[PATCH v2 22/22] KVM: arm64: Stage-2 huge mappings for protected VMs

[Vincent Donnefort]

On Thu, Oct 29, 2026 at 04:14:10PM +0000, Vincent Donnefort wrote:
> On Thu, Oct 29, 2026 at 03:29:59PM +0000, Fuad Tabba wrote:
> > Hi Vincent,
> > 
> > On Fri, 11 Sep 2026 14:50:53 +0100, Vincent Donnefort <vdonnefort at google.com> wrote:
> > [...]
> > > diff --git a/arch/arm64/kvm/pkvm.c b/arch/arm64/kvm/pkvm.c
> > [...]
> > > @@ -513,17 +512,23 @@ int pkvm_pgtable_stage2_map(struct kvm_pgtable *pgt, u64 addr, u64 size,
> > [...]
> > > +                /*
> > > +                 * If a huge mapping overlaps an existing PAGE_SIZE one,
> > > +                 * then the VMM has played games with the stage-1. Abort.
> > > +                 */
> > > +                if (WARN_ON_ONCE(mapping && mapping->nr_pages == 1 && size > PAGE_SIZE))
> > > +                        return -EFAULT;
> > 
> > A guest can hit this on its own, without the VMM touching its stage-1.
> > I ran into it while porting your unposted v3 to android18-7.3, and v3
> > has the same race. A pVM shares one page of a 2M block, and another
> > vCPU touches the block during the split's break-before-make. The host
> > sizes that fault at 2M from the THP, but under the mmu_lock it finds
> > the split's PAGE_SIZE mappings.
> 
> Nice catch!
> 
> > 
> > I made the following change in the android18-7.3 port. It maps just
> > the faulting page, since retrying alone re-faults forever if the VMM
> > puts a fresh THP behind a partly mapped block. If you're happy with it,
> > can you fold it into v3?
> > 
> > diff --git a/arch/arm64/kvm/mmu.c b/arch/arm64/kvm/mmu.c
> > index 70b002eb17e05..72fc2577f51cd 100644
> > --- a/arch/arm64/kvm/mmu.c
> > +++ b/arch/arm64/kvm/mmu.c
> > @@ -1921,6 +1921,7 @@ static int protected_pkvm_mem_abort(const struct kvm_s2_fault_desc *s2fd)
> >  	struct mm_struct *mm = current->mm;
> >  	struct kvm *kvm = vcpu->kvm;
> >  	void *hyp_memcache;
> > +	u64 size;
> >  	int ret;
> >  
> >  	hyp_memcache = get_mmu_memcache(vcpu);
> > @@ -1936,13 +1937,21 @@ static int protected_pkvm_mem_abort(const struct kvm_s2_fault_desc *s2fd)
> >  	if (ret)
> >  		goto unpin;
> >  
> > +	size = s2vi.vma_pagesize;
> >  	kvm_fault_lock(kvm);
> >  	if (mmu_invalidate_retry(kvm, s2vi.mmu_seq)) {
> >  		ret = -EAGAIN;
> >  	} else {
> > -		ret = pkvm_pgtable_stage2_map(pgt, gfn_to_gpa(s2vi.gfn), s2vi.vma_pagesize,
> > +		ret = pkvm_pgtable_stage2_map(pgt, gfn_to_gpa(s2vi.gfn), size,
> >  					      __pfn_to_phys(s2vi.pfn), KVM_PGTABLE_PROT_RWX,
> >  					      hyp_memcache, 0);
> > +		/* The block may hold PAGE_SIZE mappings from a split: map the page alone. */
> > +		if (ret == -EAGAIN && size > PAGE_SIZE) {
> > +			size = PAGE_SIZE;
> > +			ret = pkvm_pgtable_stage2_map(pgt, ALIGN_DOWN(s2fd->fault_ipa, size), size,
> > +						      page_to_phys(s2vi.page), KVM_PGTABLE_PROT_RWX,
> > +						      hyp_memcache, 0);
> > +		}
> 
> I do not believe the retry does anything, this would just hit the "if (mapping)"
> path in pkvm_pgtable_stage2_map().
> 
> And in any case, the split will remap the entire range at PTE-level. This is
> just transient and it is safe to return EAGAIN.
> 
> To keep the return -EFAULT, I could eventually mark the mapping as "split in
> progress". 

I convinced myself the retry is actually interesting for the case where the VMM
is playing with the stage-1 mappings. The non-protected case supports it, so
there's no reason for the protected one to not. And actually it does support
directly into pkvm_pgtable_stage2_map(). So I believe that's where any sort of
retry should happen.

So I will try to refactor this path to avoid discrepancy between protected and
non-protected.

-- 
Vincent

> 
> -- 
> Vincent
> 
> >  	}
> >  	kvm_fault_unlock(kvm);
> >  	if (ret) {
> > @@ -1953,6 +1962,9 @@ static int protected_pkvm_mem_abort(const struct kvm_s2_fault_desc *s2fd)
> >  		goto unpin;
> >  	}
> >  
> > +	if (size != s2vi.vma_pagesize)
> > +		account_locked_vm(mm, (s2vi.vma_pagesize - size) / PAGE_SIZE, false);
> > +
> >  	return 0;
> >  unpin:
> >  	unpin_user_page(s2vi.page);
> > diff --git a/arch/arm64/kvm/pkvm.c b/arch/arm64/kvm/pkvm.c
> > index 8a74df9f9fec3..6b5df4595f6a6 100644
> > --- a/arch/arm64/kvm/pkvm.c
> > +++ b/arch/arm64/kvm/pkvm.c
> > @@ -650,14 +650,8 @@ int pkvm_pgtable_stage2_map(struct kvm_pgtable *pgt, u64 addr, u64 size,
> >  			return -EINVAL;
> >  
> >  		/*
> > -		 * If a huge mapping overlaps an existing PAGE_SIZE one,
> > -		 * then the VMM has played games with the stage-1. Abort.
> > -		 */
> > -		if (WARN_ON_ONCE(mapping && mapping->nr_pages == 1 && size > PAGE_SIZE))
> > -			return -EFAULT;
> > -
> > -		/*
> > -		 * We either raced with another vCPU or the guest PTE
> > +		 * We either raced with another vCPU, a block overlaps the
> > +		 * PAGE_SIZE mappings of a guest-driven split, or the guest PTE
> >  		 * has been poisoned by an erroneous host access.
> >  		 */
> >  		if (mapping) {
> > 
> > Cheers,
> > /fuad
>