[PATCH] KVM: riscv: Set Accessed bit in dirty-log write fault fast path

[Anup Patel]

On Fri, Oct 16, 2026 at 3:45 PM SeungJu Cheon <suunj1331 at gmail.com> wrote:
>
> kvm_riscv_mmu_dirty_log_write_fault_fast() considers a leaf with W
> and D set already handled, even if aging has cleared its A bit.
> On hardware that faults when A is clear, the fast path returns
> true without setting A and skips the slow path that would set it.
> The guest retries the same store, but A is still clear, so it
> faults again. This repeats indefinitely, preventing the guest
> from making progress.
>
> Host reclaim or page_idle can trigger this while dirty logging is
> enabled, potentially hanging vCPUs during live migration.
>
> Require _PAGE_ACCESSED in addition to W and D before treating the
> fault as handled, and set A along with W and D. The existing
> cmpxchg loop retries if aging changes the PTE before the update.
>
> Fixes: 7705be59eb2d ("KVM: riscv: Fast-path dirty logging write faults")
> Cc: stable at vger.kernel.org # 7.2+
> Signed-off-by: SeungJu Cheon <suunj1331 at gmail.com>

LGTM.

Reviewed-by: Anup Patel <anup at brainfault.org>

Queued this patch as a fix for Linux-7.4-rcX

Thanks,
Anup

> ---
> Testing:
>
> On a HiFive Premier P550 (EIC7700X, which traps on clear A/D bits),
> run:
>
> dirty_log_perf_test -v 3 -b 256M -i 3
>
> While the test runs, repeatedly mark all system RAM idle through
> /sys/kernel/mm/page_idle/bitmap.
>
> Before the fix, the test did not complete its first iteration in
> over 11 minutes, with lock_stat showing about 16k read-side
> mmu_lock acquisitions per second from the fast path.
>
> After the fix, all three iterations complete, each taking about
> 29 seconds under the same aging workload.
>
>  arch/riscv/kvm/mmu.c | 7 ++++---
>  1 file changed, 4 insertions(+), 3 deletions(-)
>
> diff --git a/arch/riscv/kvm/mmu.c b/arch/riscv/kvm/mmu.c
> index 78a1826c466d..042d1e3b3547 100644
> --- a/arch/riscv/kvm/mmu.c
> +++ b/arch/riscv/kvm/mmu.c
> @@ -591,14 +591,15 @@ static bool kvm_riscv_mmu_dirty_log_write_fault_fast(struct kvm *kvm,
>                         dirty_marked = true;
>                 }
>
> -               if ((pte_val(old_pte) & (_PAGE_WRITE | _PAGE_DIRTY)) ==
> -                   (_PAGE_WRITE | _PAGE_DIRTY)) {
> +               if ((pte_val(old_pte) &
> +                    (_PAGE_WRITE | _PAGE_DIRTY | _PAGE_ACCESSED)) ==
> +                   (_PAGE_WRITE | _PAGE_DIRTY | _PAGE_ACCESSED)) {
>                         new_pte = old_pte;
>                         ret = true;
>                         break;
>                 }
>
> -               new_pte = pte_mkdirty(pte_mkwrite_novma(old_pte));
> +               new_pte = pte_mkyoung(pte_mkdirty(pte_mkwrite_novma(old_pte)));
>
>                 if (kvm_riscv_gstage_try_update_pte(&gstage, ptep_level, gpa,
>                                                     ptep, old_pte, new_pte)) {
> --
> 2.52.0
>