[PATCH v1 6/6] KVM: arm64: Use kvm_s2_fault_vma_info in pkvm_mem_abort()

[Fuad Tabba]

On Tue, 22 Sept 2026 at 14:08, 'Vincent Donnefort' via kernel-team
<kernel-team at android.com> wrote:
>
> To paraphrase Marc in commit 08f97454b7fa ("KVM: arm64: Fix protected
> mode handling of pages larger than 4kB"), pkvm_pgtable_stage2_map()
> assumes the address passed as a parameter is aligned to the size of the
> intended mapping, while HPFAR_EL2 gives the IPA minus the bottom 12
> bits, regardless of the system page size configuration.
>
> To fix this alignment, bring support for kvm_s2_fault_vma_info in
> pkvm_mem_abort() and use its members where possible. They do contain the
> page-alignment we need to fix the fault on system with pages larger than
> 4K.
>
> Also, add a check at the start of pkvm_pgtable_stage2_map(), it does not
> support !PAGE_ALIGNED arguments.
>
> Fixes: ea03466e806f ("KVM: arm64: Handle aborts from protected VMs")
> Cc: stable at vger.kernel.org
> Signed-off-by: Vincent Donnefort <vdonnefort at google.com>

Reviewed-by: Fuad Tabba <fuad.tabba at linux.dev>
Tested-by: Fuad Tabba < fuad.tabba at linux.dev>

Cheers,
/fuad


> ---
>  arch/arm64/kvm/mmu.c  | 24 +++++++++++++++---------
>  arch/arm64/kvm/pkvm.c |  3 +++
>  2 files changed, 18 insertions(+), 9 deletions(-)
>
> diff --git a/arch/arm64/kvm/mmu.c b/arch/arm64/kvm/mmu.c
> index ee0fcca838c1..167b769107ee 100644
> --- a/arch/arm64/kvm/mmu.c
> +++ b/arch/arm64/kvm/mmu.c
> @@ -1374,9 +1374,11 @@ static bool fault_supports_stage2_huge_mapping(const struct kvm_s2_fault_desc *s
>         if (map_size == PAGE_SIZE)
>                 return true;
>
> -       /* pKVM only supports PMD_SIZE huge-mappings */
> -       if (is_protected_kvm_enabled() && map_size != PMD_SIZE)
> -               return false;
> +       /* pKVM only supports PMD_SIZE huge-mappings for non-protected VMs */
> +       if (is_protected_kvm_enabled()) {
> +               if (vcpu_is_protected(s2fd->vcpu) || map_size != PMD_SIZE)
> +                       return false;
> +       }
>
>         size = memslot->npages * PAGE_SIZE;
>
> @@ -2167,12 +2169,12 @@ int kvm_handle_guest_sea(struct kvm_vcpu *vcpu)
>  static int pkvm_mem_abort(const struct kvm_s2_fault_desc *s2fd)
>  {
>         unsigned int flags = FOLL_HWPOISON | FOLL_LONGTERM | FOLL_WRITE;
> +       struct kvm_s2_fault_vma_info s2vi = {};
>         struct kvm_vcpu *vcpu = s2fd->vcpu;
>         struct kvm_pgtable *pgt = vcpu->arch.hw_mmu->pgt;
>         struct mm_struct *mm = current->mm;
>         struct kvm *kvm = vcpu->kvm;
>         void *hyp_memcache;
> -       struct page *page;
>         int ret;
>
>         hyp_memcache = get_mmu_memcache(vcpu);
> @@ -2180,12 +2182,16 @@ static int pkvm_mem_abort(const struct kvm_s2_fault_desc *s2fd)
>         if (ret)
>                 return -ENOMEM;
>
> +       ret = kvm_s2_fault_get_vma_info(s2fd, &s2vi);
> +       if (ret)
> +               return ret;
> +
>         ret = account_locked_vm(mm, 1, true);
>         if (ret)
>                 return ret;
>
>         mmap_read_lock(mm);
> -       ret = pin_user_pages(s2fd->hva, 1, flags, &page);
> +       ret = pin_user_pages(s2fd->hva, 1, flags, &s2vi.page);
>         mmap_read_unlock(mm);
>
>         if (ret == -EHWPOISON) {
> @@ -2195,7 +2201,7 @@ static int pkvm_mem_abort(const struct kvm_s2_fault_desc *s2fd)
>         } else if (ret != 1) {
>                 ret = -EFAULT;
>                 goto dec_account;
> -       } else if (!folio_test_swapbacked(page_folio(page))) {
> +       } else if (!folio_test_swapbacked(page_folio(s2vi.page))) {
>                 /*
>                  * We really can't deal with page-cache pages returned by GUP
>                  * because (a) we may trigger writeback of a page for which we
> @@ -2215,8 +2221,8 @@ static int pkvm_mem_abort(const struct kvm_s2_fault_desc *s2fd)
>         }
>
>         write_lock(&kvm->mmu_lock);
> -       ret = pkvm_pgtable_stage2_map(pgt, s2fd->fault_ipa, PAGE_SIZE,
> -                                     page_to_phys(page), KVM_PGTABLE_PROT_RWX,
> +       ret = pkvm_pgtable_stage2_map(pgt, gfn_to_gpa(s2vi.gfn), PAGE_SIZE,
> +                                     page_to_phys(s2vi.page), KVM_PGTABLE_PROT_RWX,
>                                       hyp_memcache, 0);
>         write_unlock(&kvm->mmu_lock);
>         if (ret) {
> @@ -2227,7 +2233,7 @@ static int pkvm_mem_abort(const struct kvm_s2_fault_desc *s2fd)
>
>         return 0;
>  unpin:
> -       unpin_user_pages(&page, 1);
> +       unpin_user_page(s2vi.page);
>  dec_account:
>         account_locked_vm(mm, 1, false);
>         return ret;
> diff --git a/arch/arm64/kvm/pkvm.c b/arch/arm64/kvm/pkvm.c
> index 8e4c6e4bec12..c298a5b9b12a 100644
> --- a/arch/arm64/kvm/pkvm.c
> +++ b/arch/arm64/kvm/pkvm.c
> @@ -414,6 +414,9 @@ int pkvm_pgtable_stage2_map(struct kvm_pgtable *pgt, u64 addr, u64 size,
>         u64 end = addr + size;
>         int ret;
>
> +       if (WARN_ON_ONCE(!PAGE_ALIGNED(addr | size)))
> +               return -EINVAL;
> +
>         lockdep_assert_held_write(&kvm->mmu_lock);
>         mapping = pkvm_mapping_iter_first(&pgt->pkvm_mappings, addr, end - 1);
>
> --
> 2.55.0.1082.g2b9226bbc0-goog
>
> To unsubscribe from this group and stop receiving emails from it, send an email to kernel-team+unsubscribe at android.com.
>