Re: [PATCH v2 1/4] KVM: SEV: Treat unassigned RMP entry as benign race on PSMASH failure

On Tue, Aug 18, 2026 at 09:15:52AM +0000, Ackerley Tng wrote:
> When handling an RMP fault, KVM attempts to split a 2MB page via PSMASH.
> If PSMASH fails, the only expected return value is FAIL_BADADDR, which does
> not distinguish the reason for the bad address. Hence, another RMP entry
> lookup is required to determine whether the failure was benign.
> 
> Specifically, KVM re-checks the RMP entry to determine if another CPU raced
> and already smashed the entry into 4KB pages.
> 
> A concurrent operation (such as guest_memfd truncation or hole punching)
> can also race and transition the page to shared, removing the page from the
> RMP table and causing PSMASH to fail. This can happen even if the page is
> still referenced by KVM, because guest_memfd reclaim transitions the RMP
> entry to shared when the folio is removed from the page cache.
> 
> Treat an unassigned RMP entry as an expected race when re-checking after a
> failed PSMASH, and skip logging an error warning.
> 
> Fixes: c63cf135cc99 ("KVM: SEV: Add support to handle RMP nested page faults")
> Signed-off-by: Ackerley Tng <[email protected]>

Reviewed-by: Michael Roth <[email protected]>

> ---
>  arch/x86/kvm/svm/sev.c | 5 +++--
>  1 file changed, 3 insertions(+), 2 deletions(-)
> 
> diff --git a/arch/x86/kvm/svm/sev.c b/arch/x86/kvm/svm/sev.c
> index fcb41dfde4c02..b2738362a928b 100644
> --- a/arch/x86/kvm/svm/sev.c
> +++ b/arch/x86/kvm/svm/sev.c
> @@ -5074,10 +5074,11 @@ void sev_handle_rmp_fault(struct kvm_vcpu *vcpu, gpa_t gpa, u64 error_code)
>  		/*
>  		 * Look it up again. If it's 4K now then the PSMASH may have
>  		 * raced with another process and the issue has already resolved
> -		 * itself.
> +		 * itself. If it's not assigned, then this must have raced with
> +		 * another process that made this page shared.
>  		 */
>  		if (!snp_lookup_rmpentry(pfn, &assigned, &rmp_level) &&
> -		    assigned && rmp_level == PG_LEVEL_4K)
> +		    ((assigned && rmp_level == PG_LEVEL_4K) || !assigned))
>  			goto out;
>  
>  		pr_warn_ratelimited("SEV: Unable to split RMP entry for GPA 0x%llx PFN 0x%llx ret %d\n",
> 
> -- 
> 2.55.0.699.gb54405d56f-goog
>