From: fuqiang wang <fuqiang.wng@gmail.com>
To: Marc Zyngier <maz@kernel.org>, Oliver Upton <oupton@kernel.org>,
Zenghui Yu <yuzenghui@huawei.com>,
linux-kernel@vger.kernel.org, kvmarm@lists.linux.dev
Cc: dongxu zhang <xu910121@sina.com>,
wangfuqiang49 <wangfuqiang49@jd.com>,
fuqiang wang <fuqiang.wng@gmail.com>
Subject: [PATCH 2/2] KVM: arm64: Skip unreset vCPUs in MPIDR lookup table
Date: Thu, 11 Jun 2026 17:09:34 +0800 [thread overview]
Message-ID: <20260611090934.84469-3-fuqiang.wng@gmail.com> (raw)
In-Reply-To: <20260611090934.84469-1-fuqiang.wng@gmail.com>
When a VM is created with CPU hotplug support, kvm_for_each_vcpu() can
walk vCPUs that have not been reset yet. Their MPIDR_EL1 state is still
zero, which aliases vCPU0 when populating the compressed MPIDR lookup
table.
As a result, cmpidr_to_idx[0] can be overwritten with the index of an
unreset vCPU. A lookup for MPIDR 0 then returns the wrong vCPU, which
can prevent interrupts targeting vCPU0 from being delivered correctly
and make guest boot extremely slow.
Skip vCPUs whose MPIDR_EL1 value does not have the RES1 bit set.
Fixes: 5544750efd51 ("KVM: arm64: Build MPIDR to vcpu index cache at runtime")
Signed-off-by: fuqiang wang <fuqiang.wng@gmail.com>
---
arch/arm64/include/asm/kvm_emulate.h | 9 +++++++++
arch/arm64/kvm/arm.c | 10 ++++++++++
2 files changed, 19 insertions(+)
diff --git a/arch/arm64/include/asm/kvm_emulate.h b/arch/arm64/include/asm/kvm_emulate.h
index 5bf3d7e1d92c..8158e88aaa4e 100644
--- a/arch/arm64/include/asm/kvm_emulate.h
+++ b/arch/arm64/include/asm/kvm_emulate.h
@@ -506,6 +506,15 @@ static inline unsigned long kvm_vcpu_get_mpidr_aff(struct kvm_vcpu *vcpu)
return __vcpu_sys_reg(vcpu, MPIDR_EL1) & MPIDR_HWID_BITMASK;
}
+/*
+ * Check if MPIDR matches hardware reset value. RES1 bits are set after reset,
+ * while a zero default indicates a vCPU that has not been reset.
+ */
+static inline bool kvm_vcpu_mpidr_is_reset(u64 val)
+{
+ return (val & MIDR_RES1_MASK) == MIDR_RES1_MASK;
+}
+
static inline void kvm_vcpu_set_be(struct kvm_vcpu *vcpu)
{
if (vcpu_mode_is_32bit(vcpu)) {
diff --git a/arch/arm64/kvm/arm.c b/arch/arm64/kvm/arm.c
index 3732ee9eb0d4..b47088201683 100644
--- a/arch/arm64/kvm/arm.c
+++ b/arch/arm64/kvm/arm.c
@@ -890,6 +890,16 @@ static void kvm_init_mpidr_data(struct kvm *kvm)
u64 aff = kvm_vcpu_get_mpidr_aff(vcpu);
u16 index = kvm_mpidr_index(data, aff);
+ /*
+ * In the CPU hot-plug scenario, the kvm_for_each_vcpu() macro
+ * iterates over all possible vcpus. For vcpus that are not
+ * reset, kvm_vcpu_get_mpidr_aff() returns 0, then the index
+ * computed by kvm_mpidr_index() will also be 0, thereby
+ * overwriting the original value of vcpu0.
+ */
+ if (!kvm_vcpu_mpidr_is_reset(aff))
+ continue;
+
data->cmpidr_to_idx[index] = c;
}
--
2.47.0
prev parent reply other threads:[~2026-06-11 9:09 UTC|newest]
Thread overview: 3+ messages / expand[flat|nested] mbox.gz Atom feed top
2026-06-11 9:09 [PATCH 0/2] KVM: arm64: Fix MPIDR lookup for unreset vCPUs fuqiang wang
2026-06-11 9:09 ` [PATCH 1/2] arm64: Add MIDR_EL1 RES1 definitions fuqiang wang
2026-06-11 9:09 ` fuqiang wang [this message]
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20260611090934.84469-3-fuqiang.wng@gmail.com \
--to=fuqiang.wng@gmail.com \
--cc=kvmarm@lists.linux.dev \
--cc=linux-kernel@vger.kernel.org \
--cc=maz@kernel.org \
--cc=oupton@kernel.org \
--cc=wangfuqiang49@jd.com \
--cc=xu910121@sina.com \
--cc=yuzenghui@huawei.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox
all inboxes | Powered by JetHome®