[PATCH v4 0/4] KVM: arm64: fix VGICv3 redistributor rollback

[Karl Mehltretter <kmehltretter@gmail.com>]

A failed REDIST_REGION write can unregister redistributor iodevs while
leaving their assignments cached. A retry then skips those vCPUs and leaves
their iodevs missing.

Patch 1 fixes the accounting when an individual MMIO-bus registration
fails. It reserves the selected region slot before registration and undoes
that assignment on failure.

Patch 2 limits rollback to assignments from the new region. Resetting
assignments from an older region can miss one held by a vCPU that is not
yet visible to kvm_for_each_vcpu() and move free_index behind that live
assignment.
slots_lock prevents a concurrent vCPU from acquiring an assignment from the
new region before a failed write removes it.

Patches 3 and 4 add regression coverage for an overlapping region, retry,
and final GICR_TYPER accesses to all four redistributors.

Testing:
- Built the modified arm64 KVM objects with W=1 and the arm64 vgic_init
  selftest using GCC 13.3.0.
- On an Arm Base RevC AEMvA FVP with GICv3, vgic_init passed with nVHE,
  VHE and protected hVHE. A VHE kernel with PROVE_LOCKING and KASAN also
  passed without lockdep or KASAN reports. A control kernel containing
  only patches 3 and 4 failed at the first GICR_TYPER access, 0x8030008.
- Under QEMU 11.0.2 TCG, test-only instrumentation paused vCPU creation
  after assigning a redistributor but before kvm_for_each_vcpu() could see
  it. An MMIO-bus registration failure was injected after one vCPU was
  assigned to the new region.
  Rollback preserved the old assignment before and after the vCPU became
  visible. A valid retry succeeded and guest GICR_TYPER accesses found all
  four redistributors.
- An adapted Linux 5.10.268 backport of patches 1 and 2, on top of
  8542a8f95a67 ("KVM: arm64: vgic-v3: Fix error handling in
  vgic_v3_set_redist_base()"), passed the isolated retry test. The
  prerequisite-only control failed at the same GICR_TYPER access.

---
Changes since v3:
- Dropped the REDIST/REDIST_REGION serialization and VGIC init/destroy
  rework, keeping the fix close to v2. (Marc)
- Limited rollback to assignments from the new region so an older-region
  assignment cannot be missed during concurrent vCPU creation.
- Added Fuad's Reviewed-by tags to patches 1, 3 and 4. These are otherwise
  unchanged from v3 (formerly patches 1, 4 and 5).

Previous version:
v3: https://lore.kernel.org/r/20260822095346.53882-1-kmehltretter@gmail.com

Karl Mehltretter (4):
  KVM: arm64: vgic-v3: Undo assignment on iodev registration failure
  KVM: arm64: vgic-v3: Roll back assignments from the new region
  KVM: arm64: selftests: Pass guest code to vm_gic_create_with_vcpus()
  KVM: arm64: selftests: Test VGICv3 redistributor region retry

 arch/arm64/kvm/vgic/vgic-mmio-v3.c            |  54 ++++++--
 tools/testing/selftests/kvm/arm64/vgic_init.c | 116 ++++++++++++++++--
 2 files changed, 151 insertions(+), 19 deletions(-)

base-commit: cf72cbb39da84b6f02f90c07f33b102fc10b16f0
-- 
2.39.5 (Apple Git-154)