Re: [RESEND PATCH 1/2] RISC-V: KVM: Release unused page after MMU invalidation
From: Anup Patel
Date: Thu Sep 10 2026 - 11:43:23 EST
On Mon, Aug 10, 2026 at 10:46 AM Xie Bo <xb@xxxxxxxxxxxxx> wrote:
>
> If an MMU invalidation races with a G-stage fault, the fault handler skips
> installing the page but leaves ret set to zero. As a result,
> kvm_release_faultin_page() treats the page as used and can unnecessarily
> mark it dirty.
>
> Track the invalidation retry separately and release the page as unused,
> while preserving the existing return value so that the vCPU retries the
> fault.
>
> Fixes: 2ed90cb0938a ("KVM: RISC-V: Retry fault if vma_lookup() results become invalid")
> Cc: stable@xxxxxxxxxxxxxxx
> Signed-off-by: Xie Bo <xb@xxxxxxxxxxxxx>
LGTM.
Reviewed-by: Anup Patel <anup@xxxxxxxxxxxxxx>
Queued this as a fix for Linux-7.3-rcX
Thanks,
Anup
> ---
> arch/riscv/kvm/mmu.c | 8 ++++++--
> 1 file changed, 6 insertions(+), 2 deletions(-)
>
> diff --git a/arch/riscv/kvm/mmu.c b/arch/riscv/kvm/mmu.c
> index 6035b5e..d189fd5 100644
> --- a/arch/riscv/kvm/mmu.c
> +++ b/arch/riscv/kvm/mmu.c
> @@ -627,6 +627,7 @@ int kvm_riscv_mmu_map(struct kvm_vcpu *vcpu, struct kvm_memory_slot *memslot,
> int ret;
> kvm_pfn_t hfn;
> bool is_hugetlb;
> + bool unused = false;
> bool writable;
> unsigned int vma_pageshift;
> gfn_t gfn = gpa >> PAGE_SHIFT;
> @@ -719,8 +720,10 @@ int kvm_riscv_mmu_map(struct kvm_vcpu *vcpu, struct kvm_memory_slot *memslot,
>
> write_lock(&kvm->mmu_lock);
>
> - if (mmu_invalidate_retry(kvm, mmu_seq))
> + if (mmu_invalidate_retry(kvm, mmu_seq)) {
> + unused = true;
> goto out_unlock;
> + }
>
> /*
> * Check if we are backed by a THP and thus use block mapping if
> @@ -743,7 +746,8 @@ int kvm_riscv_mmu_map(struct kvm_vcpu *vcpu, struct kvm_memory_slot *memslot,
> kvm_err("Failed to map in G-stage\n");
>
> out_unlock:
> - kvm_release_faultin_page(kvm, page, ret && ret != -EEXIST, writable);
> + kvm_release_faultin_page(kvm, page,
> + unused || (ret && ret != -EEXIST), writable);
> write_unlock(&kvm->mmu_lock);
> return ret;
> }
>