Re: [PATCH] KVM: x86: Use active memslots for the per-vCPU MMIO cache

[Jinu Kim]

Hi Sean, Paolo,

A friendly ping on this patch.
I originally sent this on August 7, which was fairly late in the 7.2
release cycle, so I held off on pinging during the remainder of the
cycle and the 7.3 merge window.
Now that 7.3-rc1 is out, could you please take a look when you get a chance?
Please let me know if you'd prefer that I resend or rebase the patch.

Thanks,
Jinu

2026년 8월 7일 (금) 오후 8:28, Jinu Kim <kimjw04271234@xxxxxxxxx>님이 작성:
>
> KVM tags the per-vCPU MMIO cache with a memslot generation so that a
> memslot update invalidates cached MMIO information.  Both the fill and
> validation paths use kvm_memslots(), which unconditionally selects address
> space 0, even when the vCPU is running in SMM and using address space 1.
>
> Commit 56f17dd3fbc4 ("kvm: x86: fix stale mmio cache bug") added the
> memslot generation to the cache key so that a memslot update could not
> leave a stale entry valid.  When commit 699023e23965 ("KVM: x86: add SMM
> to the MMU role, support SMRAM address space") added the SMM address space,
> these helpers were not converted to use the active memslots.
>
> Consequently, an update to the SMM memslots can leave an entry from the old
> SMM address space apparently valid after the vCPU returns to the normal
> address space.  A guest can then cause an access to valid RAM at the same
> GFN to be returned to userspace as KVM_EXIT_MMIO.
>
> Completing that exit through the VMM's RAM address space writes the backing
> page without going through KVM's write-tracking path.  If the page backs a
> nested EPT table, KVM can continue using shadow translations derived from
> the old contents.  The WARN_ON_ONCE() in kvm_mmu_write_protect_fault()
> catches this invalid cache and memslot combination.
>
> Use the vCPU's active memslots when caching and validating the entry.
> Memslot generations are unique across address spaces, so the generation
> also distinguishes the normal and SMM views.  This matches the MMIO SPTE
> cache, which already uses kvm_vcpu_memslots().
>
> On an unpatched current-mainline kernel, a regression test that fills the
> cache in SMM and updates only the SMM memslots fails the intended RAM write
> and triggers the kvm_mmu_write_protect_fault() warning.  With this change,
> the same test completes the RAM write without a warning.  The x86/smm_test,
> set_memory_region_test, and memslot_modification_stress_test selftests also
> pass.
>
> Fixes: 699023e23965 ("KVM: x86: add SMM to the MMU role, support SMRAM address space")
> Cc: stable@xxxxxxxxxxxxxxx
> Signed-off-by: Jinu Kim <kimjw04271234@xxxxxxxxx>
> ---
>  arch/x86/kvm/x86.h | 4 ++--
>  1 file changed, 2 insertions(+), 2 deletions(-)
>
> diff --git a/arch/x86/kvm/x86.h b/arch/x86/kvm/x86.h
> index 9de577ef9c97..a6d86d3dcff6 100644
> --- a/arch/x86/kvm/x86.h
> +++ b/arch/x86/kvm/x86.h
> @@ -313,7 +313,7 @@ static inline bool is_noncanonical_invlpg_address(u64 la, struct kvm_vcpu *vcpu)
>  static inline void vcpu_cache_mmio_info(struct kvm_vcpu *vcpu,
>                                         gva_t gva, gfn_t gfn, unsigned access)
>  {
> -       u64 gen = kvm_memslots(vcpu->kvm)->generation;
> +       u64 gen = kvm_vcpu_memslots(vcpu)->generation;
>
>         if (unlikely(gen & KVM_MEMSLOT_GEN_UPDATE_IN_PROGRESS))
>                 return;
> @@ -330,7 +330,7 @@ static inline void vcpu_cache_mmio_info(struct kvm_vcpu *vcpu,
>
>  static inline bool vcpu_match_mmio_gen(struct kvm_vcpu *vcpu)
>  {
> -       return vcpu->arch.mmio_gen == kvm_memslots(vcpu->kvm)->generation;
> +       return vcpu->arch.mmio_gen == kvm_vcpu_memslots(vcpu)->generation;
>  }
>
>  /*
> --
> 2.43.0
>