Re: [PATCH v4 29/48] KVM: arm64: gic-v5: Add GICv5 SPI injection to irqfd

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:

Pre-existing issues:
- [High] GICv5 VMs configured with more than 988 SPIs will unconditionally fail to initialize because the default IRQ routing setup generates routing entries that exceed KVM_IRQCHIP_NUM_PINS.
--

--- Patch [29]: [PATCH v4 29/48] KVM: arm64: gic-v5: Add GICv5 SPI injection to irqfd ---
commit a9da966fc7b449adaa92917185e2770d6d012f6f
Author: Sascha Bischoff <Sascha.Bischoff@arm.com>

KVM: arm64: gic-v5: Add GICv5 SPI injection to irqfd
    
Now that there is support for GICv5 SPIs in KVM, update
vgic_irqfd_set_irq() to translate irqchip pins into GICv5 SPI IntIDs
before injecting them.

> diff --git a/arch/arm64/kvm/vgic/vgic-irqfd.c b/arch/arm64/kvm/vgic/vgic-irqfd.c
> index 19a1094536e6a..83e84151d7aa2 100644
> --- a/arch/arm64/kvm/vgic/vgic-irqfd.c
> +++ b/arch/arm64/kvm/vgic/vgic-irqfd.c

[ ... ]

> @@ -52,8 +57,8 @@ int kvm_set_routing_entry(struct kvm *kvm,
>  		e->set = vgic_irqfd_set_irq;
>  		e->irqchip.irqchip = ue->u.irqchip.irqchip;
>  		e->irqchip.pin = ue->u.irqchip.pin;
> -		if ((e->irqchip.pin >= KVM_IRQCHIP_NUM_PINS) ||
> -		    (e->irqchip.irqchip >= KVM_NR_IRQCHIPS))
> +		if (e->irqchip.pin >= KVM_IRQCHIP_NUM_PINS ||
> +		    e->irqchip.irqchip >= KVM_NR_IRQCHIPS)
[Severity: High]
This isn't a bug introduced by this patch, but does this check cause VM
initialization to fail if a GICv5 VM is configured with more than 988 SPIs?

When userspace configures a VM with nr_spis > 988,
kvm_vgic_setup_default_irq_routing() attempts to set up a 1:1 default routing
for all SPIs:

arch/arm64/kvm/vgic/vgic-irqfd.c:kvm_vgic_setup_default_irq_routing() {
	for (i = 0; i < nr; i++) {
		entries[i].gsi = i;
		entries[i].type = KVM_IRQ_ROUTING_IRQCHIP;
		entries[i].u.irqchip.irqchip = 0;
		entries[i].u.irqchip.pin = i;
	}
	ret = kvm_set_irq_routing(kvm, entries, nr, 0);
	...
}

Because kvm_set_routing_entry() caps e->irqchip.pin at KVM_IRQCHIP_NUM_PINS
(which is 988), any entries beyond 988 will be rejected here with -EINVAL,
causing VM initialization to abort.

>  			goto out;
>  		break;
>  	case KVM_IRQ_ROUTING_MSI:

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260724104819.1296803-1-sascha.bischoff@arm.com?part=29