[PATCH v1 2/2] KVM: arm64: Fix vma_shift staleness on nested hwpoison path

[Marc Zyngier]

Hi Fuad,

On Wed, 04 Mar 2026 16:22:22 +0000,
Fuad Tabba <tabba at google.com> wrote:
> 
> When user_mem_abort() handles a nested stage-2 fault, it truncates
> vma_pagesize to respect the guest's mapping size. However, the local
> variable vma_shift is never updated to match this new size.
> 
> If the underlying host page turns out to be hardware poisoned,
> kvm_send_hwpoison_signal() is called with the original, larger
> vma_shift instead of the actual mapping size. This signals incorrect
> poison boundaries to userspace and breaks hugepage memory poison
> containment for nested VMs.
> 
> Update vma_shift to match the truncated vma_pagesize when operating
> on behalf of a nested hypervisor.
> 
> Fixes: fd276e71d1e7 ("KVM: arm64: nv: Handle shadow stage 2 page faults")
> Signed-off-by: Fuad Tabba <tabba at google.com>
> ---
>  arch/arm64/kvm/mmu.c | 1 +
>  1 file changed, 1 insertion(+)
> 
> diff --git a/arch/arm64/kvm/mmu.c b/arch/arm64/kvm/mmu.c
> index e1d6a4f591a9..b08240e0cab1 100644
> --- a/arch/arm64/kvm/mmu.c
> +++ b/arch/arm64/kvm/mmu.c
> @@ -1751,6 +1751,7 @@ static int user_mem_abort(struct kvm_vcpu *vcpu, phys_addr_t fault_ipa,
>  
>  		force_pte = (max_map_size == PAGE_SIZE);
>  		vma_pagesize = min_t(long, vma_pagesize, max_map_size);
> +		vma_shift = force_pte ? PAGE_SHIFT : __ffs(vma_pagesize);

If force_pte is set, then we know that max_map_size == PAGE_SIZE. From
there, vma_pagesize == PAGE_SIZE, since nothing can be smaller.

Is there anything preventing us from having:

		vma_shift = __ffs(vma_pagesize);

and be done with it?

Thanks,

	M.

-- 
Without deviation from the norm, progress is not possible.