[PATCH v3 0/3] LoongArch: KVM: irqchip fixes

mirror of https://lore.kernel.org/lkml/
 help / color / mirror / Atom feed

* [PATCH v3 0/3] LoongArch: KVM: irqchip fixes
@ 2026-10-14  5:29 Tao Cui
  2026-10-14  5:29 ` [PATCH v3 1/3] LoongArch: KVM: Clear device pointer in irqchip destroy callbacks Tao Cui
                   ` (2 more replies)
  0 siblings, 3 replies; 6+ messages in thread
From: Tao Cui @ 2026-10-14  5:29 UTC (permalink / raw)
  To: chenhuacai, maobibo, gaosong, zhaotianrui
  Cc: loongarch, kvm, linux-kernel, kernel, nagachaithanya9911,
	cui.tao, lihongfu

From: lihongfu <lihongfu@kylinos.cn>

Hi,

Three fixes for the LoongArch KVM irqchip code:

- Patch 1 clears the device pointer in the destroy callbacks: when
  KVM_CREATE_DEVICE succeeds but the following fd allocation fails
  (e.g. under RLIMIT_NOFILE), ops->destroy() frees the irqchip while
  kvm->arch.* still points to it.

- Patch 2 aligns kvm_pch_pic_create() with kvm_eiointc_create() by
  propagating the real error code; the kvm_ipi_create() counterpart is
  being fixed separately (Chaithanya Lagisetty).

- Patch 3 rejects repeated PCH-PIC CTRL_INIT with -EEXIST, using the
  initialized state of the kvm_io_device as the indicator; the MMIO
  base is only committed after a successful bus registration.

All patches carry Fixes tags.

Changes in v3:

- Drop "Load dmsintc pointer once in pch_msi_set_irq" (v2 patch 2),
  suggested by Bibo and Huacai.

- Patch 3 (v2 patch 4): reject repeated CTRL_INIT by checking the
  kvm_io_device state instead of a separate has_init flag, also
  suggested by Huacai; the check stays under slots_lock.

Changes in v2:

- Drop "Guard against NULL irqchip in irq injection" (v1 patch 2) and
  "Rebase steal time counter in vcpu context" (v1 patch 4) after
  review discussion: their trigger scenarios are not reachable
  through real VMM behaviour.

- Use the one-line destroy style in dmsintc suggested by Bibo.

- Track repeated PCH-PIC CTRL_INIT with a has_init flag and return
  -EEXIST instead of -EBUSY, also suggested by Bibo; move the check
  and base update under slots_lock so they are atomic.

Tao Cui (3):
  LoongArch: KVM: Clear device pointer in irqchip destroy callbacks
  LoongArch: KVM: Propagate real error code in kvm_pch_pic_create
  LoongArch: KVM: Reject repeated PCH-PIC CTRL_INIT

 arch/loongarch/kvm/intc/dmsintc.c |  1 +
 arch/loongarch/kvm/intc/eiointc.c |  1 +
 arch/loongarch/kvm/intc/ipi.c     |  1 +
 arch/loongarch/kvm/intc/pch_pic.c | 15 +++++++++++----
 4 files changed, 14 insertions(+), 4 deletions(-)

-- 
2.43.0


^ permalink raw reply	[flat|nested] 6+ messages in thread

* [PATCH v3 1/3] LoongArch: KVM: Clear device pointer in irqchip destroy callbacks
  2026-10-14  5:29 [PATCH v3 0/3] LoongArch: KVM: irqchip fixes Tao Cui
@ 2026-10-14  5:29 ` Tao Cui
  2026-10-14  5:29 ` [PATCH v3 2/3] LoongArch: KVM: Propagate real error code in kvm_pch_pic_create Tao Cui
  2026-10-14  5:29 ` [PATCH v3 3/3] LoongArch: KVM: Reject repeated PCH-PIC CTRL_INIT Tao Cui
  2 siblings, 0 replies; 6+ messages in thread
From: Tao Cui @ 2026-10-14  5:29 UTC (permalink / raw)
  To: chenhuacai, maobibo, gaosong, zhaotianrui
  Cc: loongarch, kvm, linux-kernel, kernel, nagachaithanya9911,
	cui.tao, Tao Cui

From: Tao Cui <cuitao@kylinos.cn>

The destroy callbacks of the four irqchip devices free the device
structure without clearing kvm->arch.{ipi,eiointc,pch_pic,dmsintc},
leaving a dangling pointer.  ops->destroy() is not only called at VM
teardown but also when KVM_CREATE_DEVICE succeeds and the following
anon_inode_getfd() fails (e.g. under RLIMIT_NOFILE); the VM stays
alive, kvm_arch_irqchip_in_kernel() still reports true, and interrupt
injection dereferences the freed device.

Clear the pointer when destroying.

Fixes: c532de5a67a7 ("LoongArch: KVM: Add IPI device support")
Fixes: 2e8b9df82631 ("LoongArch: KVM: Add EIOINTC device support")
Fixes: e785dfacf7e7 ("LoongArch: KVM: Add PCHPIC device support")
Fixes: 229132c309d6 ("LoongArch: KVM: Add DMSINTC device support")
Signed-off-by: Tao Cui <cuitao@kylinos.cn>
---
 arch/loongarch/kvm/intc/dmsintc.c | 1 +
 arch/loongarch/kvm/intc/eiointc.c | 1 +
 arch/loongarch/kvm/intc/ipi.c     | 1 +
 arch/loongarch/kvm/intc/pch_pic.c | 1 +
 4 files changed, 4 insertions(+)

diff --git a/arch/loongarch/kvm/intc/dmsintc.c b/arch/loongarch/kvm/intc/dmsintc.c
index ff327b4c05f7..c182185a3d59 100644
--- a/arch/loongarch/kvm/intc/dmsintc.c
+++ b/arch/loongarch/kvm/intc/dmsintc.c
@@ -146,6 +146,7 @@ static void kvm_dmsintc_destroy(struct kvm_device *dev)
 		return;
 
 	kfree(dev->kvm->arch.dmsintc);
+	dev->kvm->arch.dmsintc = NULL;
 	kfree(dev);
 }
 
diff --git a/arch/loongarch/kvm/intc/eiointc.c b/arch/loongarch/kvm/intc/eiointc.c
index 80f78e07c74a..fe0a1918f26f 100644
--- a/arch/loongarch/kvm/intc/eiointc.c
+++ b/arch/loongarch/kvm/intc/eiointc.c
@@ -675,6 +675,7 @@ static void kvm_eiointc_destroy(struct kvm_device *dev)
 
 	kvm = dev->kvm;
 	eiointc = kvm->arch.eiointc;
+	kvm->arch.eiointc = NULL;
 	mutex_lock(&kvm->slots_lock);
 	kvm_io_bus_unregister_dev(kvm, KVM_IOCSR_BUS, &eiointc->device);
 	kvm_io_bus_unregister_dev(kvm, KVM_IOCSR_BUS, &eiointc->device_vext);
diff --git a/arch/loongarch/kvm/intc/ipi.c b/arch/loongarch/kvm/intc/ipi.c
index 80faa770c0cd..7a2dd72a4952 100644
--- a/arch/loongarch/kvm/intc/ipi.c
+++ b/arch/loongarch/kvm/intc/ipi.c
@@ -441,6 +441,7 @@ static void kvm_ipi_destroy(struct kvm_device *dev)
 
 	kvm = dev->kvm;
 	ipi = kvm->arch.ipi;
+	kvm->arch.ipi = NULL;
 	mutex_lock(&kvm->slots_lock);
 	kvm_io_bus_unregister_dev(kvm, KVM_IOCSR_BUS, &ipi->device);
 	mutex_unlock(&kvm->slots_lock);
diff --git a/arch/loongarch/kvm/intc/pch_pic.c b/arch/loongarch/kvm/intc/pch_pic.c
index 220fc23ffe8c..dab2d3f1b8f6 100644
--- a/arch/loongarch/kvm/intc/pch_pic.c
+++ b/arch/loongarch/kvm/intc/pch_pic.c
@@ -483,6 +483,7 @@ static void kvm_pch_pic_destroy(struct kvm_device *dev)
 
 	kvm = dev->kvm;
 	s = kvm->arch.pch_pic;
+	kvm->arch.pch_pic = NULL;
 	/* unregister pch pic device and free it's memory */
 	mutex_lock(&kvm->slots_lock);
 	kvm_io_bus_unregister_dev(kvm, KVM_MMIO_BUS, &s->device);
-- 
2.43.0


^ permalink raw reply	[flat|nested] 6+ messages in thread

* [PATCH v3 2/3] LoongArch: KVM: Propagate real error code in kvm_pch_pic_create
  2026-10-14  5:29 [PATCH v3 0/3] LoongArch: KVM: irqchip fixes Tao Cui
  2026-10-14  5:29 ` [PATCH v3 1/3] LoongArch: KVM: Clear device pointer in irqchip destroy callbacks Tao Cui
@ 2026-10-14  5:29 ` Tao Cui
  2026-10-14  5:29 ` [PATCH v3 3/3] LoongArch: KVM: Reject repeated PCH-PIC CTRL_INIT Tao Cui
  2 siblings, 0 replies; 6+ messages in thread
From: Tao Cui @ 2026-10-14  5:29 UTC (permalink / raw)
  To: chenhuacai, maobibo, gaosong, zhaotianrui
  Cc: loongarch, kvm, linux-kernel, kernel, nagachaithanya9911,
	cui.tao, Tao Cui

From: Tao Cui <cuitao@kylinos.cn>

kvm_pch_pic_create() replaces the real error of
kvm_setup_default_irq_routing() with a fixed -ENOMEM.  Return the
actual code, as kvm_eiointc_create() already does; the kvm_ipi_create()
case is fixed separately by "Return the actual error code in
kvm_ipi_create()" (Chaithanya Lagisetty).

Fixes: e785dfacf7e7 ("LoongArch: KVM: Add PCHPIC device support")
Signed-off-by: Tao Cui <cuitao@kylinos.cn>
Reviewed-by: Bibo Mao <maobibo@loongson.cn>
---
 arch/loongarch/kvm/intc/pch_pic.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/arch/loongarch/kvm/intc/pch_pic.c b/arch/loongarch/kvm/intc/pch_pic.c
index dab2d3f1b8f6..51e4a6a39dc0 100644
--- a/arch/loongarch/kvm/intc/pch_pic.c
+++ b/arch/loongarch/kvm/intc/pch_pic.c
@@ -444,7 +444,7 @@ static int kvm_pch_pic_create(struct kvm_device *dev, u32 type)
 
 	ret = kvm_setup_default_irq_routing(kvm);
 	if (ret)
-		return -ENOMEM;
+		return ret;
 
 	s = kzalloc_obj(struct loongarch_pch_pic);
 	if (!s)
-- 
2.43.0


^ permalink raw reply	[flat|nested] 6+ messages in thread

* [PATCH v3 3/3] LoongArch: KVM: Reject repeated PCH-PIC CTRL_INIT
  2026-10-14  5:29 [PATCH v3 0/3] LoongArch: KVM: irqchip fixes Tao Cui
  2026-10-14  5:29 ` [PATCH v3 1/3] LoongArch: KVM: Clear device pointer in irqchip destroy callbacks Tao Cui
  2026-10-14  5:29 ` [PATCH v3 2/3] LoongArch: KVM: Propagate real error code in kvm_pch_pic_create Tao Cui
@ 2026-10-14  5:29 ` Tao Cui
  2026-10-14  7:37   ` Huacai Chen
  2 siblings, 1 reply; 6+ messages in thread
From: Tao Cui @ 2026-10-14  5:29 UTC (permalink / raw)
  To: chenhuacai, maobibo, gaosong, zhaotianrui
  Cc: loongarch, kvm, linux-kernel, kernel, nagachaithanya9911,
	cui.tao, Tao Cui

From: Tao Cui <cuitao@kylinos.cn>

KVM_DEV_LOONGARCH_PCH_PIC_CTRL_INIT has no guard against repeated
invocation: every call overwrites pch_pic_base and registers the same
kvm_io_device on the MMIO bus at the new address, while
kvm_pch_pic_destroy() unregisters only one bus range.  After a repeated
init, MMIO to the stale ranges computes its register offset against the
new base and silently reads 0 / drops writes, and the leftover bus
entries persist until the VM is destroyed.

Reject repeated initialization with -EEXIST, using the initialized
state of the kvm_io_device as the indicator.  The MMIO base is only
committed after a successful bus registration, and the real
registration error is propagated instead of being replaced with
-EFAULT.

Fixes: d206d9514873 ("LoongArch: KVM: Add PCHPIC user mode read and write functions")
Signed-off-by: Tao Cui <cuitao@kylinos.cn>
---
 arch/loongarch/kvm/intc/pch_pic.c | 12 +++++++++---
 1 file changed, 9 insertions(+), 3 deletions(-)

diff --git a/arch/loongarch/kvm/intc/pch_pic.c b/arch/loongarch/kvm/intc/pch_pic.c
index 51e4a6a39dc0..7979466de729 100644
--- a/arch/loongarch/kvm/intc/pch_pic.c
+++ b/arch/loongarch/kvm/intc/pch_pic.c
@@ -281,16 +281,22 @@ static int kvm_pch_pic_init(struct kvm_device *dev, u64 addr)
 	struct kvm_io_device *device;
 	struct loongarch_pch_pic *s = dev->kvm->arch.pch_pic;
 
-	s->pch_pic_base = addr;
 	device = &s->device;
+	mutex_lock(&kvm->slots_lock);
+	if (s->device.ops) {
+		ret = -EEXIST;
+		goto out;
+	}
 	/* init device by pch pic writing and reading ops */
 	kvm_iodevice_init(device, &kvm_pch_pic_ops);
-	mutex_lock(&kvm->slots_lock);
 	/* register pch pic device */
 	ret = kvm_io_bus_register_dev(kvm, KVM_MMIO_BUS, addr, PCH_PIC_SIZE, device);
+	if (!ret)
+		s->pch_pic_base = addr;
+out:
 	mutex_unlock(&kvm->slots_lock);
 
-	return (ret < 0) ? -EFAULT : 0;
+	return ret;
 }
 
 /* used by user space to get or set pch pic registers */
-- 
2.43.0


^ permalink raw reply	[flat|nested] 6+ messages in thread

* Re: [PATCH v3 3/3] LoongArch: KVM: Reject repeated PCH-PIC CTRL_INIT
  2026-10-14  5:29 ` [PATCH v3 3/3] LoongArch: KVM: Reject repeated PCH-PIC CTRL_INIT Tao Cui
@ 2026-10-14  7:37   ` Huacai Chen
  2026-10-14  8:37     ` Tao Cui
  0 siblings, 1 reply; 6+ messages in thread
From: Huacai Chen @ 2026-10-14  7:37 UTC (permalink / raw)
  To: Tao Cui
  Cc: maobibo, gaosong, zhaotianrui, loongarch, kvm, linux-kernel,
	kernel, nagachaithanya9911, Tao Cui

Hi, Tao,

On Wed, Oct 14, 2026 at 1:30 PM Tao Cui <cui.tao@linux.dev> wrote:
>
> From: Tao Cui <cuitao@kylinos.cn>
>
> KVM_DEV_LOONGARCH_PCH_PIC_CTRL_INIT has no guard against repeated
> invocation: every call overwrites pch_pic_base and registers the same
> kvm_io_device on the MMIO bus at the new address, while
> kvm_pch_pic_destroy() unregisters only one bus range.  After a repeated
> init, MMIO to the stale ranges computes its register offset against the
> new base and silently reads 0 / drops writes, and the leftover bus
> entries persist until the VM is destroyed.
>
> Reject repeated initialization with -EEXIST, using the initialized
> state of the kvm_io_device as the indicator.  The MMIO base is only
> committed after a successful bus registration, and the real
> registration error is propagated instead of being replaced with
> -EFAULT.
>
> Fixes: d206d9514873 ("LoongArch: KVM: Add PCHPIC user mode read and write functions")
> Signed-off-by: Tao Cui <cuitao@kylinos.cn>
> ---
>  arch/loongarch/kvm/intc/pch_pic.c | 12 +++++++++---
>  1 file changed, 9 insertions(+), 3 deletions(-)
>
> diff --git a/arch/loongarch/kvm/intc/pch_pic.c b/arch/loongarch/kvm/intc/pch_pic.c
> index 51e4a6a39dc0..7979466de729 100644
> --- a/arch/loongarch/kvm/intc/pch_pic.c
> +++ b/arch/loongarch/kvm/intc/pch_pic.c
> @@ -281,16 +281,22 @@ static int kvm_pch_pic_init(struct kvm_device *dev, u64 addr)
>         struct kvm_io_device *device;
>         struct loongarch_pch_pic *s = dev->kvm->arch.pch_pic;
>
> -       s->pch_pic_base = addr;
>         device = &s->device;
> +       mutex_lock(&kvm->slots_lock);
Why move the mutex_lock()?

Huacai

> +       if (s->device.ops) {
> +               ret = -EEXIST;
> +               goto out;
> +       }
>         /* init device by pch pic writing and reading ops */
>         kvm_iodevice_init(device, &kvm_pch_pic_ops);
> -       mutex_lock(&kvm->slots_lock);
>         /* register pch pic device */
>         ret = kvm_io_bus_register_dev(kvm, KVM_MMIO_BUS, addr, PCH_PIC_SIZE, device);
> +       if (!ret)
> +               s->pch_pic_base = addr;
> +out:
>         mutex_unlock(&kvm->slots_lock);
>
> -       return (ret < 0) ? -EFAULT : 0;
> +       return ret;
>  }
>
>  /* used by user space to get or set pch pic registers */
> --
> 2.43.0
>

^ permalink raw reply	[flat|nested] 6+ messages in thread

* Re: [PATCH v3 3/3] LoongArch: KVM: Reject repeated PCH-PIC CTRL_INIT
  2026-10-14  7:37   ` Huacai Chen
@ 2026-10-14  8:37     ` Tao Cui
  0 siblings, 0 replies; 6+ messages in thread
From: Tao Cui @ 2026-10-14  8:37 UTC (permalink / raw)
  To: Huacai Chen
  Cc: maobibo, gaosong, zhaotianrui, loongarch, kvm, linux-kernel,
	kernel, nagachaithanya9911, Tao Cui

Hi, Huacai

在 2026/10/14 15:37, Huacai Chen 写道:
> Hi, Tao,
> 
> On Wed, Oct 14, 2026 at 1:30 PM Tao Cui <cui.tao@linux.dev> wrote:
>>
>> From: Tao Cui <cuitao@kylinos.cn>
>>
>> KVM_DEV_LOONGARCH_PCH_PIC_CTRL_INIT has no guard against repeated
>> invocation: every call overwrites pch_pic_base and registers the same
>> kvm_io_device on the MMIO bus at the new address, while
>> kvm_pch_pic_destroy() unregisters only one bus range.  After a repeated
>> init, MMIO to the stale ranges computes its register offset against the
>> new base and silently reads 0 / drops writes, and the leftover bus
>> entries persist until the VM is destroyed.
>>
>> Reject repeated initialization with -EEXIST, using the initialized
>> state of the kvm_io_device as the indicator.  The MMIO base is only
>> committed after a successful bus registration, and the real
>> registration error is propagated instead of being replaced with
>> -EFAULT.
>>
>> Fixes: d206d9514873 ("LoongArch: KVM: Add PCHPIC user mode read and write functions")
>> Signed-off-by: Tao Cui <cuitao@kylinos.cn>
>> ---
>>  arch/loongarch/kvm/intc/pch_pic.c | 12 +++++++++---
>>  1 file changed, 9 insertions(+), 3 deletions(-)
>>
>> diff --git a/arch/loongarch/kvm/intc/pch_pic.c b/arch/loongarch/kvm/intc/pch_pic.c
>> index 51e4a6a39dc0..7979466de729 100644
>> --- a/arch/loongarch/kvm/intc/pch_pic.c
>> +++ b/arch/loongarch/kvm/intc/pch_pic.c
>> @@ -281,16 +281,22 @@ static int kvm_pch_pic_init(struct kvm_device *dev, u64 addr)
>>         struct kvm_io_device *device;
>>         struct loongarch_pch_pic *s = dev->kvm->arch.pch_pic;
>>
>> -       s->pch_pic_base = addr;
>>         device = &s->device;
>> +       mutex_lock(&kvm->slots_lock);
> Why move the mutex_lock()?
> 

Thanks for the question.

The intent is to keep the repeated-init check mutual-excluded with the
bus registration.  The set_attr ioctl path holds no other lock, so with
the check outside slots_lock, two concurrent CTRL_INIT calls could both
see device.ops == NULL and both register the same device on the MMIO
bus.  Holding the lock across the check, the registration and the base
commit makes them exclusive.

That said, if you prefer the check before the lock, I can respin --
please let me know.

Thanks,
Tao

> Huacai
> 
>> +       if (s->device.ops) {
>> +               ret = -EEXIST;
>> +               goto out;
>> +       }
>>         /* init device by pch pic writing and reading ops */
>>         kvm_iodevice_init(device, &kvm_pch_pic_ops);
>> -       mutex_lock(&kvm->slots_lock);
>>         /* register pch pic device */
>>         ret = kvm_io_bus_register_dev(kvm, KVM_MMIO_BUS, addr, PCH_PIC_SIZE, device);
>> +       if (!ret)
>> +               s->pch_pic_base = addr;
>> +out:
>>         mutex_unlock(&kvm->slots_lock);
>>
>> -       return (ret < 0) ? -EFAULT : 0;
>> +       return ret;
>>  }
>>
>>  /* used by user space to get or set pch pic registers */
>> --
>> 2.43.0
>>


^ permalink raw reply	[flat|nested] 6+ messages in thread

end of thread, other threads:[~2026-10-14  8:37 UTC | newest]

Thread overview: 6+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2026-10-14  5:29 [PATCH v3 0/3] LoongArch: KVM: irqchip fixes Tao Cui
2026-10-14  5:29 ` [PATCH v3 1/3] LoongArch: KVM: Clear device pointer in irqchip destroy callbacks Tao Cui
2026-10-14  5:29 ` [PATCH v3 2/3] LoongArch: KVM: Propagate real error code in kvm_pch_pic_create Tao Cui
2026-10-14  5:29 ` [PATCH v3 3/3] LoongArch: KVM: Reject repeated PCH-PIC CTRL_INIT Tao Cui
2026-10-14  7:37   ` Huacai Chen
2026-10-14  8:37     ` Tao Cui

This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox

all inboxes | Powered by JetHome®