Re: [PATCH v2 1/4] KVM: arm64: vgic-its: Free the caches when GITS_BASER changes

[Marc Zyngier <maz@kernel.org>]

On Fri, 21 Aug 2026 08:37:24 +0100,
Fuad Tabba <fuad.tabba@linux.dev> wrote:
> 
> Sashiko, this one is real.
> 
> On Fri, 21 Aug 2026 at 07:57, <sashiko-bot@kernel.org> wrote:
> >
> > Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
> >
> > Pre-existing issues:
> > - [High] Pre-existing race condition in ITS MMIO handler allows MSI injection while ITS is disabled due to a stale translation cache entry.
> > --
> >
> > --- Patch [1]: [PATCH v2 1/4] KVM: arm64: vgic-its: Free the caches when GITS_BASER changes ---
> > commit 98c89973da07ed23e9bd8348bfd2cf61333c4e66
> > Author: Fuad Tabba <fuad.tabba@linux.dev>
> >
> > KVM: arm64: vgic-its: Free the caches when GITS_BASER changes
> >
> > A guest that disables the ITS and changes GITS_BASER<n> with VALID still set
> > keeps the mapped devices and collections. This patch frees the list and
> > drops the translation cache whenever the stored value changes.
> >
> > Link: https://lore.kernel.org/all/87ecg9owwa.wl-maz@kernel.org/
> >
> > > diff --git a/arch/arm64/kvm/vgic/vgic-its.c b/arch/arm64/kvm/vgic/vgic-its.c
> > > index 9e782a4fea7e5..ab89b0138efd0 100644
> > > --- a/arch/arm64/kvm/vgic/vgic-its.c
> > > +++ b/arch/arm64/kvm/vgic/vgic-its.c
> >
> > [ ... ]
> >
> > > @@ -1702,6 +1705,8 @@ static void vgic_mmio_write_its_baser(struct kvm *kvm,
> > >                       vgic_its_free_collection_list(kvm, its);
> > >                       break;
> > >               }
> > > +             /* A concurrent injection may have cached a translation. */
> > > +             vgic_its_invalidate_cache(its);
> >
> > [Severity: High]
> > This is a pre-existing issue, but the commit message explicitly notes that
> > an injection can still cache an entry after the ITS is disabled.
> >
> > Is it possible for a subsequent MSI to trigger an unexpected LPI injection?
> 
> Yes, and it violates the spec: with GITS_CTLR.Enabled == 0 writes to
> GITS_TRANSLATER are ignored, so nothing should be injected.
> 
> It was reported in June [1] and is being worked on.

Is it? I'm worried this has stalled. I'll have a look...

	M.

-- 
Without deviation from the norm, progress is not possible.