Re: [PATCH v4 3/6] KVM: arm64: vgic-v3: Allow access to GICD_IIDR prior to initialization

[Oliver Upton <oliver.upton@linux.dev>]

On Thu, Aug 21, 2025 at 06:55:13PM +0800, Zhou Wang wrote:
> On 2025/7/10 5:14, Oliver Upton wrote:
> > KVM allows userspace to write GICD_IIDR for backwards-compatibility with
> > older kernels, where new implementation revisions have new features.
> > Unfortunately this is allowed to happen at runtime, and ripping features
> > out from underneath a running guest is a terrible idea.
> > 
> > While we can't do anything about the ABI, prepare for more ID-like
> > registers by allowing access to GICD_IIDR prior to VGIC initialization.
> > Subsequent changes will allow the VMM to further provision the GIC
> > feature set, e.g. the presence of nASSGIcap.
> > 
> > Signed-off-by: Oliver Upton <oliver.upton@linux.dev>
> > ---
> >  arch/arm64/kvm/vgic/vgic-init.c       |  9 +--------
> >  arch/arm64/kvm/vgic/vgic-kvm-device.c | 20 +++++++++++++++++++-
> >  2 files changed, 20 insertions(+), 9 deletions(-)
> > 
> [...]
> >  /*
> >   * vgic_v3_attr_regs_access - allows user space to access VGIC v3 state
> >   *
> > @@ -552,7 +570,7 @@ static int vgic_v3_attr_regs_access(struct kvm_device *dev,
> >  
> >  	mutex_lock(&dev->kvm->arch.config_lock);
> >  
> > -	if (!vgic_initialized(dev->kvm)) {
> > +	if (!(vgic_initialized(dev->kvm) || reg_allowed_pre_init(attr))) {
> 
> I am confused here, the logic is that:
> 
> 1. For the ID registers, they can not be modified after vGIC init.
> 2. For other registers, the original logic is that they should be modified after
>    vGIC init.
> 
> So code here should be:
> 
> if ((reg_allowed_pre_init(attr) && vgic_initialized(dev->kvm)) ||
>     !vgic_initialized(dev->kvm)) {
>          ret = -EBUSY;
>          goto out;
> }
> 
> Not sure my understanding is right.

This would break ABI which I tried to allude to in the changelog.
GICD_IIDR is _already_ writable post-init, meaning that the only option
we have is to relax that register and allow access pre- and post-init.

The preferred semantics around ID registers is that they're RW prior to
init and RO post-init. GICD_TYPER2 enforces this.

Thanks,
Oliver