From: David Woodhouse Event channel delivery now returns -EAGAIN when it races a memslot update. It always failed; now the failure is distinguishable, and instead of dropping the event each caller reacts according to its context: - kvm_xen_hvm_evtchn_send(): the KVM_XEN_HVM_EVTCHN_SEND ioctl. May sleep: passes wait == true, and kvm_gpc_refresh() rides the update out. - evtchn_set_fn(): irqfd routing, from the irqfd workqueue after the atomic fast path failed. May also wait. - kvm_xen_hcall_evtchn_send(): the guest's own EVTCHNOP_send, in vcpu_run's exit handling under the vCPU's kvm->srcu read section — the very reader the memslot update is waiting out, so waiting there deadlocks, and any guest can trigger it. Instead, leave the hypercall uncompleted, with RIP not advanced, and the guest re-executes it; each attempt cycles the srcu read section on the way back in, letting the update complete. This is how Xen itself restarts preempted hypercalls, and the pending delivery is pure guest state, so there is nothing extra to migrate. - kvm_xen_inject_timer_irqs(): the timer retry added by the previous commit — timer_pending *is* its pending state, so it keeps that and retries on the next entry pass. Neither caller may wait: the entry pass holds the vCPU's kvm->srcu, and the KVM_XEN_VCPU_GET_ATTR timer flush holds xen_lock, on which a vCPU writing the hypercall page MSR blocks inside its kvm->srcu section. The flush doesn't need to wait: an undelivered event is reported as still owed in the snapshot. Reported-by: sashiko-bot@kernel.org Closes: https://lore.kernel.org/all/20260920215341.5ECE91F000FF@smtp.kernel.org Signed-off-by: David Woodhouse Assisted-by: LLM --- arch/x86/kvm/xen.c | 58 +++++++++++++++++++++++++++++++--------------- 1 file changed, 39 insertions(+), 19 deletions(-) diff --git a/arch/x86/kvm/xen.c b/arch/x86/kvm/xen.c index f1be9022bc6f..a88f571e8682 100644 --- a/arch/x86/kvm/xen.c +++ b/arch/x86/kvm/xen.c @@ -30,9 +30,10 @@ #include "cpuid.h" #include "trace.h" -static int kvm_xen_set_evtchn(struct kvm_xen_evtchn *xe, struct kvm *kvm); +static int kvm_xen_set_evtchn(struct kvm_xen_evtchn *xe, struct kvm *kvm, + bool wait); static int kvm_xen_setattr_evtchn(struct kvm *kvm, struct kvm_xen_hvm_attr *data); -static bool kvm_xen_hcall_evtchn_send(struct kvm_vcpu *vcpu, u64 param, u64 *r); +static int kvm_xen_hcall_evtchn_send(struct kvm_vcpu *vcpu, u64 param, u64 *r); DEFINE_STATIC_KEY_DEFERRED_FALSE(kvm_xen_enabled, HZ); @@ -122,7 +123,7 @@ void kvm_xen_inject_timer_irqs(struct kvm_vcpu *vcpu) e.port = vcpu->arch.xen.timer_virq; e.priority = KVM_IRQ_ROUTING_XEN_EVTCHN_PRIO_2LEVEL; - rc = kvm_xen_set_evtchn(&e, vcpu->kvm); + rc = kvm_xen_set_evtchn(&e, vcpu->kvm, false); /* * Leave timer_pending set if the memslot is being updated @@ -1823,8 +1824,21 @@ int kvm_xen_hypercall(struct kvm_vcpu *vcpu) } break; case __HYPERVISOR_event_channel_op: - if (params[0] == EVTCHNOP_send) - handled = kvm_xen_hcall_evtchn_send(vcpu, params[1], &r); + if (params[0] == EVTCHNOP_send) { + int ret = kvm_xen_hcall_evtchn_send(vcpu, params[1], &r); + + /* + * Delivery raced a memslot update; waiting for it + * here would deadlock under vcpu_run's kvm->srcu + * read section. Leave the hypercall uncompleted — + * RIP not advanced — so the guest re-executes it. + * Each attempt cycles the srcu read section on the + * way back in, letting the update complete. + */ + if (ret == -EAGAIN) + return 1; + handled = !ret; + } break; case __HYPERVISOR_sched_op: handled = kvm_xen_hcall_sched_op(vcpu, is_64bit, params[0], @@ -2015,7 +2029,8 @@ int kvm_xen_set_evtchn_fast(struct kvm_xen_evtchn *xe, struct kvm *kvm) return rc; } -static int kvm_xen_set_evtchn(struct kvm_xen_evtchn *xe, struct kvm *kvm) +static int kvm_xen_set_evtchn(struct kvm_xen_evtchn *xe, struct kvm *kvm, + bool wait) { bool mm_borrowed = false; int rc; @@ -2052,16 +2067,13 @@ static int kvm_xen_set_evtchn(struct kvm_xen_evtchn *xe, struct kvm *kvm) */ do { struct gfn_to_pfn_cache *gpc = &kvm->arch.xen.shinfo_cache; - int idx; rc = kvm_xen_set_evtchn_fast(xe, kvm); if (rc != -EWOULDBLOCK) break; - idx = srcu_read_lock(&kvm->srcu); - rc = kvm_gpc_refresh(gpc, PAGE_SIZE, false); - srcu_read_unlock(&kvm->srcu, idx); - } while(!rc); + rc = kvm_gpc_refresh(gpc, PAGE_SIZE, wait); + } while (!rc); if (mm_borrowed) kthread_unuse_mm(kvm->mm); @@ -2076,7 +2088,7 @@ static int evtchn_set_fn(struct kvm_kernel_irq_routing_entry *e, struct kvm *kvm if (!level) return -EINVAL; - return kvm_xen_set_evtchn(&e->xen_evtchn, kvm); + return kvm_xen_set_evtchn(&e->xen_evtchn, kvm, true); } /* @@ -2150,7 +2162,7 @@ int kvm_xen_hvm_evtchn_send(struct kvm *kvm, struct kvm_irq_routing_xen_evtchn * e.vcpu_idx = -1; e.priority = uxe->priority; - ret = kvm_xen_set_evtchn(&e, kvm); + ret = kvm_xen_set_evtchn(&e, kvm, true); /* * None of that 'return 1 if it actually got delivered' nonsense. @@ -2379,7 +2391,11 @@ static int kvm_xen_setattr_evtchn(struct kvm *kvm, struct kvm_xen_hvm_attr *data return kvm_xen_eventfd_assign(kvm, data); } -static bool kvm_xen_hcall_evtchn_send(struct kvm_vcpu *vcpu, u64 param, u64 *r) +/* + * Returns 0 with *r set if handled, -EAGAIN if the hypercall should be + * re-executed by the guest, or -ENOENT to hand it to userspace. + */ +static int kvm_xen_hcall_evtchn_send(struct kvm_vcpu *vcpu, u64 param, u64 *r) { struct evtchnfd *evtchnfd; struct evtchn_send send; @@ -2389,7 +2405,7 @@ static bool kvm_xen_hcall_evtchn_send(struct kvm_vcpu *vcpu, u64 param, u64 *r) BUILD_BUG_ON(sizeof(send) != 4); if (kvm_read_guest_virt(vcpu, param, &send, sizeof(send), &e)) { *r = -EFAULT; - return true; + return 0; } /* @@ -2398,18 +2414,22 @@ static bool kvm_xen_hcall_evtchn_send(struct kvm_vcpu *vcpu, u64 param, u64 *r) */ evtchnfd = xa_load(&vcpu->kvm->arch.xen.evtchn_ports, send.port); if (!evtchnfd) - return false; + return -ENOENT; if (evtchnfd->deliver.port.port) { - int ret = kvm_xen_set_evtchn(&evtchnfd->deliver.port, vcpu->kvm); + int ret = kvm_xen_set_evtchn(&evtchnfd->deliver.port, + vcpu->kvm, false); + + if (ret == -EAGAIN) + return ret; if (ret < 0 && ret != -ENOTCONN) - return false; + return -ENOENT; } else { eventfd_signal(evtchnfd->deliver.eventfd.ctx); } *r = 0; - return true; + return 0; } void kvm_xen_init_vcpu(struct kvm_vcpu *vcpu) -- 2.43.0