Re: [PATCH 20/60] kvm: Move kvm_vcpu mode and requests field to struct kvm_vcpu_common

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
- [High] Kicking an inactive plane consumes the shared `IN_GUEST_MODE` transition but sends the IPI to the wrong host CPU, leading to lost wakeups.
--

commit 88d15ceb3d5f247a97568016e3edb271e847d58a
Author: Joerg Roedel <joerg.roedel@amd.com>

kvm: Move kvm_vcpu mode and requests field to struct kvm_vcpu_common

This commit moves the mode and requests fields from the per-plane
struct kvm_vcpu into the shared struct kvm_vcpu_common. This ensures
these states are shared across all planes of a given VCPU.

> diff --git a/include/linux/kvm_host.h b/include/linux/kvm_host.h
> index 45286b3b35c9f..7704820986da5 100644
> --- a/include/linux/kvm_host.h
> +++ b/include/linux/kvm_host.h

[ ... ]

> @@ -630,7 +631,7 @@ static inline int kvm_vcpu_exiting_guest_mode(struct kvm_vcpu *vcpu)
>  	 * memory barrier following the write of vcpu->mode in VCPU RUN.
>  	 */
>  	smp_mb__before_atomic();
> -	return cmpxchg(&vcpu->mode, IN_GUEST_MODE, EXITING_GUEST_MODE);
> +	return cmpxchg(&vcpu->common->mode, IN_GUEST_MODE, EXITING_GUEST_MODE);

[Severity: High]
Could sharing the mode field across planes lead to permanently lost wakeups
when an inactive plane is kicked?

If an inactive plane is kicked (for example, if kvm_get_vcpu_by_id() returns
plane 0 while plane 1 is active), this cmpxchg will successfully transition
the shared mode to EXITING_GUEST_MODE.

However, when __kvm_vcpu_kick() subsequently runs, it reads the per-plane
vcpu->cpu field:

virt/kvm/kvm_main.c:__kvm_vcpu_kick() {
    ...
    cpu = READ_ONCE(vcpu->cpu);
    if (cpu != me && (unsigned int)cpu < nr_cpu_ids && cpu_online(cpu)) {
        ...
        smp_send_reschedule(cpu);
    }
}

Because the kicked plane is inactive, its cpu field may be stale or -1. Will
this cause the IPI to be sent to the wrong host CPU, leaving the active plane
running in the guest?

Furthermore, since the shared mode was consumed and is now EXITING_GUEST_MODE,
would all subsequent kicks to any plane fail the cmpxchg and be ignored until
the guest naturally exits?

>  }

[ ... ]

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260608144252.351443-1-joro@8bytes.org?part=20