From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from mail-pg1-f172.google.com (mail-pg1-f172.google.com [209.85.215.172]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 5265B1E885A for ; Thu, 2 Apr 2026 01:31:30 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=209.85.215.172 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1775093491; cv=none; b=mVxI4KWSyKv+Jzt1UKfdykispy43yTB5n0F/mqOwZcHSPUcgNPqb3tJX0WMRCaTC9DZvWTYQF4E4UIhADWVqOifZjzpVCCGbTyBZDfeG3ndixZeV9IL2Zxp6UDaRJF0fbyL9BeKe9prsImGReo8OvqZwhb/VQehXGYzZQ0jLX0s= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1775093491; c=relaxed/simple; bh=CmiCJDKKLtVBWY4PaNZhE3phmXu2DbyTzXQix20TwNc=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=fz9IW6ywWpJk1IJ/bPCxa467VKSbRz1QrcVHa4Nxl2SfICqQUjGh5y1/PAbgX8ycZymzFh5lCvm4Bd33fP0sf88d3J77kvkv4fHCDoyXppCwwgJPcMwKiro1pBiFuJtzsoMtzefkH4apkOkY4V3I5G5o64LrCwPG/17HarQzES8= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com; spf=pass smtp.mailfrom=gmail.com; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b=arTX9ihX; arc=none smtp.client-ip=209.85.215.172 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=gmail.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b="arTX9ihX" Received: by mail-pg1-f172.google.com with SMTP id 41be03b00d2f7-c76b6abdb73so229662a12.1 for ; Wed, 01 Apr 2026 18:31:30 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20251104; t=1775093490; x=1775698290; darn=vger.kernel.org; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:from:to:cc:subject:date :message-id:reply-to; bh=hAh0rZ9dUNksvKcTzl6dU2+Jr09vS06UeooC9PWMHnQ=; b=arTX9ihXtJTrVUYOrC/416+TIEj0MtY2aLqTZD8Ebcm3HXb3OvUe26VXAmmPA4PnBA LAfGHNDdei3k+qFacnuMAbL1/G2hHuWC6ChDLlKgIk6wekQOxePfzLxjrCbkEUiO4ARq uov3PTUG7Qb84THccOJYcuzVHZFoRvt3T4pNlWWEiAkM/BpGH9pyYWBNhVsrkaex76f1 9Yy4i6roTjiGZlVYy68cO59IIXXMScem7+I5ntWbdFS8P7KgOFMbN30ObosNlw5CNN3v wDOV5QI/Sp4kQ7J0V8YVBc8iSkQuUqGbeOGT4woyFfmyfyqHnwVIqeRU34tk1WY0nm9V L3kA== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1775093490; x=1775698290; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:x-gm-gg:x-gm-message-state:from :to:cc:subject:date:message-id:reply-to; bh=hAh0rZ9dUNksvKcTzl6dU2+Jr09vS06UeooC9PWMHnQ=; b=DXvZG5J9Jn+G9esDWKtNZUJZ7fm14ILl842Eg6zHhyG+hlGdbXP+PQsi2fTUmCPHSx OapeFbyFuM8/6YB+SfWVD8ZDZKDwCdpKGSCrGobEeFKJAJL5iOwkh5fFwZJooRf2coG/ SVUohrLCvS6RhOGjPl9LJxXNvmAsRuBk2igo7lmeLMTww/qVk8aAL0U6XNY22Y0jG+P9 RgBePA6MD7ykGza8vRADc9RmFEmceNvrPMX2i5GZT0b9awvRLGWTq5NKCBXTeEphj9wf Ci6bqPC0JSEcpGGiUsGCpXjD6rNxl9iahbX644d33EE852jXEZ5CNw2T5KN0cKbyI6Ho rR7A== X-Forwarded-Encrypted: i=1; AJvYcCVQuu6sFwMCl9FWeNoBXzn0k/zIidRgRGep9Op9dDtsrO/tW8kBpGo7KTlEZD0Am+FlXZVcSVjRP/su9bU=@vger.kernel.org X-Gm-Message-State: AOJu0YzygwiZCgrhwruPdRiohLUrs/44Bz1HqSt77GsBQFN9QjupAmrR ac1L4HV64rCf98XcB60NSdV9BoHB7LbF9R8BPeQkiH72hGr0ejxCX0xR X-Gm-Gg: ATEYQzz9vnWZ4bQ1BbG6J//1VJWasqF1xwNyR9d0DhBdaowhYaV95jo30vmeSEN8M24 97YstlBljaymwPzzClA8SkCrz/ao3/8O54xNzJRx3OZXQKQ+fRRNKpuHHzyrU9uRhdNztF8mxGL I6QN6peI9OczxKZeDKwBFcPc0qVOWGaO6ANFlmQnyxoBswpejxduVwyMAMACroOjr6j9r8Ka8CE gJI/Tqsai7S9gtyxF9lqj+hj0oCWWRQ/zm91a+A/2Gk8wQ97T+gTJJbLzUgef9ObbB6F+K0Gqpm cDUp1F+wyuYmjakNxZ+caytORYlR48VM9tCZpgwuRH2HDmxrm0bHT6TX6FrN0u/OP61Q/MNWbCP GPkG7I0O8rq6X4kgffdf1wEtdPjxb7V8IxOKvPkriTfm43SzcQrXmSUFQSmWEevqgw2slv5tZ6s HLrDubsOh3ufS/McUeuLjXIEnxJzH2SDvP1UwJgl8= X-Received: by 2002:a05:6a20:394f:b0:398:8026:4811 with SMTP id adf61e73a8af0-39ef77372d3mr6463370637.35.1775093489688; Wed, 01 Apr 2026 18:31:29 -0700 (PDT) Received: from acer-nitro-anv15-41.. ([27.4.76.112]) by smtp.gmail.com with ESMTPSA id d2e1a72fcca58-82cf9c41b8dsm1091851b3a.34.2026.04.01.18.31.25 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Wed, 01 Apr 2026 18:31:29 -0700 (PDT) From: "shaikh.kamal" To: "H. Peter Anvin" , Paul Durrant , Sean Christopherson , David Woodhouse , kvm@vger.kernel.org, linux-kernel@vger.kernel.org, linux-rt-devel@lists.linux.dev Cc: pbonzini@redhat.com, skhan@linuxfoundation.org, me@brighamcampbell.com, syzbot+919877893c9d28162dc2@syzkaller.appspotmail.com, "shaikh.kamal" Subject: [PATCH v2 1/1] KVM: x86/xen: Use trylock for fast path event channel delivery Date: Thu, 2 Apr 2026 07:01:02 +0530 Message-ID: <20260402013102.21951-1-shaikhkamal2012@gmail.com> X-Mailer: git-send-email 2.43.0 In-Reply-To: References: Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: 8bit kvm_xen_set_evtchn_fast() acquires gpc->lock with read_lock_irqsave(), which becomes a sleeping lock on PREEMPT_RT, triggering: BUG: sleeping function called from invalid context in_hardirq(): 1, in_serving_softirq(): 0 Call Trace: rt_spin_lock+0x70/0x130 kvm_xen_set_evtchn_fast+0x20b/0xa40 xen_timer_callback+0x91/0x1a0 __run_hrtimer hrtimer_interrupt when called from hard IRQ context (e.g., hrtimer callback). The function uses read_lock_irqsave() to access two gpc structures: shinfo_cache and vcpu_info_cache. On PREEMPT_RT, these rwlocks are rt_mutex-based and cannot be acquired from hard IRQ context. Use read_trylock() instead for both gpc lock acquisitions. If either lock is contended, return -EWOULDBLOCK to trigger the existing slow path: xen_timer_callback() sets vcpu->arch.xen.timer_pending, kicks the vCPU with KVM_REQ_UNBLOCK, and the event gets injected from process context via kvm_xen_inject_timer_irqs(). This approach works on all kernels (RT and non-RT) and preserves the "fast path" semantics: acquire the lock only if immediately available, otherwise bail out rather than blocking. Reported-by: syzbot+919877893c9d28162dc2@syzkaller.appspotmail.com Closes: https://syzkaller.appspot.com/bug?extid=919877893c9d28162dc2 Fixes: 77c9b9dea4fb ("KVM: x86/xen: Use fast path for Xen timer delivery") Suggested-by: Sean Christopherson Signed-off-by: shaikh.kamal --- arch/x86/kvm/xen.c | 33 +++++++++++++++++++++++++++++---- 1 file changed, 29 insertions(+), 4 deletions(-) diff --git a/arch/x86/kvm/xen.c b/arch/x86/kvm/xen.c index d6b2a665b499..479e8f23a9c4 100644 --- a/arch/x86/kvm/xen.c +++ b/arch/x86/kvm/xen.c @@ -1817,7 +1817,17 @@ int kvm_xen_set_evtchn_fast(struct kvm_xen_evtchn *xe, struct kvm *kvm) idx = srcu_read_lock(&kvm->srcu); - read_lock_irqsave(&gpc->lock, flags); + /* + * Use trylock for the "fast" path. If the lock is contended, + * return -EWOULDBLOCK to use the slow path which injects the + * event from process context via timer_pending + KVM_REQ_UNBLOCK. + */ + local_irq_save(flags); + if (!read_trylock(&gpc->lock)) { + local_irq_restore(flags); + srcu_read_unlock(&kvm->srcu, idx); + return -EWOULDBLOCK; + } if (!kvm_gpc_check(gpc, PAGE_SIZE)) goto out_rcu; @@ -1848,10 +1858,22 @@ int kvm_xen_set_evtchn_fast(struct kvm_xen_evtchn *xe, struct kvm *kvm) } else { rc = 1; /* Delivered to the bitmap in shared_info. */ /* Now switch to the vCPU's vcpu_info to set the index and pending_sel */ - read_unlock_irqrestore(&gpc->lock, flags); + read_unlock(&gpc->lock); + local_irq_restore(flags); gpc = &vcpu->arch.xen.vcpu_info_cache; - read_lock_irqsave(&gpc->lock, flags); + local_irq_save(flags); + if (!read_trylock(&gpc->lock)) { + /* + * Lock contended. Set the in-kernel pending flag + * and kick the vCPU to inject via the slow path. + */ + local_irq_restore(flags); + if (!test_and_set_bit(port_word_bit, + &vcpu->arch.xen.evtchn_pending_sel)) + kick_vcpu = true; + goto out_kick; + } if (!kvm_gpc_check(gpc, sizeof(struct vcpu_info))) { /* * Could not access the vcpu_info. Set the bit in-kernel @@ -1885,7 +1907,10 @@ int kvm_xen_set_evtchn_fast(struct kvm_xen_evtchn *xe, struct kvm *kvm) } out_rcu: - read_unlock_irqrestore(&gpc->lock, flags); + read_unlock(&gpc->lock); + local_irq_restore(flags); + + out_kick: srcu_read_unlock(&kvm->srcu, idx); if (kick_vcpu) { -- 2.43.0