[PATCH 1/3] KVM: arm64: vgic: Drop the pending state of all LPIs when disabling LPIs

[Fuad Tabba <fuad.tabba@linux.dev>]

When the guest clears GICR_CTLR.EnableLPIs, vgic_flush_pending_lpis()
retires the LPIs on the vCPU's AP list. However, an LPI disabled in the
configuration table can be pending without being on that list. An LPI
moved to the vCPU by MOVI can also still be in another vCPU's LRs,
which pausing the vCPU doesn't fold back. These LPIs stay pending, and
the guest takes them even after re-enabling LPIs with
GICR_PENDBASER.PTZ set.

Halt the guest rather than the vCPU, so that no vCPU can fold such an
LPI back from its LRs after the flush. Have the flush clear the pending
state of every LPI targeting the vCPU. A forwarded vLPI's pending state
is in its vPE's pending table, which the flush doesn't clear.

Invalidate the translation cache before the flush. Only an MSI racing
with the disable can then make an LPI pending, or cache its translation
for later ones.

Fixes: 0e4e82f154e38 ("KVM: arm64: vgic-its: Enable ITS emulation as a virtual MSI controller")
Signed-off-by: Fuad Tabba <fuad.tabba@linux.dev>
---
 arch/arm64/kvm/vgic/vgic-mmio-v3.c | 13 +++++++------
 arch/arm64/kvm/vgic/vgic.c         | 16 +++++++++++++++-
 2 files changed, 22 insertions(+), 7 deletions(-)

diff --git a/arch/arm64/kvm/vgic/vgic-mmio-v3.c b/arch/arm64/kvm/vgic/vgic-mmio-v3.c
index 02292f8e0b431..93024879ed3b3 100644
--- a/arch/arm64/kvm/vgic/vgic-mmio-v3.c
+++ b/arch/arm64/kvm/vgic/vgic-mmio-v3.c
@@ -298,14 +298,15 @@ static void vgic_mmio_write_v3r_ctlr(struct kvm_vcpu *vcpu,
 		/*
 		 * Yes, disabling LPIs is painful, since it can be done from
 		 * a *remote* vcpu! So let's not take any chance, and make
-		 * sure that the target vCPU has written their LRs back to the
+		 * sure that every vCPU has written their LRs back to the
 		 * irq structures, and release any reference they would have.
-		 * Pause it before its LPIs read as disabled, so that the exit's
-		 * prune leaves them for vgic_flush_pending_lpis() to retire.
+		 * Halt them before the LPIs read as disabled, so that none can
+		 * fold an LPI back from its LRs after vgic_flush_pending_lpis()
+		 * has cleared it.
 		 *
 		 * If it hurts, don't do it.
 		 */
-		kvm_pause_vcpu(vcpu);
+		kvm_arm_halt_guest(vcpu->kvm);
 
 		/*
 		 * Don't disable if RWP is set, as there already an
@@ -315,12 +316,12 @@ static void vgic_mmio_write_v3r_ctlr(struct kvm_vcpu *vcpu,
 					      GICR_CTLR_ENABLE_LPIS,
 					      GICR_CTLR_RWP);
 		if (ctlr == GICR_CTLR_ENABLE_LPIS) {
-			vgic_flush_pending_lpis(vcpu);
 			vgic_its_invalidate_all_caches(vcpu->kvm);
+			vgic_flush_pending_lpis(vcpu);
 			atomic_set_release(&vgic_cpu->ctlr, 0);
 		}
 
-		kvm_resume_vcpu(vcpu);
+		kvm_arm_resume_guest(vcpu->kvm);
 	} else {
 		ctlr = atomic_cmpxchg_acquire(&vgic_cpu->ctlr, 0,
 					      GICR_CTLR_ENABLE_LPIS);
diff --git a/arch/arm64/kvm/vgic/vgic.c b/arch/arm64/kvm/vgic/vgic.c
index fe09ada322625..a99570538f104 100644
--- a/arch/arm64/kvm/vgic/vgic.c
+++ b/arch/arm64/kvm/vgic/vgic.c
@@ -207,9 +207,10 @@ static void vgic_release_deleted_lpis(struct kvm *kvm)
 void vgic_flush_pending_lpis(struct kvm_vcpu *vcpu)
 {
 	struct vgic_cpu *vgic_cpu = &vcpu->arch.vgic_cpu;
+	struct vgic_dist *dist = &vcpu->kvm->arch.vgic;
 	struct vgic_irq *irq, *tmp;
+	unsigned long intid, flags;
 	bool deleted = false;
-	unsigned long flags;
 
 	raw_spin_lock_irqsave(&vgic_cpu->ap_list_lock, flags);
 
@@ -228,6 +229,19 @@ void vgic_flush_pending_lpis(struct kvm_vcpu *vcpu)
 
 	if (deleted)
 		vgic_release_deleted_lpis(vcpu->kvm);
+
+	/* Disabled LPIs and LPIs MOVI'd here can be pending off this AP list. */
+	xa_for_each(&dist->lpi_xa, intid, irq) {
+		irq = vgic_get_irq(vcpu->kvm, intid);
+		if (!irq)
+			continue;
+
+		raw_spin_lock_irqsave(&irq->irq_lock, flags);
+		if (irq->target_vcpu == vcpu)
+			irq->pending_latch = false;
+		raw_spin_unlock_irqrestore(&irq->irq_lock, flags);
+		vgic_put_irq(vcpu->kvm, irq);
+	}
 }
 
 void vgic_irq_set_phys_pending(struct vgic_irq *irq, bool pending)
-- 
2.47.3