[PATCH v1] KVM: arm64: Fix protected VMs fault on system with pages larger than 4K

[PATCH v1] KVM: arm64: Fix protected VMs fault on system with pages larger than 4K

[Vincent Donnefort]

Just like commit 08f97454b7fa ("KVM: arm64: Fix protected mode handling
of pages larger than 4kB") fixed the boot of non-protected VMs on system
larger than 4K pages, align the fault IPA down to the page-size for
protected VMs.

To paraphrase Marc, pkvm_pgtable_stage2_map() assumes the address passed
as a parameter is aligned to the size of the intended mapping, while
HPFAR_EL2 gives the IPA minus the bottom 12 bits, regardless of the
system page size configuration.

Add a check at the start of pkvm_pgtable_stage2_map() as we do not
support !PAGE_ALIGNED arguments.

Fixes: ea03466e806f ("KVM: arm64: Handle aborts from protected VMs")
Signed-off-by: Vincent Donnefort <vdonnefort@google.com>
---
 arch/arm64/kvm/mmu.c  | 2 +-
 arch/arm64/kvm/pkvm.c | 3 +++
 2 files changed, 4 insertions(+), 1 deletion(-)

diff --git a/arch/arm64/kvm/mmu.c b/arch/arm64/kvm/mmu.c
index 9ba86450fe4a..e8d98957531a 100644
--- a/arch/arm64/kvm/mmu.c
+++ b/arch/arm64/kvm/mmu.c
@@ -1756,7 +1756,7 @@ static int pkvm_mem_abort(const struct kvm_s2_fault_desc *s2fd)
 	}
 
 	write_lock(&kvm->mmu_lock);
-	ret = pkvm_pgtable_stage2_map(pgt, s2fd->fault_ipa, PAGE_SIZE,
+	ret = pkvm_pgtable_stage2_map(pgt, ALIGN_DOWN(s2fd->fault_ipa, PAGE_SIZE), PAGE_SIZE,
 				      page_to_phys(page), KVM_PGTABLE_PROT_RWX,
 				      hyp_memcache, 0);
 	write_unlock(&kvm->mmu_lock);
diff --git a/arch/arm64/kvm/pkvm.c b/arch/arm64/kvm/pkvm.c
index 8e4c6e4bec12..1ca27d01a3ec 100644
--- a/arch/arm64/kvm/pkvm.c
+++ b/arch/arm64/kvm/pkvm.c
@@ -414,6 +414,9 @@ int pkvm_pgtable_stage2_map(struct kvm_pgtable *pgt, u64 addr, u64 size,
 	u64 end = addr + size;
 	int ret;
 
+	if (!PAGE_ALIGNED(addr | size | phys))
+		return -EINVAL;
+
 	lockdep_assert_held_write(&kvm->mmu_lock);
 	mapping = pkvm_mapping_iter_first(&pgt->pkvm_mappings, addr, end - 1);
 

base-commit: df2908090cda368b01ff43709f51890076c56157
-- 
2.55.0.1007.g17ff1f9808-goog

Re: [PATCH v1] KVM: arm64: Fix protected VMs fault on system with pages larger than 4K

[sashiko-bot]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
- [High] gmem_abort() passes an unaligned fault_ipa to kvm_pgtable_stage2_map(), which triggers the new -EINVAL check on pKVM hosts.
--

commit 724c2b0f8e554f59f7c409467796ff8e9acf590b
Author: Vincent Donnefort <vdonnefort@google.com>
Subject: KVM: arm64: Fix protected VMs fault on system with pages larger than 4K

This commit aligns the fault IPA down to the page size for protected VMs
in pkvm_mem_abort(), similar to previous fixes for non-protected VMs.
It also adds a strict page-alignment check to pkvm_pgtable_stage2_map()
which returns -EINVAL if the address, size, or physical address are unaligned.

[ ... ]

> diff --git a/arch/arm64/kvm/pkvm.c b/arch/arm64/kvm/pkvm.c
> index 8e4c6e4bec123..1ca27d01a3ec6 100644
> --- a/arch/arm64/kvm/pkvm.c
> +++ b/arch/arm64/kvm/pkvm.c
> @@ -414,6 +414,9 @@ int pkvm_pgtable_stage2_map(struct kvm_pgtable *pgt, u64 addr, u64 size,
>  	u64 end = addr + size;
>  	int ret;
>  
> +	if (!PAGE_ALIGNED(addr | size | phys))
> +		return -EINVAL;
> +

[Severity: High]
Does this new check break non-protected VMs using guest_memfd on a pKVM host?

When gmem_abort() handles page faults for guest_memfd slots, it passes
s2fd->fault_ipa directly to kvm_pgtable_stage2_map() without aligning it
down to the page size:

arch/arm64/kvm/mmu.c:gmem_abort() {
    ...
	} else {
		ret = KVM_PGT_FN(kvm_pgtable_stage2_map)(pgt, s2fd->fault_ipa,
							 PAGE_SIZE,
							 __pfn_to_phys(pfn),
							 prot, memcache, flags);
	}
    ...
}

Since HPFAR_EL2 only aligns to 4K, on a 16K or 64K page host, the fault_ipa
passed from gmem_abort() will fail this new PAGE_ALIGNED check and return
-EINVAL. This prevents memory mapping and causes the VM fault handling to
abort.

Should gmem_abort() also be updated to apply ALIGN_DOWN to s2fd->fault_ipa,
just like pkvm_mem_abort() was fixed in this patch?

>  	lockdep_assert_held_write(&kvm->mmu_lock);
>  	mapping = pkvm_mapping_iter_first(&pgt->pkvm_mappings, addr, end - 1);

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260913173516.3122436-1-vdonnefort@google.com?part=1

Re: [PATCH v1] KVM: arm64: Fix protected VMs fault on system with pages larger than 4K

[Vincent Donnefort]

On Sun, Sep 13, 2026 at 05:51:05PM +0000, sashiko-bot@kernel.org wrote:
> Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
> - [High] gmem_abort() passes an unaligned fault_ipa to kvm_pgtable_stage2_map(), which triggers the new -EINVAL check on pKVM hosts.
> --
> 
> commit 724c2b0f8e554f59f7c409467796ff8e9acf590b
> Author: Vincent Donnefort <vdonnefort@google.com>
> Subject: KVM: arm64: Fix protected VMs fault on system with pages larger than 4K
> 
> This commit aligns the fault IPA down to the page size for protected VMs
> in pkvm_mem_abort(), similar to previous fixes for non-protected VMs.
> It also adds a strict page-alignment check to pkvm_pgtable_stage2_map()
> which returns -EINVAL if the address, size, or physical address are unaligned.
> 
> [ ... ]
> 
> > diff --git a/arch/arm64/kvm/pkvm.c b/arch/arm64/kvm/pkvm.c
> > index 8e4c6e4bec123..1ca27d01a3ec6 100644
> > --- a/arch/arm64/kvm/pkvm.c
> > +++ b/arch/arm64/kvm/pkvm.c
> > @@ -414,6 +414,9 @@ int pkvm_pgtable_stage2_map(struct kvm_pgtable *pgt, u64 addr, u64 size,
> >  	u64 end = addr + size;
> >  	int ret;
> >  
> > +	if (!PAGE_ALIGNED(addr | size | phys))
> > +		return -EINVAL;
> > +
> 
> [Severity: High]
> Does this new check break non-protected VMs using guest_memfd on a pKVM host?
> 
> When gmem_abort() handles page faults for guest_memfd slots, it passes
> s2fd->fault_ipa directly to kvm_pgtable_stage2_map() without aligning it
> down to the page size:
> 
> arch/arm64/kvm/mmu.c:gmem_abort() {
>     ...
> 	} else {
> 		ret = KVM_PGT_FN(kvm_pgtable_stage2_map)(pgt, s2fd->fault_ipa,
> 							 PAGE_SIZE,
> 							 __pfn_to_phys(pfn),
> 							 prot, memcache, flags);
> 	}
>     ...
> }

Ha right...

And actually I will do gfn_to_gpa(gfn)... that fits better the series I have
sent for the protected VM huge pages.

-- 
Vincent

> 
> Since HPFAR_EL2 only aligns to 4K, on a 16K or 64K page host, the fault_ipa
> passed from gmem_abort() will fail this new PAGE_ALIGNED check and return
> -EINVAL. This prevents memory mapping and causes the VM fault handling to
> abort.
> 
> Should gmem_abort() also be updated to apply ALIGN_DOWN to s2fd->fault_ipa,
> just like pkvm_mem_abort() was fixed in this patch?
> 
> >  	lockdep_assert_held_write(&kvm->mmu_lock);
> >  	mapping = pkvm_mapping_iter_first(&pgt->pkvm_mappings, addr, end - 1);
> 
> -- 
> Sashiko AI review · https://sashiko.dev/#/patchset/20260913173516.3122436-1-vdonnefort@google.com?part=1