Re: [PATCH v2 06/13] KVM: arm64: Size the stage-2 memcache from the fault MMU

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:

Pre-existing issues:
- [High] The pKVM page fault handler `pkvm_mem_abort()` completely omits the mandatory MMU notifier invalidation retry protocol, risking the installation of stale translations.
--

commit caf2d4f716079e3655b6e5fed2957d60fe0bf41c
Author: Lorenzo Stoakes (ARM) <ljs@kernel.org>

KVM: arm64: Size the stage-2 memcache from the fault MMU

This commit updates topup_mmu_memcache() to take the target s2fd->mmu
instead of the faulting vCPU. This allows the caller to control which MMU
is used for sizing the memcache.

> diff --git a/arch/arm64/kvm/mmu.c b/arch/arm64/kvm/mmu.c
> index 13541218cadbe..8c23fef4ecf84 100644
> --- a/arch/arm64/kvm/mmu.c
> +++ b/arch/arm64/kvm/mmu.c

[ ... ]

> @@ -1755,7 +1755,7 @@ static int pkvm_mem_abort(const struct kvm_s2_fault_desc *s2fd)
>  	int ret;
>  
>  	hyp_memcache = get_mmu_memcache(vcpu);
> -	ret = topup_mmu_memcache(vcpu, hyp_memcache);
> +	ret = topup_mmu_memcache(s2fd->mmu, hyp_memcache);
>  	if (ret)
>  		return -ENOMEM;
>  

[Severity: High]
This is a pre-existing issue, but pkvm_mem_abort() appears to omit the MMU
notifier invalidation retry protocol, risking the installation of stale
translations.

Further down in pkvm_mem_abort(), the physical frame is resolved using
pin_user_pages() without first capturing the global mmu_invalidate_seq
counter:

        mmap_read_lock(mm);
        ret = pin_user_pages(s2fd->hva, 1, flags, &page);
        mmap_read_unlock(mm);

The mapping is then committed to the stage-2 page tables under the lock
without gating the installation on mmu_invalidate_retry():

        write_lock(&kvm->mmu_lock);
        ret = pkvm_pgtable_stage2_map(pgt, s2fd->fault_ipa, PAGE_SIZE,
                                      page_to_phys(page), KVM_PGTABLE_PROT_RWX,
                                      hyp_memcache, 0);
        write_unlock(&kvm->mmu_lock);

Missing the retry check breaks KVM's invalidation retry protocol. Even when
a page is pinned, a concurrent host MMU invalidation (e.g., from
madvise(MADV_DONTNEED) or NUMA balancing) can overlap with the pin.

Does this allow KVM to install stale translations, leading to memory
corruption or guest-visible data leakage?

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260914-kvm-arm-prefault-v2-0-26fb47f74b73@kernel.org?part=6