[PATCH v3 05/11] KVM: x86/xen: Retry event channel delivery which races a memslot update
From: David Woodhouse
Date: Fri Oct 16 2026 - 11:06:45 EST
From: David Woodhouse <dwmw@xxxxxxxxxxxx>
Event channel delivery now returns -EAGAIN when it races a memslot
update. It always failed; now the failure is distinguishable, and
instead of dropping the event each caller reacts according to its
context:
- kvm_xen_hvm_evtchn_send(): the KVM_XEN_HVM_EVTCHN_SEND ioctl.
May sleep: passes wait == true, and kvm_gpc_refresh() rides the
update out.
- evtchn_set_fn(): irqfd routing, from the irqfd workqueue after
the atomic fast path failed. May also wait.
- kvm_xen_hcall_evtchn_send(): the guest's own EVTCHNOP_send, in
vcpu_run's exit handling under the vCPU's kvm->srcu read section
— the very reader the memslot update is waiting out, so waiting
there deadlocks, and any guest can trigger it. Instead, leave the
hypercall uncompleted, with RIP not advanced, and the guest
re-executes it; each attempt cycles the srcu read section on the
way back in, letting the update complete. This is how Xen itself
restarts preempted hypercalls, and the pending delivery is pure
guest state, so there is nothing extra to migrate.
- kvm_xen_inject_timer_irqs(): the timer retry added by the
previous commit — timer_pending *is* its pending state, so it
keeps that and retries on the next entry pass. The entry pass
holds the vCPU's kvm->srcu, so it may not wait. The
KVM_XEN_VCPU_GET_ATTR timer flush doesn't need to wait: an
undelivered event is reported as still owed in the snapshot.
Reported-by: sashiko-bot@xxxxxxxxxx
Closes: https://lore.kernel.org/all/20260920215341.5ECE91F000FF@xxxxxxxxxxxxxxx
Signed-off-by: David Woodhouse <dwmw@xxxxxxxxxxxx>
Assisted-by: LLM
---
arch/x86/kvm/xen.c | 58 +++++++++++++++++++++++++++++++---------------
1 file changed, 39 insertions(+), 19 deletions(-)
diff --git a/arch/x86/kvm/xen.c b/arch/x86/kvm/xen.c
index 0ef646cf3990..6b7532b0e26a 100644
--- a/arch/x86/kvm/xen.c
+++ b/arch/x86/kvm/xen.c
@@ -30,9 +30,10 @@
#include "cpuid.h"
#include "trace.h"
-static int kvm_xen_set_evtchn(struct kvm_xen_evtchn *xe, struct kvm *kvm);
+static int kvm_xen_set_evtchn(struct kvm_xen_evtchn *xe, struct kvm *kvm,
+ bool wait);
static int kvm_xen_setattr_evtchn(struct kvm *kvm, struct kvm_xen_hvm_attr *data);
-static bool kvm_xen_hcall_evtchn_send(struct kvm_vcpu *vcpu, u64 param, u64 *r);
+static int kvm_xen_hcall_evtchn_send(struct kvm_vcpu *vcpu, u64 param, u64 *r);
DEFINE_STATIC_KEY_DEFERRED_FALSE(kvm_xen_enabled, HZ);
@@ -135,7 +136,7 @@ void kvm_xen_inject_timer_irqs(struct kvm_vcpu *vcpu)
e.port = vcpu->arch.xen.timer_virq;
e.priority = KVM_IRQ_ROUTING_XEN_EVTCHN_PRIO_2LEVEL;
- rc = kvm_xen_set_evtchn(&e, vcpu->kvm);
+ rc = kvm_xen_set_evtchn(&e, vcpu->kvm, false);
/*
* Leave timer_pending set if the memslot is being updated
@@ -1868,8 +1869,21 @@ int kvm_xen_hypercall(struct kvm_vcpu *vcpu)
}
break;
case __HYPERVISOR_event_channel_op:
- if (params[0] == EVTCHNOP_send)
- handled = kvm_xen_hcall_evtchn_send(vcpu, params[1], &r);
+ if (params[0] == EVTCHNOP_send) {
+ int ret = kvm_xen_hcall_evtchn_send(vcpu, params[1], &r);
+
+ /*
+ * Delivery raced a memslot update; waiting for it
+ * here would deadlock under vcpu_run's kvm->srcu
+ * read section. Leave the hypercall uncompleted —
+ * RIP not advanced — so the guest re-executes it.
+ * Each attempt cycles the srcu read section on the
+ * way back in, letting the update complete.
+ */
+ if (ret == -EAGAIN)
+ return 1;
+ handled = !ret;
+ }
break;
case __HYPERVISOR_sched_op:
handled = kvm_xen_hcall_sched_op(vcpu, is_64bit, params[0],
@@ -2060,7 +2074,8 @@ int kvm_xen_set_evtchn_fast(struct kvm_xen_evtchn *xe, struct kvm *kvm)
return rc;
}
-static int kvm_xen_set_evtchn(struct kvm_xen_evtchn *xe, struct kvm *kvm)
+static int kvm_xen_set_evtchn(struct kvm_xen_evtchn *xe, struct kvm *kvm,
+ bool wait)
{
bool mm_borrowed = false;
int rc;
@@ -2097,16 +2112,13 @@ static int kvm_xen_set_evtchn(struct kvm_xen_evtchn *xe, struct kvm *kvm)
*/
do {
struct gfn_to_pfn_cache *gpc = &kvm->arch.xen.shinfo_cache;
- int idx;
rc = kvm_xen_set_evtchn_fast(xe, kvm);
if (rc != -EWOULDBLOCK)
break;
- idx = srcu_read_lock(&kvm->srcu);
- rc = kvm_gpc_refresh(gpc, PAGE_SIZE, false);
- srcu_read_unlock(&kvm->srcu, idx);
- } while(!rc);
+ rc = kvm_gpc_refresh(gpc, PAGE_SIZE, wait);
+ } while (!rc);
if (mm_borrowed)
kthread_unuse_mm(kvm->mm);
@@ -2121,7 +2133,7 @@ static int evtchn_set_fn(struct kvm_kernel_irq_routing_entry *e, struct kvm *kvm
if (!level)
return -EINVAL;
- return kvm_xen_set_evtchn(&e->xen_evtchn, kvm);
+ return kvm_xen_set_evtchn(&e->xen_evtchn, kvm, true);
}
/*
@@ -2195,7 +2207,7 @@ int kvm_xen_hvm_evtchn_send(struct kvm *kvm, struct kvm_irq_routing_xen_evtchn *
e.vcpu_idx = -1;
e.priority = uxe->priority;
- ret = kvm_xen_set_evtchn(&e, kvm);
+ ret = kvm_xen_set_evtchn(&e, kvm, true);
/*
* None of that 'return 1 if it actually got delivered' nonsense.
@@ -2424,7 +2436,11 @@ static int kvm_xen_setattr_evtchn(struct kvm *kvm, struct kvm_xen_hvm_attr *data
return kvm_xen_eventfd_assign(kvm, data);
}
-static bool kvm_xen_hcall_evtchn_send(struct kvm_vcpu *vcpu, u64 param, u64 *r)
+/*
+ * Returns 0 with *r set if handled, -EAGAIN if the hypercall should be
+ * re-executed by the guest, or -ENOENT to hand it to userspace.
+ */
+static int kvm_xen_hcall_evtchn_send(struct kvm_vcpu *vcpu, u64 param, u64 *r)
{
struct evtchnfd *evtchnfd;
struct evtchn_send send;
@@ -2434,7 +2450,7 @@ static bool kvm_xen_hcall_evtchn_send(struct kvm_vcpu *vcpu, u64 param, u64 *r)
BUILD_BUG_ON(sizeof(send) != 4);
if (kvm_read_guest_virt(vcpu, param, &send, sizeof(send), &e)) {
*r = -EFAULT;
- return true;
+ return 0;
}
/*
@@ -2443,18 +2459,22 @@ static bool kvm_xen_hcall_evtchn_send(struct kvm_vcpu *vcpu, u64 param, u64 *r)
*/
evtchnfd = xa_load(&vcpu->kvm->arch.xen.evtchn_ports, send.port);
if (!evtchnfd)
- return false;
+ return -ENOENT;
if (evtchnfd->deliver.port.port) {
- int ret = kvm_xen_set_evtchn(&evtchnfd->deliver.port, vcpu->kvm);
+ int ret = kvm_xen_set_evtchn(&evtchnfd->deliver.port,
+ vcpu->kvm, false);
+
+ if (ret == -EAGAIN)
+ return ret;
if (ret < 0 && ret != -ENOTCONN)
- return false;
+ return -ENOENT;
} else {
eventfd_signal(evtchnfd->deliver.eventfd.ctx);
}
*r = 0;
- return true;
+ return 0;
}
void kvm_xen_init_vcpu(struct kvm_vcpu *vcpu)
--
2.43.0