From nobody Sat Jul 25 00:56:31 2026 Received: from mail-pl1-f172.google.com (mail-pl1-f172.google.com [209.85.214.172]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 2DFF04921B3 for ; Tue, 21 Jul 2026 10:35:37 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=209.85.214.172 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1784630138; cv=none; b=LEqbXG99V9JWMDEuwnCpIFJUcve1IF5JEPJ0gvlOXosjCm3ym1Q62HKCe7wDnLO1ztr8mte9XWHdXoQQgaC8A7TsnUGAZrwJjy02UtC2kRi4s+RXvcrWZ8jKE7q3RpLMvzJQTEtWUTCjOqJEmrIn/c5GSs1A4WUUC+hy+++aiYw= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1784630138; c=relaxed/simple; bh=P4KaCyidpJ+KrhrI8crT36+kmGtOpJrHs7dj1bFXusI=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=e6rQiGPB4BmqsMrohQM6UToDiCoiBw6D2yIvTnh4YjTR+HL9AKbtNrfDi3oKsTIspJdFomINWJaezk0mpBSZ5uaqjiMmbxfk7Qe8A7Ns15gZFLTFDyV+hyNqT5VUQ3JhN/M5/o+aatilHsFr9nrRxEryXj9fLKRELG7c48bllzU= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com; spf=pass smtp.mailfrom=gmail.com; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b=qFYoxv2R; arc=none smtp.client-ip=209.85.214.172 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=gmail.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b="qFYoxv2R" Received: by mail-pl1-f172.google.com with SMTP id d9443c01a7336-2ce7d2adef4so111159295ad.3 for ; Tue, 21 Jul 2026 03:35:37 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20251104; t=1784630137; x=1785234937; darn=vger.kernel.org; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:from:to:cc:subject:date :message-id:reply-to:content-type; bh=XtZKBcBFnGPQ7JWiOze8zVf2sEShewULwmU/poxZWO8=; b=qFYoxv2RRI43ewi8eobUt8BWLqLV8J6klMbcltJIccVLXJztHQJmIbXBSy8eohUR7a wyjMoOEVwCXcOvgVxG7Ru6+MnhrfBwiFZCIaXQW7NMk4FtM6CxhZ9Q9K15w9lRNxQYMV RXExbtdLwe4wmwVmLZuFCrOxeUkKv5/J/reLQSLlGQQebY0y3j8AK4k8tfDAvWX9He2p TbJCBTguCcYvG99EFnr6YKI0m6Ha9igUw5nP52yPldde5TvCMNlwYd00k4qiqYdABYm+ wKLAOmWhCgd1QEWLXtXTgG1xMbfqBLpmDzTK/8YvKE/f+W9Q93FSomDdeJVipoor089a fwJg== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1784630137; x=1785234937; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:x-gm-gg:x-gm-message-state:from :to:cc:subject:date:message-id:reply-to:content-type; bh=XtZKBcBFnGPQ7JWiOze8zVf2sEShewULwmU/poxZWO8=; b=HMEHpdFmEHsUw/MbRY20WyXWfwGqiqntwXrjjfxvxGNW6mhwFVBRMT3sPGlOro7tTy g55xasjSXXxFRBuNMv6q2qlhJz/MgXeyUe9oEC2YoJQRy6ZpS++wqXJ6FnwhBaCeVf0u ZcAjRA+CKd6DcP5BjMVchByiiRwescFjc3lRFqqHspnHg22j79T33r3A6GrWR+PNnLJn Edg14Gd1Sud9RcyM6lHqDw3QWr1xk+mReOO/kXh+jwL/OkXqtNe/WhtKwdXCWFi/LAwf 1h8Y6SPaOxgMAC8ZUp5ihDoY42siglj8vhhG+WKc97BuNLhPCFq44on+bq9mhuwR8u/e H0xg== X-Forwarded-Encrypted: i=1; AHgh+RplbHgozxMJ3axD4X0T4Ek9hyVv8lABgLDOD18Kv+Rz01INiLMSkxuggBR5Rb1tvhBhulbJ3tmwkZYeCrE=@vger.kernel.org X-Gm-Message-State: AOJu0YyQrRhL1HeARkTuOlASZsMiATN4YT5inNZlDVkIz552LMEXtl1R o1+uZwPI+1Xyl8I7mPZrktlHI3Z8y8e4j0E13UYVFpz1sOCvBgzL5G9mLxAIAkD0RKU= X-Gm-Gg: AR+sD13Mn8d9BQU78owNjVySS4xu0G7EJEhQEhK9DO/cjOOsgI6FUPeLY+1Tx0kopxm MqEpC3cNgbdaF0mDiKWN4Brn27jypFbR6cJGBUmQJmqIJeAK3ntuTF8rcwsgm2PYtCUeB5rWbnW e7LWECEVQvVKUORP+i9YNwbIbRKV60CBSd3+edxfZm47AM+lDjlndUwuzj8TeczOCWWGwfh5208 IGKlCF/JunfU/ANSJ63j94Nufeu5otWIhh4vXB7Vl87I0WfQYvbXa2MvoWtwB4WHzVKmFscJnOn vmV6gtobiv5iwETF87CjXeLpSl1S0PRwUd4aYJ9+PusPV+eMRsrD4U0j1Q0jreIq0uniiDlyDlF /ifIxUlJlQuO3LWql0sxaQFCz0PhzdZZiPEi3s2xpo8HzOQfLG65Y1lb0R5rORwU0MrYe9824sl IVvadozc5T8lkPG8YsUnwVig== X-Received: by 2002:a17:903:24f:b0:2c9:e9c4:82c1 with SMTP id d9443c01a7336-2cf3494af9fmr198445645ad.26.1784630136491; Tue, 21 Jul 2026 03:35:36 -0700 (PDT) Received: from localhost.localdomain ([124.194.218.202]) by smtp.gmail.com with ESMTPSA id d9443c01a7336-2cf3476ba24sm72240715ad.75.2026.07.21.03.35.34 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Tue, 21 Jul 2026 03:35:36 -0700 (PDT) From: Jinu Kim To: Sean Christopherson Cc: Paolo Bonzini , kvm@vger.kernel.org, linux-kernel@vger.kernel.org Subject: [PATCH v2 1/2] KVM: x86/mmu: Check write tracking in all address spaces Date: Tue, 21 Jul 2026 19:35:11 +0900 Message-ID: <20260721103512.2136240-2-kimjw04271234@gmail.com> X-Mailer: git-send-email 2.43.0 In-Reply-To: <20260721103512.2136240-1-kimjw04271234@gmail.com> References: <20260721103512.2136240-1-kimjw04271234@gmail.com> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset="utf-8" kvm_gfn_is_write_tracked() checks only the supplied memslot, but page tracking is per-address-space and shadow pages are shared across all address spaces. With SMM, a GFN can therefore be write-tracked in one address space and appear untracked through the other. Check the supplied slot first, then the slot for the other address space. This ensures all callers honor write tracking regardless of the active address space. In particular, it prevents mmu_try_to_unsync_pages() from marking an upper-level shadow page unsync and eventually triggering the BUG in pte_list_remove(). Fixes: 699023e23965 ("KVM: x86: add SMM to the MMU role, support SMRAM addr= ess space") Assisted-by: Codex:GPT-5 Signed-off-by: Jinu Kim --- arch/x86/kvm/mmu/page_track.c | 26 +++++++++++++++++++++++--- 1 file changed, 23 insertions(+), 3 deletions(-) diff --git a/arch/x86/kvm/mmu/page_track.c b/arch/x86/kvm/mmu/page_track.c index 1b17b12393a8c..ff93591be1adb 100644 --- a/arch/x86/kvm/mmu/page_track.c +++ b/arch/x86/kvm/mmu/page_track.c @@ -133,10 +133,22 @@ void __kvm_write_track_remove_gfn(struct kvm *kvm, /* * check if the corresponding access on the specified guest page is tracke= d. */ +static bool __kvm_gfn_is_write_tracked(const struct kvm_memory_slot *slot, + gfn_t gfn) +{ + int index; + + if (!slot) + return false; + + index =3D gfn_to_index(gfn, slot->base_gfn, PG_LEVEL_4K); + return !!READ_ONCE(slot->arch.gfn_write_track[index]); +} + bool kvm_gfn_is_write_tracked(struct kvm *kvm, const struct kvm_memory_slot *slot, gfn_t gfn) { - int index; + const struct kvm_memory_slot *other_slot; =20 if (!slot) return false; @@ -144,8 +156,16 @@ bool kvm_gfn_is_write_tracked(struct kvm *kvm, if (!kvm_page_track_write_tracking_enabled(kvm)) return false; =20 - index =3D gfn_to_index(gfn, slot->base_gfn, PG_LEVEL_4K); - return !!READ_ONCE(slot->arch.gfn_write_track[index]); + BUILD_BUG_ON(KVM_MAX_NR_ADDRESS_SPACES > 2); + + if (__kvm_gfn_is_write_tracked(slot, gfn)) + return true; + + if (kvm_arch_nr_memslot_as_ids(kvm) =3D=3D 1) + return false; + + other_slot =3D __gfn_to_memslot(__kvm_memslots(kvm, slot->as_id ^ 1), gfn= ); + return __kvm_gfn_is_write_tracked(other_slot, gfn); } =20 #ifdef CONFIG_KVM_EXTERNAL_WRITE_TRACKING base-commit: 6bc96b971766fbbbbdd9fb2642cedacaf02da957 --=20 2.43.0 From nobody Sat Jul 25 00:56:31 2026 Received: from mail-pl1-f172.google.com (mail-pl1-f172.google.com [209.85.214.172]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 6B79E4C954E for ; Tue, 21 Jul 2026 10:35:39 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=209.85.214.172 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1784630140; cv=none; b=EjYPLABQZ0leG88zw+ZPCW3JK3gMT7DT2l2lfEJ0+zZIFBfBLKlq6EyhUO5dCJTlz9xZIfkXwvjvmvQxjbR206ImPuuIf7HeoJvoCFRLrNaeMlhRoR3RTxSbzs1IAJPikOfevg3j/IRexzto0VCxSafS47Qt8s8BYgOVLmYu0to= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1784630140; c=relaxed/simple; bh=nVrRFr7SXPIbywSEEfW3Ni8u2i1dZH0gp2i8DA7u3d0=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=uFCbZct+F1jjcvLbfHrMHYFa8JRmMlcXuk74Zhw3xu0kO4QQK4mvxClN4JvaWUAZ4bwMZxnReI8VZxZuPam19ORRSinaPasLN1EkrbJNixJNepVQ50WRMANmQYKiW8Rbo3nYmCffa9v8ct2NuJzEjd9svcFWEQsGShc4RShU/WU= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com; spf=pass smtp.mailfrom=gmail.com; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b=JcYpCXqV; arc=none smtp.client-ip=209.85.214.172 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=gmail.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b="JcYpCXqV" Received: by mail-pl1-f172.google.com with SMTP id d9443c01a7336-2cca0c5799eso88423005ad.0 for ; Tue, 21 Jul 2026 03:35:39 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20251104; t=1784630139; x=1785234939; darn=vger.kernel.org; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:from:to:cc:subject:date :message-id:reply-to:content-type; bh=Xyu85tVI7qhkAhG73qiWVn5ZsmTezNl/fK8tiEf0dEU=; b=JcYpCXqVhmbhUPRfEFlQsXu4Hr3UQ/x4hvcuX/9UoxgZ1N+INNc6Tq+i50P3gT+bxq kMdDnZzrjL+tG8+2B8XbQG35Q8GRn1mQ3xDcMwWEKJR++Y93RfBNtBo32pan0xnUqrZu Y2zEiYKLcxxFlHJITPf3s6iUwOrhroNMQH+m+FkqgYWKLf6RihrGlX+OniMmBiHG/jG5 9dlgCtAJh14fL8GUpHxCnjZiSpxG+ZXv/EqRZaJCS6Wb2XQKSlgF8UqUNJAjKV6A+SbH HU9WAaLyortIctXTIHP+2q5e3XMjq5vs4jV/DuC6eTTv/EWzX16i/Tx0zOkKo6J/+LZz DmVg== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1784630139; x=1785234939; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:x-gm-gg:x-gm-message-state:from :to:cc:subject:date:message-id:reply-to:content-type; bh=Xyu85tVI7qhkAhG73qiWVn5ZsmTezNl/fK8tiEf0dEU=; b=qJFgWDfreDtRCyrZ3oOgBy0e2tGBhrFPu9YjNf21Y40gJjN3kGiP4TSAd+gMwYvmPx IGqrYKwQN4Dj6/FLgGiyODQo4jV8G1NnnRF3Du3EEBweyUrY3wpdxdsI8f6APXWtXwMG LfGxFVAdaFsCjgzi7eFvRghYw+ubuuELug+gkSgY61u2CsDRaEAD+Yv/1sQySyXPLzRP wFacIwdllxxrq/QKXthGihJGgNAERfb1CMJZODUhAR9nUodoLPv2R4qMpe/0sZrp5gDQ FwsVKq3eZTpWoUlzCWnfZTBGj6Y9703qa2mL1aq3GtMeeIWX8bYdkHYkjCbW/J253luf TQHQ== X-Forwarded-Encrypted: i=1; AHgh+RqAo1wUuvdrdNArrWgpdX9h9ukyi6mLNPSiH7MokRfwQayM6bnEPPdzmpfsXNlBrnbnpe0JPRBVCP/n/rQ=@vger.kernel.org X-Gm-Message-State: AOJu0YzRHRO/iCv4SvD6EMMKOA547Fzra7yeDDWbepBZp46GRVIy+Y0V VaPNTSILDsCupUtxPjJ4I7GK3hF3L7wz0KbeUHzPjPQdWfhvEiSlaePa X-Gm-Gg: AR+sD101Z1+X5ocDNDHS8PReiVIJEbzUncOm4wKg+LqXccCQI8l6RHlW/5pvIm/KQOU oYleKnxiI+ynv3K6Agx/fd58K6BigImG65brYuxUA1FemybW1KbRfq+16NISfll5Ruao6L85upI IxzBnB48EBJTK2g0W0WscS5Diu5g1AAFzLj5AyKUgjmKw8TXxoEXObjqgWMXCM6YaDHjZdvou1W 4s/kDXSv88d6sHxxha2ENuNaVxI8o8TPk7Pz5HATpbAm10YjUFWNHapnWBMSWG6iLvAqM+WAeG2 CB1XTlmAejIUaY9MtYS+b+gv6DnfCcsnjS7gHL/70GpYMmdFiRY8Ph/e/dEdRJzT8+hd7zlZ4yu gykWNa4zLHEl6OXSauI+vMFA9I390BN4uLJSCvcabelNVakj0632oWAU0wi+6mTwwqYVrcvM7Lp eRSAUsTk6cIQKmr/0hHqrc3Q== X-Received: by 2002:a17:903:2287:b0:2c9:c517:d070 with SMTP id d9443c01a7336-2cf348366bfmr182616715ad.3.1784630138721; Tue, 21 Jul 2026 03:35:38 -0700 (PDT) Received: from localhost.localdomain ([124.194.218.202]) by smtp.gmail.com with ESMTPSA id d9443c01a7336-2cf3476ba24sm72240715ad.75.2026.07.21.03.35.36 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Tue, 21 Jul 2026 03:35:38 -0700 (PDT) From: Jinu Kim To: Sean Christopherson Cc: Paolo Bonzini , kvm@vger.kernel.org, linux-kernel@vger.kernel.org Subject: [PATCH v2 2/2] KVM: x86/mmu: Check all address spaces before skipping unsync Date: Tue, 21 Jul 2026 19:35:12 +0900 Message-ID: <20260721103512.2136240-3-kimjw04271234@gmail.com> X-Mailer: git-send-email 2.43.0 In-Reply-To: <20260721103512.2136240-1-kimjw04271234@gmail.com> References: <20260721103512.2136240-1-kimjw04271234@gmail.com> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset="utf-8" mmu_try_to_unsync_pages() skips the shadow-page lookup when the supplied memslot allows a hugepage, because a shadow page would disallow hugepages. But hugepage metadata is per-address-space while shadow pages are shared across all address spaces. With SMM, the other address space can therefore have a shadow page even when the supplied memslot allows a hugepage. Check the corresponding memslot in the other address space before taking the fast path. Skip the shadow-page lookup only when all address spaces allow a hugepage. Fixes: b3ae3ceb5569 ("KVM: x86/mmu: KVM: x86/mmu: Skip unsync when large pa= ges are allowed") Assisted-by: Codex:GPT-5 Signed-off-by: Jinu Kim --- arch/x86/kvm/mmu/mmu.c | 21 ++++++++++++++++++++- 1 file changed, 20 insertions(+), 1 deletion(-) diff --git a/arch/x86/kvm/mmu/mmu.c b/arch/x86/kvm/mmu/mmu.c index 7757f0ad65c6f..1db6750992546 100644 --- a/arch/x86/kvm/mmu/mmu.c +++ b/arch/x86/kvm/mmu/mmu.c @@ -725,6 +725,25 @@ static struct kvm_lpage_info *lpage_info_slot(gfn_t gf= n, return &slot->arch.lpage_info[level - 2][idx]; } =20 +static bool kvm_gfn_is_lpage_allowed(struct kvm *kvm, + const struct kvm_memory_slot *slot, + gfn_t gfn, int level) +{ + const struct kvm_memory_slot *other_slot; + + BUILD_BUG_ON(KVM_MAX_NR_ADDRESS_SPACES > 2); + + if (lpage_info_slot(gfn, slot, level)->disallow_lpage) + return false; + + if (kvm_arch_nr_memslot_as_ids(kvm) =3D=3D 1) + return true; + + other_slot =3D __gfn_to_memslot(__kvm_memslots(kvm, slot->as_id ^ 1), gfn= ); + return !other_slot || + !lpage_info_slot(gfn, other_slot, level)->disallow_lpage; +} + /* * The most significant bit in disallow_lpage tracks whether or not memory * attributes are mixed, i.e. not identical for all gfns at the current le= vel. @@ -2972,7 +2991,7 @@ int mmu_try_to_unsync_pages(struct kvm *kvm, const st= ruct kvm_memory_slot *slot, * write-protected (see above), thus if the gfn can be mapped with a * hugepage and isn't write-tracked, it can't have a shadow page. */ - if (!lpage_info_slot(gfn, slot, PG_LEVEL_2M)->disallow_lpage) + if (kvm_gfn_is_lpage_allowed(kvm, slot, gfn, PG_LEVEL_2M)) return 0; =20 /* --=20 2.43.0