The IRQ bypass required the AIA to be in HWACCEL mode, while the KVM default is AUTO, which publishes an IMSIC VS-file whenever one is available and only falls back to the SW-file when the host has none left. Rejecting AUTO leaves every assigned device on host MSI delivery, which cannot work for a device attached to a nested domain because its stage-1 page tables belong to the guest, so the device keeps the host MSI address composed at vector activation and its MSIs fault in the guest stage-1. Co-developed-by: Wu Fei Signed-off-by: Wu Fei Signed-off-by: Gong Shuai --- arch/riscv/kvm/aia_imsic.c | 7 +++++-- 1 file changed, 5 insertions(+), 2 deletions(-) diff --git a/arch/riscv/kvm/aia_imsic.c b/arch/riscv/kvm/aia_imsic.c index 37e27f28dc62..010f9a90f107 100644 --- a/arch/riscv/kvm/aia_imsic.c +++ b/arch/riscv/kvm/aia_imsic.c @@ -981,10 +981,13 @@ static int imsic_irqfd_forward(struct kvm_kernel_irqfd *irqfd, * MSI-X because pci_write_msi_msg() masks an MSI-X vector around the * update, which conventional MSI cannot provide. */ - if (kvm->arch.aia.mode != KVM_DEV_RISCV_AIA_MODE_HWACCEL || - !imsic_irqfd_is_msix(irqfd)) + if (!imsic_irqfd_is_msix(irqfd)) return -EOPNOTSUPP; + /* + * The IOMMU writes MSIs straight into the VS-file, so bypass is + * gated by the hardware backing checks below, not the AIA mode. + */ if (!imsic_targets_valid(&kvm->arch.aia)) { pr_debug("KVM: IMSIC IRQ bypass requires all VS-files\n"); return -EOPNOTSUPP; -- 2.53.0