Re: [PATCH] KVM: PPC: Book3S HV: Disable preemption around host-side HPT lock users

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
- [High] kvm: missing preempt_disable() in kvm_test_age_rmapp() leading to deadlock
--

commit dbd9d3f82d3dd2c11f69c26045433b125bc70408
Author: Amit Machhiwal <amachhiw@linux.ibm.com>

KVM: PPC: Book3S HV: Disable preemption around host-side HPT lock users

This commit disables preemption around host-side virtual-mode paths that
acquire HPTE_V_HVLOCK and lock_rmap(). This prevents a permanent CPU hang
where a preempted host thread holding either bit-lock blocks a spinning
guest vCPU thread.

> diff --git a/arch/powerpc/kvm/book3s_64_mmu_hv.c b/arch/powerpc/kvm/book3s_64_mmu_hv.c
> index 2ccb3d138f46c..8d85ce3440ae3 100644
> --- a/arch/powerpc/kvm/book3s_64_mmu_hv.c
> +++ b/arch/powerpc/kvm/book3s_64_mmu_hv.c
[ ... ]
> @@ -890,6 +913,7 @@ static bool kvm_age_rmapp(struct kvm *kvm, struct kvm_memory_slot *memslot,
>  
>  	rmapp = &memslot->arch.rmap[gfn - memslot->base_gfn];
>   retry:
> +	preempt_disable();
>  	lock_rmap(rmapp);

[Severity: High]
Does this same deadlock risk apply to kvm_test_age_rmapp()?

Looking at kvm_test_age_rmapp() in the same file, it also acquires
the spinning rmap bit-lock without explicitly disabling preemption:

arch/powerpc/kvm/book3s_64_mmu_hv.c:kvm_test_age_rmapp() {
	...
	lock_rmap(rmapp);
	if (*rmapp & KVMPPC_RMAP_REFERENCED)
		goto out;
	...
}

kvm_test_age_rmapp() is invoked via MMU notifiers (like
mmu_notifier_test_young) holding the PTE lock. Under PREEMPT_RT, the PTE
lock is sleepable and does not disable preemption, so lock_rmap() is
acquired in a preemptible context.

If a host thread holding this bit-lock is preempted, and a guest vCPU
thread on the same CPU executes a virtual-mode path like
kvmppc_virtmode_do_h_remove() (which disables preemption) and attempts to
acquire the same rmap lock via remove_revmap_chain(), could it spin
indefinitely without yielding?

>  	if (*rmapp & KVMPPC_RMAP_REFERENCED) {
>  		*rmapp &= ~KVMPPC_RMAP_REFERENCED;
[ ... ]

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20261014185215.71832-1-amachhiw@linux.ibm.com?part=1