[PATCH v3 0/5] KVM: arm64: fix VGICv3 redistributor rollback

[Marc Zyngier]

On Sat, 22 Aug 2026 10:53:41 +0100,
Karl Mehltretter <kmehltretter at gmail.com> wrote:
> 
> A failed REDIST_REGION write can remove redistributor iodevs from
> KVM_MMIO_BUS while leaving their cached vCPU assignments intact. A
> corrected retry then skips those redistributors.
> 
> Userspace should instead see a failed region update atomically: no prior
> redistributor assignment survives the failure, and the next successful
> update rebuilds all possible assignments in region-index order.
> 
> Patch 1 fixes a separate accounting bug when an individual MMIO-bus
> registration fails. It reserves the selected region slot before
> registration and undoes that known-latest assignment if registration fails.
> 
> Patch 2 implements the atomic failed-region behavior. It unregisters every
> redistributor iodev, clears every cached assignment, resets the region
> counters, and frees the newly inserted region. An in-flight vCPU can have
> an RD iodev before kvm_for_each_vcpu() can see it, so REDIST and
> REDIST_REGION writes are serialized with vCPU creation and return -EBUSY
> while the created_vcpus/online_vcpus counts differ.
> 
> Patch 3 is independent teardown cleanup. It separates MMIO-bus teardown
> from config-locked assignment cleanup, preserves the cleanup required
> before a late failed vCPU creation frees the vCPU, and removes the special
> conditional from the common vCPU destructor.
> 
> Patch 4 keeps the selftest helper aligned with vm_create_with_vcpus(), and
> patch 5 adds regression coverage for an overlapping region, retry, and
> final GICR_TYPER accesses to all four redistributors. The test exercises
> patch 2's final-state behavior; patch 1's MMIO-bus allocation failure is
> not fault-injected.
> 
> Testing: built the patched kernel and the arm64 vgic_init selftest with
> GCC 13.3.0 in an arm64 Linux container. The selftest passed under QEMU
> 11.0.2 TCG with -machine virt,virtualization=on,gic-version=3 and -cpu max.
> 
> ---
> Changes since v2:
> - Patch 1: limit free_index rollback to the immediate registration failure
>   under slots_lock instead of generic unregistration. (Sashiko)
> - Patch 2: reset all assignments and region counters after a failed region
>   update (Marc), and serialize REDIST and REDIST_REGION writes with vCPU
>   creation so rollback cannot miss an unpublished assignment.
> - Patch 3: add an already-locked unassignment primitive, move failed-vCPU
>   cleanup to kvm_vgic_vcpu_destroy(), and remove the redundant base_addr
>   reset. (Marc)
> - Patch 4: match vm_create_with_vcpus() by using void * for the guest-code
>   argument. (Sashiko)
> - Patch 5: document how the first three redistributors span regions 0
>   and 1; no functional change.

I really don't understand why this is such a massive departure from
v2, which was pretty close to what I wanted to see.

Honestly, you are making things harder for everyone by over-designing
(or more probably under-filtering) things that should be *fixes*, and
just that.

If you want to rework all of the vgic init/destroy, fine by me. Do
that as a separate series. But for fixes that carry a Cc stable and
require backporting to 6 year old kernels, that's not on.

The hack below is what I have against your v2 to make it acceptable.

	M.

diff --git a/arch/arm64/kvm/vgic/vgic-init.c b/arch/arm64/kvm/vgic/vgic-init.c
index 84e67c23bedc0..85b00849e6154 100644
--- a/arch/arm64/kvm/vgic/vgic-init.c
+++ b/arch/arm64/kvm/vgic/vgic-init.c
@@ -539,8 +539,6 @@ static void __kvm_vgic_vcpu_destroy(struct kvm_vcpu *vcpu)
 		 */
 		if (kvm_get_vcpu_by_id(vcpu->kvm, vcpu->vcpu_id) != vcpu)
 			vgic_unregister_redist_iodev(vcpu);
-
-		vgic_cpu->rd_iodev.base_addr = VGIC_ADDR_UNDEF;
 	}
 }
 
@@ -563,14 +561,13 @@ void kvm_vgic_destroy(struct kvm *kvm)
 
 	vgic_debug_destroy(kvm);
 
-	kvm_for_each_vcpu(i, vcpu, kvm)
+	kvm_for_each_vcpu(i, vcpu, kvm) {
 		__kvm_vgic_vcpu_destroy(vcpu);
-
-	if (kvm->arch.vgic.vgic_model == KVM_DEV_TYPE_ARM_VGIC_V3) {
-		mutex_unlock(&kvm->arch.config_lock);
-		kvm_for_each_vcpu(i, vcpu, kvm)
-			vgic_unregister_redist_iodev(vcpu);
-		mutex_lock(&kvm->arch.config_lock);
+		if (kvm->arch.vgic.vgic_model == KVM_DEV_TYPE_ARM_VGIC_V3) {
+			kvm_io_bus_unregister_dev(vcpu->kvm, KVM_MMIO_BUS,
+						  &vcpu->arch.vgic_cpu.rd_iodev.dev);
+			__vgic_unassign_redist_iodev(vcpu);
+		}
 	}
 
 	kvm_vgic_dist_destroy(kvm);

-- 
Jazz isn't dead. It just smells funny.