]> www.infradead.org Git - users/jedix/linux-maple.git/commit
KVM: arm64: vgic-v4: Only attempt vLPI mapping for actual MSIs
authorOliver Upton <oliver.upton@linux.dev>
Wed, 26 Feb 2025 18:31:21 +0000 (10:31 -0800)
committerOliver Upton <oliver.upton@linux.dev>
Wed, 26 Feb 2025 21:22:48 +0000 (13:22 -0800)
commita0d7e2fc61ab54f1be817c9300231a1b48432628
treeb5b1d63be9d570312b76d1b66713316de71a9ec9
parent0ad2507d5d93f39619fc42372c347d6006b64319
KVM: arm64: vgic-v4: Only attempt vLPI mapping for actual MSIs

Some 'creative' VMMs out there may assign a VFIO MSI eventfd to an SPI
routing entry.

And yes, I can already hear you shouting about possibly driving a level
interrupt with an edge-sensitive one. You know who you are.

This works for the most part, and interrupt injection winds up taking
the software path. However, when running on GICv4-enabled hardware, KVM
erroneously attempts to setup LPI forwarding, even though the KVM
routing isn't an MSI.

Thanks to misuse of a union, the MSI destination is unlikely to match any
ITS in the VM and kvm_vgic_v4_set_forwarding() bails early. Later on when
the VM is being torn down, this half-configured state triggers the
WARN_ON() in kvm_vgic_v4_unset_forwarding() due to the fact that no HW
IRQ was ever assigned.

Avoid the whole mess by preventing SPI routing entries from getting into
the LPI forwarding helpers.

Reported-by: Sudheer Dantuluri <dantuluris@google.com>
Tested-by: Sudheer Dantuluri <dantuluris@google.com>
Fixes: 196b136498b3 ("KVM: arm/arm64: GICv4: Wire mapping/unmapping of VLPIs in VFIO irq bypass")
Acked-by: Marc Zyngier <maz@kernel.org>
Link: https://lore.kernel.org/r/20250226183124.82094-2-oliver.upton@linux.dev
Signed-off-by: Oliver Upton <oliver.upton@linux.dev>
arch/arm64/kvm/arm.c