* [PATCH] KVM: riscv: Avoid overwriting existing G-stage tables with huge leaves
@ 2026-08-14 10:57 ` Jinyu Tang
0 siblings, 0 replies; 4+ messages in thread
From: Jinyu Tang @ 2026-08-14 10:57 UTC (permalink / raw)
To: Anup Patel, Anup Patel, Atish Patra
Cc: kvm, kvm-riscv, linux-riscv, linux-kernel, Paolo Bonzini,
Sean Christopherson, Paul Walmsley, Paul Walmsley, Palmer Dabbelt,
Albert Ou, Alexandre Ghiti, Andrew Jones, Conor Dooley,
Yong-Xuan Wang, Nutty Liu, Jinyu Tang, Jinyu Tang, Sashiko
RISC-V KVM can overwrite an existing G-stage table entry when installing
a huge leaf mapping. If the target huge range already has a lower-level
page table, kvm_riscv_gstage_set_pte() can replace the non-leaf entry
with a leaf PTE. This disconnects the lower-level page table and can
change guest-visible mappings or leak the page-table page.
Reject replacing a valid non-leaf PTE with a leaf PTE. If huge-page
installation hits such a conflict, fall back to a 4K mapping for the
faulting GPA and leave the existing page-table structure intact.
Suggested-by: Sashiko <sashiko-bot@kernel.org>
Fixes: 9d05c1fee837 ("RISC-V: KVM: Implement stage2 page table programming")
Signed-off-by: Jinyu Tang <jinyu.tang@linux.dev>
---
arch/riscv/kvm/gstage.c | 22 ++++++++++++++++++++--
1 file changed, 20 insertions(+), 2 deletions(-)
diff --git a/arch/riscv/kvm/gstage.c b/arch/riscv/kvm/gstage.c
index e5002cb9cbef..23cb35e36073 100644
--- a/arch/riscv/kvm/gstage.c
+++ b/arch/riscv/kvm/gstage.c
@@ -174,6 +174,12 @@ int kvm_riscv_gstage_set_pte(struct kvm_gstage *gstage,
if (pte_val(*ptep) != pte_val(map->pte)) {
bool was_invalid = !pte_val(*ptep);
+
+ /* Avoid replacing an existing lower-level table with a leaf mapping. */
+ if (!gstage_pte_leaf(ptep) && !was_invalid &&
+ gstage_pte_leaf(&map->pte))
+ return -EEXIST;
+
set_pte(ptep, map->pte);
if (gstage_pte_leaf(ptep) &&
!(was_invalid && riscv_has_extension_unlikely(RISCV_ISA_EXT_SVVPTC)))
@@ -211,12 +217,13 @@ int kvm_riscv_gstage_map_page(struct kvm_gstage *gstage,
struct kvm_gstage_mapping *out_map)
{
bool found_leaf;
+ phys_addr_t huge_page_offset;
u32 ptep_level;
pgprot_t prot;
pte_t *ptep;
int ret;
- out_map->addr = gpa;
+ out_map->addr = gpa & PAGE_MASK;
out_map->level = 0;
ret = gstage_page_size_to_level(gstage, page_size, &out_map->level);
@@ -287,7 +294,18 @@ int kvm_riscv_gstage_map_page(struct kvm_gstage *gstage,
out_map->pte = pfn_pte(PFN_DOWN(hpa), prot);
out_map->pte = pte_mkdirty(out_map->pte);
- return kvm_riscv_gstage_set_pte(gstage, pcache, out_map);
+ ret = kvm_riscv_gstage_set_pte(gstage, pcache, out_map);
+ if (ret == -EEXIST) {
+ huge_page_offset = out_map->addr & (page_size - 1);
+ hpa += huge_page_offset;
+ out_map->level = 0;
+ out_map->pte = pfn_pte(PFN_DOWN(hpa), prot);
+ out_map->pte = pte_mkdirty(out_map->pte);
+
+ ret = kvm_riscv_gstage_set_pte(gstage, pcache, out_map);
+ }
+
+ return ret;
}
static inline unsigned long make_child_pte(unsigned long huge_pte, int index,
--
2.43.0
--
kvm-riscv mailing list
kvm-riscv@lists.infradead.org
http://lists.infradead.org/mailman/listinfo/kvm-riscv
^ permalink raw reply related [flat|nested] 4+ messages in thread* [PATCH] KVM: riscv: Avoid overwriting existing G-stage tables with huge leaves
@ 2026-08-14 10:57 ` Jinyu Tang
0 siblings, 0 replies; 4+ messages in thread
From: Jinyu Tang @ 2026-08-14 10:57 UTC (permalink / raw)
To: Anup Patel, Anup Patel, Atish Patra
Cc: kvm, kvm-riscv, linux-riscv, linux-kernel, Paolo Bonzini,
Sean Christopherson, Paul Walmsley, Paul Walmsley, Palmer Dabbelt,
Albert Ou, Alexandre Ghiti, Andrew Jones, Conor Dooley,
Yong-Xuan Wang, Nutty Liu, Jinyu Tang, Jinyu Tang, Sashiko
RISC-V KVM can overwrite an existing G-stage table entry when installing
a huge leaf mapping. If the target huge range already has a lower-level
page table, kvm_riscv_gstage_set_pte() can replace the non-leaf entry
with a leaf PTE. This disconnects the lower-level page table and can
change guest-visible mappings or leak the page-table page.
Reject replacing a valid non-leaf PTE with a leaf PTE. If huge-page
installation hits such a conflict, fall back to a 4K mapping for the
faulting GPA and leave the existing page-table structure intact.
Suggested-by: Sashiko <sashiko-bot@kernel.org>
Fixes: 9d05c1fee837 ("RISC-V: KVM: Implement stage2 page table programming")
Signed-off-by: Jinyu Tang <jinyu.tang@linux.dev>
---
arch/riscv/kvm/gstage.c | 22 ++++++++++++++++++++--
1 file changed, 20 insertions(+), 2 deletions(-)
diff --git a/arch/riscv/kvm/gstage.c b/arch/riscv/kvm/gstage.c
index e5002cb9cbef..23cb35e36073 100644
--- a/arch/riscv/kvm/gstage.c
+++ b/arch/riscv/kvm/gstage.c
@@ -174,6 +174,12 @@ int kvm_riscv_gstage_set_pte(struct kvm_gstage *gstage,
if (pte_val(*ptep) != pte_val(map->pte)) {
bool was_invalid = !pte_val(*ptep);
+
+ /* Avoid replacing an existing lower-level table with a leaf mapping. */
+ if (!gstage_pte_leaf(ptep) && !was_invalid &&
+ gstage_pte_leaf(&map->pte))
+ return -EEXIST;
+
set_pte(ptep, map->pte);
if (gstage_pte_leaf(ptep) &&
!(was_invalid && riscv_has_extension_unlikely(RISCV_ISA_EXT_SVVPTC)))
@@ -211,12 +217,13 @@ int kvm_riscv_gstage_map_page(struct kvm_gstage *gstage,
struct kvm_gstage_mapping *out_map)
{
bool found_leaf;
+ phys_addr_t huge_page_offset;
u32 ptep_level;
pgprot_t prot;
pte_t *ptep;
int ret;
- out_map->addr = gpa;
+ out_map->addr = gpa & PAGE_MASK;
out_map->level = 0;
ret = gstage_page_size_to_level(gstage, page_size, &out_map->level);
@@ -287,7 +294,18 @@ int kvm_riscv_gstage_map_page(struct kvm_gstage *gstage,
out_map->pte = pfn_pte(PFN_DOWN(hpa), prot);
out_map->pte = pte_mkdirty(out_map->pte);
- return kvm_riscv_gstage_set_pte(gstage, pcache, out_map);
+ ret = kvm_riscv_gstage_set_pte(gstage, pcache, out_map);
+ if (ret == -EEXIST) {
+ huge_page_offset = out_map->addr & (page_size - 1);
+ hpa += huge_page_offset;
+ out_map->level = 0;
+ out_map->pte = pfn_pte(PFN_DOWN(hpa), prot);
+ out_map->pte = pte_mkdirty(out_map->pte);
+
+ ret = kvm_riscv_gstage_set_pte(gstage, pcache, out_map);
+ }
+
+ return ret;
}
static inline unsigned long make_child_pte(unsigned long huge_pte, int index,
--
2.43.0
_______________________________________________
linux-riscv mailing list
linux-riscv@lists.infradead.org
http://lists.infradead.org/mailman/listinfo/linux-riscv
^ permalink raw reply related [flat|nested] 4+ messages in thread* [PATCH] KVM: riscv: Avoid overwriting existing G-stage tables with huge leaves
@ 2026-08-14 10:57 ` Jinyu Tang
0 siblings, 0 replies; 4+ messages in thread
From: Jinyu Tang @ 2026-08-14 10:57 UTC (permalink / raw)
To: Anup Patel, Anup Patel, Atish Patra
Cc: kvm, kvm-riscv, linux-riscv, linux-kernel, Paolo Bonzini,
Sean Christopherson, Paul Walmsley, Paul Walmsley, Palmer Dabbelt,
Albert Ou, Alexandre Ghiti, Andrew Jones, Conor Dooley,
Yong-Xuan Wang, Nutty Liu, Jinyu Tang, Jinyu Tang, Sashiko
RISC-V KVM can overwrite an existing G-stage table entry when installing
a huge leaf mapping. If the target huge range already has a lower-level
page table, kvm_riscv_gstage_set_pte() can replace the non-leaf entry
with a leaf PTE. This disconnects the lower-level page table and can
change guest-visible mappings or leak the page-table page.
Reject replacing a valid non-leaf PTE with a leaf PTE. If huge-page
installation hits such a conflict, fall back to a 4K mapping for the
faulting GPA and leave the existing page-table structure intact.
Suggested-by: Sashiko <sashiko-bot@kernel.org>
Fixes: 9d05c1fee837 ("RISC-V: KVM: Implement stage2 page table programming")
Signed-off-by: Jinyu Tang <jinyu.tang@linux.dev>
---
arch/riscv/kvm/gstage.c | 22 ++++++++++++++++++++--
1 file changed, 20 insertions(+), 2 deletions(-)
diff --git a/arch/riscv/kvm/gstage.c b/arch/riscv/kvm/gstage.c
index e5002cb9cbef..23cb35e36073 100644
--- a/arch/riscv/kvm/gstage.c
+++ b/arch/riscv/kvm/gstage.c
@@ -174,6 +174,12 @@ int kvm_riscv_gstage_set_pte(struct kvm_gstage *gstage,
if (pte_val(*ptep) != pte_val(map->pte)) {
bool was_invalid = !pte_val(*ptep);
+
+ /* Avoid replacing an existing lower-level table with a leaf mapping. */
+ if (!gstage_pte_leaf(ptep) && !was_invalid &&
+ gstage_pte_leaf(&map->pte))
+ return -EEXIST;
+
set_pte(ptep, map->pte);
if (gstage_pte_leaf(ptep) &&
!(was_invalid && riscv_has_extension_unlikely(RISCV_ISA_EXT_SVVPTC)))
@@ -211,12 +217,13 @@ int kvm_riscv_gstage_map_page(struct kvm_gstage *gstage,
struct kvm_gstage_mapping *out_map)
{
bool found_leaf;
+ phys_addr_t huge_page_offset;
u32 ptep_level;
pgprot_t prot;
pte_t *ptep;
int ret;
- out_map->addr = gpa;
+ out_map->addr = gpa & PAGE_MASK;
out_map->level = 0;
ret = gstage_page_size_to_level(gstage, page_size, &out_map->level);
@@ -287,7 +294,18 @@ int kvm_riscv_gstage_map_page(struct kvm_gstage *gstage,
out_map->pte = pfn_pte(PFN_DOWN(hpa), prot);
out_map->pte = pte_mkdirty(out_map->pte);
- return kvm_riscv_gstage_set_pte(gstage, pcache, out_map);
+ ret = kvm_riscv_gstage_set_pte(gstage, pcache, out_map);
+ if (ret == -EEXIST) {
+ huge_page_offset = out_map->addr & (page_size - 1);
+ hpa += huge_page_offset;
+ out_map->level = 0;
+ out_map->pte = pfn_pte(PFN_DOWN(hpa), prot);
+ out_map->pte = pte_mkdirty(out_map->pte);
+
+ ret = kvm_riscv_gstage_set_pte(gstage, pcache, out_map);
+ }
+
+ return ret;
}
static inline unsigned long make_child_pte(unsigned long huge_pte, int index,
--
2.43.0
^ permalink raw reply related [flat|nested] 4+ messages in thread* Re: [PATCH] KVM: riscv: Avoid overwriting existing G-stage tables with huge leaves
2026-08-14 10:57 ` Jinyu Tang
(?)
(?)
@ 2026-08-14 11:21 ` sashiko-bot
-1 siblings, 0 replies; 4+ messages in thread
From: sashiko-bot @ 2026-08-14 11:21 UTC (permalink / raw)
To: Jinyu Tang; +Cc: kvm
Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
- [High] The `-EEXIST` fallback logic incorrectly maps the base 0th page of a Transparent Huge Page (THP) instead of the actual faulting 4K page, causing the guest to infinitely page fault on the same instruction.
--
--- Patch [1]: [PATCH] KVM: riscv: Avoid overwriting existing G-stage tables with huge leaves ---
commit b862a43d3100b276d3d9db5fb9e061641914af1a
Author: Jinyu Tang <jinyu.tang@linux.dev>
KVM: riscv: Avoid overwriting existing G-stage tables with huge leaves
This patch adds a check in kvm_riscv_gstage_set_pte() to prevent replacing
an existing lower-level page table with a huge leaf mapping. If this conflict
occurs, it returns -EEXIST and falls back to installing a 4K mapping for the
faulting GPA instead.
> diff --git a/arch/riscv/kvm/gstage.c b/arch/riscv/kvm/gstage.c
> index b0474fcf065aa..af6b469718eb6 100644
> --- a/arch/riscv/kvm/gstage.c
> +++ b/arch/riscv/kvm/gstage.c
[ ... ]
> @@ -287,7 +294,18 @@ int kvm_riscv_gstage_map_page(struct kvm_gstage *gstage,
> out_map->pte = pfn_pte(PFN_DOWN(hpa), prot);
> out_map->pte = pte_mkdirty(out_map->pte);
>
> - return kvm_riscv_gstage_set_pte(gstage, pcache, out_map);
> + ret = kvm_riscv_gstage_set_pte(gstage, pcache, out_map);
> + if (ret == -EEXIST) {
> + huge_page_offset = out_map->addr & (page_size - 1);
> + hpa += huge_page_offset;
[Severity: High]
Does this calculation result in an offset of 0 when handling Transparent
Huge Pages (THPs)?
When a guest faults on a GPA backed by a THP, kvm_riscv_mmu_map() calls
transparent_hugepage_adjust(), which aligns the gpa down to the PMD boundary:
arch/riscv/kvm/mmu.c:transparent_hugepage_adjust() {
...
*gpa &= PMD_MASK;
...
}
Because out_map->addr is derived from this heavily-aligned gpa,
out_map->addr & (page_size - 1) will always evaluate to 0.
If the fallback mistakenly installs a 4K mapping at the base physical
address (hpa += 0) instead of the actual faulting offset within the huge
page, will the guest continuously fault on the same instruction when
attempting to access a non-zero offset, causing an infinite page fault
loop?
> + out_map->level = 0;
> + out_map->pte = pfn_pte(PFN_DOWN(hpa), prot);
> + out_map->pte = pte_mkdirty(out_map->pte);
> +
> + ret = kvm_riscv_gstage_set_pte(gstage, pcache, out_map);
> + }
> +
> + return ret;
> }
--
Sashiko AI review · https://sashiko.dev/#/patchset/20260814105752.565325-1-jinyu.tang@linux.dev?part=1
^ permalink raw reply [flat|nested] 4+ messages in thread
end of thread, other threads:[~2026-08-14 11:21 UTC | newest]
Thread overview: 4+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2026-08-14 10:57 [PATCH] KVM: riscv: Avoid overwriting existing G-stage tables with huge leaves Jinyu Tang
2026-08-14 10:57 ` Jinyu Tang
2026-08-14 10:57 ` Jinyu Tang
2026-08-14 11:21 ` sashiko-bot
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.