Re: [PATCH v2] KVM: arm64: Fix protected VM fault on system with pages larger than 4K

[Vincent Donnefort <vdonnefort@google.com>]

On Mon, Sep 14, 2026 at 08:13:42AM +0000, sashiko-bot@kernel.org wrote:
> Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
> - [High] The patch incorrectly maps the guest PA (L1 IPA) instead of the guest IPA (L2 IPA) in the shadow stage-2 page tables for nested VMs in `gmem_abort()`.
> --
> 
> commit 3995ce8aa44bf10fe23cdc5e9257510868df129d
> Author: Vincent Donnefort <vdonnefort@google.com>
> 
> KVM: arm64: Fix protected VM fault on system with pages larger than 4K
> 
> This commit aligns the fault IPA down to the page-size for protected VMs to
> fix boot issues on systems with larger than 4K pages. It updates
> pkvm_pgtable_stage2_map() to require page-aligned arguments and changes the
> callers to pass gfn_to_gpa(gfn) instead of the raw fault_ipa.
> 
> Link: https://lore.kernel.org/all/20260913173516.3122436-1-vdonnefort@google.com/
> 
> > diff --git a/arch/arm64/kvm/mmu.c b/arch/arm64/kvm/mmu.c
> > index 9ba86450fe4af..ee78201a44df1 100644
> > --- a/arch/arm64/kvm/mmu.c
> > +++ b/arch/arm64/kvm/mmu.c
> > @@ -1672,10 +1672,10 @@ static int gmem_abort(const struct kvm_s2_fault_desc *s2fd)
> >  		 * PTE, which will be preserved.
> >  		 */
> >  		prot &= ~KVM_NV_GUEST_MAP_SZ;
> > -		ret = KVM_PGT_FN(kvm_pgtable_stage2_relax_perms)(pgt, s2fd->fault_ipa,
> > +		ret = KVM_PGT_FN(kvm_pgtable_stage2_relax_perms)(pgt, gfn_to_gpa(gfn),
> >  								 prot, flags);
> >  	} else {
> > -		ret = KVM_PGT_FN(kvm_pgtable_stage2_map)(pgt, s2fd->fault_ipa, PAGE_SIZE,
> > +		ret = KVM_PGT_FN(kvm_pgtable_stage2_map)(pgt, gfn_to_gpa(gfn), PAGE_SIZE,
> >  							 __pfn_to_phys(pfn), prot,
> >  							 memcache, flags);
> >  	}
> 
> [Severity: High]
> Does this change break nested virtualization by mapping the guest PA (L1 IPA)
> instead of the faulting guest IPA (L2 IPA)?
> 
> For nested VMs handled in gmem_abort(), gfn represents the L1 IPA. By
> switching from s2fd->fault_ipa to gfn_to_gpa(gfn) in both
> kvm_pgtable_stage2_relax_perms() and kvm_pgtable_stage2_map(), the shadow
> stage-2 page tables now incorrectly install the mapping at the L1 IPA instead
> of the expected L2 IPA.
> 
> This results in the L2 guest continuously faulting at the same L2 IPA, leading
> to an infinite fault loop (DoS for the nested guest) and shadow page table
> corruption. 
> 
> [ ... ]
> 
> -- 
> Sashiko AI review · https://sashiko.dev/#/patchset/20260914075839.4019904-1-vdonnefort@google.com?part=1

That's indeed not possible to use gfn in gmem_abort() 

So I guess ALIGN_DOWN(s2fd->fault_ipa, PAGE_SIZE) will do.

-- 
Vincent