Commit a0e6ae45 authored Apr 07, 2026 by David Woodhouse Committed by Marc Zyngier Apr 24, 2026

KVM: arm64: vgic: Fix IIDR revision field extracted from wrong value

The uaccess write handlers for GICD_IIDR in both GICv2 and GICv3
extract the revision field from 'reg' (the current IIDR value read back
from the emulated distributor) instead of 'val' (the value userspace is
trying to write). This means userspace can never actually change the
implementation revision — the extracted value is always the current one.

Fix the FIELD_GET to use 'val' so that userspace can select a different
revision for migration compatibility.

Fixes: 49a1a2c7 ("KVM: arm64: vgic-v3: Advertise GICR_CTLR.{IR, CES} as a new GICD_IIDR revision")
Signed-off-by: David Woodhouse <dwmw@amazon.co.uk>
Link: https://patch.msgid.link/20260407210949.2076251-2-dwmw2@infradead.org

Signed-off-by: Marc Zyngier <maz@kernel.org>
Cc: stable@vger.kernel.org

parent f0579949

arch/arm64/kvm/vgic/vgic-mmio-v2.c

+1 −1

Original line number	Diff line number	Diff line
		@@ -91,7 +91,7 @@ static int vgic_mmio_uaccess_write_v2_misc(struct kvm_vcpu *vcpu,
		* migration from old kernels to new kernels with legacy
		* userspace.
		*/
		reg = FIELD_GET(GICD_IIDR_REVISION_MASK, reg);
		reg = FIELD_GET(GICD_IIDR_REVISION_MASK, val);
		switch (reg) {
		case KVM_VGIC_IMP_REV_2:
		case KVM_VGIC_IMP_REV_3:

arch/arm64/kvm/vgic/vgic-mmio-v3.c

+1 −1

Original line number	Diff line number	Diff line
		@@ -194,7 +194,7 @@ static int vgic_mmio_uaccess_write_v3_misc(struct kvm_vcpu *vcpu,
		if ((reg ^ val) & ~GICD_IIDR_REVISION_MASK)
		return -EINVAL;

		reg = FIELD_GET(GICD_IIDR_REVISION_MASK, reg);
		reg = FIELD_GET(GICD_IIDR_REVISION_MASK, val);
		switch (reg) {
		case KVM_VGIC_IMP_REV_2:
		case KVM_VGIC_IMP_REV_3: