Re: [PATCH v2] KVM: arm64: Fix protected VM fault on system with pages larger than 4K

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
- [High] The patch incorrectly maps the guest PA (L1 IPA) instead of the guest IPA (L2 IPA) in the shadow stage-2 page tables for nested VMs in `gmem_abort()`.
--

commit 3995ce8aa44bf10fe23cdc5e9257510868df129d
Author: Vincent Donnefort <vdonnefort@google.com>

KVM: arm64: Fix protected VM fault on system with pages larger than 4K

This commit aligns the fault IPA down to the page-size for protected VMs to
fix boot issues on systems with larger than 4K pages. It updates
pkvm_pgtable_stage2_map() to require page-aligned arguments and changes the
callers to pass gfn_to_gpa(gfn) instead of the raw fault_ipa.

Link: https://lore.kernel.org/all/20260913173516.3122436-1-vdonnefort@google.com/

> diff --git a/arch/arm64/kvm/mmu.c b/arch/arm64/kvm/mmu.c
> index 9ba86450fe4af..ee78201a44df1 100644
> --- a/arch/arm64/kvm/mmu.c
> +++ b/arch/arm64/kvm/mmu.c
> @@ -1672,10 +1672,10 @@ static int gmem_abort(const struct kvm_s2_fault_desc *s2fd)
>  		 * PTE, which will be preserved.
>  		 */
>  		prot &= ~KVM_NV_GUEST_MAP_SZ;
> -		ret = KVM_PGT_FN(kvm_pgtable_stage2_relax_perms)(pgt, s2fd->fault_ipa,
> +		ret = KVM_PGT_FN(kvm_pgtable_stage2_relax_perms)(pgt, gfn_to_gpa(gfn),
>  								 prot, flags);
>  	} else {
> -		ret = KVM_PGT_FN(kvm_pgtable_stage2_map)(pgt, s2fd->fault_ipa, PAGE_SIZE,
> +		ret = KVM_PGT_FN(kvm_pgtable_stage2_map)(pgt, gfn_to_gpa(gfn), PAGE_SIZE,
>  							 __pfn_to_phys(pfn), prot,
>  							 memcache, flags);
>  	}

[Severity: High]
Does this change break nested virtualization by mapping the guest PA (L1 IPA)
instead of the faulting guest IPA (L2 IPA)?

For nested VMs handled in gmem_abort(), gfn represents the L1 IPA. By
switching from s2fd->fault_ipa to gfn_to_gpa(gfn) in both
kvm_pgtable_stage2_relax_perms() and kvm_pgtable_stage2_map(), the shadow
stage-2 page tables now incorrectly install the mapping at the L1 IPA instead
of the expected L2 IPA.

This results in the L2 guest continuously faulting at the same L2 IPA, leading
to an infinite fault loop (DoS for the nested guest) and shadow page table
corruption. 

[ ... ]

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260914075839.4019904-1-vdonnefort@google.com?part=1