[PATCH v2 1/2] KVM: arm64: vgic: Require matching VGIC model for GICv3 ITS

[Fuad Tabba]

Hi Sascha,

On Mon, 19 Oct 2026 14:42:41 +0100, Sascha Bischoff
<sascha.bischoff at arm.com> wrote:
> On a GICv5 host with legacy support, KVM registers both VGICv3 and
> VGICv5 devices. Without a model check, a VM can create a GICv3 ITS
> alongside an incompatible VGIC, regardless of creation order.

Could you add to the commit message that the new checks apply on every
host? A GICv2 VGIC and an ITS, in either order, now fail with -ENODEV,
where before both were created and the ITS was ignored.

[...]
> diff --git a/arch/arm64/kvm/vgic/vgic-mmio-v3.c b/arch/arm64/kvm/vgic/vgic-mmio-v3.c
[...]
> @@ -42,10 +42,7 @@ bool vgic_has_its(struct kvm *kvm)
>  {
>          struct vgic_dist *dist = &kvm->arch.vgic;
>
> -        if (dist->vgic_model != KVM_DEV_TYPE_ARM_VGIC_V3)
> -                return false;
> -
> -        return dist->has_its;
> +        return !!dist->its_model;
>  }

I think this should check vgic_model as well, as Sashiko raised [1].
vgic_its_create() accepts an ITS when there's no in-kernel VGIC, and
the VM can then run with a userspace irqchip. On a GICv4.0 host,
kvm_vgic_flush_hwstate() then calls vgic_v4_commit() on every entry,
for a vPE that vgic_v4_init() never set up. irq_set_vcpu_affinity()
fails on irq 0 and the error is ignored, so nothing crashes, but this
patch makes that path reachable. The MSI paths Sashiko lists are fine,
since KVM_SIGNAL_MSI requires an in-kernel irqchip and irqfd an
initialised VGIC.

Something like this would keep the 0 == 0 case you pointed out for
Marc's version false:

        return dist->its_model && dist->its_model == dist->vgic_model;

Cheers,
/fuad

[1] https://lore.kernel.org/all/sashiko-outbox-177254@kernel.org/