From nobody Tue Apr 7 04:47:54 2026 Received: from mxhk.zte.com.cn (mxhk.zte.com.cn [160.30.148.34]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 341921B808; Mon, 16 Mar 2026 06:16:46 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=160.30.148.34 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1773641808; cv=none; b=qDIizlUh3hSLj709DMdpPKMtktZLpwzy0D42R6bVc0bTx6HPXu2BX+vL5rL/wKAgw4cZkKlNMc1qtLn8gLTiNGHOKHE7Tl9G1pVYw7LWWPpGTI9eO8JxgyTId2vVjKOfpd6nrZ/ZlhgnCDW0PmVyIPG3VxZVNRw1CVCWEWxz9+I= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1773641808; c=relaxed/simple; bh=D4J4pZmKLtTqEEF5zdd83GuA1DANrtaNC5xEQo4d7Hw=; h=Message-ID:In-Reply-To:References:Date:Mime-Version:From:To:Cc: Subject:Content-Type; b=aLq1LqOzjUSnW+fFuqRJjTnTQzgAOVT6VY87dqbiYr7v8oKS/99pOtcKhO/FJf8awbrZVTEgSqKJdM+bLm8XEgZc9iSOEDb+AUQulxhBkMT2L7TXenATfp8qb1qn1DEucBYKAHtTDdiuj76Hy6aXnBEd55K+D0KDct69Y7V7+Zc= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=zte.com.cn; spf=pass smtp.mailfrom=zte.com.cn; arc=none smtp.client-ip=160.30.148.34 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=zte.com.cn Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=zte.com.cn Received: from mse-fl2.zte.com.cn (unknown [10.5.228.133]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange x25519 server-signature RSA-PSS (2048 bits) server-digest SHA256) (No client certificate requested) by mxhk.zte.com.cn (FangMail) with ESMTPS id 4fZ4c70Mqxz4xPGS; Mon, 16 Mar 2026 14:16:39 +0800 (CST) Received: from szxl2zmapp07.zte.com.cn ([10.1.32.52]) by mse-fl2.zte.com.cn with SMTP id 62G6GTiv085875; Mon, 16 Mar 2026 14:16:29 +0800 (+08) (envelope-from wang.yechao255@zte.com.cn) Received: from mapi (szxl2zmapp06[null]) by mapi (Zmail) with MAPI id mid12; Mon, 16 Mar 2026 14:16:31 +0800 (CST) X-Zmail-TransId: 2b0869b7a03f5ae-1b7a0 X-Mailer: Zmail v1.0 Message-ID: <20260316141631543e3oVI3JGADhz5veSRD_eC@zte.com.cn> In-Reply-To: <20260316141234007qSAOsesu2cSQsj-LA-qq3@zte.com.cn> References: 20260316141234007qSAOsesu2cSQsj-LA-qq3@zte.com.cn Date: Mon, 16 Mar 2026 14:16:31 +0800 (CST) Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: Mime-Version: 1.0 From: To: , , , , , Cc: , , , , , Subject: =?UTF-8?B?W1BBVENIIHYzIDEvM10gUklTQy1WOiBLVk06IEZpeCBsb3N0IHdyaXRlIHByb3RlY3Rpb24gb24gaHVnZSBwYWdlcyBkdXJpbmcgZGlydHkgbG9nZ2luZw==?= X-MAIL: mse-fl2.zte.com.cn 62G6GTiv085875 X-TLS: YES X-SPF-DOMAIN: zte.com.cn X-ENVELOPE-SENDER: wang.yechao255@zte.com.cn X-SPF: None X-SOURCE-IP: 10.5.228.133 unknown Mon, 16 Mar 2026 14:16:39 +0800 X-Fangmail-Anti-Spam-Filtered: true X-Fangmail-MID-QID: 69B7A047.000/4fZ4c70Mqxz4xPGS Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset="utf-8" From: Wang Yechao When enabling dirty log in small chunks (e.g., QEMU default chunk size of 256K), the chunk size is always smaller than the page size of huge pages (1G or 2M) used in the gstage page tables. This caused the write protection to be incorrectly skipped for huge PTEs because the condition `(end - addr) >=3D page_size` was not satisfied. Remove the size check in `kvm_riscv_gstage_wp_range()` to ensure huge PTEs are always write-protected regardless of the chunk size. Additionally, explicitly align the address down to the page size before invoking `kvm_riscv_gstage_op_pte()` to guarantee that the address passed to the operation function is page-aligned. This fixes the issue where dirty pages might not be tracked correctly when using huge pages. Fixes: 9d05c1fee837 ("RISC-V: KVM: Implement stage2 page table programming") Signed-off-by: Wang Yechao Reviewed-by: Nutty Liu Reviewed-by: Anup Patel --- arch/riscv/kvm/gstage.c | 7 +++---- 1 file changed, 3 insertions(+), 4 deletions(-) diff --git a/arch/riscv/kvm/gstage.c b/arch/riscv/kvm/gstage.c index b67d60d722c2..d2001d508046 100644 --- a/arch/riscv/kvm/gstage.c +++ b/arch/riscv/kvm/gstage.c @@ -304,10 +304,9 @@ void kvm_riscv_gstage_wp_range(struct kvm_gstage *gsta= ge, gpa_t start, gpa_t end if (!found_leaf) goto next; - if (!(addr & (page_size - 1)) && ((end - addr) >=3D page_size)) - kvm_riscv_gstage_op_pte(gstage, addr, ptep, - ptep_level, GSTAGE_OP_WP); - + addr =3D ALIGN_DOWN(addr, page_size); + kvm_riscv_gstage_op_pte(gstage, addr, ptep, + ptep_level, GSTAGE_OP_WP); next: addr +=3D page_size; } --=20 2.27.0 From nobody Tue Apr 7 04:47:54 2026 Received: from mxct.zte.com.cn (mxct.zte.com.cn [183.62.165.209]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 2AB8B34AAF7; Mon, 16 Mar 2026 06:19:00 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=183.62.165.209 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1773641943; cv=none; b=qtz4vcl9qI+2gdUdB4frMqMiwAI8JaNNBzDZGwr7GxWFqrnQPhAUUAcR/eEqLnodPKnem3Pwg1AN1oVJUq+vDCOjzChBQs2ENoA7en0d7outz/o+g5uzgwCByWBuzpM6x08ImP0TjLrqx9wHv8OJ4XqvUjkTXqxW9JLZhCwQel0= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1773641943; c=relaxed/simple; bh=Hg0iTlD3Wu/vXFJIzt1i4lhqty4UfkTbv3A666IMngE=; h=Message-ID:In-Reply-To:References:Date:Mime-Version:From:To:Cc: Subject:Content-Type; b=ZCrBZjIcrL5faEL6F+revpaIJgO7dVAs8RzA14VPqMYrUlcmd4BUi0qjj0T9DbpmXzdAoCUmVK5jlc3vWl8cPMGwD9FUg6QWZxw6AJgcjcRRZLxNPByOHp5Q9KbS6YGdHnJZbjSIGZ4ntM4DMwchVi/uhBOkkHGScMgaBLAWTho= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=zte.com.cn; spf=pass smtp.mailfrom=zte.com.cn; arc=none smtp.client-ip=183.62.165.209 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=zte.com.cn Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=zte.com.cn Received: from mse-fl2.zte.com.cn (unknown [10.5.228.133]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange x25519 server-signature RSA-PSS (2048 bits) server-digest SHA256) (No client certificate requested) by mxct.zte.com.cn (FangMail) with ESMTPS id 4fZ4fW6K72z4xQX9; Mon, 16 Mar 2026 14:18:43 +0800 (CST) Received: from szxl2zmapp07.zte.com.cn ([10.1.32.52]) by mse-fl2.zte.com.cn with SMTP id 62G6IZu4088164; Mon, 16 Mar 2026 14:18:35 +0800 (+08) (envelope-from wang.yechao255@zte.com.cn) Received: from mapi (szxlzmapp01[null]) by mapi (Zmail) with MAPI id mid12; Mon, 16 Mar 2026 14:18:36 +0800 (CST) X-Zmail-TransId: 2b0369b7a0bcfa0-2c182 X-Mailer: Zmail v1.0 Message-ID: <20260316141836922ffC0zmiE01ptC2jpXl4zJ@zte.com.cn> In-Reply-To: <20260316141234007qSAOsesu2cSQsj-LA-qq3@zte.com.cn> References: 20260316141234007qSAOsesu2cSQsj-LA-qq3@zte.com.cn Date: Mon, 16 Mar 2026 14:18:36 +0800 (CST) Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: Mime-Version: 1.0 From: To: , , , , , Cc: , , , , Subject: =?UTF-8?B?W1BBVENIIHYzIDIvM10gUklTQy1WOiBLVk06IEFsbG93IHNwbGl0dGluZyBodWdlIHBhZ2VzIHRvIGFyYml0cmFyeSBsZXZlbA==?= X-MAIL: mse-fl2.zte.com.cn 62G6IZu4088164 X-TLS: YES X-SPF-DOMAIN: zte.com.cn X-ENVELOPE-SENDER: wang.yechao255@zte.com.cn X-SPF: None X-SOURCE-IP: 10.5.228.133 unknown Mon, 16 Mar 2026 14:18:43 +0800 X-Fangmail-Anti-Spam-Filtered: true X-Fangmail-MID-QID: 69B7A0C3.000/4fZ4fW6K72z4xQX9 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset="utf-8" From: Wang Yechao This patch introduces the function kvm_riscv_gstage_split_huge(). It splits the huge page covering a given guest physical address down to a specified target level (e.g., from 1G to 2M or 4K). The caller provides a memory cache for allocating any intermediate page tables and may request a TLB flush after the split. This functionality will be used by subsequent patches to split huge pages before handling the write-protection fault, or for other operations that require page-level granularity. Signed-off-by: Wang Yechao --- arch/riscv/include/asm/kvm_gstage.h | 4 ++ arch/riscv/kvm/gstage.c | 69 +++++++++++++++++++++++++++++ 2 files changed, 73 insertions(+) diff --git a/arch/riscv/include/asm/kvm_gstage.h b/arch/riscv/include/asm/k= vm_gstage.h index 595e2183173e..373748c6745e 100644 --- a/arch/riscv/include/asm/kvm_gstage.h +++ b/arch/riscv/include/asm/kvm_gstage.h @@ -53,6 +53,10 @@ int kvm_riscv_gstage_map_page(struct kvm_gstage *gstage, bool page_rdonly, bool page_exec, struct kvm_gstage_mapping *out_map); +int kvm_riscv_gstage_split_huge(struct kvm_gstage *gstage, + struct kvm_mmu_memory_cache *pcache, + gpa_t addr, u32 target_level, bool flush); + enum kvm_riscv_gstage_op { GSTAGE_OP_NOP =3D 0, /* Nothing */ GSTAGE_OP_CLEAR, /* Clear/Unmap */ diff --git a/arch/riscv/kvm/gstage.c b/arch/riscv/kvm/gstage.c index d2001d508046..5356abb18932 100644 --- a/arch/riscv/kvm/gstage.c +++ b/arch/riscv/kvm/gstage.c @@ -209,6 +209,75 @@ int kvm_riscv_gstage_map_page(struct kvm_gstage *gstag= e, return kvm_riscv_gstage_set_pte(gstage, pcache, out_map); } +static inline unsigned long make_child_pte(unsigned long huge_pte, int ind= ex, + unsigned long child_page_size) +{ + unsigned long child_pte =3D huge_pte; + unsigned long child_pfn_offset; + + /* + * The child_pte already has the base address of the huge page being + * split. So we just have to OR in the offset to the page at the next + * lower level for the given index. + */ + child_pfn_offset =3D index * (child_page_size / PAGE_SIZE); + child_pte |=3D pte_val(pfn_pte(child_pfn_offset, __pgprot(0))); + + return child_pte; +} + +int kvm_riscv_gstage_split_huge(struct kvm_gstage *gstage, + struct kvm_mmu_memory_cache *pcache, + gpa_t addr, u32 target_level, bool flush) +{ + u32 current_level =3D kvm_riscv_gstage_pgd_levels - 1; + pte_t *next_ptep =3D (pte_t *)gstage->pgd; + pte_t *ptep; + unsigned long huge_pte, child_pte; + unsigned long child_page_size; + int i, ret; + + while(current_level > target_level) { + ptep =3D (pte_t *)&next_ptep[gstage_pte_index(addr, current_level)]; + + if (!pte_val(ptep_get(ptep))) + break; + + if (!gstage_pte_leaf(ptep)) { + next_ptep =3D (pte_t *)gstage_pte_page_vaddr(ptep_get(ptep)); + current_level--; + continue; + } + + huge_pte =3D pte_val(ptep_get(ptep)); + + ret =3D gstage_level_to_page_size(current_level - 1, &child_page_size); + if (ret) + return ret; + + if (!pcache) + return -ENOMEM; + next_ptep =3D kvm_mmu_memory_cache_alloc(pcache); + if (!next_ptep) + return -ENOMEM; + + for (i =3D 0; i < PTRS_PER_PTE; i++) { + child_pte =3D make_child_pte(huge_pte, i, child_page_size); + set_pte((pte_t *)&next_ptep[i], __pte(child_pte)); + } + + set_pte(ptep, pfn_pte(PFN_DOWN(__pa(next_ptep)), + __pgprot(_PAGE_TABLE))); + + if (flush) + gstage_tlb_flush(gstage, current_level, addr); + + current_level--; + } + + return 0; +} + void kvm_riscv_gstage_op_pte(struct kvm_gstage *gstage, gpa_t addr, pte_t *ptep, u32 ptep_level, enum kvm_riscv_gstage_op op) { --=20 2.27.0 From nobody Tue Apr 7 04:47:54 2026 Received: from mxct.zte.com.cn (mxct.zte.com.cn [183.62.165.209]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 76DD8347539; Mon, 16 Mar 2026 06:20:39 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=183.62.165.209 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1773642041; cv=none; b=gDqEZiVQFKOL6dlW4QH/IQdHUwNxYW1U95LoSVM3Mi4+PxurFTVqpeLb5HgMEaMQI8x5u1Z1KKdHPBjFZziQaSggwa1FJIuR8Qo3ZOWEPBT6t32mOzfM02kSHOgTpXQTkFPKbPEhL9AtsdEpm2Hq86wAGMdHIouYcLcBAzXfS5Q= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1773642041; c=relaxed/simple; bh=pIiG3gYC+85imL5s+0StsEq2xk/YgHx5+4NdYmXiKts=; h=Message-ID:In-Reply-To:References:Date:Mime-Version:From:To:Cc: Subject:Content-Type; b=qFoQJTobjNRDEfq/RfwsWuZiRZMmoEe3FtDvCXufqb3G3D76wUgikxCjjSob4PsZ2d3oJg2x4hdXdjzOKJpgBwJOyRL9pPKpd+eZt8pF35vYNcBwwgzyZnhYWhyAYceLuY2+7qLxNopsZBpESKCLkPmc3rMWjmphoc3pKPfFVLM= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=zte.com.cn; spf=pass smtp.mailfrom=zte.com.cn; arc=none smtp.client-ip=183.62.165.209 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=zte.com.cn Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=zte.com.cn Received: from mse-fl1.zte.com.cn (unknown [10.5.228.132]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange x25519 server-signature RSA-PSS (2048 bits) server-digest SHA256) (No client certificate requested) by mxct.zte.com.cn (FangMail) with ESMTPS id 4fZ4hc4nwkz51Sdl; Mon, 16 Mar 2026 14:20:32 +0800 (CST) Received: from szxl2zmapp05.zte.com.cn ([10.1.32.37]) by mse-fl1.zte.com.cn with SMTP id 62G6KF36004235; Mon, 16 Mar 2026 14:20:15 +0800 (+08) (envelope-from wang.yechao255@zte.com.cn) Received: from mapi (szxlzmapp04[null]) by mapi (Zmail) with MAPI id mid12; Mon, 16 Mar 2026 14:20:17 +0800 (CST) X-Zmail-TransId: 2b0669b7a121451-2263c X-Mailer: Zmail v1.0 Message-ID: <20260316142017362R7MOT-xQWGMPiGnD0zuht@zte.com.cn> In-Reply-To: <20260316141234007qSAOsesu2cSQsj-LA-qq3@zte.com.cn> References: 20260316141234007qSAOsesu2cSQsj-LA-qq3@zte.com.cn Date: Mon, 16 Mar 2026 14:20:17 +0800 (CST) Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: Mime-Version: 1.0 From: To: , , , , , Cc: , , , , Subject: =?UTF-8?B?W1BBVENIIHYzIDMvM10gUklTQy1WOiBLVk06IFNwbGl0IGh1Z2UgcGFnZXMgZHVyaW5nIGZhdWx0IGhhbmRsaW5nIGZvciBkaXJ0eSBsb2dnaW5n?= X-MAIL: mse-fl1.zte.com.cn 62G6KF36004235 X-TLS: YES X-SPF-DOMAIN: zte.com.cn X-ENVELOPE-SENDER: wang.yechao255@zte.com.cn X-SPF: None X-SOURCE-IP: 10.5.228.132 unknown Mon, 16 Mar 2026 14:20:32 +0800 X-Fangmail-Anti-Spam-Filtered: true X-Fangmail-MID-QID: 69B7A130.002/4fZ4hc4nwkz51Sdl Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset="utf-8" From: Wang Yechao During dirty logging, all huge pages are write-protected. When the guest writes to a write-protected huge page, a page fault is triggered. Before recovering the write permission, the huge page must be split into smaller pages (e.g., 4K). After splitting, the normal mapping process proceeds, allowing write permission to be restored at the smaller page granularity. If dirty logging is disabled because migration failed or was cancelled, only recover the write permission at the 4K level, and skip recovering the huge page mapping at this time to avoid the overhead of freeing page tables. The huge page mapping can be recovered in the ioctl context, similar to x86, in a later patch. Signed-off-by: Wang Yechao --- arch/riscv/kvm/gstage.c | 56 +++++++++++++++++++++++++++++++++++++++++ 1 file changed, 56 insertions(+) diff --git a/arch/riscv/kvm/gstage.c b/arch/riscv/kvm/gstage.c index 5356abb18932..4bee042f3c7f 100644 --- a/arch/riscv/kvm/gstage.c +++ b/arch/riscv/kvm/gstage.c @@ -163,6 +163,21 @@ int kvm_riscv_gstage_set_pte(struct kvm_gstage *gstage, return 0; } +static int kvm_riscv_gstage_update_pte_prot(pte_t *ptep, pgprot_t prot) +{ + pte_t new_pte; + + if (pgprot_val(pte_pgprot(ptep_get(ptep))) =3D=3D pgprot_val(prot)) + return 0; + + new_pte =3D pfn_pte(pte_pfn(ptep_get(ptep)), prot); + new_pte =3D pte_mkdirty(new_pte); + + set_pte(ptep, new_pte); + + return 1; +} + int kvm_riscv_gstage_map_page(struct kvm_gstage *gstage, struct kvm_mmu_memory_cache *pcache, gpa_t gpa, phys_addr_t hpa, unsigned long page_size, @@ -171,6 +186,9 @@ int kvm_riscv_gstage_map_page(struct kvm_gstage *gstage, { pgprot_t prot; int ret; + pte_t *ptep; + u32 ptep_level; + bool found_leaf; out_map->addr =3D gpa; out_map->level =3D 0; @@ -203,6 +221,44 @@ int kvm_riscv_gstage_map_page(struct kvm_gstage *gstag= e, else prot =3D PAGE_WRITE; } + + found_leaf =3D kvm_riscv_gstage_get_leaf(gstage, gpa, &ptep, &ptep_level); + if (found_leaf) { + /* + * ptep_level is the current gstage mapping level of addr, out_map->level + * is the required mapping level during fault handling. + * + * 1) ptep_level > out_map->level + * This happens when dirty logging is enabled and huge pages are used. + * KVM must track the pages at 4K level, and split the huge mapping + * into 4K mappings. + * + * 2) ptep_level < out_map->level + * This happens when dirty logging is disabled and huge pages are used. + * The gstage is split into 4K mappings, but the out_map level is now + * back to the huge page level. Ignore the out_map level this time, and + * just update the pte prot here. Otherwise, we would fall back to mappi= ng + * the gstage at huge page level in `kvm_riscv_gstage_set_pte`, with the + * overhead of freeing the page tables(not support now), which would slow + * down the vCPUs' performance. + * + * It is better to recover the huge page mapping in the ioctl context wh= en + * disabling dirty logging. + * + * 3) ptep_level =3D=3D out_map->level + * We already have the ptep, just update the pte prot if the pfn not cha= nge. + * There is no need to invoke `kvm_riscv_gstage_set_pte` again. + */ + if (ptep_level > out_map->level) { + kvm_riscv_gstage_split_huge(gstage, pcache, gpa, + out_map->level, true); + } else if (ALIGN_DOWN(PFN_PHYS(pte_pfn(ptep_get(ptep))), page_size) =3D= =3D hpa) { + if (kvm_riscv_gstage_update_pte_prot(ptep, prot)) + gstage_tlb_flush(gstage, ptep_level, out_map->addr); + return 0; + } + } + out_map->pte =3D pfn_pte(PFN_DOWN(hpa), prot); out_map->pte =3D pte_mkdirty(out_map->pte); --=20 2.27.0