[PATCH v4 0/3] KVM: PPC: Fixes for Book3S HV HPT locking and paired-single decoding
flat view
WARM1d
From: Amit Machhiwal <hidden>
Date: 2026-10-07 18:21:54
Also in:
kvm, linux-hardening, lkml, stable
Revision v4 of 5 in this series.
Revisions (5)
This series addresses bug fixes across KVM PPC Book3S HV
locking/synchronization and paired-single instruction decoding.
Patches 1 & 2 fix synchronization and preemption issues introduced in
commit 6165d5dd99db ("KVM: PPC: Book3S HV: add virtual mode handlers for
HPT hcalls and page faults"):
- Patch 1 adds SRCU read lock protection when walking memslots during
virtual-mode HPT hcalls to prevent use-after-free races with concurrent
memslot updates.
- Patch 2 adds preempt_disable() around all virtual-mode HPTE bit-lock
holders — both the guest vCPU paths (kvmppc_hpte_hv_fault() and
kvmppc_pseries_do_hpt_hcall()) and the host-side paths
(kvm_unmap_rmapp(), kvm_age_rmapp(), resize_hpt_rehash_hpte()) — to
prevent CPU stalls and deadlocks on preemption.
Patch 3 fixes paired-single D-form instruction emulation:
- Patch 3 fixes get_d_signext() to correctly extract the full 12-bit D
displacement field and perform proper two's-complement sign extension.
Testing:
========
All test kernel builds were compiled with CONFIG_DEBUG_ATOMIC_SLEEP=y.
The following scenarios were verified:
1. Power9 PowerNV (L0) in Radix mode:
- Booted L0 host with kernel containing all 3 patches.
- Booted KVM guests in both Radix and Hash modes.
- Ran kernel build workload inside guests — no errors observed.
- Booted L1 guest with the same kernel — booted and ran cleanly.
2. Power9 PowerNV (L0) in Hash mode:
- Booted L0 host with kernel containing all 3 patches.
- Booted KVM guest in Hash mode.
- Ran kernel build workload inside guest — no errors observed.
- Booted L1 nested guest with the same kernel — booted and ran cleanly.
3. Power10 LPAR (L1):
- Booted Power10 LPAR with the patched kernel.
- Booted KVM guest and ran workloads — no errors observed.
Changes in v4:
==============
- v3: https://lore.kernel.org/all/20261006122404.99358-1-amachhiw@linux.ibm.com/ (local)
- Patch 2:
- Fixed missing preemption guard in kvm_htab_write(): introduced
kvmppc_virtmode_do_h_remove(), a thin wrapper that brackets
kvmppc_do_h_remove() with preempt_disable()/preempt_enable(), mirroring
the existing kvmppc_virtmode_do_h_enter() pattern. Replaced both raw
kvmppc_do_h_remove() call sites in kvm_htab_write() with the new wrapper.
- Updated commit message to document the kvm_htab_write() fix.
- Dropped Reviewed-by from Shrikanth Hegde as the patch was materially
extended.
Changes in v3:
==============
- v2: https://lore.kernel.org/all/20260930173750.56759-1-amachhiw@linux.ibm.com/ (local)
- Patch 2:
- Fixed preemption window in kvm_unmap_rmapp() and kvm_age_rmapp(): moved
preempt_disable() before lock_rmap() so both the rmap lock and the HPTE
bit-lock are held under a single non-preemptible section, and added
preempt_enable() on all early exits and retry paths before cpu_relax().
- Cleaned up kvm_test_clear_dirty_npages(): removed redundant per-iteration
preempt_disable()/preempt_enable() pairs since the caller
kvmppc_hv_get_dirty_log_hpt() already holds preempt_disable() across the
entire loop.
- Reworded commit message to clearly detail the per-function locking design
and rationale.
- Picked up Reviewed-by tag from Shrikanth Hegde.
- Patch 3:
- Picked up Reviewed-by tag from Shrikanth Hegde.
Changes in v2:
==============
- v1: https://lore.kernel.org/all/20260928122837.8782-1-amachhiw@linux.ibm.com/ (local)
- Patch 2: Extended preempt_disable()/preempt_enable() coverage to also wrap
the HPTE bit-lock hold windows in four host-side virtual-mode functions:
kvm_unmap_rmapp(), kvm_age_rmapp(), kvm_test_clear_dirty_npages(), and
resize_hpt_rehash_hpte(). These were identified as vulnerable by Sashiko AI
review and confirmed correct by audit.
- Dropped Reviewed-by from Ritesh as the patch was materially extended.
- Patch 2: Added warning comment above kvmppc_pseries_do_hpt_hcall()
documenting the preemption requirement.
Amit Machhiwal (3):
KVM: PPC: Book3S HV: Add SRCU protection for virtual-mode HPT hcalls
KVM: PPC: Book3S HV: Add preempt_disable() around virtual-mode HPTE
bit-lock users
KVM: PPC: Fix get_d_signext() 12-bit displacement for paired-single
D-form
arch/powerpc/kvm/book3s_64_mmu_hv.c | 33 +++++++++-
arch/powerpc/kvm/book3s_hv.c | 80 +++++++++++++-----------
arch/powerpc/kvm/book3s_paired_singles.c | 7 +--
3 files changed, 77 insertions(+), 43 deletions(-)
base-commit: 602042bf29f6efde39cfb5fdd9289bf4854bc0c5
--
2.54.0 (Apple Git-157)