Re: [PATCH v3 08/10] KVM: x86/lapic: Clear IPI tracking on matching-vector EOI

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
- [Medium] The EOI handler incorrectly clears the vCPU's outgoing IPI tracking state when acknowledging an incoming IPI due to conflated incoming and outgoing tracking fields.
--

commit f711eb495ad18e2339b40d0c737023fdb3459a71
Author: Wanpeng Li <wanpengli@tencent.com>

KVM: x86/lapic: Clear IPI tracking on matching-vector EOI

This commit updates apic_set_eoi() and kvm_apic_set_eoi_accelerated() to
clear IPI tracking state only when the EOI vector matches the tracked
vector, aiming to prevent eviction of pending contexts when unrelated
interrupts are handled.

> diff --git a/arch/x86/kvm/lapic.c b/arch/x86/kvm/lapic.c
> --- a/arch/x86/kvm/lapic.c
> +++ b/arch/x86/kvm/lapic.c
[ ... ]
> +static void kvm_clear_ipi_on_eoi(struct kvm_lapic *apic, int vector)
> +{
> +	struct kvm_vcpu *receiver = apic->vcpu;
> +	struct kvm_vcpu *sender;
> +	int sender_idx;
> +	u64 then, now;
> +
> +	if (unlikely(!READ_ONCE(ipi_tracking_enabled)))
> +		return;
> +
> +	if (vector < 0 || vector > 0xff)
> +		return;
> +
> +	if (READ_ONCE(receiver->arch.ipi_context.vector) != (u8)vector)
> +		return;
> +
> +	sender_idx = READ_ONCE(receiver->arch.ipi_context.last_ipi_sender);
> +	kvm_vcpu_clear_ipi_context(receiver);

[Severity: Medium]
Does calling kvm_vcpu_clear_ipi_context() here unintentionally clear the
vCPU's outgoing IPI tracking state?

Looking at kvm_vcpu_clear_ipi_context(), it clears the entire ipi_context
structure, including pending_ipi and last_ipi_receiver. Since a vCPU can
act as both a sender and a receiver concurrently, acknowledging an incoming
IPI here appears to erase the vCPU's state as a sender.

Could this destroy the directed yield hint and cause concurrent IPI sender
and receiver vCPUs to miss the yield optimization?

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260612013355.59231-1-kernellwp@gmail.com?part=8