[PATCH v2] RISC-V: KVM: Serialize IMSIC attributes with vCPU migration

[Anup Patel]

On Mon, Aug 10, 2026 at 6:51 AM Xie Bo via B4 Relay
<devnull+xb.ultrarisc.com at kernel.org> wrote:
>
> From: Xie Bo <xb at ultrarisc.com>
>
> KVM device ioctls are not serialized against KVM_RUN. As a result,
> kvm_riscv_aia_imsic_rw_attr() can snapshot the physical CPU and HGEI of
> an IMSIC VS-file before a concurrent vCPU migration releases it.
>
> The HGEI can then be allocated to another vCPU before imsic_vsfile_rw()
> uses the stale tuple. A GET or SET attribute may consequently access the
> new owner's interrupt file.
>
> Serialize the entire IMSIC attribute operation with the target vCPU
> mutex. This prevents the VS-file from being migrated and recycled until
> the attribute access completes. Acquire the mutex killably so that the
> device ioctl remains interruptible while waiting for KVM_RUN to finish.
>
> Fixes: db8b7e97d613 ("RISC-V: KVM: Add in-kernel virtualization of AIA IMSIC")
> Cc: stable at vger.kernel.org
> Signed-off-by: Xie Bo <xb at ultrarisc.com>

LGTM.

Reviewed-by: Anup Patel <anup at brainfault.org>

Queued this patch for Linux-7.3-rcX

Thanks,
Anup

> ---
> Changes in v2:
> - Use mutex_lock_killable() and return -EINTR when interrupted.
>
> Link: https://lore.kernel.org/r/20260721073612.137259-1-xb@ultrarisc.com
> ---
>  arch/riscv/kvm/aia_imsic.c | 11 +++++++++--
>  1 file changed, 9 insertions(+), 2 deletions(-)
>
> diff --git a/arch/riscv/kvm/aia_imsic.c b/arch/riscv/kvm/aia_imsic.c
> index d38f5de08..74f520e57 100644
> --- a/arch/riscv/kvm/aia_imsic.c
> +++ b/arch/riscv/kvm/aia_imsic.c
> @@ -969,9 +969,14 @@ int kvm_riscv_aia_imsic_rw_attr(struct kvm *kvm, unsigned long type,
>         if (!vcpu)
>                 return -ENODEV;
>
> +       if (mutex_lock_killable(&vcpu->mutex))
> +               return -EINTR;
> +
>         imsic = vcpu->arch.aia_context.imsic_state;
> -       if (!imsic)
> -               return -ENODEV;
> +       if (!imsic) {
> +               rc = -ENODEV;
> +               goto out_unlock;
> +       }
>         isel = KVM_DEV_RISCV_AIA_IMSIC_GET_ISEL(type);
>
>         read_lock_irqsave(&imsic->vsfile_lock, flags);
> @@ -995,6 +1000,8 @@ int kvm_riscv_aia_imsic_rw_attr(struct kvm *kvm, unsigned long type,
>                 rc = imsic_vsfile_rw(vsfile_hgei, vsfile_cpu, imsic->nr_eix,
>                                      isel, write, val);
>
> +out_unlock:
> +       mutex_unlock(&vcpu->mutex);
>         return rc;
>  }
>
>
> ---
> base-commit: b95f03f04d475aa6719d15a636ddf32222d55657
> change-id: 20260810-imsic-attr-race-06772a04450e
>
> Best regards,
> --
> Xie Bo <xb at ultrarisc.com>
>
>
>