[PATCH v3 0/4] LoongArch: KVM: Small enhancements about IPI and LBT

[PATCH v3 0/4] LoongArch: KVM: Small enhancements about IPI and LBT

[Bibo Mao]

Thre are some small enhancement about IPI emulation and LBT enabling in
LoongArch KVM. With IPI, it supports sending command to vCPU itself. And
with LBT it adds flag checking int function kvm_own_lbt() and make it
robust.

---
v2 ... v3:
  1. Fix stack protector issue in send_ipi_data()

v1 ... v2:
  1. Add sending IPI command to vCPU itself
  2. Avoid duplicated LBT enabling in kvm_own_lbt()
---
Bibo Mao (4):
  LoongArch: KVM: Fix stack protector issue in send_ipi_data()
  LoongArch: KVM: Access mailbox directly in mail_send()
  LoongArch: KVM: Add implementation with IOCSR_IPI_SET
  LoongArch: KVM: Make function kvm_own_lbt() robust

 arch/loongarch/kvm/intc/ipi.c | 57 ++++++++++++++++++++++-------------
 arch/loongarch/kvm/vcpu.c     |  8 +++--
 2 files changed, 41 insertions(+), 24 deletions(-)


base-commit: dfc0f6373094dd88e1eaf76c44f2ff01b65db851
-- 
2.39.3

[PATCH v3 1/4] LoongArch: KVM: Fix stack protector issue in send_ipi_data()

[Bibo Mao]

Function kvm_io_bus_read() is called in function send_ipi_data(), buffer
size of parameter *val should be at least 8 bytes. Some emulation
functions like loongarch_ipi_readl() and kvm_eiointc_read() will
write buffer *val with 8 bytes signed extension regardless parameter
len.

Otherwise there will be buffer overflow issue when CONFIG_STACKPROTECTOR
is enabled. The bug report is shown as follows:
Kernel panic - not syncing: stack-protector: Kernel stack is corrupted in: send_ipi_data+0x194/0x1a0 [kvm]
CPU: 11 UID: 107 PID: 2692 Comm: CPU 0/KVM Not tainted 6.17.0-rc1+ #102 PREEMPT(full)
Stack : 9000000005901568 0000000000000000 9000000003af371c 900000013c68c000
        900000013c68f850 900000013c68f858 0000000000000000 900000013c68f998
        900000013c68f990 900000013c68f990 900000013c68f6c0 fffffffffffdb058
        fffffffffffdb0e0 900000013c68f858 911e1d4d39cf0ec2 9000000105657a00
        0000000000000001 fffffffffffffffe 0000000000000578 282049464555206e
        6f73676e6f6f4c20 0000000000000001 00000000086b4000 0000000000000000
        0000000000000000 0000000000000000 9000000005709968 90000000058f9000
        900000013c68fa68 900000013c68fab4 90000000029279f0 900000010153f940
        900000010001f360 0000000000000000 9000000003af3734 000000004390000c
        00000000000000b0 0000000000000004 0000000000000000 0000000000071c1d
        ...
Call Trace:
[<9000000003af3734>] show_stack+0x5c/0x180
[<9000000003aed168>] dump_stack_lvl+0x6c/0x9c
[<9000000003ad0ab0>] vpanic+0x108/0x2c4
[<9000000003ad0ca8>] panic+0x3c/0x40
[<9000000004eb0a1c>] __stack_chk_fail+0x14/0x18
[<ffff8000023473f8>] send_ipi_data+0x190/0x1a0 [kvm]
[<ffff8000023313e4>] __kvm_io_bus_write+0xa4/0xe8 [kvm]
[<ffff80000233147c>] kvm_io_bus_write+0x54/0x90 [kvm]
[<ffff80000233f9f8>] kvm_emu_iocsr+0x180/0x310 [kvm]
[<ffff80000233fe08>] kvm_handle_gspr+0x280/0x478 [kvm]
[<ffff8000023443e8>] kvm_handle_exit+0xc0/0x130 [kvm]

Fixes: daee2f9cae551 ("LoongArch: KVM: Add IPI read and write function")
Cc: stable@vger.kernel.org
Signed-off-by: Bibo Mao <maobibo@loongson.cn>
---
 arch/loongarch/kvm/intc/ipi.c | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/arch/loongarch/kvm/intc/ipi.c b/arch/loongarch/kvm/intc/ipi.c
index e658d5b37c04..7925651d2ccf 100644
--- a/arch/loongarch/kvm/intc/ipi.c
+++ b/arch/loongarch/kvm/intc/ipi.c
@@ -99,7 +99,7 @@ static void write_mailbox(struct kvm_vcpu *vcpu, int offset, uint64_t data, int
 static int send_ipi_data(struct kvm_vcpu *vcpu, gpa_t addr, uint64_t data)
 {
 	int i, idx, ret;
-	uint32_t val = 0, mask = 0;
+	uint64_t val = 0, mask = 0;
 
 	/*
 	 * Bit 27-30 is mask for byte writing.
@@ -108,7 +108,7 @@ static int send_ipi_data(struct kvm_vcpu *vcpu, gpa_t addr, uint64_t data)
 	if ((data >> 27) & 0xf) {
 		/* Read the old val */
 		idx = srcu_read_lock(&vcpu->kvm->srcu);
-		ret = kvm_io_bus_read(vcpu, KVM_IOCSR_BUS, addr, sizeof(val), &val);
+		ret = kvm_io_bus_read(vcpu, KVM_IOCSR_BUS, addr, 4, &val);
 		srcu_read_unlock(&vcpu->kvm->srcu, idx);
 		if (unlikely(ret)) {
 			kvm_err("%s: : read data from addr %llx failed\n", __func__, addr);
@@ -124,7 +124,7 @@ static int send_ipi_data(struct kvm_vcpu *vcpu, gpa_t addr, uint64_t data)
 	}
 	val |= ((uint32_t)(data >> 32) & ~mask);
 	idx = srcu_read_lock(&vcpu->kvm->srcu);
-	ret = kvm_io_bus_write(vcpu, KVM_IOCSR_BUS, addr, sizeof(val), &val);
+	ret = kvm_io_bus_write(vcpu, KVM_IOCSR_BUS, addr, 4, &val);
 	srcu_read_unlock(&vcpu->kvm->srcu, idx);
 	if (unlikely(ret))
 		kvm_err("%s: : write data to addr %llx failed\n", __func__, addr);
-- 
2.39.3

[PATCH v3 2/4] LoongArch: KVM: Access mailbox directly in mail_send()

[Bibo Mao]

With function mail_send(), it is to write mailbox of other VCPUs.
Existing simple APIs read_mailbox/write_mailbox can be used directly
rather than send command on IOCSR address.

Signed-off-by: Bibo Mao <maobibo@loongson.cn>
---
 arch/loongarch/kvm/intc/ipi.c | 16 +++++++++++++---
 1 file changed, 13 insertions(+), 3 deletions(-)

diff --git a/arch/loongarch/kvm/intc/ipi.c b/arch/loongarch/kvm/intc/ipi.c
index 7925651d2ccf..f27f79a0c1e0 100644
--- a/arch/loongarch/kvm/intc/ipi.c
+++ b/arch/loongarch/kvm/intc/ipi.c
@@ -134,7 +134,8 @@ static int send_ipi_data(struct kvm_vcpu *vcpu, gpa_t addr, uint64_t data)
 
 static int mail_send(struct kvm *kvm, uint64_t data)
 {
-	int cpu, mailbox, offset;
+	int i, cpu, mailbox, offset;
+	uint32_t val = 0, mask = 0;
 	struct kvm_vcpu *vcpu;
 
 	cpu = ((data & 0xffffffff) >> 16) & 0x3ff;
@@ -144,9 +145,18 @@ static int mail_send(struct kvm *kvm, uint64_t data)
 		return -EINVAL;
 	}
 	mailbox = ((data & 0xffffffff) >> 2) & 0x7;
-	offset = IOCSR_IPI_BASE + IOCSR_IPI_BUF_20 + mailbox * 4;
+	offset = IOCSR_IPI_BUF_20 + mailbox * 4;
+	if ((data >> 27) & 0xf) {
+		val = read_mailbox(vcpu, offset, 4);
+		for (i = 0; i < 4; i++)
+			if (data & (BIT(27 + i)))
+				mask |= (0xff << (i * 8));
+		val &= mask;
+	}
 
-	return send_ipi_data(vcpu, offset, data);
+	val |= ((uint32_t)(data >> 32) & ~mask);
+	write_mailbox(vcpu, offset, val, 4);
+	return 0;
 }
 
 static int any_send(struct kvm *kvm, uint64_t data)
-- 
2.39.3

[PATCH v3 3/4] LoongArch: KVM: Add implementation with IOCSR_IPI_SET

[Bibo Mao]

IPI IOCSR register IOCSR_IPI_SET can send ipi interrupt to other vCPUs,
also it can send interrupt to vCPU itself. Instead there is such
operation on Linux such as arch_irq_work_raise(), it will send ipi
message to vCPU itself.

Here add implementation of write operation with IOCSR_IPI_SET register.

Signed-off-by: Bibo Mao <maobibo@loongson.cn>
---
 arch/loongarch/kvm/intc/ipi.c | 35 ++++++++++++++++++++---------------
 1 file changed, 20 insertions(+), 15 deletions(-)

diff --git a/arch/loongarch/kvm/intc/ipi.c b/arch/loongarch/kvm/intc/ipi.c
index f27f79a0c1e0..3fb98abd9554 100644
--- a/arch/loongarch/kvm/intc/ipi.c
+++ b/arch/loongarch/kvm/intc/ipi.c
@@ -7,13 +7,26 @@
 #include <asm/kvm_ipi.h>
 #include <asm/kvm_vcpu.h>
 
-static void ipi_send(struct kvm *kvm, uint64_t data)
+static void ipi_set(struct kvm_vcpu *vcpu, uint32_t data)
 {
-	int cpu, action;
 	uint32_t status;
-	struct kvm_vcpu *vcpu;
 	struct kvm_interrupt irq;
 
+	spin_lock(&vcpu->arch.ipi_state.lock);
+	status = vcpu->arch.ipi_state.status;
+	vcpu->arch.ipi_state.status |= data;
+	spin_unlock(&vcpu->arch.ipi_state.lock);
+	if ((status == 0) && data) {
+		irq.irq = LARCH_INT_IPI;
+		kvm_vcpu_ioctl_interrupt(vcpu, &irq);
+	}
+}
+
+static void ipi_send(struct kvm *kvm, uint64_t data)
+{
+	int cpu;
+	struct kvm_vcpu *vcpu;
+
 	cpu = ((data & 0xffffffff) >> 16) & 0x3ff;
 	vcpu = kvm_get_vcpu_by_cpuid(kvm, cpu);
 	if (unlikely(vcpu == NULL)) {
@@ -21,15 +34,7 @@ static void ipi_send(struct kvm *kvm, uint64_t data)
 		return;
 	}
 
-	action = BIT(data & 0x1f);
-	spin_lock(&vcpu->arch.ipi_state.lock);
-	status = vcpu->arch.ipi_state.status;
-	vcpu->arch.ipi_state.status |= action;
-	spin_unlock(&vcpu->arch.ipi_state.lock);
-	if (status == 0) {
-		irq.irq = LARCH_INT_IPI;
-		kvm_vcpu_ioctl_interrupt(vcpu, &irq);
-	}
+	ipi_set(vcpu, BIT(data & 0x1f));
 }
 
 static void ipi_clear(struct kvm_vcpu *vcpu, uint64_t data)
@@ -241,7 +246,7 @@ static int loongarch_ipi_writel(struct kvm_vcpu *vcpu, gpa_t addr, int len, cons
 		spin_unlock(&vcpu->arch.ipi_state.lock);
 		break;
 	case IOCSR_IPI_SET:
-		ret = -EINVAL;
+		ipi_set(vcpu, data);
 		break;
 	case IOCSR_IPI_CLEAR:
 		/* Just clear the status of the current vcpu */
@@ -260,10 +265,10 @@ static int loongarch_ipi_writel(struct kvm_vcpu *vcpu, gpa_t addr, int len, cons
 		ipi_send(vcpu->kvm, data);
 		break;
 	case IOCSR_MAIL_SEND:
-		ret = mail_send(vcpu->kvm, *(uint64_t *)val);
+		ret = mail_send(vcpu->kvm, data);
 		break;
 	case IOCSR_ANY_SEND:
-		ret = any_send(vcpu->kvm, *(uint64_t *)val);
+		ret = any_send(vcpu->kvm, data);
 		break;
 	default:
 		kvm_err("%s: unknown addr: %llx\n", __func__, addr);
-- 
2.39.3

[PATCH v3 4/4] LoongArch: KVM: Make function kvm_own_lbt() robust

[Bibo Mao]

Add flag KVM_LARCH_LBT checking in function kvm_own_lbt(), so that
it can be called safely rather than duplicated enabling again.

Signed-off-by: Bibo Mao <maobibo@loongson.cn>
---
 arch/loongarch/kvm/vcpu.c | 8 +++++---
 1 file changed, 5 insertions(+), 3 deletions(-)

diff --git a/arch/loongarch/kvm/vcpu.c b/arch/loongarch/kvm/vcpu.c
index d1b8c50941ca..ce478151466c 100644
--- a/arch/loongarch/kvm/vcpu.c
+++ b/arch/loongarch/kvm/vcpu.c
@@ -1283,9 +1283,11 @@ int kvm_own_lbt(struct kvm_vcpu *vcpu)
 		return -EINVAL;
 
 	preempt_disable();
-	set_csr_euen(CSR_EUEN_LBTEN);
-	_restore_lbt(&vcpu->arch.lbt);
-	vcpu->arch.aux_inuse |= KVM_LARCH_LBT;
+	if (!(vcpu->arch.aux_inuse & KVM_LARCH_LBT)) {
+		set_csr_euen(CSR_EUEN_LBTEN);
+		_restore_lbt(&vcpu->arch.lbt);
+		vcpu->arch.aux_inuse |= KVM_LARCH_LBT;
+	}
 	preempt_enable();
 
 	return 0;
-- 
2.39.3

Re: [PATCH v3 0/4] LoongArch: KVM: Small enhancements about IPI and LBT

[Huacai Chen]

Patch-1 and Patch-4 are applied for loongarch-fixes.

Huacai

On Fri, Aug 15, 2025 at 10:26 AM Bibo Mao <maobibo@loongson.cn> wrote:
>
> Thre are some small enhancement about IPI emulation and LBT enabling in
> LoongArch KVM. With IPI, it supports sending command to vCPU itself. And
> with LBT it adds flag checking int function kvm_own_lbt() and make it
> robust.
>
> ---
> v2 ... v3:
>   1. Fix stack protector issue in send_ipi_data()
>
> v1 ... v2:
>   1. Add sending IPI command to vCPU itself
>   2. Avoid duplicated LBT enabling in kvm_own_lbt()
> ---
> Bibo Mao (4):
>   LoongArch: KVM: Fix stack protector issue in send_ipi_data()
>   LoongArch: KVM: Access mailbox directly in mail_send()
>   LoongArch: KVM: Add implementation with IOCSR_IPI_SET
>   LoongArch: KVM: Make function kvm_own_lbt() robust
>
>  arch/loongarch/kvm/intc/ipi.c | 57 ++++++++++++++++++++++-------------
>  arch/loongarch/kvm/vcpu.c     |  8 +++--
>  2 files changed, 41 insertions(+), 24 deletions(-)
>
>
> base-commit: dfc0f6373094dd88e1eaf76c44f2ff01b65db851
> --
> 2.39.3
>

Re: [PATCH v3 0/4] LoongArch: KVM: Small enhancements about IPI and LBT

[Huacai Chen]

On Sun, Aug 17, 2025 at 11:45 AM Huacai Chen <chenhuacai@kernel.org> wrote:
>
> Patch-1 and Patch-4 are applied for loongarch-fixes.
The rest are applied for loongarch-kvm.


Huacai

>
> Huacai
>
> On Fri, Aug 15, 2025 at 10:26 AM Bibo Mao <maobibo@loongson.cn> wrote:
> >
> > Thre are some small enhancement about IPI emulation and LBT enabling in
> > LoongArch KVM. With IPI, it supports sending command to vCPU itself. And
> > with LBT it adds flag checking int function kvm_own_lbt() and make it
> > robust.
> >
> > ---
> > v2 ... v3:
> >   1. Fix stack protector issue in send_ipi_data()
> >
> > v1 ... v2:
> >   1. Add sending IPI command to vCPU itself
> >   2. Avoid duplicated LBT enabling in kvm_own_lbt()
> > ---
> > Bibo Mao (4):
> >   LoongArch: KVM: Fix stack protector issue in send_ipi_data()
> >   LoongArch: KVM: Access mailbox directly in mail_send()
> >   LoongArch: KVM: Add implementation with IOCSR_IPI_SET
> >   LoongArch: KVM: Make function kvm_own_lbt() robust
> >
> >  arch/loongarch/kvm/intc/ipi.c | 57 ++++++++++++++++++++++-------------
> >  arch/loongarch/kvm/vcpu.c     |  8 +++--
> >  2 files changed, 41 insertions(+), 24 deletions(-)
> >
> >
> > base-commit: dfc0f6373094dd88e1eaf76c44f2ff01b65db851
> > --
> > 2.39.3
> >