[PATCH 2/2] KVM: arm64: vgic-v4: Don't allocate vPEs when userspace clears nASSGIcap

[Oliver Upton]

On Tue, Oct 27, 2026 at 07:36:34AM +0000, Fuad Tabba wrote:
> diff --git a/arch/arm64/kvm/vgic/vgic-mmio-v3.c b/arch/arm64/kvm/vgic/vgic-mmio-v3.c
> index 5913a20d83019..a60697238a7a7 100644
> --- a/arch/arm64/kvm/vgic/vgic-mmio-v3.c
> +++ b/arch/arm64/kvm/vgic/vgic-mmio-v3.c
> @@ -48,7 +48,7 @@ bool vgic_has_its(struct kvm *kvm)
>  	return dist->has_its;
>  }
>  
> -bool vgic_supports_direct_msis(struct kvm *kvm)
> +bool vgic_supports_vpes(struct kvm *kvm)
>  {
>  	/*
>  	 * Deliberately conflate vLPI and vSGI support on GICv4.1 hardware,
> @@ -58,7 +58,12 @@ bool vgic_supports_direct_msis(struct kvm *kvm)
>  	if (system_supports_direct_sgis() && !vgic_supports_direct_sgis(kvm))
>  		return false;
>  
> -	return kvm_vgic_global_state.has_gicv4 && vgic_has_its(kvm);
> +	return kvm_vgic_global_state.has_gicv4 && vgic_is_v3(kvm);
> +}
> +
> +bool vgic_supports_direct_msis(struct kvm *kvm)
> +{
> +	return vgic_supports_vpes(kvm) && vgic_has_its(kvm);
>  }
>  
>  bool system_supports_direct_sgis(void)
> diff --git a/arch/arm64/kvm/vgic/vgic-v4.c b/arch/arm64/kvm/vgic/vgic-v4.c
> index ed236f083f0d7..0a4b9a74425b4 100644
> --- a/arch/arm64/kvm/vgic/vgic-v4.c
> +++ b/arch/arm64/kvm/vgic/vgic-v4.c
> @@ -248,7 +248,7 @@ int vgic_v4_init(struct kvm *kvm)
>  
>  	lockdep_assert_held(&kvm->arch.config_lock);
>  
> -	if (!kvm_vgic_global_state.has_gicv4)
> +	if (!vgic_supports_vpes(kvm))
>  		return 0; /* Nothing to see here... move along. */
>  
>  	if (dist->its_vm.vpes)
> diff --git a/arch/arm64/kvm/vgic/vgic.h b/arch/arm64/kvm/vgic/vgic.h
> index b71d486ae5145..7fc29a395a7db 100644
> --- a/arch/arm64/kvm/vgic/vgic.h
> +++ b/arch/arm64/kvm/vgic/vgic.h
> @@ -500,6 +500,7 @@ static inline bool vgic_host_has_gicv5(void)
>  }
>  
>  bool system_supports_direct_sgis(void);
> +bool vgic_supports_vpes(struct kvm *kvm);
>  bool vgic_supports_direct_msis(struct kvm *kvm);
>  bool vgic_supports_direct_sgis(struct kvm *kvm);
>  
> 
> Tested on the FVP (GICv4.0 and GICv4.1): KVM doesn't leak doorbells in
> either patch's case, a GICv3 VM still gets its vPEs when the ITS is
> created, and the reproducer above doesn't hit the WARN. Does that work
> for you? If so, I'll send it as v2.

Bugh... Thanks for de-crapifying my request.

Yes, this works perfectly for me.

Thanks,
Oliver