[PATCH v2 0/2] KVM: arm64: Reject mismatched GICv3 ITS/VGIC models

[PATCH v2 0/2] KVM: arm64: Reject mismatched GICv3 ITS/VGIC models

[Sascha Bischoff]

On a GICv5 host with legacy GICv3 support, KVM exposes both VGIC
models to userspace. A VM can create a GICv3 ITS alongside a GICv5
VGIC, because neither creation path checks the model of the other
device. The ITS sets has_its, but a GICv5 VM cannot use a GICv3 ITS
for MSI translation. Creating the ITS before the VGIC also lets
userspace select an incompatible VGIC model later.

Record the VGIC model required by a GICv3 ITS and reject incompatible
device creation in either order. Drop has_its in favour of using the
newly added its_model instead. The second patch tests both orderings,
skipping the test if the host does not offer a GICv3 ITS.

This series is based on kvmarm/next-7.4+fixes-7.3-2.

Changes since V1:

* Worked in Marc's suggestion to drop has_its.
* Check for its_model being non-zero in vgic_has_its(), allowing us to
  drop has_its.
* Added a comment to explain what we are actually doing. Again, Marc's
  suggestion.
* Changed the type of vgic_model from u32 to enum kvm_device_type.

Thanks,
Sascha

Sascha Bischoff (2):
  KVM: arm64: vgic: Require matching VGIC model for GICv3 ITS
  KVM: selftests: Reject GICv3 ITS with a GICv5 VGIC

 arch/arm64/kvm/vgic/vgic-init.c             | 17 +++++++++++
 arch/arm64/kvm/vgic/vgic-its.c              | 15 +++++++++-
 arch/arm64/kvm/vgic/vgic-mmio-v3.c          |  5 +---
 include/kvm/arm_vgic.h                      |  5 ++--
 tools/testing/selftests/kvm/arm64/vgic_v5.c | 32 +++++++++++++++++++++
 5 files changed, 67 insertions(+), 7 deletions(-)

-- 
2.34.1

[PATCH v2 1/2] KVM: arm64: vgic: Require matching VGIC model for GICv3 ITS

[Sascha Bischoff]

On a GICv5 host with legacy support, KVM registers both VGICv3 and
VGICv5 devices. Without a model check, a VM can create a GICv3 ITS
alongside an incompatible VGIC, regardless of creation order.

Record the VGIC model required by an ITS. Reject an ITS if the VM
already has an incompatible VGIC, and reject a VGIC if an existing
ITS requires a different model. Allow either creation order when
the models match.

Have vgic_has_its() check that the its_model has been set, and drop
the separate has_its flag.

As part of this change, swap the type of vgic_model from u32 to enum
kvm_device_type. This requires updating the switch cases in
kvm_vgic_vcpu_init() and kvm_vgic_dist_destroy() to include default
cases, which we mark as unreachable().

Signed-off-by: Sascha Bischoff <sascha.bischoff@arm.com>
---
 arch/arm64/kvm/vgic/vgic-init.c    | 17 +++++++++++++++++
 arch/arm64/kvm/vgic/vgic-its.c     | 15 ++++++++++++++-
 arch/arm64/kvm/vgic/vgic-mmio-v3.c |  5 +----
 include/kvm/arm_vgic.h             |  5 +++--
 4 files changed, 35 insertions(+), 7 deletions(-)

diff --git a/arch/arm64/kvm/vgic/vgic-init.c b/arch/arm64/kvm/vgic/vgic-init.c
index b5ea1e39c6862..e499cec70e607 100644
--- a/arch/arm64/kvm/vgic/vgic-init.c
+++ b/arch/arm64/kvm/vgic/vgic-init.c
@@ -125,6 +125,11 @@ int kvm_vgic_create(struct kvm *kvm, u32 type)
 		goto out_unlock;
 	}
 
+	if (kvm->arch.vgic.its_model && kvm->arch.vgic.its_model != type) {
+		ret = -ENODEV;
+		goto out_unlock;
+	}
+
 	if (kvm_id_regs_final(kvm))
 		goto out_unlock;
 	ret = 0;
@@ -437,6 +442,8 @@ int kvm_vgic_vcpu_init(struct kvm_vcpu *vcpu)
 		return ret;
 
 	switch (dist->vgic_model) {
+	case KVM_DEV_TYPE_ARM_VGIC_V2:
+		break;
 	case KVM_DEV_TYPE_ARM_VGIC_V3:
 		/*
 		 * If we are creating a VCPU with a GICv3 we must also register
@@ -455,6 +462,9 @@ int kvm_vgic_vcpu_init(struct kvm_vcpu *vcpu)
 		 */
 		if (vcpu->vcpu_id >= kvm_vgic_global_state.max_gicv5_vcpus)
 			return -EINVAL;
+		break;
+	default:
+		unreachable();
 	}
 
 	return ret;
@@ -554,6 +564,10 @@ static void kvm_vgic_dist_destroy(struct kvm *kvm)
 	dist->nr_spis = 0;
 	dist->vgic_dist_base = VGIC_ADDR_UNDEF;
 
+	/* A VM may be destroyed without ever creating a VGIC. */
+	if (!dist->vgic_model)
+		goto out;
+
 	switch (dist->vgic_model) {
 	case KVM_DEV_TYPE_ARM_VGIC_V2:
 		dist->vgic_cpu_base = VGIC_ADDR_UNDEF;
@@ -571,8 +585,11 @@ static void kvm_vgic_dist_destroy(struct kvm *kvm)
 		kfree(dist->vgic_v5_irs_data);
 		dist->vgic_v5_irs_data = NULL;
 		break;
+	default:
+		unreachable();
 	}
 
+out:
 	xa_destroy(&dist->lpi_xa);
 }
 
diff --git a/arch/arm64/kvm/vgic/vgic-its.c b/arch/arm64/kvm/vgic/vgic-its.c
index e5657cb603567..7df5869cff990 100644
--- a/arch/arm64/kvm/vgic/vgic-its.c
+++ b/arch/arm64/kvm/vgic/vgic-its.c
@@ -1875,6 +1875,19 @@ static int vgic_its_create(struct kvm_device *dev, u32 type)
 
 	mutex_lock(&dev->kvm->arch.config_lock);
 
+	/*
+	 * Reject creation of a GICv3 ITS if:
+	 * - The VM already has a VGIC other than GICv3.
+	 * - An existing ITS requires a VGIC model other than GICv3.
+	 */
+	if ((irqchip_in_kernel(dev->kvm) && !vgic_is_v3(dev->kvm)) ||
+	    (dev->kvm->arch.vgic.its_model &&
+	     dev->kvm->arch.vgic.its_model != KVM_DEV_TYPE_ARM_VGIC_V3)) {
+		mutex_unlock(&dev->kvm->arch.config_lock);
+		kfree(its);
+		return -ENODEV;
+	}
+
 	if (vgic_initialized(dev->kvm)) {
 		ret = vgic_v4_init(dev->kvm);
 		if (ret < 0) {
@@ -1902,7 +1915,7 @@ static int vgic_its_create(struct kvm_device *dev, u32 type)
 	xa_init(&its->translation_cache);
 
 	dev->kvm->arch.vgic.msis_require_devid = true;
-	dev->kvm->arch.vgic.has_its = true;
+	dev->kvm->arch.vgic.its_model = KVM_DEV_TYPE_ARM_VGIC_V3;
 	its->enabled = false;
 	its->dev = dev;
 
diff --git a/arch/arm64/kvm/vgic/vgic-mmio-v3.c b/arch/arm64/kvm/vgic/vgic-mmio-v3.c
index 5ab789accc9d4..5f0a5b12e338f 100644
--- a/arch/arm64/kvm/vgic/vgic-mmio-v3.c
+++ b/arch/arm64/kvm/vgic/vgic-mmio-v3.c
@@ -42,10 +42,7 @@ bool vgic_has_its(struct kvm *kvm)
 {
 	struct vgic_dist *dist = &kvm->arch.vgic;
 
-	if (dist->vgic_model != KVM_DEV_TYPE_ARM_VGIC_V3)
-		return false;
-
-	return dist->has_its;
+	return !!dist->its_model;
 }
 
 bool vgic_supports_direct_msis(struct kvm *kvm)
diff --git a/include/kvm/arm_vgic.h b/include/kvm/arm_vgic.h
index 7be81b936bf10..cad74eaff0a7e 100644
--- a/include/kvm/arm_vgic.h
+++ b/include/kvm/arm_vgic.h
@@ -502,7 +502,9 @@ struct vgic_dist {
 	bool			initialized;
 
 	/* vGIC model the kernel emulates for the guest (GICv2 or GICv3) */
-	u32			vgic_model;
+	enum kvm_device_type	vgic_model;
+	/* VGIC model required by the VM's ITS devices. */
+	enum kvm_device_type	its_model;
 
 	/* Implementation revision as reported in the GICD_IIDR */
 	u32			implementation_rev;
@@ -547,7 +549,6 @@ struct vgic_dist {
 	struct vgic_io_device	dist_iodev;
 	struct vgic_io_device	cpuif_iodev;
 
-	bool			has_its;
 	bool			table_write_in_progress;
 
 	/*
-- 
2.34.1

[PATCH v2 2/2] KVM: selftests: Reject GICv3 ITS with a GICv5 VGIC

[Sascha Bischoff]

Check that a GICv3 ITS and a GICv5 VGIC cannot be paired, regardless
of which device is created first. Skip the check when the host does not
expose a GICv3 ITS.

Signed-off-by: Sascha Bischoff <sascha.bischoff@arm.com>
---
 tools/testing/selftests/kvm/arm64/vgic_v5.c | 32 +++++++++++++++++++++
 1 file changed, 32 insertions(+)

diff --git a/tools/testing/selftests/kvm/arm64/vgic_v5.c b/tools/testing/selftests/kvm/arm64/vgic_v5.c
index d5df742b23001..5bf7d99d29147 100644
--- a/tools/testing/selftests/kvm/arm64/vgic_v5.c
+++ b/tools/testing/selftests/kvm/arm64/vgic_v5.c
@@ -2003,8 +2003,40 @@ int test_kvm_device(u32 gic_dev_type)
 	return 0;
 }
 
+static void test_vgic_v3_its_with_vgic_v5(void)
+{
+	struct kvm_vm *vm = vm_create_barebones();
+	int gic_fd, its_fd, ret;
+
+	if (__kvm_test_create_device(vm, KVM_DEV_TYPE_ARM_VGIC_ITS)) {
+		pr_info("No GICv3 ITS support; skipping mixed-model test.\n");
+		kvm_vm_free(vm);
+		return;
+	}
+
+	gic_fd = kvm_create_device(vm, KVM_DEV_TYPE_ARM_VGIC_V5);
+	ret = __kvm_create_device(vm, KVM_DEV_TYPE_ARM_VGIC_ITS);
+	TEST_ASSERT(ret < 0 && errno == ENODEV,
+		    "GICv3 ITS created after GICv5 VGIC: ret=%d errno=%d",
+		    ret, errno);
+	close(gic_fd);
+	kvm_vm_free(vm);
+
+	vm = vm_create_barebones();
+	its_fd = kvm_create_device(vm, KVM_DEV_TYPE_ARM_VGIC_ITS);
+	ret = __kvm_create_device(vm, KVM_DEV_TYPE_ARM_VGIC_V5);
+	TEST_ASSERT(ret < 0 && errno == ENODEV,
+		    "GICv5 VGIC created after GICv3 ITS: ret=%d errno=%d",
+		    ret, errno);
+	close(its_fd);
+	kvm_vm_free(vm);
+}
+
 void run_tests(u32 gic_dev_type)
 {
+	pr_info("Test VGICv5 and GICv3 ITS model mismatch\n");
+	test_vgic_v3_its_with_vgic_v5();
+
 	pr_info("Test VGICv5 address attrs\n");
 	test_vgic_v5_addr_attrs();
 
-- 
2.34.1

Re: [PATCH v2 1/2] KVM: arm64: vgic: Require matching VGIC model for GICv3 ITS

[sashiko-bot]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
- [Medium] KVM: arm64: vgic: vgic_has_its() returns true without an in-kernel VGIC
--

commit 06339a92609918e3caedb4339d3324ff581b8fee
Author: Sascha Bischoff <sascha.bischoff@arm.com>

KVM: arm64: vgic: Require matching VGIC model for GICv3 ITS

This commit records the VGIC model required by an ITS device in
struct vgic_dist and checks model compatibility during both VGIC and ITS
creation so that incompatible devices are rejected regardless of creation
order. It also replaces dist->has_its with a check on dist->its_model in
vgic_has_its() and changes dist->vgic_model to enum kvm_device_type.

> diff --git a/arch/arm64/kvm/vgic/vgic-its.c b/arch/arm64/kvm/vgic/vgic-its.c
> index e5657cb603567..7df5869cff990 100644
> --- a/arch/arm64/kvm/vgic/vgic-its.c
> +++ b/arch/arm64/kvm/vgic/vgic-its.c
> @@ -1875,6 +1875,19 @@ static int vgic_its_create(struct kvm_device *dev, u32 type)
>  
>  	mutex_lock(&dev->kvm->arch.config_lock);
>  
> +	/*
> +	 * Reject creation of a GICv3 ITS if:
> +	 * - The VM already has a VGIC other than GICv3.
> +	 * - An existing ITS requires a VGIC model other than GICv3.
> +	 */
> +	if ((irqchip_in_kernel(dev->kvm) && !vgic_is_v3(dev->kvm)) ||
> +	    (dev->kvm->arch.vgic.its_model &&
> +	     dev->kvm->arch.vgic.its_model != KVM_DEV_TYPE_ARM_VGIC_V3)) {
> +		mutex_unlock(&dev->kvm->arch.config_lock);
> +		kfree(its);
> +		return -ENODEV;
> +	}
> +
>  	if (vgic_initialized(dev->kvm)) {
>  		ret = vgic_v4_init(dev->kvm);
>  		if (ret < 0) {
> @@ -1902,7 +1915,7 @@ static int vgic_its_create(struct kvm_device *dev, u32 type)
>  	xa_init(&its->translation_cache);
>  
>  	dev->kvm->arch.vgic.msis_require_devid = true;
> -	dev->kvm->arch.vgic.has_its = true;
> +	dev->kvm->arch.vgic.its_model = KVM_DEV_TYPE_ARM_VGIC_V3;
>  	its->enabled = false;
>  	its->dev = dev;
>  
> diff --git a/arch/arm64/kvm/vgic/vgic-mmio-v3.c b/arch/arm64/kvm/vgic/vgic-mmio-v3.c
> index 5ab789accc9d4..5f0a5b12e338f 100644
> --- a/arch/arm64/kvm/vgic/vgic-mmio-v3.c
> +++ b/arch/arm64/kvm/vgic/vgic-mmio-v3.c
> @@ -42,10 +42,7 @@ bool vgic_has_its(struct kvm *kvm)
>  {
>  	struct vgic_dist *dist = &kvm->arch.vgic;
>  
> -	if (dist->vgic_model != KVM_DEV_TYPE_ARM_VGIC_V3)
> -		return false;
> -
> -	return dist->has_its;
> +	return !!dist->its_model;
>  }
>  
>  bool vgic_supports_direct_msis(struct kvm *kvm)

[Severity: Medium]
Can vgic_has_its() now return true when a VM has created an ITS device
without creating an in-kernel VGIC (dist->vgic_model == 0)?

Previously, vgic_has_its() returned false when dist->vgic_model was 0.
With this change, vgic_its_create() sets dist->its_model even when
!irqchip_in_kernel(dev->kvm), while skipping vgic_v4_init() because
vgic_initialized(dev->kvm) is false.

If userspace creates a KVM_DEV_TYPE_ARM_VGIC_ITS device and runs a vCPU
without creating an in-kernel VGIC (which kvm_vgic_map_resources() permits
when !irqchip_in_kernel(kvm)), vgic_supports_direct_msis() evaluates to
true on GICv4.0 hosts:

arch/arm64/kvm/vgic/vgic-mmio-v3.c:vgic_supports_direct_msis() {
	if (system_supports_direct_sgis() && !vgic_supports_direct_sgis(kvm))
		return false;

	return kvm_vgic_global_state.has_gicv4 && vgic_has_its(kvm);
}

In the vCPU run loop, kvm_arch_vcpu_ioctl_run() calls
kvm_vgic_flush_hwstate() unconditionally:

arch/arm64/kvm/vgic/vgic.c:kvm_vgic_flush_hwstate() {
	if (vgic_supports_direct_irqs(vcpu->kvm) && kvm_vgic_global_state.has_gicv4)
		vgic_v4_commit(vcpu);

	if (!kvm_vgic_vcpu_pending_irq(vcpu))
		return;
}

Wouldn't this call vgic_v4_commit() -> its_commit_vpe() ->
irq_set_vcpu_affinity(0, &info) on an uninitialized its_vpe where
vpe->irq == 0, as well as allowing MSI entry points such as kvm_set_msi(),
kvm_arch_set_irq_inatomic(), vgic_msi_to_its(), and
kvm_vgic_v4_set_forwarding() to proceed without an in-kernel VGIC?

Should vgic_has_its() still check irqchip_in_kernel(kvm) (or
dist->vgic_model == dist->its_model)?

[ ... ]

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20261019134242.1289002-1-sascha.bischoff@arm.com?part=1

Re: [PATCH v2 1/2] KVM: arm64: vgic: Require matching VGIC model for GICv3 ITS

[Fuad Tabba]

Hi Sascha,

On Mon, 19 Oct 2026 14:42:41 +0100, Sascha Bischoff
<sascha.bischoff@arm.com> wrote:
> On a GICv5 host with legacy support, KVM registers both VGICv3 and
> VGICv5 devices. Without a model check, a VM can create a GICv3 ITS
> alongside an incompatible VGIC, regardless of creation order.

Could you add to the commit message that the new checks apply on every
host? A GICv2 VGIC and an ITS, in either order, now fail with -ENODEV,
where before both were created and the ITS was ignored.

[...]
> diff --git a/arch/arm64/kvm/vgic/vgic-mmio-v3.c b/arch/arm64/kvm/vgic/vgic-mmio-v3.c
[...]
> @@ -42,10 +42,7 @@ bool vgic_has_its(struct kvm *kvm)
>  {
>          struct vgic_dist *dist = &kvm->arch.vgic;
>
> -        if (dist->vgic_model != KVM_DEV_TYPE_ARM_VGIC_V3)
> -                return false;
> -
> -        return dist->has_its;
> +        return !!dist->its_model;
>  }

I think this should check vgic_model as well, as Sashiko raised [1].
vgic_its_create() accepts an ITS when there's no in-kernel VGIC, and
the VM can then run with a userspace irqchip. On a GICv4.0 host,
kvm_vgic_flush_hwstate() then calls vgic_v4_commit() on every entry,
for a vPE that vgic_v4_init() never set up. irq_set_vcpu_affinity()
fails on irq 0 and the error is ignored, so nothing crashes, but this
patch makes that path reachable. The MSI paths Sashiko lists are fine,
since KVM_SIGNAL_MSI requires an in-kernel irqchip and irqfd an
initialised VGIC.

Something like this would keep the 0 == 0 case you pointed out for
Marc's version false:

        return dist->its_model && dist->its_model == dist->vgic_model;

Cheers,
/fuad

[1] https://lore.kernel.org/all/sashiko-outbox-177254@kernel.org/

Re: [PATCH v2 1/2] KVM: arm64: vgic: Require matching VGIC model for GICv3 ITS

[Sascha Bischoff]

Hi Fuad,

On 19/10/2026 16:32, Fuad Tabba wrote:
> Hi Sascha,
> 
> On Mon, 19 Oct 2026 14:42:41 +0100, Sascha Bischoff
> <sascha.bischoff@arm.com> wrote:
>> On a GICv5 host with legacy support, KVM registers both VGICv3 and
>> VGICv5 devices. Without a model check, a VM can create a GICv3 ITS
>> alongside an incompatible VGIC, regardless of creation order.
> 
> Could you add to the commit message that the new checks apply on every
> host? A GICv2 VGIC and an ITS, in either order, now fail with -ENODEV,
> where before both were created and the ITS was ignored.

Ah, that's a good point (and a situation that hadn't properly clicked in 
my head). I'll absolutely update it.

> 
> [...]
>> diff --git a/arch/arm64/kvm/vgic/vgic-mmio-v3.c b/arch/arm64/kvm/vgic/vgic-mmio-v3.c
> [...]
>> @@ -42,10 +42,7 @@ bool vgic_has_its(struct kvm *kvm)
>>   {
>>           struct vgic_dist *dist = &kvm->arch.vgic;
>>
>> -        if (dist->vgic_model != KVM_DEV_TYPE_ARM_VGIC_V3)
>> -                return false;
>> -
>> -        return dist->has_its;
>> +        return !!dist->its_model;
>>   }
> 
> I think this should check vgic_model as well, as Sashiko raised [1].

Yeah, Sashiko and you have raised a valid point here.

> vgic_its_create() accepts an ITS when there's no in-kernel VGIC, and
> the VM can then run with a userspace irqchip. On a GICv4.0 host,
> kvm_vgic_flush_hwstate() then calls vgic_v4_commit() on every entry,
> for a vPE that vgic_v4_init() never set up. irq_set_vcpu_affinity()
> fails on irq 0 and the error is ignored, so nothing crashes, but this
> patch makes that path reachable. The MSI paths Sashiko lists are fine,
> since KVM_SIGNAL_MSI requires an in-kernel irqchip and irqfd an
> initialised VGIC.
> 
> Something like this would keep the 0 == 0 case you pointed out for
> Marc's version false:
> 
>          return dist->its_model && dist->its_model == dist->vgic_model;

Foolishly, this was the variant I'd dismissed as it returns false until 
vgic_model is set. However, I guess that is the behaviour we want here. 
An ITS is only a valid ITS if the model matches.

> 
> Cheers,
> /fuad
> 
> [1] https://lore.kernel.org/all/sashiko-outbox-177254@kernel.org/

Thank you!
Sascha