Skip to content

RISC-V: KVM: Validate SBI STA shmem alignment - #401

Open
uestc-gr wants to merge 3 commits into
RVCK-Project:rvck-6.6from
uestc-gr:STA
Open

RISC-V: KVM: Validate SBI STA shmem alignment#401
uestc-gr wants to merge 3 commits into
RVCK-Project:rvck-6.6from
uestc-gr:STA

Conversation

@uestc-gr

@uestc-gr uestc-gr commented Sep 23, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

fixed: #356

KVM通过KVM_SET_ONE_REG将SBI STA共享内存配置暴露给用户空间。然而，kvm_sbi_ext_sta_set_reg()的当前实现并未验证所配置的共享内存地址的对齐情况。因此，用户空间可以设置一个不符合SBI规范的非对齐共享内存地址,触发如下告警:

WARNING: arch/riscv/kvm/vcpu_sbi_sta.c:49 at kvm_riscv_vcpu_record_steal_time

测试方法：
我们已经合入selftest 对这个非对齐共享内存地址,访问的守护，只需要合入补丁后编译出steal_time的selftest进行测试，测试结果如下：

~ # steal_time
TAP version 13
1..4
ok 1 vcpu0
ok 2 vcpu1
ok 3 vcpu2
ok 4 vcpu3

Totals: pass:4 fail:0 xfail:0 xpass:0 skip:0 error:0

@github-actions

github-actions Bot commented Sep 23, 2026 •
edited
Loading

Copy link
Copy Markdown

开始测试 log: https://github.com/RVCK-Project/rvck/actions/runs/35836611250

参数解析结果
args value
repository RVCK-Project/rvck
head ref pull/401/head
base ref rvck-6.6
LAVA repo RVCK-Project/lavaci
LAVA hardware ['qemu']
LAVA Testcase path lava-testcases/common-test/ltp/ltp.yaml
need run job kunit-test,kernel-build,check-patch,lava-trigger

测试完成

详细结果:
check result
kunit-test success
kernel-build success
check-patch success
lava-trigger-qemu success
lava-trigger-sg2042 skipped
lava-trigger-k1 skipped
lava-trigger-lpi4a skipped

Kunit Test Result

[08:25:51] Testing complete. Ran 482 tests: passed: 465, skipped: 17

Kernel Build Result

Check Patch Result
Total Errors 0
Total Warnings 5

LAVA Check (qemu)

args value
testcase_repo RVCK-Project/lavaci
lava_template lava-job-template/qemu/qemu-ltp.yaml
testcase_path lava-testcases/common-test/ltp/ltp.yaml
kernel_download_url http://10.30.190.110/openEuler-RISC-V/RVCK/OERV-RVCI/RVCK-Project/rvck/401_35836611250_1/Image
initramfs_download_url http://10.30.190.110/openEuler-RISC-V/RVCK/OERV-RVCI/RVCK-Project/rvck/401_35836611250_1/initramfs.img
rootfs_download_url https://fast-mirror.isrc.ac.cn/openeuler-sig-riscv/openEuler-RISC-V/RVCK/openEuler24.03-LTS-SP1/openeuler-rootfs.img.zst
testcase_ref main
testitem_name RVCK-Project_rvck_pull_request_target_401__common-test_qemu

result: Lava check done!

@6eanut @uestc-gr
RISC-V: KVM: Validate SBI STA shmem alignment in kvm_sbi_ext_sta_set_…
423d1fa 
…reg()

mainline inclusion
from Linux v7.1-rc1
commit fa9681e
category: bugfix
bugzilla: RVCK-Project#356

--------------------------------

The RISC-V SBI Steal-Time Accounting (STA) extension requires the shared
memory physical address to be 64-byte aligned, or set to all-ones to
explicitly disable steal-time accounting.

KVM exposes the SBI STA shared memory configuration to userspace via
KVM_SET_ONE_REG. However, the current implementation of
kvm_sbi_ext_sta_set_reg() does not validate the alignment of the configured
shared memory address. As a result, userspace can install a misaligned
shared memory address that violates the SBI specification.

Such an invalid configuration may later reach runtime code paths that
assume a valid and properly aligned shared memory region. In particular,
KVM_RUN can trigger the following WARN_ON in
kvm_riscv_vcpu_record_steal_time():

  WARNING: arch/riscv/kvm/vcpu_sbi_sta.c:49 at
  kvm_riscv_vcpu_record_steal_time

WARN_ON paths are not expected to be reachable during normal runtime
execution, and may result in a kernel panic when panic_on_warn is enabled.

Fix this by validating the computed shared memory GPA at the
KVM_SET_ONE_REG boundary. A temporary GPA is constructed and checked
before committing it to vcpu->arch.sta.shmem. The validation allows
either a 64-byte aligned GPA or INVALID_GPA (all-ones), which disables
STA as defined by the SBI specification.

This prevents invalid userspace state from reaching runtime code paths
that assume SBI STA invariants and avoids unexpected WARN_ON behavior.

Fixes: f61ce89 ("RISC-V: KVM: Add support for SBI STA registers")
Signed-off-by: Jiakai Xu <xujiakai2025@iscas.ac.cn>
Signed-off-by: Jiakai Xu <jiakaiPeanut@gmail.com>
Reviewed-by: Andrew Jones <andrew.jones@oss.qualcomm.com>
Link: https://lore.kernel.org/r/20260303010859.1763177-2-xujiakai2025@iscas.ac.cn
Signed-off-by: Anup Patel <anup@brainfault.org>
Signed-off-by: Gao Rui <gao.rui@zte.com.cn>
@6eanut @uestc-gr
KVM: selftests: Refactor UAPI tests into dedicated function
a191c5e 
mainline inclusion
from Linux v7.1-rc1
commit 40351ed
category: bugfix
bugzilla: RVCK-Project#356

--------------------------------

Move steal time UAPI tests from steal_time_init() into a separate
check_steal_time_uapi() function for better code organization and
maintainability.

Previously, x86 and ARM64 architectures performed UAPI validation
tests within steal_time_init(), mixing initialization logic with
uapi tests.

Changes by architecture:
x86_64:
  - Extract MSR reserved bits test from steal_time_init()
  - Move to check_steal_time_uapi() which tests that setting
    MSR_KVM_STEAL_TIME with KVM_STEAL_RESERVED_MASK fails
ARM64:
  - Extract three UAPI tests from steal_time_init():
     Device attribute support check
     Misaligned IPA rejection (EINVAL)
     Duplicate IPA setting rejection (EEXIST)
  - Move all tests to check_steal_time_uapi()
RISC-V:
  - Add empty check_steal_time_uapi() stub for future use
  - No changes to steal_time_init() (had no tests to extract)

The new check_steal_time_uapi() function:
  - Is called once before the per-VCPU test loop

No functional change intended.

Suggested-by: Andrew Jones <andrew.jones@oss.qualcomm.com>
Signed-off-by: Jiakai Xu <xujiakai2025@iscas.ac.cn>
Signed-off-by: Jiakai Xu <jiakaiPeanut@gmail.com>
Reviewed-by: Andrew Jones <andrew.jones@oss.qualcomm.com>
Link: https://lore.kernel.org/r/20260303010859.1763177-3-xujiakai2025@iscas.ac.cn
Signed-off-by: Anup Patel <anup@brainfault.org>
Signed-off-by: Gao Rui <gao.rui@zte.com.cn>
@6eanut @uestc-gr
RISC-V: KVM: selftests: Add RISC-V SBI STA shmem alignment tests
f084204 
mainline inclusion
from Linux v7.1-rc1
commit 7c61e74
category: bugfix
bugzilla: RVCK-Project#356

[Linux kernel 6.6 does not contain kvm_util_types.h. To avoid backporting a series
of selftests-related changes, including commits such as be1bd4c ("KVM: selftests:
Allow tagging protected memory in guest  page tables") and other patches, which would
introduce a considerable amount of complex x86-specific functionality, the INVALID_GPA
definitions are consolidated into kvm_util_base.h instead. ]
--------------------------------

Add RISC-V KVM selftests to verify the SBI Steal-Time Accounting (STA)
shared memory alignment requirements.

The SBI specification requires the STA shared memory GPA to be 64-byte
aligned, or set to all-ones to explicitly disable steal-time accounting.
This test verifies that KVM enforces the expected behavior when
configuring the SBI STA shared memory via KVM_SET_ONE_REG.

Specifically, the test checks that:
- misaligned GPAs are rejected with -EINVAL
- 64-byte aligned GPAs are accepted
- all-ones GPA is accepted

Signed-off-by: Jiakai Xu <xujiakai2025@iscas.ac.cn>
Signed-off-by: Jiakai Xu <jiakaiPeanut@gmail.com>
Reviewed-by: Andrew Jones <andrew.jones@oss.qualcomm.com>
Link: https://lore.kernel.org/r/20260303010859.1763177-4-xujiakai2025@iscas.ac.cn
Signed-off-by: Anup Patel <anup@brainfault.org>
Signed-off-by: Gao Rui <gao.rui@zte.com.cn>
@github-actions

github-actions Bot commented Sep 24, 2026 •
edited
Loading

Copy link
Copy Markdown

开始测试 log: https://github.com/RVCK-Project/rvck/actions/runs/35946314579

参数解析结果
args value
repository RVCK-Project/rvck
head ref pull/401/head
base ref rvck-6.6
LAVA repo RVCK-Project/lavaci
LAVA hardware ['qemu']
LAVA Testcase path lava-testcases/common-test/ltp/ltp.yaml
need run job kunit-test,kernel-build,check-patch,lava-trigger

测试完成

详细结果:
check result
kunit-test success
kernel-build success
check-patch success
lava-trigger-qemu success
lava-trigger-sg2042 skipped
lava-trigger-k1 skipped
lava-trigger-lpi4a skipped

Kunit Test Result

[02:17:53] Testing complete. Ran 482 tests: passed: 465, skipped: 17

Kernel Build Result

Check Patch Result
Total Errors 0
Total Warnings 5

LAVA Check (qemu)

args value
testcase_repo RVCK-Project/lavaci
lava_template lava-job-template/qemu/qemu-ltp.yaml
testcase_path lava-testcases/common-test/ltp/ltp.yaml
kernel_download_url http://10.30.190.110/openEuler-RISC-V/RVCK/OERV-RVCI/RVCK-Project/rvck/401_35946314579_1/Image
initramfs_download_url http://10.30.190.110/openEuler-RISC-V/RVCK/OERV-RVCI/RVCK-Project/rvck/401_35946314579_1/initramfs.img
rootfs_download_url https://fast-mirror.isrc.ac.cn/openeuler-sig-riscv/openEuler-RISC-V/RVCK/openEuler24.03-LTS-SP1/openeuler-rootfs.img.zst
testcase_ref main
testitem_name RVCK-Project_rvck_pull_request_target_401__common-test_qemu

result: Lava check done!

@unicornx unicornx added the ZTE label Sep 24, 2026
unicornx
unicornx approved these changes Sep 29, 2026
View reviewed changes

@unicornx unicornx left a comment

Copy link
Copy Markdown
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM

Reviewed-by: Chen Wang wangchen20@iscas.ac.cn

@unicornx

unicornx commented Sep 29, 2026

Copy link
Copy Markdown
Collaborator

Tested bootup with QEMU/virt and Pioneerbox.

Built steal_time with make ARCH=riscv CROSS_COMPILE=riscv64-unknown-linux-gnu- -C tools/testing/selftests/kvm LDFLAGS=-static but didn't test due to lack machine supporting KVM.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@unicornx unicornx unicornx approved these changes
@fangyu0809 fangyu0809 fangyu0809 approved these changes

Assignees

No one assigned

Labels

ZTE

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

【bugfix】Steal-Time特性共享内存地址对齐问题修复

4 participants

@uestc-gr @unicornx @fangyu0809 @6eanut