[PATCH] KVM: arm64: Adjust range correctly during host stage-2 faults

[Marc Zyngier]

On Wed, 25 Jun 2025 11:55:48 +0100,
Quentin Perret <qperret at google.com> wrote:
> 
> host_stage2_adjust_range() tries to find the largest block mapping that
> fits within a memory or mmio region (represented by a kvm_mem_range in
> this function) during host stage-2 faults under pKVM. To do so, it walks
> the host stage-2 page-table, finds the faulting PTE and its level, and
> then progressively increments the level until it finds a granule of the
> appropriate size. However, the condition in the loop implementing the
> above is broken as it checks kvm_level_supports_block_mapping() for the
> next level instead of the current, so pKVM may attempt to map a region
> larger than can be covered with a single block.
> 
> This is not a security problem and is quite rare in practice (the
> kvm_mem_range check usually forces host_stage2_adjust_range() to choose a
> smaller granule), but this is clearly not the expected behaviour.
> 
> Refactor the loop to fix the bug and improve readability.
> 
> Fixes: c4f0935e4d95 ("KVM: arm64: Optimize host memory aborts")
> Signed-off-by: Quentin Perret <qperret at google.com>

This patch prevents my O6 board from booting in protected mode as of
e728e705802fe. Reverting it on top of 7.0-rc2 make the box work again.

I haven't quite worked out why though. The hack below makes it work,
but implies that we can get ranges that are smaller than a page.  That
feels unlikely, but I'm not sure we can rule it out (the kernel page
size could be pretty large anyway).

Any idea?

	M.

diff --git a/arch/arm64/kvm/hyp/nvhe/mem_protect.c b/arch/arm64/kvm/hyp/nvhe/mem_protect.c
index 38f66a56a7665..d815265bd374f 100644
--- a/arch/arm64/kvm/hyp/nvhe/mem_protect.c
+++ b/arch/arm64/kvm/hyp/nvhe/mem_protect.c
@@ -518,7 +518,7 @@ static int host_stage2_adjust_range(u64 addr, struct kvm_mem_range *range)
 		granule = kvm_granule_size(level);
 		cur.start = ALIGN_DOWN(addr, granule);
 		cur.end = cur.start + granule;
-		if (!range_included(&cur, range))
+		if (!range_included(&cur, range) && level < KVM_PGTABLE_LAST_LEVEL)
 			continue;
 		*range = cur;
 		return 0;

-- 
Without deviation from the norm, progress is not possible.