From: Ackerley Tng <ackerleytng@google.com>
To: Sean Christopherson <seanjc@google.com>,
Paolo Bonzini <pbonzini@redhat.com>,
Thomas Gleixner <tglx@kernel.org>,
Ingo Molnar <mingo@redhat.com>, Borislav Petkov <bp@alien8.de>,
Dave Hansen <dave.hansen@linux.intel.com>,
x86@kernel.org, "H. Peter Anvin" <hpa@zytor.com>,
Ashish Kalra <ashish.kalra@amd.com>,
Michael Roth <michael.roth@amd.com>,
Brijesh Singh <brijesh.singh@amd.com>,
Marc Zyngier <maz@kernel.org>, Oliver Upton <oupton@kernel.org>,
Joey Gouly <joey.gouly@arm.com>,
Steffen Eiden <seiden@linux.ibm.com>,
Suzuki K Poulose <suzuki.poulose@arm.com>,
Zenghui Yu <yuzenghui@huawei.com>,
Catalin Marinas <catalin.marinas@arm.com>,
Will Deacon <will@kernel.org>,
David Hildenbrand <david@kernel.org>,
Fuad Tabba <tabba@google.com>, Yan Zhao <yan.y.zhao@intel.com>,
"Edgecombe, Rick P" <rick.p.edgecombe@intel.com>,
Vishal Annapurve <vannapurve@google.com>
Cc: kvm@vger.kernel.org, linux-kernel@vger.kernel.org,
linux-arm-kernel@lists.infradead.org, kvmarm@lists.linux.dev,
Ackerley Tng <ackerleytng@google.com>
Subject: [PATCH v2 1/4] KVM: SEV: Treat unassigned RMP entry as benign race on PSMASH failure
Date: Tue, 18 Aug 2026 09:15:52 +0000 [thread overview]
Message-ID: <20260818-gmem-no-return-page-v2-1-5298f42d49bb@google.com> (raw)
In-Reply-To: <20260818-gmem-no-return-page-v2-0-5298f42d49bb@google.com>
When handling an RMP fault, KVM attempts to split a 2MB page via PSMASH.
If PSMASH fails, the only expected return value is FAIL_BADADDR, which does
not distinguish the reason for the bad address. Hence, another RMP entry
lookup is required to determine whether the failure was benign.
Specifically, KVM re-checks the RMP entry to determine if another CPU raced
and already smashed the entry into 4KB pages.
A concurrent operation (such as guest_memfd truncation or hole punching)
can also race and transition the page to shared, removing the page from the
RMP table and causing PSMASH to fail. This can happen even if the page is
still referenced by KVM, because guest_memfd reclaim transitions the RMP
entry to shared when the folio is removed from the page cache.
Treat an unassigned RMP entry as an expected race when re-checking after a
failed PSMASH, and skip logging an error warning.
Fixes: c63cf135cc99 ("KVM: SEV: Add support to handle RMP nested page faults")
Signed-off-by: Ackerley Tng <ackerleytng@google.com>
---
arch/x86/kvm/svm/sev.c | 5 +++--
1 file changed, 3 insertions(+), 2 deletions(-)
diff --git a/arch/x86/kvm/svm/sev.c b/arch/x86/kvm/svm/sev.c
index fcb41dfde4c02..b2738362a928b 100644
--- a/arch/x86/kvm/svm/sev.c
+++ b/arch/x86/kvm/svm/sev.c
@@ -5074,10 +5074,11 @@ void sev_handle_rmp_fault(struct kvm_vcpu *vcpu, gpa_t gpa, u64 error_code)
/*
* Look it up again. If it's 4K now then the PSMASH may have
* raced with another process and the issue has already resolved
- * itself.
+ * itself. If it's not assigned, then this must have raced with
+ * another process that made this page shared.
*/
if (!snp_lookup_rmpentry(pfn, &assigned, &rmp_level) &&
- assigned && rmp_level == PG_LEVEL_4K)
+ ((assigned && rmp_level == PG_LEVEL_4K) || !assigned))
goto out;
pr_warn_ratelimited("SEV: Unable to split RMP entry for GPA 0x%llx PFN 0x%llx ret %d\n",
--
2.55.0.699.gb54405d56f-goog
next prev parent reply other threads:[~2026-08-18 9:16 UTC|newest]
Thread overview: 23+ messages / expand[flat|nested] mbox.gz Atom feed top
2026-08-18 9:15 [PATCH v2 0/4] Stop returning struct page from guest_memfd PFN lookup Ackerley Tng
2026-08-18 9:15 ` Ackerley Tng [this message]
2026-08-19 0:11 ` [PATCH v2 1/4] KVM: SEV: Treat unassigned RMP entry as benign race on PSMASH failure Michael Roth
2026-08-18 9:15 ` [PATCH v2 2/4] KVM: SEV: Drop page refcount early during RMP fault handling Ackerley Tng
2026-08-19 0:23 ` Michael Roth
2026-08-20 14:58 ` Ackerley Tng
2026-08-20 21:56 ` Michael Roth
2026-08-20 22:35 ` Ackerley Tng
2026-08-20 23:08 ` Michael Roth
2026-08-20 23:34 ` Ackerley Tng
2026-08-20 23:36 ` Sean Christopherson
2026-08-18 9:15 ` [PATCH v2 3/4] KVM: SEV: Drop page refcount early in VMSA reload Ackerley Tng
2026-08-19 0:31 ` Michael Roth
2026-08-18 9:15 ` [PATCH v2 4/4] KVM: guest_memfd: Stop returning struct page from PFN lookup Ackerley Tng
2026-08-18 13:58 ` Suzuki K Poulose
2026-08-19 0:49 ` Michael Roth
2026-08-19 8:52 ` Yan Zhao
2026-08-20 14:47 ` Ackerley Tng
2026-08-21 3:19 ` Yan Zhao
2026-08-18 17:12 ` [PATCH v2 0/4] Stop returning struct page from guest_memfd " David Hildenbrand (Arm)
2026-08-18 19:55 ` Sean Christopherson
2026-08-19 7:44 ` David Hildenbrand (Arm)
2026-08-19 14:27 ` Sean Christopherson
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20260818-gmem-no-return-page-v2-1-5298f42d49bb@google.com \
--to=ackerleytng@google.com \
--cc=ashish.kalra@amd.com \
--cc=bp@alien8.de \
--cc=brijesh.singh@amd.com \
--cc=catalin.marinas@arm.com \
--cc=dave.hansen@linux.intel.com \
--cc=david@kernel.org \
--cc=hpa@zytor.com \
--cc=joey.gouly@arm.com \
--cc=kvm@vger.kernel.org \
--cc=kvmarm@lists.linux.dev \
--cc=linux-arm-kernel@lists.infradead.org \
--cc=linux-kernel@vger.kernel.org \
--cc=maz@kernel.org \
--cc=michael.roth@amd.com \
--cc=mingo@redhat.com \
--cc=oupton@kernel.org \
--cc=pbonzini@redhat.com \
--cc=rick.p.edgecombe@intel.com \
--cc=seanjc@google.com \
--cc=seiden@linux.ibm.com \
--cc=suzuki.poulose@arm.com \
--cc=tabba@google.com \
--cc=tglx@kernel.org \
--cc=vannapurve@google.com \
--cc=will@kernel.org \
--cc=x86@kernel.org \
--cc=yan.y.zhao@intel.com \
--cc=yuzenghui@huawei.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox