Re: [PATCH] KVM: Drop kvm_vcpu.ready to squash race where "ready" can get stuck "true"

[Sean Christopherson <seanjc@google.com>]

On Tue, Apr 14, 2026, Paolo Bonzini wrote:
> On 4/9/26 23:33, Sean Christopherson wrote:
> > +static inline bool kvm_vcpu_is_runnable_and_scheduled_out(struct kvm_vcpu *vcpu)
> > +{
> > +	return READ_ONCE(vcpu->preempted) ||
> > +	       (READ_ONCE(vcpu->scheduled_out) &&
> > +		READ_ONCE(vcpu->wants_to_run) &&
> 
> wants_to_run doesn't seem important here, because blocking will never be set
> outside KVM_RUN (unlike scheduled_out which can be set within any
> vcpu_load/vcpu_put pair, if you're unlucky enough).

Oh, good point.

> > +		READ_ONCE(vcpu->stat.generic.blocking) &&
> > +		!kvm_vcpu_is_blocking(vcpu));
> 
> If you get here you have done the finish_rcuwait() in kvm_vcpu_block(),
> meaning that you've been already scheduled in, haven't you?

Gah, yes.  I didn't realize finish_rcuwait() is what actually completes the
wakeup from KVM's perspective.

> So, you would need something like this:
> 
> static inline bool kvm_vcpu_is_runnable_and_scheduled_out(struct kvm_vcpu *vcpu)
> {
> 	if (READ_ONCE(vcpu->preempted))
> 		return true;
> 
> 	if (!READ_ONCE(vcpu->scheduled_out))
> 		return false;
> 	if (!READ_ONCE(vcpu->stat.generic.blocking))

Hmm, I think this could actually be:

	if (!kvm_vcpu_is_blocking(vcpu))
		return false;

Because my use of vcpu->stat.generic.blocking was purely due to missing that
finish_rcuwait() is effectively what clears "blocking".  That would narrow the
window for false positives a little, e.g. would at least wait until after the
kvm_arch_vcpu_blocking() call to treat the vCPU as blocking.

> 		return false;
> 	return rcuwait_was_woken(kvm_arch_vcpu_get_wait(vcpu));
> }
> 
> // in rcuwait.h
> static inline bool rcuwait_was_woken(struct rcuwait *w)
> {
> 	guard(rcu)();
> 	struct task_struct *t = rcu_access_pointer(w->task);
> 	return t && !task_is_runnable(t);

Ah, and I missed the task_is_runnable() check guarding vcpu->ready.  I suspect I
assumed kvm_vcpu_on_spin() would do that check.