git: ada1f577cc29 - main - bhyve/riscv: correctly handle empty masks and broadcast in SBI IPI/RFNC

The branch main has been updated by br:

URL: https://cgit.FreeBSD.org/src/commit/?id=ada1f577cc291336cbb69782075dbbf9fe746872

commit ada1f577cc291336cbb69782075dbbf9fe746872
Author:     Doongar Singh <doonbsd@gmail.com>
AuthorDate: 2026-11-02 20:58:53 +0000
Commit:     Ruslan Bukin <br@FreeBSD.org>
CommitDate: 2026-11-02 21:05:46 +0000

    bhyve/riscv: correctly handle empty masks and broadcast in SBI IPI/RFNC
    
    Bhyve treats an empty cpu set as an error which triggers MPASS panic in
    the guest. As per the SBI spec, empty masks should return SBI_SUCCESS,
    and a base of -1UL specifies a broadcast to all harts.  Fix both in
    vmm_sbi.c, clear a1 on return, and skip the SBI ecall in
    sbi_ipi_pic_ipi_send() if the mask is empty. Also add a NULL check in
    riscv_send_ipi().
    
    Signed-off-by: Doongar Singh <doonbsd@gmail.com>
    
    Reviewed by:    br
    Differential Revision:  https://reviews.freebsd.org/D61126
---
 sys/riscv/riscv/sbi_ipi.c |  2 ++
 sys/riscv/vmm/vmm_riscv.c |  2 ++
 sys/riscv/vmm/vmm_sbi.c   | 71 ++++++++++++++++++++++++++++-------------------
 3 files changed, 47 insertions(+), 28 deletions(-)

diff --git a/sys/riscv/riscv/sbi_ipi.c b/sys/riscv/riscv/sbi_ipi.c
index fac5c0c39b99..af1df948880b 100644
--- a/sys/riscv/riscv/sbi_ipi.c
+++ b/sys/riscv/riscv/sbi_ipi.c
@@ -74,6 +74,8 @@ sbi_ipi_pic_ipi_send(device_t dev, struct intr_irqsrc *isrc, cpuset_t cpus,
 			mask |= (1ul << pc->pc_hart);
 		}
 	}
+	if (mask == 0)
+		return;
 	sbi_send_ipi(&mask);
 }
 
diff --git a/sys/riscv/vmm/vmm_riscv.c b/sys/riscv/vmm/vmm_riscv.c
index fe2ca5c07789..3798ab8b0ec8 100644
--- a/sys/riscv/vmm/vmm_riscv.c
+++ b/sys/riscv/vmm/vmm_riscv.c
@@ -548,6 +548,8 @@ riscv_send_ipi(struct hyp *hyp, cpuset_t *cpus)
 		if (!CPU_ISSET(i, cpus))
 			continue;
 		hypctx = hyp->ctx[i];
+		if (hypctx == NULL)
+			continue;
 		atomic_set_32(&hypctx->ipi_pending, 1);
 		vcpu_notify_event(vm_vcpu(vm, i));
 	}
diff --git a/sys/riscv/vmm/vmm_sbi.c b/sys/riscv/vmm/vmm_sbi.c
index c1e6022097e3..85e336847916 100644
--- a/sys/riscv/vmm/vmm_sbi.c
+++ b/sys/riscv/vmm/vmm_sbi.c
@@ -52,7 +52,7 @@ vmm_sbi_handle_rfnc(struct vcpu *vcpu, struct hypctx *hypctx)
 	struct hyp *hyp;
 	uint16_t maxcpus;
 	cpuset_t cpus;
-	int i;
+	u_int i;
 
 	func_id = hypctx->guest_regs.hyp_a[6];
 	hart_mask = hypctx->guest_regs.hyp_a[0];
@@ -83,27 +83,29 @@ vmm_sbi_handle_rfnc(struct vcpu *vcpu, struct hypctx *hypctx)
 	hyp = hypctx->hyp;
 	active_cpus = vm_active_cpus(hyp->vm);
 	maxcpus = vm_get_maxcpus(hyp->vm);
-	for (i = 0; i < maxcpus; i++) {
-		vcpu = vm_vcpu(hyp->vm, i);
-		if (vcpu == NULL)
-			continue;
-		if (hart_mask_base != -1UL) {
-			if (i < hart_mask_base)
-				continue;
-			if (!(hart_mask & (1UL << (i - hart_mask_base))))
-				continue;
-		}
-		/*
-		 * If either hart_mask_base or at least one hartid from
-		 * hart_mask is not valid, then return error.
-		 */
-		if (!CPU_ISSET(i, &active_cpus))
+
+	if (hart_mask_base == (uint64_t)-1) {
+		CPU_COPY(&active_cpus, &cpus);
+	} else {
+		if (hart_mask == 0)
+			return (SBI_SUCCESS);
+		if (hart_mask_base >= maxcpus)
 			return (SBI_ERR_INVALID_PARAM);
-		CPU_SET(i, &cpus);
+
+		while (hart_mask != 0) {
+			i = ffsl(hart_mask) - 1;
+			hart_mask &= ~(1UL << i);
+
+			if (hart_mask_base + i >= maxcpus)
+				return (SBI_ERR_INVALID_PARAM);
+			if (!CPU_ISSET(hart_mask_base + i, &active_cpus))
+				return (SBI_ERR_INVALID_PARAM);
+			CPU_SET(hart_mask_base + i, &cpus);
+		}
 	}
 
 	if (CPU_EMPTY(&cpus))
-		return (SBI_ERR_INVALID_PARAM);
+		return (SBI_SUCCESS);
 
 	vmm_fence_add(hyp->vm, &cpus, &fence);
 
@@ -138,9 +140,9 @@ vmm_sbi_handle_ipi(struct vcpu *vcpu, struct hypctx *hypctx)
 	uint64_t hart_mask;
 	uint64_t hart_mask_base;
 	uint64_t func_id;
+	uint16_t maxcpus;
 	cpuset_t cpus;
-	int hart_id;
-	int bit;
+	u_int i;
 
 	func_id = hypctx->guest_regs.hyp_a[6];
 	hart_mask = hypctx->guest_regs.hyp_a[0];
@@ -151,18 +153,30 @@ vmm_sbi_handle_ipi(struct vcpu *vcpu, struct hypctx *hypctx)
 	hyp = hypctx->hyp;
 
 	active_cpus = vm_active_cpus(hyp->vm);
+	maxcpus = vm_get_maxcpus(hyp->vm);
 
 	CPU_ZERO(&cpus);
 	switch (func_id) {
 	case SBI_IPI_SEND_IPI:
-		while ((bit = ffs(hart_mask))) {
-			hart_id = (bit - 1);
-			hart_mask &= ~(1u << hart_id);
-			if (hart_mask_base != -1)
-				hart_id += hart_mask_base;
-			if (!CPU_ISSET(hart_id, &active_cpus))
+		if (hart_mask_base == (uint64_t)-1) {
+			CPU_COPY(&active_cpus, &cpus);
+		} else {
+			if (hart_mask == 0)
+				return (SBI_SUCCESS);
+			if (hart_mask_base >= maxcpus)
 				return (SBI_ERR_INVALID_PARAM);
-			CPU_SET(hart_id, &cpus);
+
+			while (hart_mask != 0) {
+				i = ffsl(hart_mask) - 1;
+				hart_mask &= ~(1UL << i);
+
+				if (hart_mask_base + i >= maxcpus)
+					return (SBI_ERR_INVALID_PARAM);
+				if (!CPU_ISSET(hart_mask_base + i,
+				    &active_cpus))
+					return (SBI_ERR_INVALID_PARAM);
+				CPU_SET(hart_mask_base + i, &cpus);
+			}
 		}
 		break;
 	default:
@@ -171,7 +185,7 @@ vmm_sbi_handle_ipi(struct vcpu *vcpu, struct hypctx *hypctx)
 	}
 
 	if (CPU_EMPTY(&cpus))
-		return (SBI_ERR_INVALID_PARAM);
+		return (SBI_SUCCESS);
 
 	riscv_send_ipi(hyp, &cpus);
 
@@ -214,6 +228,7 @@ vmm_sbi_ecall(struct vcpu *vcpu)
 	}
 
 	hypctx->guest_regs.hyp_a[0] = error;
+	hypctx->guest_regs.hyp_a[1] = 0;
 
 	/* Request is handled in kernel mode. */
 	return (true);