s390/uv: Rework page allocation for guest variable storage area

[PATCH] s390/uv: Rework page allocation for guest variable storage area

Posted by Heiko Carstens 1 week, 2 days ago

Alexander Gordeev reported that the allocation of pages of the
guest variable storage area via the uv_alloc_range_cb() callback
of apply_to_page_range() will cause problems as soon as s390 fully
supports lazy mmu mode.

Problem is that uv_alloc_range_cb() allocates pages with GFP_KERNEL while
preemption would be disabled. This would result in reports like this:

 BUG: sleeping function called from invalid context at ./include/linux/sched/mm.h:322
 in_atomic(): 1, irqs_disabled(): 0, non_block: 0, pid: 6092, name: qemu-kvm
 preempt_count: 1, expected: 0
...
 Call Trace:
  dump_stack_lvl+0xae/0x108
  __might_resched+0x1de/0x2f0
  prepare_alloc_pages+0x1ba/0x220
  __alloc_frozen_pages_noprof+0xc6/0x390
  alloc_pages_mpol+0xe6/0x220
  alloc_frozen_pages_noprof+0x5c/0x80
  alloc_pages_noprof+0x22/0x80
  uv_alloc_range_cb+0x30/0x300
  apply_to_pte_range+0x11a/0x3b0
  apply_to_pmd_range+0x13a/0x250
  __apply_to_page_range+0x232/0x4d0
  apply_to_page_range+0x28/0x40
  uv_alloc_stor_var+0x5e/0x90
  kvm_s390_pv_alloc_vm+0x118/0x1e0 [kvm]
  kvm_s390_pv_init_vm+0x84/0x2e0 [kvm]
  kvm_s390_handle_pv+0x502/0xf70 [kvm]
  kvm_arch_vm_ioctl+0x234/0xdd0 [kvm]
  kvm_vm_ioctl+0x33a/0x890 [kvm]
  __s390x_sys_ioctl+0xfa/0x130
  __do_syscall+0x1fc/0x700
  system_call+0x72/0x90

Preallocate the pages and make use of vm_area_map_pages() to address this
potential future bug.

Reported-by: Alexander Gordeev <agordeev@linux.ibm.com>
Closes: https://lore.kernel.org/all/e9449c63-b8d2-4ed9-a184-7dcab3e8dfce-agordeev@linux.ibm.com
Signed-off-by: Heiko Carstens <hca@linux.ibm.com>
---

Notes:
    This is untested, and only based on the report from Alexander.

 arch/s390/kernel/uv.c | 41 +++++++++++++++++++++++------------------
 1 file changed, 23 insertions(+), 18 deletions(-)

diff --git a/arch/s390/kernel/uv.c b/arch/s390/kernel/uv.c
index dc14ebc0105b..3a01fc69cc3a 100644
--- a/arch/s390/kernel/uv.c
+++ b/arch/s390/kernel/uv.c
@@ -16,6 +16,7 @@
 #include <linux/swap.h>
 #include <linux/pagewalk.h>
 #include <linux/backing-dev.h>
+#include <linux/slab.h>
 #include <linux/vmalloc.h>
 #include <asm/facility.h>
 #include <asm/sections.h>
@@ -242,34 +243,38 @@ void uv_free_stor_var(void *stor_var)
 }
 EXPORT_SYMBOL_FOR_MODULES(uv_free_stor_var, "kvm");
 
-static int uv_alloc_range_cb(pte_t *ptep, unsigned long addr, void *data)
-{
-	struct page *page;
-	pte_t pte;
-
-	page = alloc_page(GFP_KERNEL_ACCOUNT | __GFP_ZERO);
-	if (!page)
-		return -ENOMEM;
-	pte = __pte(page_to_phys(page) | pgprot_val(PAGE_KERNEL));
-	set_pte(ptep, pte);
-	return 0;
-}
-
 void *uv_alloc_stor_var(unsigned long size)
 {
+	unsigned long i, nr_pages, addr;
 	struct vm_struct *area;
-	unsigned long addr;
+	struct page **pages;
 
 	size = PAGE_ALIGN(size);
+	nr_pages = size >> PAGE_SHIFT;
 	area = get_vm_area(size, VM_SPARSE);
 	if (!area)
 		return NULL;
+	pages = kvcalloc(nr_pages, sizeof(struct page *), GFP_KERNEL_ACCOUNT);
+	if (!pages)
+		goto free_area;
+	for (i = 0; i < nr_pages; i++) {
+		pages[i] = alloc_page(GFP_KERNEL_ACCOUNT | __GFP_ZERO);
+		if (!pages[i])
+			goto free_pages;
+	}
 	addr = (unsigned long)area->addr;
-	if (apply_to_page_range(&init_mm, addr, size, uv_alloc_range_cb, NULL))
-		goto out;
+	if (vm_area_map_pages(area, addr, addr + size, pages))
+		goto free_pages;
+	kvfree(pages);
 	return area->addr;
-out:
-	uv_free_stor_var(area->addr);
+free_pages:
+	for (i = 0; i < nr_pages; i++) {
+		if (pages[i])
+			__free_page(pages[i]);
+	}
+	kvfree(pages);
+free_area:
+	free_vm_area(area);
 	return NULL;
 }
 EXPORT_SYMBOL_FOR_MODULES(uv_alloc_stor_var, "kvm");
-- 
2.53.0

Re: [PATCH] s390/uv: Rework page allocation for guest variable storage area

Posted by Christian Borntraeger 2 days, 19 hours ago

Am 15.09.26 um 16:43 schrieb Heiko Carstens:
> Alexander Gordeev reported that the allocation of pages of the
> guest variable storage area via the uv_alloc_range_cb() callback
> of apply_to_page_range() will cause problems as soon as s390 fully
> supports lazy mmu mode.
> 
> Problem is that uv_alloc_range_cb() allocates pages with GFP_KERNEL while
> preemption would be disabled. This would result in reports like this:
> 
>   BUG: sleeping function called from invalid context at ./include/linux/sched/mm.h:322
>   in_atomic(): 1, irqs_disabled(): 0, non_block: 0, pid: 6092, name: qemu-kvm
>   preempt_count: 1, expected: 0
> ...
>   Call Trace:
>    dump_stack_lvl+0xae/0x108
>    __might_resched+0x1de/0x2f0
>    prepare_alloc_pages+0x1ba/0x220
>    __alloc_frozen_pages_noprof+0xc6/0x390
>    alloc_pages_mpol+0xe6/0x220
>    alloc_frozen_pages_noprof+0x5c/0x80
>    alloc_pages_noprof+0x22/0x80
>    uv_alloc_range_cb+0x30/0x300
>    apply_to_pte_range+0x11a/0x3b0
>    apply_to_pmd_range+0x13a/0x250
>    __apply_to_page_range+0x232/0x4d0
>    apply_to_page_range+0x28/0x40
>    uv_alloc_stor_var+0x5e/0x90
>    kvm_s390_pv_alloc_vm+0x118/0x1e0 [kvm]
>    kvm_s390_pv_init_vm+0x84/0x2e0 [kvm]
>    kvm_s390_handle_pv+0x502/0xf70 [kvm]
>    kvm_arch_vm_ioctl+0x234/0xdd0 [kvm]
>    kvm_vm_ioctl+0x33a/0x890 [kvm]
>    __s390x_sys_ioctl+0xfa/0x130
>    __do_syscall+0x1fc/0x700
>    system_call+0x72/0x90
> 
> Preallocate the pages and make use of vm_area_map_pages() to address this
> potential future bug.
> 
> Reported-by: Alexander Gordeev <agordeev@linux.ibm.com>
> Closes: https://lore.kernel.org/all/e9449c63-b8d2-4ed9-a184-7dcab3e8dfce-agordeev@linux.ibm.com
> Signed-off-by: Heiko Carstens <hca@linux.ibm.com>


Thanks applied. Will queue for the kvms390 tree after some CI runs.

Re: [PATCH] s390/uv: Rework page allocation for guest variable storage area

Posted by Alexander Gordeev 1 week ago

On Tue, Sep 15, 2026 at 04:43:07PM +0200, Heiko Carstens wrote:

Hi Heiko,
...
> +	for (i = 0; i < nr_pages; i++) {
> +		pages[i] = alloc_page(GFP_KERNEL_ACCOUNT | __GFP_ZERO);
> +		if (!pages[i])
> +			goto free_pages;
> +	}
...
> +	for (i = 0; i < nr_pages; i++) {
> +		if (pages[i])
> +			__free_page(pages[i]);
> +	}

Why not alloc_pages_bulk()/free_pages_bulk()?

Re: [PATCH] s390/uv: Rework page allocation for guest variable storage area

Posted by Heiko Carstens 1 week ago

On Thu, Sep 17, 2026 at 12:26:55PM +0200, Alexander Gordeev wrote:
> On Tue, Sep 15, 2026 at 04:43:07PM +0200, Heiko Carstens wrote:
> Hi Heiko,
> ...
> > +	for (i = 0; i < nr_pages; i++) {
> > +		pages[i] = alloc_page(GFP_KERNEL_ACCOUNT | __GFP_ZERO);
> > +		if (!pages[i])
> > +			goto free_pages;
> > +	}
> ...
> > +	for (i = 0; i < nr_pages; i++) {
> > +		if (pages[i])
> > +			__free_page(pages[i]);
> > +	}
> 
> Why not alloc_pages_bulk()/free_pages_bulk()?

That's because alloc_pages_bulk() contains this:

	/* Bulk allocator does not support memcg accounting. */
	if (memcg_kmem_online() && (gfp & __GFP_ACCOUNT))
		goto failed;

Which does not work with GFP_KERNEL_ACCOUNT.

Re: [PATCH] s390/uv: Rework page allocation for guest variable storage area

Posted by Alexander Gordeev 6 days, 19 hours ago

On Thu, Sep 17, 2026 at 09:35:40PM +0200, Heiko Carstens wrote:
> On Thu, Sep 17, 2026 at 12:26:55PM +0200, Alexander Gordeev wrote:
> > On Tue, Sep 15, 2026 at 04:43:07PM +0200, Heiko Carstens wrote:
> > Hi Heiko,
> > ...
> > > +	for (i = 0; i < nr_pages; i++) {
> > > +		pages[i] = alloc_page(GFP_KERNEL_ACCOUNT | __GFP_ZERO);
> > > +		if (!pages[i])
> > > +			goto free_pages;
> > > +	}
> > ...
> > > +	for (i = 0; i < nr_pages; i++) {
> > > +		if (pages[i])
> > > +			__free_page(pages[i]);
> > > +	}
> > 
> > Why not alloc_pages_bulk()/free_pages_bulk()?
> 
> That's because alloc_pages_bulk() contains this:
> 
> 	/* Bulk allocator does not support memcg accounting. */
> 	if (memcg_kmem_online() && (gfp & __GFP_ACCOUNT))
> 		goto failed;
> 
> Which does not work with GFP_KERNEL_ACCOUNT.

Thanks for the clarification!

Acked-by: Alexander Gordeev <agordeev@linux.ibm.com>