Re: [PATCH] KVM: PPC: Book3S HV: Disable preemption around host-side HPT lock users
flat view
From: Ritesh Harjani (IBM) <ritesh.list@gmail.com>
Date: 2026-10-15 03:45:36
Also in:
kvm, linux-hardening, lkml, stable
Amit Machhiwal [off-list ref] writes:
A previous change ("KVM: PPC: Book3S HV: Add preempt_disable() around
virtual-mode HPTE bit-lock users") at [1] added preempt_disable() around
guest vCPU HPT hcalls and page fault handlers executed in virtual mode.
This ensures vCPU threads cannot be preempted while holding
HPTE_V_HVLOCK or the reverse-map lock.
However, several host-side virtual-mode paths in book3s_64_mmu_hv.c also
acquire HPTE_V_HVLOCK and lock_rmap() in process context with preemption
enabled. Specifically, kvm_unmap_rmapp() and kvm_age_rmapp() take both
locks during MMU notifier callbacks and memslot flushes, while
resize_hpt_rehash_hpte() acquires HPTE_V_HVLOCK during HPT resizing. If
a host thread is preempted while holding either bit-lock, any guest vCPU
thread scheduled on the same CPU spinning for the same lock with
preemption disabled will never yield, resulting in a permanent CPU hang.
Fix this by disabling preemption across these host-side critical
sections.
For kvm_unmap_rmapp() and kvm_age_rmapp(), place preempt_disable()
before lock_rmap() so that both the rmap chain lock and the subsequent
HPTE_V_HVLOCK bit-lock are held under a single non-preemptible window.
To preserve the ABBA lock ordering between the two locks, re-enable
preemption after dropping the rmap lock on any retry or early-exit path
before spinning on cpu_relax(), allowing the lock holder to be
scheduled.
For kvm_htab_write(), the HPT migration restore path, replace the direct
calls to kvmppc_do_h_remove() with kvmppc_virtmode_do_h_remove(), a thin
wrapper that brackets kvmppc_do_h_remove() with preempt_disable() and
preempt_enable(), mirroring the existing kvmppc_virtmode_do_h_enter()
helper.
For resize_hpt_rehash_hpte(), place preempt_disable() before the
try_lock_hpte() spin loop and preempt_enable() after unlock_hpte() at
the function exit.
[1] https://git.kernel.org/powerpc/c/abbbe5ff83e7c9ed3a4d61b73011f1df7bf87907
Fixes: 6165d5dd99db ("KVM: PPC: Book3S HV: add virtual mode handlers for HPT hcalls and page faults")
Cc: stable@vger.kernel.org # v5.14+
Signed-off-by: Amit Machhiwal <redacted>
---
Changes in this version:
- Separated host-side fixes in book3s_64_mmu_hv.c into a standalone patch
(guest-side paths were merged from v1 resend).
- Previous discussion: https://lore.kernel.org/all/20261007182116.12479-3-amachhiw@linux.ibm.com/ (local)Thanks. Looks good to me. Please feel free to add: Reviewed-by: Ritesh Harjani (IBM) <ritesh.list@gmail.com>