The new __kvm_faultin_pfn() function is upset by the fact that e500 KVM ignores host page permissions - __kvm_faultin requires a "writable" outgoing argument, but e500 KVM is passing NULL. While a simple fix would be possible that simply allows writable to be NULL, it is quite ugly to have e500 KVM ignore completely the host permissions and map readonly host pages as guest-writable. A more complete fix is present in the second to fourth patches (the first is an independent bugfix, Cc'd to stable). The last one removes the VMA-based attempts at building huge shadow TLB entries, in favor of using a PTE lookup similar to what is done for x86. This special casing of VM_PFNMAP does not work well with remap_pfn_range() as it assumes that VM_PFNMAP areas are contiguous. Note that the same incorrect logic is there in ARM's get_vma_page_shift() and RISC-V's kvm_riscv_gstage_ioremap(). Fortunately, for e500 most of the code is already there; it just has to be changed to compute the range from find_linux_pte()'s output rather than find_vma(). The new code works for both VM_PFNMAP and hugetlb mappings, so the latter is removed. If this does not work out I'll go for something like https://lore.kernel.org/kvm/Z3wnsQQ67GBf1Vsb@xxxxxxxxxx/, but with the helper in arch/powerpc/kvm/e500_mmu_host.c. Patches 2-5 were tested by the reporter, Christian Zigotzky. Since the difference with v1 is minimal, I am going to send it to Linus today. Thanks, Paolo v1->v2: do not bother checking again that a memslot exists, instead add a fix to restore irqs even if !ptep Paolo Bonzini (5): KVM: e500: always restore irqs KVM: e500: use shadow TLB entry as witness for writability KVM: e500: track host-writability of pages KVM: e500: map readonly host pages for read KVM: e500: perform hugepage check after looking up the PFN arch/powerpc/kvm/e500.h | 2 + arch/powerpc/kvm/e500_mmu_host.c | 199 +++++++++++++------------------ 2 files changed, 85 insertions(+), 116 deletions(-) -- 2.47.1