From nobody Mon Sep 28 17:00:00 2026 Received: from mta0.migadu.com (out-167.mta0.migadu.com [91.218.175.167]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 90A28449B3F for ; Wed, 19 Aug 2026 10:28:21 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=91.218.175.167 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1787135305; cv=none; b=Z3zDx8+fxqq49cQr841OqT/qtAfYisTtsRHIigw6vsf4vKn4n7KdrDOO66bGyiSvUQIHFxkE+i4JJvIuUKQlI1ki0MsJlZvwWKlfmyRZV1/GePcxHPozxvxFTETzPxlLifREglgLMM9FkLo0nIDjhqua9y3FunJfUS518v6TvBg= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1787135305; c=relaxed/simple; bh=slbtI8ZsA2D3ug2zqvheMAR9v743tseMWn7tlh89cVA=; h=From:To:Cc:Subject:Date:Message-Id:In-Reply-To:References: MIME-Version; b=meD8kIbXe237Wi5VEjWxZzB45MmS4iuZuU0x8NUyUtUGK4Q+kM+RC3Kttto9boTsf3wVIs4sSXYOHk23osEizqHHDP6vHhtTOalwr46p4ZDwNBkqQGbPBIZl187+tiZnCaF0vv+/l7gTtNrS+DBJcyHBiTlAAZkhwdKj/CYHR0E= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=linux.dev; spf=pass smtp.mailfrom=linux.dev; dkim=pass (1024-bit key) header.d=linux.dev header.i=@linux.dev header.b=v+Cthkpm; arc=none smtp.client-ip=91.218.175.167 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=linux.dev Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=linux.dev Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linux.dev header.i=@linux.dev header.b="v+Cthkpm" X-Envelope-To: linux-kernel@vger.kernel.org DKIM-Signature: a=rsa-sha256; bh=slbtI8ZsA2D3ug2zqvheMAR9v743tseMWn7tlh89cVA=; c=simple/simple; d=linux.dev; h=from:to:subject:date:message-id:mime-version:content-type; s=key1; t=1787135299; v=1; x=1787740099; b=v+CthkpmbITqWA38uTEuHsk7fG/FKtHQP7KNT60LT6AqcHBUltxCGJ/nAdN5zHQbrUwrQscH Yi7IjLnzSKHNd7B3F81naG/Flh8mucrhqLA/2Z/+itOizc3vN4Du75s7PaXAxs6YttQIm0OMh3F w8+LEMaBLkwPigrjFB/uRGOw= X-Envelope-To: linux-kernel@vger.kernel.org Received: from claudy.lan (37.156.72.212) by smtp.migadu.com with ESMTPS id 95476cbcfe529942; Wed, 19 Aug 2026 10:28:19 +0000 X-Migadu-Flow: FLOW_OUT From: Fuad Tabba To: Marc Zyngier , Oliver Upton Cc: Joey Gouly , Steffen Eiden , Suzuki K Poulose , Zenghui Yu , Will Deacon , Sascha Bischoff , Sebastian Ene , Eric Auger , Fuad Tabba , kvmarm@lists.linux.dev, linux-arm-kernel@lists.infradead.org, linux-kernel@vger.kernel.org Subject: [PATCH 1/4] KVM: arm64: vgic-its: Free the caches when GITS_BASER changes Date: Wed, 19 Aug 2026 11:28:06 +0100 Message-Id: <20260819102809.310708-2-fuad.tabba@linux.dev> X-Mailer: git-send-email 2.39.5 In-Reply-To: <20260819102809.310708-1-fuad.tabba@linux.dev> References: <20260819102809.310708-1-fuad.tabba@linux.dev> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset="utf-8" A guest that disables the ITS and re-points or shrinks GITS_BASER with VALID still set keeps the devices and collections it mapped against the old table, as KVM frees them only when VALID is cleared. The table format is not architected, so a write with a different value is allowed to lose what it describes. Free the list whenever the stored value changes. Test for a change rather than a write: its_restore_enable() rewrites GITS_BASER from its probe-time cache on resume, and KVM reports GITS_TYPER.HCC as 0, so nothing re-maps the boot CPU's collection afterwards. Fixes: 36d6961c2b481 ("KVM: arm/arm64: vgic-its: Free caches when GITS_BASE= R Valid bit is cleared") Suggested-by: Marc Zyngier Link: https://lore.kernel.org/all/87ecg9owwa.wl-maz@kernel.org/ Signed-off-by: Fuad Tabba --- arch/arm64/kvm/vgic/vgic-its.c | 9 ++++++--- 1 file changed, 6 insertions(+), 3 deletions(-) diff --git a/arch/arm64/kvm/vgic/vgic-its.c b/arch/arm64/kvm/vgic/vgic-its.c index f6538b1976f9b..3339d9977af27 100644 --- a/arch/arm64/kvm/vgic/vgic-its.c +++ b/arch/arm64/kvm/vgic/vgic-its.c @@ -1649,7 +1649,7 @@ static void vgic_mmio_write_its_baser(struct kvm *kvm, unsigned long val) { const struct vgic_its_abi *abi =3D vgic_its_get_abi(its); - u64 entry_size, table_type; + u64 old, entry_size, table_type; u64 reg, *regptr, clearbits =3D 0; =20 /* When GITS_CTLR.Enable is 1, we ignore write accesses. */ @@ -1672,7 +1672,9 @@ static void vgic_mmio_write_its_baser(struct kvm *kvm, return; } =20 - reg =3D update_64bit_reg(*regptr, addr & 7, len, val); + old =3D *regptr; + + reg =3D update_64bit_reg(old, addr & 7, len, val); reg &=3D ~GITS_BASER_RO_MASK; reg &=3D ~clearbits; =20 @@ -1682,7 +1684,8 @@ static void vgic_mmio_write_its_baser(struct kvm *kvm, =20 *regptr =3D reg; =20 - if (!(reg & GITS_BASER_VALID)) { + /* The ITS driver rewrites an unchanged GITS_BASER on resume. */ + if (reg !=3D old) { /* Take the its_lock to prevent a race with a save/restore */ mutex_lock(&its->its_lock); switch (table_type) { --=20 2.39.5 From nobody Mon Sep 28 17:00:00 2026 Received: from mta0.migadu.com (out-171.mta0.migadu.com [91.218.175.171]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 591FC44C670 for ; Wed, 19 Aug 2026 10:28:27 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=91.218.175.171 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1787135311; cv=none; b=WbyHigVla9GKQnbz991KBisnKUxQPQgB8Uqi3dVDfGehHpE0hSLwavfNw2ZL2U13Xu+DTy9nmdXmpeJRw7ZBK6nzwK1Q7jaQEaVJJp/7EJj+/rBY7ffDKFkTTn6uSMRT7/7uTlwc6qUQAEBQmrp6J95xFUiFF3e+nwuGhSEQwt4= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1787135311; c=relaxed/simple; bh=gt4LUz6h5wdD5n/G/j7Qa+IcB6A6stflUNl5aSZem7k=; h=From:To:Cc:Subject:Date:Message-Id:In-Reply-To:References: MIME-Version; b=n1ZJQv7BdBN14a06L8F0wAkgozqfvGww079rzkABFAknt6HzTcbUYrkq2BuVSh1OyutgluKHNwk7pIVsYIvuirUDgisP/kL/tzXhLr0PTbWdCihA43XxbyOSoXkvYi+uylC2AIGOvvqEfEgCbIQaE6axSFXdtpF4IkEtf7aW9kg= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=linux.dev; spf=pass smtp.mailfrom=linux.dev; dkim=pass (1024-bit key) header.d=linux.dev header.i=@linux.dev header.b=FNX+dtOP; arc=none smtp.client-ip=91.218.175.171 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=linux.dev Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=linux.dev Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linux.dev header.i=@linux.dev header.b="FNX+dtOP" X-Envelope-To: linux-kernel@vger.kernel.org DKIM-Signature: a=rsa-sha256; bh=gt4LUz6h5wdD5n/G/j7Qa+IcB6A6stflUNl5aSZem7k=; c=simple/simple; d=linux.dev; h=from:to:subject:date:message-id:mime-version:content-type; s=key1; t=1787135304; v=1; x=1787740104; b=FNX+dtOP+BMnAoZhYheV5rHOmQpLGCMD7bFh0Y93NzumSAJC5xEDiumMv4QHlzPC96jWB6Uu 5qJzRkNhMvCu4LLTBcntTd1U2VoHmzJy1LTzIxbC0+YXj27FajBiR3yBsjfHW1Pg28NzV92qsPt gjDxVs2r6iYd88uVarg7NGyo= X-Envelope-To: linux-kernel@vger.kernel.org Received: from claudy.lan (37.156.72.212) by smtp.migadu.com with ESMTPS id 1b7461c5e495a37b; Wed, 19 Aug 2026 10:28:24 +0000 X-Migadu-Flow: FLOW_OUT From: Fuad Tabba To: Marc Zyngier , Oliver Upton Cc: Joey Gouly , Steffen Eiden , Suzuki K Poulose , Zenghui Yu , Will Deacon , Sascha Bischoff , Sebastian Ene , Eric Auger , Fuad Tabba , kvmarm@lists.linux.dev, linux-arm-kernel@lists.infradead.org, linux-kernel@vger.kernel.org Subject: [PATCH 2/4] Revert "KVM: arm64: vgic-its: Don't save collections the table cannot hold" Date: Wed, 19 Aug 2026 11:28:07 +0100 Message-Id: <20260819102809.310708-3-fuad.tabba@linux.dev> X-Mailer: git-send-email 2.39.5 In-Reply-To: <20260819102809.310708-1-fuad.tabba@linux.dev> References: <20260819102809.310708-1-fuad.tabba@linux.dev> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset="utf-8" This reverts commit 9b10fb74e4b661543d188701bd4d024fc5c18f58. Freeing the collections when GITS_BASER changes removes the state this check rejected: vgic_its_cmd_handle_mapi(), vgic_its_cmd_handle_mapc() and vgic_its_restore_cte() all validate the ID against the current table before allocating, and the table can no longer change under the list. What remains is a collection whose entry is not backed by a memslot, which the write fails on anyway, so the check costs a save userspace should be able to issue reliably and buys nothing. The reverted commit credited the check with bounding the walk as well. It stays bounded without it: collection IDs are unique and each is below the table's capacity, so the list cannot be longer than the table. Suggested-by: Marc Zyngier Link: https://lore.kernel.org/all/87ecg9owwa.wl-maz@kernel.org/ Signed-off-by: Fuad Tabba --- arch/arm64/kvm/vgic/vgic-its.c | 3 --- 1 file changed, 3 deletions(-) diff --git a/arch/arm64/kvm/vgic/vgic-its.c b/arch/arm64/kvm/vgic/vgic-its.c index 3339d9977af27..cc6ea5c3409ae 100644 --- a/arch/arm64/kvm/vgic/vgic-its.c +++ b/arch/arm64/kvm/vgic/vgic-its.c @@ -2535,9 +2535,6 @@ static int vgic_its_save_collection_table(struct vgic= _its *its) max_size =3D GITS_BASER_NR_PAGES(baser) * SZ_64K; =20 list_for_each_entry(collection, &its->collection_list, coll_list) { - if (!vgic_its_check_id(its, baser, collection->collection_id, NULL)) - return -EINVAL; - ret =3D vgic_its_save_cte(its, collection, gpa); if (ret) return ret; --=20 2.39.5 From nobody Mon Sep 28 17:00:00 2026 Received: from mta1.migadu.com (out-228.mta1.migadu.com [95.215.58.228]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id C5AA644C67F for ; Wed, 19 Aug 2026 10:28:32 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=95.215.58.228 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1787135316; cv=none; b=cvVQ47Raj03vejuUTufflzXiQDZWk+R47qJyswJWfa52339Wy9fUW2BXeCCvQg7KUhUtjevMK+SAAa5a7yf/21idi7bq5/TtjDBEVtjg+JhBXd0K+9DddL/d4z9lvs7Xloe0mPZL7B+t1xvMM6Wy07BeTuqhtltGZkmhGyfF8Zg= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1787135316; c=relaxed/simple; bh=ND3FDfa/qCk5V+rP9yXVtcSn7EWp1L01qy+mI7z3Zkk=; h=From:To:Cc:Subject:Date:Message-Id:In-Reply-To:References: MIME-Version; b=tLDX5zjdX149+e3TUJ/CQ8inBJcueUcAh56XDKb47lW34aICpiD5sZaH0R2x+u+LmAge3cWhrvY78aTpUZ5H4zmhwDNCwui7tRgSeomMeUopV9pw2SXk3lTS4txc+yrhA/l/VkMJEHaqBM2Mvt8DVF6CBXt0gfMAspLSiOYpPfs= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=linux.dev; spf=pass smtp.mailfrom=linux.dev; dkim=pass (1024-bit key) header.d=linux.dev header.i=@linux.dev header.b=OiKqPEq3; arc=none smtp.client-ip=95.215.58.228 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=linux.dev Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=linux.dev Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linux.dev header.i=@linux.dev header.b="OiKqPEq3" X-Envelope-To: linux-kernel@vger.kernel.org DKIM-Signature: a=rsa-sha256; bh=ND3FDfa/qCk5V+rP9yXVtcSn7EWp1L01qy+mI7z3Zkk=; c=simple/simple; d=linux.dev; h=from:to:subject:date:message-id:mime-version:content-type; s=key1; t=1787135309; v=1; x=1787740109; b=OiKqPEq3KTu4gORRoIWR5xMLppn2wWk+G5qLoG7tMPbFJ+iLPGHpMb8vnfrdP8qfMihHZI9f EP9c1yYiQZ5VVHXGJQU7072aOW6j9jSUhzY5zgF3AFXJUVWZCe9/tMMnAefPIoRz6huSmSfRs2V 47ibg3ffvAEFyq89QJaNTb+I= X-Envelope-To: linux-kernel@vger.kernel.org Received: from claudy.lan (37.156.72.212) by smtp.migadu.com with ESMTPS id 3086ea0630f1674f; Wed, 19 Aug 2026 10:28:28 +0000 X-Migadu-Flow: FLOW_OUT From: Fuad Tabba To: Marc Zyngier , Oliver Upton Cc: Joey Gouly , Steffen Eiden , Suzuki K Poulose , Zenghui Yu , Will Deacon , Sascha Bischoff , Sebastian Ene , Eric Auger , Fuad Tabba , kvmarm@lists.linux.dev, linux-arm-kernel@lists.infradead.org, linux-kernel@vger.kernel.org Subject: [PATCH 3/4] KVM: arm64: vgic-its: Skip unreachable devices instead of failing the save Date: Wed, 19 Aug 2026 11:28:08 +0100 Message-Id: <20260819102809.310708-4-fuad.tabba@linux.dev> X-Mailer: git-send-email 2.39.5 In-Reply-To: <20260819102809.310708-1-fuad.tabba@linux.dev> References: <20260819102809.310708-1-fuad.tabba@linux.dev> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset="utf-8" vgic_its_save_device_tables() aborts with -EINVAL when a device's entry falls outside the device table, which a guest can arrange on its own: an indirect table lets it clear an L1 entry's valid bit without touching GITS_BASER. That fails a save userspace should be able to issue reliably. Skip the device instead, and point the saved DTE chain past it, as commit ad1e686e2378d ("KVM: arm64: vgic-its: Point saved ITEs at the next valid entry") does for ITEs. compute_next_devid_offset() takes the next device off the list whether or not it was saved, so the predecessor would otherwise point at an entry the save never wrote. Restore follows that offset while it stays inside the table being scanned: within an L2 block, or anywhere in a flat table. Both need userspace to remove a memslot under the table, since dropping an L1 entry takes the whole block with it and scan_its_table() stops at the block boundary. Fixes: 57a9a117154c9 ("KVM: arm64: vgic-its: Device table save/restore") Suggested-by: Marc Zyngier Link: https://lore.kernel.org/all/86bjaz5s6v.wl-maz@kernel.org/ Signed-off-by: Fuad Tabba --- arch/arm64/kvm/vgic/vgic-its.c | 32 +++++++++++++++++++------------- 1 file changed, 19 insertions(+), 13 deletions(-) diff --git a/arch/arm64/kvm/vgic/vgic-its.c b/arch/arm64/kvm/vgic/vgic-its.c index cc6ea5c3409ae..717fbd563fb01 100644 --- a/arch/arm64/kvm/vgic/vgic-its.c +++ b/arch/arm64/kvm/vgic/vgic-its.c @@ -2013,18 +2013,22 @@ static int vgic_its_attr_regs_access(struct kvm_dev= ice *dev, return ret; } =20 -static u32 compute_next_devid_offset(struct list_head *h, +static u32 compute_next_devid_offset(struct vgic_its *its, u64 baser, struct its_device *dev) { - struct its_device *next; - u32 next_offset; + struct its_device *next =3D dev; =20 - if (list_is_last(&dev->dev_list, h)) - return 0; - next =3D list_next_entry(dev, dev_list); - next_offset =3D next->device_id - dev->device_id; + /* + * Point at the next device vgic_its_save_device_tables() saves. It + * sorts device_list first, so the subtraction cannot underflow. + */ + list_for_each_entry_continue(next, &its->device_list, dev_list) { + if (vgic_its_check_id(its, baser, next->device_id, NULL)) + return min_t(u32, next->device_id - dev->device_id, + VITS_DTE_MAX_DEVID_OFFSET); + } =20 - return min_t(u32, next_offset, VITS_DTE_MAX_DEVID_OFFSET); + return 0; } =20 static u32 compute_next_eventid_offset(struct list_head *h, struct its_ite= *ite) @@ -2265,17 +2269,18 @@ static int vgic_its_restore_itt(struct vgic_its *it= s, struct its_device *dev) * vgic_its_save_dte - Save a device table entry at a given GPA * * @its: ITS handle + * @baser: GITS_BASER the caller is saving against * @dev: ITS device * @ptr: GPA */ -static int vgic_its_save_dte(struct vgic_its *its, struct its_device *dev, - gpa_t ptr) +static int vgic_its_save_dte(struct vgic_its *its, u64 baser, + struct its_device *dev, gpa_t ptr) { u64 val, itt_addr_field; u32 next_offset; =20 itt_addr_field =3D dev->itt_addr >> 8; - next_offset =3D compute_next_devid_offset(&its->device_list, dev); + next_offset =3D compute_next_devid_offset(its, baser, dev); val =3D (1ULL << KVM_ITS_DTE_VALID_SHIFT | ((u64)next_offset << KVM_ITS_DTE_NEXT_SHIFT) | (itt_addr_field << KVM_ITS_DTE_ITTADDR_SHIFT) | @@ -2374,15 +2379,16 @@ static int vgic_its_save_device_tables(struct vgic_= its *its) int ret; gpa_t eaddr; =20 + /* Don't fail a save that userspace must be able to issue. */ if (!vgic_its_check_id(its, baser, dev->device_id, &eaddr)) - return -EINVAL; + continue; =20 ret =3D vgic_its_save_itt(its, dev); if (ret) return ret; =20 - ret =3D vgic_its_save_dte(its, dev, eaddr); + ret =3D vgic_its_save_dte(its, baser, dev, eaddr); if (ret) return ret; } --=20 2.39.5 From nobody Mon Sep 28 17:00:00 2026 Received: from mta1.migadu.com (out-234.mta1.migadu.com [95.215.58.234]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id C2F7844C648 for ; Wed, 19 Aug 2026 10:28:32 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=95.215.58.234 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1787135316; cv=none; b=MtOKoczfUD+6rKAGsJFDs7xtXG6lgXLNtvs494iOEdGWIcqI58y4NRSJc7fTTc+SOWX05QfWwQujTAbTgN1g0orc9lJe5s6sbryKcqHECpC/EwZ/68gEsqOIBTG04GmEL5xqVVx+hkyxgNEWIrnuOJDAf3kLaUBXeTPbJf29IJs= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1787135316; c=relaxed/simple; bh=gYzwu8KYItqSmkpSAUmRmzyO8SidQUvDXcKIjiUX++c=; h=From:To:Cc:Subject:Date:Message-Id:In-Reply-To:References: MIME-Version; b=AYJMtWPHJF37KrDDFUX0A3wsGwiEkZ1dQUF65I81eENDV/R9mH4FAcalVSdkQa9YyDzRF5bXkvL2Zbs25+KoSvGxaHszsWlf7W2VtYCsnDTnvGyNwGzj2ft7Uv/LLXxDbnqLcFqucQRZnKE1UzuN+xrVhbp8eLOfKCbDL6AQWis= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=linux.dev; spf=pass smtp.mailfrom=linux.dev; dkim=pass (1024-bit key) header.d=linux.dev header.i=@linux.dev header.b=X0ydBcGR; arc=none smtp.client-ip=95.215.58.234 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=linux.dev Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=linux.dev Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linux.dev header.i=@linux.dev header.b="X0ydBcGR" X-Envelope-To: linux-kernel@vger.kernel.org DKIM-Signature: a=rsa-sha256; bh=gYzwu8KYItqSmkpSAUmRmzyO8SidQUvDXcKIjiUX++c=; c=simple/simple; d=linux.dev; h=from:to:subject:date:message-id:mime-version:content-type; s=key1; t=1787135309; v=1; x=1787740109; b=X0ydBcGRvl9z8h4YA9IMTGFjFhkZ8FpycrVA3xVK6REw6CQi0SNV/QgSSNQRLW5IIpnspkIU 9HIjtBwz4p/b3L4wizXUTvjEkx+AcTrz3+vU2IrhRZp/vdBoWDyZBJOvaQdxk31lE9P2SzH3ky3 BpTB22achuO0OqYxNh0xnH2c= X-Envelope-To: linux-kernel@vger.kernel.org Received: from claudy.lan (37.156.72.212) by smtp.migadu.com with ESMTPS id ce5a26984099601b; Wed, 19 Aug 2026 10:28:29 +0000 X-Migadu-Flow: FLOW_OUT From: Fuad Tabba To: Marc Zyngier , Oliver Upton Cc: Joey Gouly , Steffen Eiden , Suzuki K Poulose , Zenghui Yu , Will Deacon , Sascha Bischoff , Sebastian Ene , Eric Auger , Fuad Tabba , kvmarm@lists.linux.dev, linux-arm-kernel@lists.infradead.org, linux-kernel@vger.kernel.org Subject: [PATCH 4/4] KVM: arm64: selftests: Add ITS table save tests Date: Wed, 19 Aug 2026 11:28:09 +0100 Message-Id: <20260819102809.310708-5-fuad.tabba@linux.dev> X-Mailer: git-send-email 2.39.5 In-Reply-To: <20260819102809.310708-1-fuad.tabba@linux.dev> References: <20260819102809.310708-1-fuad.tabba@linux.dev> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset="utf-8" Cover the two ways a guest can leave a table that KVM_DEV_ARM_ITS_SAVE_TABLES has to cope with: a GITS_BASER write that changes the table, which drops the collections it described, and a device whose L2 block the guest invalidated, which the save skips. Each case then resets and restores, which is what the save exists for. Both fail without the preceding patches. The first save returns -EINVAL, and the second saves a DTE pointing 8192 entries ahead, at an entry the save never wrote. Assisted-by: Antigravity:gemini-3.1-pro Signed-off-by: Fuad Tabba --- tools/testing/selftests/kvm/Makefile.kvm | 1 + .../selftests/kvm/arm64/vgic_its_save.c | 441 ++++++++++++++++++ 2 files changed, 442 insertions(+) create mode 100644 tools/testing/selftests/kvm/arm64/vgic_its_save.c diff --git a/tools/testing/selftests/kvm/Makefile.kvm b/tools/testing/selft= ests/kvm/Makefile.kvm index 5f8d17ee5f677..67a18e6d13177 100644 --- a/tools/testing/selftests/kvm/Makefile.kvm +++ b/tools/testing/selftests/kvm/Makefile.kvm @@ -184,6 +184,7 @@ TEST_GEN_PROGS_arm64 +=3D arm64/stage2_block_transitions TEST_GEN_PROGS_arm64 +=3D arm64/vcpu_width_config TEST_GEN_PROGS_arm64 +=3D arm64/vgic_init TEST_GEN_PROGS_arm64 +=3D arm64/vgic_irq +TEST_GEN_PROGS_arm64 +=3D arm64/vgic_its_save TEST_GEN_PROGS_arm64 +=3D arm64/vgic_lpi_stress TEST_GEN_PROGS_arm64 +=3D arm64/vgic_v5 TEST_GEN_PROGS_arm64 +=3D arm64/vpmu_counter_access diff --git a/tools/testing/selftests/kvm/arm64/vgic_its_save.c b/tools/test= ing/selftests/kvm/arm64/vgic_its_save.c new file mode 100644 index 0000000000000..864da01539f3f --- /dev/null +++ b/tools/testing/selftests/kvm/arm64/vgic_its_save.c @@ -0,0 +1,441 @@ +// SPDX-License-Identifier: GPL-2.0-only +/* + * vgic_its_save - KVM_DEV_ARM_ITS_SAVE_TABLES against tables a guest brok= e. + * + * Both cases are reachable by a guest on its own, and neither may fail a = save + * that userspace has to be able to issue: + * + * - Changing GITS_BASER drops the collections it described, so the= save + * writes nothing but the terminating invalid entry. + * - A device the device table can no longer address is skipped, and the = saved + * DTE chain skips it too rather than pointing at an entry never writte= n. + * + * Both cases then reset and restore, which is what the save exists for. + * + * Copyright (c) 2026 Google LLC + * Author: Fuad Tabba + */ + +#include +#include +#include +#include + +#include "kvm_util.h" +#include "gic.h" +#include "gic_v3.h" +#include "gic_v3_its.h" +#include "processor.h" +#include "ucall.h" +#include "vgic.h" + +#define TEST_MEMSLOT_INDEX 1 + +/* All three ITS table entry sizes are 8 bytes in ABI 0. */ +#define ESZ 8 +#define ENTRIES_PER_PAGE (SZ_64K / ESZ) + +/* CTE and DTE layout, mirroring KVM's KVM_ITS_* in arch/arm64/kvm/vgic/v= gic.h */ +#define CTE_VALID_MASK BIT_ULL(63) +#define DTE_VALID_MASK BIT_ULL(63) +#define DTE_NEXT_SHIFT 49 +#define DTE_NEXT_MASK GENMASK_ULL(62, 49) + +/* L1 entry of an indirect table: valid bit plus a 64K aligned L2 address.= */ +#define L1E_VALID_MASK BIT_ULL(63) +#define L1E_ADDR_MASK GENMASK_ULL(51, 16) + +#define GITS_BASER_PAGES_MASK GENMASK_ULL(7, 0) + +#define POISON 0xdeadbeefdeadbeefULL + +/* The collection table starts at two pages and is shrunk to one. */ +#define COLL_TBL_PAGES 2 +#define COLL_TBL_SZ (COLL_TBL_PAGES * SZ_64K) + +/* One more collection than the shrunken table can hold. */ +#define NR_COLLECTIONS (ENTRIES_PER_PAGE + 1) + +/* Two devices, one per L2 block of the indirect device table. */ +#define DEVICE_A_ID 0 +#define DEVICE_B_ID ENTRIES_PER_PAGE + +/* + * its_send_mapd_cmd() encodes ilog2(itt_size) - 1 as num_eventid_bits, and + * vgic_its_restore_itt() scans BIT_ULL(num_eventid_bits) * ESZ, so the si= ze + * handed to MAPD has to match the ITT allocated for it. + */ +#define ITT_EVENTID_BITS 13 +#define ITT_MAPD_SIZE BIT_ULL(ITT_EVENTID_BITS + 1) +#define ITT_SZ (BIT_ULL(ITT_EVENTID_BITS) * ESZ) + +static struct kvm_vm *vm; +static struct kvm_vcpu *vcpu; +static int its_fd; +static gpa_t gpa_base; + +static struct test_data { + gpa_t device_table; + gpa_t collection_table; + gpa_t cmdq_base; + void *cmdq_base_va; + + gpa_t lpi_prop_table; + gpa_t lpi_pend_table; + + void *device_l1_va; + gpa_t device_l2[2]; + gpa_t itt_tables; +} test_data; + +static unsigned long its_baser_offset(unsigned int type) +{ + int i; + + for (i =3D 0; i < GITS_BASER_NR_REGS; i++) { + unsigned long offset =3D GITS_BASER + (i * sizeof(u64)); + u64 baser =3D readq_relaxed(GITS_BASE_GVA + offset); + + if (GITS_BASER_TYPE(baser) =3D=3D type) + return offset; + } + + GUEST_FAIL("Couldn't find an ITS BASER of type %u", type); + return -1; +} + +static void its_set_enable(bool enable) +{ + u32 ctlr =3D readl_relaxed(GITS_BASE_GVA + GITS_CTLR); + + if (enable) + ctlr |=3D GITS_CTLR_ENABLE; + else + ctlr &=3D ~GITS_CTLR_ENABLE; + + writel_relaxed(ctlr, GITS_BASE_GVA + GITS_CTLR); +} + +/* + * Shrink the collection table to a single page, leaving VALID set. BASER + * writes are ignored while the ITS is enabled. + */ +static void guest_shrink_coll_table(void) +{ + unsigned long offset =3D its_baser_offset(GITS_BASER_TYPE_COLLECTION); + u64 baser; + + its_set_enable(false); + + baser =3D readq_relaxed(GITS_BASE_GVA + offset); + baser &=3D ~GITS_BASER_PAGES_MASK; + writeq_relaxed(baser, GITS_BASE_GVA + offset); +} + +static void guest_baser_change(void) +{ + u32 coll_id; + + gic_init(GIC_V3, 1); + gic_rdist_enable_lpis(test_data.lpi_prop_table, SZ_64K, + test_data.lpi_pend_table); + + its_init(test_data.collection_table, COLL_TBL_SZ, + test_data.device_table, SZ_64K, + test_data.cmdq_base, SZ_64K); + + for (coll_id =3D 0; coll_id < NR_COLLECTIONS; coll_id++) + its_send_mapc_cmd(test_data.cmdq_base_va, 0, coll_id, true); + + guest_shrink_coll_table(); + + GUEST_DONE(); +} + +/* Turn the already installed device table into an indirect one. */ +static void guest_make_device_table_indirect(void) +{ + unsigned long offset =3D its_baser_offset(GITS_BASER_TYPE_DEVICE); + u64 baser; + + its_set_enable(false); + + baser =3D readq_relaxed(GITS_BASE_GVA + offset); + writeq_relaxed(baser | GITS_BASER_INDIRECT, GITS_BASE_GVA + offset); + + its_set_enable(true); +} + +static void guest_unreachable_device(void) +{ + u64 *l1; + + gic_init(GIC_V3, 1); + gic_rdist_enable_lpis(test_data.lpi_prop_table, SZ_64K, + test_data.lpi_pend_table); + + its_init(test_data.collection_table, SZ_64K, + test_data.device_table, SZ_64K, + test_data.cmdq_base, SZ_64K); + + guest_make_device_table_indirect(); + + /* Both L2 blocks present, so both MAPDs are in range. */ + l1 =3D test_data.device_l1_va; + l1[0] =3D L1E_VALID_MASK | (test_data.device_l2[0] & L1E_ADDR_MASK); + l1[1] =3D L1E_VALID_MASK | (test_data.device_l2[1] & L1E_ADDR_MASK); + + its_send_mapd_cmd(test_data.cmdq_base_va, DEVICE_A_ID, + test_data.itt_tables, ITT_MAPD_SIZE, true); + its_send_mapd_cmd(test_data.cmdq_base_va, DEVICE_B_ID, + test_data.itt_tables + ITT_SZ, ITT_MAPD_SIZE, true); + + /* + * Drop the block holding device B. No ITS command and no GITS_BASER + * write is involved, so nothing tells KVM the device is now + * unreachable. + */ + l1[1] =3D 0; + + GUEST_DONE(); +} + +static void run_guest(void) +{ + struct ucall uc; + + vcpu_run(vcpu); + switch (get_ucall(vcpu, &uc)) { + case UCALL_DONE: + break; + case UCALL_ABORT: + REPORT_GUEST_ASSERT(uc); + break; + default: + TEST_FAIL("Unexpected ucall: %lu", uc.cmd); + } +} + +static int save_tables(void) +{ + return __kvm_device_attr_set(its_fd, KVM_DEV_ARM_VGIC_GRP_CTRL, + KVM_DEV_ARM_ITS_SAVE_TABLES, NULL); +} + +static u64 its_reg_get(unsigned long offset) +{ + u64 val; + + kvm_device_attr_get(its_fd, KVM_DEV_ARM_VGIC_GRP_ITS_REGS, offset, + &val); + return val; +} + +static void its_reg_set(unsigned long offset, u64 val) +{ + kvm_device_attr_set(its_fd, KVM_DEV_ARM_VGIC_GRP_ITS_REGS, offset, + &val); +} + +/* + * What a migration target does with the saved tables, in the order + * Documentation/virt/kvm/devices/arm-vgic-its.rst gives: the GITS_ regist= ers + * first, then the tables. The reset in between clears GITS_BASER.Valid, + * which is why the registers have to be written back before the restore. + */ +static void reset_and_restore_tables(void) +{ + u64 baser[GITS_BASER_NR_REGS]; + int ret, i; + + for (i =3D 0; i < GITS_BASER_NR_REGS; i++) + baser[i] =3D its_reg_get(GITS_BASER + (i * sizeof(u64))); + + ret =3D __kvm_device_attr_set(its_fd, KVM_DEV_ARM_VGIC_GRP_CTRL, + KVM_DEV_ARM_ITS_CTRL_RESET, NULL); + TEST_ASSERT(!ret, "Expected the reset to succeed, got ret %d errno %d", + ret, errno); + + for (i =3D 0; i < GITS_BASER_NR_REGS; i++) + its_reg_set(GITS_BASER + (i * sizeof(u64)), baser[i]); + + ret =3D __kvm_device_attr_set(its_fd, KVM_DEV_ARM_VGIC_GRP_CTRL, + KVM_DEV_ARM_ITS_RESTORE_TABLES, NULL); + TEST_ASSERT(!ret, "Expected the restore to succeed, got ret %d errno %d", + ret, errno); +} + +static void poison_range(gpa_t base, size_t size) +{ + u64 *entry =3D addr_gpa2hva(vm, base); + size_t i; + + for (i =3D 0; i < size / ESZ; i++) + entry[i] =3D POISON; +} + +static void setup_memslot(size_t sz) +{ + size_t pages =3D sz / vm->page_size; + + gpa_base =3D ((vm_compute_max_gfn(vm) + 1) * vm->page_size) - sz; + vm_userspace_mem_region_add(vm, VM_MEM_SRC_ANONYMOUS, gpa_base, + TEST_MEMSLOT_INDEX, pages, 0); +} + +static gpa_t alloc_64k(size_t nr) +{ + size_t pages_per_64k =3D vm_calc_num_guest_pages(vm->mode, SZ_64K); + gpa_t gpa =3D vm_phy_pages_alloc(vm, nr * pages_per_64k, gpa_base, + TEST_MEMSLOT_INDEX); + + TEST_ASSERT(IS_ALIGNED(gpa, SZ_64K), + "Allocation at 0x%lx is not 64K aligned, GITS_BASER cannot address i= t", + gpa); + return gpa; +} + +static void map_to_guest(gpa_t gpa, size_t nr) +{ + size_t pages_per_64k =3D vm_calc_num_guest_pages(vm->mode, SZ_64K); + + virt_map(vm, gpa, gpa, nr * pages_per_64k); +} + +static void setup_common(void) +{ + test_data.cmdq_base =3D alloc_64k(1); + map_to_guest(test_data.cmdq_base, 1); + test_data.cmdq_base_va =3D (void *)test_data.cmdq_base; + + test_data.lpi_prop_table =3D alloc_64k(1); + test_data.lpi_pend_table =3D alloc_64k(1); +} + +static void teardown(void) +{ + close(its_fd); + kvm_vm_free(vm); + memset(&test_data, 0, sizeof(test_data)); +} + +/* + * A GITS_BASER write that changes the table drops the collections it + * described. The save then has an empty list, so it writes the terminating + * invalid entry and nothing else. + */ +static void test_baser_change_drops_collections(void) +{ + u64 *cte; + int ret, i; + + pr_info("Testing that a GITS_BASER change drops the collections\n"); + + vm =3D vm_create_with_one_vcpu(&vcpu, guest_baser_change); + setup_memslot((4 + COLL_TBL_PAGES) * SZ_64K); + its_fd =3D vgic_its_setup(vm); + + test_data.device_table =3D alloc_64k(1); + test_data.collection_table =3D alloc_64k(COLL_TBL_PAGES); + setup_common(); + + sync_global_to_guest(vm, test_data); + run_guest(); + + /* Anything KVM writes is then the only thing that changed. */ + poison_range(test_data.collection_table, COLL_TBL_SZ); + + ret =3D save_tables(); + TEST_ASSERT(!ret, "Expected the save to succeed, got %d errno %d", + ret, errno); + + cte =3D addr_gpa2hva(vm, test_data.collection_table); + + /* + * Finding the terminator at the head of the table is also what proves + * the reads below landed in the saved table rather than elsewhere. + */ + TEST_ASSERT(le64toh(cte[0]) =3D=3D 0, + "CTE 0: expected the terminating invalid entry, got 0x%llx", + (unsigned long long)le64toh(cte[0])); + + for (i =3D 1; i < COLL_TBL_SZ / ESZ; i++) + TEST_ASSERT(cte[i] =3D=3D POISON, + "CTE %d: expected it untouched, got 0x%llx", + i, (unsigned long long)cte[i]); + + reset_and_restore_tables(); + + teardown(); +} + +/* + * A device whose L2 block the guest dropped is skipped by the save, and t= he + * DTE chain skips it too: left alone, the surviving device would point at= an + * entry the save never wrote. + */ +static void test_unreachable_device_skipped(void) +{ + u64 dte; + int ret; + + pr_info("Testing that an unreachable device is skipped by the save\n"); + + vm =3D vm_create_with_one_vcpu(&vcpu, guest_unreachable_device); + setup_memslot(9 * SZ_64K); + its_fd =3D vgic_its_setup(vm); + + test_data.device_table =3D alloc_64k(1); + test_data.collection_table =3D alloc_64k(1); + test_data.device_l2[0] =3D alloc_64k(1); + test_data.device_l2[1] =3D alloc_64k(1); + test_data.itt_tables =3D alloc_64k(2); + setup_common(); + + map_to_guest(test_data.device_table, 1); + test_data.device_l1_va =3D (void *)test_data.device_table; + + sync_global_to_guest(vm, test_data); + run_guest(); + + poison_range(test_data.device_l2[0], SZ_64K); + poison_range(test_data.device_l2[1], SZ_64K); + + ret =3D save_tables(); + TEST_ASSERT(!ret, "Expected the save to succeed, got %d errno %d", + ret, errno); + + dte =3D le64toh(*(u64 *)addr_gpa2hva(vm, test_data.device_l2[0])); + + /* Device A is still reachable, so it is saved. */ + TEST_ASSERT(dte & DTE_VALID_MASK, + "Device A: expected a valid DTE, got 0x%llx", + (unsigned long long)dte); + + /* + * Device B is the only device after it and was skipped, so nothing + * follows A in the saved chain. + */ + TEST_ASSERT(FIELD_GET(DTE_NEXT_MASK, dte) =3D=3D 0, + "Device A: expected no next device, got offset %llu", + (unsigned long long)FIELD_GET(DTE_NEXT_MASK, dte)); + + /* And nothing was written into the block the guest dropped. */ + TEST_ASSERT(*(u64 *)addr_gpa2hva(vm, test_data.device_l2[1]) =3D=3D POISO= N, + "Device B: expected its entry untouched"); + + reset_and_restore_tables(); + + teardown(); +} + +int main(void) +{ + TEST_REQUIRE(kvm_supports_vgic_v3()); + + test_baser_change_drops_collections(); + test_unreachable_device_skipped(); + + pr_info("All ok!\n"); + return 0; +} --=20 2.39.5