Re: [PATCH 1/4] KVM: x86/mmu: WARN, don't BUG, when walking a cached root with a PAE MMU

[Jim Mattson]

On Tue, Oct 13, 2026 at 4:17 PM Yosry Ahmed <yosry@xxxxxxxxxx> wrote:
>
> Replace the BUG_ON() in shadow_walk_init_using_root() that guards against
> walking a cached (previous) root while the MMU is configured for PAE
> paging with a WARN_ON_ONCE(), and terminate the walk if the WARN fires.
> Walking a cached root with a PAE MMU is a KVM bug, as PAE roots are never
> cached, but there's no need to bring down the host, as KVM can simply
> bail from the walk.
>
> Note, the BUG_ON() is currently reachable by a guest if TDP is disabled,
> as KVM walks cached roots even if they were created for a different MMU
> context, e.g. if L2 executes INVLPG while using PAE paging, L1 doesn't
> intercept INVLPG, and L1's 64-bit root is cached.
>
> Add a common error label for terminating the walk, and use it for the
> existing invalid/dummy root check as well.
>
> Fixes: 7eb77e9f5fcf ("kvm: x86: Add a root_hpa parameter to kvm_mmu->invlpg()")
> Cc: stable@xxxxxxxxxxxxxxx
> Assisted-by: LLM
> Signed-off-by: Yosry Ahmed <yosry@xxxxxxxxxx>
> ---
>  arch/x86/kvm/mmu/mmu.c | 13 ++++++++-----
>  1 file changed, 8 insertions(+), 5 deletions(-)
>
> diff --git a/arch/x86/kvm/mmu/mmu.c b/arch/x86/kvm/mmu/mmu.c
> index aadd5bdc2c97a..126faef5a6476 100644
> --- a/arch/x86/kvm/mmu/mmu.c
> +++ b/arch/x86/kvm/mmu/mmu.c
> @@ -2558,10 +2558,8 @@ static void shadow_walk_init_using_root(struct kvm_shadow_walk_iterator *iterato
>         iterator->addr = addr;
>         iterator->shadow_addr = root;
>
> -       if (WARN_ON_ONCE(!VALID_PAGE(root)) || kvm_mmu_is_dummy_root(root)) {
> -               iterator->level = 0;
> -               return;
> -       }
> +       if (WARN_ON_ONCE(!VALID_PAGE(root)) || kvm_mmu_is_dummy_root(root))
> +               goto error;
>
>         iterator->level = vcpu->arch.mmu->root_role.level;
>
> @@ -2575,7 +2573,8 @@ static void shadow_walk_init_using_root(struct kvm_shadow_walk_iterator *iterato
>                  * prev_root is currently only used for 64-bit hosts. So only
>                  * the active root_hpa is valid here.
>                  */

Can you please rewrite this poorly worded comment that now explains
your code below? What do 64-bit *hosts* have to do with this
bug/warning? I assume that should be 64-bit *guests*. But, even that's
imprecise. Aren't prev_roots tied to 4- or 5- level paging (i.e. long mode)?

> -               BUG_ON(root != vcpu->arch.mmu->root.hpa);
> +               if (WARN_ON_ONCE(root != vcpu->arch.mmu->root.hpa))
> +                       goto error;