bK2iptW0lVVg0A92D4y080IK9ixVDw6PWQvf5hQEFwrTpu68= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1772198937; c=relaxed/simple; bh=ywQttif3CalR9NUeMqe0jrGf5rptr1jELNO/5/jL9A0=; h=Mime-Version:Content-Type:Date:Message-Id:Subject:Cc:To:From: References:In-Reply-To; b=bGo5FNA/TxCS8avTEuSSfnSMygGWMm1CBQP18M9oyChBVKKG11JbZiN6Je76g67sCB7jcH+spavYGTKvDF/u/w7ZhD0llu2exhqk4+inDwMLLUqgsAkVCDUsdlfx7XCRrBoRgDmvsAJTRw5zH/U93OF5O0n1JEWbrdMH6HWJDHU= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dmarc=pass (p=reject dis=none) header.from=oss.qualcomm.com; spf=pass smtp.mailfrom=oss.qualcomm.com; dkim=pass (2048-bit key) header.d=qualcomm.com header.i=@qualcomm.com header.b=gMN6reQx; dkim=pass (2048-bit key) header.d=oss.qualcomm.com header.i=@oss.qualcomm.com header.b=XqbYS5QE; arc=none smtp.client-ip=205.220.168.131 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=reject dis=none) header.from=oss.qualcomm.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=oss.qualcomm.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=qualcomm.com header.i=@qualcomm.com header.b="gMN6reQx"; dkim=pass (2048-bit key) header.d=oss.qualcomm.com header.i=@oss.qualcomm.com header.b="XqbYS5QE" Received: from pps.filterd (m0279867.ppops.net [127.0.0.1]) by mx0a-0031df01.pphosted.com (8.18.1.11/8.18.1.11) with ESMTP id 61RBAUma2663501 for ; Fri, 27 Feb 2026 13:28:55 GMT DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=qualcomm.com; h= cc:content-transfer-encoding:content-type:date:from:in-reply-to :message-id:mime-version:references:subject:to; s=qcppdkim1; bh= az4A8WsRSQIRPaSotZ08AsqnlM/RQPqIKqEzlZWYba0=; b=gMN6reQxhwE+cY0e 1i2jQY3avQAz/Eux6j5Ou9pjJcaJXBKsZqkB0v8UtRpcUeBt8kxc50SxK5cdGN0x vy7H6+ikVAJ8qVKPtDk4sgoqIDFWzgejc2kNn7HD/kLTvtxe5EakL69qayNZu2pl oOT2Iw2vhAgSRVz+rO7563JOMa6CxXMFUMnjyTggW8Dnnrc7VykQA7qRtOBSJ4y3 mcqmLzmUGQROrvZfJESD9hHWlx/4MqjZBNEh0dAqb7XxP2XCu6ielY6lp54RjoFr gB9Jo/QSP+58/TXO2YBQ/1rz7FiuZ9E3yoE1jxMk8xnuoh9D+6KkSkMI7sJABIf3 Szv4ng== Received: from mail-qt1-f200.google.com (mail-qt1-f200.google.com [209.85.160.200]) by mx0a-0031df01.pphosted.com (PPS) with ESMTPS id 4ck43r9nr7-1 (version=TLSv1.3 cipher=TLS_AES_128_GCM_SHA256 bits=128 verify=NOT) for ; Fri, 27 Feb 2026 13:28:55 +0000 (GMT) Received: by mail-qt1-f200.google.com with SMTP id d75a77b69052e-503915b0a88so366428011cf.1 for ; Fri, 27 Feb 2026 05:28:55 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=oss.qualcomm.com; s=google; t=1772198934; x=1772803734; darn=vger.kernel.org; h=in-reply-to:references:from:to:cc:subject:message-id:date :content-transfer-encoding:mime-version:from:to:cc:subject:date :message-id:reply-to; bh=az4A8WsRSQIRPaSotZ08AsqnlM/RQPqIKqEzlZWYba0=; b=XqbYS5QEEw2WMm+IXIji8KC+OinWWPbYsIo0LlfdfS/B/gqsG0j7m45BBQbGJOp8eY bhZc64T0rga4YWz6qJnDbybV1mLr83Aw0NMNNOB54mUul2RiS+FsnOGv9rSxcQYP2Jg3 FZ95WjM27z3ttkTX5Hsz5SQixw2fN8i8WkHr7YJNxhxamMvSd37IDVV0YIB4dp3Hy6yI h8Ho7AAh7eoNZ0ETRmjbHsjzCyyZs/HAf2ZzxdN8aCSSLBBuegXFUpvQQ/nqzZnO1DpV aLyAph6tZWhO9pUzRtSAE//Rz7mpWacTRiWARfJ0zCd06zr6eP8ludjKPGSaa4allrWB BpSA== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20230601; t=1772198934; x=1772803734; h=in-reply-to:references:from:to:cc:subject:message-id:date :content-transfer-encoding:mime-version:x-gm-gg:x-gm-message-state :from:to:cc:subject:date:message-id:reply-to; bh=az4A8WsRSQIRPaSotZ08AsqnlM/RQPqIKqEzlZWYba0=; b=RSB2Ybir38dCjgyr+Xs2bkmtr+/HWMbsbI6Sx4fsnOgfctvwoBvMrJnXv9kyc3aBlc TDB+11eM92EU7aDROjli8vzDct5AKgv6Gt3H0whKjMmQ97Sc/dAjshQLrqqgO3p+d9V8 r4Uu/mOCdjS3/Dwz/R+HaVTSPb6sLUZbuoBB0NiVXGof/kWGXNbo0FapMEK1JZY/yFW+ R875d8G9dFNAGz/IY8wIpbxh3F6WKoSOuWD8ASpxsm1n6tLtqpYfk2THEG7g2pqgAlDy HjWmL1Y21DAapfOElwBJ4A0jzIYv9XibOg6FeAR9YMhktlaemYpb1PSFLWVU3fBdV4Li u0JA== X-Forwarded-Encrypted: i=1; AJvYcCUzncs5tqvh+/7uwYg8xhNBSicOjS4ktILjrwAmVmD6SWykAszrmora6ibQcXR/A2BCuONkTqJBet3jFgA=@vger.kernel.org X-Gm-Message-State: AOJu0Yz1lTDK91laneb8QAYI/puSjWytPCnFYdd55/Z2sXIcHDByja7+ I/+Hxv8fVp2qZNeO5s2tP4W6kA3B5LZ6sTT15dm7R1kvojgDT7RYfvkS7XoLCX1ad4Gi8AA5SSu mFmU8UTHjY6JuM0pSON/5Q4rsA7QD0eVZfFLChU8WtaFHqVJlgaDc78cro+yq48C2A3U= X-Gm-Gg: ATEYQzy6kDDepOz8FDnLTIDZQciUQBsoXr4gE2OjN/V9nHE0VkFY6ZPnL9cjNY+F0h7 80M8nz4JGKBTdeHCHgpBkWpBOtxtohrVohVcxO5GiPoccvwgP5rcSEBc3cO9yGnlz1hLq1CZque 9juS34QMDHTh6aWloha11thuwsM+dV3SisUNjLWSjnKRL6K91T0tS7zsYCqtZX3m7HGWEIY2Ah8 w6BqWr1Vc02M6PFzFj0yFFkQPFZh01TEiEaSkoI940uniK0reU+oWL/hiFD0jkYSTC/BLtqcFTb r0AO9/XTAaickoAvURSKWXd00ZQU84FEeXTGX2tq2VR0CIcz2ypNIoZVDXn1W6ZrrUuJKMvPg8s Wbg2lqrpeKBb57yk1Ab3L/TflytO3PXhNB5XU5czgcwXzdAzUNa1Zkxe6KOPR X-Received: by 2002:a05:620a:7108:b0:89f:8bb8:c103 with SMTP id af79cd13be357-8cbc8df0b7fmr340490885a.49.1772198934195; Fri, 27 Feb 2026 05:28:54 -0800 (PST) X-Received: by 2002:a05:620a:7108:b0:89f:8bb8:c103 with SMTP id af79cd13be357-8cbc8df0b7fmr340483885a.49.1772198933454; Fri, 27 Feb 2026 05:28:53 -0800 (PST) Received: from localhost (ip-86-49-242-13.bb.vodafone.cz. [86.49.242.13]) by smtp.gmail.com with ESMTPSA id a640c23a62f3a-b935ae93357sm145840866b.48.2026.02.27.05.28.52 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Fri, 27 Feb 2026 05:28:52 -0800 (PST) Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: Mime-Version: 1.0 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset=UTF-8 Date: Fri, 27 Feb 2026 13:28:51 +0000 Message-Id: Subject: Re: [PATCH 4/4] KVM: riscv: Fix Spectre-v1 in PMU counter access Cc: , , , , "Daniel Weber" , "Michael Schwarz" , "Marton Bognar" , "Jo Van Bulck" To: "Lukas Gerlach" , "Anup Patel" , "Atish Patra" , "Paul Walmsley" , "Palmer Dabbelt" , "Albert Ou" , "Alexandre Ghiti" , "Andrew Jones" From: =?utf-8?q?Radim_Kr=C4=8Dm=C3=A1=C5=99?= References: <20260226-kvm-riscv-spectre-v1-v1-0-5f930ea16691@cispa.de> <20260226-kvm-riscv-spectre-v1-v1-4-5f930ea16691@cispa.de> In-Reply-To: <20260226-kvm-riscv-spectre-v1-v1-4-5f930ea16691@cispa.de> X-Proofpoint-ORIG-GUID: hHZDpBbisJR0GSKjTb5bJNX5OMBY93HO X-Proofpoint-GUID: hHZDpBbisJR0GSKjTb5bJNX5OMBY93HO X-Authority-Analysis: v=2.4 cv=DOqCIiNb c=1 sm=1 tr=0 ts=69a19c17 cx=c_pps a=JbAStetqSzwMeJznSMzCyw==:117 a=9tUHzIdeCh+UoOnba06Qjw==:17 a=IkcTkHD0fZMA:10 a=HzLeVaNsDn8A:10 a=M51BFTxLslgA:10 a=s4-Qcg_JpJYA:10 a=VkNPw1HP01LnGYTKEx00:22 a=u7WPNUs3qKkmUXheDGA7:22 a=eoimf2acIAo5FJnRuUoq:22 a=EUspDBNiAAAA:8 a=l_Klt5aIuPl-FdbJcjgA:9 a=QEXdDO2ut3YA:10 a=uxP6HrT_eTzRwkO_Te1X:22 X-Proofpoint-Spam-Details-Enc: AW1haW4tMjYwMjI3MDExOSBTYWx0ZWRfX1NbafX1QV64I Pd0sBjUSCFQQkBHvL2c4RqSYLRZu4aUp1n5+JfFfDWq8sTLG+qKCb7GjCWTxGUS6E8x9GOq+OpM Pu5+imJZgC8ftCBR3d8p9jG66b05m6TW2Rnqsd7UISgBiWsGnkUSrOTCm9oclo79JToXBM+6mLh 2rqreAgQRcQJmt+SGsjhOESOM09EurCdfSTSXvzjBYDnwrwK13WVc26M1O4oYQg8+8Hh5+skaF4 +xcwlx8Pvcvi/8K+7A2RL7g/aXpcsArNqg5JCFC408KUKYlAH9htqrOhbmQ15N241viDSQpHE8N PCjGhOEPNzJM2O+rP2WlwPGHFr35pxyJ8X8vlX+4ogq43Oe4Lseb2zdX0ePcvLUvkaNWCgc1Xf7 zaEukosomLY7zxuXRhUtPhoBrPqeLYim1LWDQQHkgjFrNcTCu2mlLas+biRmQ78/DM7kVakOK/O SK4TkcZBf4bjrSJdvnw== X-Proofpoint-Virus-Version: vendor=baseguard engine=ICAP:2.0.293,Aquarius:18.0.1121,Hydra:6.1.51,FMLib:17.12.100.49 definitions=2026-02-27_02,2026-02-27_01,2025-10-01_01 X-Proofpoint-Spam-Details: rule=outbound_notspam policy=outbound score=0 spamscore=0 phishscore=0 malwarescore=0 adultscore=0 priorityscore=1501 clxscore=1015 suspectscore=0 impostorscore=0 lowpriorityscore=0 bulkscore=0 classifier=typeunknown authscore=0 authtc= authcc= route=outbound adjust=0 reason=mlx scancount=1 engine=8.22.0-2602130000 definitions=main-2602270119 2026-02-26T15:19:01+01:00, Lukas Gerlach : > Guest-controlled counter indices received via SBI ecalls are used to > index into the PMC array. Sanitize them with array_index_nospec() > to prevent speculative out-of-bounds access. > > Similar to x86 commit 13c5183a4e64 ("KVM: x86: Protect MSR-based > index computations in pmu.h from Spectre-v1/L1TF attacks"). > > Fixes: 8f0153ecd3bf ("RISC-V: KVM: Add skeleton support for perf") > Signed-off-by: Lukas Gerlach > --- > diff --git a/arch/riscv/kvm/vcpu_pmu.c b/arch/riscv/kvm/vcpu_pmu.c > @@ -525,6 +528,7 @@ int kvm_riscv_vcpu_pmu_ctr_info(struct kvm_vcpu *vcpu= , unsigned long cidx, > return 0; > } > =20 > + cidx =3D array_index_nospec(cidx, RISCV_KVM_MAX_COUNTERS); This one also covers a non-speculation bug, since the previous condition used cidx > RISCV_KVM_MAX_COUNTER. :) I'll send a patch for that. I noticed a few other places where mis-speculation is possible, see below; can you explain why they don't need protection? Anyway, the series looks good, Reviewed-by: Radim Kr=C4=8Dm=C3=A1=C5=99 Thanks. --- diff --git a/arch/riscv/kvm/vcpu_pmu.c b/arch/riscv/kvm/vcpu_pmu.c index 4d8d5e9aa53d..08301b6033f0 100644 --- a/arch/riscv/kvm/vcpu_pmu.c +++ b/arch/riscv/kvm/vcpu_pmu.c @@ -87,7 +87,7 @@ static void kvm_pmu_release_perf_event(struct kvm_pmc *pm= c) =20 static u64 kvm_pmu_get_perf_event_hw_config(u32 sbi_event_code) { - return hw_event_perf_map[sbi_event_code]; + return hw_event_perf_map[array_index_nospec(sbi_event_code, SBI_PMU_HW_GE= NERAL_MAX)]; } =20 static u64 kvm_pmu_get_perf_event_cache_config(u32 sbi_event_code) @@ -559,7 +559,7 @@ int kvm_riscv_vcpu_pmu_ctr_start(struct kvm_vcpu *vcpu,= unsigned long ctr_base, } /* Start the counters that have been configured and requested by the gues= t */ for_each_set_bit(i, &ctr_mask, RISCV_MAX_COUNTERS) { - pmc_index =3D i + ctr_base; + pmc_index =3D array_index_nospec(i + ctr_base, RISCV_KVM_MAX_COUNTERS); if (!test_bit(pmc_index, kvpmu->pmc_in_use)) continue; /* The guest started the counter again. Reset the overflow status */ @@ -630,7 +630,7 @@ int kvm_riscv_vcpu_pmu_ctr_stop(struct kvm_vcpu *vcpu, = unsigned long ctr_base, =20 /* Stop the counters that have been configured and requested by the guest= */ for_each_set_bit(i, &ctr_mask, RISCV_MAX_COUNTERS) { - pmc_index =3D i + ctr_base; + pmc_index =3D array_index_nospec(i + ctr_base, RISCV_KVM_MAX_COUNTERS); if (!test_bit(pmc_index, kvpmu->pmc_in_use)) continue; pmc =3D &kvpmu->pmc[pmc_index]; @@ -761,6 +761,7 @@ int kvm_riscv_vcpu_pmu_ctr_cfg_match(struct kvm_vcpu *v= cpu, unsigned long ctr_ba } } =20 + ctr_idx =3D array_index_nospec(ctr_idx, RISCV_KVM_MAX_COUNTERS); pmc =3D &kvpmu->pmc[ctr_idx]; pmc->idx =3D ctr_idx; =20