Re: [PATCH 2/2] KVM: arm64: vgic-v4: Don't allocate vPEs when userspace clears nASSGIcap

[Oliver Upton <oupton@kernel.org>]

Hi Fuad,

On Mon, Oct 26, 2026 at 03:26:39PM +0000, Fuad Tabba wrote:
> Since commit c652887a92887 ("KVM: arm64: vgic-v3: Allow userspace to
> write GICD_TYPER2.nASSGIcap"), userspace can disable vPE allocation for
> a VM on a GICv4.1 host with vSGIs by clearing nASSGIcap before the vgic
> is initialised. vgic_init() then skips vgic_v4_init(), and
> kvm_vgic_dist_destroy() skips vgic_v4_teardown(). vgic_its_create()
> still calls vgic_v4_init() for an ITS created after the vgic is
> initialised, though, and vgic_v4_init() allocates the vPEs and requests
> a doorbell IRQ for each vCPU. Destroying the VM leaks them, and leaves
> each doorbell handler registered with a vCPU that's about to be freed.
> 
> Rather than gate on vgic_supports_direct_irqs(), which reads has_its
> before vgic_its_create() sets it, check for a cleared nASSGIcap in
> vgic_v4_init().
> 
> Fixes: c652887a92887 ("KVM: arm64: vgic-v3: Allow userspace to write GICD_TYPER2.nASSGIcap")
> Cc: stable@vger.kernel.org
> Signed-off-by: Fuad Tabba <fuad.tabba@linux.dev>
> ---
>  arch/arm64/kvm/vgic/vgic-v4.c | 4 ++++
>  1 file changed, 4 insertions(+)
> 
> diff --git a/arch/arm64/kvm/vgic/vgic-v4.c b/arch/arm64/kvm/vgic/vgic-v4.c
> index a01de4de608a6..12a57921f6af3 100644
> --- a/arch/arm64/kvm/vgic/vgic-v4.c
> +++ b/arch/arm64/kvm/vgic/vgic-v4.c
> @@ -251,6 +251,10 @@ int vgic_v4_init(struct kvm *kvm)
>  	if (!kvm_vgic_global_state.has_gicv4 || dist->vgic_model != KVM_DEV_TYPE_ARM_VGIC_V3)
>  		return 0; /* Nothing to see here... move along. */
>  
> +	/* Userspace disabled vPE allocation by clearing nASSGIcap */
> +	if (system_supports_direct_sgis() && !vgic_supports_direct_sgis(kvm))
> +		return 0;
> +

Looking at both of the patches now, I'd rather we just fix the
predicates and use those to consistently gate GICv4. Untested as always:

diff --git a/arch/arm64/kvm/vgic/vgic-its.c b/arch/arm64/kvm/vgic/vgic-its.c
index 9e782a4fea7e..2b22f096a504 100644
--- a/arch/arm64/kvm/vgic/vgic-its.c
+++ b/arch/arm64/kvm/vgic/vgic-its.c
@@ -1866,9 +1866,16 @@ static int vgic_its_create(struct kvm_device *dev, u32 type)
 
 	mutex_lock(&dev->kvm->arch.config_lock);
 
+	/*
+	 * Make an early indication that this VM has an ITS so calls to
+	 * vgic_supports_direct_irqs() work as intended, rolling back state
+	 * if we fail to setup GICv4.
+	 */
+	dev->kvm->arch.vgic.has_its = true;
 	if (vgic_initialized(dev->kvm)) {
 		ret = vgic_v4_init(dev->kvm);
 		if (ret < 0) {
+			dev->kvm->arch.vgic.has_its = false;
 			mutex_unlock(&dev->kvm->arch.config_lock);
 			kfree(its);
 			return ret;
@@ -1893,7 +1900,6 @@ static int vgic_its_create(struct kvm_device *dev, u32 type)
 	xa_init(&its->translation_cache);
 
 	dev->kvm->arch.vgic.msis_require_devid = true;
-	dev->kvm->arch.vgic.has_its = true;
 	its->enabled = false;
 	its->dev = dev;
 
diff --git a/arch/arm64/kvm/vgic/vgic-v4.c b/arch/arm64/kvm/vgic/vgic-v4.c
index ed236f083f0d..c65bd8783284 100644
--- a/arch/arm64/kvm/vgic/vgic-v4.c
+++ b/arch/arm64/kvm/vgic/vgic-v4.c
@@ -248,8 +248,8 @@ int vgic_v4_init(struct kvm *kvm)
 
 	lockdep_assert_held(&kvm->arch.config_lock);
 
-	if (!kvm_vgic_global_state.has_gicv4)
-		return 0; /* Nothing to see here... move along. */
+	if (!vgic_supports_direct_irqs(kvm))
+		return 0;
 
 	if (dist->its_vm.vpes)
 		return 0;
diff --git a/arch/arm64/kvm/vgic/vgic.h b/arch/arm64/kvm/vgic/vgic.h
index b71d486ae514..bd1614c9ff05 100644
--- a/arch/arm64/kvm/vgic/vgic.h
+++ b/arch/arm64/kvm/vgic/vgic.h
@@ -509,6 +509,10 @@ static inline bool vgic_supports_direct_irqs(struct kvm *kvm)
 	if (vgic_is_v5(kvm))
 		return true;
 
+	/* GICv2 never supports direct IRQs */
+	if (!vgic_is_v3(kvm))
+		return false;
+
 	return vgic_supports_direct_msis(kvm) || vgic_supports_direct_sgis(kvm);
 }
 
-- 
Thanks,
Oliver