Commit 2e8a2c1b0306 for kernel

commit 2e8a2c1b03068d76782343446f1b2114ae2ee0bd
Author: Jinu Kim <kimjw04271234@gmail.com>
Date:   Tue Jul 21 19:35:12 2026 +0900

    KVM: x86/mmu: Check all address spaces before skipping unsync

    mmu_try_to_unsync_pages() skips the shadow-page lookup when the
    supplied memslot allows a hugepage, because a shadow page would disallow
    hugepages.  But hugepage metadata is per-address-space while shadow pages
    are shared across all address spaces.  With SMM, the other address space
    can therefore have a shadow page even when the supplied memslot allows a
    hugepage.

    Check the corresponding memslot in the other address space before
    taking the fast path.  Skip the shadow-page lookup only when all address
    spaces allow a hugepage.

    Fixes: b3ae3ceb5569 ("KVM: x86/mmu: KVM: x86/mmu: Skip unsync when large pages are allowed")
    Assisted-by: Codex:GPT-5
    Signed-off-by: Jinu Kim <kimjw04271234@gmail.com>
    [invert direction of the conditional. - Paolo]
    Message-ID: <20260721103512.2136240-3-kimjw04271234@gmail.com>
    Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>

diff --git a/arch/x86/kvm/mmu/mmu.c b/arch/x86/kvm/mmu/mmu.c
index 22cf222d3033..66e69d2a41b3 100644
--- a/arch/x86/kvm/mmu/mmu.c
+++ b/arch/x86/kvm/mmu/mmu.c
@@ -722,6 +722,26 @@ static struct kvm_lpage_info *lpage_info_slot(gfn_t gfn,
 	return &slot->arch.lpage_info[level - 2][idx];
 }

+static bool kvm_gfn_is_lpage_allowed(struct kvm *kvm,
+				     const struct kvm_memory_slot *slot,
+				     gfn_t gfn, int level)
+{
+	const struct kvm_memory_slot *other_slot;
+
+	BUILD_BUG_ON(KVM_MAX_NR_ADDRESS_SPACES > 2);
+
+	if (lpage_info_slot(gfn, slot, level)->disallow_lpage)
+		return false;
+
+	if (kvm_arch_nr_memslot_as_ids(kvm) > 1) {
+		other_slot = __gfn_to_memslot(__kvm_memslots(kvm, slot->as_id ^ 1), gfn);
+		if (other_slot && lpage_info_slot(gfn, other_slot, level)->disallow_lpage)
+			return false;
+	}
+
+	return true;
+}
+
 /*
  * The most significant bit in disallow_lpage tracks whether or not memory
  * attributes are mixed, i.e. not identical for all gfns at the current level.
@@ -2968,7 +2988,7 @@ int mmu_try_to_unsync_pages(struct kvm *kvm, const struct kvm_memory_slot *slot,
 	 * write-protected (see above), thus if the gfn can be mapped with a
 	 * hugepage and isn't write-tracked, it can't have a shadow page.
 	 */
-	if (!lpage_info_slot(gfn, slot, PG_LEVEL_2M)->disallow_lpage)
+	if (kvm_gfn_is_lpage_allowed(kvm, slot, gfn, PG_LEVEL_2M))
 		return 0;

 	/*