[PATCH 6.18.y] KVM: x86/mmu: Preserve nested TDP shadow page tables if they are used as roots

[PATCH 6.18.y] KVM: x86/mmu: Preserve nested TDP shadow page tables if they are used as roots

[Sean Christopherson]

From: Hyunwoo Kim <imv4bel@gmail.com>

kvm_mmu_zap_oldest_mmu_pages() excludes a shadow page whose root_count
is non-zero from top-level reclaim, because such a page cannot be
freed. The path in mmu_page_zap_pte() that recursively zaps a parentless
nested TDP child has no such check. As a result, a shadow page can
be zapped even if the page itself can't be freed; as the comment in
kvm_mmu_zap_oldest_mmu_pages() notes, zapping it will just force vCPUs
to rebuild the page.

As in top-level reclaim, do not recursively prepare zapping of a
nested TDP child whose root_count is non-zero.

Fixes: 2de4085cccea ("KVM: x86/MMU: Recursively zap nested TDP SPs when zapping last/only parent")
Signed-off-by: Hyunwoo Kim <imv4bel@gmail.com>
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
Signed-off-by: Sean Christopherson <seanjc@google.com>
---
 arch/x86/kvm/mmu/mmu.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/arch/x86/kvm/mmu/mmu.c b/arch/x86/kvm/mmu/mmu.c
index 205d314a7583..1fa251ca4dcc 100644
--- a/arch/x86/kvm/mmu/mmu.c
+++ b/arch/x86/kvm/mmu/mmu.c
@@ -2630,6 +2630,7 @@ static int mmu_page_zap_pte(struct kvm *kvm, struct kvm_mmu_page *sp,
 			 */
 			if (tdp_enabled && invalid_list &&
 			    child->role.guest_mode &&
+			    !child->root_count &&
 			    !atomic_long_read(&child->parent_ptes.val))
 				return kvm_mmu_prepare_zap_page(kvm, child,
 								invalid_list);

base-commit: 2ff600d29ee478d0a8d46ef8a58afb5e038fe692
-- 
2.56.0.218.g1ec904b173-goog

Re: [PATCH 6.18.y] KVM: x86/mmu: Preserve nested TDP shadow page tables if they are used as roots

[Sean Christopherson]

On Tue, Oct 20, 2026, Sean Christopherson wrote:
> From: Hyunwoo Kim <imv4bel@gmail.com>

Gah, I'm rusty sending patches to stable@.  This should have:

[ Upstream commit 7a2c70e777a00c32ebafd376a6fe31ebb91c5b20 ]

I'll spam a v2 right away so that I don't forget...

> kvm_mmu_zap_oldest_mmu_pages() excludes a shadow page whose root_count
> is non-zero from top-level reclaim, because such a page cannot be
> freed. The path in mmu_page_zap_pte() that recursively zaps a parentless
> nested TDP child has no such check. As a result, a shadow page can
> be zapped even if the page itself can't be freed; as the comment in
> kvm_mmu_zap_oldest_mmu_pages() notes, zapping it will just force vCPUs
> to rebuild the page.
> 
> As in top-level reclaim, do not recursively prepare zapping of a
> nested TDP child whose root_count is non-zero.
> 
> Fixes: 2de4085cccea ("KVM: x86/MMU: Recursively zap nested TDP SPs when zapping last/only parent")
> Signed-off-by: Hyunwoo Kim <imv4bel@gmail.com>
> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
> Signed-off-by: Sean Christopherson <seanjc@google.com>
> ---
>  arch/x86/kvm/mmu/mmu.c | 1 +
>  1 file changed, 1 insertion(+)
> 
> diff --git a/arch/x86/kvm/mmu/mmu.c b/arch/x86/kvm/mmu/mmu.c
> index 205d314a7583..1fa251ca4dcc 100644
> --- a/arch/x86/kvm/mmu/mmu.c
> +++ b/arch/x86/kvm/mmu/mmu.c
> @@ -2630,6 +2630,7 @@ static int mmu_page_zap_pte(struct kvm *kvm, struct kvm_mmu_page *sp,
>  			 */
>  			if (tdp_enabled && invalid_list &&
>  			    child->role.guest_mode &&
> +			    !child->root_count &&
>  			    !atomic_long_read(&child->parent_ptes.val))
>  				return kvm_mmu_prepare_zap_page(kvm, child,
>  								invalid_list);
> 
> base-commit: 2ff600d29ee478d0a8d46ef8a58afb5e038fe692
> -- 
> 2.56.0.218.g1ec904b173-goog