[PATCH v2 0/2] KVM: x86/mmu: fix cross-address-space MMU metadata checks

[Jinu Kim <kimjw04271234@gmail.com>]

The x86 shadow MMU keeps write-tracking and hugepage metadata per address
space, but shares the shadow-page hash across all address spaces.  With SMM,
checking only the supplied memslot can therefore miss metadata for the same
GFN in the other address space.

For write tracking, this can allow an upper-level shadow page to become
unsync.  Synchronizing the page later can treat a non-leaf SPTE as a leaf and
reach the BUG in pte_list_remove().  The observed nested-VMX failure was:

  WARNING: mmu_try_to_unsync_pages
  WARNING: ept_sync_spte
  kernel BUG at arch/x86/kvm/mmu/mmu.c:1104
  RIP: pte_list_remove.isra.0

Patch 1 makes kvm_gfn_is_write_tracked() check both x86 address spaces so
that all callers honor write tracking regardless of the active address
space.

Patch 2 makes the hugepage fast path in mmu_try_to_unsync_pages() check both
address spaces before skipping the shadow-page lookup.  It is kept separate
because the hugepage optimization was added much more recently than the
write-tracking bug.

The series is based on commit
6bc96b971766fbbbbdd9fb2642cedacaf02da957.

Testing on Intel VMX:

- Patch 1 alone completed the reproducer without a KVM warning or fault;
  vmx_pf_exception_test passed all 75 checks.
- Patch 2 alone built and loaded successfully; vmx_pse_test passed all 92
  checks.
- The full series completed the reproducer without a KVM warning or fault;
  vmx_pse_test passed all 92 checks with EPT enabled and all 92 checks with
  EPT disabled.
- bzImage, kvm.ko, kvm-intel.ko, and irqbypass.ko built successfully with
  CONFIG_KVM_WERROR=y.

Changes from v1:

- Split the write-tracking and hugepage fixes for independent backporting.
- Move the cross-address-space write-tracking check into
  kvm_gfn_is_write_tracked() so that all callers are covered.
- Check the supplied memslot before consulting the other address space.

Jinu Kim (2):
  KVM: x86/mmu: Check write tracking in all address spaces
  KVM: x86/mmu: Check all address spaces before skipping unsync

 arch/x86/kvm/mmu/mmu.c        | 21 ++++++++++++++++++++-
 arch/x86/kvm/mmu/page_track.c | 26 +++++++++++++++++++++++---
 2 files changed, 43 insertions(+), 4 deletions(-)

--
2.43.0