vfio/pci: Fix racy bitfields and tighten struct layout

Bitfield operations are not atomic, they use a read-modify-write
pattern, therefore we should be careful not to pack bitfields that
can be concurrently updated into the same storage unit.

This split takes a binary approach: flags that are only modified
pre/post open/close remain bitfields, flags modified from user
action, including actions that reach across to another device (ex.
reset) use dedicated storage units.

Note that the virq_disabled and bardirty flags are relocated to fill
an existing hole in the structure.

Bitfield justifications:

  has_dyn_msix: written only in vfio_pci_core_enable()
  pci_2_3: written only in vfio_pci_core_enable()
  reset_works: written only in vfio_pci_core_enable()
  extended_caps: written only in vfio_cap_len() under vfio_config_init()
  has_vga: written only in vfio_pci_core_enable()
  nointx: written only in vfio_pci_core_enable()
  needs_pm_restore: written only in vfio_pci_probe_power_state()
  disable_idle_d3: written only at .init in vfio_pci_core_init_dev()

Dedicated storage units:

  virq_disabled: written by guest INTx command writes in
                 vfio_basic_config_write() while the device is open
  bardirty: written by guest BAR writes in vfio_basic_config_write()
            while the device is open
  pm_intx_masked: written in the runtime-PM suspend path.
  pm_runtime_engaged: written by low-power feature entry/exit paths
  needs_reset: set in vfio_pci_core_disable() and cleared for devices in
               the set by vfio_pci_dev_set_try_reset()
  sriov_active: written by vfio_pci_core_sriov_configure() via sysfs
                sriov_numvfs while bound.

Fixes: 9cd0f6d5cbb6 ("vfio/pci: Use bitfield for struct vfio_pci_core_device flags")
Cc: stable@vger.kernel.org
Assisted-by: Claude:claude-opus-4-8
Signed-off-by: Alex Williamson <alex.williamson@nvidia.com>
Reviewed-by: Kevin Tian <kevin.tian@intel.com>
Link: https://lore.kernel.org/r/20260615191241.688297-4-alex.williamson@nvidia.com
Signed-off-by: Alex Williamson <alex@shazbot.org>

diff --git a/include/linux/vfio_pci_core.h b/include/linux/vfio_pci_core.h
index 27aab3fdbb91d14144dab569f3be3b15a82428eb..985b8af5a04b9b728d9bf67d385f80e9508a38bf 100644 (file)
--- a/include/linux/vfio_pci_core.h
+++ b/include/linux/vfio_pci_core.h
@@ -101,6 +101,9 @@ struct vfio_pci_core_device {
        const struct vfio_pci_device_ops *pci_ops;
        void __iomem            *barmap[PCI_STD_NUM_BARS];
        bool                    bar_mmap_supported[PCI_STD_NUM_BARS];
+       /* Flags modified at runtime - dedicated storage unit */
+       bool                    virq_disabled;
+       bool                    bardirty;
        u8                      *pci_config_map;
        u8                      *vconfig;
        struct perm_bits        *msi_perm;
@@ -115,19 +118,19 @@ struct vfio_pci_core_device {
        u16                     msix_size;
        u32                     msix_offset;
        u32                     rbar[7];
+       /* Flags only modified on setup/release - bitfield ok */
        bool                    has_dyn_msix:1;
        bool                    pci_2_3:1;
-       bool                    virq_disabled:1;
        bool                    reset_works:1;
        bool                    extended_caps:1;
-       bool                    bardirty:1;
        bool                    has_vga:1;
-       bool                    needs_reset:1;
        bool                    nointx:1;
        bool                    needs_pm_restore:1;
-       bool                    pm_intx_masked:1;
-       bool                    pm_runtime_engaged:1;
        bool                    disable_idle_d3:1;
+       /* Flags modified at runtime - dedicated storage unit */
+       bool                    needs_reset;
+       bool                    pm_intx_masked;
+       bool                    pm_runtime_engaged;
        bool                    sriov_active;
        struct pci_saved_state  *pci_saved_state;
        struct pci_saved_state  *pm_save;