Re: [PATCH] RISC-V: KVM: Preserve LCOFIP when checking pending interrupts

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:

Pre-existing issues:
- [High] The patch fixes the LCOFIP bit shift for pending interrupts in `kvm_riscv_vcpu_has_interrupts()`, but fails to fix identical shifting bugs in the `sip` CSR user-space accessors (`kvm_riscv_vcpu_general_get_csr` and `kvm_riscv_vcpu_general_set_csr`), breaking live migration and state save/restore.
--

commit 303435fe5072a60c37b6dc33685536a2c46952a5
Author: Pengpeng Hou <pengpeng@iscas.ac.cn>

RISC-V: KVM: Preserve LCOFIP when checking pending interrupts

KVM injects the guest counter-overflow interrupt into HVIP bit 13 and
records the same bit in irqs_pending. The guest enables it through VSIE
LCOFIE, also at bit 13.

> diff --git a/arch/riscv/kvm/vcpu.c b/arch/riscv/kvm/vcpu.c
> index 977e36ab83d3f..bdace86686e1a 100644
> --- a/arch/riscv/kvm/vcpu.c
> +++ b/arch/riscv/kvm/vcpu.c
> @@ -471,12 +471,14 @@ int kvm_riscv_vcpu_unset_interrupt(struct kvm_vcpu *vcpu, unsigned int irq)
>  bool kvm_riscv_vcpu_has_interrupts(struct kvm_vcpu *vcpu, u64 mask)
>  {
>  	unsigned long flags;
> -	unsigned long ie;
> +	unsigned long ie, vsie;
>  	bool ret;
>  
>  	raw_spin_lock_irqsave(&vcpu->arch.irqs_pending_lock, flags);
> -	ie = ((vcpu->arch.guest_csr.vsie & VSIP_VALID_MASK)
> -		<< VSIP_TO_HVIP_SHIFT) & (unsigned long)mask;
> +	vsie = vcpu->arch.guest_csr.vsie & VSIP_VALID_MASK;
> +	ie = ((vsie & ~SIP_LCOFIP) << VSIP_TO_HVIP_SHIFT) |
> +	     (vsie & SIP_LCOFIP);
> +	ie &= (unsigned long)mask;

[Severity: High]
This is a pre-existing issue, but does the same LCOFIP bit shift bug also
break the sip CSR user-space accessors in arch/riscv/kvm/vcpu_onereg.c?

Looking at kvm_riscv_vcpu_general_get_csr(), the PMU overflow bit
(IRQ_PMU_OVF, bit 13) in hvip is shifted right by VSIP_TO_HVIP_SHIFT (1) to
bit 12, then masked out by VSIP_VALID_MASK which lacks bit 12:

    *out_val = (csr->hvip >> VSIP_TO_HVIP_SHIFT) & VSIP_VALID_MASK;
    *out_val |= csr->hvip & ~IRQ_LOCAL_MASK;

The subsequent OR with ~IRQ_LOCAL_MASK clears bits 0-13, dropping it
entirely.

Similarly in kvm_riscv_vcpu_general_set_csr(), when userspace restores sip,
the incoming bit 13 is incorrectly shifted left by 1 to bit 14 before being
written to hvip:

    reg_val &= VSIP_VALID_MASK;
    reg_val <<= VSIP_TO_HVIP_SHIFT;

Can this silently lose or corrupt the guest PMU overflow interrupt state
during VM live migration or state save/restore when userspace calls
KVM_GET_ONE_REG and KVM_SET_ONE_REG?

>  	ie |= vcpu->arch.guest_csr.vsie & ~IRQ_LOCAL_MASK &
>  		(unsigned long)mask;
>  	ret = vcpu->arch.irqs_pending[0] & ie;

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260901080610.91993-1-pengpeng@iscas.ac.cn?part=1