Re: [PATCH v4 29/48] KVM: arm64: gic-v5: Add GICv5 SPI injection to irqfd

On Fri, 2026-07-24 at 12:19 +0000, [email protected] wrote:
> Thank you for your contribution! Sashiko AI review found 1 potential
> issue(s) to consider:
> 
> Pre-existing issues:
> - [High] GICv5 VMs configured with more than 988 SPIs will
> unconditionally fail to initialize because the default IRQ routing
> setup generates routing entries that exceed KVM_IRQCHIP_NUM_PINS.
> --
> 
> --- Patch [29]: [PATCH v4 29/48] KVM: arm64: gic-v5: Add GICv5 SPI
> injection to irqfd ---
> commit a9da966fc7b449adaa92917185e2770d6d012f6f
> Author: Sascha Bischoff <[email protected]>
> 
> KVM: arm64: gic-v5: Add GICv5 SPI injection to irqfd
>     
> Now that there is support for GICv5 SPIs in KVM, update
> vgic_irqfd_set_irq() to translate irqchip pins into GICv5 SPI IntIDs
> before injecting them.
> 
> > diff --git a/arch/arm64/kvm/vgic/vgic-irqfd.c
> > b/arch/arm64/kvm/vgic/vgic-irqfd.c
> > index 19a1094536e6a..83e84151d7aa2 100644
> > --- a/arch/arm64/kvm/vgic/vgic-irqfd.c
> > +++ b/arch/arm64/kvm/vgic/vgic-irqfd.c
> 
> [ ... ]
> 
> > @@ -52,8 +57,8 @@ int kvm_set_routing_entry(struct kvm *kvm,
> >  		e->set = vgic_irqfd_set_irq;
> >  		e->irqchip.irqchip = ue->u.irqchip.irqchip;
> >  		e->irqchip.pin = ue->u.irqchip.pin;
> > -		if ((e->irqchip.pin >= KVM_IRQCHIP_NUM_PINS) ||
> > -		    (e->irqchip.irqchip >= KVM_NR_IRQCHIPS))
> > +		if (e->irqchip.pin >= KVM_IRQCHIP_NUM_PINS ||
> > +		    e->irqchip.irqchip >= KVM_NR_IRQCHIPS)
> [Severity: High]
> This isn't a bug introduced by this patch, but does this check cause
> VM
> initialization to fail if a GICv5 VM is configured with more than 988
> SPIs?
> 
> When userspace configures a VM with nr_spis > 988,
> kvm_vgic_setup_default_irq_routing() attempts to set up a 1:1 default
> routing
> for all SPIs:
> 
> arch/arm64/kvm/vgic/vgic-irqfd.c:kvm_vgic_setup_default_irq_routing()
> {
> 	for (i = 0; i < nr; i++) {
> 		entries[i].gsi = i;
> 		entries[i].type = KVM_IRQ_ROUTING_IRQCHIP;
> 		entries[i].u.irqchip.irqchip = 0;
> 		entries[i].u.irqchip.pin = i;
> 	}
> 	ret = kvm_set_irq_routing(kvm, entries, nr, 0);
> 	...
> }
> 
> Because kvm_set_routing_entry() caps e->irqchip.pin at
> KVM_IRQCHIP_NUM_PINS
> (which is 988), any entries beyond 988 will be rejected here with -
> EINVAL,
> causing VM initialization to abort.

I've re-worked this to bump up the limit to 1024 to match the max GICv5
SPIs (picking 988 for GICv5 feels a tad wrong, and we'd waste memory
there as we allocate a whole power of 2 of entries for the IST).

I've added a GIC type check here too, else it becomes possible for
GICv2/3 to set routing entries for SPIs that can never exist (and hence
cause the vgic_irq selftest to fail). Hence, the limit for GICv2/3
remains at 988, and is 1024 for GICv5.

> 
> >  			goto out;
> >  		break;
> >  	case KVM_IRQ_ROUTING_MSI:
> 
Thanks,
Sascha