[PATCH v2 0/4] KVM: arm64: GICv5 KVM IRS review fixes

[PATCH v2 0/4] KVM: arm64: GICv5 KVM IRS review fixes

[Sascha Bischoff]

Hi all,

v1 [1] combined irqchip and KVM fixes identified by Sashiko [2] while
reviewing the GICv5 KVM IRS series [3]. Following feedback, v2 splits
the fixes into separate irqchip and KVM postings. This posting
contains the KVM fixes; the irqchip fixes are posted separately.

Changes since v1:

* Split the combined series into irqchip and KVM postings.

* Extend the out-of-range GICv5 PPI fix to reject unsupported PPIs at
  the type-validation boundary as well as in the lookup path.

* Add a fix to validate a GICv5 timer PPI before claiming its IRQ.

The fixes are:

* Free gic_kvm_info when vGIC initialisation fails because the
  maintenance interrupt is not provided but is required.

* Fix speculative accesses in the common vGIC SPI lookup which could
  previously underflow. The SPI index is now made relative to the SPI
  array before array_index_nospec() constrains it rather than
  afterwards.

* Reject GICv5 PPIs outside KVM's supported private IRQ range. These
  were previously classified as PPIs and clamped to zero, aliasing
  private IRQ 0.

* Validate the architecturally fixed GICv5 timer PPI before claiming it
  with the vGIC.

These changes are based on v7.2-rc7.

Thanks,
Sascha

[1] https://lore.kernel.org/all/20260810102652.758719-1-sascha.bischoff@arm.com/
[2] https://sashiko.dev/#/patchset/20260724104819.1296803-1-sascha.bischoff%40arm.com
[3] https://lore.kernel.org/all/20260724104819.1296803-1-sascha.bischoff@arm.com/

Sascha Bischoff (4):
  KVM: arm64: vgic: Free gic_kvm_info on initialization failure
  KVM: arm64: vgic: Prevent speculative SPI array underflow
  KVM: arm64: vgic: Reject out-of-range GICv5 PPI IDs
  KVM: arm64: Validate GICv5 timer PPIs before claiming ownership

 arch/arm64/kvm/arch_timer.c     | 5 +++--
 arch/arm64/kvm/vgic/vgic-init.c | 4 +++-
 arch/arm64/kvm/vgic/vgic.c      | 7 +++++--
 include/kvm/arm_vgic.h          | 2 ++
 4 files changed, 13 insertions(+), 5 deletions(-)

-- 
2.34.1

[PATCH v2 1/4] KVM: arm64: vgic: Free gic_kvm_info on initialization failure

[Sascha Bischoff]

vgic_set_kvm_info() allocates gic_kvm_info for use by
kvm_vgic_hyp_init(). When a maintenance interrupt is mandatory but not
provided, kvm_vgic_hyp_init() returns -ENXIO before reaching the
common cleanup path, leaking said allocation.

Route this error through that cleanup path so that gic_kvm_info is
freed and the global pointer is cleared.

Fixes: 0e5cb7770684 ("irqchip/gic: Split vGIC probing information from the GIC code")
Link: https://sashiko.dev/#/patchset/20260724104819.1296803-1-sascha.bischoff@arm.com?part=1
Signed-off-by: Sascha Bischoff <sascha.bischoff@arm.com>
---
 arch/arm64/kvm/vgic/vgic-init.c | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/arch/arm64/kvm/vgic/vgic-init.c b/arch/arm64/kvm/vgic/vgic-init.c
index 907057881b26a..65e203d6a2cf4 100644
--- a/arch/arm64/kvm/vgic/vgic-init.c
+++ b/arch/arm64/kvm/vgic/vgic-init.c
@@ -787,7 +787,8 @@ int kvm_vgic_hyp_init(void)
 
 	if (has_mask && !gic_kvm_info->maint_irq) {
 		kvm_err("No vgic maintenance irq\n");
-		return -ENXIO;
+		ret = -ENXIO;
+		goto out_free;
 	}
 
 	/*
@@ -820,6 +821,7 @@ int kvm_vgic_hyp_init(void)
 
 	kvm_vgic_global_state.maint_irq = gic_kvm_info->maint_irq;
 
+out_free:
 	kfree(gic_kvm_info);
 	gic_kvm_info = NULL;
 
-- 
2.34.1

Re: [PATCH v2 1/4] KVM: arm64: vgic: Free gic_kvm_info on initialization failure

[Joey Gouly]

On Tue, Aug 11, 2026 at 03:10:17PM +0000, Sascha Bischoff wrote:
> vgic_set_kvm_info() allocates gic_kvm_info for use by
> kvm_vgic_hyp_init(). When a maintenance interrupt is mandatory but not
> provided, kvm_vgic_hyp_init() returns -ENXIO before reaching the
> common cleanup path, leaking said allocation.
> 
> Route this error through that cleanup path so that gic_kvm_info is
> freed and the global pointer is cleared.
> 
> Fixes: 0e5cb7770684 ("irqchip/gic: Split vGIC probing information from the GIC code")
> Link: https://sashiko.dev/#/patchset/20260724104819.1296803-1-sascha.bischoff@arm.com?part=1
> Signed-off-by: Sascha Bischoff <sascha.bischoff@arm.com>
> ---
>  arch/arm64/kvm/vgic/vgic-init.c | 4 +++-
>  1 file changed, 3 insertions(+), 1 deletion(-)
> 
> diff --git a/arch/arm64/kvm/vgic/vgic-init.c b/arch/arm64/kvm/vgic/vgic-init.c
> index 907057881b26a..65e203d6a2cf4 100644
> --- a/arch/arm64/kvm/vgic/vgic-init.c
> +++ b/arch/arm64/kvm/vgic/vgic-init.c
> @@ -787,7 +787,8 @@ int kvm_vgic_hyp_init(void)
>  
>  	if (has_mask && !gic_kvm_info->maint_irq) {
>  		kvm_err("No vgic maintenance irq\n");
> -		return -ENXIO;
> +		ret = -ENXIO;
> +		goto out_free;
>  	}
>  
>  	/*
> @@ -820,6 +821,7 @@ int kvm_vgic_hyp_init(void)
>  
>  	kvm_vgic_global_state.maint_irq = gic_kvm_info->maint_irq;
>  
> +out_free:
>  	kfree(gic_kvm_info);
>  	gic_kvm_info = NULL;
>  

Reviewed-by: Joey Gouly <joey.gouly@arm.com>

[PATCH v2 2/4] KVM: arm64: vgic: Prevent speculative SPI array underflow

[Sascha Bischoff]

For a non-GICv5 VM, SPI interrupt IDs include the private-interrupt
offset, while KVM's SPI array is indexed from zero. The lookup applies
array_index_nospec() to the absolute interrupt ID and subtracts the
private-interrupt offset afterwards.

On a speculative bypass of the range check for an interrupt ID below
the private range, the clamp preserves the small absolute value and
the subtraction underflows to an out-of-bounds SPI array index.

Convert the interrupt ID to a zero-based index into the SPI array
before applying array_index_nospec(). This way, we ensure that we
clamp to a reachable SPI ID, rather than an out-of-range SPI index.

Fixes: 41b87599c743 ("KVM: arm/arm64: vgic: fix possible spectre-v1 in vgic_get_irq()")
Link: https://sashiko.dev/#/patchset/20260724104819.1296803-1-sascha.bischoff@arm.com?part=27
Signed-off-by: Sascha Bischoff <sascha.bischoff@arm.com>
---
 arch/arm64/kvm/vgic/vgic.c | 5 +++--
 1 file changed, 3 insertions(+), 2 deletions(-)

diff --git a/arch/arm64/kvm/vgic/vgic.c b/arch/arm64/kvm/vgic/vgic.c
index 74bace10a22ed..352d52bd6315c 100644
--- a/arch/arm64/kvm/vgic/vgic.c
+++ b/arch/arm64/kvm/vgic/vgic.c
@@ -93,8 +93,9 @@ struct vgic_irq *vgic_get_irq(struct kvm *kvm, u32 intid)
 	/* SPIs */
 	if (intid >= VGIC_NR_PRIVATE_IRQS &&
 	    intid < (kvm->arch.vgic.nr_spis + VGIC_NR_PRIVATE_IRQS)) {
-		intid = array_index_nospec(intid, kvm->arch.vgic.nr_spis + VGIC_NR_PRIVATE_IRQS);
-		return &kvm->arch.vgic.spis[intid - VGIC_NR_PRIVATE_IRQS];
+		intid -= VGIC_NR_PRIVATE_IRQS;
+		intid = array_index_nospec(intid, kvm->arch.vgic.nr_spis);
+		return &kvm->arch.vgic.spis[intid];
 	}
 
 	/* LPIs */
-- 
2.34.1

Re: [PATCH v2 2/4] KVM: arm64: vgic: Prevent speculative SPI array underflow

[Joey Gouly]

On Tue, Aug 11, 2026 at 03:10:47PM +0000, Sascha Bischoff wrote:
> For a non-GICv5 VM, SPI interrupt IDs include the private-interrupt
> offset, while KVM's SPI array is indexed from zero. The lookup applies
> array_index_nospec() to the absolute interrupt ID and subtracts the
> private-interrupt offset afterwards.
> 
> On a speculative bypass of the range check for an interrupt ID below
> the private range, the clamp preserves the small absolute value and
> the subtraction underflows to an out-of-bounds SPI array index.
> 
> Convert the interrupt ID to a zero-based index into the SPI array
> before applying array_index_nospec(). This way, we ensure that we
> clamp to a reachable SPI ID, rather than an out-of-range SPI index.
> 
> Fixes: 41b87599c743 ("KVM: arm/arm64: vgic: fix possible spectre-v1 in vgic_get_irq()")
> Link: https://sashiko.dev/#/patchset/20260724104819.1296803-1-sascha.bischoff@arm.com?part=27
> Signed-off-by: Sascha Bischoff <sascha.bischoff@arm.com>
> ---
>  arch/arm64/kvm/vgic/vgic.c | 5 +++--
>  1 file changed, 3 insertions(+), 2 deletions(-)
> 
> diff --git a/arch/arm64/kvm/vgic/vgic.c b/arch/arm64/kvm/vgic/vgic.c
> index 74bace10a22ed..352d52bd6315c 100644
> --- a/arch/arm64/kvm/vgic/vgic.c
> +++ b/arch/arm64/kvm/vgic/vgic.c
> @@ -93,8 +93,9 @@ struct vgic_irq *vgic_get_irq(struct kvm *kvm, u32 intid)
>  	/* SPIs */
>  	if (intid >= VGIC_NR_PRIVATE_IRQS &&
>  	    intid < (kvm->arch.vgic.nr_spis + VGIC_NR_PRIVATE_IRQS)) {
> -		intid = array_index_nospec(intid, kvm->arch.vgic.nr_spis + VGIC_NR_PRIVATE_IRQS);
> -		return &kvm->arch.vgic.spis[intid - VGIC_NR_PRIVATE_IRQS];
> +		intid -= VGIC_NR_PRIVATE_IRQS;
> +		intid = array_index_nospec(intid, kvm->arch.vgic.nr_spis);
> +		return &kvm->arch.vgic.spis[intid];
>  	}
>  
>  	/* LPIs */

Reviewed-by: Joey Gouly <joey.gouly@arm.com>

[PATCH v2 3/4] KVM: arm64: vgic: Reject out-of-range GICv5 PPI IDs

[Sascha Bischoff]

GICv5 supports up to 128 PPIs, but KVM currently implements only the
first 64, which contain the architected PPIs it supports.

An encoded PPI with an ID outside that range passes irq_is_ppi(),
which only checks the encoded interrupt type. vgic_get_vcpu_irq()
therefore looks it up in private_irqs[], where array_index_nospec()
clamps the out-of-range index to zero and aliases PPI 0.

Include the supported PPI range in irq_is_ppi() so that KVM interfaces
reject unsupported PPIs. Also reject an out-of-range PPI in the lookup
as a safeguard against callers bypassing the predicate.

Fixes: 4d591252bacb ("KVM: arm64: gic-v5: Implement PPI interrupt injection")
Fixes: eb8bce08ecb1 ("KVM: arm64: gic: Introduce interrupt type helpers")
Link: https://sashiko.dev/#/patchset/20260724104819.1296803-1-sascha.bischoff@arm.com?part=27
Signed-off-by: Sascha Bischoff <sascha.bischoff@arm.com>
---
 arch/arm64/kvm/vgic/vgic.c | 2 ++
 include/kvm/arm_vgic.h     | 2 ++
 2 files changed, 4 insertions(+)

diff --git a/arch/arm64/kvm/vgic/vgic.c b/arch/arm64/kvm/vgic/vgic.c
index 352d52bd6315c..b25303d9919fd 100644
--- a/arch/arm64/kvm/vgic/vgic.c
+++ b/arch/arm64/kvm/vgic/vgic.c
@@ -118,6 +118,8 @@ struct vgic_irq *vgic_get_vcpu_irq(struct kvm_vcpu *vcpu, u32 intid)
 		switch (type) {
 		case KVM_DEV_TYPE_ARM_VGIC_V5:
 			intid = vgic_v5_get_hwirq_id(intid);
+			if (intid >= VGIC_V5_NR_PRIVATE_IRQS)
+				return NULL;
 			intid = array_index_nospec(intid, VGIC_V5_NR_PRIVATE_IRQS);
 			break;
 		default:
diff --git a/include/kvm/arm_vgic.h b/include/kvm/arm_vgic.h
index cefddc9c621de..1a549cceecbec 100644
--- a/include/kvm/arm_vgic.h
+++ b/include/kvm/arm_vgic.h
@@ -65,6 +65,8 @@
 		switch (t) {						\
 		case KVM_DEV_TYPE_ARM_VGIC_V5:				\
 			__ret = is_v5_type(GICV5_HWIRQ_TYPE_PPI, (i));	\
+			__ret &= FIELD_GET(GICV5_HWIRQ_ID, (i)) <	\
+				 VGIC_V5_NR_PRIVATE_IRQS;		\
 			break;						\
 		default:						\
 			__ret  = (i) >= VGIC_NR_SGIS;			\
-- 
2.34.1

Re: [PATCH v2 3/4] KVM: arm64: vgic: Reject out-of-range GICv5 PPI IDs

[Joey Gouly]

On Tue, Aug 11, 2026 at 03:11:18PM +0000, Sascha Bischoff wrote:
> GICv5 supports up to 128 PPIs, but KVM currently implements only the
> first 64, which contain the architected PPIs it supports.
> 
> An encoded PPI with an ID outside that range passes irq_is_ppi(),
> which only checks the encoded interrupt type. vgic_get_vcpu_irq()
> therefore looks it up in private_irqs[], where array_index_nospec()
> clamps the out-of-range index to zero and aliases PPI 0.
> 
> Include the supported PPI range in irq_is_ppi() so that KVM interfaces
> reject unsupported PPIs. Also reject an out-of-range PPI in the lookup
> as a safeguard against callers bypassing the predicate.
> 
> Fixes: 4d591252bacb ("KVM: arm64: gic-v5: Implement PPI interrupt injection")
> Fixes: eb8bce08ecb1 ("KVM: arm64: gic: Introduce interrupt type helpers")
> Link: https://sashiko.dev/#/patchset/20260724104819.1296803-1-sascha.bischoff@arm.com?part=27
> Signed-off-by: Sascha Bischoff <sascha.bischoff@arm.com>
> ---
>  arch/arm64/kvm/vgic/vgic.c | 2 ++
>  include/kvm/arm_vgic.h     | 2 ++
>  2 files changed, 4 insertions(+)
> 
> diff --git a/arch/arm64/kvm/vgic/vgic.c b/arch/arm64/kvm/vgic/vgic.c
> index 352d52bd6315c..b25303d9919fd 100644
> --- a/arch/arm64/kvm/vgic/vgic.c
> +++ b/arch/arm64/kvm/vgic/vgic.c
> @@ -118,6 +118,8 @@ struct vgic_irq *vgic_get_vcpu_irq(struct kvm_vcpu *vcpu, u32 intid)
>  		switch (type) {
>  		case KVM_DEV_TYPE_ARM_VGIC_V5:
>  			intid = vgic_v5_get_hwirq_id(intid);
> +			if (intid >= VGIC_V5_NR_PRIVATE_IRQS)
> +				return NULL;
>  			intid = array_index_nospec(intid, VGIC_V5_NR_PRIVATE_IRQS);
>  			break;
>  		default:
> diff --git a/include/kvm/arm_vgic.h b/include/kvm/arm_vgic.h
> index cefddc9c621de..1a549cceecbec 100644
> --- a/include/kvm/arm_vgic.h
> +++ b/include/kvm/arm_vgic.h
> @@ -65,6 +65,8 @@
>  		switch (t) {						\
>  		case KVM_DEV_TYPE_ARM_VGIC_V5:				\
>  			__ret = is_v5_type(GICV5_HWIRQ_TYPE_PPI, (i));	\
> +			__ret &= FIELD_GET(GICV5_HWIRQ_ID, (i)) <	\
> +				 VGIC_V5_NR_PRIVATE_IRQS;		\
>  			break;						\
>  		default:						\
>  			__ret  = (i) >= VGIC_NR_SGIS;			\

Reviewed-by: Joey Gouly <joey.gouly@arm.com>

[PATCH v2 4/4] KVM: arm64: Validate GICv5 timer PPIs before claiming ownership

[Sascha Bischoff]

With GICv5, timer PPIs use architecturally defined IDs, and therefore
we require userspace to use the architected IDs too. We perform this
validation in timer_irqs_are_valid(), which validates the configured
PPI after claiming it with kvm_vgic_set_owner(). This is obviously the
wrong order, and could both result in a NULL pointer dereference for
an ID >= 64 and in an incorrect ownership claim.

Switch the order to first validate the PPI before setting the
owner. This both prevents an invalid GICv5 timer PPI from reaching the
IRQ lookup, and avoids claiming an IRQ for a timer configuration that
will be rejected.

Fixes: 06c85b58e0b1 ("KVM: arm64: Move GICv5 timer PPI validation into timer_irqs_are_valid()")
Link: https://sashiko.dev/#/message/20260810111614.DDC731F000E9%40smtp.kernel.org
Signed-off-by: Sascha Bischoff <sascha.bischoff@arm.com>
---
 arch/arm64/kvm/arch_timer.c | 5 +++--
 1 file changed, 3 insertions(+), 2 deletions(-)

diff --git a/arch/arm64/kvm/arch_timer.c b/arch/arm64/kvm/arch_timer.c
index 4155fe89b58a1..af7e2894cd690 100644
--- a/arch/arm64/kvm/arch_timer.c
+++ b/arch/arm64/kvm/arch_timer.c
@@ -1529,13 +1529,14 @@ static bool timer_irqs_are_valid(struct kvm_vcpu *vcpu)
 
 		ctx = vcpu_get_timer(vcpu, i);
 		irq = timer_irq(ctx);
-		if (kvm_vgic_set_owner(vcpu, irq, ctx))
-			break;
 
 		/* With GICv5, the default PPI is what you get -- nothing else */
 		if (vgic_is_v5(vcpu->kvm) && irq != get_vgic_ppi(vcpu->kvm, default_ppi[i]))
 			break;
 
+		if (kvm_vgic_set_owner(vcpu, irq, ctx))
+			break;
+
 		/*
 		 * We know by construction that we only have PPIs, so all values
 		 * are less than 32 for non-GICv5 VGICs. On GICv5, they are
-- 
2.34.1

Re: [PATCH v2 4/4] KVM: arm64: Validate GICv5 timer PPIs before claiming ownership

[Joey Gouly]

On Tue, Aug 11, 2026 at 03:11:48PM +0000, Sascha Bischoff wrote:
> With GICv5, timer PPIs use architecturally defined IDs, and therefore
> we require userspace to use the architected IDs too. We perform this
> validation in timer_irqs_are_valid(), which validates the configured
> PPI after claiming it with kvm_vgic_set_owner(). This is obviously the
> wrong order, and could both result in a NULL pointer dereference for
> an ID >= 64 and in an incorrect ownership claim.
> 
> Switch the order to first validate the PPI before setting the
> owner. This both prevents an invalid GICv5 timer PPI from reaching the
> IRQ lookup, and avoids claiming an IRQ for a timer configuration that
> will be rejected.
> 
> Fixes: 06c85b58e0b1 ("KVM: arm64: Move GICv5 timer PPI validation into timer_irqs_are_valid()")
> Link: https://sashiko.dev/#/message/20260810111614.DDC731F000E9%40smtp.kernel.org
> Signed-off-by: Sascha Bischoff <sascha.bischoff@arm.com>
> ---
>  arch/arm64/kvm/arch_timer.c | 5 +++--
>  1 file changed, 3 insertions(+), 2 deletions(-)
> 
> diff --git a/arch/arm64/kvm/arch_timer.c b/arch/arm64/kvm/arch_timer.c
> index 4155fe89b58a1..af7e2894cd690 100644
> --- a/arch/arm64/kvm/arch_timer.c
> +++ b/arch/arm64/kvm/arch_timer.c
> @@ -1529,13 +1529,14 @@ static bool timer_irqs_are_valid(struct kvm_vcpu *vcpu)
>  
>  		ctx = vcpu_get_timer(vcpu, i);
>  		irq = timer_irq(ctx);
> -		if (kvm_vgic_set_owner(vcpu, irq, ctx))
> -			break;
>  
>  		/* With GICv5, the default PPI is what you get -- nothing else */
>  		if (vgic_is_v5(vcpu->kvm) && irq != get_vgic_ppi(vcpu->kvm, default_ppi[i]))
>  			break;
>  
> +		if (kvm_vgic_set_owner(vcpu, irq, ctx))
> +			break;
> +
>  		/*
>  		 * We know by construction that we only have PPIs, so all values
>  		 * are less than 32 for non-GICv5 VGICs. On GICv5, they are

Reviewed-by: Joey Gouly <joey.gouly@arm.com>