Thread (2 messages) 2 messages, 2 authors, 3d ago

Re: [PATCH] KVM: PPC: Book3S HV: Disable preemption around host-side HPT lock users

flat view

From: Ritesh Harjani (IBM) <ritesh.list@gmail.com>
Date: 2026-10-15 03:45:36
Also in: kvm, linux-hardening, lkml, stable

Amit Machhiwal [off-list ref] writes:
A previous change ("KVM: PPC: Book3S HV: Add preempt_disable() around
virtual-mode HPTE bit-lock users") at [1] added preempt_disable() around
guest vCPU HPT hcalls and page fault handlers executed in virtual mode.
This ensures vCPU threads cannot be preempted while holding
HPTE_V_HVLOCK or the reverse-map lock.

However, several host-side virtual-mode paths in book3s_64_mmu_hv.c also
acquire HPTE_V_HVLOCK and lock_rmap() in process context with preemption
enabled.  Specifically, kvm_unmap_rmapp() and kvm_age_rmapp() take both
locks during MMU notifier callbacks and memslot flushes, while
resize_hpt_rehash_hpte() acquires HPTE_V_HVLOCK during HPT resizing.  If
a host thread is preempted while holding either bit-lock, any guest vCPU
thread scheduled on the same CPU spinning for the same lock with
preemption disabled will never yield, resulting in a permanent CPU hang.

Fix this by disabling preemption across these host-side critical
sections.

For kvm_unmap_rmapp() and kvm_age_rmapp(), place preempt_disable()
before lock_rmap() so that both the rmap chain lock and the subsequent
HPTE_V_HVLOCK bit-lock are held under a single non-preemptible window.
To preserve the ABBA lock ordering between the two locks, re-enable
preemption after dropping the rmap lock on any retry or early-exit path
before spinning on cpu_relax(), allowing the lock holder to be
scheduled.

For kvm_htab_write(), the HPT migration restore path, replace the direct
calls to kvmppc_do_h_remove() with kvmppc_virtmode_do_h_remove(), a thin
wrapper that brackets kvmppc_do_h_remove() with preempt_disable() and
preempt_enable(), mirroring the existing kvmppc_virtmode_do_h_enter()
helper.

For resize_hpt_rehash_hpte(), place preempt_disable() before the
try_lock_hpte() spin loop and preempt_enable() after unlock_hpte() at
the function exit.

[1] https://git.kernel.org/powerpc/c/abbbe5ff83e7c9ed3a4d61b73011f1df7bf87907

Fixes: 6165d5dd99db ("KVM: PPC: Book3S HV: add virtual mode handlers for HPT hcalls and page faults")
Cc: stable@vger.kernel.org # v5.14+
Signed-off-by: Amit Machhiwal <redacted>
---
Changes in this version:
- Separated host-side fixes in book3s_64_mmu_hv.c into a standalone patch
  (guest-side paths were merged from v1 resend).
- Previous discussion: https://lore.kernel.org/all/20261007182116.12479-3-amachhiw@linux.ibm.com/ (local)
Thanks. Looks good to me. Please feel free to add:
Reviewed-by: Ritesh Harjani (IBM) <ritesh.list@gmail.com>
Keyboard shortcuts
hback out one level
jnext message in thread
kprevious message in thread
ldrill in
Escclose help / fold thread tree
?toggle this help