[PATCH v2 22/22] KVM: arm64: Stage-2 huge mappings for protected VMs

[Vincent Donnefort]

On Thu, Oct 29, 2026 at 03:29:59PM +0000, Fuad Tabba wrote:
> Hi Vincent,
> 
> On Fri, 11 Sep 2026 14:50:53 +0100, Vincent Donnefort <vdonnefort at google.com> wrote:
> [...]
> > diff --git a/arch/arm64/kvm/pkvm.c b/arch/arm64/kvm/pkvm.c
> [...]
> > @@ -513,17 +512,23 @@ int pkvm_pgtable_stage2_map(struct kvm_pgtable *pgt, u64 addr, u64 size,
> [...]
> > +                /*
> > +                 * If a huge mapping overlaps an existing PAGE_SIZE one,
> > +                 * then the VMM has played games with the stage-1. Abort.
> > +                 */
> > +                if (WARN_ON_ONCE(mapping && mapping->nr_pages == 1 && size > PAGE_SIZE))
> > +                        return -EFAULT;
> 
> A guest can hit this on its own, without the VMM touching its stage-1.
> I ran into it while porting your unposted v3 to android18-7.3, and v3
> has the same race. A pVM shares one page of a 2M block, and another
> vCPU touches the block during the split's break-before-make. The host
> sizes that fault at 2M from the THP, but under the mmu_lock it finds
> the split's PAGE_SIZE mappings.

Nice catch!

> 
> I made the following change in the android18-7.3 port. It maps just
> the faulting page, since retrying alone re-faults forever if the VMM
> puts a fresh THP behind a partly mapped block. If you're happy with it,
> can you fold it into v3?
> 
> diff --git a/arch/arm64/kvm/mmu.c b/arch/arm64/kvm/mmu.c
> index 70b002eb17e05..72fc2577f51cd 100644
> --- a/arch/arm64/kvm/mmu.c
> +++ b/arch/arm64/kvm/mmu.c
> @@ -1921,6 +1921,7 @@ static int protected_pkvm_mem_abort(const struct kvm_s2_fault_desc *s2fd)
>  	struct mm_struct *mm = current->mm;
>  	struct kvm *kvm = vcpu->kvm;
>  	void *hyp_memcache;
> +	u64 size;
>  	int ret;
>  
>  	hyp_memcache = get_mmu_memcache(vcpu);
> @@ -1936,13 +1937,21 @@ static int protected_pkvm_mem_abort(const struct kvm_s2_fault_desc *s2fd)
>  	if (ret)
>  		goto unpin;
>  
> +	size = s2vi.vma_pagesize;
>  	kvm_fault_lock(kvm);
>  	if (mmu_invalidate_retry(kvm, s2vi.mmu_seq)) {
>  		ret = -EAGAIN;
>  	} else {
> -		ret = pkvm_pgtable_stage2_map(pgt, gfn_to_gpa(s2vi.gfn), s2vi.vma_pagesize,
> +		ret = pkvm_pgtable_stage2_map(pgt, gfn_to_gpa(s2vi.gfn), size,
>  					      __pfn_to_phys(s2vi.pfn), KVM_PGTABLE_PROT_RWX,
>  					      hyp_memcache, 0);
> +		/* The block may hold PAGE_SIZE mappings from a split: map the page alone. */
> +		if (ret == -EAGAIN && size > PAGE_SIZE) {
> +			size = PAGE_SIZE;
> +			ret = pkvm_pgtable_stage2_map(pgt, ALIGN_DOWN(s2fd->fault_ipa, size), size,
> +						      page_to_phys(s2vi.page), KVM_PGTABLE_PROT_RWX,
> +						      hyp_memcache, 0);
> +		}

I do not believe the retry does anything, this would just hit the "if (mapping)"
path in pkvm_pgtable_stage2_map().

And in any case, the split will remap the entire range at PTE-level. This is
just transient and it is safe to return EAGAIN.

To keep the return -EFAULT, I could eventually mark the mapping as "split in
progress". 

-- 
Vincent

>  	}
>  	kvm_fault_unlock(kvm);
>  	if (ret) {
> @@ -1953,6 +1962,9 @@ static int protected_pkvm_mem_abort(const struct kvm_s2_fault_desc *s2fd)
>  		goto unpin;
>  	}
>  
> +	if (size != s2vi.vma_pagesize)
> +		account_locked_vm(mm, (s2vi.vma_pagesize - size) / PAGE_SIZE, false);
> +
>  	return 0;
>  unpin:
>  	unpin_user_page(s2vi.page);
> diff --git a/arch/arm64/kvm/pkvm.c b/arch/arm64/kvm/pkvm.c
> index 8a74df9f9fec3..6b5df4595f6a6 100644
> --- a/arch/arm64/kvm/pkvm.c
> +++ b/arch/arm64/kvm/pkvm.c
> @@ -650,14 +650,8 @@ int pkvm_pgtable_stage2_map(struct kvm_pgtable *pgt, u64 addr, u64 size,
>  			return -EINVAL;
>  
>  		/*
> -		 * If a huge mapping overlaps an existing PAGE_SIZE one,
> -		 * then the VMM has played games with the stage-1. Abort.
> -		 */
> -		if (WARN_ON_ONCE(mapping && mapping->nr_pages == 1 && size > PAGE_SIZE))
> -			return -EFAULT;
> -
> -		/*
> -		 * We either raced with another vCPU or the guest PTE
> +		 * We either raced with another vCPU, a block overlaps the
> +		 * PAGE_SIZE mappings of a guest-driven split, or the guest PTE
>  		 * has been poisoned by an erroneous host access.
>  		 */
>  		if (mapping) {
> 
> Cheers,
> /fuad