On Wed, Sep 23, 2026 at 12:18:10PM +0100, Fuad Tabba wrote:
Hi Lorenzo,
On Tue, 22 Sep 2026 15:18:04 +0100, "Lorenzo Stoakes (ARM)"
[off-list ref] wrote:
[...]
quoted
diff --git a/arch/arm64/kvm/mmu.c b/arch/arm64/kvm/mmu.c
[...]
quoted
+static long __pre_fault_s2(struct kvm_s2_mmu *mmu, struct kvm_vcpu *vcpu,
+ gpa_t gpa, struct kvm_memory_slot *memslot, s8 level)
[...]
quoted
+ if (is_gmem)
+ ret = gmem_abort(&s2fd, &result);
+ else
+ ret = user_mem_abort(&s2fd, &result);
When kvm_gmem_get_pfn() fails, gmem_abort() calls
kvm_prepare_memory_fault_exit() before returning, which on this path
writes vcpu->run's exit_reason and memory_fault fields outside
KVM_RUN. If that happens on a vCPU between its KVM_EXIT_MMIO and its
next KVM_RUN, kvm_arch_vcpu_ioctl_run() reads KVM_EXIT_MEMORY_FAULT
instead, skips kvm_handle_mmio_return(), and the guest repeats the
access. Could gmem_abort() skip that exit when result is set?
user_mem_abort() never writes kvm_run.
Ack yeah we shouldn't be updating vcpu->run like that in that case, will
update to avoid doing that in v4.
Cheers,
/fuad
--
Cheers, Lorenzo