mirror of https://lore.kernel.org/lkml/
 help / color / mirror / Atom feed
From: Heiko Carstens <hca@linux.ibm.com>
To: Christian Borntraeger <borntraeger@linux.ibm.com>,
	Janosch Frank <frankja@linux.ibm.com>,
	Claudio Imbrenda <imbrenda@linux.ibm.com>,
	David Hildenbrand <david@kernel.org>
Cc: Vasily Gorbik <gor@linux.ibm.com>,
	Sven Schnelle <svens@linux.ibm.com>,
	Alexander Gordeev <agordeev@linux.ibm.com>,
	kvm@vger.kernel.org, linux-s390@vger.kernel.org,
	linux-kernel@vger.kernel.org
Subject: [PATCH] s390/uv: Rework page allocation for guest variable storage area
Date: Tue, 15 Sep 2026 16:43:07 +0200	[thread overview]
Message-ID: <20260915144307.2367089-1-hca@linux.ibm.com> (raw)

Alexander Gordeev reported that the allocation of pages of the
guest variable storage area via the uv_alloc_range_cb() callback
of apply_to_page_range() will cause problems as soon as s390 fully
supports lazy mmu mode.

Problem is that uv_alloc_range_cb() allocates pages with GFP_KERNEL while
preemption would be disabled. This would result in reports like this:

 BUG: sleeping function called from invalid context at ./include/linux/sched/mm.h:322
 in_atomic(): 1, irqs_disabled(): 0, non_block: 0, pid: 6092, name: qemu-kvm
 preempt_count: 1, expected: 0
...
 Call Trace:
  dump_stack_lvl+0xae/0x108
  __might_resched+0x1de/0x2f0
  prepare_alloc_pages+0x1ba/0x220
  __alloc_frozen_pages_noprof+0xc6/0x390
  alloc_pages_mpol+0xe6/0x220
  alloc_frozen_pages_noprof+0x5c/0x80
  alloc_pages_noprof+0x22/0x80
  uv_alloc_range_cb+0x30/0x300
  apply_to_pte_range+0x11a/0x3b0
  apply_to_pmd_range+0x13a/0x250
  __apply_to_page_range+0x232/0x4d0
  apply_to_page_range+0x28/0x40
  uv_alloc_stor_var+0x5e/0x90
  kvm_s390_pv_alloc_vm+0x118/0x1e0 [kvm]
  kvm_s390_pv_init_vm+0x84/0x2e0 [kvm]
  kvm_s390_handle_pv+0x502/0xf70 [kvm]
  kvm_arch_vm_ioctl+0x234/0xdd0 [kvm]
  kvm_vm_ioctl+0x33a/0x890 [kvm]
  __s390x_sys_ioctl+0xfa/0x130
  __do_syscall+0x1fc/0x700
  system_call+0x72/0x90

Preallocate the pages and make use of vm_area_map_pages() to address this
potential future bug.

Reported-by: Alexander Gordeev <agordeev@linux.ibm.com>
Closes: https://lore.kernel.org/all/e9449c63-b8d2-4ed9-a184-7dcab3e8dfce-agordeev@linux.ibm.com
Signed-off-by: Heiko Carstens <hca@linux.ibm.com>
---

Notes:
    This is untested, and only based on the report from Alexander.

 arch/s390/kernel/uv.c | 41 +++++++++++++++++++++++------------------
 1 file changed, 23 insertions(+), 18 deletions(-)

diff --git a/arch/s390/kernel/uv.c b/arch/s390/kernel/uv.c
index dc14ebc0105b..3a01fc69cc3a 100644
--- a/arch/s390/kernel/uv.c
+++ b/arch/s390/kernel/uv.c
@@ -16,6 +16,7 @@
 #include <linux/swap.h>
 #include <linux/pagewalk.h>
 #include <linux/backing-dev.h>
+#include <linux/slab.h>
 #include <linux/vmalloc.h>
 #include <asm/facility.h>
 #include <asm/sections.h>
@@ -242,34 +243,38 @@ void uv_free_stor_var(void *stor_var)
 }
 EXPORT_SYMBOL_FOR_MODULES(uv_free_stor_var, "kvm");
 
-static int uv_alloc_range_cb(pte_t *ptep, unsigned long addr, void *data)
-{
-	struct page *page;
-	pte_t pte;
-
-	page = alloc_page(GFP_KERNEL_ACCOUNT | __GFP_ZERO);
-	if (!page)
-		return -ENOMEM;
-	pte = __pte(page_to_phys(page) | pgprot_val(PAGE_KERNEL));
-	set_pte(ptep, pte);
-	return 0;
-}
-
 void *uv_alloc_stor_var(unsigned long size)
 {
+	unsigned long i, nr_pages, addr;
 	struct vm_struct *area;
-	unsigned long addr;
+	struct page **pages;
 
 	size = PAGE_ALIGN(size);
+	nr_pages = size >> PAGE_SHIFT;
 	area = get_vm_area(size, VM_SPARSE);
 	if (!area)
 		return NULL;
+	pages = kvcalloc(nr_pages, sizeof(struct page *), GFP_KERNEL_ACCOUNT);
+	if (!pages)
+		goto free_area;
+	for (i = 0; i < nr_pages; i++) {
+		pages[i] = alloc_page(GFP_KERNEL_ACCOUNT | __GFP_ZERO);
+		if (!pages[i])
+			goto free_pages;
+	}
 	addr = (unsigned long)area->addr;
-	if (apply_to_page_range(&init_mm, addr, size, uv_alloc_range_cb, NULL))
-		goto out;
+	if (vm_area_map_pages(area, addr, addr + size, pages))
+		goto free_pages;
+	kvfree(pages);
 	return area->addr;
-out:
-	uv_free_stor_var(area->addr);
+free_pages:
+	for (i = 0; i < nr_pages; i++) {
+		if (pages[i])
+			__free_page(pages[i]);
+	}
+	kvfree(pages);
+free_area:
+	free_vm_area(area);
 	return NULL;
 }
 EXPORT_SYMBOL_FOR_MODULES(uv_alloc_stor_var, "kvm");
-- 
2.53.0


                 reply	other threads:[~2026-09-15 14:43 UTC|newest]

Thread overview: [no followups] expand[flat|nested]  mbox.gz  Atom feed

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=20260915144307.2367089-1-hca@linux.ibm.com \
    --to=hca@linux.ibm.com \
    --cc=agordeev@linux.ibm.com \
    --cc=borntraeger@linux.ibm.com \
    --cc=david@kernel.org \
    --cc=frankja@linux.ibm.com \
    --cc=gor@linux.ibm.com \
    --cc=imbrenda@linux.ibm.com \
    --cc=kvm@vger.kernel.org \
    --cc=linux-kernel@vger.kernel.org \
    --cc=linux-s390@vger.kernel.org \
    --cc=svens@linux.ibm.com \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox

all inboxes | Powered by JetHome®