* [PATCH] riscv: KVM: Add hart-to-vCPU mapping for faster MSI injection
@ 2026-07-30 9:36 BillXiang
2026-07-30 9:56 ` sashiko-bot
2026-10-02 6:53 ` Anup Patel
0 siblings, 2 replies; 4+ messages in thread
From: BillXiang @ 2026-07-30 9:36 UTC (permalink / raw)
To: anup
Cc: atish.patra, pjw, palmer, aou, alex, kvm, kvm-riscv, linux-riscv,
linux-kernel, xiangwencheng
Replace linear searches over all vCPUs in MSI injection paths with a
direct hart_index -> vCPU lookup table. This avoids O(n) scans on
every injected interrupt and improves performance when the number of
vCPUs is large.
Both kvm_riscv_aia_inject_msi_by_id() and kvm_riscv_aia_inject_msi()
now use the table instead of iterating over the vCPU list.
Signed-off-by: BillXiang <xiangwencheng@lanxincomputing.com>
---
arch/riscv/include/asm/kvm_aia.h | 2 +
arch/riscv/kvm/aia_device.c | 67 +++++++++++++++++++++-----------
2 files changed, 47 insertions(+), 22 deletions(-)
diff --git a/arch/riscv/include/asm/kvm_aia.h b/arch/riscv/include/asm/kvm_aia.h
index c67ec5ac0..71240b0a2 100644
--- a/arch/riscv/include/asm/kvm_aia.h
+++ b/arch/riscv/include/asm/kvm_aia.h
@@ -47,6 +47,8 @@ struct kvm_aia {
/* Internal state of APLIC */
void *aplic_state;
+
+ struct kvm_vcpu **hart_to_vcpu;
};
struct kvm_vcpu_aia_csr {
diff --git a/arch/riscv/kvm/aia_device.c b/arch/riscv/kvm/aia_device.c
index be83c2d5f..595553817 100644
--- a/arch/riscv/kvm/aia_device.c
+++ b/arch/riscv/kvm/aia_device.c
@@ -253,6 +253,14 @@ static int aia_init(struct kvm *kvm)
if (ret)
return ret;
+ aia->hart_to_vcpu = kcalloc(kvm->created_vcpus,
+ sizeof(struct kvm_vcpu*),
+ GFP_KERNEL);
+ if (!aia->hart_to_vcpu) {
+ ret = -ENOMEM;
+ goto fail_cleanup_aplic;
+ }
+
/* Iterate over each VCPU */
kvm_for_each_vcpu(idx, vcpu, kvm) {
vaia = &vcpu->arch.aia_context;
@@ -274,6 +282,12 @@ static int aia_init(struct kvm *kvm)
/* Update HART index of the IMSIC based on IMSIC base */
vaia->hart_index = aia_imsic_hart_index(aia,
vaia->imsic_addr);
+
+ if (aia->hart_to_vcpu[vaia->hart_index]) {
+ ret = -EINVAL;
+ goto fail_cleanup_imsics;
+ }
+ aia->hart_to_vcpu[vaia->hart_index] = vcpu;
/* Initialize IMSIC for this VCPU */
ret = kvm_riscv_vcpu_aia_imsic_init(vcpu);
@@ -293,6 +307,9 @@ static int aia_init(struct kvm *kvm)
continue;
kvm_riscv_vcpu_aia_imsic_cleanup(vcpu);
}
+ kfree(aia->hart_to_vcpu);
+ aia->hart_to_vcpu = NULL;
+fail_cleanup_aplic:
kvm_riscv_aia_aplic_cleanup(kvm);
return ret;
}
@@ -551,30 +568,28 @@ void kvm_riscv_vcpu_aia_deinit(struct kvm_vcpu *vcpu)
int kvm_riscv_aia_inject_msi_by_id(struct kvm *kvm, u32 hart_index,
u32 guest_index, u32 iid)
{
- unsigned long idx;
struct kvm_vcpu *vcpu;
+ struct kvm_aia *aia = &kvm->arch.aia;
/* Proceed only if AIA was initialized successfully */
if (!kvm_riscv_aia_initialized(kvm))
return -EBUSY;
- /* Inject MSI to matching VCPU */
- kvm_for_each_vcpu(idx, vcpu, kvm) {
- if (vcpu->arch.aia_context.hart_index == hart_index)
- return kvm_riscv_vcpu_aia_imsic_inject(vcpu,
- guest_index,
- 0, iid);
- }
+ if (!aia->hart_to_vcpu || hart_index >= kvm->created_vcpus)
+ return 0;
- return 0;
+ vcpu = aia->hart_to_vcpu[hart_index];
+ if (!vcpu)
+ return 0;
+
+ return kvm_riscv_vcpu_aia_imsic_inject(vcpu, guest_index, 0, iid);
}
int kvm_riscv_aia_inject_msi(struct kvm *kvm, struct kvm_msi *msi)
{
gpa_t tppn, ippn;
- unsigned long idx;
struct kvm_vcpu *vcpu;
- u32 g, toff, iid = msi->data;
+ u32 g, toff, iid = msi->data, hart_index;
struct kvm_aia *aia = &kvm->arch.aia;
gpa_t target = (((gpa_t)msi->address_hi) << 32) | msi->address_lo;
@@ -589,18 +604,22 @@ int kvm_riscv_aia_inject_msi(struct kvm *kvm, struct kvm_msi *msi)
g = tppn & (BIT(aia->nr_guest_bits) - 1);
tppn &= ~((gpa_t)(BIT(aia->nr_guest_bits) - 1));
- /* Inject MSI to matching VCPU */
- kvm_for_each_vcpu(idx, vcpu, kvm) {
- ippn = vcpu->arch.aia_context.imsic_addr >>
- IMSIC_MMIO_PAGE_SHIFT;
- if (ippn == tppn) {
- toff = target & (IMSIC_MMIO_PAGE_SZ - 1);
- return kvm_riscv_vcpu_aia_imsic_inject(vcpu, g,
- toff, iid);
- }
- }
+ if (!aia->hart_to_vcpu)
+ return 0;
- return 0;
+ hart_index = aia_imsic_hart_index(aia, target);
+ if(hart_index >= kvm->created_vcpus)
+ return 0;
+
+ vcpu = aia->hart_to_vcpu[hart_index];
+ if (!vcpu)
+ return 0;
+
+ ippn = vcpu->arch.aia_context.imsic_addr >> IMSIC_MMIO_PAGE_SHIFT;
+ if (ippn != tppn)
+ return 0;
+ toff = target & (IMSIC_MMIO_PAGE_SZ - 1);
+ return kvm_riscv_vcpu_aia_imsic_inject(vcpu, g, toff, iid);
}
int kvm_riscv_aia_inject_irq(struct kvm *kvm, unsigned int irq, bool level)
@@ -641,10 +660,14 @@ void kvm_riscv_aia_init_vm(struct kvm *kvm)
void kvm_riscv_aia_destroy_vm(struct kvm *kvm)
{
+ struct kvm_aia *aia = &kvm->arch.aia;
/* Proceed only if AIA was initialized successfully */
if (!kvm_riscv_aia_initialized(kvm))
return;
+ kfree(aia->hart_to_vcpu);
+ aia->hart_to_vcpu = NULL;
+
/* Cleanup APLIC context */
kvm_riscv_aia_aplic_cleanup(kvm);
}
--
2.53.0
^ permalink raw reply related [flat|nested] 4+ messages in thread
* Re: [PATCH] riscv: KVM: Add hart-to-vCPU mapping for faster MSI injection
2026-07-30 9:36 [PATCH] riscv: KVM: Add hart-to-vCPU mapping for faster MSI injection BillXiang
@ 2026-07-30 9:56 ` sashiko-bot
2026-10-02 6:53 ` Anup Patel
1 sibling, 0 replies; 4+ messages in thread
From: sashiko-bot @ 2026-07-30 9:56 UTC (permalink / raw)
To: BillXiang; +Cc: kvm
Thank you for your contribution! Sashiko AI review found 4 potential issue(s) to consider:
- [Critical] Heap out-of-bounds write in `aia_init()` due to unvalidated, user-controlled `hart_index`.
- [High] Heap out-of-bounds read in MSI injection paths due to bounds checking against the dynamically changing `kvm->created_vcpus`.
- [High] Initializing the AIA irqchip when zero vCPUs exist assigns `ZERO_SIZE_PTR` to `hart_to_vcpu`, leading to a fatal page fault on MSI injection.
- [High] Missing memory barrier (data race) when publishing the `kvm->arch.aia.initialized` flag.
--
--- Patch [1]: [PATCH] riscv: KVM: Add hart-to-vCPU mapping for faster MSI injection ---
commit 709e2881a16d8c1738dcbf37e41c35b07a8f7157
Author: BillXiang <xiangwencheng@lanxincomputing.com>
riscv: KVM: Add hart-to-vCPU mapping for faster MSI injection
This patch introduces a direct lookup table to map hart_index to vCPU for
MSI injections, replacing the previous linear scans. The table is allocated
during AIA device initialization based on the number of created vCPUs.
> diff --git a/arch/riscv/kvm/aia_device.c b/arch/riscv/kvm/aia_device.c
> index b195a93add1ce..555157d1db5b0 100644
> --- a/arch/riscv/kvm/aia_device.c
> +++ b/arch/riscv/kvm/aia_device.c
> @@ -249,6 +249,14 @@ static int aia_init(struct kvm *kvm)
> if (ret)
> return ret;
>
> + aia->hart_to_vcpu = kcalloc(kvm->created_vcpus,
> + sizeof(struct kvm_vcpu*),
> + GFP_KERNEL);
> + if (!aia->hart_to_vcpu) {
> + ret = -ENOMEM;
> + goto fail_cleanup_aplic;
> + }
> +
[Severity: High]
If the host userspace initializes the AIA irqchip before creating any vCPUs,
will kcalloc() with a zero count return ZERO_SIZE_PTR?
Because ZERO_SIZE_PTR is not NULL, the allocation check will pass.
Later on, if a vCPU is created and an MSI is injected, could this lead to a
page fault when ZERO_SIZE_PTR is used as a base pointer for the array
in kvm_riscv_aia_inject_msi()?
> /* Iterate over each VCPU */
> kvm_for_each_vcpu(idx, vcpu, kvm) {
> vaia = &vcpu->arch.aia_context;
[ ... ]
> @@ -271,6 +279,12 @@ static int aia_init(struct kvm *kvm)
> vaia->hart_index = aia_imsic_hart_index(aia,
> vaia->imsic_addr);
>
> + if (aia->hart_to_vcpu[vaia->hart_index]) {
[Severity: Critical]
Is vaia->hart_index guaranteed to be within the bounds of the hart_to_vcpu
array?
The hart_index is derived from the user-controlled imsic_addr, nr_hart_bits,
and nr_group_bits via aia_imsic_hart_index().
Since aia->hart_to_vcpu is sized exactly to kvm->created_vcpus, could a
maliciously configured address cause an out-of-bounds read and subsequent
out-of-bounds write when we assign the vcpu pointer to this array?
> + ret = -EINVAL;
> + goto fail_cleanup_imsics;
> + }
> + aia->hart_to_vcpu[vaia->hart_index] = vcpu;
> +
> /* Initialize IMSIC for this VCPU */
> ret = kvm_riscv_vcpu_aia_imsic_init(vcpu);
[Severity: High]
Does publishing the aia->hart_to_vcpu array and setting the initialized flag
at the end of aia_init() require a memory barrier?
aia_init() publishes the array and then sets:
kvm->arch.aia.initialized = true;
Since KVM_SIGNAL_MSI ioctls do not hold kvm->lock, they can run concurrently.
Because RISC-V uses a weakly ordered memory model, could the CPU or compiler
reorder the write to the initialized flag before the array is fully populated?
If a concurrent MSI injection sees initialized == true but reads an
uninitialized aia->hart_to_vcpu array, could this result in a wild pointer
dereference?
[ ... ]
> @@ -541,30 +558,28 @@ void kvm_riscv_vcpu_aia_deinit(struct kvm_vcpu *vcpu)
> int kvm_riscv_aia_inject_msi_by_id(struct kvm *kvm, u32 hart_index,
> u32 guest_index, u32 iid)
> {
[ ... ]
> + if (!aia->hart_to_vcpu || hart_index >= kvm->created_vcpus)
> + return 0;
>
> - return 0;
> + vcpu = aia->hart_to_vcpu[hart_index];
[Severity: High]
Could this bounds check fail to protect the array access if vCPUs are created
after the AIA device is initialized?
The hart_to_vcpu array is allocated with a capacity equal to
kvm->created_vcpus at the time aia_init() is called.
If additional vCPUs are created via KVM_CREATE_VCPU post-initialization,
kvm->created_vcpus will increase dynamically.
Would injecting an MSI with a hart_index corresponding to a newly added vCPU
bypass this check (since it tests against the newly incremented vCPU count
rather than the array's actual allocation size) and result in an
out-of-bounds read?
> + if (!vcpu)
> + return 0;
> +
> + return kvm_riscv_vcpu_aia_imsic_inject(vcpu, guest_index, 0, iid);
> }
>
> int kvm_riscv_aia_inject_msi(struct kvm *kvm, struct kvm_msi *msi)
> {
[ ... ]
> + hart_index = aia_imsic_hart_index(aia, target);
> + if(hart_index >= kvm->created_vcpus)
> + return 0;
> +
> + vcpu = aia->hart_to_vcpu[hart_index];
[Severity: High]
Does the same dynamic kvm->created_vcpus bounds checking regression apply
here in kvm_riscv_aia_inject_msi() as well?
--
Sashiko AI review · https://sashiko.dev/#/patchset/20260730093614.983508-1-xiangwencheng@lanxincomputing.com?part=1
^ permalink raw reply [flat|nested] 4+ messages in thread
* Re: [PATCH] riscv: KVM: Add hart-to-vCPU mapping for faster MSI injection
2026-07-30 9:36 [PATCH] riscv: KVM: Add hart-to-vCPU mapping for faster MSI injection BillXiang
2026-07-30 9:56 ` sashiko-bot
@ 2026-10-02 6:53 ` Anup Patel
2026-10-08 6:41 ` BillXiang
1 sibling, 1 reply; 4+ messages in thread
From: Anup Patel @ 2026-10-02 6:53 UTC (permalink / raw)
To: BillXiang
Cc: atish.patra, pjw, palmer, aou, alex, kvm, kvm-riscv, linux-riscv,
linux-kernel
On Thu, Jul 30, 2026 at 3:06 PM BillXiang
<xiangwencheng@lanxincomputing.com> wrote:
>
> Replace linear searches over all vCPUs in MSI injection paths with a
> direct hart_index -> vCPU lookup table. This avoids O(n) scans on
> every injected interrupt and improves performance when the number of
> vCPUs is large.
>
> Both kvm_riscv_aia_inject_msi_by_id() and kvm_riscv_aia_inject_msi()
> now use the table instead of iterating over the vCPU list.
The AIA hart_index bits for VCPUs are based on the IMSIC address
set by the KVM user-space and are not required to be contiguous hence
this patch is already broken.
NACK from my side.
Regards,
Anup
>
> Signed-off-by: BillXiang <xiangwencheng@lanxincomputing.com>
> ---
> arch/riscv/include/asm/kvm_aia.h | 2 +
> arch/riscv/kvm/aia_device.c | 67 +++++++++++++++++++++-----------
> 2 files changed, 47 insertions(+), 22 deletions(-)
>
> diff --git a/arch/riscv/include/asm/kvm_aia.h b/arch/riscv/include/asm/kvm_aia.h
> index c67ec5ac0..71240b0a2 100644
> --- a/arch/riscv/include/asm/kvm_aia.h
> +++ b/arch/riscv/include/asm/kvm_aia.h
> @@ -47,6 +47,8 @@ struct kvm_aia {
>
> /* Internal state of APLIC */
> void *aplic_state;
> +
> + struct kvm_vcpu **hart_to_vcpu;
> };
>
> struct kvm_vcpu_aia_csr {
> diff --git a/arch/riscv/kvm/aia_device.c b/arch/riscv/kvm/aia_device.c
> index be83c2d5f..595553817 100644
> --- a/arch/riscv/kvm/aia_device.c
> +++ b/arch/riscv/kvm/aia_device.c
> @@ -253,6 +253,14 @@ static int aia_init(struct kvm *kvm)
> if (ret)
> return ret;
>
> + aia->hart_to_vcpu = kcalloc(kvm->created_vcpus,
> + sizeof(struct kvm_vcpu*),
> + GFP_KERNEL);
> + if (!aia->hart_to_vcpu) {
> + ret = -ENOMEM;
> + goto fail_cleanup_aplic;
> + }
> +
> /* Iterate over each VCPU */
> kvm_for_each_vcpu(idx, vcpu, kvm) {
> vaia = &vcpu->arch.aia_context;
> @@ -274,6 +282,12 @@ static int aia_init(struct kvm *kvm)
> /* Update HART index of the IMSIC based on IMSIC base */
> vaia->hart_index = aia_imsic_hart_index(aia,
> vaia->imsic_addr);
> +
> + if (aia->hart_to_vcpu[vaia->hart_index]) {
> + ret = -EINVAL;
> + goto fail_cleanup_imsics;
> + }
> + aia->hart_to_vcpu[vaia->hart_index] = vcpu;
>
> /* Initialize IMSIC for this VCPU */
> ret = kvm_riscv_vcpu_aia_imsic_init(vcpu);
> @@ -293,6 +307,9 @@ static int aia_init(struct kvm *kvm)
> continue;
> kvm_riscv_vcpu_aia_imsic_cleanup(vcpu);
> }
> + kfree(aia->hart_to_vcpu);
> + aia->hart_to_vcpu = NULL;
> +fail_cleanup_aplic:
> kvm_riscv_aia_aplic_cleanup(kvm);
> return ret;
> }
> @@ -551,30 +568,28 @@ void kvm_riscv_vcpu_aia_deinit(struct kvm_vcpu *vcpu)
> int kvm_riscv_aia_inject_msi_by_id(struct kvm *kvm, u32 hart_index,
> u32 guest_index, u32 iid)
> {
> - unsigned long idx;
> struct kvm_vcpu *vcpu;
> + struct kvm_aia *aia = &kvm->arch.aia;
>
> /* Proceed only if AIA was initialized successfully */
> if (!kvm_riscv_aia_initialized(kvm))
> return -EBUSY;
>
> - /* Inject MSI to matching VCPU */
> - kvm_for_each_vcpu(idx, vcpu, kvm) {
> - if (vcpu->arch.aia_context.hart_index == hart_index)
> - return kvm_riscv_vcpu_aia_imsic_inject(vcpu,
> - guest_index,
> - 0, iid);
> - }
> + if (!aia->hart_to_vcpu || hart_index >= kvm->created_vcpus)
> + return 0;
>
> - return 0;
> + vcpu = aia->hart_to_vcpu[hart_index];
> + if (!vcpu)
> + return 0;
> +
> + return kvm_riscv_vcpu_aia_imsic_inject(vcpu, guest_index, 0, iid);
> }
>
> int kvm_riscv_aia_inject_msi(struct kvm *kvm, struct kvm_msi *msi)
> {
> gpa_t tppn, ippn;
> - unsigned long idx;
> struct kvm_vcpu *vcpu;
> - u32 g, toff, iid = msi->data;
> + u32 g, toff, iid = msi->data, hart_index;
> struct kvm_aia *aia = &kvm->arch.aia;
> gpa_t target = (((gpa_t)msi->address_hi) << 32) | msi->address_lo;
>
> @@ -589,18 +604,22 @@ int kvm_riscv_aia_inject_msi(struct kvm *kvm, struct kvm_msi *msi)
> g = tppn & (BIT(aia->nr_guest_bits) - 1);
> tppn &= ~((gpa_t)(BIT(aia->nr_guest_bits) - 1));
>
> - /* Inject MSI to matching VCPU */
> - kvm_for_each_vcpu(idx, vcpu, kvm) {
> - ippn = vcpu->arch.aia_context.imsic_addr >>
> - IMSIC_MMIO_PAGE_SHIFT;
> - if (ippn == tppn) {
> - toff = target & (IMSIC_MMIO_PAGE_SZ - 1);
> - return kvm_riscv_vcpu_aia_imsic_inject(vcpu, g,
> - toff, iid);
> - }
> - }
> + if (!aia->hart_to_vcpu)
> + return 0;
>
> - return 0;
> + hart_index = aia_imsic_hart_index(aia, target);
> + if(hart_index >= kvm->created_vcpus)
> + return 0;
> +
> + vcpu = aia->hart_to_vcpu[hart_index];
> + if (!vcpu)
> + return 0;
> +
> + ippn = vcpu->arch.aia_context.imsic_addr >> IMSIC_MMIO_PAGE_SHIFT;
> + if (ippn != tppn)
> + return 0;
> + toff = target & (IMSIC_MMIO_PAGE_SZ - 1);
> + return kvm_riscv_vcpu_aia_imsic_inject(vcpu, g, toff, iid);
> }
>
> int kvm_riscv_aia_inject_irq(struct kvm *kvm, unsigned int irq, bool level)
> @@ -641,10 +660,14 @@ void kvm_riscv_aia_init_vm(struct kvm *kvm)
>
> void kvm_riscv_aia_destroy_vm(struct kvm *kvm)
> {
> + struct kvm_aia *aia = &kvm->arch.aia;
> /* Proceed only if AIA was initialized successfully */
> if (!kvm_riscv_aia_initialized(kvm))
> return;
>
> + kfree(aia->hart_to_vcpu);
> + aia->hart_to_vcpu = NULL;
> +
> /* Cleanup APLIC context */
> kvm_riscv_aia_aplic_cleanup(kvm);
> }
> --
> 2.53.0
^ permalink raw reply [flat|nested] 4+ messages in thread
* Re: [PATCH] riscv: KVM: Add hart-to-vCPU mapping for faster MSI injection
2026-10-02 6:53 ` Anup Patel
@ 2026-10-08 6:41 ` BillXiang
0 siblings, 0 replies; 4+ messages in thread
From: BillXiang @ 2026-10-08 6:41 UTC (permalink / raw)
To: Anup Patel
Cc: atish.patra, pjw, palmer, aou, alex, kvm, kvm-riscv, linux-riscv,
linux-kernel
On 10/2/2026 2:53 PM, Anup Patel wrote:
> On Thu, Jul 30, 2026 at 3:06 PM BillXiang
> <xiangwencheng@lanxincomputing.com> wrote:
>>
>> Replace linear searches over all vCPUs in MSI injection paths with a
>> direct hart_index -> vCPU lookup table. This avoids O(n) scans on
>> every injected interrupt and improves performance when the number of
>> vCPUs is large.
>>
>> Both kvm_riscv_aia_inject_msi_by_id() and kvm_riscv_aia_inject_msi()
>> now use the table instead of iterating over the vCPU list.
>
> The AIA hart_index bits for VCPUs are based on the IMSIC address
> set by the KVM user-space and are not required to be contiguous hence
> this patch is already broken.
Hi Anup,
Thanks for the review. You’re right — hart_index is not guaranteed
contiguous because it comes from the userspace-provided IMSIC address.
Sizing the table by created_vcpus and bounds-checking against it is
therefore wrong.
I'll use an xarray keyed by hart_index instead, or drop the optimization
if that’s preferred.
Regards,
Bill
>
> NACK from my side.
>
> Regards,
> Anup
>
>>
>> Signed-off-by: BillXiang <xiangwencheng@lanxincomputing.com>
>> ---
>> arch/riscv/include/asm/kvm_aia.h | 2 +
>> arch/riscv/kvm/aia_device.c | 67 +++++++++++++++++++++-----------
>> 2 files changed, 47 insertions(+), 22 deletions(-)
>>
>> diff --git a/arch/riscv/include/asm/kvm_aia.h b/arch/riscv/include/asm/kvm_aia.h
>> index c67ec5ac0..71240b0a2 100644
>> --- a/arch/riscv/include/asm/kvm_aia.h
>> +++ b/arch/riscv/include/asm/kvm_aia.h
>> @@ -47,6 +47,8 @@ struct kvm_aia {
>>
>> /* Internal state of APLIC */
>> void *aplic_state;
>> +
>> + struct kvm_vcpu **hart_to_vcpu;
>> };
>>
>> struct kvm_vcpu_aia_csr {
>> diff --git a/arch/riscv/kvm/aia_device.c b/arch/riscv/kvm/aia_device.c
>> index be83c2d5f..595553817 100644
>> --- a/arch/riscv/kvm/aia_device.c
>> +++ b/arch/riscv/kvm/aia_device.c
>> @@ -253,6 +253,14 @@ static int aia_init(struct kvm *kvm)
>> if (ret)
>> return ret;
>>
>> + aia->hart_to_vcpu = kcalloc(kvm->created_vcpus,
>> + sizeof(struct kvm_vcpu*),
>> + GFP_KERNEL);
>> + if (!aia->hart_to_vcpu) {
>> + ret = -ENOMEM;
>> + goto fail_cleanup_aplic;
>> + }
>> +
>> /* Iterate over each VCPU */
>> kvm_for_each_vcpu(idx, vcpu, kvm) {
>> vaia = &vcpu->arch.aia_context;
>> @@ -274,6 +282,12 @@ static int aia_init(struct kvm *kvm)
>> /* Update HART index of the IMSIC based on IMSIC base */
>> vaia->hart_index = aia_imsic_hart_index(aia,
>> vaia->imsic_addr);
>> +
>> + if (aia->hart_to_vcpu[vaia->hart_index]) {
>> + ret = -EINVAL;
>> + goto fail_cleanup_imsics;
>> + }
>> + aia->hart_to_vcpu[vaia->hart_index] = vcpu;
>>
>> /* Initialize IMSIC for this VCPU */
>> ret = kvm_riscv_vcpu_aia_imsic_init(vcpu);
>> @@ -293,6 +307,9 @@ static int aia_init(struct kvm *kvm)
>> continue;
>> kvm_riscv_vcpu_aia_imsic_cleanup(vcpu);
>> }
>> + kfree(aia->hart_to_vcpu);
>> + aia->hart_to_vcpu = NULL;
>> +fail_cleanup_aplic:
>> kvm_riscv_aia_aplic_cleanup(kvm);
>> return ret;
>> }
>> @@ -551,30 +568,28 @@ void kvm_riscv_vcpu_aia_deinit(struct kvm_vcpu *vcpu)
>> int kvm_riscv_aia_inject_msi_by_id(struct kvm *kvm, u32 hart_index,
>> u32 guest_index, u32 iid)
>> {
>> - unsigned long idx;
>> struct kvm_vcpu *vcpu;
>> + struct kvm_aia *aia = &kvm->arch.aia;
>>
>> /* Proceed only if AIA was initialized successfully */
>> if (!kvm_riscv_aia_initialized(kvm))
>> return -EBUSY;
>>
>> - /* Inject MSI to matching VCPU */
>> - kvm_for_each_vcpu(idx, vcpu, kvm) {
>> - if (vcpu->arch.aia_context.hart_index == hart_index)
>> - return kvm_riscv_vcpu_aia_imsic_inject(vcpu,
>> - guest_index,
>> - 0, iid);
>> - }
>> + if (!aia->hart_to_vcpu || hart_index >= kvm->created_vcpus)
>> + return 0;
>>
>> - return 0;
>> + vcpu = aia->hart_to_vcpu[hart_index];
>> + if (!vcpu)
>> + return 0;
>> +
>> + return kvm_riscv_vcpu_aia_imsic_inject(vcpu, guest_index, 0, iid);
>> }
>>
>> int kvm_riscv_aia_inject_msi(struct kvm *kvm, struct kvm_msi *msi)
>> {
>> gpa_t tppn, ippn;
>> - unsigned long idx;
>> struct kvm_vcpu *vcpu;
>> - u32 g, toff, iid = msi->data;
>> + u32 g, toff, iid = msi->data, hart_index;
>> struct kvm_aia *aia = &kvm->arch.aia;
>> gpa_t target = (((gpa_t)msi->address_hi) << 32) | msi->address_lo;
>>
>> @@ -589,18 +604,22 @@ int kvm_riscv_aia_inject_msi(struct kvm *kvm, struct kvm_msi *msi)
>> g = tppn & (BIT(aia->nr_guest_bits) - 1);
>> tppn &= ~((gpa_t)(BIT(aia->nr_guest_bits) - 1));
>>
>> - /* Inject MSI to matching VCPU */
>> - kvm_for_each_vcpu(idx, vcpu, kvm) {
>> - ippn = vcpu->arch.aia_context.imsic_addr >>
>> - IMSIC_MMIO_PAGE_SHIFT;
>> - if (ippn == tppn) {
>> - toff = target & (IMSIC_MMIO_PAGE_SZ - 1);
>> - return kvm_riscv_vcpu_aia_imsic_inject(vcpu, g,
>> - toff, iid);
>> - }
>> - }
>> + if (!aia->hart_to_vcpu)
>> + return 0;
>>
>> - return 0;
>> + hart_index = aia_imsic_hart_index(aia, target);
>> + if(hart_index >= kvm->created_vcpus)
>> + return 0;
>> +
>> + vcpu = aia->hart_to_vcpu[hart_index];
>> + if (!vcpu)
>> + return 0;
>> +
>> + ippn = vcpu->arch.aia_context.imsic_addr >> IMSIC_MMIO_PAGE_SHIFT;
>> + if (ippn != tppn)
>> + return 0;
>> + toff = target & (IMSIC_MMIO_PAGE_SZ - 1);
>> + return kvm_riscv_vcpu_aia_imsic_inject(vcpu, g, toff, iid);
>> }
>>
>> int kvm_riscv_aia_inject_irq(struct kvm *kvm, unsigned int irq, bool level)
>> @@ -641,10 +660,14 @@ void kvm_riscv_aia_init_vm(struct kvm *kvm)
>>
>> void kvm_riscv_aia_destroy_vm(struct kvm *kvm)
>> {
>> + struct kvm_aia *aia = &kvm->arch.aia;
>> /* Proceed only if AIA was initialized successfully */
>> if (!kvm_riscv_aia_initialized(kvm))
>> return;
>>
>> + kfree(aia->hart_to_vcpu);
>> + aia->hart_to_vcpu = NULL;
>> +
>> /* Cleanup APLIC context */
>> kvm_riscv_aia_aplic_cleanup(kvm);
>> }
>> --
>> 2.53.0
^ permalink raw reply [flat|nested] 4+ messages in thread
end of thread, other threads:[~2026-10-08 6:43 UTC | newest]
Thread overview: 4+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2026-07-30 9:36 [PATCH] riscv: KVM: Add hart-to-vCPU mapping for faster MSI injection BillXiang
2026-07-30 9:56 ` sashiko-bot
2026-10-02 6:53 ` Anup Patel
2026-10-08 6:41 ` BillXiang
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox