* [PATCH] riscv: KVM: Add hart-to-vCPU mapping for faster MSI injection
@ 2026-07-30 9:36 ` BillXiang
0 siblings, 0 replies; 4+ messages in thread
From: BillXiang @ 2026-07-30 9:36 UTC (permalink / raw)
To: anup
Cc: atish.patra, pjw, palmer, aou, alex, kvm, kvm-riscv, linux-riscv,
linux-kernel, xiangwencheng
Replace linear searches over all vCPUs in MSI injection paths with a
direct hart_index -> vCPU lookup table. This avoids O(n) scans on
every injected interrupt and improves performance when the number of
vCPUs is large.
Both kvm_riscv_aia_inject_msi_by_id() and kvm_riscv_aia_inject_msi()
now use the table instead of iterating over the vCPU list.
Signed-off-by: BillXiang <xiangwencheng@lanxincomputing.com>
---
arch/riscv/include/asm/kvm_aia.h | 2 +
arch/riscv/kvm/aia_device.c | 67 +++++++++++++++++++++-----------
2 files changed, 47 insertions(+), 22 deletions(-)
diff --git a/arch/riscv/include/asm/kvm_aia.h b/arch/riscv/include/asm/kvm_aia.h
index c67ec5ac0..71240b0a2 100644
--- a/arch/riscv/include/asm/kvm_aia.h
+++ b/arch/riscv/include/asm/kvm_aia.h
@@ -47,6 +47,8 @@ struct kvm_aia {
/* Internal state of APLIC */
void *aplic_state;
+
+ struct kvm_vcpu **hart_to_vcpu;
};
struct kvm_vcpu_aia_csr {
diff --git a/arch/riscv/kvm/aia_device.c b/arch/riscv/kvm/aia_device.c
index be83c2d5f..595553817 100644
--- a/arch/riscv/kvm/aia_device.c
+++ b/arch/riscv/kvm/aia_device.c
@@ -253,6 +253,14 @@ static int aia_init(struct kvm *kvm)
if (ret)
return ret;
+ aia->hart_to_vcpu = kcalloc(kvm->created_vcpus,
+ sizeof(struct kvm_vcpu*),
+ GFP_KERNEL);
+ if (!aia->hart_to_vcpu) {
+ ret = -ENOMEM;
+ goto fail_cleanup_aplic;
+ }
+
/* Iterate over each VCPU */
kvm_for_each_vcpu(idx, vcpu, kvm) {
vaia = &vcpu->arch.aia_context;
@@ -274,6 +282,12 @@ static int aia_init(struct kvm *kvm)
/* Update HART index of the IMSIC based on IMSIC base */
vaia->hart_index = aia_imsic_hart_index(aia,
vaia->imsic_addr);
+
+ if (aia->hart_to_vcpu[vaia->hart_index]) {
+ ret = -EINVAL;
+ goto fail_cleanup_imsics;
+ }
+ aia->hart_to_vcpu[vaia->hart_index] = vcpu;
/* Initialize IMSIC for this VCPU */
ret = kvm_riscv_vcpu_aia_imsic_init(vcpu);
@@ -293,6 +307,9 @@ static int aia_init(struct kvm *kvm)
continue;
kvm_riscv_vcpu_aia_imsic_cleanup(vcpu);
}
+ kfree(aia->hart_to_vcpu);
+ aia->hart_to_vcpu = NULL;
+fail_cleanup_aplic:
kvm_riscv_aia_aplic_cleanup(kvm);
return ret;
}
@@ -551,30 +568,28 @@ void kvm_riscv_vcpu_aia_deinit(struct kvm_vcpu *vcpu)
int kvm_riscv_aia_inject_msi_by_id(struct kvm *kvm, u32 hart_index,
u32 guest_index, u32 iid)
{
- unsigned long idx;
struct kvm_vcpu *vcpu;
+ struct kvm_aia *aia = &kvm->arch.aia;
/* Proceed only if AIA was initialized successfully */
if (!kvm_riscv_aia_initialized(kvm))
return -EBUSY;
- /* Inject MSI to matching VCPU */
- kvm_for_each_vcpu(idx, vcpu, kvm) {
- if (vcpu->arch.aia_context.hart_index == hart_index)
- return kvm_riscv_vcpu_aia_imsic_inject(vcpu,
- guest_index,
- 0, iid);
- }
+ if (!aia->hart_to_vcpu || hart_index >= kvm->created_vcpus)
+ return 0;
- return 0;
+ vcpu = aia->hart_to_vcpu[hart_index];
+ if (!vcpu)
+ return 0;
+
+ return kvm_riscv_vcpu_aia_imsic_inject(vcpu, guest_index, 0, iid);
}
int kvm_riscv_aia_inject_msi(struct kvm *kvm, struct kvm_msi *msi)
{
gpa_t tppn, ippn;
- unsigned long idx;
struct kvm_vcpu *vcpu;
- u32 g, toff, iid = msi->data;
+ u32 g, toff, iid = msi->data, hart_index;
struct kvm_aia *aia = &kvm->arch.aia;
gpa_t target = (((gpa_t)msi->address_hi) << 32) | msi->address_lo;
@@ -589,18 +604,22 @@ int kvm_riscv_aia_inject_msi(struct kvm *kvm, struct kvm_msi *msi)
g = tppn & (BIT(aia->nr_guest_bits) - 1);
tppn &= ~((gpa_t)(BIT(aia->nr_guest_bits) - 1));
- /* Inject MSI to matching VCPU */
- kvm_for_each_vcpu(idx, vcpu, kvm) {
- ippn = vcpu->arch.aia_context.imsic_addr >>
- IMSIC_MMIO_PAGE_SHIFT;
- if (ippn == tppn) {
- toff = target & (IMSIC_MMIO_PAGE_SZ - 1);
- return kvm_riscv_vcpu_aia_imsic_inject(vcpu, g,
- toff, iid);
- }
- }
+ if (!aia->hart_to_vcpu)
+ return 0;
- return 0;
+ hart_index = aia_imsic_hart_index(aia, target);
+ if(hart_index >= kvm->created_vcpus)
+ return 0;
+
+ vcpu = aia->hart_to_vcpu[hart_index];
+ if (!vcpu)
+ return 0;
+
+ ippn = vcpu->arch.aia_context.imsic_addr >> IMSIC_MMIO_PAGE_SHIFT;
+ if (ippn != tppn)
+ return 0;
+ toff = target & (IMSIC_MMIO_PAGE_SZ - 1);
+ return kvm_riscv_vcpu_aia_imsic_inject(vcpu, g, toff, iid);
}
int kvm_riscv_aia_inject_irq(struct kvm *kvm, unsigned int irq, bool level)
@@ -641,10 +660,14 @@ void kvm_riscv_aia_init_vm(struct kvm *kvm)
void kvm_riscv_aia_destroy_vm(struct kvm *kvm)
{
+ struct kvm_aia *aia = &kvm->arch.aia;
/* Proceed only if AIA was initialized successfully */
if (!kvm_riscv_aia_initialized(kvm))
return;
+ kfree(aia->hart_to_vcpu);
+ aia->hart_to_vcpu = NULL;
+
/* Cleanup APLIC context */
kvm_riscv_aia_aplic_cleanup(kvm);
}
--
2.53.0
^ permalink raw reply related [flat|nested] 4+ messages in thread* [PATCH] riscv: KVM: Add hart-to-vCPU mapping for faster MSI injection
@ 2026-07-30 9:36 ` BillXiang
0 siblings, 0 replies; 4+ messages in thread
From: BillXiang @ 2026-07-30 9:36 UTC (permalink / raw)
To: anup
Cc: atish.patra, pjw, palmer, aou, alex, kvm, kvm-riscv, linux-riscv,
linux-kernel, xiangwencheng
Replace linear searches over all vCPUs in MSI injection paths with a
direct hart_index -> vCPU lookup table. This avoids O(n) scans on
every injected interrupt and improves performance when the number of
vCPUs is large.
Both kvm_riscv_aia_inject_msi_by_id() and kvm_riscv_aia_inject_msi()
now use the table instead of iterating over the vCPU list.
Signed-off-by: BillXiang <xiangwencheng@lanxincomputing.com>
---
arch/riscv/include/asm/kvm_aia.h | 2 +
arch/riscv/kvm/aia_device.c | 67 +++++++++++++++++++++-----------
2 files changed, 47 insertions(+), 22 deletions(-)
diff --git a/arch/riscv/include/asm/kvm_aia.h b/arch/riscv/include/asm/kvm_aia.h
index c67ec5ac0..71240b0a2 100644
--- a/arch/riscv/include/asm/kvm_aia.h
+++ b/arch/riscv/include/asm/kvm_aia.h
@@ -47,6 +47,8 @@ struct kvm_aia {
/* Internal state of APLIC */
void *aplic_state;
+
+ struct kvm_vcpu **hart_to_vcpu;
};
struct kvm_vcpu_aia_csr {
diff --git a/arch/riscv/kvm/aia_device.c b/arch/riscv/kvm/aia_device.c
index be83c2d5f..595553817 100644
--- a/arch/riscv/kvm/aia_device.c
+++ b/arch/riscv/kvm/aia_device.c
@@ -253,6 +253,14 @@ static int aia_init(struct kvm *kvm)
if (ret)
return ret;
+ aia->hart_to_vcpu = kcalloc(kvm->created_vcpus,
+ sizeof(struct kvm_vcpu*),
+ GFP_KERNEL);
+ if (!aia->hart_to_vcpu) {
+ ret = -ENOMEM;
+ goto fail_cleanup_aplic;
+ }
+
/* Iterate over each VCPU */
kvm_for_each_vcpu(idx, vcpu, kvm) {
vaia = &vcpu->arch.aia_context;
@@ -274,6 +282,12 @@ static int aia_init(struct kvm *kvm)
/* Update HART index of the IMSIC based on IMSIC base */
vaia->hart_index = aia_imsic_hart_index(aia,
vaia->imsic_addr);
+
+ if (aia->hart_to_vcpu[vaia->hart_index]) {
+ ret = -EINVAL;
+ goto fail_cleanup_imsics;
+ }
+ aia->hart_to_vcpu[vaia->hart_index] = vcpu;
/* Initialize IMSIC for this VCPU */
ret = kvm_riscv_vcpu_aia_imsic_init(vcpu);
@@ -293,6 +307,9 @@ static int aia_init(struct kvm *kvm)
continue;
kvm_riscv_vcpu_aia_imsic_cleanup(vcpu);
}
+ kfree(aia->hart_to_vcpu);
+ aia->hart_to_vcpu = NULL;
+fail_cleanup_aplic:
kvm_riscv_aia_aplic_cleanup(kvm);
return ret;
}
@@ -551,30 +568,28 @@ void kvm_riscv_vcpu_aia_deinit(struct kvm_vcpu *vcpu)
int kvm_riscv_aia_inject_msi_by_id(struct kvm *kvm, u32 hart_index,
u32 guest_index, u32 iid)
{
- unsigned long idx;
struct kvm_vcpu *vcpu;
+ struct kvm_aia *aia = &kvm->arch.aia;
/* Proceed only if AIA was initialized successfully */
if (!kvm_riscv_aia_initialized(kvm))
return -EBUSY;
- /* Inject MSI to matching VCPU */
- kvm_for_each_vcpu(idx, vcpu, kvm) {
- if (vcpu->arch.aia_context.hart_index == hart_index)
- return kvm_riscv_vcpu_aia_imsic_inject(vcpu,
- guest_index,
- 0, iid);
- }
+ if (!aia->hart_to_vcpu || hart_index >= kvm->created_vcpus)
+ return 0;
- return 0;
+ vcpu = aia->hart_to_vcpu[hart_index];
+ if (!vcpu)
+ return 0;
+
+ return kvm_riscv_vcpu_aia_imsic_inject(vcpu, guest_index, 0, iid);
}
int kvm_riscv_aia_inject_msi(struct kvm *kvm, struct kvm_msi *msi)
{
gpa_t tppn, ippn;
- unsigned long idx;
struct kvm_vcpu *vcpu;
- u32 g, toff, iid = msi->data;
+ u32 g, toff, iid = msi->data, hart_index;
struct kvm_aia *aia = &kvm->arch.aia;
gpa_t target = (((gpa_t)msi->address_hi) << 32) | msi->address_lo;
@@ -589,18 +604,22 @@ int kvm_riscv_aia_inject_msi(struct kvm *kvm, struct kvm_msi *msi)
g = tppn & (BIT(aia->nr_guest_bits) - 1);
tppn &= ~((gpa_t)(BIT(aia->nr_guest_bits) - 1));
- /* Inject MSI to matching VCPU */
- kvm_for_each_vcpu(idx, vcpu, kvm) {
- ippn = vcpu->arch.aia_context.imsic_addr >>
- IMSIC_MMIO_PAGE_SHIFT;
- if (ippn == tppn) {
- toff = target & (IMSIC_MMIO_PAGE_SZ - 1);
- return kvm_riscv_vcpu_aia_imsic_inject(vcpu, g,
- toff, iid);
- }
- }
+ if (!aia->hart_to_vcpu)
+ return 0;
- return 0;
+ hart_index = aia_imsic_hart_index(aia, target);
+ if(hart_index >= kvm->created_vcpus)
+ return 0;
+
+ vcpu = aia->hart_to_vcpu[hart_index];
+ if (!vcpu)
+ return 0;
+
+ ippn = vcpu->arch.aia_context.imsic_addr >> IMSIC_MMIO_PAGE_SHIFT;
+ if (ippn != tppn)
+ return 0;
+ toff = target & (IMSIC_MMIO_PAGE_SZ - 1);
+ return kvm_riscv_vcpu_aia_imsic_inject(vcpu, g, toff, iid);
}
int kvm_riscv_aia_inject_irq(struct kvm *kvm, unsigned int irq, bool level)
@@ -641,10 +660,14 @@ void kvm_riscv_aia_init_vm(struct kvm *kvm)
void kvm_riscv_aia_destroy_vm(struct kvm *kvm)
{
+ struct kvm_aia *aia = &kvm->arch.aia;
/* Proceed only if AIA was initialized successfully */
if (!kvm_riscv_aia_initialized(kvm))
return;
+ kfree(aia->hart_to_vcpu);
+ aia->hart_to_vcpu = NULL;
+
/* Cleanup APLIC context */
kvm_riscv_aia_aplic_cleanup(kvm);
}
--
2.53.0
_______________________________________________
linux-riscv mailing list
linux-riscv@lists.infradead.org
http://lists.infradead.org/mailman/listinfo/linux-riscv
^ permalink raw reply related [flat|nested] 4+ messages in thread* Re: [PATCH] riscv: KVM: Add hart-to-vCPU mapping for faster MSI injection
2026-07-30 9:36 ` BillXiang
(?)
(?)
@ 2026-07-30 9:56 ` sashiko-bot
-1 siblings, 0 replies; 4+ messages in thread
From: sashiko-bot @ 2026-07-30 9:56 UTC (permalink / raw)
To: BillXiang; +Cc: kvm
Thank you for your contribution! Sashiko AI review found 4 potential issue(s) to consider:
- [Critical] Heap out-of-bounds write in `aia_init()` due to unvalidated, user-controlled `hart_index`.
- [High] Heap out-of-bounds read in MSI injection paths due to bounds checking against the dynamically changing `kvm->created_vcpus`.
- [High] Initializing the AIA irqchip when zero vCPUs exist assigns `ZERO_SIZE_PTR` to `hart_to_vcpu`, leading to a fatal page fault on MSI injection.
- [High] Missing memory barrier (data race) when publishing the `kvm->arch.aia.initialized` flag.
--
--- Patch [1]: [PATCH] riscv: KVM: Add hart-to-vCPU mapping for faster MSI injection ---
commit 709e2881a16d8c1738dcbf37e41c35b07a8f7157
Author: BillXiang <xiangwencheng@lanxincomputing.com>
riscv: KVM: Add hart-to-vCPU mapping for faster MSI injection
This patch introduces a direct lookup table to map hart_index to vCPU for
MSI injections, replacing the previous linear scans. The table is allocated
during AIA device initialization based on the number of created vCPUs.
> diff --git a/arch/riscv/kvm/aia_device.c b/arch/riscv/kvm/aia_device.c
> index b195a93add1ce..555157d1db5b0 100644
> --- a/arch/riscv/kvm/aia_device.c
> +++ b/arch/riscv/kvm/aia_device.c
> @@ -249,6 +249,14 @@ static int aia_init(struct kvm *kvm)
> if (ret)
> return ret;
>
> + aia->hart_to_vcpu = kcalloc(kvm->created_vcpus,
> + sizeof(struct kvm_vcpu*),
> + GFP_KERNEL);
> + if (!aia->hart_to_vcpu) {
> + ret = -ENOMEM;
> + goto fail_cleanup_aplic;
> + }
> +
[Severity: High]
If the host userspace initializes the AIA irqchip before creating any vCPUs,
will kcalloc() with a zero count return ZERO_SIZE_PTR?
Because ZERO_SIZE_PTR is not NULL, the allocation check will pass.
Later on, if a vCPU is created and an MSI is injected, could this lead to a
page fault when ZERO_SIZE_PTR is used as a base pointer for the array
in kvm_riscv_aia_inject_msi()?
> /* Iterate over each VCPU */
> kvm_for_each_vcpu(idx, vcpu, kvm) {
> vaia = &vcpu->arch.aia_context;
[ ... ]
> @@ -271,6 +279,12 @@ static int aia_init(struct kvm *kvm)
> vaia->hart_index = aia_imsic_hart_index(aia,
> vaia->imsic_addr);
>
> + if (aia->hart_to_vcpu[vaia->hart_index]) {
[Severity: Critical]
Is vaia->hart_index guaranteed to be within the bounds of the hart_to_vcpu
array?
The hart_index is derived from the user-controlled imsic_addr, nr_hart_bits,
and nr_group_bits via aia_imsic_hart_index().
Since aia->hart_to_vcpu is sized exactly to kvm->created_vcpus, could a
maliciously configured address cause an out-of-bounds read and subsequent
out-of-bounds write when we assign the vcpu pointer to this array?
> + ret = -EINVAL;
> + goto fail_cleanup_imsics;
> + }
> + aia->hart_to_vcpu[vaia->hart_index] = vcpu;
> +
> /* Initialize IMSIC for this VCPU */
> ret = kvm_riscv_vcpu_aia_imsic_init(vcpu);
[Severity: High]
Does publishing the aia->hart_to_vcpu array and setting the initialized flag
at the end of aia_init() require a memory barrier?
aia_init() publishes the array and then sets:
kvm->arch.aia.initialized = true;
Since KVM_SIGNAL_MSI ioctls do not hold kvm->lock, they can run concurrently.
Because RISC-V uses a weakly ordered memory model, could the CPU or compiler
reorder the write to the initialized flag before the array is fully populated?
If a concurrent MSI injection sees initialized == true but reads an
uninitialized aia->hart_to_vcpu array, could this result in a wild pointer
dereference?
[ ... ]
> @@ -541,30 +558,28 @@ void kvm_riscv_vcpu_aia_deinit(struct kvm_vcpu *vcpu)
> int kvm_riscv_aia_inject_msi_by_id(struct kvm *kvm, u32 hart_index,
> u32 guest_index, u32 iid)
> {
[ ... ]
> + if (!aia->hart_to_vcpu || hart_index >= kvm->created_vcpus)
> + return 0;
>
> - return 0;
> + vcpu = aia->hart_to_vcpu[hart_index];
[Severity: High]
Could this bounds check fail to protect the array access if vCPUs are created
after the AIA device is initialized?
The hart_to_vcpu array is allocated with a capacity equal to
kvm->created_vcpus at the time aia_init() is called.
If additional vCPUs are created via KVM_CREATE_VCPU post-initialization,
kvm->created_vcpus will increase dynamically.
Would injecting an MSI with a hart_index corresponding to a newly added vCPU
bypass this check (since it tests against the newly incremented vCPU count
rather than the array's actual allocation size) and result in an
out-of-bounds read?
> + if (!vcpu)
> + return 0;
> +
> + return kvm_riscv_vcpu_aia_imsic_inject(vcpu, guest_index, 0, iid);
> }
>
> int kvm_riscv_aia_inject_msi(struct kvm *kvm, struct kvm_msi *msi)
> {
[ ... ]
> + hart_index = aia_imsic_hart_index(aia, target);
> + if(hart_index >= kvm->created_vcpus)
> + return 0;
> +
> + vcpu = aia->hart_to_vcpu[hart_index];
[Severity: High]
Does the same dynamic kvm->created_vcpus bounds checking regression apply
here in kvm_riscv_aia_inject_msi() as well?
--
Sashiko AI review · https://sashiko.dev/#/patchset/20260730093614.983508-1-xiangwencheng@lanxincomputing.com?part=1
^ permalink raw reply [flat|nested] 4+ messages in thread