Re: CPU Lockups in KVM with deferred hrtimer rearming

Thomas Gleixner
2026-04-21T17:11:21Z

On Tue, Apr 21 2026 at 13:49, Peter Zijlstra wrote:
> On Tue, Apr 21, 2026 at 01:34:07PM +0200, Peter Zijlstra wrote:
>> > > > KVM invokes regular interrupts with pt_regs which have interrupts
>> > > > disabled. That's correct from the KVM point of view, but completely
>> > > > violates the obviously correct expectations of the interrupt entry/exit
>> > > > code.
>> > >
>> > > Mooo :-(
>>
>> Also, is this a x86/KVM 'special' or is this true for all arch/KVM that
>> use GENERIC_ENTRY?
>
> Should we not make asm_fred_entry_from_kvm()/VMX_DO_EVENT_IRQOFF fix IF
> on the fake frame instead? We know it will enable IRQs after doing
> handle_exit_irqoff() in vcpu_enter_guest().

Doesn't work :)

> SVM does not seem affected with this particular insanity.

Looks like. It will take the interrupt after local_irq_enable().

Now for VMX, that hrtimer_rearm_deferred() call should really go into
handle_external_interrupt_irqoff(), which in turn requires to export
__hrtimer_rearm_deferred().

But we can avoid that alltogether. Something like the untested below.

Thanks,

tglx
---
--- a/kernel/time/hrtimer.c
+++ b/kernel/time/hrtimer.c
@@ -42,9 +42,10 @@
#include <linux/timer.h>
#include <linux/freezer.h>
#include <linux/compat.h>
-
#include <linux/uaccess.h>

+#include <asm/irq_regs.h>
+
#include <trace/events/timer.h>

#include "tick-internal.h"
@@ -2062,11 +2063,16 @@ void __hrtimer_rearm_deferred(void)
static __always_inline void
hrtimer_interrupt_rearm(struct hrtimer_cpu_base *cpu_base, ktime_t expires_next)
{
- /* hrtimer_interrupt() just re-evaluated the first expiring timer */
- cpu_base->deferred_needs_update = false;
- /* Cache the expiry time */
- cpu_base->deferred_expires_next = expires_next;
- set_thread_flag(TIF_HRTIMER_REARM);
+ /* Lies, damned lies and virt */
+ if (likely(!regs_irqs_disabled(get_irq_regs()))) {
+ /* hrtimer_interrupt() just re-evaluated the first expiring timer */
+ cpu_base->deferred_needs_update = false;
+ /* Cache the expiry time */
+ cpu_base->deferred_expires_next = expires_next;
+ set_thread_flag(TIF_HRTIMER_REARM);
+ } else {
+ hrtimer_rearm(cpu_base, expires_next, false);
+ }
}
#else /* CONFIG_HRTIMER_REARM_DEFERRED */
static __always_inline void