[PATCH v2 1/2] KVM: arm64: vgic: Require matching VGIC model for GICv3 ITS

[Sascha Bischoff]

Hi Fuad,

On 19/10/2026 16:32, Fuad Tabba wrote:
> Hi Sascha,
> 
> On Mon, 19 Oct 2026 14:42:41 +0100, Sascha Bischoff
> <sascha.bischoff at arm.com> wrote:
>> On a GICv5 host with legacy support, KVM registers both VGICv3 and
>> VGICv5 devices. Without a model check, a VM can create a GICv3 ITS
>> alongside an incompatible VGIC, regardless of creation order.
> 
> Could you add to the commit message that the new checks apply on every
> host? A GICv2 VGIC and an ITS, in either order, now fail with -ENODEV,
> where before both were created and the ITS was ignored.

Ah, that's a good point (and a situation that hadn't properly clicked in 
my head). I'll absolutely update it.

> 
> [...]
>> diff --git a/arch/arm64/kvm/vgic/vgic-mmio-v3.c b/arch/arm64/kvm/vgic/vgic-mmio-v3.c
> [...]
>> @@ -42,10 +42,7 @@ bool vgic_has_its(struct kvm *kvm)
>>   {
>>           struct vgic_dist *dist = &kvm->arch.vgic;
>>
>> -        if (dist->vgic_model != KVM_DEV_TYPE_ARM_VGIC_V3)
>> -                return false;
>> -
>> -        return dist->has_its;
>> +        return !!dist->its_model;
>>   }
> 
> I think this should check vgic_model as well, as Sashiko raised [1].

Yeah, Sashiko and you have raised a valid point here.

> vgic_its_create() accepts an ITS when there's no in-kernel VGIC, and
> the VM can then run with a userspace irqchip. On a GICv4.0 host,
> kvm_vgic_flush_hwstate() then calls vgic_v4_commit() on every entry,
> for a vPE that vgic_v4_init() never set up. irq_set_vcpu_affinity()
> fails on irq 0 and the error is ignored, so nothing crashes, but this
> patch makes that path reachable. The MSI paths Sashiko lists are fine,
> since KVM_SIGNAL_MSI requires an in-kernel irqchip and irqfd an
> initialised VGIC.
> 
> Something like this would keep the 0 == 0 case you pointed out for
> Marc's version false:
> 
>          return dist->its_model && dist->its_model == dist->vgic_model;

Foolishly, this was the variant I'd dismissed as it returns false until 
vgic_model is set. However, I guess that is the behaviour we want here. 
An ITS is only a valid ITS if the model matches.

> 
> Cheers,
> /fuad
> 
> [1] https://lore.kernel.org/all/sashiko-outbox-177254@kernel.org/

Thank you!
Sascha