Re: [PATCH v2] KVM: x86/mmu: Write-protect tracked GFNs in all address spaces

[Artem Dinaburg <artem@trailofbits.com>]

On Wed, Aug 05, 2026 at 12:14:04PM -0700, Sean Christopherson wrote:
> Actually, irrespective of what we do with SMM, we should harden KVM to
> skip marking upper-level SPs as unsync, because while corrupting guest
> memory is bad, corrupting guest memory *and* crashing/compromising the
> host is worse.

This is correct. There is a working guest-to-host escape via an
upper-level unsync shadow page. It works on Debian oldstable and
likely other shipping distributions. I'd like to see that patch
applied even if the SMM question stays open.

> it wasn't clear to me how marking an upper-level SP as unsync leads to a
> corrupted rmap, and I hadn't thought too hard about it.

There is a bug, unrelated to rmap and still unfixed in the longterm
trees, that turns an unsync upper-level shadow page into a writable
mapping the guest shouldn't have. It can be readily found via AI
assistance.

Either of the two suggested fixes would be fine, but the unsync
behavior is dangerous and should be prevented.