KVM: arm64: vgic: Hoist SGI/PPI alloc from vgic_init() to kvm_create_vgic()

If userspace creates vcpus, then a vgic, we end-up in a situation
where irqchip_in_kernel() will return true, but no private interrupt
has been allocated for these vcpus. This situation will continue
until userspace initialises the vgic, at which point we fix the
early vcpus. Should a vcpu run or be initialised in the interval,
bad things may happen.

An obvious solution is to move this fix-up phase to the point where
the vgic is created. This ensures that from that point onwards,
all vcpus have their private interrupts, as new vcpus will directly
allocate them.

With that, we have the invariant that when irqchip_in_kernel() is
true, all vcpus have their private interrupts.

Reported-by: Alexander Potapenko <glider@google.com>
Reviewed-by: Oliver Upton <oliver.upton@linux.dev>
Link: https://lore.kernel.org/r/20250212182558.2865232-3-maz@kernel.org
Signed-off-by: Marc Zyngier <maz@kernel.org>

diff --git a/arch/arm64/kvm/vgic/vgic-init.c b/arch/arm64/kvm/vgic/vgic-init.c
index bc7e22ab5d812256e6568d948b4de92f3fd0e5af..775461cf2d2dbc4e4980c9824f01af92a783c104 100644 (file)
--- a/arch/arm64/kvm/vgic/vgic-init.c
+++ b/arch/arm64/kvm/vgic/vgic-init.c
@@ -34,9 +34,9 @@
  *
  * CPU Interface:
  *
- * - kvm_vgic_vcpu_init(): initialization of static data that
- *   doesn't depend on any sizing information or emulation type. No
- *   allocation is allowed there.
+ * - kvm_vgic_vcpu_init(): initialization of static data that doesn't depend
+ *   on any sizing information. Private interrupts are allocated if not
+ *   already allocated at vgic-creation time.
  */
 
 /* EARLY INIT */
@@ -58,6 +58,8 @@ void kvm_vgic_early_init(struct kvm *kvm)
 
 /* CREATION */
 
+static int vgic_allocate_private_irqs_locked(struct kvm_vcpu *vcpu, u32 type);
+
 /**
  * kvm_vgic_create: triggered by the instantiation of the VGIC device by
  * user space, either through the legacy KVM_CREATE_IRQCHIP ioctl (v2 only)
@@ -112,6 +114,22 @@ int kvm_vgic_create(struct kvm *kvm, u32 type)
                goto out_unlock;
        }
 
+       kvm_for_each_vcpu(i, vcpu, kvm) {
+               ret = vgic_allocate_private_irqs_locked(vcpu, type);
+               if (ret)
+                       break;
+       }
+
+       if (ret) {
+               kvm_for_each_vcpu(i, vcpu, kvm) {
+                       struct vgic_cpu *vgic_cpu = &vcpu->arch.vgic_cpu;
+                       kfree(vgic_cpu->private_irqs);
+                       vgic_cpu->private_irqs = NULL;
+               }
+
+               goto out_unlock;
+       }
+
        kvm->arch.vgic.in_kernel = true;
        kvm->arch.vgic.vgic_model = type;
 
@@ -180,7 +198,7 @@ static int kvm_vgic_dist_init(struct kvm *kvm, unsigned int nr_spis)
        return 0;
 }
 
-static int vgic_allocate_private_irqs_locked(struct kvm_vcpu *vcpu)
+static int vgic_allocate_private_irqs_locked(struct kvm_vcpu *vcpu, u32 type)
 {
        struct vgic_cpu *vgic_cpu = &vcpu->arch.vgic_cpu;
        int i;
@@ -218,17 +236,28 @@ static int vgic_allocate_private_irqs_locked(struct kvm_vcpu *vcpu)
                        /* PPIs */
                        irq->config = VGIC_CONFIG_LEVEL;
                }
+
+               switch (type) {
+               case KVM_DEV_TYPE_ARM_VGIC_V3:
+                       irq->group = 1;
+                       irq->mpidr = kvm_vcpu_get_mpidr_aff(vcpu);
+                       break;
+               case KVM_DEV_TYPE_ARM_VGIC_V2:
+                       irq->group = 0;
+                       irq->targets = BIT(vcpu->vcpu_id);
+                       break;
+               }
        }
 
        return 0;
 }
 
-static int vgic_allocate_private_irqs(struct kvm_vcpu *vcpu)
+static int vgic_allocate_private_irqs(struct kvm_vcpu *vcpu, u32 type)
 {
        int ret;
 
        mutex_lock(&vcpu->kvm->arch.config_lock);
-       ret = vgic_allocate_private_irqs_locked(vcpu);
+       ret = vgic_allocate_private_irqs_locked(vcpu, type);
        mutex_unlock(&vcpu->kvm->arch.config_lock);
 
        return ret;
@@ -258,7 +287,7 @@ int kvm_vgic_vcpu_init(struct kvm_vcpu *vcpu)
        if (!irqchip_in_kernel(vcpu->kvm))
                return 0;
 
-       ret = vgic_allocate_private_irqs(vcpu);
+       ret = vgic_allocate_private_irqs(vcpu, dist->vgic_model);
        if (ret)
                return ret;
 
@@ -295,7 +324,7 @@ int vgic_init(struct kvm *kvm)
 {
        struct vgic_dist *dist = &kvm->arch.vgic;
        struct kvm_vcpu *vcpu;
-       int ret = 0, i;
+       int ret = 0;
        unsigned long idx;
 
        lockdep_assert_held(&kvm->arch.config_lock);
@@ -315,35 +344,6 @@ int vgic_init(struct kvm *kvm)
        if (ret)
                goto out;
 
-       /* Initialize groups on CPUs created before the VGIC type was known */
-       kvm_for_each_vcpu(idx, vcpu, kvm) {
-               ret = vgic_allocate_private_irqs_locked(vcpu);
-               if (ret)
-                       goto out;
-
-               for (i = 0; i < VGIC_NR_PRIVATE_IRQS; i++) {
-                       struct vgic_irq *irq = vgic_get_vcpu_irq(vcpu, i);
-
-                       switch (dist->vgic_model) {
-                       case KVM_DEV_TYPE_ARM_VGIC_V3:
-                               irq->group = 1;
-                               irq->mpidr = kvm_vcpu_get_mpidr_aff(vcpu);
-                               break;
-                       case KVM_DEV_TYPE_ARM_VGIC_V2:
-                               irq->group = 0;
-                               irq->targets = 1U << idx;
-                               break;
-                       default:
-                               ret = -EINVAL;
-                       }
-
-                       vgic_put_irq(kvm, irq);
-
-                       if (ret)
-                               goto out;
-               }
-       }
-
        /*
         * If we have GICv4.1 enabled, unconditionally request enable the
         * v4 support so that we get HW-accelerated vSGIs. Otherwise, only