[PATCH 3/6] KVM: arm64: Make stage2_pte_cacheable() return false when S2_AS_S1 is set

[Will Deacon]

On Mon, Jan 19, 2026 at 10:56:48AM +0000, Marc Zyngier wrote:
> We cannot tell from the S2 attributes whether what we map is memory
> or not when S2_AS_S1 is set, and issuing a CMO on device memory may
> not be the best idea.
> 
> In this particular case, pretend that the mapping isn't cacheable.
> 
> Signed-off-by: Marc Zyngier <maz at kernel.org>
> ---
>  arch/arm64/kvm/hyp/pgtable.c | 8 ++++++++
>  1 file changed, 8 insertions(+)
> 
> diff --git a/arch/arm64/kvm/hyp/pgtable.c b/arch/arm64/kvm/hyp/pgtable.c
> index 3c5f399b1b986..07561a227f75e 100644
> --- a/arch/arm64/kvm/hyp/pgtable.c
> +++ b/arch/arm64/kvm/hyp/pgtable.c
> @@ -911,6 +911,14 @@ static void stage2_unmap_put_pte(const struct kvm_pgtable_visit_ctx *ctx,
>  static bool stage2_pte_cacheable(struct kvm_pgtable *pgt, kvm_pte_t pte)
>  {
>  	u64 memattr = pte & KVM_PTE_LEAF_ATTR_LO_S2_MEMATTR;
> +
> +	/*
> +	 * With S2_AS_S1, we have no idea whether the OA is actual memory or
> +	 * a device. Don't even try a CMO on that.
> +	 */
> +	if (pgt->flags & KVM_PGTABLE_S2_AS_S1)
> +		return false;
> +
>  	return kvm_pte_valid(pte) && memattr == KVM_S2_MEMATTR(pgt, NORMAL);

Since KVM_PGTABLE_S2_AS_S1 is only set for the pKVM host stage-2 and
that doesn't provide any cache maintenance callbacks in its
kvm_pgtable_mm_ops, I don't think the current code is actually broken,
although it's harmless to add the check (and the comment might benefit
from some additional rewording?).

Will