On Mon, 24 Nov 2025 11:34:38 +0000, Marc Zyngier maz@kernel.org wrote:
On Wed, 19 Nov 2025 15:49:08 +0000, Jack Thomson jackabt.amazon@gmail.com wrote:
[...]
- fault_info->hpfar_el2 = HPFAR_EL2_NS |
FIELD_PREP(HPFAR_EL2_FIPA, ipa >> 12);- if (kvm_slot_has_gmem(memslot)) {
ret = gmem_abort(vcpu, ipa, NULL, memslot, false);- } else {
hva = gfn_to_hva_memslot_prot(memslot, gfn, NULL);if (kvm_is_error_hva(hva)) {ret = -EFAULT;goto out;}ret = user_mem_abort(vcpu, ipa, NULL, memslot, &page_size, hva,false);- }
And thinking of it a bit more, this is completely broken. What happens if the vcpu is in a nested context? You just populate random pages in an IPA space that is not relevant at all, corrupting the guest state.
You must correctly handle the context the vcpu is in, instead of assuming that this is the canonical context. This means going via the *guest's* S2 translation, just like handle_mem_abort() does.
M.