[PATCH] KVM: riscv: Avoid overwriting existing G-stage tables with huge leaves

[PATCH] KVM: riscv: Avoid overwriting existing G-stage tables with huge leaves

[Jinyu Tang]

RISC-V KVM can overwrite an existing G-stage table entry when installing
a huge leaf mapping. If the target huge range already has a lower-level
page table, kvm_riscv_gstage_set_pte() can replace the non-leaf entry
with a leaf PTE. This disconnects the lower-level page table and can
change guest-visible mappings or leak the page-table page.

Reject replacing a valid non-leaf PTE with a leaf PTE. If huge-page
installation hits such a conflict, fall back to a 4K mapping for the
faulting GPA and leave the existing page-table structure intact.

Suggested-by: Sashiko <sashiko-bot@kernel.org>
Fixes: 9d05c1fee837 ("RISC-V: KVM: Implement stage2 page table programming")
Signed-off-by: Jinyu Tang <jinyu.tang@linux.dev>
---
 arch/riscv/kvm/gstage.c | 22 ++++++++++++++++++++--
 1 file changed, 20 insertions(+), 2 deletions(-)

diff --git a/arch/riscv/kvm/gstage.c b/arch/riscv/kvm/gstage.c
index e5002cb9cbef..23cb35e36073 100644
--- a/arch/riscv/kvm/gstage.c
+++ b/arch/riscv/kvm/gstage.c
@@ -174,6 +174,12 @@ int kvm_riscv_gstage_set_pte(struct kvm_gstage *gstage,
 
 	if (pte_val(*ptep) != pte_val(map->pte)) {
 		bool was_invalid = !pte_val(*ptep);
+
+		/* Avoid replacing an existing lower-level table with a leaf mapping. */
+		if (!gstage_pte_leaf(ptep) && !was_invalid &&
+		    gstage_pte_leaf(&map->pte))
+			return -EEXIST;
+
 		set_pte(ptep, map->pte);
 		if (gstage_pte_leaf(ptep) &&
 		    !(was_invalid && riscv_has_extension_unlikely(RISCV_ISA_EXT_SVVPTC)))
@@ -211,12 +217,13 @@ int kvm_riscv_gstage_map_page(struct kvm_gstage *gstage,
 			      struct kvm_gstage_mapping *out_map)
 {
 	bool found_leaf;
+	phys_addr_t huge_page_offset;
 	u32 ptep_level;
 	pgprot_t prot;
 	pte_t *ptep;
 	int ret;
 
-	out_map->addr = gpa;
+	out_map->addr = gpa & PAGE_MASK;
 	out_map->level = 0;
 
 	ret = gstage_page_size_to_level(gstage, page_size, &out_map->level);
@@ -287,7 +294,18 @@ int kvm_riscv_gstage_map_page(struct kvm_gstage *gstage,
 	out_map->pte = pfn_pte(PFN_DOWN(hpa), prot);
 	out_map->pte = pte_mkdirty(out_map->pte);
 
-	return kvm_riscv_gstage_set_pte(gstage, pcache, out_map);
+	ret = kvm_riscv_gstage_set_pte(gstage, pcache, out_map);
+	if (ret == -EEXIST) {
+		huge_page_offset = out_map->addr & (page_size - 1);
+		hpa += huge_page_offset;
+		out_map->level = 0;
+		out_map->pte = pfn_pte(PFN_DOWN(hpa), prot);
+		out_map->pte = pte_mkdirty(out_map->pte);
+
+		ret = kvm_riscv_gstage_set_pte(gstage, pcache, out_map);
+	}
+
+	return ret;
 }
 
 static inline unsigned long make_child_pte(unsigned long huge_pte, int index,
-- 
2.43.0

Re: [PATCH] KVM: riscv: Avoid overwriting existing G-stage tables with huge leaves

[sashiko-bot]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
- [High] The `-EEXIST` fallback logic incorrectly maps the base 0th page of a Transparent Huge Page (THP) instead of the actual faulting 4K page, causing the guest to infinitely page fault on the same instruction.
--

--- Patch [1]: [PATCH] KVM: riscv: Avoid overwriting existing G-stage tables with huge leaves ---
commit b862a43d3100b276d3d9db5fb9e061641914af1a
Author: Jinyu Tang <jinyu.tang@linux.dev>

KVM: riscv: Avoid overwriting existing G-stage tables with huge leaves

This patch adds a check in kvm_riscv_gstage_set_pte() to prevent replacing
an existing lower-level page table with a huge leaf mapping. If this conflict
occurs, it returns -EEXIST and falls back to installing a 4K mapping for the
faulting GPA instead.

> diff --git a/arch/riscv/kvm/gstage.c b/arch/riscv/kvm/gstage.c
> index b0474fcf065aa..af6b469718eb6 100644
> --- a/arch/riscv/kvm/gstage.c
> +++ b/arch/riscv/kvm/gstage.c

[ ... ]

> @@ -287,7 +294,18 @@ int kvm_riscv_gstage_map_page(struct kvm_gstage *gstage,
>  	out_map->pte = pfn_pte(PFN_DOWN(hpa), prot);
>  	out_map->pte = pte_mkdirty(out_map->pte);
>  
> -	return kvm_riscv_gstage_set_pte(gstage, pcache, out_map);
> +	ret = kvm_riscv_gstage_set_pte(gstage, pcache, out_map);
> +	if (ret == -EEXIST) {
> +		huge_page_offset = out_map->addr & (page_size - 1);
> +		hpa += huge_page_offset;

[Severity: High]
Does this calculation result in an offset of 0 when handling Transparent
Huge Pages (THPs)?

When a guest faults on a GPA backed by a THP, kvm_riscv_mmu_map() calls
transparent_hugepage_adjust(), which aligns the gpa down to the PMD boundary:

arch/riscv/kvm/mmu.c:transparent_hugepage_adjust() {
    ...
    *gpa &= PMD_MASK;
    ...
}

Because out_map->addr is derived from this heavily-aligned gpa,
out_map->addr & (page_size - 1) will always evaluate to 0.

If the fallback mistakenly installs a 4K mapping at the base physical
address (hpa += 0) instead of the actual faulting offset within the huge
page, will the guest continuously fault on the same instruction when
attempting to access a non-zero offset, causing an infinite page fault
loop?

> +		out_map->level = 0;
> +		out_map->pte = pfn_pte(PFN_DOWN(hpa), prot);
> +		out_map->pte = pte_mkdirty(out_map->pte);
> +
> +		ret = kvm_riscv_gstage_set_pte(gstage, pcache, out_map);
> +	}
> +
> +	return ret;
>  }

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260814105752.565325-1-jinyu.tang@linux.dev?part=1