[PATCH 1/3] KVM: arm64: Don't walk the whole IPA space when destroying a pKVM stage-2

[Fuad Tabba]

Hi Vincent,

On Tue, 03 Nov 2026 14:52:36 +0000, Vincent Donnefort
<vdonnefort at google.com> wrote:
[...]
> > Walk the mapping tree once instead, and reschedule after passing each
> > mapping to the reclaim or unshare helper. The unshare helper can't
> > reschedule itself, as the map and unmap paths call it under the
> > mmu_lock. A failed unshare now leaves only its own mapping behind, not
> > the rest of its chunk.
>
> Not a problem now, but don't we make the device assignment story harder?

I don't think so. In Android, the host doesn't track the MMIO of a
device assigned to a protected guest. The hypervisor maps it into the
guest, and gives it back to the host in __pkvm_start_teardown_vm(),
before the host reclaims anything. So the walk this patch changes
shouldn't reach it.

>
> >
> > Fixes: 4ddfab5436b69 ("KVM: arm64: Reschedule as needed when destroying the stage-2 page-tables")
>
> Isn't it an optimisation?

No, it fixes a regression: 4ddfab5436b6 replaced a single walk of the
mapping tree with the 2^27 lookups, as described in the commit
message.

[...]
> > diff --git a/arch/arm64/kvm/pkvm.c b/arch/arm64/kvm/pkvm.c
[...]
> > @@ -513,10 +514,18 @@ void pkvm_pgtable_stage2_destroy_range(struct kvm_pgtable *pgt,
[...]
> > +        for_each_mapping_in_range_safe(pgt, addr, addr + size, mapping) {
> > +                u64 start = __pkvm_mapping_start(mapping);
> > +                u64 end = __pkvm_mapping_end(mapping) + 1;
>
> __pkvm_mapping_* are rb-tree internals. I think it is better to use explicitly:
>
>   start = gfn_to_gpa(mapping->gfn);
>   end = start + (mapping->nr_pages * PAGE_SIZE)

Ack.

>
> Also, I wonder if we'd better WARN if the mapping isn't aligned with the
> destroyed range?

No need. The function's only caller passes the whole IPA space, so
every mapping is inside the range.

Cheers,
/fuad