linux/arch/x86/kvm
Sean Christopherson df83746075 KVM: x86/mmu: Only WARN in direct MMUs when overwriting shadow-present SPTE
Adjust KVM's sanity check against overwriting a shadow-present SPTE with a
another SPTE with a different target PFN to only apply to direct MMUs,
i.e. only to MMUs without shadowed gPTEs.  While it's impossible for KVM
to overwrite a shadow-present SPTE in response to a guest write, writes
from outside the scope of KVM, e.g. from host userspace, aren't detected
by KVM's write tracking and so can break KVM's shadow paging rules.

  ------------[ cut here ]------------
  pfn != spte_to_pfn(*sptep)
  WARNING: arch/x86/kvm/mmu/mmu.c:3069 at mmu_set_spte+0x1e4/0x440 [kvm], CPU#0: vmx_ept_stale_r/872
  Modules linked in: kvm_intel kvm irqbypass
  CPU: 0 UID: 1000 PID: 872 Comm: vmx_ept_stale_r Not tainted 7.0.0-rc2-eafebd2d2ab0-sink-vm #319 PREEMPT
  Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 0.0.0 02/06/2015
  RIP: 0010:mmu_set_spte+0x1e4/0x440 [kvm]
  Call Trace:
   <TASK>
   ept_page_fault+0x535/0x7f0 [kvm]
   kvm_mmu_do_page_fault+0xee/0x1f0 [kvm]
   kvm_mmu_page_fault+0x8d/0x620 [kvm]
   vmx_handle_exit+0x18c/0x5a0 [kvm_intel]
   kvm_arch_vcpu_ioctl_run+0xc55/0x1c20 [kvm]
   kvm_vcpu_ioctl+0x2d5/0x980 [kvm]
   __x64_sys_ioctl+0x8a/0xd0
   do_syscall_64+0xb5/0x730
   entry_SYSCALL_64_after_hwframe+0x4b/0x53
   </TASK>
  ---[ end trace 0000000000000000 ]---

Fixes: 11d4517511 ("KVM: x86/mmu: Warn if PFN changes on shadow-present SPTE in shadow MMU")
Cc: stable@vger.kernel.org
Signed-off-by: Sean Christopherson <seanjc@google.com>
2026-03-27 22:33:33 +01:00
..
mmu KVM: x86/mmu: Only WARN in direct MMUs when overwriting shadow-present SPTE 2026-03-27 22:33:33 +01:00
svm KVM: x86: clarify leave_smm() return value 2026-03-11 18:41:12 +01:00
vmx KVM: x86: clarify leave_smm() return value 2026-03-11 18:41:12 +01:00
.gitignore KVM: x86: use a separate asm-offsets.c file 2022-11-09 12:10:17 -05:00
Kconfig KVM: remove CONFIG_KVM_GENERIC_MMU_NOTIFIER 2026-02-28 15:31:35 +01:00
Makefile KVM: x86: Enforce use of EXPORT_SYMBOL_FOR_KVM_INTERNAL 2026-01-12 09:31:20 -08:00
cpuid.c KVM: x86: synthesize CPUID bits only if CPU capability is set 2026-03-11 18:41:11 +01:00
cpuid.h KVM: x86: Harden against unexpected adjustments to kvm_cpu_caps 2026-01-30 13:28:29 -08:00
debugfs.c KVM: Get rid of return value from kvm_arch_create_vm_debugfs() 2024-02-23 21:44:58 +00:00
emulate.c KVM: x86: Enable support for emulating AVX MOV instructions 2025-11-20 07:26:08 -08:00
fpu.h KVM: x86: Add AVX support to the emulator's register fetch and writeback 2025-11-19 14:30:54 -08:00
hyperv.c KVM: x86: hyper-v: Validate all GVAs during PV TLB flush 2026-03-11 18:41:11 +01:00
hyperv.h KVM: x86: Drop superfluous kvm_hv_set_sint() => kvm_hv_synic_set_irq() wrapper 2025-06-20 13:52:43 -07:00
i8254.c treewide: Replace kmalloc with kmalloc_obj for non-scalar types 2026-02-21 01:02:28 -08:00
i8254.h KVM: x86: Move IRQ mask notifier infrastructure to I/O APIC emulation 2025-06-20 13:52:52 -07:00
i8259.c treewide: Replace kmalloc with kmalloc_obj for non-scalar types 2026-02-21 01:02:28 -08:00
ioapic.c KVM: x86: Fix SRCU list traversal in kvm_fire_mask_notifiers() 2026-03-11 18:41:11 +01:00
ioapic.h KVM: x86: Bury ioapic.h definitions behind CONFIG_KVM_IOAPIC 2026-01-12 09:31:41 -08:00
irq.c Merge tag 'kvm-x86-apic-6.20' of https://github.com/kvm-x86/linux into HEAD 2026-02-11 12:45:32 -05:00
irq.h KVM: x86: Move kvm_irq_delivery_to_apic() from irq.c to lapic.c 2025-09-10 12:05:09 -07:00
kvm-asm-offsets.c KVM: SVM: move MSR_IA32_SPEC_CTRL save/restore to assembly 2022-11-09 12:25:53 -05:00
kvm_cache_regs.h KVM: VMX: Make CR4.CET a guest owned bit 2025-09-23 10:03:09 -07:00
kvm_emulate.h KVM: x86: Refactor REX prefix handling in instruction emulation 2025-11-19 14:36:38 -08:00
kvm_onhyperv.c KVM: x86: Export KVM-internal symbols for sub-modules only 2025-09-30 13:40:02 -04:00
kvm_onhyperv.h KVM: x86: Move Hyper-V partition assist page out of Hyper-V emulation context 2023-12-07 09:34:01 -08:00
lapic.c treewide: Replace kmalloc with kmalloc_obj for non-scalar types 2026-02-21 01:02:28 -08:00
lapic.h Merge tag 'kvm-x86-apic-6.20' of https://github.com/kvm-x86/linux into HEAD 2026-02-11 12:45:32 -05:00
mmu.h KVM TDX changes for 6.19: 2025-11-26 09:36:37 +01:00
mtrr.c KVM: x86: drop x86.h include from cpuid.h 2024-11-01 09:22:23 -07:00
pmu.c Merge tag 'kvm-x86-pmu-6.20' of https://github.com/kvm-x86/linux into HEAD 2026-02-11 12:45:40 -05:00
pmu.h KVM: x86/pmu: Disallow emulation in the fastpath if mediated PMCs are active 2026-01-08 11:52:12 -08:00
reverse_cpuid.h KVM: x86: Advertise AVX10_VNNI_INT CPUID to userspace 2026-01-23 10:00:02 -08:00
smm.c KVM: x86: Export KVM-internal symbols for sub-modules only 2025-09-30 13:40:02 -04:00
smm.h KVM: x86: Save and reload SSP to/from SMRAM 2025-09-23 09:11:22 -07:00
trace.h KVM: SVM: Treat exit_code as an unsigned 64-bit value through all of KVM 2026-01-13 17:37:03 -08:00
tss.h
x86.c KVM generic changes for 7.0 2026-03-11 18:01:55 +01:00
x86.h Merge tag 'kvm-x86-pmu-6.20' of https://github.com/kvm-x86/linux into HEAD 2026-02-11 12:45:40 -05:00
xen.c Convert 'alloc_obj' family to use the new default GFP_KERNEL argument 2026-02-21 17:09:51 -08:00
xen.h KVM: x86: Update Xen TSC leaves during CPUID emulation 2025-02-25 07:09:55 -08:00