[PATCH] RISC-V: KVM: Preserve LCOFIP when checking pending interrupts

[PATCH] RISC-V: KVM: Preserve LCOFIP when checking pending interrupts

[Pengpeng Hou]

KVM injects the guest counter-overflow interrupt into HVIP bit 13 and
records the same bit in irqs_pending. The guest enables it through VSIE
LCOFIE, also at bit 13.

kvm_riscv_vcpu_has_interrupts() shifts the complete VSIP valid mask by
VSIP_TO_HVIP_SHIFT before matching it against irqs_pending. That maps
SSIP, STIP, and SEIP to VSSIP, VSTIP, and VSEIP, but incorrectly moves
LCOFIP from bit 13 to bit 14. The following high-interrupt term excludes
all local interrupt bits, so it cannot recover LCOFIP.

As a result, kvm_arch_vcpu_runnable() can report false for a vCPU waiting
in WFI even though an enabled PMU overflow interrupt is pending.

Keep LCOFIP in place while shifting the three interrupt classes that have
distinct VS-level bit positions. This makes a vCPU halted in WFI runnable
when its PMU overflow interrupt is pending.

Fixes: 16b0bde9a37c ("RISC-V: KVM: Add perf sampling support for guests")
Signed-off-by: Pengpeng Hou <pengpeng@iscas.ac.cn>
---
 arch/riscv/kvm/vcpu.c | 8 +++++---
 1 file changed, 5 insertions(+), 3 deletions(-)

diff --git a/arch/riscv/kvm/vcpu.c b/arch/riscv/kvm/vcpu.c
index e062ca1..c6eb3bd 100644
--- a/arch/riscv/kvm/vcpu.c
+++ b/arch/riscv/kvm/vcpu.c
@@ -487,12 +487,14 @@ int kvm_riscv_vcpu_unset_interrupt(struct kvm_vcpu *vcpu, unsigned int irq)
 bool kvm_riscv_vcpu_has_interrupts(struct kvm_vcpu *vcpu, u64 mask)
 {
 	unsigned long flags;
-	unsigned long ie;
+	unsigned long ie, vsie;
 	bool ret;
 
 	raw_spin_lock_irqsave(&vcpu->arch.irqs_pending_lock, flags);
-	ie = ((vcpu->arch.guest_csr.vsie & VSIP_VALID_MASK)
-		<< VSIP_TO_HVIP_SHIFT) & (unsigned long)mask;
+	vsie = vcpu->arch.guest_csr.vsie & VSIP_VALID_MASK;
+	ie = ((vsie & ~SIP_LCOFIP) << VSIP_TO_HVIP_SHIFT) |
+	     (vsie & SIP_LCOFIP);
+	ie &= (unsigned long)mask;
 	ie |= vcpu->arch.guest_csr.vsie & ~IRQ_LOCAL_MASK &
 		(unsigned long)mask;
 	ret = vcpu->arch.irqs_pending[0] & ie;

Re: [PATCH] RISC-V: KVM: Preserve LCOFIP when checking pending interrupts

[sashiko-bot]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:

Pre-existing issues:
- [High] The patch fixes the LCOFIP bit shift for pending interrupts in `kvm_riscv_vcpu_has_interrupts()`, but fails to fix identical shifting bugs in the `sip` CSR user-space accessors (`kvm_riscv_vcpu_general_get_csr` and `kvm_riscv_vcpu_general_set_csr`), breaking live migration and state save/restore.
--

commit 303435fe5072a60c37b6dc33685536a2c46952a5
Author: Pengpeng Hou <pengpeng@iscas.ac.cn>

RISC-V: KVM: Preserve LCOFIP when checking pending interrupts

KVM injects the guest counter-overflow interrupt into HVIP bit 13 and
records the same bit in irqs_pending. The guest enables it through VSIE
LCOFIE, also at bit 13.

> diff --git a/arch/riscv/kvm/vcpu.c b/arch/riscv/kvm/vcpu.c
> index 977e36ab83d3f..bdace86686e1a 100644
> --- a/arch/riscv/kvm/vcpu.c
> +++ b/arch/riscv/kvm/vcpu.c
> @@ -471,12 +471,14 @@ int kvm_riscv_vcpu_unset_interrupt(struct kvm_vcpu *vcpu, unsigned int irq)
>  bool kvm_riscv_vcpu_has_interrupts(struct kvm_vcpu *vcpu, u64 mask)
>  {
>  	unsigned long flags;
> -	unsigned long ie;
> +	unsigned long ie, vsie;
>  	bool ret;
>  
>  	raw_spin_lock_irqsave(&vcpu->arch.irqs_pending_lock, flags);
> -	ie = ((vcpu->arch.guest_csr.vsie & VSIP_VALID_MASK)
> -		<< VSIP_TO_HVIP_SHIFT) & (unsigned long)mask;
> +	vsie = vcpu->arch.guest_csr.vsie & VSIP_VALID_MASK;
> +	ie = ((vsie & ~SIP_LCOFIP) << VSIP_TO_HVIP_SHIFT) |
> +	     (vsie & SIP_LCOFIP);
> +	ie &= (unsigned long)mask;

[Severity: High]
This is a pre-existing issue, but does the same LCOFIP bit shift bug also
break the sip CSR user-space accessors in arch/riscv/kvm/vcpu_onereg.c?

Looking at kvm_riscv_vcpu_general_get_csr(), the PMU overflow bit
(IRQ_PMU_OVF, bit 13) in hvip is shifted right by VSIP_TO_HVIP_SHIFT (1) to
bit 12, then masked out by VSIP_VALID_MASK which lacks bit 12:

    *out_val = (csr->hvip >> VSIP_TO_HVIP_SHIFT) & VSIP_VALID_MASK;
    *out_val |= csr->hvip & ~IRQ_LOCAL_MASK;

The subsequent OR with ~IRQ_LOCAL_MASK clears bits 0-13, dropping it
entirely.

Similarly in kvm_riscv_vcpu_general_set_csr(), when userspace restores sip,
the incoming bit 13 is incorrectly shifted left by 1 to bit 14 before being
written to hvip:

    reg_val &= VSIP_VALID_MASK;
    reg_val <<= VSIP_TO_HVIP_SHIFT;

Can this silently lose or corrupt the guest PMU overflow interrupt state
during VM live migration or state save/restore when userspace calls
KVM_GET_ONE_REG and KVM_SET_ONE_REG?

>  	ie |= vcpu->arch.guest_csr.vsie & ~IRQ_LOCAL_MASK &
>  		(unsigned long)mask;
>  	ret = vcpu->arch.irqs_pending[0] & ie;

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260901080610.91993-1-pengpeng@iscas.ac.cn?part=1

Re: [PATCH] RISC-V: KVM: Preserve LCOFIP when checking pending interrupts

[Yicong Yang]

Hi,

On 9/1/26 4:06 PM, Pengpeng Hou wrote:
> KVM injects the guest counter-overflow interrupt into HVIP bit 13 and
> records the same bit in irqs_pending. The guest enables it through VSIE
> LCOFIE, also at bit 13.
> 
> kvm_riscv_vcpu_has_interrupts() shifts the complete VSIP valid mask by
> VSIP_TO_HVIP_SHIFT before matching it against irqs_pending. That maps
> SSIP, STIP, and SEIP to VSSIP, VSTIP, and VSEIP, but incorrectly moves
> LCOFIP from bit 13 to bit 14. The following high-interrupt term excludes
> all local interrupt bits, so it cannot recover LCOFIP.
> 
> As a result, kvm_arch_vcpu_runnable() can report false for a vCPU waiting
> in WFI even though an enabled PMU overflow interrupt is pending.
> 
> Keep LCOFIP in place while shifting the three interrupt classes that have
> distinct VS-level bit positions. This makes a vCPU halted in WFI runnable
> when its PMU overflow interrupt is pending.
> 
> Fixes: 16b0bde9a37c ("RISC-V: KVM: Add perf sampling support for guests")
> Signed-off-by: Pengpeng Hou <pengpeng@iscas.ac.cn>

i suppose it's a vsip/hvip conversion bug but currently only lcofi will
trigger this. a fix for the conversion:

https://lore.kernel.org/linux-riscv/20260804134018.85497-1-yang.yicong@picoheart.com/

> ---
>  arch/riscv/kvm/vcpu.c | 8 +++++---
>  1 file changed, 5 insertions(+), 3 deletions(-)
> 
> diff --git a/arch/riscv/kvm/vcpu.c b/arch/riscv/kvm/vcpu.c
> index e062ca1..c6eb3bd 100644
> --- a/arch/riscv/kvm/vcpu.c
> +++ b/arch/riscv/kvm/vcpu.c
> @@ -487,12 +487,14 @@ int kvm_riscv_vcpu_unset_interrupt(struct kvm_vcpu *vcpu, unsigned int irq)
>  bool kvm_riscv_vcpu_has_interrupts(struct kvm_vcpu *vcpu, u64 mask)
>  {
>  	unsigned long flags;
> -	unsigned long ie;
> +	unsigned long ie, vsie;
>  	bool ret;
>  
>  	raw_spin_lock_irqsave(&vcpu->arch.irqs_pending_lock, flags);
> -	ie = ((vcpu->arch.guest_csr.vsie & VSIP_VALID_MASK)
> -		<< VSIP_TO_HVIP_SHIFT) & (unsigned long)mask;
> +	vsie = vcpu->arch.guest_csr.vsie & VSIP_VALID_MASK;
> +	ie = ((vsie & ~SIP_LCOFIP) << VSIP_TO_HVIP_SHIFT) |
> +	     (vsie & SIP_LCOFIP);
> +	ie &= (unsigned long)mask;
>  	ie |= vcpu->arch.guest_csr.vsie & ~IRQ_LOCAL_MASK &
>  		(unsigned long)mask;
>  	ret = vcpu->arch.irqs_pending[0] & ie;
> 
> 
> _______________________________________________
> linux-riscv mailing list
> linux-riscv@lists.infradead.org
> http://lists.infradead.org/mailman/listinfo/linux-riscv