Re: [RFC PATCH 0/3] RISC-V: KVM/IOMMU: Fix MRIF irqfd notice handling

[fangyu.yu@linux.alibaba.com]

>Hi Fangyu,
>
>I put together a local test branch based on Andrew's RISC-V IOMMU
>irqbypass series [1] and your MRIF RFC series [2], then ran VFIO device
>assignment tests on hardware on top of that combined tree.
>
>One test case that exposed a problem was a VFIO guest started with QEMU's
>AIA emulation mode, e.g. `riscv-aia=emul`.  The guest could hang because
>a normal MSI injection was classified as a MRIF notice, so KVM skipped
>the software IMSIC EIP update and the interrupt was never made pending.
>
>The issue is that the current code identifies a MRIF notice by comparing
>the injected guest interrupt ID with cached host MSI data:
>
>    msg->data == iid
>
>That is a payload value comparison, not a source/provenance check.  A
>normal MSI injection can carry the same interrupt ID value as a cached
>host MSI message.  If the vCPU is currently using the software IMSIC file
>and this collision happens, KVM can misclassify the normal MSI as a MRIF
>notice, skip the software IMSIC EIP update, and leave the guest waiting
>for an interrupt that was never made pending.

Hi Zhanpeng,

Thanks for reviewing and testing my patches, and for pointing out
the race condition issues. Your analysis is very helpful.

A few notes on the current status:

My original patches were based on Andrew Jones's tree [1]. Andrew
has since published a v2 [2], and I have adapted my work on top of
that version with some additional fixes. However, Andrew's v2 still
needs further adjustments, so I plan to rebase onto his v3 once it
is available.

When I send out my v2, I will take your patchset into consideration.

Thanks again for your effort.

[1] https://github.com/jones-drew/linux/tree/riscv/
    iommu-irqbypass-rfc-v2-rc1
[2] https://lore.kernel.org/linux-riscv/
    20250920203851.2205115-20-ajones@ventanamicro.com/

Fangyu

>This series identifies MRIF notices by irqfd route provenance instead.
>irqfd_wakeup() already injects from a seqcount-protected copy of
>irqfd->irq_entry, so patch 2 keeps the architecture's MRIF notice metadata
>in that route snapshot.  Userspace MSI injection and normal guest MSI
>injection do not carry irqfd MRIF provenance and therefore follow the
>normal software IMSIC path.
>
>The generic KVM change is needed because the decision must be made from
>the same copied route that irqfd_wakeup() injects from; keeping the
>provenance in RISC-V side state would not be tied to that route snapshot.
>
>Feel free to fold any of these patches into previous commits if you think
>that is a better shape for the next version. I also have a few other local
>adaptation and improvement patches on top, but kept them out of this series
>to focus on the MRIF notice issue. Please let me know if you already have a
>plan for the next revision, I am happy to support your next version in
>whichever form is useful.
>
>Zhanpeng Zhang (3):
>  iommu/riscv: Complete MRIF MSI PTE setup
>  KVM: Move irqfd arch data into route snapshots
>  RISC-V: KVM: Identify MRIF notices from irqfd snapshots
>
>These patches are based on a combined tree, not a plain upstream tree.
>The combined tree is made up of the following pieces:
>In your series, patch 4/6 is already covered by the irqbypass series [1].
>I ported patches 1/6, 2/6, 3/6, the relevant MRIF MSI PTE part of 5/6,
>and the notice handler part of 6/6, with a few integration changes.
>
>Fangyu Yu's MRIF RFC series [2] (selected patches):
>  [1/6] RISC-V: Add more elements to irqbypass vcpu_info
>  [2/6] RISC-V: KVM: Transfer the physical address of MRIF to iommu-ir
>  [3/6] RISC-V: KVM: Add a xarray to record host irq msg
>  [5/6, adapted] iommu/riscv: Add MRIF mode support
>  [6/6, adapted] RISC-V: KVM: Check the MRIF in notice MSI irq handler
>
>Andrew Jones et al. [1] (irqbypass series, omitted):
>  [RFC PATCH v2 00/18] iommu/riscv: Add irqbypass support
>
>[1] https://lists.infradead.org/pipermail/kvm-riscv/2025-September/010148.html
>[2] https://lwn.net/ml/all/20250811061104.10326-1-fangyu.yu@linux.alibaba.com/