[PATCH v2 22/22] KVM: arm64: Stage-2 huge mappings for protected VMs

[Fuad Tabba]

Hi Vincent,

On Fri, 11 Sep 2026 14:50:53 +0100, Vincent Donnefort <vdonnefort at google.com> wrote:
[...]
> diff --git a/arch/arm64/kvm/pkvm.c b/arch/arm64/kvm/pkvm.c
[...]
> @@ -513,17 +512,23 @@ int pkvm_pgtable_stage2_map(struct kvm_pgtable *pgt, u64 addr, u64 size,
[...]
> +                /*
> +                 * If a huge mapping overlaps an existing PAGE_SIZE one,
> +                 * then the VMM has played games with the stage-1. Abort.
> +                 */
> +                if (WARN_ON_ONCE(mapping && mapping->nr_pages == 1 && size > PAGE_SIZE))
> +                        return -EFAULT;

A guest can hit this on its own, without the VMM touching its stage-1.
I ran into it while porting your unposted v3 to android18-7.3, and v3
has the same race. A pVM shares one page of a 2M block, and another
vCPU touches the block during the split's break-before-make. The host
sizes that fault at 2M from the THP, but under the mmu_lock it finds
the split's PAGE_SIZE mappings.

I made the following change in the android18-7.3 port. It maps just
the faulting page, since retrying alone re-faults forever if the VMM
puts a fresh THP behind a partly mapped block. If you're happy with it,
can you fold it into v3?

diff --git a/arch/arm64/kvm/mmu.c b/arch/arm64/kvm/mmu.c
index 70b002eb17e05..72fc2577f51cd 100644
--- a/arch/arm64/kvm/mmu.c
+++ b/arch/arm64/kvm/mmu.c
@@ -1921,6 +1921,7 @@ static int protected_pkvm_mem_abort(const struct kvm_s2_fault_desc *s2fd)
 	struct mm_struct *mm = current->mm;
 	struct kvm *kvm = vcpu->kvm;
 	void *hyp_memcache;
+	u64 size;
 	int ret;
 
 	hyp_memcache = get_mmu_memcache(vcpu);
@@ -1936,13 +1937,21 @@ static int protected_pkvm_mem_abort(const struct kvm_s2_fault_desc *s2fd)
 	if (ret)
 		goto unpin;
 
+	size = s2vi.vma_pagesize;
 	kvm_fault_lock(kvm);
 	if (mmu_invalidate_retry(kvm, s2vi.mmu_seq)) {
 		ret = -EAGAIN;
 	} else {
-		ret = pkvm_pgtable_stage2_map(pgt, gfn_to_gpa(s2vi.gfn), s2vi.vma_pagesize,
+		ret = pkvm_pgtable_stage2_map(pgt, gfn_to_gpa(s2vi.gfn), size,
 					      __pfn_to_phys(s2vi.pfn), KVM_PGTABLE_PROT_RWX,
 					      hyp_memcache, 0);
+		/* The block may hold PAGE_SIZE mappings from a split: map the page alone. */
+		if (ret == -EAGAIN && size > PAGE_SIZE) {
+			size = PAGE_SIZE;
+			ret = pkvm_pgtable_stage2_map(pgt, ALIGN_DOWN(s2fd->fault_ipa, size), size,
+						      page_to_phys(s2vi.page), KVM_PGTABLE_PROT_RWX,
+						      hyp_memcache, 0);
+		}
 	}
 	kvm_fault_unlock(kvm);
 	if (ret) {
@@ -1953,6 +1962,9 @@ static int protected_pkvm_mem_abort(const struct kvm_s2_fault_desc *s2fd)
 		goto unpin;
 	}
 
+	if (size != s2vi.vma_pagesize)
+		account_locked_vm(mm, (s2vi.vma_pagesize - size) / PAGE_SIZE, false);
+
 	return 0;
 unpin:
 	unpin_user_page(s2vi.page);
diff --git a/arch/arm64/kvm/pkvm.c b/arch/arm64/kvm/pkvm.c
index 8a74df9f9fec3..6b5df4595f6a6 100644
--- a/arch/arm64/kvm/pkvm.c
+++ b/arch/arm64/kvm/pkvm.c
@@ -650,14 +650,8 @@ int pkvm_pgtable_stage2_map(struct kvm_pgtable *pgt, u64 addr, u64 size,
 			return -EINVAL;
 
 		/*
-		 * If a huge mapping overlaps an existing PAGE_SIZE one,
-		 * then the VMM has played games with the stage-1. Abort.
-		 */
-		if (WARN_ON_ONCE(mapping && mapping->nr_pages == 1 && size > PAGE_SIZE))
-			return -EFAULT;
-
-		/*
-		 * We either raced with another vCPU or the guest PTE
+		 * We either raced with another vCPU, a block overlaps the
+		 * PAGE_SIZE mappings of a guest-driven split, or the guest PTE
 		 * has been poisoned by an erroneous host access.
 		 */
 		if (mapping) {

Cheers,
/fuad