From: tabba@google•com
To: Marc Zyngier <maz@kernel•org>, Oliver Upton <oupton@kernel•org>,
Joey Gouly <joey.gouly@arm•com>,
Suzuki K Poulose <suzuki.poulose@arm•com>,
Zenghui Yu <yuzenghui@huawei•com>,
Catalin Marinas <catalin.marinas@arm•com>,
Will Deacon <will@kernel•org>,
Quentin Perret <qperret@google•com>,
Vincent Donnefort <vdonnefort@google•com>
Cc: linux-arm-kernel@lists•infradead.org, kvmarm@lists•linux.dev,
linux-kernel@vger•kernel.org
Subject: [PATCH v2 2/3] KVM: arm64: Avoid host/hyp share desync on unshare hypercall failure
Date: Fri, 29 May 2026 13:17:54 +0100 [thread overview]
Message-ID: <20260529121755.2923500-3-tabba@google.com> (raw)
In-Reply-To: <20260529121755.2923500-1-tabba@google.com>
unshare_pfn_hyp() erases the tracking node from hyp_shared_pfns
and frees it before invoking __pkvm_host_unshare_hyp. If the
hypercall fails (e.g. EL2 refcount still held, or page-state
mismatch), the host loses its record while EL2 still holds the
share, breaking later share/unshare attempts on the same pfn.
Invoke the hypercall first; erase and free only on success.
Document at the kvm_unshare_hyp() call site that the WARN_ON() is
left non-fatal: a failed unshare leaks the page (it stays shared
with the hypervisor) but breaks no isolation guarantee.
Fixes: 52b28657ebd7 ("KVM: arm64: pkvm: Unshare guest structs during teardown")
Reported-by: Sashiko (local):gemini-3.1-pro
Suggested-by: Vincent Donnefort <vdonnefort@google•com>
Signed-off-by: Fuad Tabba <tabba@google•com>
---
arch/arm64/kvm/mmu.c | 15 ++++++++++++---
1 file changed, 12 insertions(+), 3 deletions(-)
diff --git a/arch/arm64/kvm/mmu.c b/arch/arm64/kvm/mmu.c
index 4a928fb003ff..e08503e89fc4 100644
--- a/arch/arm64/kvm/mmu.c
+++ b/arch/arm64/kvm/mmu.c
@@ -524,13 +524,17 @@ static int unshare_pfn_hyp(u64 pfn)
goto unlock;
}
- this->count--;
- if (this->count)
+ if (this->count > 1) {
+ this->count--;
+ goto unlock;
+ }
+
+ ret = kvm_call_hyp_nvhe(__pkvm_host_unshare_hyp, pfn);
+ if (ret)
goto unlock;
rb_erase(&this->node, &hyp_shared_pfns);
kfree(this);
- ret = kvm_call_hyp_nvhe(__pkvm_host_unshare_hyp, pfn);
unlock:
mutex_unlock(&hyp_shared_pfns_lock);
@@ -581,6 +585,11 @@ void kvm_unshare_hyp(void *from, void *to)
end = PAGE_ALIGN(__pa(to));
for (cur = start; cur < end; cur += PAGE_SIZE) {
pfn = __phys_to_pfn(cur);
+ /*
+ * A failed unshare leaks the page: it stays shared with the
+ * hypervisor and is no longer reusable for pKVM. No isolation
+ * guarantee is broken, and this is not expected in practice.
+ */
WARN_ON(unshare_pfn_hyp(pfn));
}
}
--
2.54.0.929.g9b7fa37559-goog
next prev parent reply other threads:[~2026-05-29 12:18 UTC|newest]
Thread overview: 5+ messages / expand[flat|nested] mbox.gz Atom feed top
2026-05-29 12:17 [PATCH v2 0/3] KVM: arm64: Fix host/hyp tracking on share/unshare hypercall failure tabba
2026-05-29 12:17 ` [PATCH v2 1/3] KVM: arm64: Free hyp-share tracking node when share hypercall fails tabba
2026-05-29 12:17 ` tabba [this message]
2026-05-29 12:17 ` [PATCH v2 3/3] KVM: arm64: Roll back partial shares on kvm_share_hyp() failure tabba
2026-06-03 10:12 ` [PATCH v2 0/3] KVM: arm64: Fix host/hyp tracking on share/unshare hypercall failure Vincent Donnefort
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20260529121755.2923500-3-tabba@google.com \
--to=tabba@google$(echo .)com \
--cc=catalin.marinas@arm$(echo .)com \
--cc=joey.gouly@arm$(echo .)com \
--cc=kvmarm@lists$(echo .)linux.dev \
--cc=linux-arm-kernel@lists$(echo .)infradead.org \
--cc=linux-kernel@vger$(echo .)kernel.org \
--cc=maz@kernel$(echo .)org \
--cc=oupton@kernel$(echo .)org \
--cc=qperret@google$(echo .)com \
--cc=suzuki.poulose@arm$(echo .)com \
--cc=vdonnefort@google$(echo .)com \
--cc=will@kernel$(echo .)org \
--cc=yuzenghui@huawei$(echo .)com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox