[PATCH] KVM: PPC: Book3S HV nestedv2: Don't drop pending doorbell across L2 entry

[PATCH] KVM: PPC: Book3S HV nestedv2: Don't drop pending doorbell across L2 entry

[Vaibhav Jain]

On nestedv2 the L1 converts a pending doorbell into guest DPDES state at
the top of kvmhv_vcpu_entry_nestedv2() and immediately forgets about it:

	if (vcpu->arch.doorbell_request) {
		vcpu->arch.doorbell_request = 0;
		kvmppc_set_dpdes(vcpu, 1);
	}

Clearing 'doorbell_request' at this point assumes that handing DPDES to the
L0 is equivalent to the L2 having taken the doorbell. That is not true, and
the doorbell can be lost in two ways:

  - The block runs before the lazy_irq_pending() check, so the doorbell is
    consumed even on the path that returns 0 without ever calling
    H_GUEST_RUN_VCPU.

  - DPDES stays pending in the L2 until it is actually delivered. The L2
    may exit for an unrelated reason (hcall, page fault, HDEC) with the
    doorbell still set, typically because it was running with MSR[EE]=0.
    Nothing reloads DPDES afterwards, so the L1 never learns this.

Once 'doorbell_request' has been cleared, the L1 has no record of the
pending doorbell. kvmppc_doorbell_pending() returns false, so
kvmppc_read_dpdes() reports the target thread as idle when a sibling vCPU
emulates 'mfspr DPDES', and the vCPU can be treated as having no work
pending and blocked. From the L2's point of view the doorbell is silently
lost, which shows up as an SMT guest hanging on a doorbell-based IPI.

Fix this by making 'doorbell_request' track the L2's DPDES rather than
being consumed by entry:

  - inject DPDES after the early-return paths and before
    kvmhv_nestedv2_flush_vcpu() serializes it into the vcpu run input
    buffer, and no longer clear 'doorbell_request' there,

  - after H_GUEST_RUN_VCPU, reload DPDES from the L0. The run output only
    carries the state the L0 chose to return and the 'valids' bitmap is
    zeroed on exit, so an explicit kvmhv_nestedv2_cached_reload() is
    needed to see the L2's current value,

  - if DPDES is still set the doorbell was not delivered, so keep
    'doorbell_request' pending so that it is re-injected on the next
    entry; otherwise clear it.

This keeps a pending doorbell visible to the L1 for as long as the L2 has
not consumed it, so vCPU wakeup and DPDES emulation on sibling vCPUs stay
consistent with the L2's actual state.

Fixes: 54ec2bd9e017 ("KVM: PPC: Book3S HV nestedv2: Fix doorbell emulation")
Signed-off-by: Vaibhav Jain <vaibhav@linux.ibm.com>
Assisted-by: Claude:Opus-5
---
 arch/powerpc/kvm/book3s_hv.c | 20 +++++++++++++++-----
 1 file changed, 15 insertions(+), 5 deletions(-)

diff --git a/arch/powerpc/kvm/book3s_hv.c b/arch/powerpc/kvm/book3s_hv.c
index 61dbeea317f3..40f8717b8a7d 100644
--- a/arch/powerpc/kvm/book3s_hv.c
+++ b/arch/powerpc/kvm/book3s_hv.c
@@ -15,6 +15,7 @@
  * by Alexander Graf <agraf@suse.de>.
  */
 
+#include "asm/guest-state-buffer.h"
 #include <linux/kvm_host.h>
 #include <linux/kernel.h>
 #include <linux/err.h>
@@ -4253,11 +4254,6 @@ static int kvmhv_vcpu_entry_nestedv2(struct kvm_vcpu *vcpu, u64 time_limit,
 	int trap;
 	long rc;
 
-	if (vcpu->arch.doorbell_request) {
-		vcpu->arch.doorbell_request = 0;
-		kvmppc_set_dpdes(vcpu, 1);
-	}
-
 	io = &vcpu->arch.nestedv2_io;
 
 	msr = mfmsr();
@@ -4265,6 +4261,9 @@ static int kvmhv_vcpu_entry_nestedv2(struct kvm_vcpu *vcpu, u64 time_limit,
 	if (lazy_irq_pending())
 		return 0;
 
+	if (vcpu->arch.doorbell_request)
+		kvmppc_set_dpdes(vcpu, 1);
+
 	rc = kvmhv_nestedv2_flush_vcpu(vcpu, time_limit);
 	if (rc < 0)
 		return -EINVAL;
@@ -4296,6 +4295,17 @@ static int kvmhv_vcpu_entry_nestedv2(struct kvm_vcpu *vcpu, u64 time_limit,
 	if (rc < 0)
 		return -EINVAL;
 
+	/* Check if privileged door bell was requested and handled */
+	if (vcpu->arch.vcore->dpdes) {
+		kvmhv_nestedv2_cached_reload(vcpu, KVMPPC_GSID_DPDES);
+		if (vcpu->arch.vcore->dpdes)
+			vcpu->arch.doorbell_request |= vcpu->arch.vcore->dpdes;
+		else
+			cpu->arch.doorbell_request = 0;
+	} else {
+		vcpu->arch.doorbell_request = 0;
+	}
+
 	timer_rearm_host_dec(*tb);
 
 	/* Record context switch and guest_run_time data */
-- 
2.55.0

Re: [PATCH] KVM: PPC: Book3S HV nestedv2: Don't drop pending doorbell across L2 entry

[sashiko-bot]

Thank you for your contribution! Sashiko AI review found 2 potential issue(s) to consider:
- [High] Concurrent doorbell requests from sibling vCPUs are silently lost due to unconditional clearing of `doorbell_request` on exit.
- [Low] Typo in variable name `cpu` instead of `vcpu` leads to an undeclared identifier and build failure.
--

--- Patch [1]: [PATCH] KVM: PPC: Book3S HV nestedv2: Don't drop pending doorbell across L2 entry ---
commit efc59a0f35293530907029b05624f01523b4f3ea
Author: Vaibhav Jain <vaibhav@linux.ibm.com>

KVM: PPC: Book3S HV nestedv2: Don't drop pending doorbell across L2 entry

This patch changes how pending doorbells are tracked during nestedv2 entry.
Instead of unconditionally consuming the doorbell on entry, it tracks the
L2's DPDES state and only clears the request if it was actually handled by
the L2.

Fixes: 54ec2bd9e017 ("KVM: PPC: Book3S HV nestedv2: Fix doorbell emulation")

> diff --git a/arch/powerpc/kvm/book3s_hv.c b/arch/powerpc/kvm/book3s_hv.c
> --- a/arch/powerpc/kvm/book3s_hv.c
> +++ b/arch/powerpc/kvm/book3s_hv.c

[ ... ]

> @@ -4296,6 +4295,17 @@ static int kvmhv_vcpu_entry_nestedv2(struct kvm_vcpu *vcpu, u64 time_limit,
>  	if (rc < 0)
>  		return -EINVAL;
>  
> +	/* Check if privileged door bell was requested and handled */
> +	if (vcpu->arch.vcore->dpdes) {
> +		kvmhv_nestedv2_cached_reload(vcpu, KVMPPC_GSID_DPDES);
> +		if (vcpu->arch.vcore->dpdes)
> +			vcpu->arch.doorbell_request |= vcpu->arch.vcore->dpdes;
> +		else
> +			cpu->arch.doorbell_request = 0;

[Severity: Low]
Is there a typo in this assignment?

Using cpu instead of vcpu here appears to cause a build failure due to an
undeclared identifier.

> +	} else {
> +		vcpu->arch.doorbell_request = 0;

[Severity: High]
Could this unconditional clear overwrite concurrent doorbell requests from
sibling vCPUs?

If a sibling vCPU executes msgsndp and sets doorbell_request to 1 while the
target vCPU is executing the L2 guest, that update might be lost.

When the target vCPU exits with vcpu->arch.vcore->dpdes == 0, this path
would wipe out any concurrent doorbell_request set by the sibling during the
guest's execution or exit process. Would this cause guest SMT threads to
miss IPIs and hang?

> +	}
> +
>  	timer_rearm_host_dec(*tb);

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260803034426.44249-1-vaibhav@linux.ibm.com?part=1