Hi Lorenzo, On Tue, 22 Sep 2026 15:18:04 +0100, "Lorenzo Stoakes (ARM)" <[email protected]> wrote: [...] > diff --git a/arch/arm64/kvm/mmu.c b/arch/arm64/kvm/mmu.c [...] > +static long __pre_fault_s2(struct kvm_s2_mmu *mmu, struct kvm_vcpu *vcpu, > + gpa_t gpa, struct kvm_memory_slot *memslot, s8 > level) [...] > + if (is_gmem) > + ret = gmem_abort(&s2fd, &result); > + else > + ret = user_mem_abort(&s2fd, &result);
When kvm_gmem_get_pfn() fails, gmem_abort() calls kvm_prepare_memory_fault_exit() before returning, which on this path writes vcpu->run's exit_reason and memory_fault fields outside KVM_RUN. If that happens on a vCPU between its KVM_EXIT_MMIO and its next KVM_RUN, kvm_arch_vcpu_ioctl_run() reads KVM_EXIT_MEMORY_FAULT instead, skips kvm_handle_mmio_return(), and the guest repeats the access. Could gmem_abort() skip that exit when result is set? user_mem_abort() never writes kvm_run. Cheers, /fuad
