Re: [PATCH 1/4] KVM: x86/mmu: WARN, don't BUG, when walking a cached root with a PAE MMU

[Yosry Ahmed]

On Wed, Oct 14, 2026 at 5:48 AM Jim Mattson <jmattson@xxxxxxxxxx> wrote:
>
> On Tue, Oct 13, 2026 at 4:17 PM Yosry Ahmed <yosry@xxxxxxxxxx> wrote:
> >
> > Replace the BUG_ON() in shadow_walk_init_using_root() that guards against
> > walking a cached (previous) root while the MMU is configured for PAE
> > paging with a WARN_ON_ONCE(), and terminate the walk if the WARN fires.
> > Walking a cached root with a PAE MMU is a KVM bug, as PAE roots are never
> > cached, but there's no need to bring down the host, as KVM can simply
> > bail from the walk.
> >
> > Note, the BUG_ON() is currently reachable by a guest if TDP is disabled,
> > as KVM walks cached roots even if they were created for a different MMU
> > context, e.g. if L2 executes INVLPG while using PAE paging, L1 doesn't
> > intercept INVLPG, and L1's 64-bit root is cached.
> >
> > Add a common error label for terminating the walk, and use it for the
> > existing invalid/dummy root check as well.
> >
> > Fixes: 7eb77e9f5fcf ("kvm: x86: Add a root_hpa parameter to kvm_mmu->invlpg()")
> > Cc: stable@xxxxxxxxxxxxxxx
> > Assisted-by: LLM
> > Signed-off-by: Yosry Ahmed <yosry@xxxxxxxxxx>
> > ---
> >  arch/x86/kvm/mmu/mmu.c | 13 ++++++++-----
> >  1 file changed, 8 insertions(+), 5 deletions(-)
> >
> > diff --git a/arch/x86/kvm/mmu/mmu.c b/arch/x86/kvm/mmu/mmu.c
> > index aadd5bdc2c97a..126faef5a6476 100644
> > --- a/arch/x86/kvm/mmu/mmu.c
> > +++ b/arch/x86/kvm/mmu/mmu.c
> > @@ -2558,10 +2558,8 @@ static void shadow_walk_init_using_root(struct kvm_shadow_walk_iterator *iterato
> >         iterator->addr = addr;
> >         iterator->shadow_addr = root;
> >
> > -       if (WARN_ON_ONCE(!VALID_PAGE(root)) || kvm_mmu_is_dummy_root(root)) {
> > -               iterator->level = 0;
> > -               return;
> > -       }
> > +       if (WARN_ON_ONCE(!VALID_PAGE(root)) || kvm_mmu_is_dummy_root(root))
> > +               goto error;
> >
> >         iterator->level = vcpu->arch.mmu->root_role.level;
> >
> > @@ -2575,7 +2573,8 @@ static void shadow_walk_init_using_root(struct kvm_shadow_walk_iterator *iterato
> >                  * prev_root is currently only used for 64-bit hosts. So only
> >                  * the active root_hpa is valid here.
> >                  */
>
> Can you please rewrite this poorly worded comment that now explains
> your code below? What do 64-bit *hosts* have to do with this
> bug/warning? I assume that should be 64-bit *guests*. But, even that's
> imprecise. Aren't prev_roots tied to 4- or 5- level paging (i.e. long mode)?

I believe it should say that PAE roots are not cached, so only the
current root should reach here. Right?

I can reword when I respin.

>
> > -               BUG_ON(root != vcpu->arch.mmu->root.hpa);
> > +               if (WARN_ON_ONCE(root != vcpu->arch.mmu->root.hpa))
> > +                       goto error;