Re: [PATCH 1/2] RISC-V: KVM: Move hfence type check out of loop

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
- [High] The patch completely breaks KVM_REQ_FENCE_I requests by unconditionally returning early from `make_xfence_request` when `data` is NULL, silently dropping guest instruction cache invalidations.
--

--- Patch [1]: [PATCH 1/2] RISC-V: KVM: Move hfence type check out of loop ---
commit 7dbdb7321dcb98c78f1282572934fc7ae89bab7e
Author: Wang Yechao <wang.yechao255@zte.com.cn>

RISC-V: KVM: Move hfence type check out of loop

This commit moves the validation of data and data->type outside the
VCPU iteration loop in make_xfence_request() to reduce overhead. It
adds an early return if the hfence data or its type is invalid.

> diff --git a/arch/riscv/kvm/tlb.c b/arch/riscv/kvm/tlb.c
> index 993b25ea94d67..a67b44a4d1d7a 100644
> --- a/arch/riscv/kvm/tlb.c
> +++ b/arch/riscv/kvm/tlb.c
> @@ -335,6 +335,9 @@ static void make_xfence_request(struct kvm *kvm,
>  	unsigned int actual_req = req;
>  	DECLARE_BITMAP(vcpu_mask, KVM_MAX_VCPUS);
>  
> +	if (!data || !data->type)
> +		return;
> +

[Severity: High]
Does this early return break callers that intentionally pass NULL for data?

For example, kvm_riscv_fence_i() calls make_xfence_request() with data=NULL
to broadcast a KVM_REQ_FENCE_I request:

arch/riscv/kvm/tlb.c:kvm_riscv_fence_i() {
    ...
    make_xfence_request(kvm, hbase, hmask, KVM_REQ_FENCE_I,
                        KVM_REQ_FENCE_I, NULL);
    ...
}

In the old code, passing NULL skipped enqueueing to the hfence queue but still
allowed the loop to populate vcpu_mask, so the request was properly broadcast.

With this change, the function returns immediately, dropping guest instruction
cache invalidations. Could this lead to guests executing stale instructions?

>  	bitmap_zero(vcpu_mask, KVM_MAX_VCPUS);
>  	kvm_for_each_vcpu(i, vcpu, kvm) {
>  		if (hbase != -1UL) {

[ ... ]

> @@ -347,9 +350,6 @@ static void make_xfence_request(struct kvm *kvm,
>  
>  		bitmap_set(vcpu_mask, i, 1);
>  
> -		if (!data || !data->type)
> -			continue;
> -
>  		/*
>  		 * Enqueue hfence data to VCPU hfence queue. If we don't
>  		 * have space in the VCPU hfence queue then fallback to

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260707113715.413265-1-wang.yechao255@zte.com.cn?part=1