Re: [PATCH v18] arm64: mm: Handle Granule Protection Faults (GPFs)

[Catalin Marinas <catalin.marinas@arm.com>]

On Mon, Sep 28, 2026 at 12:01:18PM +0100, Suzuki K Poulose wrote:
> On 22/09/2026 15:49, Catalin Marinas wrote:
> > On Tue, Sep 22, 2026 at 02:21:13PM +0100, Suzuki K Poulose wrote:
> > > I had another look and we could handle this via kvm_fault_is_gmem_abort()
> > > see in arch/arm64/kvm/mmu.c:
> > > 
> > > 
> > > diff --git a/arch/arm64/kvm/mmu.c b/arch/arm64/kvm/mmu.c
> > > index 87e49251e0447..af5a4bf961aae 100644
> > > --- a/arch/arm64/kvm/mmu.c
> > > +++ b/arch/arm64/kvm/mmu.c
> > > @@ -1731,6 +1731,9 @@ static int gmem_abort(const struct kvm_s2_fault_desc
> > > *s2fd)
> > >          gfn_t gfn;
> > >          int ret;
> > > 
> > > +       if (!kvm_slot_has_gmem(s2fd->memslot))
> > > +               return -EINVAL;
> > 
> > I wonder whether we should add a KVM_BUG_ON() here. With the rest of the
> > changes, we should never get in this situation. Well, to be revisited
> > for private devices.
> > 
> > Also maybe move it to the caller, kvm_vm_mem_abort(), and not change
> > kvm_fault_is_gmem_abort(). Something like:
> > 
> > 	if (private_ipa_fault(kvm, s2fd->fault_ipa) &&
> > 	    KVM_BUG_ON(!kvm_slot_has_gmem(s2fd->memslot), kvm))
> > 		return -EIO;
> > 
> > To me it makes more sense for gmem_abort() to be called only *if* it's a
> > gmem slot. So any inconsistency, avoiding user_mem_abort() for private
> > memory, should be done in the caller. I assume the caller will also have
> > to route the private device path as well rather than rely on
> > gmem_abort().
> > 
> > > +
> > >          if (!perm_fault) {
> > >                  memcache = get_mmu_memcache(vcpu);
> > >                  ret = topup_mmu_memcache(vcpu, memcache);
> > > @@ -2277,10 +2280,12 @@ static bool private_ipa_fault(struct kvm *kvm,
> > > phys_addr_t fault_ipa);
> > >   static bool kvm_fault_is_gmem_abort(struct kvm *kvm,
> > >                                      const struct kvm_s2_fault_desc *s2fd)
> > >   {
> > > -       if (!kvm_slot_has_gmem(s2fd->memslot))
> > > -               return false;
> > >          if (kvm_memslot_is_gmem_only(s2fd->memslot))
> > >                  return true;
> > > +       /*
> > > +        * For Realms, all private faults must be backed by GMEM.
> > > +        * TODO: Handle Trusted device private memory mappings.
> > > +        */
> > >          if (private_ipa_fault(kvm, s2fd->fault_ipa))
> > >                  return true;
> > >          return false;
> > > 
> > > 
> > > Also, I have the following hunk for preventing memslot modifications.
> > > I will add this to v20 integration branch, which is almost ready ;-)
> > > 
> > > diff --git a/arch/arm64/kvm/mmu.c b/arch/arm64/kvm/mmu.c
> > > index 582b48e34486b..87e49251e0447 100644
> > > --- a/arch/arm64/kvm/mmu.c
> > > +++ b/arch/arm64/kvm/mmu.c
> > > @@ -2783,6 +2783,18 @@ void kvm_arch_commit_memory_region(struct kvm *kvm,
> > >          }
> > >   }
> > > 
> > > +static bool kvm_prevents_memslot_change(struct kvm *kvm, enum kvm_mr_change change)
> > > +{
> > > +       /* Cannot modify memslots once a pVM has run or Realm created */
> > > +       if (change != KVM_MR_DELETE && change != KVM_MR_MOVE)
> > > +               return false;
> > > +
> > > +       if ((kvm_vm_is_protected_pkvm(kvm) && pkvm_hyp_vm_is_created(kvm)) ||
> > > +            kvm_realm_is_created(kvm))
> > > +               return true;
> > > +       return false;
> > > +}
> > > +
> 
> This needs to be tweaked for Realm to support non-secure device assignment.
> Aneesh reports that the Device assignment fails now,
> because the Device BAR reset deletes the memory slot and re-registers
> it, which the above change prevents.
> 
> I will modify that to
> 1. Prevent "Guest-memfd" backed memory slot deletion. Makes sure that
>    nothing can replace a private memory slot.
> 2. Allow non-Guest-memfd backed memory slots to be created
>   after the Realm is created. We anyways prevent "private" memory
>   to be mapped from a non-Guest-memfd memslot.

Yes, I think this should be fine. But at least with the last version I
looked at, we did not prevent private memory from being mapped from
non-guest_memfd slots (there was a way to delete the gmem slot, add a
normal one while the guest does a private IPA access). If we prevent
gmem slot deletion, we no longer have this issue, although we should
warn somewhere on the user_mem_abort() both.

Anyway, to be discussed on the KVM patches, not here. I raised it
initially here as I was looking whether a non-gmem slot ever ends up
private and trigger the GPF.

-- 
Catalin