[PATCH v2] KVM: x86/mmu: Fix NX page unaccounting for TDP MMU pages

[PATCH v2] KVM: x86/mmu: Fix NX page unaccounting for TDP MMU pages

[Carlos López]

unaccount_nx_huge_page() unconditionally passes KVM_SHADOW_MMU to
untrack_possible_nx_huge_page(), which is incorrect, particularly on
the path from kvm_recover_nx_huge_pages(), which handles pages from
both MMUs.

Fix this by adding a helper to retrieve the MMU type of a page and use
it to pass the correct variant down.

Fixes: 6777885605e1 ("KVM: x86/mmu: Track possible NX huge pages separately for TDP vs. Shadow MMU")
Signed-off-by: Carlos López <clopez@suse.de>
---
v2:
  * Use a helper to retrieve the MMU type to avoid referencing KVM_TDP_MMU for
    32 bit builds (Sashiko).
 arch/x86/kvm/mmu/mmu.c     |  2 +-
 arch/x86/kvm/mmu/tdp_mmu.h | 11 +++++++++++
 2 files changed, 12 insertions(+), 1 deletion(-)

diff --git a/arch/x86/kvm/mmu/mmu.c b/arch/x86/kvm/mmu/mmu.c
index 9788ff180374..fa3e9ff7bec1 100644
--- a/arch/x86/kvm/mmu/mmu.c
+++ b/arch/x86/kvm/mmu/mmu.c
@@ -868,7 +868,7 @@ static void unaccount_nx_huge_page(struct kvm *kvm, struct kvm_mmu_page *sp)
 {
 	sp->nx_huge_page_disallowed = false;
 
-	untrack_possible_nx_huge_page(kvm, sp, KVM_SHADOW_MMU);
+	untrack_possible_nx_huge_page(kvm, sp, page_mmu_type(sp));
 }
 
 static struct kvm_memory_slot *gfn_to_memslot_dirty_bitmap(struct kvm_vcpu *vcpu,
diff --git a/arch/x86/kvm/mmu/tdp_mmu.h b/arch/x86/kvm/mmu/tdp_mmu.h
index bd62977c9199..17e506ea3298 100644
--- a/arch/x86/kvm/mmu/tdp_mmu.h
+++ b/arch/x86/kvm/mmu/tdp_mmu.h
@@ -115,8 +115,19 @@ u64 *kvm_tdp_mmu_fast_pf_get_last_sptep(struct kvm_vcpu *vcpu, gfn_t gfn,
 
 #ifdef CONFIG_X86_64
 static inline bool is_tdp_mmu_page(struct kvm_mmu_page *sp) { return sp->tdp_mmu_page; }
+
+static inline enum kvm_mmu_type page_mmu_type(struct kvm_mmu_page *sp) {
+	return is_tdp_mmu_page(sp) ? KVM_TDP_MMU : KVM_SHADOW_MMU;
+}
+
 #else
+
 static inline bool is_tdp_mmu_page(struct kvm_mmu_page *sp) { return false; }
+
+static inline enum kvm_mmu_type page_mmu_type(struct kvm_mmu_page *sp) {
+	return KVM_SHADOW_MMU;
+}
+
 #endif
 
 #endif /* __KVM_X86_MMU_TDP_MMU_H */

base-commit: 70c944caf570fda2d79baa71435589a8db39f048
-- 
2.51.0

Re: [PATCH v2] KVM: x86/mmu: Fix NX page unaccounting for TDP MMU pages

[Sean Christopherson]

On Wed, Sep 16, 2026, Carlos López wrote:
> unaccount_nx_huge_page() unconditionally passes KVM_SHADOW_MMU to
> untrack_possible_nx_huge_page(), which is incorrect, particularly on
> the path from kvm_recover_nx_huge_pages(), which handles pages from
> both MMUs.
> 
> Fix this by adding a helper to retrieve the MMU type of a page and use
> it to pass the correct variant down.
> 
> Fixes: 6777885605e1 ("KVM: x86/mmu: Track possible NX huge pages separately for TDP vs. Shadow MMU")
> Signed-off-by: Carlos López <clopez@suse.de>
> ---
> v2:
>   * Use a helper to retrieve the MMU type to avoid referencing KVM_TDP_MMU for
>     32 bit builds (Sashiko).
>  arch/x86/kvm/mmu/mmu.c     |  2 +-
>  arch/x86/kvm/mmu/tdp_mmu.h | 11 +++++++++++
>  2 files changed, 12 insertions(+), 1 deletion(-)
> 
> diff --git a/arch/x86/kvm/mmu/mmu.c b/arch/x86/kvm/mmu/mmu.c
> index 9788ff180374..fa3e9ff7bec1 100644
> --- a/arch/x86/kvm/mmu/mmu.c
> +++ b/arch/x86/kvm/mmu/mmu.c
> @@ -868,7 +868,7 @@ static void unaccount_nx_huge_page(struct kvm *kvm, struct kvm_mmu_page *sp)
>  {
>  	sp->nx_huge_page_disallowed = false;
>  
> -	untrack_possible_nx_huge_page(kvm, sp, KVM_SHADOW_MMU);
> +	untrack_possible_nx_huge_page(kvm, sp, page_mmu_type(sp));

I would rather pass in the MMU type.  That avoids page_mmu_type(), and also makes
it clear unaccount_nx_huge_page() is a common API, whereas account_nx_huge_page()
can only be used by the shadow MMU because setting nx_huge_page_disallowed needs
to be done before the page is linked in the TDP MMU, i.e. needs to be decoupled
from the tracking.

diff --git a/arch/x86/kvm/mmu/mmu.c b/arch/x86/kvm/mmu/mmu.c
index c254d96bd332..482818947737 100644
--- a/arch/x86/kvm/mmu/mmu.c
+++ b/arch/x86/kvm/mmu/mmu.c
@@ -864,11 +864,12 @@ void untrack_possible_nx_huge_page(struct kvm *kvm, struct kvm_mmu_page *sp,
 	list_del_init(&sp->possible_nx_huge_page_link);
 }
 
-static void unaccount_nx_huge_page(struct kvm *kvm, struct kvm_mmu_page *sp)
+static void unaccount_nx_huge_page(struct kvm *kvm, struct kvm_mmu_page *sp,
+				   enum kvm_mmu_type mmu_type)
 {
 	sp->nx_huge_page_disallowed = false;
 
-	untrack_possible_nx_huge_page(kvm, sp, KVM_SHADOW_MMU);
+	untrack_possible_nx_huge_page(kvm, sp, mmu_type);
 }
 
 static struct kvm_memory_slot *gfn_to_memslot_dirty_bitmap(struct kvm_vcpu *vcpu,
@@ -2835,7 +2836,7 @@ static bool __kvm_mmu_prepare_zap_page(struct kvm *kvm,
 	}
 
 	if (sp->nx_huge_page_disallowed)
-		unaccount_nx_huge_page(kvm, sp);
+		unaccount_nx_huge_page(kvm, sp, KVM_SHADOW_MMU);
 
 	sp->role.invalid = 1;
 
@@ -8061,7 +8062,7 @@ static void kvm_recover_nx_huge_pages(struct kvm *kvm,
 		WARN_ON_ONCE(!sp->nx_huge_page_disallowed);
 		WARN_ON_ONCE(!sp->role.direct);
 
-		unaccount_nx_huge_page(kvm, sp);
+		unaccount_nx_huge_page(kvm, sp, mmu_type);
 
 		if (is_tdp_mmu)
 			spin_unlock(tdp_mmu_pages_lock);