[PATCH] riscv: KVM: Add hart-to-vCPU mapping for faster MSI injection

[PATCH] riscv: KVM: Add hart-to-vCPU mapping for faster MSI injection

[BillXiang]

Replace linear searches over all vCPUs in MSI injection paths with a
direct hart_index -> vCPU lookup table. This avoids O(n) scans on
every injected interrupt and improves performance when the number of
vCPUs is large.

Both kvm_riscv_aia_inject_msi_by_id() and kvm_riscv_aia_inject_msi()
now use the table instead of iterating over the vCPU list.

Signed-off-by: BillXiang <xiangwencheng@lanxincomputing.com>
---
 arch/riscv/include/asm/kvm_aia.h |  2 +
 arch/riscv/kvm/aia_device.c      | 67 +++++++++++++++++++++-----------
 2 files changed, 47 insertions(+), 22 deletions(-)

diff --git a/arch/riscv/include/asm/kvm_aia.h b/arch/riscv/include/asm/kvm_aia.h
index c67ec5ac0..71240b0a2 100644
--- a/arch/riscv/include/asm/kvm_aia.h
+++ b/arch/riscv/include/asm/kvm_aia.h
@@ -47,6 +47,8 @@ struct kvm_aia {
 
 	/* Internal state of APLIC */
 	void		*aplic_state;
+
+	struct kvm_vcpu **hart_to_vcpu;
 };
 
 struct kvm_vcpu_aia_csr {
diff --git a/arch/riscv/kvm/aia_device.c b/arch/riscv/kvm/aia_device.c
index be83c2d5f..595553817 100644
--- a/arch/riscv/kvm/aia_device.c
+++ b/arch/riscv/kvm/aia_device.c
@@ -253,6 +253,14 @@ static int aia_init(struct kvm *kvm)
 	if (ret)
 		return ret;
 
+	aia->hart_to_vcpu = kcalloc(kvm->created_vcpus,
+					sizeof(struct kvm_vcpu*),
+					GFP_KERNEL);
+	if (!aia->hart_to_vcpu) {
+		ret = -ENOMEM;
+		goto fail_cleanup_aplic;
+	}
+
 	/* Iterate over each VCPU */
 	kvm_for_each_vcpu(idx, vcpu, kvm) {
 		vaia = &vcpu->arch.aia_context;
@@ -274,6 +282,12 @@ static int aia_init(struct kvm *kvm)
 		/* Update HART index of the IMSIC based on IMSIC base */
 		vaia->hart_index = aia_imsic_hart_index(aia,
 							vaia->imsic_addr);
+		
+		if (aia->hart_to_vcpu[vaia->hart_index]) {
+			ret = -EINVAL;
+			goto fail_cleanup_imsics;
+		}
+		aia->hart_to_vcpu[vaia->hart_index] = vcpu;
 
 		/* Initialize IMSIC for this VCPU */
 		ret = kvm_riscv_vcpu_aia_imsic_init(vcpu);
@@ -293,6 +307,9 @@ static int aia_init(struct kvm *kvm)
 			continue;
 		kvm_riscv_vcpu_aia_imsic_cleanup(vcpu);
 	}
+	kfree(aia->hart_to_vcpu);
+	aia->hart_to_vcpu = NULL;
+fail_cleanup_aplic:
 	kvm_riscv_aia_aplic_cleanup(kvm);
 	return ret;
 }
@@ -551,30 +568,28 @@ void kvm_riscv_vcpu_aia_deinit(struct kvm_vcpu *vcpu)
 int kvm_riscv_aia_inject_msi_by_id(struct kvm *kvm, u32 hart_index,
 				   u32 guest_index, u32 iid)
 {
-	unsigned long idx;
 	struct kvm_vcpu *vcpu;
+	struct kvm_aia *aia = &kvm->arch.aia;
 
 	/* Proceed only if AIA was initialized successfully */
 	if (!kvm_riscv_aia_initialized(kvm))
 		return -EBUSY;
 
-	/* Inject MSI to matching VCPU */
-	kvm_for_each_vcpu(idx, vcpu, kvm) {
-		if (vcpu->arch.aia_context.hart_index == hart_index)
-			return kvm_riscv_vcpu_aia_imsic_inject(vcpu,
-							       guest_index,
-							       0, iid);
-	}
+	if (!aia->hart_to_vcpu || hart_index >= kvm->created_vcpus)
+		return 0;
 
-	return 0;
+	vcpu = aia->hart_to_vcpu[hart_index];
+	if (!vcpu)
+		return 0;
+	
+	return kvm_riscv_vcpu_aia_imsic_inject(vcpu, guest_index, 0, iid);
 }
 
 int kvm_riscv_aia_inject_msi(struct kvm *kvm, struct kvm_msi *msi)
 {
 	gpa_t tppn, ippn;
-	unsigned long idx;
 	struct kvm_vcpu *vcpu;
-	u32 g, toff, iid = msi->data;
+	u32 g, toff, iid = msi->data, hart_index;
 	struct kvm_aia *aia = &kvm->arch.aia;
 	gpa_t target = (((gpa_t)msi->address_hi) << 32) | msi->address_lo;
 
@@ -589,18 +604,22 @@ int kvm_riscv_aia_inject_msi(struct kvm *kvm, struct kvm_msi *msi)
 	g = tppn & (BIT(aia->nr_guest_bits) - 1);
 	tppn &= ~((gpa_t)(BIT(aia->nr_guest_bits) - 1));
 
-	/* Inject MSI to matching VCPU */
-	kvm_for_each_vcpu(idx, vcpu, kvm) {
-		ippn = vcpu->arch.aia_context.imsic_addr >>
-					IMSIC_MMIO_PAGE_SHIFT;
-		if (ippn == tppn) {
-			toff = target & (IMSIC_MMIO_PAGE_SZ - 1);
-			return kvm_riscv_vcpu_aia_imsic_inject(vcpu, g,
-							       toff, iid);
-		}
-	}
+	if (!aia->hart_to_vcpu)
+		return 0;
 
-	return 0;
+	hart_index = aia_imsic_hart_index(aia, target);
+	if(hart_index >= kvm->created_vcpus)
+		return 0;
+	
+	vcpu = aia->hart_to_vcpu[hart_index];
+	if (!vcpu)
+		return 0;
+
+	ippn = vcpu->arch.aia_context.imsic_addr >> IMSIC_MMIO_PAGE_SHIFT;
+	if (ippn != tppn)
+		return 0;
+	toff = target & (IMSIC_MMIO_PAGE_SZ - 1);
+	return kvm_riscv_vcpu_aia_imsic_inject(vcpu, g,	toff, iid);
 }
 
 int kvm_riscv_aia_inject_irq(struct kvm *kvm, unsigned int irq, bool level)
@@ -641,10 +660,14 @@ void kvm_riscv_aia_init_vm(struct kvm *kvm)
 
 void kvm_riscv_aia_destroy_vm(struct kvm *kvm)
 {
+	struct kvm_aia *aia = &kvm->arch.aia;
 	/* Proceed only if AIA was initialized successfully */
 	if (!kvm_riscv_aia_initialized(kvm))
 		return;
 
+	kfree(aia->hart_to_vcpu);
+	aia->hart_to_vcpu = NULL;
+
 	/* Cleanup APLIC context */
 	kvm_riscv_aia_aplic_cleanup(kvm);
 }
-- 
2.53.0

-- 
kvm-riscv mailing list
kvm-riscv@lists.infradead.org
http://lists.infradead.org/mailman/listinfo/kvm-riscv

[PATCH] riscv: KVM: Add hart-to-vCPU mapping for faster MSI injection

[BillXiang]

Replace linear searches over all vCPUs in MSI injection paths with a
direct hart_index -> vCPU lookup table. This avoids O(n) scans on
every injected interrupt and improves performance when the number of
vCPUs is large.

Both kvm_riscv_aia_inject_msi_by_id() and kvm_riscv_aia_inject_msi()
now use the table instead of iterating over the vCPU list.

Signed-off-by: BillXiang <xiangwencheng@lanxincomputing.com>
---
 arch/riscv/include/asm/kvm_aia.h |  2 +
 arch/riscv/kvm/aia_device.c      | 67 +++++++++++++++++++++-----------
 2 files changed, 47 insertions(+), 22 deletions(-)

diff --git a/arch/riscv/include/asm/kvm_aia.h b/arch/riscv/include/asm/kvm_aia.h
index c67ec5ac0..71240b0a2 100644
--- a/arch/riscv/include/asm/kvm_aia.h
+++ b/arch/riscv/include/asm/kvm_aia.h
@@ -47,6 +47,8 @@ struct kvm_aia {
 
 	/* Internal state of APLIC */
 	void		*aplic_state;
+
+	struct kvm_vcpu **hart_to_vcpu;
 };
 
 struct kvm_vcpu_aia_csr {
diff --git a/arch/riscv/kvm/aia_device.c b/arch/riscv/kvm/aia_device.c
index be83c2d5f..595553817 100644
--- a/arch/riscv/kvm/aia_device.c
+++ b/arch/riscv/kvm/aia_device.c
@@ -253,6 +253,14 @@ static int aia_init(struct kvm *kvm)
 	if (ret)
 		return ret;
 
+	aia->hart_to_vcpu = kcalloc(kvm->created_vcpus,
+					sizeof(struct kvm_vcpu*),
+					GFP_KERNEL);
+	if (!aia->hart_to_vcpu) {
+		ret = -ENOMEM;
+		goto fail_cleanup_aplic;
+	}
+
 	/* Iterate over each VCPU */
 	kvm_for_each_vcpu(idx, vcpu, kvm) {
 		vaia = &vcpu->arch.aia_context;
@@ -274,6 +282,12 @@ static int aia_init(struct kvm *kvm)
 		/* Update HART index of the IMSIC based on IMSIC base */
 		vaia->hart_index = aia_imsic_hart_index(aia,
 							vaia->imsic_addr);
+		
+		if (aia->hart_to_vcpu[vaia->hart_index]) {
+			ret = -EINVAL;
+			goto fail_cleanup_imsics;
+		}
+		aia->hart_to_vcpu[vaia->hart_index] = vcpu;
 
 		/* Initialize IMSIC for this VCPU */
 		ret = kvm_riscv_vcpu_aia_imsic_init(vcpu);
@@ -293,6 +307,9 @@ static int aia_init(struct kvm *kvm)
 			continue;
 		kvm_riscv_vcpu_aia_imsic_cleanup(vcpu);
 	}
+	kfree(aia->hart_to_vcpu);
+	aia->hart_to_vcpu = NULL;
+fail_cleanup_aplic:
 	kvm_riscv_aia_aplic_cleanup(kvm);
 	return ret;
 }
@@ -551,30 +568,28 @@ void kvm_riscv_vcpu_aia_deinit(struct kvm_vcpu *vcpu)
 int kvm_riscv_aia_inject_msi_by_id(struct kvm *kvm, u32 hart_index,
 				   u32 guest_index, u32 iid)
 {
-	unsigned long idx;
 	struct kvm_vcpu *vcpu;
+	struct kvm_aia *aia = &kvm->arch.aia;
 
 	/* Proceed only if AIA was initialized successfully */
 	if (!kvm_riscv_aia_initialized(kvm))
 		return -EBUSY;
 
-	/* Inject MSI to matching VCPU */
-	kvm_for_each_vcpu(idx, vcpu, kvm) {
-		if (vcpu->arch.aia_context.hart_index == hart_index)
-			return kvm_riscv_vcpu_aia_imsic_inject(vcpu,
-							       guest_index,
-							       0, iid);
-	}
+	if (!aia->hart_to_vcpu || hart_index >= kvm->created_vcpus)
+		return 0;
 
-	return 0;
+	vcpu = aia->hart_to_vcpu[hart_index];
+	if (!vcpu)
+		return 0;
+	
+	return kvm_riscv_vcpu_aia_imsic_inject(vcpu, guest_index, 0, iid);
 }
 
 int kvm_riscv_aia_inject_msi(struct kvm *kvm, struct kvm_msi *msi)
 {
 	gpa_t tppn, ippn;
-	unsigned long idx;
 	struct kvm_vcpu *vcpu;
-	u32 g, toff, iid = msi->data;
+	u32 g, toff, iid = msi->data, hart_index;
 	struct kvm_aia *aia = &kvm->arch.aia;
 	gpa_t target = (((gpa_t)msi->address_hi) << 32) | msi->address_lo;
 
@@ -589,18 +604,22 @@ int kvm_riscv_aia_inject_msi(struct kvm *kvm, struct kvm_msi *msi)
 	g = tppn & (BIT(aia->nr_guest_bits) - 1);
 	tppn &= ~((gpa_t)(BIT(aia->nr_guest_bits) - 1));
 
-	/* Inject MSI to matching VCPU */
-	kvm_for_each_vcpu(idx, vcpu, kvm) {
-		ippn = vcpu->arch.aia_context.imsic_addr >>
-					IMSIC_MMIO_PAGE_SHIFT;
-		if (ippn == tppn) {
-			toff = target & (IMSIC_MMIO_PAGE_SZ - 1);
-			return kvm_riscv_vcpu_aia_imsic_inject(vcpu, g,
-							       toff, iid);
-		}
-	}
+	if (!aia->hart_to_vcpu)
+		return 0;
 
-	return 0;
+	hart_index = aia_imsic_hart_index(aia, target);
+	if(hart_index >= kvm->created_vcpus)
+		return 0;
+	
+	vcpu = aia->hart_to_vcpu[hart_index];
+	if (!vcpu)
+		return 0;
+
+	ippn = vcpu->arch.aia_context.imsic_addr >> IMSIC_MMIO_PAGE_SHIFT;
+	if (ippn != tppn)
+		return 0;
+	toff = target & (IMSIC_MMIO_PAGE_SZ - 1);
+	return kvm_riscv_vcpu_aia_imsic_inject(vcpu, g,	toff, iid);
 }
 
 int kvm_riscv_aia_inject_irq(struct kvm *kvm, unsigned int irq, bool level)
@@ -641,10 +660,14 @@ void kvm_riscv_aia_init_vm(struct kvm *kvm)
 
 void kvm_riscv_aia_destroy_vm(struct kvm *kvm)
 {
+	struct kvm_aia *aia = &kvm->arch.aia;
 	/* Proceed only if AIA was initialized successfully */
 	if (!kvm_riscv_aia_initialized(kvm))
 		return;
 
+	kfree(aia->hart_to_vcpu);
+	aia->hart_to_vcpu = NULL;
+
 	/* Cleanup APLIC context */
 	kvm_riscv_aia_aplic_cleanup(kvm);
 }
-- 
2.53.0

_______________________________________________
linux-riscv mailing list
linux-riscv@lists.infradead.org
http://lists.infradead.org/mailman/listinfo/linux-riscv

[PATCH] riscv: KVM: Add hart-to-vCPU mapping for faster MSI injection

[BillXiang]

Replace linear searches over all vCPUs in MSI injection paths with a
direct hart_index -> vCPU lookup table. This avoids O(n) scans on
every injected interrupt and improves performance when the number of
vCPUs is large.

Both kvm_riscv_aia_inject_msi_by_id() and kvm_riscv_aia_inject_msi()
now use the table instead of iterating over the vCPU list.

Signed-off-by: BillXiang <xiangwencheng@lanxincomputing.com>
---
 arch/riscv/include/asm/kvm_aia.h |  2 +
 arch/riscv/kvm/aia_device.c      | 67 +++++++++++++++++++++-----------
 2 files changed, 47 insertions(+), 22 deletions(-)

diff --git a/arch/riscv/include/asm/kvm_aia.h b/arch/riscv/include/asm/kvm_aia.h
index c67ec5ac0..71240b0a2 100644
--- a/arch/riscv/include/asm/kvm_aia.h
+++ b/arch/riscv/include/asm/kvm_aia.h
@@ -47,6 +47,8 @@ struct kvm_aia {
 
 	/* Internal state of APLIC */
 	void		*aplic_state;
+
+	struct kvm_vcpu **hart_to_vcpu;
 };
 
 struct kvm_vcpu_aia_csr {
diff --git a/arch/riscv/kvm/aia_device.c b/arch/riscv/kvm/aia_device.c
index be83c2d5f..595553817 100644
--- a/arch/riscv/kvm/aia_device.c
+++ b/arch/riscv/kvm/aia_device.c
@@ -253,6 +253,14 @@ static int aia_init(struct kvm *kvm)
 	if (ret)
 		return ret;
 
+	aia->hart_to_vcpu = kcalloc(kvm->created_vcpus,
+					sizeof(struct kvm_vcpu*),
+					GFP_KERNEL);
+	if (!aia->hart_to_vcpu) {
+		ret = -ENOMEM;
+		goto fail_cleanup_aplic;
+	}
+
 	/* Iterate over each VCPU */
 	kvm_for_each_vcpu(idx, vcpu, kvm) {
 		vaia = &vcpu->arch.aia_context;
@@ -274,6 +282,12 @@ static int aia_init(struct kvm *kvm)
 		/* Update HART index of the IMSIC based on IMSIC base */
 		vaia->hart_index = aia_imsic_hart_index(aia,
 							vaia->imsic_addr);
+		
+		if (aia->hart_to_vcpu[vaia->hart_index]) {
+			ret = -EINVAL;
+			goto fail_cleanup_imsics;
+		}
+		aia->hart_to_vcpu[vaia->hart_index] = vcpu;
 
 		/* Initialize IMSIC for this VCPU */
 		ret = kvm_riscv_vcpu_aia_imsic_init(vcpu);
@@ -293,6 +307,9 @@ static int aia_init(struct kvm *kvm)
 			continue;
 		kvm_riscv_vcpu_aia_imsic_cleanup(vcpu);
 	}
+	kfree(aia->hart_to_vcpu);
+	aia->hart_to_vcpu = NULL;
+fail_cleanup_aplic:
 	kvm_riscv_aia_aplic_cleanup(kvm);
 	return ret;
 }
@@ -551,30 +568,28 @@ void kvm_riscv_vcpu_aia_deinit(struct kvm_vcpu *vcpu)
 int kvm_riscv_aia_inject_msi_by_id(struct kvm *kvm, u32 hart_index,
 				   u32 guest_index, u32 iid)
 {
-	unsigned long idx;
 	struct kvm_vcpu *vcpu;
+	struct kvm_aia *aia = &kvm->arch.aia;
 
 	/* Proceed only if AIA was initialized successfully */
 	if (!kvm_riscv_aia_initialized(kvm))
 		return -EBUSY;
 
-	/* Inject MSI to matching VCPU */
-	kvm_for_each_vcpu(idx, vcpu, kvm) {
-		if (vcpu->arch.aia_context.hart_index == hart_index)
-			return kvm_riscv_vcpu_aia_imsic_inject(vcpu,
-							       guest_index,
-							       0, iid);
-	}
+	if (!aia->hart_to_vcpu || hart_index >= kvm->created_vcpus)
+		return 0;
 
-	return 0;
+	vcpu = aia->hart_to_vcpu[hart_index];
+	if (!vcpu)
+		return 0;
+	
+	return kvm_riscv_vcpu_aia_imsic_inject(vcpu, guest_index, 0, iid);
 }
 
 int kvm_riscv_aia_inject_msi(struct kvm *kvm, struct kvm_msi *msi)
 {
 	gpa_t tppn, ippn;
-	unsigned long idx;
 	struct kvm_vcpu *vcpu;
-	u32 g, toff, iid = msi->data;
+	u32 g, toff, iid = msi->data, hart_index;
 	struct kvm_aia *aia = &kvm->arch.aia;
 	gpa_t target = (((gpa_t)msi->address_hi) << 32) | msi->address_lo;
 
@@ -589,18 +604,22 @@ int kvm_riscv_aia_inject_msi(struct kvm *kvm, struct kvm_msi *msi)
 	g = tppn & (BIT(aia->nr_guest_bits) - 1);
 	tppn &= ~((gpa_t)(BIT(aia->nr_guest_bits) - 1));
 
-	/* Inject MSI to matching VCPU */
-	kvm_for_each_vcpu(idx, vcpu, kvm) {
-		ippn = vcpu->arch.aia_context.imsic_addr >>
-					IMSIC_MMIO_PAGE_SHIFT;
-		if (ippn == tppn) {
-			toff = target & (IMSIC_MMIO_PAGE_SZ - 1);
-			return kvm_riscv_vcpu_aia_imsic_inject(vcpu, g,
-							       toff, iid);
-		}
-	}
+	if (!aia->hart_to_vcpu)
+		return 0;
 
-	return 0;
+	hart_index = aia_imsic_hart_index(aia, target);
+	if(hart_index >= kvm->created_vcpus)
+		return 0;
+	
+	vcpu = aia->hart_to_vcpu[hart_index];
+	if (!vcpu)
+		return 0;
+
+	ippn = vcpu->arch.aia_context.imsic_addr >> IMSIC_MMIO_PAGE_SHIFT;
+	if (ippn != tppn)
+		return 0;
+	toff = target & (IMSIC_MMIO_PAGE_SZ - 1);
+	return kvm_riscv_vcpu_aia_imsic_inject(vcpu, g,	toff, iid);
 }
 
 int kvm_riscv_aia_inject_irq(struct kvm *kvm, unsigned int irq, bool level)
@@ -641,10 +660,14 @@ void kvm_riscv_aia_init_vm(struct kvm *kvm)
 
 void kvm_riscv_aia_destroy_vm(struct kvm *kvm)
 {
+	struct kvm_aia *aia = &kvm->arch.aia;
 	/* Proceed only if AIA was initialized successfully */
 	if (!kvm_riscv_aia_initialized(kvm))
 		return;
 
+	kfree(aia->hart_to_vcpu);
+	aia->hart_to_vcpu = NULL;
+
 	/* Cleanup APLIC context */
 	kvm_riscv_aia_aplic_cleanup(kvm);
 }
-- 
2.53.0

Re: [PATCH] riscv: KVM: Add hart-to-vCPU mapping for faster MSI injection

[sashiko-bot]

Thank you for your contribution! Sashiko AI review found 4 potential issue(s) to consider:
- [Critical] Heap out-of-bounds write in `aia_init()` due to unvalidated, user-controlled `hart_index`.
- [High] Heap out-of-bounds read in MSI injection paths due to bounds checking against the dynamically changing `kvm->created_vcpus`.
- [High] Initializing the AIA irqchip when zero vCPUs exist assigns `ZERO_SIZE_PTR` to `hart_to_vcpu`, leading to a fatal page fault on MSI injection.
- [High] Missing memory barrier (data race) when publishing the `kvm->arch.aia.initialized` flag.
--

--- Patch [1]: [PATCH] riscv: KVM: Add hart-to-vCPU mapping for faster MSI injection ---
commit 709e2881a16d8c1738dcbf37e41c35b07a8f7157
Author: BillXiang <xiangwencheng@lanxincomputing.com>

riscv: KVM: Add hart-to-vCPU mapping for faster MSI injection

This patch introduces a direct lookup table to map hart_index to vCPU for
MSI injections, replacing the previous linear scans. The table is allocated
during AIA device initialization based on the number of created vCPUs.

> diff --git a/arch/riscv/kvm/aia_device.c b/arch/riscv/kvm/aia_device.c
> index b195a93add1ce..555157d1db5b0 100644
> --- a/arch/riscv/kvm/aia_device.c
> +++ b/arch/riscv/kvm/aia_device.c
> @@ -249,6 +249,14 @@ static int aia_init(struct kvm *kvm)
>  	if (ret)
>  		return ret;
>  
> +	aia->hart_to_vcpu = kcalloc(kvm->created_vcpus,
> +					sizeof(struct kvm_vcpu*),
> +					GFP_KERNEL);
> +	if (!aia->hart_to_vcpu) {
> +		ret = -ENOMEM;
> +		goto fail_cleanup_aplic;
> +	}
> +

[Severity: High]
If the host userspace initializes the AIA irqchip before creating any vCPUs,
will kcalloc() with a zero count return ZERO_SIZE_PTR?

Because ZERO_SIZE_PTR is not NULL, the allocation check will pass.

Later on, if a vCPU is created and an MSI is injected, could this lead to a
page fault when ZERO_SIZE_PTR is used as a base pointer for the array
in kvm_riscv_aia_inject_msi()?

>  	/* Iterate over each VCPU */
>  	kvm_for_each_vcpu(idx, vcpu, kvm) {
>  		vaia = &vcpu->arch.aia_context;
[ ... ]
> @@ -271,6 +279,12 @@ static int aia_init(struct kvm *kvm)
>  		vaia->hart_index = aia_imsic_hart_index(aia,
>  							vaia->imsic_addr);
>  
> +		if (aia->hart_to_vcpu[vaia->hart_index]) {

[Severity: Critical]
Is vaia->hart_index guaranteed to be within the bounds of the hart_to_vcpu
array?

The hart_index is derived from the user-controlled imsic_addr, nr_hart_bits,
and nr_group_bits via aia_imsic_hart_index().

Since aia->hart_to_vcpu is sized exactly to kvm->created_vcpus, could a
maliciously configured address cause an out-of-bounds read and subsequent
out-of-bounds write when we assign the vcpu pointer to this array?

> +			ret = -EINVAL;
> +			goto fail_cleanup_imsics;
> +		}
> +		aia->hart_to_vcpu[vaia->hart_index] = vcpu;
> +
>  		/* Initialize IMSIC for this VCPU */
>  		ret = kvm_riscv_vcpu_aia_imsic_init(vcpu);

[Severity: High]
Does publishing the aia->hart_to_vcpu array and setting the initialized flag
at the end of aia_init() require a memory barrier?

aia_init() publishes the array and then sets:
    kvm->arch.aia.initialized = true;

Since KVM_SIGNAL_MSI ioctls do not hold kvm->lock, they can run concurrently.

Because RISC-V uses a weakly ordered memory model, could the CPU or compiler
reorder the write to the initialized flag before the array is fully populated?

If a concurrent MSI injection sees initialized == true but reads an
uninitialized aia->hart_to_vcpu array, could this result in a wild pointer
dereference?

[ ... ]
> @@ -541,30 +558,28 @@ void kvm_riscv_vcpu_aia_deinit(struct kvm_vcpu *vcpu)
>  int kvm_riscv_aia_inject_msi_by_id(struct kvm *kvm, u32 hart_index,
>  				   u32 guest_index, u32 iid)
>  {
[ ... ]
> +	if (!aia->hart_to_vcpu || hart_index >= kvm->created_vcpus)
> +		return 0;
>  
> -	return 0;
> +	vcpu = aia->hart_to_vcpu[hart_index];

[Severity: High]
Could this bounds check fail to protect the array access if vCPUs are created
after the AIA device is initialized?

The hart_to_vcpu array is allocated with a capacity equal to
kvm->created_vcpus at the time aia_init() is called.

If additional vCPUs are created via KVM_CREATE_VCPU post-initialization,
kvm->created_vcpus will increase dynamically.

Would injecting an MSI with a hart_index corresponding to a newly added vCPU
bypass this check (since it tests against the newly incremented vCPU count
rather than the array's actual allocation size) and result in an
out-of-bounds read?

> +	if (!vcpu)
> +		return 0;
> +
> +	return kvm_riscv_vcpu_aia_imsic_inject(vcpu, guest_index, 0, iid);
>  }
>  
>  int kvm_riscv_aia_inject_msi(struct kvm *kvm, struct kvm_msi *msi)
>  {
[ ... ]
> +	hart_index = aia_imsic_hart_index(aia, target);
> +	if(hart_index >= kvm->created_vcpus)
> +		return 0;
> +
> +	vcpu = aia->hart_to_vcpu[hart_index];

[Severity: High]
Does the same dynamic kvm->created_vcpus bounds checking regression apply
here in kvm_riscv_aia_inject_msi() as well?

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260730093614.983508-1-xiangwencheng@lanxincomputing.com?part=1