[PATCH v3 3/3] RISC-V: KVM: Widen G-stage fault address to gpa_t

[Anup Patel]

On Wed, Jul 29, 2026 at 5:37 PM Bingyu.Xian <shanbeeyoo at gmail.com> wrote:
>
> fault_addr in gstage_page_fault() and the fault_addr parameter of
> kvm_riscv_vcpu_mmio_load/store() are unsigned long.  On RV32 with
> Sv32x4, guest physical addresses are 34 bits, so a 32-bit unsigned
> long truncates bits 32/33 at two points:
>
>   - reconstruction: fault_addr = (trap->htval << 2) | ... is evaluated
>     in 32-bit arithmetic, dropping bits 32/33 before widening;
>   - the MMIO handler call: even with the local widened, the handler's
>     unsigned long parameter narrows it back to 32 bits, aliasing
>     accesses above 4 GB into the low 4 GB.
>
> Widen fault_addr to gpa_t end to end: the local in gstage_page_fault(),
> the (gpa_t) cast before the <<2 shift, and the fault_addr parameters of
> kvm_riscv_vcpu_mmio_load/store().  The handlers' internal uses
> (run->mmio.phys_addr is __u64, kvm_io_bus_read/write() take gpa_t) are
> already 64-bit, so no further changes are needed.
>
> Also in preparation for sharing a common struct kvm_page_fault across
> architectures, where fault_addr is gpa_t.  No functional change on RV64.
>
> Fixes: 9d05c1fee837 ("RISC-V: KVM: Implement stage2 page table programming")
> Assisted-by: YuanSheng: deepseek-v4-pro
> Co-developed-by: Quan Zhou <zhouquan at iscas.ac.cn>
> Signed-off-by: Quan Zhou <zhouquan at iscas.ac.cn>
> Signed-off-by: Bingyu Xian <shanbeeyoo at gmail.com>

LGTM.

Reviewed-by: Anup Patel <anup at brainfault.org>

Queued this patch for Linux-7.3

Thanks,
Anup

> ---
>  arch/riscv/include/asm/kvm_vcpu_insn.h | 4 ++--
>  arch/riscv/kvm/vcpu_exit.c             | 5 +++--
>  arch/riscv/kvm/vcpu_insn.c             | 4 ++--
>  3 files changed, 7 insertions(+), 6 deletions(-)
>
> diff --git a/arch/riscv/include/asm/kvm_vcpu_insn.h b/arch/riscv/include/asm/kvm_vcpu_insn.h
> index 350011c83581..a5c50dd4a884 100644
> --- a/arch/riscv/include/asm/kvm_vcpu_insn.h
> +++ b/arch/riscv/include/asm/kvm_vcpu_insn.h
> @@ -38,10 +38,10 @@ int kvm_riscv_vcpu_virtual_insn(struct kvm_vcpu *vcpu, struct kvm_run *run,
>                                 struct kvm_cpu_trap *trap);
>
>  int kvm_riscv_vcpu_mmio_load(struct kvm_vcpu *vcpu, struct kvm_run *run,
> -                            unsigned long fault_addr,
> +                            gpa_t fault_addr,
>                              unsigned long htinst);
>  int kvm_riscv_vcpu_mmio_store(struct kvm_vcpu *vcpu, struct kvm_run *run,
> -                             unsigned long fault_addr,
> +                             gpa_t fault_addr,
>                               unsigned long htinst);
>  int kvm_riscv_vcpu_mmio_return(struct kvm_vcpu *vcpu, struct kvm_run *run);
>
> diff --git a/arch/riscv/kvm/vcpu_exit.c b/arch/riscv/kvm/vcpu_exit.c
> index 6c8530b9f29e..28cf9b27bb07 100644
> --- a/arch/riscv/kvm/vcpu_exit.c
> +++ b/arch/riscv/kvm/vcpu_exit.c
> @@ -17,12 +17,13 @@ static int gstage_page_fault(struct kvm_vcpu *vcpu, struct kvm_run *run,
>  {
>         struct kvm_gstage_mapping host_map;
>         struct kvm_memory_slot *memslot;
> -       unsigned long hva, fault_addr;
> +       unsigned long hva;
> +       gpa_t fault_addr;
>         bool writable;
>         gfn_t gfn;
>         int ret;
>
> -       fault_addr = (trap->htval << 2) | (trap->stval & 0x3);
> +       fault_addr = ((gpa_t)trap->htval << 2) | (trap->stval & 0x3);
>         gfn = fault_addr >> PAGE_SHIFT;
>         memslot = gfn_to_memslot(vcpu->kvm, gfn);
>         hva = gfn_to_hva_memslot_prot(memslot, gfn, &writable);
> diff --git a/arch/riscv/kvm/vcpu_insn.c b/arch/riscv/kvm/vcpu_insn.c
> index f09f9251d1f0..6506411a3f78 100644
> --- a/arch/riscv/kvm/vcpu_insn.c
> +++ b/arch/riscv/kvm/vcpu_insn.c
> @@ -371,7 +371,7 @@ int kvm_riscv_vcpu_virtual_insn(struct kvm_vcpu *vcpu, struct kvm_run *run,
>   * Returns < 0 to report failure and exit run-loop
>   */
>  int kvm_riscv_vcpu_mmio_load(struct kvm_vcpu *vcpu, struct kvm_run *run,
> -                            unsigned long fault_addr,
> +                            gpa_t fault_addr,
>                              unsigned long htinst)
>  {
>         u8 data_buf[8];
> @@ -494,7 +494,7 @@ int kvm_riscv_vcpu_mmio_load(struct kvm_vcpu *vcpu, struct kvm_run *run,
>   * Returns < 0 to report failure and exit run-loop
>   */
>  int kvm_riscv_vcpu_mmio_store(struct kvm_vcpu *vcpu, struct kvm_run *run,
> -                             unsigned long fault_addr,
> +                             gpa_t fault_addr,
>                               unsigned long htinst)
>  {
>         u8 data8;
> --
> 2.54.0
>