From 739dfb8b4b768f553463125253c87ff2c86ac036 Mon Sep 17 00:00:00 2001 From: "Bingyu.Xian" Date: Wed, 29 Jul 2026 20:07:33 +0800 Subject: [PATCH] RISC-V: KVM: Widen G-stage fault address to gpa_t fault_addr in gstage_page_fault() and the fault_addr parameter of kvm_riscv_vcpu_mmio_load/store() are unsigned long. On RV32 with Sv32x4, guest physical addresses are 34 bits, so a 32-bit unsigned long truncates bits 32/33 at two points: - reconstruction: fault_addr = (trap->htval << 2) | ... is evaluated in 32-bit arithmetic, dropping bits 32/33 before widening; - the MMIO handler call: even with the local widened, the handler's unsigned long parameter narrows it back to 32 bits, aliasing accesses above 4 GB into the low 4 GB. Widen fault_addr to gpa_t end to end: the local in gstage_page_fault(), the (gpa_t) cast before the <<2 shift, and the fault_addr parameters of kvm_riscv_vcpu_mmio_load/store(). The handlers' internal uses (run->mmio.phys_addr is __u64, kvm_io_bus_read/write() take gpa_t) are already 64-bit, so no further changes are needed. Also in preparation for sharing a common struct kvm_page_fault across architectures, where fault_addr is gpa_t. No functional change on RV64. Fixes: 9d05c1fee837 ("RISC-V: KVM: Implement stage2 page table programming") Assisted-by: YuanSheng: deepseek-v4-pro Co-developed-by: Quan Zhou Signed-off-by: Quan Zhou Signed-off-by: Bingyu Xian Reviewed-by: Anup Patel Link: https://lore.kernel.org/r/20260729120733.829457-4-shanbeeyoo@gmail.com Signed-off-by: Anup Patel --- arch/riscv/include/asm/kvm_vcpu_insn.h | 4 ++-- arch/riscv/kvm/vcpu_exit.c | 5 +++-- arch/riscv/kvm/vcpu_insn.c | 4 ++-- 3 files changed, 7 insertions(+), 6 deletions(-) diff --git a/arch/riscv/include/asm/kvm_vcpu_insn.h b/arch/riscv/include/asm/kvm_vcpu_insn.h index 350011c83581..a5c50dd4a884 100644 --- a/arch/riscv/include/asm/kvm_vcpu_insn.h +++ b/arch/riscv/include/asm/kvm_vcpu_insn.h @@ -38,10 +38,10 @@ int kvm_riscv_vcpu_virtual_insn(struct kvm_vcpu *vcpu, struct kvm_run *run, struct kvm_cpu_trap *trap); int kvm_riscv_vcpu_mmio_load(struct kvm_vcpu *vcpu, struct kvm_run *run, - unsigned long fault_addr, + gpa_t fault_addr, unsigned long htinst); int kvm_riscv_vcpu_mmio_store(struct kvm_vcpu *vcpu, struct kvm_run *run, - unsigned long fault_addr, + gpa_t fault_addr, unsigned long htinst); int kvm_riscv_vcpu_mmio_return(struct kvm_vcpu *vcpu, struct kvm_run *run); diff --git a/arch/riscv/kvm/vcpu_exit.c b/arch/riscv/kvm/vcpu_exit.c index 73299770a98a..9985c3bd2557 100644 --- a/arch/riscv/kvm/vcpu_exit.c +++ b/arch/riscv/kvm/vcpu_exit.c @@ -17,12 +17,13 @@ static int gstage_page_fault(struct kvm_vcpu *vcpu, struct kvm_run *run, { struct kvm_gstage_mapping host_map; struct kvm_memory_slot *memslot; - unsigned long hva, fault_addr; + unsigned long hva; + gpa_t fault_addr; bool writable; gfn_t gfn; int ret; - fault_addr = (trap->htval << 2) | (trap->stval & 0x3); + fault_addr = ((gpa_t)trap->htval << 2) | (trap->stval & 0x3); gfn = fault_addr >> PAGE_SHIFT; memslot = gfn_to_memslot(vcpu->kvm, gfn); hva = gfn_to_hva_memslot_prot(memslot, gfn, &writable); diff --git a/arch/riscv/kvm/vcpu_insn.c b/arch/riscv/kvm/vcpu_insn.c index f09f9251d1f0..6506411a3f78 100644 --- a/arch/riscv/kvm/vcpu_insn.c +++ b/arch/riscv/kvm/vcpu_insn.c @@ -371,7 +371,7 @@ int kvm_riscv_vcpu_virtual_insn(struct kvm_vcpu *vcpu, struct kvm_run *run, * Returns < 0 to report failure and exit run-loop */ int kvm_riscv_vcpu_mmio_load(struct kvm_vcpu *vcpu, struct kvm_run *run, - unsigned long fault_addr, + gpa_t fault_addr, unsigned long htinst) { u8 data_buf[8]; @@ -494,7 +494,7 @@ int kvm_riscv_vcpu_mmio_load(struct kvm_vcpu *vcpu, struct kvm_run *run, * Returns < 0 to report failure and exit run-loop */ int kvm_riscv_vcpu_mmio_store(struct kvm_vcpu *vcpu, struct kvm_run *run, - unsigned long fault_addr, + gpa_t fault_addr, unsigned long htinst) { u8 data8;