Re: [PATCH v18] arm64: mm: Handle Granule Protection Faults (GPFs)

[Catalin Marinas <catalin.marinas@arm.com>]

On Tue, Sep 22, 2026 at 02:21:13PM +0100, Suzuki K Poulose wrote:
> I had another look and we could handle this via kvm_fault_is_gmem_abort()
> see in arch/arm64/kvm/mmu.c:
> 
> 
> diff --git a/arch/arm64/kvm/mmu.c b/arch/arm64/kvm/mmu.c
> index 87e49251e0447..af5a4bf961aae 100644
> --- a/arch/arm64/kvm/mmu.c
> +++ b/arch/arm64/kvm/mmu.c
> @@ -1731,6 +1731,9 @@ static int gmem_abort(const struct kvm_s2_fault_desc
> *s2fd)
>         gfn_t gfn;
>         int ret;
> 
> +       if (!kvm_slot_has_gmem(s2fd->memslot))
> +               return -EINVAL;

I wonder whether we should add a KVM_BUG_ON() here. With the rest of the
changes, we should never get in this situation. Well, to be revisited
for private devices.

Also maybe move it to the caller, kvm_vm_mem_abort(), and not change
kvm_fault_is_gmem_abort(). Something like:

	if (private_ipa_fault(kvm, s2fd->fault_ipa) &&
	    KVM_BUG_ON(!kvm_slot_has_gmem(s2fd->memslot), kvm))
		return -EIO;

To me it makes more sense for gmem_abort() to be called only *if* it's a
gmem slot. So any inconsistency, avoiding user_mem_abort() for private
memory, should be done in the caller. I assume the caller will also have
to route the private device path as well rather than rely on
gmem_abort().

> +
>         if (!perm_fault) {
>                 memcache = get_mmu_memcache(vcpu);
>                 ret = topup_mmu_memcache(vcpu, memcache);
> @@ -2277,10 +2280,12 @@ static bool private_ipa_fault(struct kvm *kvm,
> phys_addr_t fault_ipa);
>  static bool kvm_fault_is_gmem_abort(struct kvm *kvm,
>                                     const struct kvm_s2_fault_desc *s2fd)
>  {
> -       if (!kvm_slot_has_gmem(s2fd->memslot))
> -               return false;
>         if (kvm_memslot_is_gmem_only(s2fd->memslot))
>                 return true;
> +       /*
> +        * For Realms, all private faults must be backed by GMEM.
> +        * TODO: Handle Trusted device private memory mappings.
> +        */
>         if (private_ipa_fault(kvm, s2fd->fault_ipa))
>                 return true;
>         return false;
> 
> 
> Also, I have the following hunk for preventing memslot modifications.
> I will add this to v20 integration branch, which is almost ready ;-)
> 
> diff --git a/arch/arm64/kvm/mmu.c b/arch/arm64/kvm/mmu.c
> index 582b48e34486b..87e49251e0447 100644
> --- a/arch/arm64/kvm/mmu.c
> +++ b/arch/arm64/kvm/mmu.c
> @@ -2783,6 +2783,18 @@ void kvm_arch_commit_memory_region(struct kvm *kvm,
>         }
>  }
> 
> +static bool kvm_prevents_memslot_change(struct kvm *kvm, enum kvm_mr_change change)
> +{
> +       /* Cannot modify memslots once a pVM has run or Realm created */
> +       if (change != KVM_MR_DELETE && change != KVM_MR_MOVE)
> +               return false;
> +
> +       if ((kvm_vm_is_protected_pkvm(kvm) && pkvm_hyp_vm_is_created(kvm)) ||
> +            kvm_realm_is_created(kvm))
> +               return true;
> +       return false;
> +}
> +
>  int kvm_arch_prepare_memory_region(struct kvm *kvm,
>                                    const struct kvm_memory_slot *old,
>                                    struct kvm_memory_slot *new,
> @@ -2791,12 +2803,9 @@ int kvm_arch_prepare_memory_region(struct kvm *kvm,
>         hva_t hva, reg_end;
>         int ret = 0;
> 
> -       if (kvm_vm_is_protected_pkvm(kvm)) {
> -               /* Cannot modify memslots once a pVM has run. */
> -               if (pkvm_hyp_vm_is_created(kvm) &&
> -                   (change == KVM_MR_DELETE || change == KVM_MR_MOVE)) {
> +       if (kvm_vm_is_protected(kvm)) {
> +               if (kvm_prevents_memslot_change(kvm, change))
>                         return -EPERM;
> -               }
> 
>                 if (new &&
>                     new->flags & (KVM_MEM_LOG_DIRTY_PAGES | KVM_MEM_READONLY)) {

I think this should work.

Thanks.

-- 
Catalin