[PATCH v2 0/2] KVM: arm64: vgic-its: Fix LPI double mapping and DISCARD

[Fuad Tabba <fuad.tabba@linux.dev>]

Hi folks,

Changes since v1 [1]:
  - Dropped the second mapping of an LPI at MAPTI, instead of keeping a
    doubly mapped LPI out of GICv4 forwarding. (Marc)
  - Keyed that check on whether an ITE maps the LPI, not on whether its
    vgic_irq exists.
  - Added a patch that makes DISCARD remove the pending state. (Marc)

Two fixes to the ITS emulation. The first stops a guest from mapping
one LPI from two events, which can oops a GICv4 host when the VMM then
routes an assigned device's MSI to the second event. The second makes
DISCARD remove the LPI's pending state, as the spec requires.

Tested on QEMU, which emulates a GICv4 ITS. A local reproducer with two
vCPUs DISCARDs an LPI that's pending in the other vCPU's list register.
On rc3, and with patch 2 but without its halt, the guest still takes
the LPI. With the series applied, it doesn't.

Based on Linux 7.3-rc3 (fd73f4a665989).

Cheers,
/fuad

[1] https://lore.kernel.org/all/20261012084743.2228612-1-fuad.tabba@linux.dev/

Fuad Tabba (2):
  KVM: arm64: vgic-its: Don't map an LPI from more than one event
  KVM: arm64: vgic-its: Remove the pending state of a discarded LPI

 arch/arm64/kvm/vgic/vgic-its.c | 50 +++++++++++++++++++++++++++++-----
 include/kvm/arm_vgic.h         |  1 +
 2 files changed, 44 insertions(+), 7 deletions(-)


base-commit: fd73f4a6659897191fa0d40695fe370925dd3780
-- 
2.39.5