github-mirror/linux
1
0
Fork 0
mirror of https://github.com/torvalds/linux.git synced 2026-11-07 06:17:02 +01:00
Code Issues Actions Packages Projects Releases Wiki Activity Graph

KVM: x86/mmu: Fix NX page unaccounting for TDP MMU pages

Browse Source 
unaccount_nx_huge_page() unconditionally passes KVM_SHADOW_MMU to
untrack_possible_nx_huge_page(), which is incorrect, particularly on
the path from kvm_recover_nx_huge_pages(), which handles pages from
both MMUs.

Fix this by passing down the MMU type from the callers. Note that
__kvm_mmu_prepare_zap_page() is only used for shadow MMU pages.

Fixes: 6777885605 ("KVM: x86/mmu: Track possible NX huge pages separately for TDP vs. Shadow MMU")
Signed-off-by: Carlos López <clopez@suse.de>
Link: https://patch.msgid.link/20260916143310.1909993-2-clopez@suse.de
Signed-off-by: Sean Christopherson <seanjc@google.com>
This commit is contained in:
Carlos López 2026-09-16 16:33:11 +02:00 committed by Sean Christopherson
parent 64f1cf2884
commit 31adfe155d
1 changed files with 5 additions and 4 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

9
arch/x86/kvm/mmu/mmu.c
View File

@ -864,11 +864,12 @@ void untrack_possible_nx_huge_page(struct kvm *kvm, struct kvm_mmu_page *sp,
list_del_init(&sp->possible_nx_huge_page_link);
}
static void unaccount_nx_huge_page(struct kvm *kvm, struct kvm_mmu_page *sp)
static void unaccount_nx_huge_page(struct kvm *kvm, struct kvm_mmu_page *sp,
enum kvm_mmu_type mmu_type)
{
sp->nx_huge_page_disallowed = false;
untrack_possible_nx_huge_page(kvm, sp, KVM_SHADOW_MMU);
untrack_possible_nx_huge_page(kvm, sp, mmu_type);
}
static struct kvm_memory_slot *gfn_to_memslot_dirty_bitmap(struct kvm_vcpu *vcpu,
@ -2829,7 +2830,7 @@ static bool __kvm_mmu_prepare_zap_page(struct kvm *kvm,
}
if (sp->nx_huge_page_disallowed)
unaccount_nx_huge_page(kvm, sp);
unaccount_nx_huge_page(kvm, sp, KVM_SHADOW_MMU);
sp->role.invalid = 1;
@ -8050,7 +8051,7 @@ static void kvm_recover_nx_huge_pages(struct kvm *kvm,
WARN_ON_ONCE(!sp->nx_huge_page_disallowed);
WARN_ON_ONCE(!sp->role.direct);
unaccount_nx_huge_page(kvm, sp);
unaccount_nx_huge_page(kvm, sp, mmu_type);
if (is_tdp_mmu)
spin_unlock(tdp_mmu_pages_lock);