Re: [PATCH v2] RISC-V: Clear HSTATUS.HU on CPU initialization

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
- [Critical] riscv: incomplete HSTATUS.HU mitigation on asymmetric MP due to global check
--

commit 34c26113f845622c7a6f9c472ce2342eaac66df7
Author: Yong-Xuan Wang <yongxuan.wang@sifive.com>

RISC-V: Clear HSTATUS.HU on CPU initialization

This commit clears the HSTATUS.HU bit during CPU initialization to restrict
hypervisor instructions to HS-mode. This is intended to prevent unexpected
guest memory access from U-mode code.

> diff --git a/arch/riscv/kernel/cpufeature.c b/arch/riscv/kernel/cpufeature.c
> index f46aa5602d74d..80767a0166026 100644
> --- a/arch/riscv/kernel/cpufeature.c
> +++ b/arch/riscv/kernel/cpufeature.c

[ ... ]

> @@ -1183,6 +1183,18 @@ void __init riscv_user_isa_enable(void)
>  		pr_warn("Zicbop disabled as it is unavailable on some harts\n");
>  }
>  
> +void riscv_clear_hypervisor_csr(void)
> +{
> +	if (!riscv_has_extension_unlikely(RISCV_ISA_EXT_h))
> +		return;

[Severity: Critical]
Does this global check cause a regression on asymmetric multiprocessor setups?

If the 'H' extension is not present on all CPUs, the global
riscv_has_extension_unlikely() check returns false because it relies on the
riscv_isa bitmap representing the intersection of all CPUs' extensions.

This would cause riscv_clear_hypervisor_csr() to exit early without clearing
HSTATUS.HU on the specific CPUs that do possess the 'H' extension. This could
potentially allow unprivileged U-mode processes on those capable CPUs to
execute hypervisor instructions (HLV/HSV) and access host physical memory.

Would it be better to use riscv_cpu_has_extension_unlikely(smp_processor_id(),
RISCV_ISA_EXT_h) here to ensure the check evaluates correctly for each CPU?

> +
> +	/*
> +	 * Clear HSTATUS.HU to restrict hypervisor instructions to HS-mode.
> +	 * This prevents user-mode from executing HLV/HSV instructions.
> +	 */
> +	csr_clear(CSR_HSTATUS, HSTATUS_HU);
> +}
> +

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260924-hstatus_hu-v2-1-7e970f5f1d8d@sifive.com?part=1