Patch "riscv: KVM: Fix SBI IPI error generation" has been added to the 6.6-stable tree

[Sasha Levin <sashal@xxxxxxxxxx>]

This is a note to let you know that I've just added the patch titled

    riscv: KVM: Fix SBI IPI error generation

to the 6.6-stable tree which can be found at:
    http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary

The filename of the patch is:
     riscv-kvm-fix-sbi-ipi-error-generation.patch
and it can be found in the queue-6.6 subdirectory.

If you, or anyone else, feels it should not be added to the stable tree,
please let <stable@xxxxxxxxxxxxxxx> know about it.



commit 19a233925a062d99e872ebedf79e39b6eee29788
Author: Andrew Jones <ajones@xxxxxxxxxxxxxxxx>
Date:   Mon Feb 17 09:45:10 2025 +0100

    riscv: KVM: Fix SBI IPI error generation
    
    [ Upstream commit 0611f78f83c93c000029ab01daa28166d03590ed ]
    
    When an invalid function ID of an SBI extension is used we should
    return not-supported, not invalid-param. Also, when we see that at
    least one hartid constructed from the base and mask parameters is
    invalid, then we should return invalid-param. Finally, rather than
    relying on overflowing a left shift to result in zero and then using
    that zero in a condition which [correctly] skips sending an IPI (but
    loops unnecessarily), explicitly check for overflow and exit the loop
    immediately.
    
    Fixes: 5f862df5585c ("RISC-V: KVM: Add v0.1 replacement SBI extensions defined in v0.2")
    Signed-off-by: Andrew Jones <ajones@xxxxxxxxxxxxxxxx>
    Reviewed-by: Anup Patel <anup@xxxxxxxxxxxxxx>
    Link: https://lore.kernel.org/r/20250217084506.18763-10-ajones@xxxxxxxxxxxxxxxx
    Signed-off-by: Anup Patel <anup@xxxxxxxxxxxxxx>
    Signed-off-by: Sasha Levin <sashal@xxxxxxxxxx>

diff --git a/arch/riscv/kvm/vcpu_sbi_replace.c b/arch/riscv/kvm/vcpu_sbi_replace.c
index 7c4d5d38a3390..26e2619ab887b 100644
--- a/arch/riscv/kvm/vcpu_sbi_replace.c
+++ b/arch/riscv/kvm/vcpu_sbi_replace.c
@@ -51,9 +51,10 @@ static int kvm_sbi_ext_ipi_handler(struct kvm_vcpu *vcpu, struct kvm_run *run,
 	struct kvm_cpu_context *cp = &vcpu->arch.guest_context;
 	unsigned long hmask = cp->a0;
 	unsigned long hbase = cp->a1;
+	unsigned long hart_bit = 0, sentmask = 0;
 
 	if (cp->a6 != SBI_EXT_IPI_SEND_IPI) {
-		retdata->err_val = SBI_ERR_INVALID_PARAM;
+		retdata->err_val = SBI_ERR_NOT_SUPPORTED;
 		return 0;
 	}
 
@@ -62,15 +63,23 @@ static int kvm_sbi_ext_ipi_handler(struct kvm_vcpu *vcpu, struct kvm_run *run,
 		if (hbase != -1UL) {
 			if (tmp->vcpu_id < hbase)
 				continue;
-			if (!(hmask & (1UL << (tmp->vcpu_id - hbase))))
+			hart_bit = tmp->vcpu_id - hbase;
+			if (hart_bit >= __riscv_xlen)
+				goto done;
+			if (!(hmask & (1UL << hart_bit)))
 				continue;
 		}
 		ret = kvm_riscv_vcpu_set_interrupt(tmp, IRQ_VS_SOFT);
 		if (ret < 0)
 			break;
+		sentmask |= 1UL << hart_bit;
 		kvm_riscv_vcpu_pmu_incr_fw(tmp, SBI_PMU_FW_IPI_RCVD);
 	}
 
+done:
+	if (hbase != -1UL && (hmask ^ sentmask))
+		retdata->err_val = SBI_ERR_INVALID_PARAM;
+
 	return ret;
 }