On Wed, Jan 25, 2023 at 5:49 PM Sean Christopherson <seanjc@xxxxxxxxxx> wrote: [...] > --- > arch/x86/kvm/mmu/tdp_mmu.c | 92 ++++++++++---------------------------- > 1 file changed, 24 insertions(+), 68 deletions(-) > > diff --git a/arch/x86/kvm/mmu/tdp_mmu.c b/arch/x86/kvm/mmu/tdp_mmu.c > index bba33aea0fb0..2f78ca43a276 100644 > --- a/arch/x86/kvm/mmu/tdp_mmu.c > +++ b/arch/x86/kvm/mmu/tdp_mmu.c [...] > @@ -1289,8 +1244,7 @@ static bool age_gfn_range(struct kvm *kvm, struct tdp_iter *iter, > new_spte = mark_spte_for_access_track(new_spte); > } > > - tdp_mmu_set_spte_no_acc_track(kvm, iter, new_spte); > - > + kvm_tdp_mmu_write_spte(iter->sptep, iter->old_spte, new_spte, iter->level); This can race with fast_page_fault() setting the W-bit and the CPU setting the D-bit. i.e. This call to kvm_tdp_mmu_write_spte() could clear the W-bit or D-bit. > @@ -1703,9 +1657,11 @@ static void clear_dirty_pt_masked(struct kvm *kvm, struct kvm_mmu_page *root, > new_spte = iter.old_spte & ~shadow_dirty_mask; > else > continue; > + > + kvm_set_pfn_dirty(spte_to_pfn(iter.old_spte)); > } > > - tdp_mmu_set_spte_no_dirty_log(kvm, &iter, new_spte); > + kvm_tdp_mmu_write_spte(iter.sptep, iter.old_spte, new_spte, iter.level); Similar issue here. This call to kvm_tdp_mmu_write_spte() could clear the A-bit or mark the SPTE for access-tracking. > -- >
