Re: [PATCH] KVM: riscv: Free detached G-stage page tables outside mmu_lock

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
- [High] kvm: riscv: read_unlock() with IRQs disabled triggers PREEMPT_RT WARN
--

commit 4942abf031219dcd47ba5f900125f636dc95e221
Author: Can Qi <qican5708@163.com>

KVM: riscv: Free detached G-stage page tables outside mmu_lock

This commit modifies the KVM RISC-V MMU to detach and free G-stage page
tables outside of mmu_lock to reduce lock contention during large VM
teardown. It quiesces guest and host hardware users before freeing the
detached tree, and replaces the KVM-wide split page cache with a
per-operation cache.

> diff --git a/arch/riscv/kvm/vcpu_exit.c b/arch/riscv/kvm/vcpu_exit.c
> index 88e0c369b3544..da3308a3d0203 100644
> --- a/arch/riscv/kvm/vcpu_exit.c
> +++ b/arch/riscv/kvm/vcpu_exit.c
> @@ -90,7 +90,21 @@ unsigned long kvm_riscv_vcpu_unpriv_read(struct kvm_vcpu *vcpu,
>  	register unsigned long ttmp asm("a1");
>  	unsigned long flags, val, tmp, old_stvec, old_hstatus;
>  
> +	/*
> +	 * Prevent G-stage teardown while HLV/HLVX can walk the page tables.
> +	 * The active-root check prevents a new walk from starting after detach.
> +	 */
> +	read_lock(&vcpu->kvm->mmu_lock);
> +	if (!vcpu->kvm->arch.pgd) {
> +		read_unlock(&vcpu->kvm->mmu_lock);
> +		trap->scause = EXC_LOAD_GUEST_PAGE_FAULT;
> +		trap->stval = guest_addr;
> +		return 0;
> +	}
>  	local_irq_save(flags);
> +	/* Publish the hardware walk before dropping the root lifetime lock. */
> +	smp_store_mb(vcpu->mode, READING_SHADOW_PAGE_TABLES);
> +	read_unlock(&vcpu->kvm->mmu_lock);

[Severity: High]
Does this sequence trigger a kernel warning on PREEMPT_RT systems?

On PREEMPT_RT, rwlocks are sleepable rt_rwlocks, and read_unlock() calls
migrate_enable(), which explicitly warns if called with interrupts disabled.
Since local_irq_save() disables interrupts just before
read_unlock(&vcpu->kvm->mmu_lock) is called, it seems this would cause a
WARN/BUG splat in kvm_riscv_vcpu_unpriv_read().

This path appears to be reachable by any untrusted guest capable of issuing
unprivileged accesses that trap to KVM, making it a guest-triggerable host
issue in PREEMPT_RT environments.

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260920123117.49830-1-qican5708@163.com?part=1