diff options
| author | Hyunwoo Kim <imv4bel@gmail.com> | 2026-07-12 10:14:50 +0900 |
|---|---|---|
| committer | Paolo Bonzini <pbonzini@redhat.com> | 2026-07-21 12:25:18 +0200 |
| commit | 7a2c70e777a00c32ebafd376a6fe31ebb91c5b20 (patch) | |
| tree | 1679f4f921862ecc6b11b24c1203df9c8a90a843 /arch | |
| parent | 2abd5287f08319fa35764566b15c6e22cb1068db (diff) | |
| download | linux-next-7a2c70e777a00c32ebafd376a6fe31ebb91c5b20.tar.gz linux-next-7a2c70e777a00c32ebafd376a6fe31ebb91c5b20.zip | |
KVM: x86/mmu: Preserve nested TDP shadow page tables if they are used as roots
kvm_mmu_zap_oldest_mmu_pages() excludes a shadow page whose root_count
is non-zero from top-level reclaim, because such a page cannot be
freed. The path in mmu_page_zap_pte() that recursively zaps a parentless
nested TDP child has no such check. As a result, a shadow page can
be zapped even if the page itself can't be freed; as the comment in
kvm_mmu_zap_oldest_mmu_pages() notes, zapping it will just force vCPUs
to rebuild the page.
As in top-level reclaim, do not recursively prepare zapping of a
nested TDP child whose root_count is non-zero.
Fixes: 2de4085cccea ("KVM: x86/MMU: Recursively zap nested TDP SPs when zapping last/only parent")
Signed-off-by: Hyunwoo Kim <imv4bel@gmail.com>
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
Diffstat (limited to 'arch')
| -rw-r--r-- | arch/x86/kvm/mmu/mmu.c | 1 |
1 files changed, 1 insertions, 0 deletions
diff --git a/arch/x86/kvm/mmu/mmu.c b/arch/x86/kvm/mmu/mmu.c index 41f92ed1ca37..7e80abba7313 100644 --- a/arch/x86/kvm/mmu/mmu.c +++ b/arch/x86/kvm/mmu/mmu.c @@ -2642,6 +2642,7 @@ static int mmu_page_zap_pte(struct kvm *kvm, struct kvm_mmu_page *sp, */ if (tdp_enabled && invalid_list && child->role.guest_mode && + !child->root_count && !atomic_long_read(&child->parent_ptes.val)) return kvm_mmu_prepare_zap_page(kvm, child, invalid_list); |