From nobody Mon Sep 28 19:23:39 2026 Received: from mail-pg1-f199.google.com (mail-pg1-f199.google.com [209.85.215.199]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id CC60841B8F9 for ; Tue, 18 Aug 2026 08:12:56 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=209.85.215.199 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1787040779; cv=none; b=OYWXPawbNTKz6AfSqPE3HNC7oQI8VfosdwajPHXQWQeUurLa4xr9SKUY25kD7sXjUXGNFM/uVYKp34cFdfDxGFiF+tzN3t0iPU5SSvVGggN7tKEdgpm6S1bEsz3lF59ssSlcZdBL6o+7rCkULGq26EPETPkReMDimbJzoB9kFIo= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1787040779; c=relaxed/simple; bh=M2Ifb8ZR+HwA/H1LGAE2C/jP4eVMt+pmNz86ycTCoCc=; h=Date:In-Reply-To:Mime-Version:References:Message-ID:Subject:From: To:Cc:Content-Type; b=ANIDJ8CfIMO4T/PTsEHQkIWYroZ5KviWonevt8b/Tjvu8y85jCkMt5jMb6oUbtpfUcK+T1q60nlAW01h93QNPBcPFqeH2Hti3XcXXogFLc02wwIsHViEzKfdxVVnib1Y1BvepkqaYYq+oVTg9x/W5d/g020QinoRbIm9dHMxOQA= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=reject dis=none) header.from=google.com; spf=pass smtp.mailfrom=flex--ackerleytng.bounces.google.com; dkim=pass (2048-bit key) header.d=google.com header.i=@google.com header.b=gnN6T+rM; arc=none smtp.client-ip=209.85.215.199 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=reject dis=none) header.from=google.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=flex--ackerleytng.bounces.google.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=google.com header.i=@google.com header.b="gnN6T+rM" Received: by mail-pg1-f199.google.com with SMTP id 41be03b00d2f7-cbb467e56aaso3114588a12.1 for ; Tue, 18 Aug 2026 01:12:56 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=20251104; t=1787040776; x=1787645576; darn=vger.kernel.org; h=content-type:cc:to:from:subject:message-id:references:mime-version :in-reply-to:date:from:to:cc:subject:date:message-id:reply-to :content-type; bh=7jHUMARs30oMku7rrAHEp5fhgY0hNDCAk+0nqtnlfj0=; b=gnN6T+rMWPC9082m84vAj6qSPGwgYKFL0R3y2e9DnWVFll1c292pkFZzqIqV6j2Kn7 joXyDi2OZsHAP3gR6/bAnDfhT5EFZ7FeNqCTQEIr4/Di6EVKaUxvzvxHDPkcX6xK4aX1 c5x6GfldgEZOe0isDF8u7kM4aHxm4ha/CVia1ABdaE2g55PlNZveRsGLYE8hVt6IaNgI EE7xqC3Tfcg4IenrM6Ius5i/RfjCGoy0YOrGjkd0nsCyXXmrHda28GWBpkM6sFTbuDOw HdTxwvPlhi6NNu91IN3q08/9vXveGdBCUNW5wyOLgK9BeQWHh4NRmyIk0vLYfF5eepFf 021Q== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1787040776; x=1787645576; h=content-type:cc:to:from:subject:message-id:references:mime-version :in-reply-to:date:x-gm-message-state:from:to:cc:subject:date :message-id:reply-to:content-type; bh=7jHUMARs30oMku7rrAHEp5fhgY0hNDCAk+0nqtnlfj0=; b=TkwALR4f3cHAnGpHoOQ/J2X/VuxUztYRawA/vCD5wjy3vxCZCh9QqbgisIAuHDygWV m72kHD3YjsMJG0/19w6yuE6GYCA+apPbfBSApQ38cICJzpGYy9Vr/66V27Mu02c1e1gT VOW+BLc0fmzPOZf4fvoRp28gDyA526a6vKY02we8+ats2ULMgpURXijP6NB0GMHAwguG nvFVhP8uLMJB4BIIA9NJq7LPOKQo5iG2Pl4pZF3WWyqBcEGh38X+4oQV1h8EUTcZbXg/ rz7AQ5G6M8z8dh3otk0MTpan8b5MLsWt3WodFAQFawGG2tty449x+/it1iy8tjeIgJ+u bSpw== X-Forwarded-Encrypted: i=1; AHgh+Rp/zeYmOqanzfTRlYeBzex9Z5ZPWGFAlzuGDHPNrctSI3k5OIvOLSHu2Y4n1Sne3XFuY4UhSXgQlLw9IEo=@vger.kernel.org X-Gm-Message-State: AOJu0Yyu1DKUx9fozLIOetTzhHbUvrnEsaNHeRYAhANSUSib1DWPYGy6 rAhaYTgN5ev5qHSARhSLgf3vgKxtPRkvvCckgJkgqurYqK/2Bf9QoEXd0yr2C7z9Ut6H+oJ3g70 a8id9P73FYl9Sj1lQBkxKACuV2A== X-Received: from pgdh4.prod.google.com ([2002:a05:6a02:5184:b0:c9a:37aa:b17d]) (user=ackerleytng job=prod-delivery.src-stubby-dispatcher) by 2002:a05:6a21:6f8b:b0:3cc:4d86:389c with SMTP id adf61e73a8af0-3ccda4b542amr9870906637.13.1787040776115; Tue, 18 Aug 2026 01:12:56 -0700 (PDT) Date: Tue, 18 Aug 2026 08:12:35 +0000 In-Reply-To: <20260818-gmem-no-return-page-v1-0-4f8d939efdbc@google.com> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: Mime-Version: 1.0 References: <20260818-gmem-no-return-page-v1-0-4f8d939efdbc@google.com> X-Developer-Key: i=ackerleytng@google.com; a=ed25519; pk=sAZDYXdm6Iz8FHitpHeFlCMXwabodTm7p8/3/8xUxuU= X-Developer-Signature: v=1; a=ed25519-sha256; t=1787040773; l=2004; i=ackerleytng@google.com; s=20260225; h=from:subject:message-id; bh=M2Ifb8ZR+HwA/H1LGAE2C/jP4eVMt+pmNz86ycTCoCc=; b=NMp2JIOD4jsbFJI/klpvqjQYI52qH+FRAQ3nl2QtSwfyO9la4WUlSpaEfhVwNd0VJlP0lcaCT c2/EcIXTH8fCy1k0RKSRKA3SJNRZKxQY4GJqvWPjQUHmryAYp7Y8Bq7 X-Mailer: b4 0.16.0 Message-ID: <20260818-gmem-no-return-page-v1-1-4f8d939efdbc@google.com> Subject: [PATCH 1/4] KVM: SEV: Treat unassigned RMP entry as benign race on PSMASH failure From: Ackerley Tng To: Sean Christopherson , Paolo Bonzini , Thomas Gleixner , Ingo Molnar , Borislav Petkov , Dave Hansen , x86@kernel.org, "H. Peter Anvin" , Ashish Kalra , Michael Roth , Brijesh Singh , Marc Zyngier , Oliver Upton , Joey Gouly , Steffen Eiden , Suzuki K Poulose , Zenghui Yu , Catalin Marinas , Will Deacon , David Hildenbrand , Fuad Tabba , Yan Zhao , "Edgecombe, Rick P" , Vishal Annapurve Cc: kvm@vger.kernel.org, linux-kernel@vger.kernel.org, linux-arm-kernel@lists.infradead.org, kvmarm@lists.linux.dev, Ackerley Tng Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: quoted-printable When handling an RMP fault, KVM attempts to split a 2MB page via PSMASH. If PSMASH fails, the only expected return value is FAIL_BADADDR, which does not distinguish the reason for the bad address. Hence, another RMP entry lookup is required to determine whether the failure was benign. Specifically, KVM re-checks the RMP entry to determine if another CPU raced and already smashed the entry into 4KB pages. A concurrent operation (such as guest_memfd truncation or hole punching) can also race and transition the page to shared, removing the page from the RMP table and causing PSMASH to fail. This can happen even if the page is still referenced by KVM, because guest_memfd reclaim transitions the RMP entry to shared when the folio is removed from the page cache. Treat an unassigned RMP entry as an expected race when re-checking after a failed PSMASH, and skip logging an error warning. Fixes: c63cf135cc99 ("KVM: SEV: Add support to handle RMP nested page fault= s") Signed-off-by: Ackerley Tng --- arch/x86/kvm/svm/sev.c | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) diff --git a/arch/x86/kvm/svm/sev.c b/arch/x86/kvm/svm/sev.c index fcb41dfde4c02..b2738362a928b 100644 --- a/arch/x86/kvm/svm/sev.c +++ b/arch/x86/kvm/svm/sev.c @@ -5074,10 +5074,11 @@ void sev_handle_rmp_fault(struct kvm_vcpu *vcpu, gp= a_t gpa, u64 error_code) /* * Look it up again. If it's 4K now then the PSMASH may have * raced with another process and the issue has already resolved - * itself. + * itself. If it's not assigned, then this must have raced with + * another process that made this page shared. */ if (!snp_lookup_rmpentry(pfn, &assigned, &rmp_level) && - assigned && rmp_level =3D=3D PG_LEVEL_4K) + ((assigned && rmp_level =3D=3D PG_LEVEL_4K) || !assigned)) goto out; =20 pr_warn_ratelimited("SEV: Unable to split RMP entry for GPA 0x%llx PFN 0= x%llx ret %d\n", --=20 2.55.0.699.gb54405d56f-goog From nobody Mon Sep 28 19:23:39 2026 Received: from mail-pf1-f197.google.com (mail-pf1-f197.google.com [209.85.210.197]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 820AC41DDF4 for ; Tue, 18 Aug 2026 08:12:58 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=209.85.210.197 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1787040781; cv=none; b=Mfhi+/MtLgUbolctiEk34g+B4adcPFKJ1Q0YHw7jVTk5FSS5i4gXQw+Wg2iNmumvlZEZof0PDv0D2nwbiXflIApR/xm2IpG0vIaCfAoxa1Bd5uLfqTkspA8yvHIqlzzTSfKc0f/raOKTGxMeiiT6vnqctiejD8B6o8PSUPhuYrs= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1787040781; c=relaxed/simple; bh=7i6cqBtbFkQctrI98iz0J10uujeLpSmIIWcG5kUAid8=; h=Date:In-Reply-To:Mime-Version:References:Message-ID:Subject:From: To:Cc:Content-Type; b=Kk1/ttjTFFzdeg0bKRMuGQhDwChJtHcpCEJoPyLbF3/HkHvaVRUjfMz8r5G9E9iMjFDmDtkchuWcjccFC1svccVL+PY5+imUKwNgkpLF4VVRm0zYjeDjNSHasDiJu4Kyemaip2e8zKaPXhe3Xg4MPILO+mB/VOzlbabG9C+VGjY= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=reject dis=none) header.from=google.com; spf=pass smtp.mailfrom=flex--ackerleytng.bounces.google.com; dkim=pass (2048-bit key) header.d=google.com header.i=@google.com header.b=SxBNQ2WZ; arc=none smtp.client-ip=209.85.210.197 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=reject dis=none) header.from=google.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=flex--ackerleytng.bounces.google.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=google.com header.i=@google.com header.b="SxBNQ2WZ" Received: by mail-pf1-f197.google.com with SMTP id d2e1a72fcca58-8485b7e18b4so7129406b3a.1 for ; Tue, 18 Aug 2026 01:12:58 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=20251104; t=1787040778; x=1787645578; darn=vger.kernel.org; h=content-type:cc:to:from:subject:message-id:references:mime-version :in-reply-to:date:from:to:cc:subject:date:message-id:reply-to :content-type; bh=k3ULsNgYxwRhZwue5bCy+g9EswRkhCGynb1/tmXwwp8=; b=SxBNQ2WZdi+yx7i7T7w80XIWfig5JXAq1IWse2xb9wjL5jzs7Y/0BbaEBuDOyNskvY sTqgSq9vfnOQtvByY+mBoyGH8Ta0kDCEK9zQh1V8T6xP00emtVokHkndvObiiIsEJlHh o+rhVAIKMWL7nkZGFtpCdOMhLvjHz/vYCwRaSRTke0S8AlyKuFS7pVuQhj0sGyDD57K8 5goXyDd+eT0fiVNLY6SWfUQ0AAeE/f+WZMsjOAe1+6TISUBLM/nYehISFSK07bpI8FjO VFp8VHhlzw+rwyC4EamFiEsWMKYrlG3o121nxmDgUWl8CueU9oPrYdVLd0uroMnuHlfc 1Obg== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1787040778; x=1787645578; h=content-type:cc:to:from:subject:message-id:references:mime-version :in-reply-to:date:x-gm-message-state:from:to:cc:subject:date :message-id:reply-to:content-type; bh=k3ULsNgYxwRhZwue5bCy+g9EswRkhCGynb1/tmXwwp8=; b=KQEkn8XNwJ2brVMZ3vHHy3fBScCAqm9NdBayXHMQ0PkeKv1POraWNTqUpk9Z7ZnLVt oMkrwOsAs1OIz4uLAxDBkDgi9zNlbDWPiLDgcntz2b20Ss6rAdDNz6DeAf8RRErxS1sz mNe6FVbJgAn3iOqp+7MzoIk3S3iPiREcY4fE460i3nTywg8DjWXTsal6g2RTIe47gSU2 nZd1r7rI5hr649GkeHhrieCwHyorOupEQEAJVVT56/RAEV5oqXjyaoxWSKr0upgKeGdW /eWQuQU1N05Ao/T280LrbQ1OACGX2EVuFbRbv/rK7p5V4/t4jE2YXN2J2n4/k+fMHuV4 Ep1Q== X-Forwarded-Encrypted: i=1; AHgh+RoVhuVqjWBmZ4YzkvKpZ7nsSDOTyBNKiQ123XKcAm+FBK+MM0oIJ8FG+/MyTt2tQC7gwj2w1SZUEJT/ozk=@vger.kernel.org X-Gm-Message-State: AOJu0YyUbH9YkQ8XnTAvLigQ1O59fZkca3LqbVAs9vKMe33/X2OjGHUY hJUvLTaqFpeBQ/IJk4iNBnGjzq8TZAM1Ey5Jfq1LxS1WIZ9Vcxvtb9oe1FoqV8qGmiZQdgucN95 M5VwTRBIZ1f6QXnptOMqUX0tBcw== X-Received: from pglf19.prod.google.com ([2002:a63:1013:0:b0:c96:da8a:c09c]) (user=ackerleytng job=prod-delivery.src-stubby-dispatcher) by 2002:a05:6a21:10a:b0:3cb:853e:850e with SMTP id adf61e73a8af0-3cc71b7acbamr41629166637.13.1787040777693; Tue, 18 Aug 2026 01:12:57 -0700 (PDT) Date: Tue, 18 Aug 2026 08:12:36 +0000 In-Reply-To: <20260818-gmem-no-return-page-v1-0-4f8d939efdbc@google.com> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: Mime-Version: 1.0 References: <20260818-gmem-no-return-page-v1-0-4f8d939efdbc@google.com> X-Developer-Key: i=ackerleytng@google.com; a=ed25519; pk=sAZDYXdm6Iz8FHitpHeFlCMXwabodTm7p8/3/8xUxuU= X-Developer-Signature: v=1; a=ed25519-sha256; t=1787040773; l=1697; i=ackerleytng@google.com; s=20260225; h=from:subject:message-id; bh=7i6cqBtbFkQctrI98iz0J10uujeLpSmIIWcG5kUAid8=; b=ekVPncMmVUriS84Zt3+p8nRYXWSGEYGwwUVXJK5NXlHtz70OGF8spprSioZ5xfncCfU5EKAue 7ocjFnw2d/JCgGzlgbUnq1q4Jp4Sgvc0ggqydJcjSIEBFCCyy17BUEN X-Mailer: b4 0.16.0 Message-ID: <20260818-gmem-no-return-page-v1-2-4f8d939efdbc@google.com> Subject: [PATCH 2/4] KVM: SEV: Drop page refcount early during RMP fault handling From: Ackerley Tng To: Sean Christopherson , Paolo Bonzini , Thomas Gleixner , Ingo Molnar , Borislav Petkov , Dave Hansen , x86@kernel.org, "H. Peter Anvin" , Ashish Kalra , Michael Roth , Brijesh Singh , Marc Zyngier , Oliver Upton , Joey Gouly , Steffen Eiden , Suzuki K Poulose , Zenghui Yu , Catalin Marinas , Will Deacon , David Hildenbrand , Fuad Tabba , Yan Zhao , "Edgecombe, Rick P" , Vishal Annapurve Cc: kvm@vger.kernel.org, linux-kernel@vger.kernel.org, linux-arm-kernel@lists.infradead.org, kvmarm@lists.linux.dev, Ackerley Tng Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: quoted-printable When handling an RMP fault, KVM retrieves the PFN for a private GPA from guest_memfd. The page reference taken during PFN lookup is not needed for the remainder of the handler, as checking the RMP entry, splitting the 2MB page via PSMASH, and zapping shadow page tables only operate on PFNs. Drop the page reference immediately after retrieving the PFN instead of holding it across the entire handler. A later patch will follow up with completely not returning refcounted pages from kvm_gmem_get_pfn(). No functional change intended. Signed-off-by: Ackerley Tng --- arch/x86/kvm/svm/sev.c | 5 ++--- 1 file changed, 2 insertions(+), 3 deletions(-) diff --git a/arch/x86/kvm/svm/sev.c b/arch/x86/kvm/svm/sev.c index b2738362a928b..19c31fa944e34 100644 --- a/arch/x86/kvm/svm/sev.c +++ b/arch/x86/kvm/svm/sev.c @@ -5036,12 +5036,13 @@ void sev_handle_rmp_fault(struct kvm_vcpu *vcpu, gp= a_t gpa, u64 error_code) gpa); return; } + kvm_release_page_unused(page); =20 ret =3D snp_lookup_rmpentry(pfn, &assigned, &rmp_level); if (ret || !assigned) { pr_warn_ratelimited("SEV: Unexpected RMP fault, no assigned RMP entry fo= und for GPA 0x%llx PFN 0x%llx error %d\n", gpa, pfn, ret); - goto out_no_trace; + return; } =20 /* @@ -5088,8 +5089,6 @@ void sev_handle_rmp_fault(struct kvm_vcpu *vcpu, gpa_= t gpa, u64 error_code) kvm_zap_gfn_range(kvm, gfn, gfn + PTRS_PER_PMD); out: trace_kvm_rmp_fault(vcpu, gpa, pfn, error_code, rmp_level, ret); -out_no_trace: - kvm_release_page_unused(page); } =20 static bool is_pfn_range_shared(kvm_pfn_t start, kvm_pfn_t end) --=20 2.55.0.699.gb54405d56f-goog From nobody Mon Sep 28 19:23:39 2026 Received: from mail-pl1-f199.google.com (mail-pl1-f199.google.com [209.85.214.199]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 24D80344031 for ; Tue, 18 Aug 2026 08:13:00 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=209.85.214.199 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1787040783; cv=none; b=Ori3upZcQjlmHB78lAnzLktIGmLGQ4SHmiND6wNElvrWydl66+HgnvLI2jetjNsSaBPlqawCS5WDrky0Hsb0LVsL6i3Kv4nqPg0yqqg+EYtyooO3YaELOHwdpDsd0UjY94Wr3kEn75BP14F98NSa7Df2V4iR1TxaxOyHG7gbKos= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1787040783; c=relaxed/simple; bh=HBAMvv39sFk8+6D6cJKyVCd7nwzLeY+DW3CPjKwbem4=; h=Date:In-Reply-To:Mime-Version:References:Message-ID:Subject:From: To:Cc:Content-Type; b=CCmG5xG3xw85YHcGh+sIfJ+k3D3qY1FyT33HL8rUX5VG5+ceizHC7MWyCvKYbL0xBYXlzcdoR8CacVosfT1mBsrIgcF6r3so4YTzHcjYPQE0SEX+hfPFIDpLsWQD0P6fdOy9cbsBvsQAZHdRz9doWk4cyFobAyn6/xlAinq4E34= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=reject dis=none) header.from=google.com; spf=pass smtp.mailfrom=flex--ackerleytng.bounces.google.com; dkim=pass (2048-bit key) header.d=google.com header.i=@google.com header.b=UiiKD+bl; arc=none smtp.client-ip=209.85.214.199 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=reject dis=none) header.from=google.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=flex--ackerleytng.bounces.google.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=google.com header.i=@google.com header.b="UiiKD+bl" Received: by mail-pl1-f199.google.com with SMTP id d9443c01a7336-2cfc52ddc55so71427735ad.3 for ; Tue, 18 Aug 2026 01:13:00 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=20251104; t=1787040779; x=1787645579; darn=vger.kernel.org; h=content-type:cc:to:from:subject:message-id:references:mime-version :in-reply-to:date:from:to:cc:subject:date:message-id:reply-to :content-type; bh=py9oGM3siJXhjPmyy5yHILORKpTNDQOmPG7vid7oKT4=; b=UiiKD+blmv72foumMyyOR3CvMjGGlbmRtrgaENMGWWzaCL+6alLF6HkdQxb/LthHFD wntIlAL9mHTrYxZpwI9ecYnYX0PbObpag2qtF9S0qX17msF42CIWCG/GxIBB71kW/7VF HDryp6uCgKqWuDEeh8SyWT3/zvG2NkmIx/58TJcIwnhc3OzM+VIoys1TWHSKDEU6hGJ4 w/MtqA/JCcMEWA4Ls1v+1GN5hWg2k5FbOHkisckRJi6ppdvP+u9iuC9Z5/9UgWL8YKZF N6FMQRDcrzmtwrUvQ88FpDKv+AYoK3wHF9hS+U8bpCKgHvUxbNTjijzkfRclfVR53eze rcyQ== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1787040779; x=1787645579; h=content-type:cc:to:from:subject:message-id:references:mime-version :in-reply-to:date:x-gm-message-state:from:to:cc:subject:date :message-id:reply-to:content-type; bh=py9oGM3siJXhjPmyy5yHILORKpTNDQOmPG7vid7oKT4=; b=o59jgaf7e8n081chYCxDtlu5Kn8vSX4aStrromAJIYpeQYYACUDQdugW8+eX6TEMjj BkpSewF+A/wwXJ5yv/82T4QWMKPoe9IHi3DC7h7IZPo3rWREJOfsx9Ub3LDeiaANYVd5 A4HLguaEJ/R95bthp6mVOUro58tTGfCO78OYp4ZFiqdcFZiQCWMUiWa4AqkmXDCzql4n FJSTLLyurznBaxaoiBsaXNJ/ZG275Lx7XEpo3a2JkiCGkkKklh4/b+TgqLrNyXheQDc5 Y9MWkwQCbKc3v3glpZue8S+yfnytP34YA7bTRr2kpsDUFXzYcEIBczmBc2VKQ67sW/cz gfvA== X-Forwarded-Encrypted: i=1; AHgh+RobUaXzGpsW0nO5o8baR9VpI8Z1NxSdoHE1IAnAhhtIxMgMwiM9PaJ6nA5CPwv1Uqqoz1ywdD7VZI+BnkE=@vger.kernel.org X-Gm-Message-State: AOJu0Yw5TK0qnSFvt26YpFYm8EmuwwuAzNabzXkpmEv2rPPaudK+wnGA 9OucQKwCI8T9BpQWzRVeQ05wmkJ5UW6b8i22bby7Yn6RNRKd9IFnJUhEu5s/W2IfwOEpKOeepBq 2LY29YCFK5URbTsQHYx/xNu8LJw== X-Received: from plpw11.prod.google.com ([2002:a17:902:9a8b:b0:2cf:2ac5:9098]) (user=ackerleytng job=prod-delivery.src-stubby-dispatcher) by 2002:a17:902:ce04:b0:2c8:2808:3ec9 with SMTP id d9443c01a7336-2d3b0d5e658mr384056035ad.12.1787040779293; Tue, 18 Aug 2026 01:12:59 -0700 (PDT) Date: Tue, 18 Aug 2026 08:12:37 +0000 In-Reply-To: <20260818-gmem-no-return-page-v1-0-4f8d939efdbc@google.com> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: Mime-Version: 1.0 References: <20260818-gmem-no-return-page-v1-0-4f8d939efdbc@google.com> X-Developer-Key: i=ackerleytng@google.com; a=ed25519; pk=sAZDYXdm6Iz8FHitpHeFlCMXwabodTm7p8/3/8xUxuU= X-Developer-Signature: v=1; a=ed25519-sha256; t=1787040773; l=1303; i=ackerleytng@google.com; s=20260225; h=from:subject:message-id; bh=HBAMvv39sFk8+6D6cJKyVCd7nwzLeY+DW3CPjKwbem4=; b=mOyqx2L3EUevN+HReTiR9BLbQbbIVJKA9Szdy3xkBVDx5LW4GH0t8FRgmGB1JMIT6leK1f26j KObbm72z9rQACvWlEFb2sbi6pWXRCUOdCOO3xSedy+PeOf8JyXHnclA X-Mailer: b4 0.16.0 Message-ID: <20260818-gmem-no-return-page-v1-3-4f8d939efdbc@google.com> Subject: [PATCH 3/4] KVM: SEV: Drop page refcount early in VMSA reload From: Ackerley Tng To: Sean Christopherson , Paolo Bonzini , Thomas Gleixner , Ingo Molnar , Borislav Petkov , Dave Hansen , x86@kernel.org, "H. Peter Anvin" , Ashish Kalra , Michael Roth , Brijesh Singh , Marc Zyngier , Oliver Upton , Joey Gouly , Steffen Eiden , Suzuki K Poulose , Zenghui Yu , Catalin Marinas , Will Deacon , David Hildenbrand , Fuad Tabba , Yan Zhao , "Edgecombe, Rick P" , Vishal Annapurve Cc: kvm@vger.kernel.org, linux-kernel@vger.kernel.org, linux-arm-kernel@lists.infradead.org, kvmarm@lists.linux.dev, Ackerley Tng Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: quoted-printable When reloading the guest VMSA for an SEV-SNP vCPU, KVM retrieves the PFN from guest_memfd. Drop the page reference immediately after retrieving the PFN instead of holding it across MMU lock acquisition in preparation for a follow-up patch to stop returning page pointers from guest_memfd PFN lookups. This is safe because the page's validity and presence are governed by KVM's MMU invalidation protocol rather than the page reference. No functional change intended. Signed-off-by: Ackerley Tng --- arch/x86/kvm/svm/sev.c | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-) diff --git a/arch/x86/kvm/svm/sev.c b/arch/x86/kvm/svm/sev.c index 19c31fa944e34..3fc582fa343cc 100644 --- a/arch/x86/kvm/svm/sev.c +++ b/arch/x86/kvm/svm/sev.c @@ -4062,6 +4062,7 @@ static void __sev_snp_reload_vmsa(struct kvm_vcpu *vc= pu, gpa_t gpa) */ if (kvm_gmem_get_pfn(vcpu->kvm, slot, gfn, &pfn, &page, NULL)) return; + kvm_release_page_clean(page); =20 read_lock(&kvm->mmu_lock); /* @@ -4076,8 +4077,6 @@ static void __sev_snp_reload_vmsa(struct kvm_vcpu *vc= pu, gpa_t gpa) else svm->vmcb->control.vmsa_pa =3D pfn_to_hpa(pfn); read_unlock(&kvm->mmu_lock); - - kvm_release_page_clean(page); } =20 /* --=20 2.55.0.699.gb54405d56f-goog From nobody Mon Sep 28 19:23:39 2026 Received: from mail-pg1-f197.google.com (mail-pg1-f197.google.com [209.85.215.197]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 41E33420E9F for ; Tue, 18 Aug 2026 08:13:02 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=209.85.215.197 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1787040784; cv=none; b=gDE613y70dt/V04CjP6xQRa+RpLDzb6CbnAhEXckF03YELJg2SroUWyk9mmYzCLc5v5xNCyUy9G2/CWPtmEQQel5wtIztfcWNNOBjT8mWLsC5L7BjPSJoR1FCHPriQ2OwM9j8gkBgie+r+7wIRM6+OCuKoPo463dj+Lyi8ZPPYM= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1787040784; c=relaxed/simple; bh=jC/FuU3q+aE44Qo/ZCfyDCEiyjg3Sn4iBLXQRXTOxug=; h=Date:In-Reply-To:Mime-Version:References:Message-ID:Subject:From: To:Cc:Content-Type; b=nLJZpBL6LjZfsYa9kxS32datKGRv6FARYX5dxDeBotS7XqMEcVSvGqNCIb0VyqfxOqRfXkwqca2U+fRIVEd/At5V+6XzExdR21BM9of/sKlB7qaap4pCMohHki4zH53NYME+5DGbiQlvSAFo1L6Joycfolbqv1IlxEdLPf5aZaU= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=reject dis=none) header.from=google.com; spf=pass smtp.mailfrom=flex--ackerleytng.bounces.google.com; dkim=pass (2048-bit key) header.d=google.com header.i=@google.com header.b=bpPH35OI; arc=none smtp.client-ip=209.85.215.197 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=reject dis=none) header.from=google.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=flex--ackerleytng.bounces.google.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=google.com header.i=@google.com header.b="bpPH35OI" Received: by mail-pg1-f197.google.com with SMTP id 41be03b00d2f7-cc132709c76so2903813a12.3 for ; Tue, 18 Aug 2026 01:13:02 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=20251104; t=1787040781; x=1787645581; darn=vger.kernel.org; h=content-type:cc:to:from:subject:message-id:references:mime-version :in-reply-to:date:from:to:cc:subject:date:message-id:reply-to :content-type; bh=sVmR3VY2P/43Xc1WVt4/8Wvg41WzumPQhGva3P6A3c8=; b=bpPH35OIcPK1HX9hGHMQayd3NnbBlDfUfO7bhEFGpCRHcSx+/8wgPTQUwWO0k9wYrh 9EQv1tdQu/pS/N6NzlZQCyRX0HR+M9n0WbdolrVT5vNXUHu4ott31N1Ih4ExvykSvCtG goPY1HSA0vFG9LIfCk6o1fmUXmdA5b/v1u2JdiYI4sElMVkYX+JbUoUkv01bXfNWMqSH oluCcfuOCXJbUcFnOrYqxqBkuGd8x0r7ASZvDpee744YCFayBEzKAu6pQRdvLslc9s5L 2BQs6LbXmACZaH4puXLErsJ5fyGpCDa5zpm3ZPnO9Ps9vjKbbXXlMMaxYd7uCfdDA8xg BGlA== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1787040781; x=1787645581; h=content-type:cc:to:from:subject:message-id:references:mime-version :in-reply-to:date:x-gm-message-state:from:to:cc:subject:date :message-id:reply-to:content-type; bh=sVmR3VY2P/43Xc1WVt4/8Wvg41WzumPQhGva3P6A3c8=; b=DsznMM6JNXLVld5C+rnZBsM0QH9rvxRp4AE9mFpqZiEdL2B2hQH0oM1Qgqn2AG4jvJ r89CknRAlw/P2sN6qlNrC/kNqsZkoKzzFLXr9pdu0+0VHAyKpnQnCtgKIERBtJ7WYMGH DL3TfpbGRY31LOEVUFDC7cK+JxD1oFOh2OD1NjC6IM6VgLZpOrKcHL0/WtRas9lbL3Lo VgbtPaK/VNMsfWo7z7gINGDhdguv8vM+lnjiOdmyPz9daU9QZVtTUHkC6UM7pXLy3R5W Q4pRYlsLJFVL575A/IZpg6b07ZmbhRz9gd3yMDmrmDJf/nlKtpFDkNjmr0HIt+hcWWKJ wSxA== X-Forwarded-Encrypted: i=1; AHgh+RpeEg5ITJKtWsLx6nAko+2M7xI1uLeXzW+H2lRBk3YIWla8otlXLs1aADaxLRglROfCA6Unp1VkKnqK6cI=@vger.kernel.org X-Gm-Message-State: AOJu0YwZDMJA/wbGRwFaiua37/iSNsihW7q/vStTdpwd8AbznoTilEJw JRhul/x4lUVv/9aCeIXBmN8L7hX0KeCGuhYWWW3t9v2iRncosvdptxFvevFo4UJl0c1526uQPFr 9gVIoURpJJ1gsQaP5wkf7eKqvcg== X-Received: from pgkc14.prod.google.com ([2002:a63:ef4e:0:b0:c99:3b68:c9e4]) (user=ackerleytng job=prod-delivery.src-stubby-dispatcher) by 2002:a05:6a21:4685:b0:3c3:875d:705e with SMTP id adf61e73a8af0-3ccda96659cmr9559681637.19.1787040780904; Tue, 18 Aug 2026 01:13:00 -0700 (PDT) Date: Tue, 18 Aug 2026 08:12:38 +0000 In-Reply-To: <20260818-gmem-no-return-page-v1-0-4f8d939efdbc@google.com> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: Mime-Version: 1.0 References: <20260818-gmem-no-return-page-v1-0-4f8d939efdbc@google.com> X-Developer-Key: i=ackerleytng@google.com; a=ed25519; pk=sAZDYXdm6Iz8FHitpHeFlCMXwabodTm7p8/3/8xUxuU= X-Developer-Signature: v=1; a=ed25519-sha256; t=1787040773; l=7522; i=ackerleytng@google.com; s=20260225; h=from:subject:message-id; bh=oRKeat8XDy9tQquxaI02+cUjLXHoVTmOLq0ZPD46ISw=; b=SInLKT396SW4cghL3FPwB9A8Gfd2ogtUQxrRFWcc/tomMx6uzYdPrHiU4m8hxj+GroqAcqTC1 zpoSAG5TeFCB8YuMSY8+T1Kxtuwbbc4Yr5CMpCl3wBQ5xKfY6und/Ha X-Mailer: b4 0.16.0 Message-ID: <20260818-gmem-no-return-page-v1-4-4f8d939efdbc@google.com> Subject: [PATCH 4/4] KVM: guest_memfd: Stop returning struct page from PFN lookup From: Ackerley Tng To: Sean Christopherson , Paolo Bonzini , Thomas Gleixner , Ingo Molnar , Borislav Petkov , Dave Hansen , x86@kernel.org, "H. Peter Anvin" , Ashish Kalra , Michael Roth , Brijesh Singh , Marc Zyngier , Oliver Upton , Joey Gouly , Steffen Eiden , Suzuki K Poulose , Zenghui Yu , Catalin Marinas , Will Deacon , David Hildenbrand , Fuad Tabba , Yan Zhao , "Edgecombe, Rick P" , Vishal Annapurve Cc: kvm@vger.kernel.org, linux-kernel@vger.kernel.org, linux-arm-kernel@lists.infradead.org, kvmarm@lists.linux.dev, Ackerley Tng Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: quoted-printable From: Sean Christopherson KVM currently expects guest_memfd PFN lookups to return a refcounted struct page, which callers hold across fault handling. Holding a page reference across fault handling is problematic for guest_memfd. In-place memory conversions between confidential computing shared and private states inspect folio refcounts to ensure exclusive ownership by guest_memfd. A concurrent guest page fault taking a reference on the folio causes conversions to fail due to an elevated refcount. guest_memfd already notifies KVM of page invalidations, so callers within KVM only need to respect the MMU invalidation protocol to safely rely on guest_memfd for page presence. Furthermore, removing struct page from the guest_memfd PFN lookup moves KVM closer toward supporting memory backends that are not backed by struct page. Drop the folio reference immediately before returning from the guest_memfd PFN lookup, and stop returning the struct page pointer. For ARM, initialize the local page pointer to NULL so that the shared cleanup path that releases fault-in pages safely no-ops for guest_memfd. For x86, no additional changes are required in the MMU fault path because the page fault tracking structure is zero-initialized at the start of page fault handling, ensuring the refcounted page pointer is already NULL. Reported-by: Yan Zhao Closes: https://lore.kernel.org/all/anZ4W9o5pTWIEgMY@yzhao56-desk.sh.intel.= com/ Signed-off-by: Sean Christopherson Co-developed-by: Yan Zhao Signed-off-by: Yan Zhao Co-developed-by: Ackerley Tng Signed-off-by: Ackerley Tng --- arch/arm64/kvm/mmu.c | 4 ++-- arch/arm64/kvm/nested.c | 4 ++-- arch/x86/kvm/mmu/mmu.c | 2 +- arch/x86/kvm/svm/sev.c | 8 ++------ include/linux/kvm_host.h | 6 ++---- virt/kvm/guest_memfd.c | 9 ++------- 6 files changed, 11 insertions(+), 22 deletions(-) diff --git a/arch/arm64/kvm/mmu.c b/arch/arm64/kvm/mmu.c index 6c941aaa10c63..e5d637a5ec558 100644 --- a/arch/arm64/kvm/mmu.c +++ b/arch/arm64/kvm/mmu.c @@ -1613,7 +1613,7 @@ static int gmem_abort(const struct kvm_s2_fault_desc = *s2fd) enum kvm_pgtable_prot prot =3D KVM_PGTABLE_PROT_R; struct kvm_pgtable *pgt =3D s2fd->vcpu->arch.hw_mmu->pgt; unsigned long mmu_seq; - struct page *page; + struct page *page =3D NULL; struct kvm *kvm =3D s2fd->vcpu->kvm; void *memcache =3D NULL; kvm_pfn_t pfn; @@ -1641,7 +1641,7 @@ static int gmem_abort(const struct kvm_s2_fault_desc = *s2fd) /* Pairs with the smp_wmb() in kvm_mmu_invalidate_end(). */ smp_rmb(); =20 - ret =3D kvm_gmem_get_pfn(kvm, s2fd->memslot, gfn, &pfn, &page, NULL); + ret =3D kvm_gmem_get_pfn(kvm, s2fd->memslot, gfn, &pfn, NULL); if (ret) { kvm_prepare_memory_fault_exit(s2fd->vcpu, s2fd->fault_ipa, PAGE_SIZE, write_fault, exec_fault, false); diff --git a/arch/arm64/kvm/nested.c b/arch/arm64/kvm/nested.c index fb54f6dad995c..43523bb17621a 100644 --- a/arch/arm64/kvm/nested.c +++ b/arch/arm64/kvm/nested.c @@ -1360,7 +1360,7 @@ static int kvm_translate_vncr(struct kvm_vcpu *vcpu, = bool *is_gmem) bool write_fault, writable; unsigned long mmu_seq; struct vncr_tlb *vt; - struct page *page; + struct page *page =3D NULL; u64 va, pfn, gfn; int ret; =20 @@ -1411,7 +1411,7 @@ static int kvm_translate_vncr(struct kvm_vcpu *vcpu, = bool *is_gmem) if (is_error_noslot_pfn(pfn) || (write_fault && !writable)) return -EFAULT; } else { - ret =3D kvm_gmem_get_pfn(vcpu->kvm, memslot, gfn, &pfn, &page, NULL); + ret =3D kvm_gmem_get_pfn(vcpu->kvm, memslot, gfn, &pfn, NULL); if (ret) { kvm_prepare_memory_fault_exit(vcpu, vt->wr.pa, PAGE_SIZE, write_fault, false, false); diff --git a/arch/x86/kvm/mmu/mmu.c b/arch/x86/kvm/mmu/mmu.c index c519e8e8d646f..129d403308051 100644 --- a/arch/x86/kvm/mmu/mmu.c +++ b/arch/x86/kvm/mmu/mmu.c @@ -4604,7 +4604,7 @@ static int kvm_mmu_faultin_pfn_gmem(struct kvm_vcpu *= vcpu, } =20 r =3D kvm_gmem_get_pfn(vcpu->kvm, fault->slot, fault->gfn, &fault->pfn, - &fault->refcounted_page, &max_order); + &max_order); if (r) { kvm_mmu_prepare_memory_fault_exit(vcpu, fault); return r; diff --git a/arch/x86/kvm/svm/sev.c b/arch/x86/kvm/svm/sev.c index 3fc582fa343cc..0a324e5b556b1 100644 --- a/arch/x86/kvm/svm/sev.c +++ b/arch/x86/kvm/svm/sev.c @@ -4016,7 +4016,6 @@ static void __sev_snp_reload_vmsa(struct kvm_vcpu *vc= pu, gpa_t gpa) struct kvm *kvm =3D vcpu->kvm; gfn_t gfn =3D gpa_to_gfn(gpa); unsigned long mmu_seq; - struct page *page; kvm_pfn_t pfn; =20 lockdep_assert_held(&svm->sev_es.snp_vmsa_mutex); @@ -4060,9 +4059,8 @@ static void __sev_snp_reload_vmsa(struct kvm_vcpu *vc= pu, gpa_t gpa) * The new VMSA will be private memory guest memory, so retrieve the * PFN from the gmem backend. */ - if (kvm_gmem_get_pfn(vcpu->kvm, slot, gfn, &pfn, &page, NULL)) + if (kvm_gmem_get_pfn(vcpu->kvm, slot, gfn, &pfn, NULL)) return; - kvm_release_page_clean(page); =20 read_lock(&kvm->mmu_lock); /* @@ -5002,7 +5000,6 @@ void sev_handle_rmp_fault(struct kvm_vcpu *vcpu, gpa_= t gpa, u64 error_code) struct kvm_memory_slot *slot; struct kvm *kvm =3D vcpu->kvm; int order, rmp_level, ret; - struct page *page; bool assigned; kvm_pfn_t pfn; gfn_t gfn; @@ -5029,13 +5026,12 @@ void sev_handle_rmp_fault(struct kvm_vcpu *vcpu, gp= a_t gpa, u64 error_code) return; } =20 - ret =3D kvm_gmem_get_pfn(kvm, slot, gfn, &pfn, &page, &order); + ret =3D kvm_gmem_get_pfn(kvm, slot, gfn, &pfn, &order); if (ret) { pr_warn_ratelimited("SEV: Unexpected RMP fault, no backing page for priv= ate GPA 0x%llx\n", gpa); return; } - kvm_release_page_unused(page); =20 ret =3D snp_lookup_rmpentry(pfn, &assigned, &rmp_level); if (ret || !assigned) { diff --git a/include/linux/kvm_host.h b/include/linux/kvm_host.h index 03bfc92864b6e..502465119ca0c 100644 --- a/include/linux/kvm_host.h +++ b/include/linux/kvm_host.h @@ -2586,13 +2586,11 @@ static inline bool kvm_mem_is_private(struct kvm *k= vm, gfn_t gfn) =20 #ifdef CONFIG_KVM_GUEST_MEMFD int kvm_gmem_get_pfn(struct kvm *kvm, struct kvm_memory_slot *slot, - gfn_t gfn, kvm_pfn_t *pfn, struct page **page, - int *max_order); + gfn_t gfn, kvm_pfn_t *pfn, int *max_order); #else static inline int kvm_gmem_get_pfn(struct kvm *kvm, struct kvm_memory_slot *slot, gfn_t gfn, - kvm_pfn_t *pfn, struct page **page, - int *max_order) + kvm_pfn_t *pfn, int *max_order) { KVM_BUG_ON(1, kvm); return -EIO; diff --git a/virt/kvm/guest_memfd.c b/virt/kvm/guest_memfd.c index b596486d184ca..589762140c3ef 100644 --- a/virt/kvm/guest_memfd.c +++ b/virt/kvm/guest_memfd.c @@ -751,8 +751,7 @@ static struct folio *__kvm_gmem_get_pfn(struct file *fi= le, } =20 int kvm_gmem_get_pfn(struct kvm *kvm, struct kvm_memory_slot *slot, - gfn_t gfn, kvm_pfn_t *pfn, struct page **page, - int *max_order) + gfn_t gfn, kvm_pfn_t *pfn, int *max_order) { pgoff_t index =3D kvm_gmem_get_index(slot, gfn); struct folio *folio; @@ -780,11 +779,7 @@ int kvm_gmem_get_pfn(struct kvm *kvm, struct kvm_memor= y_slot *slot, #endif =20 folio_unlock(folio); - - if (!r) - *page =3D folio_file_page(folio, index); - else - folio_put(folio); + folio_put(folio); =20 return r; } --=20 2.55.0.699.gb54405d56f-goog